Attachment A SIS Statement of Objectives r3.pdf

U N C L A S S I F I E D | S T U D E N T I N F O R M A T I O N S Y S T E M R E P L A C E M E N T

U N C L A S S I F I E D

M

United States Department of State Foreign Service Institute George P. Shultz National Foreign Affairs Training Center 4000 Arlington Boulevard Arlington, Virginia 22204

FOREIGN SERVICE INSTITUTE

Statement of Objectives Student Information System Replacement

Document last updated:

January 14, 2020

Prepared for:

U.S. Department of State Office of Acquisitions

Table of Contents

1. Introduction

2. Purpose

3. Scope

4. Period and Location of Performance

5. Background

5.1. Current STMS Environment

5.2. Existing/Legacy Environment Components

6. New SIS and Target Environment

6.1. Combined New SIS/LMSys User Community

7. Objectives

7.1. Task Area 1: SIS Environmental Analysis

7.2. Task Area 2: SIS Deployment Planning

7.3. Task Area 3: SIS Pilot Deployment, Integration and Data Migration

7.4. Task Area 4: SIS Operations and Legacy Closeout Support

7.5. Task Area 5: Maintenance and Support Program

8. Deliverables

8.1. Preparation

8.2. Task Area 1: SIS Environmental Analysis

8.3. Task Area 2: SIS Deployment Planning

8.4. Task Area 3: SIS Pilot Deployment, Integration and Data Migration

8.5. Task Area 4: SIS Operations and Legacy Closeout Support

9. Constraints

9.1. Access Control

9.2. Authentication

9.3. Personnel Security Clearances

9.4. Non-Disclosure Agreements

10. Appendix A – SIS Requirements

10.1. Questions

11. Requirements Prioritization Categories

11.1. General Requirements

11.2. Accessibility (Mobility)

11.3. Admissions

11.4. Enrollment

11.5. Personnel Management

11.6. Curriculum Management

11.7. IT Service Management

11.8. Student Services

11.9. Student Portal (MySISWeb)

11.10. Finance Management

11.11. Facilities Management

11.12. Communication

11.13. Content Management

11.14. Delivery

11.15. Systems Integration

11.16. Evaluation (data collection and analysis)

11.17. Outreach/Notification

11.18. Reporting

12. Appendix B – Glossary

U N C L A S S I F I E D | S T U D E N T I N F O R M A T I O N S Y S T E M R E P L A C E M E N T 1

1. Introduction

The Foreign Service Institute (FSI) is the training bureau of the U.S. Department of State (DOS) and a principal training institution for the U.S. Government foreign affairs community. The Foreign Service Institute is the U.S. Government’s premier foreign affairs training provider, serving the U.S. Department of State and the entire USG foreign affairs community as a strategic enabler of diplomatic excellence.

We are dedicated to ensuring the career-long learning opportunities required for success in today’s global arena. The Institute is located at the George P. Shultz National Foreign Affairs Training Center (NFATC) in Arlington, Virginia, with additional training centers domestically, overseas, and in the Washington metropolitan area.

FSI processes over 170,000 student enrollments annually from the DOS, more than 40 other government agencies, and all military service branches. Offering more than 700 classroom courses, 70 foreign languages, about 270 custom-developed distance learning products, FSI also provides access to about 2,700 commercial distance learning courses – all which are available worldwide 24x7 via the Internet.

FSI’s courses range in length from one day to two years and are designed to promote successful performance in each student’s professional assignment, to facilitate Foreign Service personnel adjustment to other countries and cultures, and to enhance the leadership and management capabilities of the U.S. Foreign Affairs and Civil Service communities.

Other courses and services are tailored towards helping students and their families adapt to the lifestyle changes that are inevitable with regularly rotating overseas assignments and consequently, their mobile lifestyles. Subjects include cultural studies as well as critical and timely topics including emergency preparedness and cyber security that the employees and families must actively practice while on assignment.

2. Purpose

The government is considering its options with respect to updating or replacing the existing Student Information System (SIS), referred to as the “Student Training Management System (STMS),” at FSI. The Institute is considering a new Student Information System (SIS) using a cloud-based commercial off-the-shelf (COTS) software application. Any new SIS (cloud-based COTS package) will need to offer a single, modern, centralized, customer-focused, cloud-based training management solution that will assist the Institute in the management of training engagements and logistics data in a more efficient and effective manner than the current system, STMS.

This Request for Information (RFI) is being issued solely to determine potential sources for information and planning purposes – it does not constitute a Request for Proposal (RFP) or a promise to issue an RFP in the future. This RFI should not be construed as a commitment by the Government for any purpose other than to gain the information requested for market research. The purpose of this notice is to conduct market research, a continuous process for collecting and analyzing information about capabilities within the market to satisfy agency needs.

U N C L A S S I F I E D | S T U D E N T I N F O R M A T I O N S Y S T E M R E P L A C E M E N T 2

3. Scope

Should FSI decide to proceed with replacement, FSI would seek a contractor to provide all computing and support services required to plan, deploy, and integrate an enterprise-wide SIS into a target environment that is compliant with DOS policies that include cloud solutions approved by the E-Gov Program Management Office. Upon deployment of the SIS, the contractor would then need to provide ongoing services required to operate, maintain, and safeguard the SIS, train FSI staff on the use of the SIS, and support decommissioning the Institute’s existing, locally hosted STMS and associated in-house support services.

4. Period and Location of Performance

Should the government decide to pursue a solicitation for any work related to this scope, the period of performance will be provided as part of that solicitation. The timeline of any such work will likely be based on a phased delivery approach, and will most likely span two or more years for the full scope.

As part of any such implementation, the government will require that key work activity of the effort be performed onsite within the primary location(s) listed below. If alternative locations are either required or allowable, that will be specified as part of the solicitation. The post-deployment performance location for ongoing SIS maintenance and development will be determined during the planning phase of this effort.

FSI and other State Department DC metro locations:

Primary location:

U.S. Department of State, Building Annex SA-42 George P. Shultz National Foreign Affairs Training Center (NFATC) 4000 Arlington Boulevard Arlington, VA 22204

Alternate location:

U.S. Department of State, Building Annex SA-15 Pomponio Plaza East 1800 N. Kent Street Arlington, VA 22209

Alternate location:

U.S. Department of State, FSI Annex 1200 Wilson Boulevard Rosslyn, VA 22209

For contractor staff working onsite, FSI will provide appropriate workspace, equipment, materials, and information necessary for contractor staff to perform tasks associated with this effort. Transportation between contractor facilities and FSI will not be charged to the government.

U N C L A S S I F I E D | S T U D E N T I N F O R M A T I O N S Y S T E M R E P L A C E M E N T 3

For performance being conducted offsite, the contractor shall be responsible for having the appropriate workspace, equipment, and material necessary to provide all deliverables requested by the government.

The government will provide needed equipment for remote network access if required to perform offsite work. Travel in and/or around the local Washington, D.C., metro area for the purpose of working at the contractor’s place of performance will not be charged to the government.

At the request of the government, occasional attendance at meetings or other events offsite in the local Washington, D.C. metro area may be required. The government will notify contractor personnel of meeting requests in advance of attendance.

5. Background

The Training Management Systems (TMS) division at FSI manages the current Student Training Management System (STMS). The TMS division works with the FSI Registrar to manage training administration and student records. The TMS division also receives important infrastructure support from FSI’s Office of Management and Information Systems (OMIS) and coordinates work with the Education Delivery Systems (EDS) division, which develops and maintains the Learning Management System (LMSys).

STMS has improved over the years to meet the needs of FSI schools through ongoing custom development. While this custom development approach has enabled the Institute to meet its most fundamental training needs, FSI’s custom development approach has been unable to maintain pace with FSI’s modern business needs. FSI’s STMS is now over two decades old and is inadequate when compared to the functionality and higher efficiency available through other offerings currently in the marketplace.

With today’s advances in mobile technology, students need access to online self-services and training requests regardless of their global location and time zone. Other benefits expected of a modern cloud-based COTS-based SIS at FSI are an increase in business processing efficiency, stemming from manual processes currently found inhuman resources, facility, curriculum, and enrollment management applications. FSI also expects advancements in data confidentiality, integrity, and availability through the enhanced security capabilities offered by a modern system. In addition, the Institute expects to gain benefits in communications efficiency allowing the Institute to disseminate more information out to its worldwide clientele quickly and in real-time as expected by its stakeholder community.

Additionally, the SIS must be able to track formal and informal learning in classroom, mobile, and blended learning settings and interface with one or more Learning Management Systems (LMSys) used by FSI.

Empowering students, instructors, and staff through the procurement of a new, more capable and contemporary SIS with deployment into its target environment will allow the Institute to bring more efficiency to its business processes and provide scalable, best-of-breed services to its stakeholders.

5.1. Current STMS Environment

U N C L A S S I F I E D | S T U D E N T I N F O R M A T I O N S Y S T E M R E P L A C E M E N T 4

STMS is a heavily customized version of a modified off-the-shelf (MOTS) software application that was initially purchased, deployed, and hosted using on premises resources originally provided by FSI in 1998.

STMS is currently operational and has undergone significant development and customization over its lifespan for security compliance, modernization, and extensibility purposes.

The original COTS product purchased for STMS was built for commercial learning and training. It has been continuously customized to meet the needs of the Institute and its globally deployed workforce.

STMS primarily manages personnel data for students, instructors, and application administrators. STMS has evolved to receive worldwide 24x7 online training requests and provide transcript services to Federal Government employees, eligible family members, and members of household.

STMS is the Department’s System of Record (SOR) for student training and is managed by the Foreign Service Institute. STMS also provides the Institute’s database of record for tracking student registrations, course completions, testing assessment results, and other educational service transactions. Since every user in STMS has a unique personal identifier, the data is used as a key reference source for a host of integrated internal FSI logistics and business management applications related to room reservations, skills incentive programs, HR employment records, cybersecurity certification, parking, surveys, distance learning management systems, transcripts, and reporting.

FSI’s Office of the Registrar is the primary functional stakeholder of the system whose business needs drive a significant portion of STMS’ requirements. The Registrar is responsible for course enrollments and completions (classroom, distance), course scheduling, external training, student information and administrative services, administration of the FSI Learning Management System (LMSys), reporting to stakeholders, and retention of the Department’s official training records. Five distinctly different schools at FSI and several global training centers use STMS to communicate with the Registrar on course offerings and student completions. The FSI Budget Office also uses STMS when working with the Registrar for invoicing purposes, and with FSI schools to shape tuition amounts.

A variety of stakeholders external to FSI consume data from STMS and use the STMS system to enroll their constituent student populations. Examples of STMS stakeholders external to FSI include the State Department’s Bureau of Human Resources (HR), Career Development and Assignments Office (CDA), HR Executive Office, Bureau of Intelligence and Research (INR), and Diplomatic Security (DS). As an information system, STMS is assessed as having a Federal Information Security Management Act (FISMA) categorization level of “Moderate Impact.”

The core STMS database is a critical data source for the Central Human Resource Personnel Management System at the Department of State’s Human Resource Bureau. The primary HR application is known as the Global Employee Management System (GEMS). FSI synchronizes with GEMS by providing and receiving a daily data feed using a simplex bidirectional interface. This daily synchronization is critical in keeping both systems up to date and that allows Human Resources and FSI to make proper student admission, enrollment, and course credit decisions.

The STMS database also interfaces with the department’s Comptroller and Global Financial Services (CGFS) through the Global Financial Management System (GFMS). STMS data is used for producing invoices by GFMS.

U N C L A S S I F I E D | S T U D E N T I N F O R M A T I O N S Y S T E M R E P L A C E M E N T 5

5.2. Existing/Legacy Environment Components

FSI’s standard desktop environment consists of the following items:

Microsoft Windows 10 Internet Explorer 11 Google Chrome Microsoft Office 2016 Professional Plus Microsoft Office 365 Skype 2016 Microsoft Edge Microsoft Silverlight 5.1 Adobe Reader v11 Adobe Shockwave Player 12.2 Adobe Flash Player ActiveX 23 Java 8 64-bit

Other Development Tools to be encountered Microsoft .NET Framework 4.5.5 Microsoft SQL Server 2012 Management Studio Team Foundation Server 2015

6. New SIS and Target Environment

The new Student Information System (SIS) and the target environment sought by the Institute should enable it to meet all objectives expressed in Section 6 and fulfill all “mandatory” requirements expressed in Appendix A of this document.

FSI needs an integrated, modern, customer-centric SIS that will support the training operations required to educate and prepare a globally deployed student audience performing the Department’s mission critical activities.

FSI needs a modern SIS that provides the core registration and completion functions, student information and administrative services, curriculum description, finance management, and records retention of a training organization with the flexibility to adapt to changes in U.S. Federal policy and data governance while maintaining alignment with DOS strategic goals, human capital requirements, and foreign policy priorities.

FSI needs a Student Information System with features that can be easily integrated with a variety of State and Non-State stakeholder systems, federal and international human resources data attributes, learning/course delivery systems and data, and facility management applications.

U N C L A S S I F I E D | S T U D E N T I N F O R M A T I O N S Y S T E M R E P L A C E M E N T 6

FSI needs a secure SIS with a technology platform compatible with DOS technology governance, application environments, and provides modern data storage, processing, and software development features that allow for extensibility and enhanced security features. The SIS will need to have security controls consistent with the FISMA “Moderate Impact” system categorization level.

The needed capabilities are grouped into functional and technology domains. They include personnel, curriculum, admissions, enrollment, finance, facilities, records, and reporting. The needed technical management capabilities include infrastructure, security, and compliance. A completed system will integrate across any domains with current and future systems and allow for 24x7 integrated workflow, management, and reporting processes for external systems of record, attendance and yield, transcripts, notifications to personnel, audit history, while enabling system administrators to efficiently and effectively provide maintenance.

SIS and LMSys integration is expected to have a single student record for all interactions with either system, with no relevant data stored elsewhere, and with real-time data exchange between systems. The result is a complete understanding of each student and activity, uniting instructional and administrative information into a complete student profile.

In addition to the Identity authentication and access controls discussed in Section 9.1, access for an individual user to both the Student Information System and the Learning Management System (LMSys) must be controlled with the same credentials. The goal is to remove the need for multiple usernames and passwords for a single user to have access to the two systems.

In addition, the SIS and the target environment will provide FSI leadership and policy administrators’ visibility into business operations and allow changes to be made over time in a flexible a manner. The SIS solution must continue to provide upgrades and releases to the purchased COTS system that keep pace with changing technology over the life of the system.

The SIS will conform to common industry Student Information System standards and will support mobile devices used by FSI’s User community. Examples of common mobile devices that the SIS will support include:

Google Android Apple iPad Apple iPhone Samsung Blackberry Microsoft Mobile

6.1. Combined New SIS/LMSys User Community

The following table summarizes the set of SIS-related roles that have been identified by the FSI Registrar, schools and SIS support stakeholders within the set of SIS requirements expressed in “Appendix A: SIS Requirements List”.

U N C L A S S I F I E D | S T U D E N T I N F O R M A T I O N S Y S T E M R E P L A C E M E N T 7

User Type User Coordinator Administrative Assistant

Course Coordinator Librarian Program Assistant Bureau Training Coordinator

Designer / Developer Content Specialist Course Developer Developer

Instructional Designer Mobile Developer

End User Guest JSP Participant/Retiree Military Employee Military EFM Non-State USG Employee Non-State EFM State Dept. Employee State Dept. EFM

Student Student–Non-State EFM Student–Non-State Employee Student–State Dept. EFM Student–State Department Employee User

Governance / Oversight Director (Dean) Deputy Director (Associate Dean) Deputy Director Division Director–Career Transition Center Division Director–Overseas Briefing Center Division Director–Training Registrar

Evaluator Portfolio Manager Program Manager Project Manager Supervisor System Manager Bureau Training Coordinator

Instructor Instructional Trainer Instructor MML Instructor (Customer)

Non-FSI Instructor Training Instructor

Support – Functional Coach Subject Matter Expert Support – Technical Administrator

Blended Course Administrator System Administrator Training Technician

IT Staff Software Developer Database Architect Database Developer Database Administrator

Quality Assurance Webmasters

Registrar Staff Registrar Supervisory Program Analysts Supervisor Team Lead Program Analyst

Program Assistant Business Analyst Student Services Specialist Financial Management Analyst

Budget Staff Budget Analyst Budget Approver

Approvers Supervisor Training officer Bureau Executive Office Contract Officer/Representative Third level/School approver

7. Objectives

The contractor shall provide a new SIS that meets the requirements defined in Appendix A. The contractor shall support the deployment of the Institute’s new SIS and associated operational support workloads working with FSI IT staff to its selected target environment and to provide ongoing SIS

U N C L A S S I F I E D | S T U D E N T I N F O R M A T I O N S Y S T E M R E P L A C E M E N T 8 development and maintenance support for the SIS facilitated by comprehensive SIS planning and management services.

The following lists the major capabilities of the integrated student information system that FSI wishes to purchase.

Replace current in-house developed system.

Provide a cloud-based solution that is Federal Risk and Authorization Management Program

(FEDRAMP) approved at a Moderate impact level and can securely manage “Sensitive But Unclassified” (SBU) information that connects to DOS OpenNet+ Network.

Provide complete integration between student, faculty, staff training management and administrative processes, and systems.

Eliminate duplicative standalone business processing systems, independent tracking mechanisms and paper-intensive manual processes.

Increase information analysis capabilities that support strategic decision-making.

Eliminate duplicate efforts, especially concerning redundant data entry processes.

Allow FSI to easily develop and deliver reports and information that meet its requirements.

Provide modern processing capabilities such as tiered level permissions/user roles, workflow approvals, alerts and audits, and eRecords.

Provide a consistent user interface, online documentation and context sensitive help.

Establish a foundation for integrating new systems in the future.

7.1. Task Area 1: SIS Environmental Analysis

The contractor shall provide the following:

7.1.1. Conduct detailed analysis of Technical Architecture Review baseline and “as-is” documentation to support overall implementation and deployment planning.

7.1.2. Provide all planning support necessary to fully develop and deliver services.

7.2. Task Area 2: SIS Deployment Planning

The contractor Shall provide the following:

7.2.1. Provide all planning support necessary to fully develop and deliver services.

Produce a roadmap for the Institute to effectively plan for SIS deployment that maximizes cost reduction and savings and identifies constraints and inhibitors to SIS deployment. Considerations for this roadmap include:

Describe approach to developing a business case for deployment to include comparison of current expenditures to proposed expenditures (ranging from facility, hardware, middleware & database, infrastructure etc.), demonstrating ROI of proposed solution.

Provide an SIS deployment plan describing recommendations for deployment that encompasses the appropriate service models (SaaS, PaaS, or IaaS or internal), and deployment model (private, U N C L A S S I F I E D | S T U D E N T I N F O R M A T I O N S Y S T E M R E P L A C E M E N T 9 public, community, etc.) of all services to be deployed, as well as rationale for the recommended models.

Provide detailed methodology for implementing software. Methodology shall include estimated timeframe, overview of phases and milestones, assumptions, and assumed responsibilities

Provide recommendations for SIS phased deployment based on the application’s development lifecycle, business relevance, security impacts, organizational roles, financial aspects of service delivery, and other deployment considerations.

Address sourcing model that the Institute will be authorized to control where the SIS and related applications will be hosted based on security, performance, disaster recovery, and service level requirements.

Provide recommendations for incorporating government-wide and agency-specific security controls into the target design and deployment plan.

Describe approach to identify and manage communication, change management, and training needs that accommodates both deployment and pre-deployment planning.

Produce a plan that will have the IT management environment encompassing the management of the target environment (i.e. - conventional hosting, private and/or public clouds).

Describe approach to ensure that procedures and documentation are developed for deployment execution. Provide planning and deployment overview to FSI Executive Management.

Explain how each of the following types of testing has been addressed in your implementation plan: (a) module testing; (b) integration testing; (c) parallel testing and (d) stress/load testing.

Describe approach to target environment governance for post-implementation.

7.2.2. Provide SIS deployment planning services that accommodate considerations from an enterprise perspective including impact on the Institute’s business units, contracts, management, stakeholders, resources engagement and technical components (application, infrastructure, and security).

7.2.3. Provide SIS deployment planning services that account for the Student Information System’s lifecycle, ranging from integration, testing, and production. Provide services that include considerations for maintaining services post-deployment.

Deliver a target environment technical architecture capturing the “to-be” SIS deployment state that is consistent with adopted federal enterprise architecture frameworks and consistent with Institute-specific architecture standards.

Include considerations in the deployment planning solution for the target design such as capacity, schedules, deployment priority, cost, etc.

Describe approach to providing technical advice to SIS deployment that will enable the Institute to implement metering to deployed services including provisioning capabilities, accounting capabilities, billing capabilities, etc.

Describe approach to testing for deployment planning.

7.2.4. Produce a plan that Shall support co-existing non-cloud and cloud architectures during and after deployment.

U N C L A S S I F I E D | S T U D E N T I N F O R M A T I O N S Y S T E M R E P L A C E M E N T 10

7.2.5. Describe the proposed solution’s security strategy and encryption methods. Also indicate how security is ensured in both the on-Premise, cloud and mobile environments, and where data is encrypted (at rest, in transit).

7.2.6. Provide comprehensive analysis of the Institute’s current SIS and infrastructure that incorporates considerations for security such as data sensitivity, legal or other regulatory issues, disaster recovery, currently deployed remote access or internal security considerations, etc.

7.2.7. Provide support and services in compliance and in alignment with Federal Risk and Authorization

Management Program (FedRAMP) approved at a Moderate impact level, standardized security assessment, authorization, and continuous monitoring policies in deployment planning services, as required by the scope of the project.

7.2.8. Provide technical services regarding security and privacy in the deployment planning services that are consistent with the NIST Special Publication 800-144 – “Guidelines on Security and Privacy in Public Cloud Computing” or other applicable federal, agency and Institute standards and guidelines.

7.2.9. Describe approach to securing proprietary information in connection with SIS product and services proposals to prevent unauthorized disclosure.

7.2.10. Describe framework and approach to incorporating federal, agency and Institute security requirements into deployment planning recommendations.

7.2.11. List any additional Security and Privacy standards to which the contractor should conform to for their services/solution. For example:

Properly securing the connections between systems in the SIS target environment, including SIS-associated legacy systems and integration with LMSys that uses a Cornerstone solution.

Implementation of Trusted Internet Connections and similar mandates.

7.2.12. Maintain clear government visibility into program cost, schedule, technical performance, and risk, including periodic reporting.

7.2.13. Provide meaningful reporting and analytics that provide the Institute with up-to-date and comprehensive information regarding technical and management performance.

7.2.14. Provide a brief description on the management of subcontractor relationships and contracts.

Outline the roles and responsibilities per party involved in the service and where key responsibilities reside.

7.2.15. Provide a transition plan detailing milestones, activities, and timelines for the deployment services.

7.2.16. Provide a vendor management plan including risk analysis, evaluation, communication, performance, auditing, and dispute resolution.

U N C L A S S I F I E D | S T U D E N T I N F O R M A T I O N S Y S T E M R E P L A C E M E N T 11

7.3. Task Area 3: SIS Pilot Deployment, Integration and Data Migration

The contractor shall provide the following:

7.3.1. Provide SIS target environment deployment services that accommodate considerations from an enterprise perspective including impact on Institute business units, contracts, management, and technical components (application, infrastructure, and security). This should tie to the purpose of the applications or services being deployed and can include users, stakeholders, business hours, and related input and output processes based on the role and business function of the affected systems.

7.3.2. Provide all necessary support to fully deploy the Institute’s SIS and associated support services to the target environment.

7.3.3. Provide hosting services within specified geographic location for the target applications and

7.3.4. Provide communications plan for all affected parties of the deployment to ensure end-user adoption, customer satisfaction, successful organizational process changes, and alignment with the Institute’s policies, requirements and goals.

7.3.5. Provide all technical advisory services necessary to fully deploy the Institute’s SIS and associated support services to the target environment.

7.3.6. Provide environments for production, integration, development and sandbox purposes to support the complete SIS solution’s lifecycle.

7.3.7. Provide integration, data migration and post-deployment pilot support services.

7.3.8. Provide upgrades and releases to the purchased COTS system that keep pace with changing technology over the pilot period of the system.

7.3.9. Provide open standards-based technologies whenever possible to provide interoperability.

7.3.10. Provide additional resources for bandwidth, storage, software licenses, etc. as required supporting the SIS deployment beyond the amount normally planned for operations.

7.3.11. Provide SIS deployment status including milestones and support or implement specified SIS deployment testing plans and related rollback capabilities.

7.3.12. Provide backup, recovery and disaster recovery procedures and processes in the target environment for the SIS and associated support services that support the following objectives:

Recovery Point Objective (RPO) – Ability to recover files for any specific day within a rolling six (6) month period.

Recovery Time Objective (RTO) – Ability to recover files within twenty-four (24) hours of request.

U N C L A S S I F I E D | S T U D E N T I N F O R M A T I O N S Y S T E M R E P L A C E M E N T 12

Data Backup Location – Data backups maintained or replicated at a site geographically disparate from the production site such that the loss of one data center does not prohibit recovery of data within the prescribed RTO.

Any other relevant details from existing business continuity plans (BCP).

7.3.13. Provide support for data storage tiers as specified within the target applications and services.

7.3.14. Provide complete support for IPv6 within the target environment provided.

7.3.15. Provide support and services in compliance and alignment with Federal Risk and Authorization

Management Program (FedRAMP approved at a Moderate impact level) standardized security assessment, authorization, and continuous monitoring policies as required by the scope of the project. Assessment and Authorization (A&A) activities will be included as part of the deployment.

7.3.16. Provide deployment services regarding security and privacy that are consistent with the NIST Special Publication 800-144 – “Guidelines on Security and Privacy in Public Cloud Computing” and other applicable standards and guidelines.

7.3.17. Provide a security plan focused on the integration points of end-user authentication (e.g. LDAP), cloud or internal environment management authentication (PIV card), and physical and logical security and certification (e.g. FedRAMP approved at a Moderate impact level) delivering a single comprehensive solution that can be leveraged across the organization reducing end user confusion and security management complexity.

7.3.18. Provide a trusted secure communication channel for target environment management to support the government’s PIV Card authentication (dual factor method) of remote access in accordance with OMB M-11-11.

7.3.19. Provide security for non-standard data transfers both in transit and at rest resulting from the deployment of the SIS and associated support services to its target environment.

7.3.20. Provide support for specified auditable events related to the SIS and associated support

7.3.21. Provide support personnel who have a minimum secret security clearance at the vendor’s expense.

7.3.22. List any additional Security and Privacy standards to which the contractor should conform to for their SIS service/solution. For example:

Properly securing the connections between SIS-associated systems.

Implementation of Trusted Internet Connections and similar mandates.

Implementation of Institute specific intellectual property rights policy.

7.3.23. Utilize relevant tools and analysis techniques for analyzing, evaluating and presenting information gathered throughout the deployment planning phases. Describe approach and examples of relevant tools and analysis techniques for all relevant phases.

U N C L A S S I F I E D | S T U D E N T I N F O R M A T I O N S Y S T E M R E P L A C E M E N T 13

7.3.24. Provide the Institute decision-making support in the form of relevant artifacts and work products.

Describe in the proposed methods of compliance with requirements for the business, management and security objectives, proposed service level agreements (SLAs), associated terms and conditions, and enforcement methodology.

7.3.25. Provide end-to-end monitoring capability and reporting for service level agreement (SLA) requirements and metrics. Provide a proposed SLA and associated terms and conditions that describe methods of compliance with SOO objectives and requirements. Key elements covered in the SLA include:

Metrics for the services as measured as the [describe calculation of metric]; not to be less than that proposed within the acquisition vehicle and including definitions.

Metric Time Objectives for tasks.

Methodology for ensuring that the SLA is met.

7.3.26. Provide configuration management information for the target environment that will integrate with the Institute’s configuration management system.

7.3.27. Provide archived and deleted record data retention consistent with the Institute data retention policy. Attach, reference, or specify the applicable policy.

7.3.28. Provide a draft Quality Assurance Surveillance Plan (QASP) that shall include details for measuring performance and deliverables with metrics that may include data availability, storage capacity, uptime, etc.

7.3.29. Provide a change management plan describing recommendation for managing changes to the SIS solution throughout its lifecycle to include incorporating vendor updates to the SIS product and accommodating custom development needs.

7.4. Task Area 4: SIS Operations and Legacy Closeout Support

7.4.1. Provide upgrades and releases to the purchased COTS system that keep pace with changing technology over the life of the system.

7.4.2. Provide maximum alignment to federal property reuse and disposal process requirements, amplifying the Institute’s ability to achieve management objectives.

7.4.3. Provide services that accommodate considerations from an enterprise perspective including impact on Institute business units, contracts, management, and technical components application, infrastructure, and security. This should delineate both affected and necessary business units to achieve the decommissioning and disposition activities and can include

U N C L A S S I F I E D | S T U D E N T I N F O R M A T I O N S Y S T E M R E P L A C E M E N T 14 stakeholders, impacted staff, business hours, and related agency contract and asset management processes and systems.

7.4.4. Provide communications plan for all affected parties of the service and facility decommissioning(s) to ensure minimized operational disruption, customer satisfaction, successful organizational process changes, and alignment with the Institute’s policies, requirements and goals.

7.4.5. Continue to provide support for the new SIS and enable additional technologies to be added in as technology progresses.

7.4.6. Provide all technical advisory services necessary to fully decommission the Institute’s existing SIS and associated support services to fully release associated resources for other use.

7.4.7. Provide final state backup copies of data, logs, and files for the SIS and associated support services that are decommissioned.

7.4.8. Provide planning and management services to efficiently provide for the disposition of assets including the management of related service contracts.

7.4.9. Provide efficient facility services to prepare the site for “turn-in” condition.

7.4.10. Provide for the planning, management, and execution of the cessation of current SIS operations and related activities of the facilities.

7.4.11. Provide for storage media data sanitization or destruction as appropriate consistent with NIST Special Publication 800-88 or other applicable standards and guidelines.

7.4.12. List any additional Security and Privacy standards to which the contractor service/solution shall conform.

7.4.13. Enable the Institute to maintain compliance with relevant security and privacy policies at Institute, agency and federal levels as they relate to the operation and maintenance of the SIS.

7.4.14. Provide meaningful reporting and analytics that provide the Institute with up-to-date and comprehensive information regarding technical and management performance of the SIS and its target environment consistent with metrics developed in SLA(s).

7.4.15. Allow the contractor maximum flexibility to innovatively manage program cost, schedule, performance, risks, warranties, contracts and subcontracts, vendors, and data required to deliver effective decommissioning and disposition management services.

7.4.16. Maintain clear government visibility into program cost, schedule, technical performance, and risk, including periodic reporting.

U N C L A S S I F I E D | S T U D E N T I N F O R M A T I O N S Y S T E M R E P L A C E M E N T 15

7.4.17. Provide a brief description on the management of subcontractor relationships and contracts.

Outline the roles and responsibilities per party involved in the service and where key responsibilities reside.

7.4.18. Provide a vendor management plan including risk analysis, evaluation, communication, performance, auditing, and dispute resolution.

7.4.19. Coordinate with Institute property management personnel concerning all activity relating to electronic equipment.

7.4.20. Provide electronic equipment disposal services in line with Institute policies and procedures.

7.4.21. Provide asset disposition services in accordance with relevant federal, state, and local laws related to electronics reuse, recycling, and disposal.

7.4.22. Provide updates and coordination with Institute’s asset management system.

7.4.23. Provide environmental programs and policies that maximize outcomes providing best value to the government, including through the tracking and reduction of energy use, greenhouse gas emissions, and other negative environmental impacts, with respect to the scope of these objectives.

7.4.24. Provide all support operations necessary to maintain, upgrade and/or update the SIS while maximizing cost efficiency.

7.5. Task Area 5: Maintenance and Support Program

7.5.1. Provide post-implementation onsite support plan that include the period of time support after go-live.

7.5.2. Provide post-implementation of-site support plan.

7.5.3. Provide delivery method of future upgrade and product encasements including frequency upgrade by module.

7.5.4. Provide problem solving and resolution procedure, bug fixes, patches and other support such as knowledge base plan.

8. Deliverables

The following list provides the set of deliverables required for this effort, organized according to task area and subject to the government’s approval:

U N C L A S S I F I E D | S T U D E N T I N F O R M A T I O N S Y S T E M R E P L A C E M E N T 16

8.1. Preparation

Project Management Plan Project Schedule and Milestones Scope and Requirements Matrix Communications Plan

8.2. Task Area 1: SIS Environmental Analysis

Analysis and understanding of FSI’s current STMS environment, and analysis of existing, on premise

SIS-related technical resources are best suited for replacement by the SIS or co-deployment with the

SIS.

8.3. Task Area 2: SIS Deployment Planning

A target environment capable of hosting SBU content.

A target environment capable of hosting sensitive but unclassified (SBU) content.

Comprehensive planning for deployment of the SIS to its target environment that supports cost-effective, secure, and agile IT management. At a minimum, planning deliverables must include:

o Product Backlog o Phased Implementation Plan o System Design Specification/Software architecture document o Scope and Requirements Management Plan o Product requirement document o Requirements Traceability Matrix o Risk Management Plan o Contingency Plan o System Security Plan o Test Management Plan o User Acceptance Review Presentation o Quality Assurance documentation o Maintenance and Help Guide o API documentation

8.4. Task Area 3: SIS Pilot Deployment, Integration and Data Migration

Provision of the target hosting environment selected by the Institute and associated release plan.

Successful and complete deployment of the SIS and associated solutions, services and security, privacy and other relevant controls to its target environment which would require:

o Approved Test Report o Training Plan and Materials o Deployment Readiness Review and O&M Transition Presentations o Approved Authority to Operate (ATO)

U N C L A S S I F I E D | S T U D E N T I N F O R M A T I O N S Y S T E M R E P L A C E M E N T 17 o Consolidated and simplified SIS application and service management and monitoring of the SIS in its target environment to support cost-effective, secure, and agile IT management in the form of:

o MOUs, SOPs, SLAs. etc.

o Operations and Maintenance Guides o User Manuals, Job Aids, and Quick Reference Guides

8.5. Task Area 4: SIS Operations and Legacy Closeout Support

Provision of SIS development services to provide for future SIS feature extensibility.

Provision of periodic upgrades and releases to the SIS that keep pace with changing technology over the life of the system.

Successful decommissioning of FSI’s current SIS and any existing, SIS-related solutions, and support services.

Efficient and policy compliant disposition in an environmentally sound manner of any unneeded, existing SIS-related assets.

Support for preparing FSI facility space into “turn-in” condition to be defined by the current facility space owner.

Development of Lessons Learned Report(s).

Post-Implementation Review Presentation.

9. Constraints

This section lists laws, rules, regulations, standards, technology limitations and other constraints that the service and/or service provider must adhere to or work under.

9.1. Access Control

In accordance with Foreign Affairs Manual reference 12 FAM 643.2-1 https://fam.state.gov/, the contractor shall be responsible for the following access control safeguards:

9.1.1. System managers will restrict access to data, programs, etc., based on the identity of the users and/or the functional role for each group to which they belong.

9.1.2. System managers will restrict access to data, programs, etc., based on the sensitivity (as represented by a label) of the information contained in the data, program, etc. and the formal authorization (i.e., clearance) of users to access information of such sensitivity.

9.1.3. System managers must limit access to system software, utilities, and system services that could be used to gain unauthorized access to system data and software through network services.

System managers will prohibit users from accessing functions to which they have no defined need.

9.1.4. Allow System Administrators to create and manage system permissions and assign those permissions to roles, so that those permissions can be assigned to Users based on their job role and division.

U N C L A S S I F I E D | S T U D E N T I N F O R M A T I O N S Y S T E M R E P L A C E M E N T 18

9.1.5. Allow System Authorized Users to assign roles to Users based on the needs of their job role and division, so that they can protect data confidentiality and ensure separation of duties.

9.1.6. Allow Users to request to be granted explicit system permissions, so that Users can perform job duties that are outside the normal scope of their role.

9.1.7. Allow the System and Users to routinely certify User information in order to maintain data and acknowledge user access.

9.1.8. Allow System Authorized Users to remove system permissions and roles from a User, so that they can ensure that the User can no longer access related systems, subsystems, processes, and data.

9.1.9. The System needs to remove all permissions and roles from any Users who are inactive for a certain period of time, so that only Users with a current business need can access the system.

9.1.10. Allow System Authorized Users to view all Users who have system permissions and roles, so that they can determine who may or may not need to have those permissions.

9.1.11. Where possible, system managers must ensure that all systems’ access permissions default to no access for all access types definable for the connection, until a specific need has been established and approved. (Access types include read, write, modify, execute, delete, append, etc.) Once a need has been established, the principle of least privilege must be employed allowing only the level of access necessary for a user’s job duties.

9.1.12. The system manager must configure service windows for the SIS and associated support technologies for only those hours operationally required. After-hours access must not be configured unless a specific operational need has been identified and documented by the system manager and ISSO.

9.1.13. System managers must restrict node-hopping programs to those users who have a legitimate need to access remote systems. Where a need for intermediate logons by users to gain access to distant systems has been established, system managers must limit the functionality of these node-hopping programs in order to promote controlled access. These programs can be limited using system-level security controls, locally developed procedures, or other mechanisms that control the selection of input parameter values.

9.1.14. System managers must ensure that users are limited to only one remote logon session at a time.

9.1.15. System managers must ensure that SIS and associated support systems comply with applicable agency and Institute access control policies.

9.2. Authentication

9.2.1. In accordance with Foreign Affairs Manual reference 12 FAM 632.1-4 https://fam.state.gov/, the contractor shall be responsible for the following identification and authentication controls:

9.2.2. System managers must configure systems to require user identification and authentication.

U N C L A S S I F I E D | S T U D E N T I N F O R M A T I O N S Y S T E M R E P L A C E M E N T 19

9.2.3. .

The System needs to perform routine activities to identify instances that may require a Student User Account to be automatically updated or disabled.

9.2.4. System managers must configure networked systems to require a Smart Card and passphrase for user authentication. This includes networked devices, e.g., multi-function printers and digital senders that require user authentication. Send requests for exceptions to the Smart Card requirement to IRM/IA.

9.2.5. System managers must configure standalone systems to require either:

Both a Smart Card and passphrase or Access Code/Pin or A password for user authentication

9.2.6. Personnel with elevated system privileges must have separate privileged and user accounts, and the privileged account must not be used to perform user activities, e.g., sending email or accessing external classified web sites/applications.

9.2.7. System managers must immediately disable user IDs under the following conditions:

Whenever notified by a user's supervisor that the user no longer requires AIS access (e.g., user no longer employed with the Department);

Whenever notified by a proper authority, such as the human resources officer, that the user's employment has been terminated with the Department; or

When the user ID is no longer needed (e.g., obsolete account)

9.3. Personnel Security Clearances

Homeland Security Presidential Directive-12 requires that all federal entities ensure that all contractors have current and approved security background investigations that are equivalent to investigations performed…