36C10B18Q3124-001.pdf

V and

PAGE 1 OF 1. REQUISITION NO.

2. CONTRACT NO. 3. AWARD/EFFECTIVE DATE 4. ORDER NO. 5. SOLICITATION NUMBER 6. SOLICITATION ISSUE DATE

a. NAME b. TELEPHONE NO. (No Collect Calls) 8. OFFER DUE DATE/LOCAL

TIME

9. ISSUED BY CODE 10. THIS ACQUISITION IS UNRESTRICTED OR SET ASIDE: % FOR:

SMALL BUSINESS

HUBZONE SMALL

BUSINESS

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

WOMEN-OWNED SMALL BUSINESS

(WOSB) ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

EDWOSB

8(A)

NAICS:

SIZE STANDARD:

11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

SEE SCHEDULE

12. DISCOUNT TERMS

13a. THIS CONTRACT IS A

RATED ORDER UNDER

DPAS (15 CFR 700)

13b. RATING

14. METHOD OF SOLICITATION

RFQ IFB RFP

15. DELIVER TO CODE 16. ADMINISTERED BY CODE

17a. CONTRACTOR/OFFEROR CODE FACILITY CODE 18a. PAYMENT WILL BE MADE BY CODE

TELEPHONE NO. DUNS: DUNS+4:

PHONE: FAX:

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN OFFER

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK BELOW IS CHECKED

SEE ADDENDUM

19. 20. 21. 22. 23. 24.

ITEM NO. SCHEDULE OF SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

(Use Reverse and/or Attach Additional Sheets as Necessary)

25. ACCOUNTING AND APPROPRIATION DATA 26. TOTAL AWARD AMOUNT (For Govt. Use Only)

27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1, 52.212-4. FAR 52.212-3 AND 52.212-5 ARE ATTACHED. ADDENDA ARE ARE NOT ATTACHED.

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA ARE ARE NOT ATTACHED

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN _______________ 29. AWARD OF CONTRACT: REF. ___________________________________ OFFER

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND DATED ________________________________. YOUR OFFER ON SOLICITATION

DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY (BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE

ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED SET FORTH HEREIN IS ACCEPTED AS TO ITEMS:

30a. SIGNATURE OF OFFEROR/CONTRACTOR 31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER)

30b. NAME AND TITLE OF SIGNER (TYPE OR PRINT) 30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER (TYPE OR PRINT) 31c. DATE SIGNED

AUTHORIZED FOR LOCAL REPRODUCTION (REV. 2/2012)

PREVIOUS EDITION IS NOT USABLE Prescribed by GSA - FAR (48 CFR) 53.212

7. FOR SOLICITATION

INFORMATION CALL:

STANDARD FORM 1449

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 30

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS 93

36C10B18Q3124 08-23-2018

Mike Frank 732-440-9701 09-06-2018

3:00PM EST

Department of Veterans Affairs

Technology Acquisition Center

23 Christopher Way

Eatontown NJ 07724

X 100

X

541512

$27.5 Million

N/A

See Delivery Schedule

Eatontown NJ 07724

Financial Services Center

PO Box 149971

Austin TX 78714-8971

Request for Quote (RFQ) is being issued for:

VA API Development and Operations

This RFQ will result in a hybrid Firm-Fixed Price/

Time-and-Materials (T&M)/Labor-Hour type contract.

Period of Performance is 12 months from date of award

Points of Contact:

Contract Specialist - Michael Frank, 732-440-9701

Michael.Frank@va.gov

Contracting Officer - Juan Quinones, 732-440-9714

Juan.Quinones@va.gov

X X

Juan Quinones

Contracting Officer

36C10B18Q3124

Table of Contents

SECTION A

A.1 SF 1449 SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

SECTION B - CONTINUATION OF SF 1449 BLOCKS

B.1 GOVERNING LAW

B.2 SOFTWARE LICENSE, MAINTENANCE AND TECHNICAL SUPPORT

B.3 CONTRACT ADMINISTRATION DATA

B.4 PRICE SCHEDULE

B.5 PERFORMANCE WORK STATEMENT

SECTION C - CONTRACT CLAUSES

C.1 52.252-2 CLAUSES INCORPORATED BY REFERENCE (FEB 1998)

C.2 52.212-5 CONTRACT TERMS AND CONDITIONS REQUIRED TO IMPLEMENT

STATUTES OR EXECUTIVE ORDERS—COMMERCIAL ITEMS (JUL 2018)

C.3 52.217-7 OPTION FOR INCREASED QUANTITY—SEPARATELY PRICED LINE

ITEM (MAR 1989)

C.4 VAAR 852.203-70 COMMERCIAL ADVERTISING (JAN 2008)

C.5 VAAR 852.219-10 VA NOTICE OF TOTAL SERVICE-DISABLED VETERAN-OWNED

SMALL BUSINESS SET-ASIDE (JUL 2016)(DEVIATION)

C.6 VAAR 852.232-72 ELECTRONIC SUBMISSION OF PAYMENT REQUESTS (NOV

2012)

C.7 VAAR 852.237-70 CONTRACTOR RESPONSIBILITIES (APR 1984)

C.8 VAAR 852.270-1 REPRESENTATIVES OF CONTRACTING OFFICERS (JAN 2008) . 65

SECTION D - CONTRACT DOCUMENTS, EXHIBITS, OR ATTACHMENTS

SECTION E - SOLICITATION PROVISIONS

E.1 52.252-1 SOLICITATION PROVISIONS INCORPORATED BY REFERENCE (FEB

1998)

E.2 52.209-7 INFORMATION REGARDING RESPONSIBILITY MATTERS (JUL 2013) ... 67

E.3 52.212-3 OFFEROR REPRESENTATIONS AND CERTIFICATIONS—COMMERCIAL

ITEMS (NOV 2017)

E.4 52.216-1 TYPE OF CONTRACT (APR 1984)

E.5 52.227-15 REPRESENTATION OF LIMITED RIGHTS DATA AND RESTRICTED

COMPUTER SOFTWARE (DEC 2007)

E.6 52.233-2 SERVICE OF PROTEST (SEP 2006)

E.7 VAAR 852.233-70 PROTEST CONTENT/ALTERNATIVE DISPUTE RESOLUTION

(JAN 2008)

E.8 VAAR 852.233-71 ALTERNATE PROTEST PROCEDURE (JAN 1998)

E.9 BASIS FOR AWARD

E.10 QUOTE SUBMISSION INSTRUCTIONS

SECTION B - CONTINUATION OF SF 1449 BLOCKS

B.1 GOVERNING LAW

Federal law and regulations, including the Federal Acquisition Regulations (FAR), shall govern this Contract/Order. Commercial license agreements may be made a part of this Contract/Order but only if both parties expressly make them an addendum hereto. If the commercial license agreement is not made an addendum, it shall not apply, govern, be a part of or have any effect whatsoever on the Contract/Order; this includes, but is not limited to, any agreement embedded in the computer software (clickwrap), any agreement that is otherwise delivered with or provided to the Government with the commercial computer software or documentation (shrinkwrap), or any other license agreement otherwise referred to in any document. If a commercial license agreement is made an addendum, only those provisions addressing data rights regarding the

Government’s use, duplication and disclosure of data (e.g., restricted computer software) are included and made a part of this Contract/Order, and only to the extent that those provisions are not duplicative or inconsistent with Federal law, Federal regulation, the incorporated FAR clauses and the provisions of this Contract/Order; those provisions in the commercial license agreement that do not address data rights regarding the Government’s use, duplication and disclosure of data shall not be included or made a part of the Contract/Order. Federal law and regulation including, without limitation, the Contract Disputes Act (41 U.S.C. § 7101 et seq.), the Anti-Deficiency Act (31 U.S.C. § 1341 et seq.), the Competition in Contracting Act (41

U.S.C. § 3301 et seq.), the Prompt Payment Act (31 U.S.C. §3901 et seq.), Contracts for Data

Processing or Maintenance (38 U.S.C. § 5725), and FAR clauses 52.212-4, 52.227-14, 52.227-19 shall supersede, control, and render ineffective any inconsistent, conflicting, or duplicative provision in any commercial license agreement. In the event of conflict between this Clause and any provision in the Contract/Order or the commercial license agreement or elsewhere, the terms of this Clause shall prevail. Claims of patent or copyright infringement brought against the

Government as a party shall be defended by the U.S. Department of Justice (DOJ). 28 U.S.C. §

516. At the discretion of DOJ, the Contractor may be allowed reasonable participation in the defense of the litigation. Any additional changes to the Contract/Order must be made by contract/order modification (Standard Form 30) and shall only be effected by a warranted

Contracting Officer. Nothing in this Contract/Order or any commercial license agreement shall be construed as a waiver of sovereign immunity.

B.2 SOFTWARE LICENSE, MAINTENANCE AND TECHNICAL SUPPORT

(1) Definitions.

(a) Licensee. The term “licensee” shall mean the U.S. Department of Veterans Affairs

(“VA”) and is synonymous with “Government.”

(b) Licensor. The term “licensor” shall mean the contractor having the necessary license or ownership rights to deliver license, software maintenance and support of the computer software being acquired. The term “contractor” is the party identified in Block 17a on the

SF1449. If the contractor is a reseller and not the Licensor, the contractor remains responsible for performance under this order.

(c) Software. The term “software” shall mean the licensed computer software product(s) cited in the Schedule of Supplies/Services.

(d) Maintenance. The term “maintenance” is the process of enhancing and optimizing software, as well as remedying defects. It shall include all new fixes, patches, releases, updates, versions and upgrades, as further defined below.

(e) Technical Support. The term “technical support” refers to the range of services providing assistance for the software via the telephone, email, a website or otherwise.

(f) Release or Update. The term “release” or “update” are terms that refer to a revision of software that contains defect corrections, minor enhancements or improvements of the software’s functionality. This is usually designated by a change in the number to the right of the decimal point (e.g., from Version 5.3 to 5.4). An example of an update is the addition of new hardware.

(g) Version or Upgrade. The term “version” or “upgrade” are terms that refer to a revision of software that contains new or improved functionality. This is usually designated by a change in the number to the left of the decimal point (e.g., from Version 5.4 to 6).

(2) Software License

(a) Unless otherwise stated in the Schedule of Supplies/Services, the Performance Work

Statement or Product Description, the software license provided to the Government is a perpetual, nonexclusive license to use the software

(b) The Government may use the software in a networked environment.

(c) Any dispute regarding the license grant or usage limitations shall be resolved in accordance with the Disputes Clause incorporated in FAR 52.212-4(d).

(d) All limitations of software usage are expressly stated in the Schedule of

Supplies/Services and the Performance Work Statement/Product Description.

(3) Software Maintenance and Technical Support

(a) If the Government desires to continue software maintenance and support beyond the period of performance identified in this contract or order, the Government will issue a separate contract or order for maintenance and support. Conversely, if a contract or order for continuing software maintenance and technical support is not received the contractor is neither authorized nor permitted to renew any of the previously furnished services.

(b) The contractor shall provide software support services, which includes periodic updates, enhancements and corrections to the software, and reasonable technical support, all of which are customarily provided by the contractor to its commercial customers so as to cause the software to perform according to its specifications, documentation or demonstrated claims.

(c) Any telephone support provided by contractor shall be at no additional cost.

(d) The contractor shall provide all maintenance services in a timely manner in accordance with the contractor’s customary practice or as defined in the Performance Work

Statement/Product Description. However, prolonged delay (exceeding 2 business days) in resolving software problems will be noted in the Government’s various past performance records on the contractor (e.g., www.ppirs.gov).

(e) If the Government allows the maintenance and support to lapse and subsequently wishes to reinstate it, any reinstatement fee charged shall not exceed the amounts that would have been charged if the Government had not allowed the subscription to lapse.

(4) Disabling Software Code. The Government requires delivery of computer software that does not contain any code that will, upon the occurrence or the nonoccurrence of any event, disable the software. Such code includes but is not limited to a computer virus, restrictive key, node lock, time-out or other function, whether implemented by electronic, mechanical, or other means, which limits or hinders the use or access to any computer software based on residency on a specific hardware configuration, frequency of duration of use, or other limiting criteria. If any such disabling code is present, the contractor agrees to indemnify the

Government for all damages suffered as a result of a disabling caused by such code, and the contractor agrees to remove such code upon the Government’s request at no extra cost to the

Government. Inability of the contractor to remove the disabling software code will be considered an inexcusable delay and a material breach of contract, and the Government may exercise its right to terminate for cause. In addition, the Government is permitted to remove the code as it deems appropriate and charge the Contractor for consideration for the time and effort expended in removing the code.

(5) Manuals and Publications. Upon Government request, the contractor shall furnish the most current version of the user manual and publications for all products/services provided under this contract or order at no cost.

http://www.ppirs.gov/

B.3 CONTRACT ADMINISTRATION DATA

(continuation from Standard Form 1449, block 18A.)

1. Contract Administration: All contract administration matters will be handled by the following individuals:

a. CONTRACTOR: To Be Determined

b. GOVERNMENT: Contracting Officer (36C10B)

Technology Acquisition Center

Eatontown, NJ 07724

2. CONTRACTOR REMITTANCE ADDRESS: All payments by the Government to the contractor will be made in accordance with:

[X] 52.232-33, Payment by Electronic Funds Transfer—System For Award

Management, or

3. INVOICES: Invoices shall be submitted in arrears:

a. Quarterly [ ]

b. Semi-Annually [ ]

c. Other [X] Upon Acceptance of Sprint Certification Package IAW PWS paragraph 5.2.1 and upon acceptance of deliverables in Section B.4 and IAW Section B.5

Performance Work Statement, Section 6.4.1 for Deliverable Metrics/SLA Performance.

4. GOVERNMENT INVOICE ADDRESS: All Invoices from the contractor shall be submitted electronically in accordance with VAAR Clause 852.232-72 Electronic Submission of

Payment Requests.

5. ACKNOWLEDGMENT OF AMENDMENTS: The Quoter acknowledges receipt of amendments to the RFQ numbered and dated as follows:

AMENDMENT NO DATE

B.4 PRICE SCHEDULE

Inspection/Acceptance//F.O.B: Destination.

All deliverables must be submitted electronically to the VA Program Manager (PM), Contracting

Officer’s Representative (COR), and Contracting Officer unless otherwise specified in the line item. Please be advised that in accordance with Federal Acquisition Regulation (FAR) Part

2.101, a “day” means, unless otherwise specified, a CALENDER day. Additionally, deliverables with due dates falling on a weekend or holiday shall be submitted the following Government work day after the weekend or holiday.

The Price Schedule contains contract line items identified as not separately priced (NSP). This means the price for the line item is included in the price of another, related line item. The

Contractor shall not invoice the Government for any portion of the contract line item which contains an NSP until the Contractor has delivered the total quantity of all related contract line items and the Government has accepted them.

The Contractor shall meet all Deliverable Metrics/Service Level Agreements (SLA) as described in the Performance Work Statement (PWS). However, if the Contractor’s performance falls below a required service level, the Contractor shall only be paid for the lower service level provided. See Section B.5 Performance Work Statement, Section 6.4.1 for Deliverable

Metrics/SLA Performance.

NOTE: Vendors are instructed to see Request for Quote (RFQ) Section E for proposal submission instructions inclusive of the price quote. The Section B.4 Price Schedule of the RFQ is for informational purposes only and shall not be completed. Quoters are cautioned that alterations to the line items as specified below may render quotes unacceptable. All questions shall be directed to the Contract Specialist, Michael Frank, Michale.Frank@va.gov and

Contracting Officer, Juan Quinones, Juan.Quinones@va.gov prior to the closing date and time specified in the RFQ.

Base Period

Period of Performance: 12 months from date of award

CLIN DESCRIPTION QTY UNIT UNIT PRICE TOTAL PRICE

0001 Project Management in accordance with

(IAW) paragraphs 5.1 of the Performance

Work Statement (PWS).

This Firm-Fixed-Price (FFP) Contract Line

Item Number (CLIN) includes all labor, travel and deliverables required for the successful completion of the services detailed in PWS paragraphs 5.1 (inclusive of all of its subparagraphs).

The price of CLIN 0001 shall be included in and allocated to CLIN 0002 and CLIN 0003.

Period of performance shall be 12 months from date of award.

12 MO NSP NSP

mailto:Michale.Frank@va.gov mailto:Juan.Quinones@va.gov

0001AA Monthly Status Report IAW paragraph

5.1.1 of the PWS.

Due the fifth day of each month throughout the period of performance.

12 EA NSP NSP

0001AB Privacy and HIPAA Training -

TMS Training Certificates of Completion for VA Privacy and Information Security

Awareness Training IAW paragraphs 5.1.4 of the PWS.

Due 1 week after award and/or one week after on-boarding of new employee and annually as required throughout the period of performance for all Contractor employees.

1 LO NSP NSP

0001AC VA Privacy and Information Security

Awareness Signed Rules of Behavior IAW paragraphs 5.1.4 of the PWS.

annually as required throughout the period of performance for all Contractor employees.

1 LO NSP NSP

0001AD VA HIPAA Certificate of Completion

IAW paragraphs 5.1.4 of the PWS.

annually as required throughout the period of performance for all Contractor employees.

1 LO NSP NSP

0002 VA API Development IAW paragraphs

5.2.1 of the PWS.

This FFP CLIN includes all labor, travel, software licenses and deliverables required for the successful completion of the tasks

IAW PWS paragraph 5.2.1.

The Government anticipates that the number of sprints and the total price of CLIN 0002 in conjunction with the total prices of CLINs

0003, 0006 and 0007 should maximize the

Governments budget and Subpart 13.5 –

Simplified Procedures for Certain

Commercial Items threshold of $7M.

Instructions: The Quoter shall propose the unit price per sprint and complete the quantity of sprints it can accomplish in a 12-

Fill-in

QTY _

EA $ NTE $

month period for the total price proposed for

CLIN 0002.

Contractor may invoice after Government acceptance of Sprint Certification Package and Artifacts. Contractor may only submit one invoice per month and include all sprints completed during that period.

0002AA Sprint Plan IAW paragraph 5.2 of the PWS

Due at the beginning of each two-week sprint. The Contractor shall update the

Sprint Plan at the conclusion of the sprint planning.

1 EA NSP NSP

0002AB Product Roadmap IAW paragraph 5.2 of the PWS

Due at the conclusion of the first sprint and updated thereafter with each sprint.

1 EA NSP NSP

0002AC Discovery Reports IAW paragraph 5.2 of

Due at the conclusion of the sprint when discovery is a prioritized item in the sprint.

1 EA NSP NSP

0002AD API Documentation IAW paragraph 5.2 of

Due at the conclusion of the first sprint and updated thereafter with each sprint.

1 EA NSP NSP

0002AE Sprint Certification Package and Artifacts

IAW paragraph 5.2 of the PWS

Due at conclusion of each two-week sprint.

1 LO NSP NSP

0002AF API Code IAW paragraph 5.2 of the PWS

Due at conclusion of each two-week sprint.

0002AG API Marketing, Outreach, and Product

Management IAW PWS Paragraph 5.2.1.1

12 MO NSP NSP

0003 API Operations IAW paragraph 5.2.2 of the

PWS.

This FFP CLIN includes all labor, travel, software licenses and other costs required for the successful completion of the tasks IAW

PWS paragraph 5.2.2.

Period of performance shall be 12 months from date of award.

12 MO $ $

0003AA SLA Monitoring Plan IAW paragraphs

5.2.2 of the PWS

Due within 30 days after award and updated as needed.

1 LO NSP NSP

0003AB Monthly VA API SLA Report IAW paragraphs 5.2.2 of the PWS

Due within 30 days after award and updated monthly thereafter.

1 LO NSP NSP

0003AC Postmortems IAW paragraphs 5.2.2 of the

PWS

A template for the postmortems due within

30 days of award. Postmortems due within one-week of production outages.

1 LO NSP NSP

0003AD Authority to Operate Package

Documentation IAW paragraphs 5.2.2.1 of

Updates due as changes occur.

0003AE Monitoring and Alerting IAW paragraph

5.2.2.2 of the PWS.

12 MO NSP NSP

0003AF Quarterly Resource Utilization

Optimization Plan

IAW paragraph 5.2.2.3 of the PWS.

Due quarterly

4 EA NSP NSP

0003AG Monthly Utilization Report IAW paragraph

5.2.2.3 of the PWS.

Due monthly

12 EA NSP NSP

0003AH Monthly Security Assessment Report IAW paragraph 5.2.2.4 of the PWS.

Due monthly

1 EA NSP NSP

0004 Contractor Staff Roster

IAW PWS Paragraph 6.2.2

Due three days ARO and updated within one day of any changes in employee’s status.

Electronic submission to: VA PM, COR, CO

The price of this CLIN shall be allocated to

CLIN 0002 and 0003.

1 LO NSP NSP

0005 Final Section 508 Compliance Test Results

IAW paragraph A3.4 of the PWS.

1 EA NSP NSP

Due upon delivery of each deliverable.

The price of this CLIN shall be allocated to

CLIN 0002 and CLIN 0003.

BASE PERIOD TOTAL $

OPTIONAL TASKS:

This is an optional task, FAR 52.217-7, Option for Increased Quantity – Separately priced Line

Item (MAR 1989). Work shall not commence until, and unless, a formal modification is issued by the Contracting Officer. This optional task can be exercised from time to time, multiple times not to exceed 12 months in total.

CLIN DESCRIPTION QTY UNIT UNIT PRICE TOTAL PRICE

0006 Optional Tasks: Labor Hour CLINs IAW

PWS Paragraphs 5.3 – 5.4.2

5.3 VA API Gateway Development and

Operations

5.4.1 API Developer Portal

5.4.2 Governance and Technical Support

This is a Labor Hour CLIN and includes all labor and deliverables required for the successful completion of the services detailed in PWS sections 5.3 – 5.4.2 and their subparagraphs.

This Labor Hour CLIN is IAW FAR 52.232-

7 for invoicing or billing purposes.

The Contractor shall not execute performance on this task without approval from the Contracting Officer via a modification. Labor-Hour rates shall not exceed those set forth in Attachment 005.

This optional task may be exercised multiple times from time to time up to the NTE amount.

1 LO NTE $ NTE $

0006AA VA API Gateway Development and

Operations IAW PWS Paragraphs 5.3

1 LO NSP NSP

0006AB API Developer Portal IAW PWS Paragraph

5.4.1

1 LO NSP NSP

0006AC Governance and Technical Support IAW

PWS Paragraph 5.4.2

1 LO NSP NSP

0007 Software License Management IAW PWS paragraph 5.4.3.

1 LO NTE$ NTE$

This is a T&M CLIN and includes all labor and software licenses required for the successful completion of PWS Task 5.4.3.

Work shall be executed in accordance with funding provided at time of award or under formal modification. Work shall not commence unless and until funding is provided by the Contracting Officer. T&M rates shall not exceed those set forth in

Attachment 005.

This T&M CLIN is IAW FAR 52.232-7 for invoicing or billing purposes.

*Government Not to Exceed Material

Ceiling: $_____

+ Fixed Handling Rate ______ %

= Material NTE Ceiling $

OPTIONAL TASKS TOTAL $

CONTRACT TOTAL (INCLUSIVE OF ALL OPTIONS) $

36C10B18Q2839

B.5 PERFORMANCE WORK STATEMENT

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS (VA)

Office of Information & Technology

Enterprise Program Management Office (EPMO)

VA API Development and Operations

Date: August 20, 2018

TAC-18-49850

Version Number: 1.0

1.0 BACKGROUND

The Department of Veterans Affairs (VA) requires Contractor support to design, develop, and maintain various aspects of the VA Application Programming Interface (API) platform, including but not limited to platform design, API development and maintenance, developer documentation, and product management best practices to work with teams internal and external to VA, using modern software development methods and tools.

From shopping for car insurance, to paying bills online, to scheduling a dentist appointment, Americans expect the places where they do business to offer easy-to-use, secure digital tools.

Veterans, caregivers, Servicemembers, Veterans Service Organizations (VSO), and VA’s other users are no different; they expect VA to offer a digital experience on par with the private sector companies they interact with in their day-to-day lives.

VA is taking an API-first strategy to deliver the high quality digital experiences our users expect.

A single set of APIs will power every VA digital service, and these same APIs will be exposed to approved third parties to build products and applications on top of VA services and data.

These APIs across every vertical of VA’s business will enable VA users to receive a consistent, high quality experience across all VA communication channels (e.g., digital, phone, mail, in-person, etc.).

The health industry is quickly converging on the Fast Healthcare Interoperability Resources

(FHIR) standard to enable enhanced data interoperability between both internal and external systems. API-enabled and FHIR based solutions are easier for developers to implement as it makes use of modern web standards and RESTful architectures with more easily understood specifications. By liberating data and enhancing interoperability with FHIR, VA will shift data ownership to Veterans, making it more readily available.

In the benefits space, VSOs and other third parties spend significant amounts of time manually looking in VA systems to check on the status of a claim for a Veteran they are working with, or to find out if a rating has been granted. If VA were instead able to provide APIs to this information, authorized individuals and organizations would be able to access it more readily, improving the experience they can provide for Veterans and reducing VA costs.

Finally, one of VA’s core competencies should be “knowing and sharing what we know” about a

Veteran, including data such as service history, accurate mailing address, and disability ratings.

VA should be able to share this information with Veterans and Veteran-authorized third parties.

Veterans should not need to upload a Department of Defense Form 214 (DD214) to a website to prove their military service history or discharge status, which is not only difficult for some

Veterans but also presents identity theft risks by needlessly sharing personally identifiable information (PII). With APIs, VA plans to put this data back in the hands of Veterans so that they can use it more efficiently and securely, resulting in a better, more personalized digital experience for Veterans.

This contract is not for creating a specific number of APIs, or APIs in a single domain, but rather for agile, cross-functional teams that can work alongside a VA product team to prioritize, build, operate, and iterate on APIs across many parts of VA. It will include creating new APIs, refactoring or replatforming existing APIs, building on top of existing APIs, and/or working with other teams to improve their APIs and/or expose their data in a modern way.

2.0 APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. “Federal Information Security Modernization Act of 2014”

2. Federal Information Processing Standards (FIPS) Publication 140-2, “Security

Requirements For Cryptographic Modules”

3. FIPS Pub 200, Minimum Security Requirements for Federal Information and

Information Systems, March 2016

4. FIPS Pub 201-2, “Personal Identity Verification of Federal Employees and

Contractors,” August 2013

5. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

6. Public Law 109-461, Veterans Benefits, Health Care, and Information Technology

Act of 2006, Title IX, Information Security Matters

7. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”

8. VA Handbook 0710, Personnel Security and Suitability Security Program, May 2,

9. Office of Management and Budget (OMB) Circular A-130, “Managing Federal

Information as a Strategic Resource,” July 28, 2016

10. An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule, October 2008

11. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended by the Workforce Investment Act of 1998 (P.L. 105-220), August 7, 1998

12. VA Handbook 6500, “Risk Management Framework for VA Information Systems –

Tier 3: VA Information Security Program,” March 10, 2015

13. VA Handbook 6500.1, “Electronic Media Sanitization,” November 03, 2008

14. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal

Information (SPI)”, July 28, 2016

15. VA Handbook 6500.3, “Assessment, Authorization, And Continuous Monitoring Of

VA Information Systems,” February 3, 2014

16. VA Handbook 6500.5, “Incorporating Security and Privacy in System Development

Lifecycle”, March 22, 2010

17. VA Handbook 6500.6, “Contract Security,” March 12, 2010

18. VA Handbook 6500.8, “Information System Contingency Planning”, April 6, 2011

19. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

20. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy

Impact Assessment,” October 15, 2014

21. VA Handbook 6508.1, “Procedures for Privacy Threshold Analysis and Privacy

Impact Assessment,” July 30, 2015

22. VA Handbook 6510, “VA Identity and Access Management”, January 15, 2016

23. VA Handbook, 6300.1, Records Management Procedures, March 24, 2010

24. NIST SP 800-37, Guide for Applying the Risk Management Framework to Federal

Information Systems: a Security Life Cycle Approach, June 10, 2014

25. NIST SP 800-53 Rev. 4, Security and Privacy Controls for Federal Information

Systems and Organizations, January 22, 2015

26. OMB Memorandum, “Transition to IPv6”, September 28, 2010

27. VA Directive 0735, Homeland Security Presidential Directive 12 (HSPD-12)

Program, October 26, 2015 https://www.va.gov/trm/TRMHomePage.aspx

28. OMB Memorandum M-07-16, Safeguarding Against and Responding to the Breach of Personally Identifiable Information, May 22, 2007

29. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, Digital Identity Guidelines, June

30. Trusted Internet Connections (TIC) Reference Architecture Document, Version 2.0, Federal Interagency Technical Reference Architectures, Department of Homeland

Security, October 1, 2013, https://s3.amazonaws.com/sitesusa/wp-content/uploads/sites/482/2015/04/TIC_Ref_Arch_v2-0_2013.pdf

31. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote

Access”, January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

32. “Veteran Focused Integration Process (VIP) Guide 2.0”, May 2017, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

33. VA Memorandum “Use of Personal Email (VAIQ #7581492)”, April 24, 2015, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

34. VA Memorandum “Updated VA Information Security Rules of Behavior (VAIQ

#7823189)”, September, 15, 2017, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

35. API Best Practices

a. 18 F API Standards (https://github.com/18F/api-standards)

b. WH API Standards https://github.com/WhiteHouse/api-standards

36. Building Twelve-Factor App (https://12factor.net/).

37. Experience with incorporating and using open source technologies

(https://sourcecode.cio.gov/OSS/).

38. The Agile Manifesto (http://www.agilemanifesto.org/)

39. The U.S. Digital Services Playbook (https://playbook.cio.gov/)

40. The Techfar Hub (https://techfarhub.cio.gov/)

41. VA Enterprise Cloud (VAEC) Technical Reference Guide for Acquisition Support, October 2017 (Attachment 001)

3.0 SCOPE OF WORK

The Contractor shall provide VA with agile development and operations of APIs and support for the VA API Gateway. This includes project management, product management, requirements refinement, human centered design, iterative development, user research and usability testing, standards enforcement, automated testing, performance metrics definition and reporting, automated monitoring and performance reporting, and continuous integration / continuous delivery (CI/CD) for the development and enhancement of APIs and the API Gateway.

Through the Government’s prioritization of the backlog, the Contractor shall prioritize execution of all aspects of the API Gateway. The Contractor shall also work to ensure that all APIs are deployed or migrated into a VA designated cloud.

The Government will provide the Contractor with access to the VAEC to include the credits required for all VAEC cloud development, testing, and production environment requirements.

The VAEC includes a secure dedicated Wide Area Network connection between VA and the

VAEC Cloud Service Provider (CSP). The Contractor shall not be responsible for buying cloud credits for this contract. The VAEC is currently supported by two Federal Risk and

Authorization Management Program (FedRAMP) High Certified and VA ATO approved CSPs.

Both VAEC environments provide access to all of each CSP's FedRAMP Authorized Services in their respective cloud to implement the proposed solution. In addition, each VAEC CSP provides https://s3.amazonaws.com/sitesusa/wp-content/uploads/sites/482/2015/04/TIC_Ref_Arch_v2-0_2013.pdf https://s3.amazonaws.com/sitesusa/wp-content/uploads/sites/482/2015/04/TIC_Ref_Arch_v2-0_2013.pdf https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371 https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 https://github.com/18F/api-standards) https://github.com/WhiteHouse/api-standards https://12factor.net/) https://sourcecode.cio.gov/OSS/ http://www.agilemanifesto.org/ http://www.agilemanifesto.org/) https://playbook.cio.gov/ https://playbook.cio.gov/) https://techfarhub.cio.gov/) a set of common shared services such as security scanning; Active Directory and single-sign

(SSO); PIV integration; and performance monitoring to facilitate solution implementation.

Specifications for each VAEC CSP, including access requirements, will be provided at the project kick off meeting.

A Minimum Viable Product (MVP) API Gateway has already been stood up in AWS but the contractor may propose the use of a different VAEC cloud if they can demonstrate how the alternative will provide equal to or superior performance than AWS at equal to or lower cost to the Government, including transition costs. The MVP API Gateway is using open-source Kong, but the Contractor may propose the use of other API Gateway products if they can demonstrate how the product and platform will provide equal to or superior performance than Kong at equal to or lower cost to the Government, including transition costs.

The Contractor’s support and solutions shall align with the U.S. Digital Services Playbook

(https://playbook.cio.gov). The Contractor shall be familiar with the concepts in each play and implement them in its approaches and support.

4.0 PERFORMANCE DETAILS

This is a hybrid Firm-Fixed Price (FFP)/Time-and-Materials (T&M)/Labor-Hour type contract.

4.1 PERFORMANCE PERIOD

The Period of Performance shall consist of one 12-month period.

There are 10 Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, four are set by date:

New Year's Day January 1

Independence Day July 4

Veterans Day November 11

Christmas Day December 25

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

Martin Luther King's Birthday Third Monday in January

Washington's Birthday Third Monday in February

Memorial Day Last Monday in May

Labor Day First Monday in September

Columbus Day Second Monday in October

Thanksgiving Fourth Thursday in November

4.2 PLACE OF PERFORMANCE

Tasks under this PWS may be performed at Contractor facilities. The Contractor is expected to attend in-person VA meetings and / or working sessions as requested by VA.

https://playbook.cio.gov/

4.3 TRAVEL

The Government anticipates travel under this effort to perform the tasks associated with the effort, as well as to attend program-related meetings or conferences throughout the PoP. The meeting locations shall be located in Washington, DC. The Contractor shall include all estimated travel costs in its FFP line items. These costs will not be directly reimbursed by the

Government. The following is the estimated travel for the FFP portion of the effort.

Purpose Number of

Trips

TT TTrips

Number of Days

Number of

Staff

Kick-off Meeting 1 1-3 4

Quarterly Program Reviews 4 1-3 4

5.0 SPECIFIC TASKS AND DELIVERABLES

The Contractor shall perform the following:

5.1 PROJECT MANAGEMENT

5.1.1 REPORTING REQUIREMENTS

The Contractor shall deliver Monthly Status Reports. These reports shall provide accurate, timely, and complete project information supporting reporting Requirements. The Monthly

Status Report shall include the following data elements and reporting capability shall address the below requirements:

a. Project Name

b. Overview and description of the contract

c. Overall high-level assessment of contract progress

d. All work in-progress and completed during the reporting period

e. Identification of any contract related issues uncovered during the reporting period and especially highlight those areas with a high probability of impacting schedule, cost or performance goals and their likely impact on schedule, cost, or performance goals

f. Explanations for any unresolved issues, including possible solutions and any actions required of the Government and/or Contractor to resolve or mitigate any identified issue, including a plan and timeframe for resolution

g. Status on previously identified issues, actions taken to mitigate the situation and/or progress made in rectifying the situation.

h. Work planned for the subsequent two reporting periods, when applicable

i. Provide expenditures based upon your proposed spend plan.

j. Workforce staffing data showing all Contractor personnel performing on the effort by task during the current reporting period along with status of their background investigation/VA clearance and biographies. After the initial labor baseline is provided, each Monthly Status Report shall identify any changes in staffing identifying each person who was added to the contract or removed from the contract.

k. Original schedule of deliverables at the start of each sprint and the corresponding deliverables made during the current reporting period.

l. Cost analysis that includes consumption of cloud resources by API.

m. Software licenses at or nearing end of life and software security certificates nearing expiration.

The Contractor shall communicate with VA so that issues that arise are transparent to both parties to prevent escalation of outstanding issues.

For each T&M/Labor-Hour task, indicate:

a. Summary of work performed

b. Expenditures for the reporting period, to include prime labor and each subcontractor identified separately

c. Contract Line Item Number expenditure

d. Burn rate

e. Percentage of work completed

Deliverable:

A. Monthly Status Report

5.1.2 TECHNICAL KICK-OFF MEETING

The Contractor shall conduct a kick-off meeting with the VA PM, Contracting Officer’s

Representative (COR) and the Contracting Officer (CO). The meeting shall be held within 10 business days after contract award. The kick-off meeting shall be an in-person meeting in a VA or

VA-approved Contractor facility. The Contractor shall propose an agenda for VA COR approval three days prior to the meeting. The Contractor shall provide meeting minutes capturing discussion, agreements, and action items resulting from the kick-off meeting. The kick-off meeting shall address post award topics and shall present the Contractor’s draft plans and approach for meeting PWS requirements.

5.1.3 KEY PERSONNEL

Specific expertise and experience in product management, engineering, and operating highly available products is essential for accomplishing the tasks outlined in this PWS. The Contractor shall identify statements of qualifications for individuals that will fulfill the key personnel positions identified below.

Key Roles:

• Product Manager:

o Experience managing entire agile software development lifecycle for a project of at least one million dollars up to and including production delivery and some phase of post-delivery support.

o Experience as a product manager accountable for delivery with at least 10 software professionals with a duration of greater than one year.

o Demonstrated success with delivering digital products.

• Chief Engineer:

o Background as a Software Engineer for at least five years, including experience as a Software Engineer for at least one project in one of the VAEC’s CSP Vendors

Clouds.

o Chief Architect or Senior Engineer on a production system in one of the VAEC

CSP Vendors Clouds.

o Demonstrated knowledge and use of modern software development and Dev/Ops tools, including GitHub.

• Chief Operations Manager:

o Background as a Software Engineer, Site Reliability Engineer, or DevOps

Engineer for at least three years.

o Experience running a 24x7 Software based System for at least 6 months.

o Experience with oversight of an operations team of at least 5 people for at least one year.

o Experience in Incident Management for a software based system.

o Experience with oversight of a team running a trouble ticket system.

o Demonstrated success using modern DevOps methods and tools including automated testing tools and monitoring tools.

o Demonstrated ability to drive frequent release cycles (daily / weekly)

Any personnel the Contractor offers as substitutes shall have the ability and qualifications equal to or better than the key personnel which are being replaced. If any change to a key personnel position becomes necessary, the Contractor shall immediately notify the VA PM and COR in writing, but whenever possible Contractor shall notify the VA PM of substitutions in personnel in writing 30 calendar days prior to making any change in key personnel, and provide a detailed explanation of the circumstances necessitating the proposed substitution and shall demonstrate that the proposed replacement personnel are of at least substantially equal ability and qualifications as the individual originally proposed for that position.

The Contractor agrees that it has a contractual obligation to mitigate the consequences of the loss of Key Personnel and shall promptly secure any necessary replacements in accordance with

(IAW) this PWS section. Failure to replace a Key Person pursuant to this clause and without a break in performance of the labor category at issue shall be considered a condition endangering contract performance and may provide grounds for termination for cause.

5.1.4 PRIVACY AND HIPAA TRAINING

The Contractor shall submit status of VA Privacy and Information Security Awareness training for all individuals engaged on the task. The status reporting shall identify; a single Contractor

Security Point of Contract, the names of all personnel engaged on the task, their initial training date for VA Privacy and Information Security training, and their next required training date. This information shall be submitted as part of the Weekly/ Progress Status Report.

The Contractor shall submit Talent Management System (TMS) training certificates of completion for VA Privacy and Information Security Awareness training. The Contractor shall also provide VA Privacy and Information Security Awareness Signed Rules of Behavior, and

VA Health Insurance Portability and Accountability Act (HIPAA) Certificate of Completion

IAW Section 9, Training, from Appendix C of the VA Handbook 6500.6, “Contract Security”.

Deliverables:

A. TMS Training Certificates of Completion for VA Privacy and Information Security

Awareness Training

B. VA Privacy and Information Security Awareness Signed Rules of Behavior

C. VA HIPAA Certificate of Completion

5.2 VA API Development & Operations

VA is taking an API-first strategy to deliver the high quality digital experiences our users expect.

A single set of APIs will power every VA digital service, and these same APIs will be exposed to approved third parties to build products and applications on top of VA services and data.

These APIs across every vertical of VA’s business will enable VA users to receive a consistent, high quality experience across all VA communication channels (e.g., digital, phone, mail, in-person, etc.).

5.2.1 API Development

The Contractor shall provide cross-functional Contractor Sprint Teams for the development of

VA APIs. This contract is not for creating a specific number of APIs, or APIs in a single domain, but rather for agile, cross-functional teams that can work alongside a VA product team to prioritize, build, operate, and iterate on APIs across many parts of VA. It will include creating new APIs, refactoring or replatforming existing APIs, building on top of existing APIs, and/or working with other teams to improve their APIs and/or expose their data in a modern way. The specific scope of functionality of the tasks will be determined by VA API Product Owners and the VA PM/COR, prior to sprint commencing. At the beginning of each two-week sprint, each

Contractor Sprint Team shall initiate, coordinate, and participate in a Sprint Planning Meeting and develop a Sprint Plan with the VA Project Team, including the VA PM, COR, designated

VA Product Owner and additional stakeholders, to plan the work to be accomplished for the sprint. Additionally, the team shall determine the acceptance criteria for the sprint and populate the Sprint Backlog.

The Contractor, in collaboration with the VA Project Team, shall prioritize a backlog, estimate the relative complexity of each task, and determine the amount of work that can be accomplished in a two-week sprint. All activity scheduled in each sprint and backlog shall be captured and have status showing all work items, changes, and impediments. The Contractor shall update the

Sprint Plan at the conclusion of the sprint planning. Once the Sprint Plan is accepted by the VA

PM/COR and the VA Product Team, the sprint backlog may change throughout the duration of the sprint, however, the effort of work will remain constant.

The Contractor shall provide a Sprint Demonstration that confirms all functionality developed in the sprint is operational. At the Sprint Demonstration, the Contractor Sprint Team shall submit a

Sprint Certification Package to the VA PM/COR for review and approval.

The Sprint Certification Package shall include a summary of the planned, accomplished, and unaccomplished work for the two-week sprint to include issues encountered and corrective actions taken as well as all artifacts produced, including any and all code (submitted to a VA source code repository, such as GitHub), during the sprint. This package, certification that all work is completed, and a demonstration that all work planned for the sprint has been fully implemented, are necessary for sprint acceptance by the Government. The Contractor shall complete all work planned for each sprint and receive VA PM/COR approval of the Sprint

Certification Package for the prior sprint before beginning a new sprint.

Specifically, the Contractor shall support the building and maintaining of APIs as products, including:

a. Discovery - Conduct discovery activities on existing VA APIs as well as internal and external business process flows and functions. Work closely with VA customers to understand their needs and how those map to VA capabilities. Collect available data, user feedback, and VA stakeholder feedback and capture in a Discovery Report.

b. Product Roadmap - A comprehensive list of the APIs and API functionality that needs to be built or updated and prioritization of these based on Discovery that has happened.

c. Coordination - Participate in VA stakeholder meetings, some of which will be in-person at VA facilities, to plan building and integrating the services and change management activities including but not limited to managing agendas, minutes, action items, and collaboration tool management meetings.

d. Mock API development – Mock proposed APIs to receive feedback from potential consumers and iterate on designs quickly prior to beginning software development.

e. Code Development - Define, author, and deliver code in a way that meets private sector best practices, meets the needs of the users, and conforms to the requirements and architecture provided by the government; ensure peer reviews for code quality;

incorporate testing into code development, including security scans. The Contractor shall follow an agile methodology that may result in several production releases in each sprint.

The Contractor shall adhere to objectives defined in the U.S. Digital Services Playbook, as well as VA’s VIP policy. All Contractor team members shall be proficient on VA tools, including GitHub, and all code should be developed in the open.

f. Integration Support – Integrate with external systems and other VA systems as needed to access appropriate data, including configuring, testing, and documenting the integration.

g. Data Migration – Develop, implement, and document any necessary data migration strategies/plan(s).

h. Deployment Activities - Plan for, create and validate the implementation and deployment instructions for use during service deployment. All deployment steps should be instrumented as infrastructure as code.

i. DevOps – Work collaboratively and cross functionally with other contractor engineering and DevOps teams to implement CI/CD processes.

j. Metrics Reporting – Develop and communicate product metrics. Metrics may include but are not limited to how many users are using the product, transactions performed, concurrent users, and value provided to the VA and API consumers. This task includes identifying and measuring baseline metrics for comparison.

k. Communication - Participating in integrated program/project teams and/or Scrum teams to enhance communication, share lessons learned, and facilitate rapid identification and mitigation of dependencies between various functional entities. The includes communication internal and external to VA.

l.…