P09 - Draft PWS Low Earth Orbit at RFI.docx

Low Earth Orbit (LEO) Internet Services

VA-24-00019830

PERFORMANCE WORK STATEMENT (PWS) DEPARTMENT OF VETERANS AFFAIRS

Office of Information & Technology Core Provisioning, Mobility Services (CPMS) Low Earth Orbit (LEO) Internet Services

Date: March 6, 2024

VA-24-00019830

PWS Version Number: 1.2

Contents

1. BACKGROUND

The Department of Veterans Affairs (VA), Office of Information & Technology (OIT), Connectivity & Collaboration Services (CCS), Core Provisioning, Mobility Services (CPMS) team strives to provide high quality, effective, and efficient mobile device services to VA Medical Centers (VAMCs), Community Based Outpatient Clinics (CBOCs), field and program offices and other remote users that are geographically dispersed throughout the United States (US), Guam, Saipan, American Samoa, Philippines, and Puerto Rico. These services include continuous mobile Telecommunications services to VA facilities within the geographic areas identified herein. Low Earth Orbit (LEO) Internet Services for both mobile and fixed sites.VA initiated Starlink test pilot for 11 fixed sites.

VA has a requirement to obtain commercially available fixed and mobile LEO Satellite Internet DATA services for the purpose of disaster recovery, emergency management, and rapid deployment as required.

2. APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

44 U.S.C. § 3541-3549, “Federal Information Security Management Act (FISMA) of 2002” “Federal Information Security Modernization Act of 2014” Federal Information Processing Standards (FIPS) Publication 140-2, “Security Requirements for Cryptographic Modules” FIPS Pub 199. “Standards for Security Categorization of Federal Information and Information Systems,” February 2004 FIPS Pub 200, “Minimum Security Requirements for Federal Information and Information Systems,” March 2006 FIPS Pub 201-2, “Personal Identity Verification of Federal Employees and Contractors,” August 2013 10 U.S.C. § 2224, "Defense Information Assurance Program" 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974.”

Public Law 109-461, Veterans Benefits, Health Care, and Information Technology Act of 2006, Title IX, Information Security Matters 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964” VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, https://www.va.gov/vapubs/index.cfm VA Handbook 0710, “Personnel Security and Suitability Program,” May 2, 2016, https://www.va.gov/vapubs/index.cfm VA Directive and Handbook 6102, “Internet/Intranet Services,” August 5, 2019 36 C.F.R. Part 1194 “Information and Communication Technology Standards and Guidelines,” January 18, 2017 Office of Management and Budget (OMB) Circular A-130, “Managing Federal Information as a Strategic Resource,” July 28, 2016 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed Services (CHAMPUS)” NIST SP 800-66 Rev. 1, “An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule,” October 2008 Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended, January 18, 2017 Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004 VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021 VA Handbook 6500, “Risk Management Framework for VA Information Systems VA Information Security Program,” February 24, 2021 VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI),” March 12, 2019 VA Handbook 6500.5, “Incorporating Security and Privacy into the System Development Lifecycle,” March 22, 2010 VA Handbook 6500.6, “Contract Security,” March 12, 2010 VA Handbook 6500.8, “Information System Contingency Planning,” April 6, 2011 VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018 VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017 OIT Process Asset Library (PAL), Welcome to the Office of Information and Technology (OIT) Process Asset Library Website (va.gov). Process Maps - Welcome to the Office of Information and Technology (OIT) Process Asset Library Website (va.gov) and Process Asset Library - Welcome to the Office of Information and Technology (OIT) Process Asset Library Website (va.gov) One-VA Technical Reference Model (TRM) (reference at Home Page (va.gov)) VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014 VA Handbook 6508.1, “Procedures for Privacy Threshold Analysis and Privacy Impact Assessment,” July 30, 2015 VA Handbook 6510, “VA Identity and Access Management,” January 15, 2016 VA Directive and Handbook 6513, “Secure External Connections,” October 12, 2017 VA Directive 6300, “Records and Information Management,” September 21, 2018 VA Handbook, 6300.1, “Records Management Procedures, “March 24, 2010 NIST SP 800-37 Rev 2, “Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy,” December 2018 NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020) VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015 VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” March 24, 2014 OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005 OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019 OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008 Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance, December 2, 2011, (NOTE: Part A of the FICAM Roadmap and Implementation Guidance, v2.0, was replaced in 2015 with updated Architecture (https://arch.idmanagement.gov/#what-is-the-ficam-architecture) NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access, “June 2018 NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, “Digital Identity Guidelines,” updated March 02, 2020 NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014 NIST SP 800-164, “Guidelines on Hardware-Rooted Security in Mobile Devices (Draft),” October 2012 Draft National Institute of Standards and Technology Interagency Report (NISTIR) 7981, “Mobile, PIV, and Authentication,” March 2014 VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference Document Library (va.gov)) IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference Document Library (va.gov)) VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896 Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019 OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008 Sections 524 and 525 of the Energy Independence and Security Act of 2007, (Public Law 110–140), December 19, 2007 Section 104 of the Energy Policy Act of 2005, (Public Law 109–58), August 8, 2005 Executive Order 13834, “Efficient Federal Operations,” dated May 17, 2018 Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 2, 2001 VA Directive 0058, “VA Green Purchasing Program,” July 19, 2013 VA Handbook 0058, “VA Green Purchasing Program,” July 19, 2013 Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103 “Veteran Focused Integration Process (VIP) Guide 4.0,” January 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371 VA Memorandum “Proper Use of Email and Other Messaging Services,” January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 “DevSecOps Product Line Management Playbook” version 2.0, May 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946 NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020 OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol Version 6 (IPv6),” November 19, 2020 Social Security Number (SSN) Fraud Prevention Act of 2017 Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23, 2018

3. SCOPE OF WORK

VA, OIT, CCS, CPMS requires brand name Space X Starlink LEO services, or equal. The Contractor shall provide all transmission facilities, equipment, materials, travel, installation and deinstallation/removal of hardware along with optional accessories, testing, maintenance, 24/7/365 monitoring and support for mobile and fixed sites. Provide validation assessment of coverage and operability of LEO services. These services shall include any special items, equipment, wiring or infrastructure to ensure the Contractor's solution is compatible with the Government's current telecommunications infrastructure at the VA facilities. The contractor shall absorb 11 existing fixed Starlink locations (listed in attachment A SDP’s) without interruption of service.

The Contractor shall provide troubleshooting and sustainment of the LEO Internet Services connectivity up to its termination point, emergency support during declared disasters, program management support, transition plans delineating the Phase-In and Phase-Out approaches, vulnerability remediation, on-site training, and support, remote training and support, and help desk services. Vendor shall provide helpdesk services and portal network monitoring capabilities.

4. PERFORMANCE PERIOD

The period of performance (PoP) shall be for 60 months with five 12-month ordering periods. Installation, maintenance, and disconnection of services shall take place between 8:00 AM to 4:30 PM (Local Time), Monday through Friday, excluding Federal holidays. Any work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO). If required, the CO may designate the Contractor to work during holidays and weekends.

There are Eleven (11) Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, five are set by date:

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

5. PLACE OF PERFORMANCE

Tasks under this PWS shall be performed at both Vendor and VA facilities.

The Tasks under this PWS that shall be performed at VA facilities. Locations are listed in Attachment A Service Delivery Points (SDP).

6. OTHER DIRECT COSTS (ODCs) (ALL ORDER TYPES) ODCs may consist of software, materials, and Task Order-related items that are incidental to the services being performed. The cost of general-purpose items required for the conduct of the Contractor’s normal business operations will not be considered an allowable ODC in the performance of this Contract. Profit is not allowed on ODCs for any Task Order; however, applicable burdens are allowed in accordance with Contractor’s established accounting practices. If applicable, the CO must identify a not-to-exceed ODC ceiling under a separate CLIN on the Task Order.

7. REPORTING REQUIREMENTS

The Contractor shall provide the COR with Monthly Progress Reports in electronic form in Microsoft Word and Project formats. The report shall include detailed instructions/explanations for each required data element, to ensure that data is accurate and consistent. These reports shall reflect data as of the last day of the preceding month.

The Monthly Progress Reports shall cover all work completed during the reporting period and work planned for the subsequent reporting period. The report shall also identify any problems that arose and a description of how the problems were resolved. If problems have not been completely resolved, the Contractor shall provide an explanation including their plan and timeframe for resolving the issue. The report shall also include an itemized list of all Information and Communication Technology (ICT) deliverables and their current Section 508 conformance status. The Contractor shall monitor performance against the CPMP and report any deviations. It is expected that the Contractor shall keep in communication with VA accordingly so that issues that arise are transparent to both parties to prevent escalation of outstanding issues. The Monthly Progress Report shall be provided on the third business day of each month.

7. Deliverables:

7.0.1. Monthly Progress Report

7.0.2. Network Operations Monitoring

7.0.3. User near real-time usage reporting

7.0.4. Service Availability Reporting

7.0.5. Service Activation Reporting

7.0.6. Monthly Status Reporting

7.0.7. Quarterly Usage Report

7.0.8. Fault and Service Outage Reporting

7.0.9. Incident Reporting

7.0.10. Task Order Reporting

8. KICKOFF MEETINGS

The Contractor shall hold a kickoff meeting within 10 business days after award unless otherwise specified. At a minimum, the Contractor shall present, for review and approval by the Government, the details of the intended approach, work plan, and project schedule for each effort. Dates, locations (can be virtual), and agenda shall be specified at least five calendar days prior to the meeting. The CO, Contract Specialist (CS), COR, and VA PM shall be invited at a minimum. The Contractor shall produce and distribute the kickoff meeting minutes identifying the key discussion points and action items. The Contractor shall deliver the kickoff meeting minutes to the COR within five business days after the kickoff meeting. The Contractor shall produce an escalation matrix that identifies technical support points of contacts and includes instructions on how to escalate issues via phone or email.

8. Deliverables:

8.1.1.1. Kickoff Meeting Minutes

8.1.1.2. Escalation Matrix

8.1.1.2.1. Recurring Data Services

9. SERVICE TYPES AND FEATURES

The Contractor shall provide high speed transmission rates and maintenance of LEO Satellite Network with 24/7/365 connectivity where commercially available at:

9. A minimum of 100 megabit per second (Mbps) downlink.

9. A minimum of 20 Mbps uplink.

9. Tiered data packages to include unlimited data at a fixed rate for both the fixed and mobile site.

9. Network management and reporting.

9. Dashboard or some diagnostics tool for user level network management.

10. PRIORITY 2 – SERVICE DEGRADED

Service Degraded means VA’s workflow is not seriously affected or limited. The Contractor repair technician shall respond to all Service Degraded reports within four hours. Status notifications shall be provided to VA local POC as identified by award, every business day via telephone until restored. The fault shall not return for 30 calendar days or it shall be considered a continuation of the original fault.

11. EXCLUSIONS

During scheduled maintenance of the Service, the Contractor shall notify the COR within three business days of the maintenance window and describe in detail how long and to what level degraded service is to be expected. The Contractor shall obtain approval in advance from the COR before scheduled maintenance occurs.

12. SPECIFIC TASKS AND DELIVERABLES

The contractor shall provide and/or acquire the services, hardware, and software required by individual TOs pursuant to the requirements specified below throughout the contract period of performance.

The contractor shall furnish a copy of the valid, current Federal Communication Commission or other applicable regulatory filings for all LEO constellations and services provided prior to offering services under this PWS.

Individual TOs may encompass one or more of the tasks below. Specific task requirements are not mutually exclusive and may apply across multiple tasks. Specific requirements will be detailed in individual TOs. Standards for task performance are defined in section 5.8 "Performance Standards" below.

12. Task 1 - Operational Packaged LEO Service The contractor shall provide operational packaged LEO services. This service shall consist of various service offerings provided as end-to-end managed services that mirror the contractor’s commercial offerings.

Each service provided under this task shall be documented by a Service Level Agreement (SLA) that specifies pertinent threshold and objective performance parameters of the service to which the contractor shall commit. Such parameters may include, without limitation, minimum guaranteed data throughput or product/effect delivery frequency, maximum permitted data throughput or product/effect delivery frequency, maximum guaranteed data or product/effect latency, minimum guaranteed service availability percentage, and useful combinations of those and other such parameters.

Proposed operational packaged LEO services not available at the time of initial contract award, shall be available from the contractor within 36 months of contract award.

12. Task 2 - Operational Customer Specific LEO Service The service provided under this section shall conform to the requirements stated in the TO for the operational customer specific services. These services will be purchased in response to a specific end-user requirement and may differ in functions, performance, connectivity and equipment from the operational packaged LEO services.

Operational customer specific LEO services shall be deemed acceptable for VA’s operational requirements prior to award of a task order for those services. This permission is predicated on the contractor’s operational requirements of this PWS and the ability of those services to be provided in a manner appropriate for VA’s operational mission requirements.

12. Task 3 - Initial, Limited Use LEO Service (Optional) If offered on a task order, the contractor shall provide trial or demonstration capabilities and capacity to the Government prior to the commercial operational capability of the host constellation. Services furnished may include but are not limited to airtime, data products, end-to-end demonstration managed services or segments of service, network interconnects, platform and network integration services, business services including billing, system/network status, customer care, engineering, support, and other services and equipment in support of Government trail and limited use demonstrations of contractor’s services and systems.

The objective of the initial, limited use service is to provide an opportunity for the Government to evaluate the commercial service offerings and determine its suitability for various operational scenarios and requirements. This service shall be used exclusively for evaluation purposes and shall not support mission or mission critical functions at any time.

Initial, limited use LEO services shall be available for activation within 12 months of contract award.

12. Task 4 - Equipment If compatible equipment is required to utilize the service, the contractor shall ensure the availability of such equipment for purchase by the Government, as specified in the task order.

12. General Requirements The contractor shall provide the equipment based on task order requirements.

12. Equipment Shipment Under standard shipping timelines and terms, the contractor shall ship equipment as defined in each TO. To ensure VA requirements are filled, two additional expedited shipping requirements are included: 2-day and overnight.

Unless specifically indicated in the TO, all deliveries shall follow the standard shipping requirement. Equipment shall be delivered as described in the TO. If the shipment time for a particular TO cannot be met, the contractor shall immediately notify the Contracting Officer (as listed on the TO), and the customer with an explanation and a plan of action to resolve the problem. The delay shall also be reported for the appropriate month in the Monthly Status Report.

The contractor shall include applicable shipping charges as a one-time other direct cost (ODC) for the shipping categories listed in Table 13.11. The contractor shall ensure that packing meets the requirements of the shipper, and that packaging/packing is sufficient to prevent damage. The contractor shall ensure the shipment is receivable at Government locations. The contractor shall replace lost or damaged shipments and re-ship via an acceptable carrier if the shipment cannot be received at the Government location. All packages shall be trackable, and the tracking number shall be provided to the Government upon shipment.

All shipments, either single or multiple container deliveries, shall bear the VA Task Order number on external shipping labels and associated manifests or packing lists. In the case of multiple container deliveries, a statement readable near the VA Task order number shall indicate total number of containers for the complete shipment (e.g., “Package 1 of 2”), clearly readable on manifests and external shipping labels.

TABLE SHIPPING TIMELINES

All shipments, CONUS or OCONUS shall be “Free on Board – Destination” or “FOB-Destination”.

12. Equipment Warranties Contractor shall offer commercial standard warranty for all equipment provided. All warranties shall be included in the price of the item or device. Warranty coverage shall begin coverage on the date the Government received the item any warranty that extends beyond the last date to place orders under this contract shall extend until the warranty’s standard end date. A CONUS return shipping address shall be provided for all warranty return items.

13. Training www.

14. CONTRACTOR PROJECT MANAGEMENT PLAN

14. The Contractor shall perform the following:

14.14.1. Contractor Project Management Plan, to include current test equipment service without interruption, laying out the Contractor’s approach, timelines to accomplish each task in the PWS, and tools to be used in execution of the contract. The CPMP shall take the form of both a narrative and graphic format that displays the schedule, milestones, risks, and resource support. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPMP shall be concurred during the kickoff meeting and updated monthly thereafter. The Contractor shall update and maintain the VA Project Manager (PM) approved CPMP throughout the period of performance.

14.14.2. Operations & Maintenance Contractor sustainment Plan for LEO Commercial Satellite Communications Services

14.14.3. Warranty

14.14.4. Portal that provides near real time data

14.14.5. Data used by each terminal and data pool.

14.14.6. Network availability

14.14.7. Data limit warnings

14.14.8. Visibility of traffic type

14.14.9. Help Desk Ticket Tracker, ticket number, description of issue, weekly status update,

14.14.10. Equipment Deliverables

14.14.10.1. Fixed Terminal for install on or near supported building. Terminal must be installed in a way that does not permanently damage the facility and can be uninstalled and allows for easy access of equipment for maintenance.

14.14.10.2. Mobile terminal to be installed on vehicles in a manner compliant with vehicle vendor warranty. Install must be removable and allow easy access that supports maintenance. Once installed height of vehicle must not exceed 13.5 Feet.

14.14.10.3. Manned portable LEO terminal, Ruggedized case, weight not to exceed 90 Lbs. with wheels and telescoping handle.

14.14.10.4. cart based terminal able to be transported via a 2in hitch receiver.

14.14.11. Program management support.

14.14.12. Transition plans delineating the Phase-In and Phase-Out approaches.

14.14.13. Support hardware and software maintenance.

14.14.14. Vulnerability remediation.

14.14.15. Support on-site and remote training.

14.14.16. Perform updates/replacements of hardware and software.

14.14.17. Remote and on-site support.

14.14.18. Help desk services.

14.14.19. Conduct equipment installation, mobile and fixed sites

14.14.20. Site Survey for fixed and mobile locations.

14.14.21. Installation for fixed and mobile locations.

14.14.22. Integrate 11 current fixed locations into new contract.

The contractor shall provide weekly updates via VA’s secure file transfer portal and electronic delivery to deliver and install mobile and fixed terminals. Also, establish a detailed project schedule with milestones and deadlines.

15. ESTABLISHMENT OF SERVICES

Requirements for access to VA facilities shall include the following:

Normal hours of operation at VA facilities are 8:00 AM to 4:30 PM (Local Time) except the Network Operations Center (NOC) which is open 24/7. Access after normal administrative hours shall be coordinated and approved with each site.

The Contractor shall provide the LEO Internet services 24 hours a day, 7 days a week, 365 days a year. Services shall include all non-recurring charges specific to the facility. Service that is provided under a fixed period service pricing plan may be changed in speed or capacity, or may be converted to another service, without incurring a discontinuance charge.

The Contractor shall seek permission and schedule via the COR entrance to the Government facility for the purpose of installing, inspecting or repairing of the facilities, or upon termination of the service, for the purpose of removing Contractor equipment. The Contractor shall notify the COR within one business day if access is not obtained.

Exclusions During scheduled maintenance of the Service, the Contractor shall notify the COR within three business days of the maintenance window and describe in detail how long and to what level degraded service is to be expected. The Contractor shall obtain approval in advance from the COR before scheduled maintenance occurs.

MEAN TIME TO RESTORE (MTTR)

MTTR is the average time for the Contractor to restore the service during a service outage in a billing month.

The Contractor shall provide technical support/resolution during established business hours to assist VA with issues pertaining to the outages. MTTR times begin when the Contractor receives a support request from VA. The Contractor shall respond to VA’s support requests according to the following fault classifications.

Routine: One calendar day for outage and 72 hours for degraded service from the time the Contractor confirms receipt of the VA’s outage notification Serious: 12 hours from the time the Contractor confirms receipt of the VA’s outage notification.

Catastrophic TTR: shall be three (3) hours for outage from the time the Contractor confirms receipt of the VA’s outage notification.

16. CONTRACTOR CUSTOMER SUPPORT

The Contractor shall use an Escalation Process to resolve customer service issues and provide a single POC for each issue or dispute. The Contractor shall provide the COR an Escalation Process 14 calendar days after contract award outlining the specific steps taken to resolve customer service issues. The escalation list shall be updated within 30 calendar days after any change of contractor key personnel.

The Contractor shall provide the COR a Customer Support Organization Chart containing employee names, email addresses, and direct phone numbers.

The Contractor shall provide technical Help Desk support. Technical Help Desk support is required 24 hours a day, 7 days a week, and 365 days year. A manned tollfree number shall be designated as the primary help number for VA to call to report a problem and have a Trouble Ticket assigned. Automated answering or ticket automation service shall not be an acceptable solution. The Contractor’s customer service representative shall be located in the Continental United States (CONUS) and also be fluent in spoken and written English. A Trouble Ticket is the method used by the Government to advise the Help Desk of a perceived fault, including a service outage or a failure to meet SLA. A unique Trouble Ticket reference number shall be given to the Government representative and also used each time the Government calls in to the Help Desk for any fault update or, if appropriate, to inform the Contractor of restoration of the service.

The Contractor shall provide the COR a monthly report of Help Desk trouble tickets at the completion of each billing cycle. The Help Desk report shall contain all tickets opened during the billing cycle and shall include a list of trouble ticket numbers and the circuits effected, reporting location, time of trouble ticket report, time of service restoration, and description of fault and resolution of fault.

Deliverables:

16.14.23. Escalation Process Plan

16.14.24. Customer Support Organization Chart

16.14.25. Monthly Help Desk Report

16.14.26. QoS (Quality of Services)

17. MAINTENANCE PERFORMANCE

The Contractor shall obtain the approval of the VA Facility Telecommunications Manager (TM) prior to starting any work that will cause a service outage). The Contractor shall notify the COR and VA Facility TM, if work needs to be performed outside of normal business hours, a minimum of three business days before the work is to begin (except in the case of Trouble Ticket repair). The Contractor shall receive approval from the VA Facility TM prior to commencement of either intrusive testing or contractor actions which may affect service quality.

The Contractor shall clean up all work areas immediately after completing work in VA facilities, including removal and disposal of defective vendor equipment (Non-VA equipment). The Contractor shall notify VA when any service request, repair, or maintenance is completed. Notification shall be by telephone call or email to the VA local technical contact. The service request, repair, or maintenance is not considered complete until a VA Facility point of contact confirms that the completion of service is acceptable.

18. GENERAL REQUIREMENTS

18. ENTERPRISE AND IT FRAMEWORK

18.15.1. VA TECHNICAL REFERENCE MODEL

The Contractor shall support the VA enterprise management framework. In association with the framework, the Contractor shall comply with OIT Technical Reference Model (VA TRM). The VA TRM is one component within the overall Enterprise Architecture (EA) that establishes a common vocabulary and structure for describing the information technology used to develop, operate, and maintain enterprise applications. Moreover, the VA TRM, which includes the Standards Profile and Product List, serves as a technology roadmap and tool for supporting OIT. Architecture & Engineering Services (AES) has overall responsibility for the VA TRM.

18.15.2. FEDERAL IDENTITY, CREDENTIAL, AND ACCESS MANAGEMENT (FICAM)

The Contractor shall ensure Commercial Off-The-Shelf (COTS) product(s), software configuration and customization, and/or new software are Personal Identity Verification (PIV) card-enabled by accepting HSPD-12 PIV credentials using VA Enterprise Technical Architecture (ETA), https://www.ea.oit.va.gov/EAOIT/VA_EA/Enterprise_Technical_Architecture.asp, and VA Identity and Access Management (IAM) approved enterprise design and integration patterns, https://www.oit.va.gov/library/recurring/edp/index.cfm. The Contractor shall ensure all Contractor delivered applications and systems comply with the VA Identity, Credential, and Access Management policies and guidelines set forth in VA Handbook 6510 VA Identity and Access Management, VA Handbook 0735 Homeland Security Presidential Directive 12 (HSPD-12) Program, and align with the Federal Identity, Credential, and Access Management Roadmap and Implementation Guidance v2.0.

The Contractor shall ensure all Contractor delivered applications and systems provide user authentication services compliant with the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-63-3, VA Handbook 6500 Appendix F, “VA System Security Controls”, and VA IAM enterprise requirements for direct, assertion-based authentication, and/or trust-based authentication, as determined by the design and integration patterns. Direct authentication at a minimum must include Public Key Infrastructure (PKI) based authentication supportive of PIV card and/or Common Access Card (CAC), as determined by the business need.

The Contractor shall ensure all Contractor delivered applications and systems conform to the specific Identity and Access Management PIV requirements set forth in the Office of Management and Budget (OMB) Memoranda M-05-24, M-19-17, and NIST Federal Information Processing Standard (FIPS) 201-2. OMB Memoranda M-05-24 and M-19-17 can be found at: https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2005/m05-24.pdf, and https://www.whitehouse.gov/wp-content/uploads/2019/05/M-19-17.pdf respectively. Contractor delivered applications and systems shall be on the FIPS 201-2 Approved Product List (APL). If the Contractor delivered application and system is not on the APL, the Contractor shall be responsible for taking the application and system through the FIPS 201 Evaluation Program.

18.15.2.1. The Contractor shall ensure all Contractor delivered applications and systems support:

18.15.2.1.1. Automated provisioning and are able to use enterprise provisioning service.

18.15.2.1.2. Interfacing with VA’s Master Person Index (MPI) to provision identity attributes, if the solution relies on VA user identities. MPI is the authoritative source for VA user identity data.

18.15.2.1.3. The VA defined unique identity (Secure Identifier [SEC ID] / Integrated Control Number [ICN]).

18.15.2.1.4. Multiple authenticators for a given identity and authenticators at every Authenticator Assurance Level (AAL) appropriate for the solution.

18.15.2.1.5. Identity proofing for each Identity Assurance Level (IAL) appropriate for the solution.

18.15.2.1.6. Federation for each Federation Assurance Level (FAL) appropriate for the solution, if applicable.

18.15.2.1.7. Two-factor authentication (2FA) through an applicable design pattern as outlined in VA Enterprise Design Patterns.

18.15.2.1.8. A Security Assertion Markup Language (SAML) implementation if the solution relies on assertion-based authentication. Additional assertion implementations, besides the required SAML assertion, may be provided as long as they are compliant with NIST SP 800-63-3 guidelines.

18.15.2.1.9. Authentication/account binding based on trusted Hypertext Transfer Protocol (HTTP) headers if the solution relies on Trust based authentication.

18.15.2.1.10. Role Based Access Control.

18.15.2.1.11. Auditing and reporting capabilities.

18.15.2.1.12. Compliance with VIEWS 00155984, PIV Logical Access Policy Clarification https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896 The required Assurance Levels for this specific effort are Identity Assurance Level 3, Authenticator Assurance Level 3, and Federation Assurance Level 3.

18.15.3. INTERNET PROTOCOL VERSION 6 (IPV6)

The Contractor solution shall support Internet Protocol Version 6 (IPv6) based upon the memo issued by the Office of Management and Budget (OMB) on November 19, 2020 (https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-07.pdf). IPv6 technology, in accordance with the USGv6 Program (https://www.nist.gov/programs-projects/usgv6-program/usgv6-revision-1), NIST Special Publication (SP) 500-267B Revision 1 “USGv6 Profile” (https://doi.org/10.6028/NIST.SP.500-267Br1), and NIST SP 800-119 “Guidelines for the Secure Deployment of IPv6” (https://doi.org/10.6028/NIST.SP.800-119), compliance shall be included in all IT infrastructures, application designs, application development, operational systems and sub-systems, and their integration. In addition to the above requirements, all devices shall support native IPv6 and dual stack (IPv6 / IPv4) connectivity without additional memory or other resources being provided by the Government, so that they can function in a mixed environment. All public/external facing servers and services (e.g., web, email, DNS, ISP services, etc.) shall support native IPv6 and dual stack (IPv6 / IPv4) users and all internal infrastructure and applications shall communicate using native IPv6 and dual stack (IPv6 / IPv4) operations.

18.15.4. TRUSTED INTERNET CONNECTION (TIC)

The Contractor solution shall meet the requirements outlined in Office of Management and Budget Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative“ (https://www.whitehouse.gov/wp-content/uploads/2019/09/M-19-26.pdf), VA Directive 6513 “Secure External Connections”, and shall comply with the TIC 3.0 Core Guidance Documents, including all Volumes and TIC Use Cases, found at the Cybersecurity & Infrastructure Security Agency (CISA) (https://www.cisa.gov/publication/tic-30-core-guidance-documents). Any deviations must be approved by the VA TIC 3.0 Working Group at vaoisesatic30team@va.gov.

18.15.5. STANDARD COMPUTER CONFIGURATION

The Contractor IT end user solution that is developed for use on standard VA computers shall be compatible with and be supported on the standard VA operating system, currently Windows 10 (64bit), Edge (Chromium based), and 365 Apps for enterprise. Applications delivered to VA and intended to be deployed to Windows 10 workstations shall be delivered as a signed .msi package with switches for silent and unattended installation and updates shall be delivered in signed .msp file formats for easy deployment using Microsoft Endpoint Configuration Manager (CM) VA’s current desktop application deployment tool. Signing of the software code shall be through a vendor provided certificate that is trusted by VA using a code signing authority such as Verizon/Cybertrust or Symantec/VeriSign. The Contractor shall also ensure and certify that their solution functions as expected when used from a standard VA computer, with non-admin, standard user rights that have been configured using the United States Government Configuration Baseline (USGCB) and Defense Information Systems Agency (DISA) Secure Technical Implementation Guide (STIG) specific to the particular client operating system being used.

18.15.6. VETERAN FOCUSED INTEGRATION PROCESS (VIP) AND PRODUCT LINE MANAGEMENT (PLM) The Contractor shall support VA efforts IAW the updated Veteran Focused Integration Process (VIP) and Product Line Management (PLM). The major focus of the new VIP is on Governance and Reporting and is less prescriptive, with a focus on outcomes and continuous delivery of value. Product Line Management (PLM) is a framework that focuses on delivering functional products that provide the highest priority work to customers while delivering simplified, reliable, and practical solutions to the business, medical staff, and our Veterans. The VIP Guide is a companion guide to the PLM Playbook and can be found at: https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371 and the PLM Playbook can be found at https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946. The PLM Playbook pivots from project-centric to product-centric delivery and contains descriptive practices that focuses on outcomes. The PLM Playbook contains a set of “plays” that implement Development, Security, and Operations (DevSecOps) principles and processes such as automated development, continuous integration/continuous delivery, and release on demand. The PLM Playbook details how product lines implement Lean-Agile principles, methods, practices, and techniques through levels of maturity. VIP and PLM are the authoritative processes that IT projects must follow to ensure development and delivery of IT products.

18.15.7. PROCESS ASSET LIBRARY (PAL)

The Contractor shall perform their duties consistent with the processes defined in the OIT Process Asset Library (PAL). The PAL scope includes the full spectrum of OIT functions and activities, such as VIP project management, operations, service delivery, communications, acquisition, and resource management. PAL serves as an authoritative and informative repository of searchable processes, activities or tasks, roles, artifacts, tools and applicable standards and guides to assist the OIT workforce, Government and Contractor personnel. The Contractor shall follow the PAL processes to ensure compliance with policies and regulations and to meet VA quality standards. The PAL includes the contractor onboarding process consistent with Section 6.2.2 and can be found at https://www.va.gov/PROCESS/artifacts/maps/process_CONB_ext.pdf. The main PAL can be accessed at www.va.gov/process.

18.15.8. AUTHORITATIVE DATA SOURCES

The VA Enterprise Architecture Repository (VEAR) is one component within the overall EA that establishes the common framework for data taxonomy for describing the data architecture used to develop, operate, and maintain enterprise applications. The Contractor shall comply with the department’s Authoritative Data Source (ADS) requirement that VA systems, services, and processes throughout the enterprise shall access VA data solely through official VA ADSs where applicable, see below. The Information Classes which compose each ADS are located in the VEAR, in the Data & Information domain. The Contractor shall ensure that all delivered applications and system solutions support:

18.15.8.1. Interfacing with VA’s Master Person Index (MPI) (formerly the Master Veteran Index (MVI)) to provision identity attributes, if the solution relies on VA user identities. MPI is the authoritative source for VA user identity data.

18.15.8.2. Interfacing with Capital Asset Inventory (CAI) to conduct real property record management actions, if the solution relies on real property records data. CAI is the authoritative source for VA real property record management data.

18.15.8.3. Interfacing with electronic Contract Management System (eCMS) for access to contract, contract line item, purchase requisition, offering vendor and vendor, and solicitation information above the micro-purchase threshold, if the solution relies on procurement data. ECMS is the authoritative source for VA procurement actions data.

18.15.8.4. Interfacing with HRSmart Human Resources Information System to conduct personnel action processing, on-boarding, benefits management, and compensation management, if the solution relies on personnel data. HRSmart is the authoritative source for VA personnel information data.

18.15.8.5. Interfacing with Vet360 to access personal contact information, if the solution relies on VA Veteran personal contact information data. Vet360 is the authoritative source for VA Veteran Personal Contact Data.

18.15.8.6. Interfacing with VA/Department of Defense (DoD) Identity Repository (VADIR) for determining eligibility for VA benefits under Title 38, if the solution relies on qualifying active-duty military service data. VADIR is the authoritative source for Qualifying Active-Duty military service in VA.

18.15.9. SOCIAL SECURITY NUMBER (SSN) REDUCTION

The Contractor solution shall support the Social Security Number (SSN) Fraud Prevention Act (FPA) of 2017 which prohibits the inclusion of SSNs on any document sent by mail. The Contractor support shall also be performed in accordance with Section 240 of the Consolidated Appropriations Act (CAA) 2018, enacted March 23, 2018, which mandates VA to discontinue using SSNs to identify individuals in all VA information systems as the Primary Identifier. The Contractor shall ensure that any new IT solution discontinues the use of SSN as the Primary Identifier to replace the SSN with the ICN in all VA information systems for all individuals. The Contractor shall ensure that all Contractor delivered applications and systems integrate with the VA Master Person Index (MPI) for identity traits to include the use of the ICN as the Primary Identifier. The Contractor solution may only use a Social Security Number to identify an individual in an information system if and only if the use of such number is required to obtain information VA requires from an information system that is not under the jurisdiction of VA.

18.15.10. SOFTWARE AND LICENSING REQUIREMENTS

The Contractor shall be responsible for the provision of all software licenses and any associated licensing maintenance required for any development, delivery, integration, operation, and/or maintenance associated with its proposed application(s), software products, software solution, and/or system including, but not limited to, any and all application(s), software and/or software products that comprise, are a part of, or integrate with the Contractor’s proposed application(s), software products, software solution, and/or system for the life of any resulting contract.

18. SECURITY AND PRIVACY REQUIREMENTS

18.16.1. POSITION/TASK RISK DESIGNATION LEVEL(S)

In accordance with VA Handbook 0710, Personnel Security and Suitability Program, the position sensitivity and the level of background investigation commensurate with the required level of access for the following tasks within the PWS are:

Position Sensitivity and Background Investigation Requirements by Task

The Tasks identified above and the resulting Position Sensitivity and Background Investigation requirements identify, in effect, the Background Investigation requirements for Contractor individuals, based upon the tasks the particular Contractor individual will be working. The submitted Contractor Staff Roster must indicate the required Background Investigation Level for each Contractor individual based upon the tasks the Contractor individual will be working, in accordance with their submitted proposal.

18.16.2. CONTRACTOR PERSONNEL SECURITY REQUIREMENTS

Contractor Responsibilities:

18.16.2.1. The Contractor shall prescreen all personnel requiring access to the computer systems to ensure they maintain the appropriate Background Investigation, and are able to read, write, speak, and understand the English language.

18.16.2.2. Within 3 business days after award, the Contractor shall provide a roster of Contractor and Subcontractor employees to the COR to begin their background investigations in accordance with the PAL template artifact. The Contractor Staff Roster shall contain the Contractor’s Full Name, Date of Birth, Place of Birth, individual background investigation level requirement (based upon Section 6.2 Tasks), etc. The Contractor shall submit full Social Security Numbers either within the Contractor Staff Roster or under separate cover to the COR. The Contractor Staff Roster shall be updated and provided to VA within 1 day of any changes in employee status, training certification completion status, Background Investigation level status, additions/removal of employees, etc. throughout the Period of Performance. The Contractor Staff Roster shall remain a historical document indicating all past information and the Contractor shall indicate in the Comment field, employees no longer supporting this contract. The preferred method to send the Contractor Staff Roster or Social Security Number is by encrypted e-mail. If unable to send encrypted e-mail, other methods which comply with FIPS 140-2 are to encrypt the file, use a secure fax, or use a traceable mail service.

18.16.2.3. The Contractor should coordinate with the location of the nearest VA fingerprinting office through the COR. Only electronic fingerprints are authorized. The Contractor shall bring their completed Security and Investigations Center (SIC) Fingerprint request form with them (see paragraph d.4. below) when getting fingerprints taken.

18.16.2.4. The Contractor shall ensure the following required forms are submitted to the COR within 5 days after contract award:

18.16.2.4.1. Optional Form 306

18.16.2.4.2. Self-Certification of Continuous Service

18.16.2.4.3. VA Form 0710

18.16.2.4.4. Completed SIC Fingerprint Request Form

18.16.2.5. The Contractor personnel shall submit all required information related to their background investigations (completion of the investigation documents (SF85, SF85P, or SF 86) utilizing the Office of Personnel Management’s (OPM) Electronic Questionnaire for Investigations Processing (e-QIP) after receiving an email notification from the Security and Investigation Center (SIC).

18.16.2.6. The Contractor employee shall certify and release the e-QIP document, print,…