36C10A24Q0080.docx

Sources Sought Notice

GENERAL INFORMATION

SET-ASIDE

Technology Acquisition Center

23 Christopher Way Eatontown NJ 07724

POINT OF CONTACT*

Contract Specialist Shakiya Harris Shakiya.Harris@va.gov 512-981-4021

PLACE OF PERFORMANCE

ADDRESS

POSTAL CODE

COUNTRY

ADDITIONAL INFORMATION

AGENCY’S URL

URL DESCRIPTION

AGENCY CONTACT’S EMAIL ADDRESS

EMAIL DESCRIPTION

Sources Sought Notice

DESCRIPTION

Request for Information Network-based Encryption Key Recovery Storage System Planning UID# VA-24-00078945

1. Introduction

This RFI is for planning purposes only and shall not be considered an Invitation for Bid, Request for Task Execution Plan, Request for Quotation or a Request for Proposal. Additionally, there is no obligation on the part of the Government to acquire any products or services described in this RFI. Your response to this RFI will be treated only as information for the Government to consider. You will not be entitled to payment for direct or indirect costs that you incur in responding to this RFI. This request does not constitute a solicitation for proposals or the authority to enter into negotiations to award a contract. No funds have been authorized, appropriated or received for this effort. Interested parties are responsible for adequately marking proprietary, restricted or competition sensitive information contained in their response. The Government does not intend to pay for the information submitted in response to this RFI.

The North American Industry Classification System (NAICS) for this requirement is 513210 with a size standard of $47 million.

2. Submittal Information:

All responsible sources may submit a response in accordance with the below information.

There is a page limitation for this RFI of 15 pages. The Government will not review any other information or attachments included, that are in excess of the (15) page limit. NO MARKETING MATERIALS ARE ALLOWED AS PART OF THIS RFI. Generic capability statements will not be accepted or reviewed. Your response must address capabilities specific to the services required in the attached PWS and must include the following:

a. Interested Vendors shall at a minimum, provide the following information in the initial paragraph of the submission:

Name of Company Address Point of Contact Phone Number Fax Number Email address Company Business Size and Status For VOSB and SDVOSBs, proof of verification in VIP.

NAICS code(s) Socioeconomic data Data Universal Numbering System (DUNS) Number Existing Contractual Vehicles (GWAC, FSS, or MAC)

b. Provide a summary of your capability to meet the requirements contained within the draft PWS for the following areas:

1. Discuss capabilities, including direct experience, providing technical experience with third-party access recovery of Personal Identity Verification (PIV)/ Common Access Card (CAC)-encrypted emails while complying with Federal Public Key Infrastructure (PKI) regulations. Please include specific narrative describing the time your organization has demonstrated this capability with examples of successes delivering the described services, place of performance, and contact information.

2. Discuss capabilities, including direct experience, recommending technical PKI integrations/solutions to Federal agencies (or other agencies of comparable size and scope as the Department of Veterans Affairs) and conducting planned and unplanned requirements in an Agile environment. Please include specific narrative describing the time your organization has demonstrated this capability successfully, place of performance, and contact information.

3. Discuss capabilities, including direct PKI experience, balancing resources, and workload due to fluctuations in project needs and constraints in a complex and fast-paced environment with multiple stakeholders and competing priorities. Please include specific narrative describing the time your organization has demonstrated this capability successfully, place of performance, and contact information.

4. Discuss capabilities, including direct experience, supporting, and successfully implementing PKI cloud solutions, if experienced in VA cloud solutions, please provide more detail. Please include specific narrative describing the time your organization has demonstrated this capability successfully, place of performance, and contact information.

c. Provide your Corporate Service Line experience or expertise in performing these services and specific examples or references. Specific examples or references provided must include the agency, point of contact, dollar value, and contract number.

d. Your response shall include information as to available personnel and financial resources; full names of proposed team members and the PWS requirements planned to be subcontracted to them, which must include the prime planned percentage or the names of the potential team members that may be used to fulfill the set aside requirement.

e. Has the draft PWS provided sufficient detail to describe the technical requirements that encompass the software development and production operations support services to be performed under this effort.

______ YES _______ NO (if No, answer question below)

If “NO”, please provide your technical comments/recommendations on elements of the draft PWS that may contribute to a more accurate proposal submission and efficient, cost-effective effort.

Responses are due no later than May 24, 2024 @ 15:00 PM EST via email to Shakiya Harris at Shakiya.harris@va.gov. Please note “Network-based Encryption Key Recovery Storage System” in the subject line of your response.

Mark your response as “Proprietary Information” if the information is considered business sensitive. The email file size shall not exceed 5 MB.

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Office of Information & Technology Infrastructure Operations

Network-based Encryption Key Recovery Storage Solution

Date: April 22, 2024 Planning UID# VA-24-00078945 PWS Version Number: 4

Contents

1.0 BACKGROUND

The Department of Veterans Affairs (VA), Office of Information & Technology (OIT), Infrastructure Operations (IO) strives to provide high quality, effective, and efficient Information Technology (IT) services to those responsible for providing care to the Veterans at the point-of-care as well as throughout all the points of the Veterans’ health care in an effective, timely and compassionate manner. VA depends on Information Management/Information Technology (IM/IT) systems to meet mission goals.

Currently, the VA employs a robust Public Key Infrastructure (PKI) system that involves the issuance of x.509 certificates to staff members for Federal Information Processing Standard (FIPS) compliant encryption of electronic messages and documents. VA Personal Identity Verification (PIV) cards assert a hardware Object Identifier (OID) which identifies the functional usage of all x.509 certificates encoded on the chip of each smart card. VA also has a FIPS compliant service for the issuance of an HSPD-12 (Homeland Security Presidential Directive 12) approved software-based x.509 certificate which allows storage within a software repository. Issuance of Secure / Multipurpose Internet Mail Extensions (S/MIME) Key Management x.509 certificates, commonly referred to as “encryption certificate”, occurs from the following Certificate Authorities (CA):

1. Verizon Business (CyberTrust): host two issuance CAs: Veterans Affairs User CA B1 and Veterans Affairs CA B3.

2. U.S. Treasury: host one issuance CA: Department of Veterans Affairs.

Both externally hosted CAs issue PIV Card encoded S/MIME certificates and Verizon Business (VzB) provides software-based PIV compliant S/MIME certificates.

To comply with legislative directives, such as The Freedom of Information Act 5 U.S.C. § 552 (Public Law 114-185) and The Homeland Security Act, assigning litigation discovery responsibilities for all Federal Agencies to the Office of General Council (OGC), the VA has implemented measures to facilitate private key recovery. The Key Management certificate is escrowed within the CA directory, enabling the VA to provide decryption services when required for litigation discovery purposes.

The Network Based Encryption Key Recovery Storage System (NBEKRSS) is a vital component of the PKI infrastructure within the VA, currently the VA utilizes Zeva DecryptNaBox. It integrates with various systems, such as Office 365, Self-Recovery, and Third-Party Recovery, to manage and decrypt encrypted messages. The VA also maintains eight Luna T-5000 HSMs across its data centers in the United States, ensuring secure key management with PED remote capability.

In November 2018, VA issued the Cloud First Policy mandating that all new and existing IT solutions be assessed to determine suitability to be offered as an enterprise cloud computing service. The VA Enterprise Cloud (VAEC) was established by the Enterprise Cloud Solutions Office (ECSO) in 2017, to host cloud computing solutions.

The NBEKRSS shall be implemented and hosted in the VA Enterprise Cloud as part of an Optional Task in this contract.

2.0 APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. Federal Information Processing Standards (FIPS) Publication 140-2, “Security Requirements for Cryptographic Modules”

2. FIPS Pub 199. “Standards for Security Categorization of Federal Information and Information Systems,” February 2004

3. FIPS Pub 200, “Minimum Security Requirements for Federal Information and Information Systems,” March 2006

4. FIPS Pub 201-2, “Personal Identity Verification of Federal Employees and Contractors,” August 2013

5. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

6. VA Handbook 6500, “Risk Management Framework for VA Information Systems VA Information Security Program,” February 24, 2021

7. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI),” March 12, 2019

8. VA Handbook 6500.5, “Incorporating Security and Privacy into the System Development Lifecycle,” March 22, 2010

9. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

10. VA Handbook 6510, “VA Identity and Access Management,” January 15, 2016

11. VA Directive and Handbook 6513, “Secure External Connections,” October 12, 2017

12. VA Directive 6300, “Records and Information Management,” September 21, 2018

13. VA Handbook, 6300.1, “Records Management Procedures, “ March 24, 2010

14. National Institute of Standards and Technology (NIST) SP 800-37 Rev 2, “Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy,” December 2018

15. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020)

16. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015

17. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” March 24, 2014

18. OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005

19. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019

20. OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008

21. Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance, December 2, 2011, (NOTE: Part A of the FICAM Roadmap and Implementation Guidance, v2.0, was replaced in 2015 with an updated Architecture (https://arch.idmanagement.gov/#what-is-the-ficam-architecture)

22. NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access,“ June 2018

23. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, “Digital Identity Guidelines,” updated March 02, 2020

24. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014

25. VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

26. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

27. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

28. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

29. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019

30. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

31. “Veteran Focused Integration Process (VIP) Guide 4.0,” January 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

32. VA Memorandum “Proper Use of Email and Other Messaging Services,” January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

33. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol Version 6 (IPv6),” November 19, 2020

34. Social Security Number (SSN) Fraud Prevention Act of 2017

35. VA Enterprise Cloud Technical Reference Guide, Version 1.3 July 2018

3.0 SCOPE OF WORK

The Contractor shall provide necessary application licenses for the NBEKRSS solution, as well as comprehensive support for product management, operations and maintenance, agile development, testing, remediation, upgrades, migrations, and troubleshooting. See section 5.3.1 for current NBEKRSS information. The requirement includes delivery of a complete network-based PKI storage solution including any/all hardware, software, middleware, interfaces, and documentation. The Contractor shall leverage an Agile product development methodology to iteratively optimize the NBEKRSS.

This solution shall be hosted in the VAEC environment and be fully functional no later than June 2025. In the event that a VAEC cloud service provider (CSP) has not yet been selected by VA, the Contractor shall recommend a CSP for the solution.

The Contractor shall not be responsible for providing or acquiring cloud capacity or server hosting infrastructure for this contract. VA will furnish VAEC capacity as GFE.

4.0 PERFORMANCE DETAILS

4.1 PERFORMANCE PERIOD

The PoP shall be 12 months from date of award and contains five (5) optional tasks, to be exercised at the Government’s discretion. The NBEKRSS will need to be readily available 24x7x365 but no on call/after-hours support will be required. Vendor will be required to work during normal business hours 8am-4:30pm CST Monday through Friday, except for Federal holidays.

There are eleven (11) Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, five are set by date:

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

4.2 PLACE OF PERFORMANCE

Tasks under this PWS shall be performed at Contractor facilities utilizing VA Government Furnished Equipment (GFE) see section 6.6 for more information regarding what will be provided. The Contractor shall identify the Contractor’s place of performance in their proposal submission.

4.3 TRAVEL

The Government does not anticipate travel under this effort to perform the tasks associated with the effort.

5.0 SPECIFIC TASKS AND DELIVERABLES

The Contractor shall perform all Tasks and Deliverables in sections 5.1 and 5.3 during the Base Period if implementing a new system. If Contractor uses current system, Zeva DecryptNaBox sections 5.1.1, and 5.3.3-5.3.7 shall be omitted.

5.1 PROJECT MANAGEMENT

5.1.1 CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, timeline, and tools to be used in execution of the contract. The CPMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks, and resource support. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPMP shall be concurred upon and updated in accordance with Section B of the contract. The Contractor shall update and maintain the VA PM approved CPMP throughout the PoP.

Deliverable:

A. Contractor Project Management Plan

5.1.2 TECHNICAL KICKOFF MEETING

The Contractor shall hold a technical kickoff meeting within 10 days after award of the contract. The Contractor shall present, for review and approval by the Government, the details of the intended approach, work plan, and project schedule for each effort. The Contractor shall specify dates, locations (can be virtual), agenda (shall be provided to all attendees at least five (5) calendar days prior to the meeting), and meeting minutes (shall be provided to all attendees within three (3) calendar days after the meeting). The Contractor shall invite the Contracting Officer (CO), Contracting Officer’s Representative (COR), and the VA Project Manager (PM).

5.1.3 REPORTING REQUIREMENTS

The Contractor shall provide the CO, COR, and VA PM with Weekly Progress Reports in electronic form in Microsoft Word and Project formats. The report shall include detailed instructions/explanations for each required data element, to ensure that data is accurate and consistent. These reports shall reflect data as of the last day of the preceding week.

The Weekly Progress Reports shall cover all work completed during the reporting period and work planned for the subsequent reporting period. The report shall also identify any problems that arose and a description of how the problems were resolved. If problems have not been completely resolved, the Contractor shall provide an explanation including their plan and timeframe for resolving the issue. The report shall also include an itemized list of all Information and Communication Technology (ICT) deliverables and their current Section 508 conformance status. The Contractor shall monitor performance against the CPMP if applicable and report any deviations. It is expected that the Contractor will keep in communication with VA accordingly so that issues that arise are transparent to both parties to prevent escalation of outstanding issues.

Deliverable:

A. Weekly Progress Report

5.1.4 PRIVACY & HIPAA TRAINING

The Contractor shall complete and submit TMS Training Certificates of completion for VA Privacy and Information Security Awareness and Rules of Behavior and shall also complete and provide VA Health Insurance Portability and Accountability Act (HIPAA) training Certificates of Completion and provide signed copies of the Contractor Rules of Behavior in accordance with Section 9, Training, from Appendix C of the VA Handbook 6500.6, “Contract Security”.

Deliverable:

A. VA Privacy and Information Security Awareness and Rules of Behavior Training Certificate /Signed Rules of Behavior/HIPAA Certificate of Completion

5.1.5 ONBOARDING

The Contractor shall assist in the managing of the onboarding of its staff in conjunction with the VA COR. Onboarding includes steps to obtain a VA network and email account, complete training, initiate background investigations, and gain physical and logical access, which may include elevated privileges to the necessary development and test environments for the various systems to be enhanced. A single Contractor Onboarding POC shall be designated by the Contractor who tracks the onboarding status of all Contractor personnel. The Contractor Onboarding POC shall be responsible for accurate and timely submission of all required VA onboarding paperwork to the VA COR. The Contractor shall be responsible for tracking the status of all their staff’s onboarding activities and report the status at the staff level during onboarding status meetings. The Contractor shall provide an Onboarding Status Report weekly for any staff with outstanding onboarding requests for review by the VA COR and VA Project Manager.

Deliverable:

· Onboarding Status Report

5.2 NBEKRSS BASE PERIOD REQUIREMENTS

The Contractor shall provide a Network-based Encryption Key Recovery Storage Solution for VA at the beginning of the base period to respond to Office of General Counsel and Freedom of Information Act requests. The solution must comply with all Federal Information Processing Standard (FIPS) and PIV policy (as appropriate) as it relates to PIV encryption key recovery and storage.

5.2.1 CURRENT NBEKRSS INFORMATION

The current NBEKRSS the VA is utilizing is a perpetual license for Zeva DecryptNaBox version 2.8.2.3. The NBEKRSS infrastructure consists of nine dedicated Windows Server 2016 machines running Microsoft .Net Runtime Hosting Bundle 7.0.18, Microsoft .NET Framework, multiple versions of Microsoft Visual C++ Redistributable and Oracle Java version 8 update 371. There are three (3) for Development, three (3) for Pre-Production and three (3) for Production. One server in each stage has the Key Migration Tool 2.8.3.0 installed, Internet Information Services (IIS) Manager version 10, and the SQL Server Management Studio version 20 for database management. The VA maintains eight Luna T-5000 HSMs across its data centers in the United States, using software version 7.13.0-146 with twenty (20) licensed partitions with remote PED capability.

There are two significant issues with the current NBERKSS solution.

5.2.1.1 US TREASURY NOT INTEGRATED

The first issue is the previous Contractor was not able to integrate Zeva software before the contract ended with US Treasury host Department of Veteran Affairs CA for the collection and recovery of end entity issued Key Management (encryption) certificates issued through General Services Administration (GSA) USAccess PIV card program.

5.2.1.2 FORWARD CHAIN ISSUE

The second issue is with recovery from Verizon Business’s Veterans Affairs CA B3 where the returned data blob is forward chained instead of backward chained. The majority of Key Management Keys returned from Verizon Web Registration Authority Operator (WebRAO) start with the end entity serial number/identifiers first and the associated attributes of the CA chain. There are thousands which are forward returned; the leading serial number is the root CA (Common Policy CA G2) and the associated attributes END with the end entity serial number/identifiers. When these forward chained keys are received the Zeva system fails to apply or escrow them.

5.2.2 NBEKRSS REQUIREMENTS

The Contractor shall provide a NBEKRSS solution that, at a minimum, meets the following requirements:

· Is a HSPD-12, FIPS, and NIST compliant PKI decryption and storage solution which meets Federal guidelines and conditions of operations as define for recovery and decryption.

· Can access, recover, and utilize all escrowed key materials from Verizon Business (VzB) and Treasury.

· Ability to search multiple end points for key recovery. The Contractor shall pull Verizon soft certificates into the application. Contractor shall include the recovery of VzB escrow is redirected to VA internal key store for recovery purposes. Decrypts and stores PIV-encrypted Microsoft Outlook 365 emails. (The intent of the NBEKRSS is to examine Microsoft encrypted electronic messages (email) and Microsoft Word documents and Adobe PDF documents which are all encrypted utilizing S/MIME standards. The NBEKRSS should examine the document types, identify certificates associated with the encryption of the messages and decrypt the messages and documents into clear text version which will allow the end entity the ability to read/view the contents of the message and all who were sent it.)

· Supports all standard encryption key lengths, including older lengths for decrypting older messages.

· Has a web interface that allows an operator to search for, select, retrieve and store VzB and Entrust encryption key pairs. This self-recovery feature is essential for mobile device users to pull USAccess card encryption certificates onto smart phones to enable reading and encrypting of messages.

· Provide a Diagnostic tool for Administrators to troubleshoot PKI problems by collecting detailed information about certificate chain validation, certificate store operations and signature verification. Logs shall be able to view and consume recovered encryption key pairs.

· Is interoperable with Hardware Security Modules (HSM’s) T-5000’s using PED remote capability, and VAEC capable.

· Is available for users with a 99% uptime.

· The contractor shall ensure any necessary licensing for NBEKRSS is activated and legal for all application components within the system. Pricing of the licenses should not be priced separately and will become VA property once applied. VA supplies the Microsoft application licenses and database licenses. All other licensing cost of all applications associated with the system is included in the contract, such as Prorate Reinstatement Fees, Annual Software Maintenance for licensed products and Application Engineering Support.

· The Contractor shall ensure any COTS products used in the NBEKRSS solution are One-VA Technical Reference Model (TRM)-approved products or submit and achieve TRM approval if not already listed.

To meet VA needs the NBEKRSS shall be configured with multiple integrations:

· Office 365 (O365): a component of O365 is Microsoft’s Exchange Mail Service which supports the Outlook client user mail application. This application includes a plug-in service which allows for the PKI solution to decrypt electronic messages selected by the approved user.

· Self-Recovery: hosted IIS web page which requires PIV certificate authentication and allows the card holder to self-recover any S/MIME escrowed certificate associated with the card holder’s identity.

· Third-Party Recovery: hosted IIS web page which requires PIV certificate authentication and allows an approved Recovery Agent to perform a third-party recovery of submitted identities S/MIME escrowed certificate. This recovery requires approval by a confirmed Registration Authority (RA).

5.2.3 AGILE SCRUM TEAM

The Contractor shall provide one (1) agile scrum team (approximately 2 Full Time Equivalent (FTE) resources made up of the appropriate technical skill sets). The contractor shall provide tier 2/3 support responsible for providing daily support to approximately 15 VA staff and contractors. Support includes response support through email/instant messaging/phone/help desk tickets. In the first six months of Fiscal Year 2024 an average of 60 help desk tickets were generated and over 2,500 certificates were recovered manually.

The contractor shall provide tasks including:

Help Desk Ticket Resolution

· Respond to users and resolve application issues.

· Resolve help tickets related to problems, issues, and questions regarding encrypted message jobs submitted for decryption.

· Provide training and correct any issues related to encryption system.

· Grant and revoke authorized access for users.

Application and Installation Support

· Install all applications onto VA hardware/virtual hardware.

· Ensure all services accounts are migrated to gMSA (Group Managed Service Accounts) per VA policy.

· Address failed decryption jobs and missing end entity certificates.

· Patch the Microsoft Operation System and other software applications integrated within the NBEKRSS monthly and as needed.

· Remediate any issues found in monthly Nessus Scan Reports and provide evidence upon request for ATO award, ensuring compliance with the Network-based Encryption Key Recovery Storage Solution.

Documentation Creation

· Create basic documentation of processes and training materials for end-users and technical support.

· Reporting of current Microsoft Monthly Patching Activity, testing report prior to release of monthly patching into Production

The NBEKRSS solution requires various system enhancements and customizations. The VA also needs to integrate the Department of Veterans Affairs CA hosted by the US Treasury with the solution to ensure the recovery of Key Management Key materials.

The Contractor shall perform the following tasks:

Integration with Department of Veterans Affairs CA

· Develop the integration with the Shared Service Provider (SSP) hosted Department of Veterans Affairs CA at the US Treasury.

· Develop Self-Service Recovery portal for both end entity and third-party recovery of user certificates collected by the system.

Secure Collection and Storage of Key Materials

· Securely request, collect, and store all private key materials from issued Key Management Key certificates in a FIPS compliant manner.

· Configure and utilize the SQL host for storing all VA collected key materials.

Correction to Collection Component

· Develop a correction to the system's collection component to allow the recovery of all CyberTrust key materials from the Verizon Business hosted system.

· Integrate with a VA staged SQL source for dumping and staging the key materials for recovery.

Hexadecimal Serial Number Export Fix

· Develop a fix to enable the direct pasting of a hexadecimal serial number into the hexadecimal field without the need for additional steps (Current system has a work around that direct pasting of the hexadecimal serial number into the hexadecimal field will only work if you additionally click in the decimal serial number field immediately after, then click the next button to continue with the exporting.)

Support for Verizon Business Decommissioning

· Support the consumption and upload of p12 files when Verizon Business decommissions User B1 and B3 Certificate Authorities in October of 2024.

Deliverables:

A. Weekly Help Desk Ticket Reports B. ATO remediation evidence reports C. Process and Training Documentation Materials.

D. Monthly Patching Report

5.2.4 VIRTUAL TRAINING

The Contractor shall provide one online or web-based virtual training session for approximately six users and three system administrators on how to unencrypt emails using the NBEKRSS software. The Contractor shall provide VA with information about where to go to obtain the web-based training and when the training becomes available. The Contractor shall provide a NBEKRSS User Manual.

5.2.5 AUTHORITY TO OPERATE (ATO) SUPPORT

The Contractor shall track, update, and modify all documents related to system design and solution which are required by internal VA processes for Authority to Operate (ATO). The Contractor shall provide support for the NBEKRSS ATO process documentation in support of VA obtaining and maintaining an ATO. The Contractor shall:

a. Coordinate with VA subject matter experts (SMEs).

b. Use visuals to help communicate complex topics (figures, tables, and graphics).

c. Use plain English, i.e., active voice, gender neutral language, to communicate the intended message clearly and concisely. Use multiple formats, including Rational Team Concert, Microsoft (MS) Word, PowerPoint, Excel, .PDF, as necessary for the ATO documentation.

d. Meet Section 508 requirements, where applicable.

e. Maintain and, following COR approval, enhance the existing file naming conventions for program electronic documents.

f. Collect, develop and/or edit content, where necessary.

The Government anticipates ATO documentation will be required for the ATO Documentation Package. In support of the ATO process, the Contractor shall provide the ATO Documentation Package including the documents a through h below. The Contractor shall also be responsible for remediation of any documentation deemed unacceptable by VA.

a. Mitigations Plan of Action & Milestones

b. ATO Memorandum of Understanding (MOU)

c. Risk Assessment

d. Disaster Recovery Plan

e. Incident Response Plan

f. Information System Contingency Plan

g. Configuration Management Plan

h. ATO Paperwork

Deliverable:

A. ATO Documentation Package

5.3 AGILE PRODUCT DEVELOPMENT

The Contractor shall provide analysis, design, development, testing and deployment of the NBEKRSS following the Agile methodology as described below and, in the VA Veteran Focused Integration Process (VIP) guidelines for all work related to changes of the system configuration, integration, or enhancements as well as execution under any optional task order. The Contractor shall manage the product backlog continually through development and evolution of the product.

5.3.1 AGILE REPORTING REQUIREMENTS

The Contractor shall use a version control tool to provide a single Agile project/product lifecycle management tool to track execution details. The version control tool shall be used to provide a single authoritative project and product data and artifact repository. The Contractor shall manage all project data and artifacts in this data and artifact repository daily.

The Contractor shall use the version control tool to:

a. Input and manage scheduled project/product sprints and backlog.

b. Input and manage project/product agile requirements.

c. Input and manage project/product risks and issues.

d. Input and manage project/product configurations and changes.

e. Input and manage project/product test plans and execution.

f. Input and manage project/product planning and engineering documentation.

g. Input and manage linkages to correlate requirements to change orders to configurable items to risks, impediments, and issues to test cases and test results to show full traceability.

The Contractor shall show within the version control tool or another tracking tool that all Agile requirements, changes, tests performed, and test results show evidence of code coverage and test coverage of all the requirements specified.

5.3.2 AGILE REQUIREMENTS ELABORATION

The Contractor shall complete an initial backlog grooming session, prior to each build, with the VA team to properly understand and elaborate business Agile requirements. The outcome of this session shall be a complete review of, and agreement to, the initial user stories, including user stories added because of backlog grooming by decomposing epics into stakeholder needs, business requirements, business rules, requirements visualizations and user story elaborations.

The Contractor shall:

a. Ensure all epics are included and executed as appropriate within the overall agile backlog grooming effort.

b. Populate the backlog during an initial planning session identifying all features the team considers relevant to building the product. The backlog serves as the primary source for all program requirements and user stories, and the team shall prioritize the contents.

c. Establish initial Unit of measurement (e.g., Story Points) as the estimated relative complexity of user stories.

d. Facilitate any stakeholder briefings, meetings and/or elicitation sessions.

e. Execute requirements reviews with stakeholders and record results of reviews,

f. Update requirement data because of the reviews.

g. Identify the development and test environment access that is needed 30 days prior to development start.

The Contractor shall input and maintain all user stories, stakeholder needs, visualizations, stories, and other sources of requirement’s information for functional and non-functional requirements in the version control tool.

5.3.3 BUILD PLANNING

The Contractor shall conduct and facilitate build planning activities prior to the beginning of a build and during the execution of each build.

In preparation for build planning, the Contractor shall coordinate with the VA Project Manager, Product Owner, and Project Team to elaborate requirements such as epics and sub-epics, develop user stories, manage backlogs, analyze changes, and estimate levels of effort. The Contractor shall comply with VA requirements management guidelines such as the VIP. The Contractor shall apply Agile methodologies and best practices, and use VA designated requirements management tools, repositories, and templates, as approved by the PM and/or COR, to develop, enter and upload requirements data, documents, and artifacts.

The Contractor shall coordinate build planning sessions to develop a Build Plan for each planned build/release. This Plan includes prioritized backlog items that capture build content, estimated level of effort, preliminary timelines, and dependencies, risks/issues, and constraints. The Build Plan defines the scope of work which the development team commits to, in the agreed upon time frame (preferably 2 months or less), to deliver a useful and usable product/solution that is deployable.

The Contractor shall provide the Build Plan to the COR/PM and obtain approval prior to initiating any development activities. This Plan shall also include both Contractor and VA testing activities, dependencies, and descriptions of the interfaces and interactions between solution components that are needed to test and validate. The Build Plan shall define the test strategy and specify the types and scope of testing to be conducted during each product build (e.g., unit, functional, non-functional, accessibility, system, reliability, usability, interoperability, regression, security, performance).

At the conclusion of the Build Planning phase, the Contractor shall provide a Build Release Planning Package outlining the prioritized capabilities, estimation of level of effort, and timeline for completion. After the Build Planning Package is approved and the team is ready to start the build, the two (2) months or less build cycle will start.

Deliverable:

1. Build Plan

1. Build Release Planning Package

5.3.4 SPRINT PLANNING

Once the Build Plan has been approved by the VA PM and/or COR, the Contractor shall conduct and facilitate sprint planning activities prior to the beginning of a short iteration or sprint of development. The Contractor shall coordinate with the VA Product Owner and development team to develop a Sprint Plan that defines prioritized backlog items, estimated level of effort, acceptance criteria, design, test events, and dependencies, risks, and issues. The Sprint Plan defines the scope of work which the development team can, in an agreed upon time frame (10 days to two (2) weeks), develop features and functions that are required to address user stories. The Contractor shall analyze the sprint user stories to define and document the sprint tasks.

The Contractor shall support integration across multiple sprints to prepare for the release of useable capabilities and facilitate the process for obtaining VA Product Owner agreement of the build and team commitment on Sprint Plans. The Contractor shall use VA designated tools, repositories, and templates to maintain sprint plans.

The Contractor shall initiate sprint planning at the beginning of each sprint included in the build. All activity scheduled in each sprint and backlog will be captured in the version control tool and have status showing all work items, changes, impediments, and retrospectives. All data and artifacts in the version control tool shall be fully linked to requirements data and test data.

The Contractor shall support, coordinate, and provide input for the Sprint Acceptance Criteria in the version control tool. The Sprint Acceptance Criteria shall be coordinated and approved, by the VA PM, for every sprint.

Deliverable:

A. Sprint Plan

5.3.5 SPRINT EXECUTION

The Contractor shall build, develop, and deliver, in the form of source code, within short iterations (10 days to 2 weeks), working IT products/solutions that satisfy sprint backlog items, acceptance criteria, and are deployable. The Contractor shall conduct sprint development including disciplined testing (unit, functional, regression) and reviews as a continuous process, to avoid finding issues at the end of sprint development. The Contractor shall develop the features and capabilities as work items in the VA approved tools that were established in the Sprint Plan. The Contractor shall identify, troubleshoot, and resolve bugs/issues identified during testing. The Contractor shall conduct unit testing during the development effort to ensure all developed components of an application are individually and independently operating and satisfy requirements prior to the start of test and validation. The Contractor shall deliver, upload, and setup in the VA designated tool, repository, and environment bug-free code at the end of development and unit testing.

The Contractor shall provide scrum master expertise to conduct and facilitate daily scrums (typically time-boxed - 15 minutes) to review team progress; report and resolve impediments, allow team members to have clarity on work being done while promoting collaboration, and discussing daily plans.

The Contractor shall support scrum of scrums (three (3) times per week) to discuss progress, impediments, and cross-project dependencies. The Contractor shall conduct and facilitate sprint reviews at the end of each sprint to inspect completed work. The Contractor shall review/demonstrate the developed functionality to the Product Owner and key stakeholders to confirm it satisfies acceptance criteria.

The Contractor shall coordinate with the VA Project Manager to provide demonstrations of the product/solution, system as part of the sprint review. The Contractor shall review/demonstrate that the acceptance criteria have been met. The sprint review is conducted with the project team and key VA stakeholders at the end of each sprint. The Contractor shall obtain official customer acceptance of the sprint. Stakeholder feedback shall be gathered, analyzed, and documented in a Sprint Review Report for each sprint to summarize the outcome and results of the review, and identify required changes, corrections, and future requirements. The Sprint Review Report shall also include sprint retrospectives, sprint burn down summaries, and sprint velocity summaries.

The Contractor shall conduct and facilitate sprint retrospectives at the end of each sprint to capture team performance lessons learned; what went well; what did not go well; and what action items are being tracked to help with improvements. The Contractor shall document within the Sprint Review Report a Sprint Retrospective for each sprint that summarizes the outcome and results of the retrospective; and identifies any planned sprint items not completed during the sprint, issues encountered, and plans for resolution.

The Contractor shall document all activity executed in each sprint and updates to the backlog in the version control tool including all project artifacts such as work items, changes, risks, issues, impediments, and retrospectives. All data and artifacts in the version control tool shall be fully linked to requirements data and test data. All project artifacts and source code shall be under change and configuration management using the VA approved tool. The Contractor shall provide daily updates, to include progress on tasks during sprints, blockers, and dependencies.

The Contractor shall:

a. Develop the features and capabilities as work items in the version control tool that were established in the Sprint Plan.

b. Initiate and conduct daily scrums (typically 15 minutes) to show the team progress, impediments, and daily plans.

c. Update the version control tool daily, to include progress on tasks during sprints, blockers, and dependencies.

d. Coordinate and support demonstration of the sprint activities with the project team and Users at the end of each sprint. This is termed a Sprint Review and will result in Customer Acceptance of the Sprint.

e. Develop and deliver automated build and automated publishing capabilities to schedule jobs and support continuous integration for every sprint. Automated build tools shall follow the approved list from the One-VA TRM and code shall be demonstrable and stable enough to be promoted to another environment without issue by evidence of the status of tests and results in the version control tool.

f. Initiate and facilitate a Sprint Retrospective at the end of the Sprint to capture team performance lessons learned. The Contractor shall document lessons learned in the version control tool.

g. The Contractor shall conduct risk management of all work performed under this contract and include risk management issues within the Sprint Review Report.

h. The Contractor shall conduct configuration management of all work performed under this contract and include configuration management issues within the Sprint Review Report.

Deliverables:

A. Source Code B. Sprint Review Report

5.3.6 TESTING SUPPORT

The Contractor shall conduct testing for the NBEKRSS. The Contractor shall provide testing services to test and validate developed products and solutions for any work being done under this PWS.

The Contractor shall coordinate with the VA Testing Manager and testing team(s) to provide input for the development of testing strategies, plans, and timelines. The Contractor shall coordinate with the VA Testing Manager to support test preparation activities such as the setup and configuration of environments, preparation of test cases/scripts, and test data.

The Contractor shall work with the VA Project Manager, Testing Manager and Testing Team(s) to test and validate a developed product/solution to ensure it is deployable and satisfies requirements and acceptance criteria.

The Contractor shall provide a Master Test Plan that describes the approach for testing and validating the developed product/solution and ensure it is ready to be released and deployed. These test plans shall include all required testing types and events to validate that solution components are integrated and satisfy requirements and acceptance criteria. Examples of standard testing types include product component testing (function/unit), component integration and system testing, quality assurance, user acceptance/user functionality testing, field testing (initial operational capability), and enterprise testing (e.g., multi-divisional, security, privacy, Section 508 - accessibility, performance/capacity, load testing).

The Contractor shall develop, maintain, and execute development Test Cases and Test Scripts. The Contractor shall provide automated scripts where possible. All exceptions shall be reviewed and approved by the VA PM.

The Government will provide the appropriate Test Data for each testing event that shall be used for testing products/solutions developed under this PWS which includes test data for 10 sample scenarios for the Contractor to use in testing.

Deliverables:

A. Master Test Plan B. Test Cases and Test Scripts

5.3.7 PRODUCT DEPLOYMENT

The Contractor shall develop a Deployment Plan that includes the Pre and Post Deployment steps (including timeline and responsible party), and back-out and rollback…