National Institute of Standards and Technology (NIST), Child Care Subsidy Program Support

General Information NIST is looking to expand and enhance NIST's portfolio of family-friendly programs, which currently includes on-site childcare centers, alternative work schedules, family-friendly leave, and family medical leave, with a childcare subsidy program. The direct financial benefit to staff would serve as an incentive for recruiting and retaining both lower salaried and entry-level administrative and technical staff. NIST seeks a solution which provides security and privacy protection consistent with requirements defined by applicable federal laws, regulations, policies, and standards (e.g., the Federal Information Security Management Act (FISMA), OMB Circular A-130, and FIPS Publication 200). REQUIREMENTS - Cybersecurity/Privacy Requirements The solution provider (including subcontractors) may meet these requirements through various means including but not limited to; FedRAMP authorization, current third-party assessments (e.g., SSAE, PCI) and/or responses to NIST special publication control set SP 800-171. ? Minimally Acceptable Controls System security plan describing physical, technical, and administrative controls implemented to protect systems and sensitive personally identifiable information (SPII). IT management processes to establish and manage secure configuration baselines including routine patching for all operating systems and applications. Access to SPII is restricted to those with a need to know. Personnel with access to SPII have background investigations performed (e.g. criminal, financial etc.), and are trained on secure handling of SPII. Access Controls for SPII meet or exceed industry best practices for access and identification control including, but not limited to, connectivity to servers and databases, multi-factor authentication for remote accesses for administration, secure configurations for any devices accessing the system, and strong physical security for any place where the data is accessed. The solution supports multifactor authentication for users and/or supports integration with customer federation services for Single-Sign capability. Processes for scanning on a continual basis for vulnerabilities and proper configurations for all aspects of the system, as well as processes for timely mitigation of findings. Auditing and Incident Response processes including customer notification of suspected or actual incidents and logging with sufficient information to perform forensics on any incident. Processes for notifying and providing appropriate mitigations, including but not limited to credit monitoring services, for subsidy applicants in the event of suspected or actual incidents. SPII is encrypted in transit using TLS 1.2 or better and encrypted at rest in all places the SPII is stored. All encryption algorithms and modules are FIPS 140-2/140-3 validated. If unable to meet any of the requirements listed above, solution provider may provide details of mitigations or alternative protections in place to ensure the appropriate handling and protection of SPII. If the solution provider provides services to other Federal agencies, provide a general description of the security risk management approach and client point of contact. Functional/Programmatic Requirements - TASKS Kick-off Meeting The Contractor shall attend a kick-off meeting, via conference call or video conference, with NIST no later than one week after award. The Contractor shall contact the Contracting Officer's Representative (COR) to schedule a date and time for the meeting. The meeting venue (conference call or video conference) will be determined at this time. Attendees shall include, at a minimum, the Contracting Officer's Representative, the Contracting Officer or Contract Specialist, the Contractor's Program Manager, and all Contractor personnel that will be working on this project. The meeting will review the contract requirements, summarize contract rules, review the background and objectives of the NIST CCSP program, and discuss the tasks required by the statement of work. The Contractor shall provide a summary of the meeting via email no later than three days after the meeting date. Develop a Website The Contractor shall develop, host, and maintain a website for the CCSP that is secure for a federal agency. Minimum requirements for the website: Application form for NIST employees in accordance with Attachment 2; Child Care provider form in accordance with Attachment 3; Be live 24/7; The website must link to the NIST Website; Instructions on the application process; Contractor points of contact; COR name and contact information; Information on customer support and how to reach a live representative; The NIST Child Care Subsidy Program Business Care Analysis; The following language: If you are contributing to a Dependent Care Flexible Spending Account (DCFSA): In accordance with Section 129 of the Internal Revenue Code, an employee can generally exclude from gross income up to $5,000.00 of benefits received under a Dependent Care Assistance Program each year. This would include DCFSA and the NIST Child Care Subsidy Program. Subsidy amounts from both of these programs may not exceed the $5,000.00 limit. For further guidance please refer to the following link: Office of Personnel Management - Benefits Administration Letter The Contractor shall develop an alpha version of the website and provide this version to the COR for review and comment. The COR will provide written comments to the Contractor within five business days. The Contractor shall revise the website based on the COR's comments. The Contractor shall provide a beta version of the website to the COR not later than five business days after receipt of the COR's comments. Upon approval by the COR, the Contractor shall release the website live, notify the COR, and provide a link to the website. The COR will be responsible to ensure that this website is linked to the NIST website. Develop Letter Templates for Acceptance and Rejection The contractor shall develop letter templates for acceptance, rejection, and the notification of recipient reaching the $5,000 maximum subsidy with respect to the CCSP for the applicant and the childcare provider. Minimum requirements for templates include the following: Notification of Rejection: Date application was received; Name of applicant; Reason for denial; Date notice is sent to COR; Notification of Acceptance: Date application was received; Name of applicant; Date subsidy is effective; Date notice is sent to applicant Notification to recipient that is reaching $5,000 maximum subsidy: Date recipient is due to reach $5K; Name of recipient; Date of notification Draft templates shall be provided to the COR for comment and/or approval. The Contractor shall incorporate all comments and return final versions to the COR for approval. Upon approval, these templates shall be utilized throughout the life of the contract. Changes to the templates must be approved by the COR prior to implementation. Attend meet-and-greets with NIST employees during Marketing period The contractor shall be present on the NIST Gaithersburg campus at least twice for a one-hour increment to answer questions any NIST staff may have regarding the Child Care Subsidy Program. The room location will be determined closer to the marketing date (will be located in building 101). The audience will be NIST Gaithersburg employees. Contractor should provide any FAQ documents available, and any materials that will allow NIST employees to understand eligibility requirements. Provide and Process CCSP Applications The Contractor shall receive and process all CCSP applications. Process shall include, at a minimum, verifying all amounts reported, verifying eligibility in accordance with Attachment 1, verifying all forms are signed, and verifying all information on the childcare provider form is complete. To be determined eligible, the applicant must comply with the eligibility requirements in Attachment 1 and all of the following: Requiring each childcare provider to submit a copy of any current license and any statement of compliance from anybody charged with regulating that provider; Requiring childcare providers to submit their taxpayer identification numbers; and Insuring that licensed childcare providers understand that, if, for whatever reason, the provider is no longer licensed or subject to regulatory oversight or is not in compliance with applicable regulations, the provider will immediately notify the Contractor and the Federal employee whose child is enrolled in the childcare program. In such cases, the provider will no longer be permitted to receive the childcare subsidy. The Contractor shall review all documentation provided by the applicant and make a recommendation to the COR that the applicant is or is not eligible for Federal assistance under the CCSP. The COR shall review the Contractor's recommendation and provide the final determination of eligibility to the Contractor. Upon receipt of the COR's concurrence, the Contractor shall forward a written response to the applicant and the childcare provider, via e-mail or U.S. mail, using the appropriate template provided under Task 3. The application must be processed, a determination of eligibility approved by the COR, and a response provided to the applicant not later than 30 days from the date the application is received. The Contractor shall maintain an individual record for each applicant which includes all documents, information, applications, invoices, communication records, and any other documents pertinent to their case. The Contractor shall have access and will be handling the following PII/BII: Applicant Information (As listed on OPM-1643 Form): Federal Agency where employed (NIST) First/Last name of Parent/Applicant Social Security Number (SSN) of applicant Grade level of Applicant Work Address Work E-mail address Work Telephone Number Home Address of Applicant Personal Email Address Home telephone number Category of Parent (Single/Couple) Spouse Federal Employee (Y/N) First/Last name of spouse Employing Agency of Spouse Grade of Spouse Total Family Income as reported on most recent IRS form 1040/1040A (Include copy of IRS form) Name of First Child Social Security Number (SSN) of child Date of Birth of child Name of Child Care Provider Weekly Child Care Costs Date of Enrollment Type of Application If any other form of State, County, or local subsidy is being received for the child(ren) (Y/N), source of subsidy, amount of subsidy Address of Provider Telephone number of childcare providers Type of care (Center-Based Care/Family home-based care) All of the above information is needed for each child receiving a subsidy Signature and date signed of Parent/Legal Guardian Child Care Provider Information (As listed on OPM-1644 Form) Name of Parent/Legal Guardian with child in the provider's care Federal Agency of Parent Type of Provider (Family Child Care, Child Care Center, Federally Sponsored Child Care Center) Name of Child Care Provider Address of Child Care Provider Provider E-Mail Address Provider Telephone Number Tax Identification number or Social Security Number (SSN) Provider Fax Number License Number of Provider State in which License is issued License Expiration date Name of each child, enrollment date, whether the child receives any other subsidy, source of subsidy, amount of subsidy, and total weekly fee for each child for each Federal Employee who applied for a subsidy at the notated facility Name of Financial Institution Financial institution's routing number Address of financial institution Type of account (Checking/Savings) Provider's Account Number Name of Provider Title of Provider Representative Signature of Provider Date of Signature Customer Support The Contractor must have personnel available to respond to questions from NIST personnel about the program between the hours of 9:00 AM and 4:00 PM Monday through Friday. The Contractor cannot speak for NIST or provide information that is not publicly available on the website. Questionable requests or inquiries must be forwarded to the COR for a response. Review of Monthly Invoices The Contractor must have an established invoicing process to receive, review, and pay invoices electronically for the CCSP program. Upon acceptance into the program, the Contractor must notify the provider to submit complete invoices, in arrears, to the Contractor. To be determined complete, the invoice must include all of the following information: The name of the employee; The name of the childcare provider; The child/children's name(s); The amount of subsidy per child; The total amount on invoice; The dates of subsidy; The invoice date; The period being billed. The Contractor shall review invoices and provide payment, if appropriate, based on the invoiced amount not later than 30 calendar days after the date of receipt of a complete invoice. The Contractor shall pay the childcare subsidy tuition assistance directly to the childcare provider, and not to the Federal employee. The Contractor shall: Ensure that the childcare provider submits a written invoice, on a monthly basis, to the Contractor; Childcare subsidy shall be submitted as weekly amounts and the invoices must be prepared using full week amounts unless the child leaves the program during a particular week. A full week amount consists of the weekly amount. The Contractor must notify the COR when, in the subsequent 60-day period, they will have accrued a total of 75% of the maximum subsidy allowance of $150,000. This is a NIST sponsored program with an annual spending limit. When the maximum expenditure of funds occurs, applications will be placed on a waiting list in the order in which their complete application was received. The Contractor must notify the applicant via email that the program is at the maximum allowance and that the applicant has been placed on a waiting list. If the Contractor is late on any given invoice payment, they must notify the COR with the basis for the late payment. Reapplication The Contractor is not required to have applicants re-apply on an annual basis. The Contractor shall ensure that applicants re-certify no later than May 15th of each year. The Contractor must require that applicants submit their current federal income tax return, leave and earnings (L&E) statement, and a fee schedule from the childcare provider. The Contractor shall notify each applicant with respect to recertification on an annual basis. Reporting Requirements The Contractor shall submit monthly reports to the NIST COR on the status of NIST's CCSP in an encrypted format. These reports shall be transmitted with a cover letter, on the Contractor's letterhead, describing the content. The reports shall contain the following information and shall be due on the fifteenth (15) day following the end of the month: The amount of childcare subsidy disbursed in a given month; The number of children enrolled whose parents receive the childcare subsidy; The number of federal employees from NIST who qualified for and received subsidy; The total family income of each family that receives a childcare subsidy; The amount of the weekly childcare subsidy for each recipient The name and address of each childcare provider that provides services for the childcare subsidy recipients; The number of total applicants for the month; The number of applications in process; The number of new childcare subsidies approved; The number of applicants who were ineligible with reason; The length of time an applicant remains in the program; The reason why a NIST employee left the program; The percent of NIST employees in each career path enrolled in the CCSP; The number of applicants who reapply and are no longer eligible, to include child's name and amount previously received; The number of applicants who were denied assistance due to lack of NIST funds; The remaining balance of NIST's funds; and The time NIST funds reach 75% of subsidy. Return Applicant Files to NIST No later than five calendar days after the last day of the contract, the Contractor must return all applicant files and all templates to the COR. Contracting Office Address Department of Commerce, National Institute of Standards and Technology, Acquisition Management Division, 100 Bureau Drive, Building 301, Room B121, Mail Stop 1640, Gaithersburg, MD, 20899-1640 NIST is seeking responses from all responsible sources. Small businesses are defined under the associated NAICS code for this effort, 518210 Computing Infrastructure Providers, Data Processing, Web Hosting, and Related Services as those domestic sources having $35M. Please include your company's size classification and socio-economic status in any response to this notice. Instructions to Responders: Interested parties that have the capabilities to meet the Government's basic requirements are requested to email capabilities statement of no more than 20 pages, describing their abilities to meet all requirements to contact@example.gov no later than the response date of April 25, 2022, 12:00 p.m. EST for this sources sought notice. The report should include relevant information to your capabilities including any requirements that cannot be met or is deemed close to but not meeting an identified requirement. Also, the following information is requested to be provided as part of the response to this sources sought notice: Name of company(ies), their addresses, and a point of contact for the company (name, phone number, fax number and email address) that provide the services for which specifications are provided. Indication if the company(ies) are small business and/or any other social economic category(ies). Please highlight if company is an 8(a) and/or owned by an Alaska Native Corporation, Indian Tribe, Native Hawiian Organization, Community Development Corporation; HUBZONE, SDVOSB, EDWOSB or WOSB. Indication of whether the services required are currently on one or more GSA Schedule (i.e. Multiple Award Schedules [MAS]) contracts and, if so, the GSA MAS contract number(s). Indication if the company(ies) can provide all, or some, of the services. Any other relevant information that is not listed above which the Government should consider in developing its minimum specifications and finalizing its market research.