2024-IS-04-06_PWS_Technical Evaluation Security Testing v2 Formatting 2-1-2024 CLEAN.docx

Technical Evaluation Security Testing (TEST)

VA-24-00032846

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Office of Information & Technology (OIT) Office of Information Security (OIS) Information Security Operations (ISO) Security Assessment & Validation Directorate (SAVD)

Technical Evaluation Security Testing (TEST)

Date: February 1, 2024

VA-24-00032846

PWS Version Number: 4.0

Contents

BACKGROUND

The Department of Veterans Affairs (VA), Office of Information & Technology (OIT), Office of Information Security (OIS) delivers available, adaptable, secure, and cost-effective technology services to VA, transforming the Department into an innovative, 21st century organization, and acts as a steward for all VA’s IT assets and resources. OIT delivers the necessary technology and expertise that supports Veterans and their families through effective communication and management of people, technology, business requirements, and financial processes. To meet these goals, OIT strives to provide high quality, effective, and efficient Information Technology (IT) services to those responsible for providing care to the Veterans at the point-of-care as well as throughout all the points of the Veterans’ health care in an effective, timely and compassionate manner. VA depends on Information Management/ Information Technology (IM/IT) systems to meet mission goals.

It is important that Veterans’ most sensitive information about their personal identity and medical records be protected. VA systems contain sensitive but unclassified data, personally identifiable information (PII), and protected health information (PHI) that, if compromised, may have a negative impact on Veterans, VA, and the Federal Government. The challenge is ensuring that VA safeguards this information in a way that minimizes any interference with the business processes and technologies used to deliver services to our nation’s Veterans. To meet this challenge and comply with Federal legislation, VA established an enterprise-wide information security program with a mission to “serve our Veterans, their beneficiaries, employees, and all VA stakeholders by ensuring the confidentiality, integrity, and availability of VA sensitive information and information systems.”

The business of VA, the second largest cabinet Department, is a massive, far-reaching, and complex effort that truly exemplifies direct public service to very special United States (U.S.) citizens. There are 20 million living Veterans, and about a quarter of the nation's population is potentially eligible for VA benefits and services because they are Veterans or beneficiaries of Veterans.

VA operates a network of more than 1,500 facilities and has over 350,000 employees. Among the many professions represented in the vast VA workforce are physicians, nurses, counselors, statisticians, architects, engineers, computer specialists, and attorneys.

VA computer networks, known as “information systems,” encounter over 45 million weekly security-related events and have over 500,000 workstations, 350,000 users, 500 network security appliances, and 25,000 servers. The requirement for network security support is mainly derived from the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53 series, Incident Response (IR) control families. VA requires the capability to identify, detect, protect, and rapidly respond to assure containment and remediation (recover) of any security attacks against our systems. Any security incidents such as computer viruses, malicious software (malware), and other suspicious activity must be detected, contained, and removed from VA systems, and must also be analyzed using advanced digital media analytics capabilities to fully determine the root cause details for how these incidents occurred and to determine if the viruses and malware may have spread to other VA computers and networks. Success in achieving effective enterprise network defense capabilities at VA involves leveraging intelligence collected, the Information Security Continuous Monitoring (ISCM) capabilities deployed across the enterprise, and Advanced Persistent Threat (APT) hunting abilities of security experts.

VA’s direction of the information protection efforts expresses what and where information security controls need to be implemented in order to help further VA IT goals and objectives and achieve the VA mission. This builds on the VA information protection mission by providing direction and describing the future state of enterprise-wide security. VA’s Cybersecurity Strategy Goals outline our approach to countering the cybersecurity threat, while continuing to innovate and adapt to a rapidly changing IT landscape:

Goal 1. Secure and protect VA and Veteran information.

Goal 2. Protect information systems and assets.

Goal 3. Leverage innovation to strengthen cybersecurity.

Goal 4. Enhance cybersecurity through partnerships and information sharing.

Goal 5. Empower VA mission through cybersecurity risk management.

VA’s Security Assessment and Validation Directorate (SAVD) performs several key functions to help ensure that these five goals are achieved and to provide enterprise-wide information security services as required by the Federal Information Security Modernization Act of 2014 (FISMA), as well as comply with many other Federal information security and privacy requirements. However, compliance only sets the minimum standard that a VA information security program must achieve. The program's vision is to “provide world-class information security for VA and Veteran information and information systems,” a vision that far exceeds compliance and strives for excellence. To achieve these goals, SAVD continues to pioneer development of cyber security operations and capabilities.

SAVD performs independent verification and validation of VA's cyber security posture and performs cyber-related reporting to outside Agencies.

APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. Memorandum For Heads of Executive Departments and Agencies *, Fiscal Year 2015- 2016 Guidance on Federal Information Security and Privacy Management Requirements, M-16-03

2. 44 U.S.C. § 3541-3549, “Federal Information Security Management Act (FISMA) of 2002”

3. Federal Information Security Modernization Act of 2014

4. Federal Information Processing Standards (FIPS) Publication 140-2, “Security Requirements for Cryptographic Modules”

5. FIPS Pub 199. “Standards for Security Categorization of Federal Information and Information Systems,” February 2004

6. FIPS Pub 200, “Minimum Security Requirements for Federal Information and Information Systems,” March 2006

7. FIPS Pub 201-2, “Personal Identity Verification of Federal Employees and Contractors,” August 2013

8. 10 U.S.C. § 2224, "Defense Information Assurance Program"

9. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

10. Public Law 109-461, Veterans Benefits, Health Care, and Information Technology Act of 2006, Title IX, Information Security Matters

11. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”

12. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, https://www.va.gov/vapubs/index.cfm

13. VA Handbook 0710, “Personnel Security and Suitability Program,” May 2, 2016, https://www.va.gov/vapubs/index.cfm

14. VA Directive and Handbook 6102, “Internet/Intranet Services,” August 5, 2019

15. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and Guidelines,” January 18, 2017

16. Office of Management and Budget (OMB) Circular A-130, “Managing Federal Information as a Strategic Resource,” July 28, 2016

17. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed Services (CHAMPUS)”

18. NIST SP 800-66 Rev. 1, “An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule,” October 2008

19. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended, January 18, 2017

20. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

21. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021

22. VA Handbook 6500, “Risk Management Framework for VA Information Systems VA Information Security Program,” February 24, 2021

23. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI),” March 12, 2019

24. VA Handbook 6500.5, “Incorporating Security and Privacy into the System Development Lifecycle,” March 22, 2010

25. VA Handbook 6500.6, “Contract Security,” March 12, 2010

26. VA Handbook 6500.8, “Information System Contingency Planning,” April 6, 2011

27. VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018

28. VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017

29. OIT Process Asset Library (PAL), https://www.va.gov/process/ . Reference Process Maps at https://www.va.gov/process/maps.asp and Artifact templates at https://www.va.gov/process/artifacts.asp

30. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

31. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014

32. VA Handbook 6508.1, “Procedures for Privacy Threshold Analysis and Privacy Impact Assessment,” July 30, 2015

33. VA Handbook 6510, “VA Identity and Access Management,” January 15, 2016

34. VA Directive and Handbook 6513, “Secure External Connections,” October 12, 2017

35. VA Directive 6300, “Records and Information Management,” September 21, 2018

36. VA Handbook, 6300.1, “Records Management Procedures.” March 24, 2010

37. NIST SP 800-37 Rev 2, “Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy,” December 2018

38. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020)

39. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015

40. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” March 24, 2014

41. OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005

42. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019

43. OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008

44. Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance, December 2, 2011, (NOTE: Part A of the FICAM Roadmap and Implementation Guidance, v2.0, was replaced in 2015 with an updated Architecture (https://arch.idmanagement.gov/#what-is-the-ficam-architecture)

45. NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access,“ June 2018

46. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, “Digital Identity Guidelines,” updated March 02, 2020

47. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014

48. NIST SP 800-164, “Guidelines on Hardware-Rooted Security in Mobile Devices (Draft),” October 2012

49. NIST SP 800-115, “Technical Guide to Information Security Testing and Assessment, September 2008

50. Draft National Institute of Standards and Technology Interagency Report (NISTIR) 7981, “Mobile, PIV, and Authentication,” March 2014

51. VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

52. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

53. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

54. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

55. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019

56. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008

57. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (Public Law 110–140), December 19, 2007

58. Section 104 of the Energy Policy Act of 2005, (Public Law 109–58), August 8, 2005

59. Executive Order 13834, “Efficient Federal Operations,” dated May 17, 2018

60. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 2, 2001

61. VA Directive 0058, “VA Green Purchasing Program,” July 19, 2013

62. VA Handbook 0058, “VA Green Purchasing Program,” July 19, 2013

63. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

64. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

65. “Veteran Focused Integration Process (VIP) Guide 4.0,” January 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

66. VA Memorandum “Proper Use of Email and Other Messaging Services,” January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

67. “DevSecOps Product Line Management Playbook” version 2.0, May 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

68. NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020

69. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol Version 6 (IPv6),” November 19, 2020

70. Social Security Number (SSN) Fraud Prevention Act of 2017

71. Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23, 2018

72. 44 USC 3554: Federal agencies are required to comply with DHS-developed directives.

SCOPE OF WORK

The Contractor shall enable VA to comply with 44 U.S. Code § 3554 - Federal agency responsibilities in accordance with (b) Agency Program (5) periodic testing and evaluation of the effectiveness of information security policies, procedures, and practices, to be performed with a frequency depending on risk, but no less than annually, of which such testing: (A) shall include testing of management, operational, and technical controls of every information system identified in the inventory required under section 3505(c); (B) may include testing relied on in an evaluation under section 3555; and, (C) shall include using automated tools, consistent with standards and guidelines published under section 11331 of Title 40.

The Contractor shall enable VA to comply with 44 U.S. Code § 3554, NIST Special Publication (SP) 800-37 (Risk Management Framework (RMF)), and FISMA to assess, review, and validate that security and privacy controls are being appropriately implemented, operating as intended, and producing the desired results, thus minimizing exposure to VA systems and information to unacceptable risk of security incidents that seriously impact VA networks and information. These support activities for security evaluation testing and assessments will assist Information System Security Officers (ISSOs), Information System Owners (ISOs), Authorizing Officials Designated Representative (AODR), Authorizing Officials (AOs) and VA senior leadership and other relevant stakeholders to have detailed, independent, and complete information prior to issuing Authorizations To Operate (ATOs). This requirement will also meet the mission of the organization to effectively conduct continuous monitoring through technical security evaluation and testing reports listing every control that did not comply with NIST and VA requirements, including a comprehensive listing of all vulnerabilities found and the full spectrum of federally mandated controls VA must satisfy in accordance with FISCAM and FISMA audits. These reports are vital to helping ISOs create corresponding Plan of Action and Milestones (POA&M) to remediate control risks or accept them, as required by FISMA.

ORDER TYPE

The effort shall be proposed on a Firm Fixed Price (FFP) basis, including optional Time and Material tasks, with Cost Reimbursable Travel.

PERFORMANCE DETAILS

PERFORMANCE PERIOD

The Period of Performance (PoP) shall be a base period of 12 months from award, with four 12- month option period(s) and two Optional Tasks. The total PoP for this contract shall not exceed 60 months, inclusive of all options.

The PoP for each Optional Task shall not exceed 12 months per exercise:

1. Optional Task One (1): Surge Support - VA may exercise this optional task for Surge Support to perform the tasks identified in Section 5.7. This task may be exercised at any time and from time to time throughout the period of performance, unlimited times per PoP, at the discretion of the Government and can be exercised during the base period and each option period of performance. This optional task PoP shall run concurrent with the period in which it was exercised.

2. Optional Task Two (2): Additional Support Teams - VA may exercise these optional tasks for additional Advanced Persistent Threat Group Emulation (APTGE), Red Team and/or Special Purpose Team (SPT) Support to perform the tasks identified in Section 5.2, 5.3. &5.4. This task may be exercised at any time and from time to time throughout the period of performance, unlimited times per PoP, at the discretion of the Government and can be exercised during the base period and each option period of performance. This optional task PoP shall run concurrent with the period in which it was exercised.

3. Optional Task Three (3): Transition Out Support shall have PoP of four months. May be exercised up to one time at any time during base or option periods. Any work, excluding tasks that require 24x7x365 support, at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO).

There are 11 Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, five are set by date:

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if a holiday falls on a Sunday, then Monday shall be observed as a holiday.

The following six remaining holidays are set by day of the week and month:

PLACE OF PERFORMANCE

Tasks under this PWS shall be performed remotely or performed at the Contractor’s facilities, except when travel is required per section 4.3. All support personnel shall be located within the Continental Unites States (CONUS). The Contractor shall identify the Contractor’s place of performance in its Task Execution Plan submission for all personnel who do not work at the contractor’s facilities. The Contractor staff shall be available to coordinate with VA Office of Information Security (OIS) staff on normal Federal Government workdays and respond between the hours of 9:00 a.m. and 5:00 p.m. Eastern Time.

TRAVEL

The Government anticipates travel under this effort to perform the tasks associated with the effort throughout the PoP under a Cost Reimbursable basis. Travel shall be Cost Reimbursable with a not to exceed ceiling on travel expenses per year. The Government encourages maximum utilization of teleconferencing and video conferencing for meetings. The Government anticipates travel may be required in support of meetings, training, presentations, or briefings with project stakeholders including project team members, VA management, and VA customers impacted by business, product, and process requirements.

Travel shall be in accordance with the Federal Travel Regulations (FTR) and requires advanced concurrence by the Program Manager (PM) and approval by the Contracting Officer’s Representative (COR). Travel and per diem shall be reimbursed in accordance with FTR. The Contractor shall provide cost estimates with each travel request. Each Contractor invoice shall include copies of all receipts that support the travel costs claimed in the invoice. The Government will not reimburse for local travel within a 50-mile radius from the Contractor's authorized duty stations. This includes travel, subsistence, and associated labor charges for travel time. Travel performed for personal convenience and daily travel to and from work at the Contractor's facility will not be reimbursed.

The estimated number of trips supporting this program is 20 per year. Anticipated locations within VA’s geographic Districts include the following, estimated at 5 days each in duration to include travel days with an estimated amount of people commensurate to the Federal Information Processing Standards (FIPS) categorization and level of effort for each system based on test plans:

1. Pacific District – 4 trips

2. Continental District – 4 trips

3. Midwest District – 4 trips

4. Southeast District – 4 trips

5. North Atlantic District – 4 trips Government Furnished Equipment The Government has multiple remote access solutions available to include Citrix Access Gateway (CAG), RESCUE GFE (VPN); GFE Mobile; VA Virtual Office (VAVO); Azure Virtual Desktop (AVD) Government Furnished Equipment (GFE) is limited to Contractor personnel who require direct access to VA information systems to perform standard business functions related to performance of a tasks in this TO and in compliance with VA Rules of Behavior (ROB). Use of GFE for real or emulated malicious activities, including, but not limited to, unauthorized penetration testing or simulated attacks or violating the ROB is prohibited. All activities that could be perceived as malicious shall be performed with non-GFE equipment and be authorized in Test Plan and Rules of Engagement (RoE) that is approved by the government.

When necessary, the Government will furnish up to 150 computers for use by the Contractor to access VA networks, systems, or applications to meet the requirements of this PWS. The overarching goal is to provide the most cost-effective access to the VA environment and ensure proper Change Management procedures are followed. Contractor personnel shall adhere to all VA system access procedures for on-site and remote users in accordance with VA standards, local security regulations, policies, and rules of behavior. GFE distribution shall be approved by the COR and PM on a case-by-case basis prior to issuance.

The contractor shall perform technical testing with equipment that is owned and operated by the contractor.

The Government will not provide mobile phones, IT accessories including, mobile Wi-Fi hotspots/wireless access points, additional or specialized keyboards or mice, bags, extra cables, extra Personal Identity Verification (PIV) card readers, peripheral devices, or additional memory including storage of any kind. With the exception of GFE to conduct normal business operations within VA ROB, the Contractor is responsible for providing infrastructure and IT accessories in support of the TO as necessary. Any installation of IT infrastructure, systems, accessories or software on VA network shall be approved and coordinated with the COR.

SPECIFIC TASKS AND DELIVERABLES

The Contractor shall provide dedicated staff with the appropriate mix of cross functional roles and the requisite mix of experience, skills, and expertise to fully and successfully execute tasks outlined under this TO. The Contractor shall utilize personnel who have the existing requisite experience, competence, and credentials prior to onboarding for this effort. The Government will not bear the expense to develop contractor competencies, obtain training, certifications or experiences.

PROJECT MANAGEMENT

CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, timeline, and tools to be used in execution of this TO effort. The purpose of this plan is to ensure that the Government and the Contractor understand and manage risk, communications, schedules, deliverables, quality, and human resources. The contractor shall ensure the CPMP take the form of both a narrative and graphic format to illustrate schedules, milestones, risks, and resource support. The CPMP shall also include procedures that detail how the Contractor will coordinate and execute plans, routines, and ad-hoc data collection and reporting requests as identified within the PWS. The initial baseline CPMP shall be approved by the government and kept current in accordance with Section B of the TO.

The Contractor shall update and maintain the VA Program Manager (PM) approved CPMP throughout the PoP. The contractor shall enable the government to access the CPMP and associated artifacts in VA SharePoint site or any other platform of the government’s choosing.

The CPMP shall be treated as a dynamic document, regularly reviewed and updated to reflect changing conditions, new information, and the Government’s emerging priorities. The contractor shall adopt a proactive approach to planning that ensures the CPMP remains relevant and a useful tool for guiding decision-making. The Contractor shall provide the COR with the CPMP within 10 business days after TO award and the CPMP shall be updated monthly thereafter.

The CPMP and subsidiary plans shall include the following:

1. Schedule Management Plan: Shall include GANTT charts and schedules of all planned deliverables.

2. Scope Management Plan: Shall describe how the contractor will control the activities and deliverables and the roles and responsibilities of everyone involved. The Schedule Management Plan shall also include:

a. Who has authority and responsibility for scope management.

b. How the scope is measured and verified (i.e., Quality Checklists, Scope Baseline, Work Performance Measurements, etc.)

c. Who is responsible for final acceptance of project scope and deliverables.

d. Organizational Chart

3. Staffing Management Plan: Shall illustrate and detail the arrangement of Management, Key and Support personnel assigned to the contract, as well as corporate reach-back for staff augmentation.

4. Quality Control Plan: Shall detail plan to establish a program to ensure all work products and deliverables meet the need of the Government, are accurate, free of errors or defects.

5. Performance Management Plan: The contractor shall outline how performance will be monitored and measured for acceptance by the government. This includes schedule adherence, effectiveness, and stakeholder satisfaction.

6. Communications Plan: Shall list the roles and contact information of all Management and key personnel both for the Contractor and Government, tasks and functional area assignments and associations.

7. Risk Management Plan: Shall detail all risks that may impact contract success, to include a common name or title, probability, impact, risk score, origin, explanation, planned or recommended mitigation.

8. Organization Chart (org chart) in Visio format for positions vacant and filled, which shall include names, locations, team assigned, role, tour of duty / shift as applicable, associated sub-contractors, reporting structure. The Contractor shall update the org chart monthly, as needed.

The contractor shall propose plan formats or templates that meet the Government’s requirements. VA may provide templates/shells for each plan and the VA PM will provide guidance to the Contractor on the necessary inputs/ information that are required to develop the outputs for each one of the subsidiary plans. The above list may be updated by VA to include additional subsidiary plans.

Deliverable:

A. Contractor Project Management Plan

CONTRACTOR PERSONNEL MANAGEMENT

The Contractor shall provide a Staffing Plan within three business days after award, following the requirements provided for each Section in the table below. The Contractor shall develop and present the Government with a Staffing Plan that includes the Labor Category (LCAT), resource function/role, resource name, status of background investigations, PWS Task Section affiliation, requirements (experience and/or certifications) met, physical location, and onboarding / offboarding status as well as any positions that do not yet have a candidate selected. The ability to sort and filter on all categories shall be reflected in the Staffing Plan. The staffing plan shall also include Key Personnel Positions (See PWS Section 5.1.8).

The contractor shall provide a Contractor Manpower Report to the COR. The report is due on a weekly basis during the Transition In period, and monthly thereafter. The report shall contain the following information for each person supporting this Task Order:

1. Name

2. Team Assigned

3. Role

4. Site Location

5. Contact Information

6. Start date

7. Separation date

8. In/ Out processing progress status details (to include all aspects)

9. Background investigation progress status and date released

10. VA required training completion dates

The Contractor, when notified of an unfavorably adjudicated background investigation on a Contractor employee as determined by the Government, shall withdraw the employee from consideration in working under the task order.

Deliverables:

A. Staffing Plan B. Contractor Manpower Report

Onboarding / Offboarding The Contractor shall provide dedicated support to manage Onboarding/Offboarding of contractor personnel who work under this TO. Onboarding/Offboarding shall be conducted through the VA Identity Management Toolkit portal as appropriate.

As part of this support, the Contractor shall ensure that all personnel who require access to network devices, servers, security devices and/or desktop systems shall possess industry standard knowledge and skill sets specific to the technology to be accessed with the prescribed experience defined in the below sections of the PWS. Where qualifications are not specifically called out, the Contractor shall provide resources adequately qualified to successfully perform the described functions.

Contractor Onboarding SOP shall include:

1. Scheduling appointments to submit electronic fingerprints.

2. Submitting request for Talent Management System (TMS) accounts.

3. Completing VA mandatory training for contractors

4. Coordinating completion of background request application using the Federal Electronic Questionnaires for Investigations Processing (e-QIP).

5. Completing and submit background investigation information and documents.

6. Coordinating Personal Identification Verification (PIV) card issuance activities.

7. Completing and submit system account request forms.

8. Ensuring computer issuance is properly coordinated with VA Asset Management Team with coordination through the COR/ VA PM.

9. Ensuring all efforts for in-processing are coordinated and communicated to the COR.

10. Retain a log of all onboarding activities for personnel assigned to this effort, which shall be made available to the COR upon request.

11. Completing and submitting documented requests for specific individuals who require elevated privilege to successfully execute this TO

Onboarding/offboarding VA Identity Management Toolkit portal link below:

https://mvitkssoi.iam.va.gov/imdquiWeb/provManagedUserAcctSelf.action?action=requestAccount The Contractor shall identify individuals who require elevated privileges to the necessary development and test environments for the product lines.

After review between the Contractor and VA COR(s), a decision will be made as to the necessity of obtaining GFE for the onboarding staff. If approved, Contractor shall follow the appropriate steps to obtain the equipment.

A Contract Lead (single Contractor Onboarding Point of Contact (POC)) shall be designated by the Contractor that performs onboarding/offboarding and tracks the onboarding status of all Contractor personnel. The Contractor Onboarding POC shall be responsible for accurate and timely submission of all required VA onboarding documents to the VA COR(s). All VA onboarding (non PII) documents shall be stored in the deliverables folder in the COR designated VA SharePoint site or equivalent tool. The Contractor Onboarding POC shall be responsible for tracking the status of all their staff’s onboarding activities to include the names of all personnel engaged on the task, their initial training date for VA Privacy and Information Security training, and their next required training date. The Contractor Onboarding POC shall also report the status of the staff level in the Biweekly Status Report.

The Contractor shall manage all the offboarding processes for access to VA individual system/environment access for all Contractor staff. The Contractor shall prepare all forms necessary for termination of access to VA information systems, in accordance with VA guidance and policies. The Contractor shall confirm via email to COR, VA Team Lead, and CO whether the GFE equipment, associated documentation, and PIV card has been returned to the proper receiving authorities in accordance with VA policy.

The Contractor shall perform the efforts required for offboarding Contractor personnel assigned to this effort as defined in the OIS Contractor Offboarding SOP, to include:

1. Sending out notifications of termination.

2. Removal access.

3. Withdrawing of physical access.

4. Collecting issued property (computer, two factor authentication tokens).

5. Returning PIV Card to PIV Sponsor.

6. Circulating checklist.

Deliverable:

A. On/Off-boarding Monthly Status Report including:

a. Name of contractor employee

b. Team

c. Title

d. Role (scope of work and responsibilities)

e. Start Date

f. Departure date

g. List of assigned VA assets including PIV & attestation that all were returned.

h. Attestation that all accesses (physical and logical) were revoked.

i. Confirmation that relevant knowledge was transferred, and status of pending tasks/deliverables were appropriately reassigned.

REPORTING REQUIREMENTS

The Contractor shall ensure that all reports, work products and deliverables submitted to the VA will be in accordance with the approved OIT/OIS style writing guide, and suitable for submitting to a non-technical senior management audience, and/or a technical audience.

The Contractor shall facilitate a weekly teleconference status meeting with the OIT OIS ISO SAVD staff to discuss progress against milestones, document issues, pending deliverables, and other pertinent topics concerning the task areas. During the weekly status meetings, the Contractor shall record the call, and create meeting minutes utilizing Microsoft Word. The Contractor shall provide Weekly Progress Reports which addresses, issues, risks, risk mitigation strategies progress against milestones and progress against schedules. Current risks shall be highlighted during weekly meetings. Past or mitigated risks shall be archived and available for later reference or review.

The Contractor shall ensure the minutes contain notes on all discussions, by topics and with details. The Contractor shall ensure that SAVD Management or Project Management Offices and applicable parties are informed of issues to prevent escalation.

The Contractor shall provide a weekly update of the Risk Management Plan to the Contracting Officer Representative. The risk management plan shall include a Risk Log, with acceptable template to be provided by the COR. The Contractor shall detail all risks that impact successful execution of the TO with acceptable template to be provided by the COR. This includes a common name or title of the status, issue category, issue number, issue description, area affected, date open, date closed, risk identified, recommended mitigation, notes/next actions.

The Contractor shall provide a consolidated monthly deliverable acceptance report, due no later than the 15th of each month. (Alternatively due on the first Monday of each month if the 15th falls on a weekend). The report shall be delivered in pdf writable form to the COR. The COR will provide minimal content for the deliverable acceptance report. The Contractor shall route the deliverable acceptance report to Government task leads or subject matter experts for acceptance signatures before providing to the COR.

Deliverables:

A. Risk Management Plan B. Consolidated Deliverable Acceptance Report

TECHNICAL KICKOFF MEETING

The contractor shall facilitate a technical kickoff meeting 10 days after TO award. The technical kickoff meeting shall be onsite at a VA facility (location to be determined, or remotely (virtual), at the government’s discretion). The Contractor shall coordinate the date, time, and location with the Contracting Officer (CO), as the Post-Award Conference Chairperson, the VA PM (Co-Chairperson), the Contract Specialist (CS), the COR, and OIT OIS ISO SAVD Leadership. The Contractor shall provide a draft agenda to the CO, the COR and the VA PM at least five calendar days prior to the meeting. Upon Government approval of a final agenda, the Contractor shall distribute the final version to all meeting attendees. During the kickoff meeting, the Contractor shall present, for review and approval by the Government, the details of the intended approach, work plan, and project schedule for each effort via a Microsoft Office PowerPoint presentation. At the conclusion of the meeting, the Contractor shall update the presentation with a final slide entitled “Summary Report” which shall include notes on any major issues, agreements, or disagreements discussed during the kickoff meeting and the following statement “As the Post-Award Conference Chairperson, I have reviewed the entirety of this presentation and assert that it is an accurate representation and summary of the discussions held during the Technical Kickoff Meeting for the Technical Evaluation Security Testing (TEST) contract.” The Contractor shall submit the final updated presentation to the CO for review and signature within three calendar days after the meeting. The Contractor shall coordinate with the CS, prepare and distribute the Technical Kickoff Meeting minutes to the CO, COR, and all attendees within three calendar days after the meeting. The Contractor shall obtain concurrence from the CS on the content of the Meeting Minutes prior to distribution of the document.

Deliverables:

A. Technical Kick-off B. Draft Agenda C. Presentation Slides and Summary Report D. Approved Meeting Minutes

VA TRAINING

The Contractor shall ensure all Contractor personnel engaged on this effort complete VA-required and -provided training before their due dates. The current core requirements include VA Privacy and Information Security Awareness Training and Rules of Behavior Status. Role-based specific training of equivalent complexity may also be required. VA has the right to modify the training requirements. Completion of these training requirements are required during the onboarding of personnel and required before individuals start working under this TO.

The Contractor shall submit VA Privacy and Information Security Training Certificates for each Contractor employee in accordance with Section 9, Training, from Appendix C of the VA Handbook 6500.6, “Contract Security”. The contractor shall ensure that training referenced above is renewed annually by each contractor staff member.

The Contractor shall provide VA COR with progress and completion status of VA Privacy and Information Security Awareness Training and Rules of Behavior in the form of a Training Status Report. The Training Status Report shall convey the following: first and last name of all Contractor personnel engaged on the effort, their initial training completion date(s), next required training date. The training status report and completion certificates shall be maintained by the Contractor in a VA provided central location.

The Contractor shall provide a Quarterly Staff Certification Report that track and report all industry certifications held and obtained by Contractor staff on a quarterly basis, the first business day of each quarter, and upon new hire onboarding.

Deliverable:

A. Training Status Report B. Quarterly Staff Certification Report

SURGE SUPPORT PLANNING

VA SAVD may be tasked by VA leadership to rapidly respond to current and future changes in organizational objectives, legislative mandates, or other critical needs.

The Contractor shall plan or provide planning support for VA SAVD surge efforts as detailed in Section 5.7 (Optional Task One) with a dedicated team to perform information system enhancements to meet these new requirements. The surge support planning may involve interpreting potentially new regulations and translating them into requirements (requirements elaboration), coordinating and implementing new solution deliveries, and/or development of solutions for special high-interest projects assigned to the VA SAVD organization.

The Contractor shall submit a Surge Plan for all task areas to account for how the Contractor shall continue to support VA SAVD while responding to events that require short term elevated level of effort. The Contractor shall provide the Government with a preliminary Surge Plan which meets all tasks in the PWS 30 days prior to completing the Transition-In phase. The plan shall include items such as secondary skillset dispersion, ensuring primary tasks are not neglected or delayed due to insufficient staffing levels. After the initial acceptance, the plan shall be provided on the first business day of each fiscal year quarter to the Government for acceptance.

Deliverable:

A. Surge Plan

KEY PERSONNEL

All personnel performing work on this TO shall possess experience, and competency in the disciplines and functional areas described in each task related to the design, analysis, engineering, operation, and security of VA. All personnel shall have knowledge of NIST security controls and possess sufficient understanding of industry standards to successfully execute vulnerability scanning, penetration testing, and red team operations.

It is the responsibility of the Contractor to provide Contractor support personnel and subcontractors who have the required background, certifications, experience, VA and/ or DoD security clearance (when authorized), and access authorization or combination thereof to meet the requirements in the PWS.

If any change to personnel, the Contractor shall immediately notify the CO and COR/ VA PM in writing. The Contractor shall propose replacement personnel who shall be of at least equal in ability and qualifications as the individuals currently performing in that role within 30 days.

All key personnel positions shall be filled 30 days after award.

Table 1 Key Personnel Required Experience/Knowledge

Risk and Vulnerability Analyst, Senior

Sr, Software Developer

PROGRAM MANAGEMENT SUPPORT

The Contractor shall identify at least one Program Manager (PgM). The Contractor PgM shall perform the following: Provide technical supervision and guidance for all Contractor personnel assigned to their respective areas on the TO. Maintain an awareness of all efforts under this TO and demonstrate leadership in a pioneering and dynamic organization. Remain engaged with VA Leads to ensure all goals, initiatives, tasks, and workflows are known, understood, and implemented. Ensure adequate personnel are available to accomplish required work. Perform quality control of work production.

The Contractor shall provide a Weekly Contract Health Review to include staffing issues and statuses, SLA metrics and trending, along with any other issues the PM has been involved in to include any specific items that VA COR or SAVD management have requested through closure. This will be presented in a meeting as a briefing and accompanied by an ongoing updated report and minutes.