GS-35F-0382T-007.pdf

Table of Contents

SECTION A

A.1 SF 1449 SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

Table of Contents

A.2 SUMMARY OF ORDER

A.3 GOVERNING LAW

SECTION B - CONTINUATION OF SF 1449 BLOCKS

B.1 CONTRACT ADMINISTRATION DATA

B.2 PRICE SCHEDULE

B.3 PERFORMANCE WORK STATEMENT

ADDENDUM A – ADDITIONAL VA REQUIREMENTS, CONSOLIDATED

SECTION C - CONTRACT CLAUSES

C.1 FSS RFQ INTRODUCTORY LANGUAGE

C.2 52.252-2 CLAUSES INCORPORATED BY REFERENCE (FEB 1998)

C.3 52.203-19 PROHIBITION ON CONTRACTING WITH ENTITIES THAT REQUIRE

CERTAIN INTERNAL CONFIDENTIALITY AGREEMENTS (JAN 2017)

C.4 52.217-9 OPTION TO EXTEND THE TERM OF THE CONTRACT (MAR 2000)

C.5 VAAR 852.203-70 COMMERCIAL ADVERTISING (JAN 2008)

C.6 VAAR 852.232-72 ELECTRONIC SUBMISSION OF PAYMENT REQUESTS (NOV

2018)

C.7 VAAR 852.237-70 CONTRACTOR RESPONSIBILITIES (APR 1984)

C.8 VAAR 852.270-1 REPRESENTATIVES OF CONTRACTING OFFICERS (JAN

2008)

SECTION D - CONTRACT DOCUMENTS, EXHIBITS, OR ATTACHMENTS

GS-35F-0382T 36C10B19F0096

A.2 SUMMARY OF ORDER

This action GS-35F-0382T 36C10B19F0096 titled, “Verizon Business PKI Solution” is issued on a Firm-Fixed-Price (FFP) basis for the requirements as detailed in Section B.3, Performance Work Statement. The Contractor’s proposal in full is incorporated by reference at Section D.

The period of performance shall be a 12-month base period commencing on February 10, 2019 through February 9, 2020, with two one option period up to 12 months.

The total value of this order is $4,877,400.00. Funds in the amount of $2,438,700.00 have been obligated to fully fund the base period.

Invoice(s) shall reference PO Number 116-S95579 and Order number

36C10B19F0096.

The Contracting Officer’s Representative (COR) for this effort is Rolanda Copeland, Rolanda.Copeland@va.gov.

A.3 GOVERNING LAW

Federal law and regulations, including the Federal Acquisition Regulations (FAR), shall govern this Contract/Order. Commercial license agreements may be made a part of this Contract/Order but only if both parties expressly make them an addendum hereto.

If the commercial license agreement is not made an addendum, it shall not apply, govern, be a part of or have any effect whatsoever on the Contract/Order; this includes, but is not limited to, any agreement embedded in the computer software (clickwrap), any agreement that is otherwise delivered with or provided to the Government with the commercial computer software or documentation (shrinkwrap), or any other license agreement otherwise referred to in any document. If a commercial license agreement is made an addendum, only those provisions addressing data rights regarding the

Government’s use, duplication and disclosure of data (e.g., restricted computer software) are included and made a part of this Contract/Order, and only to the extent that those provisions are not duplicative or inconsistent with Federal law, Federal regulation, the incorporated FAR clauses and the provisions of this Contract/Order;

those provisions in the commercial license agreement that do not address data rights regarding the Government’s use, duplication and disclosure of data shall not be included or made a part of the Contract/Order. Federal law and regulation including, without limitation, the Contract Disputes Act (41 U.S.C. § 7101 et seq.), the Anti-

Deficiency Act (31 U.S.C. § 1341 et seq.), the Competition in Contracting Act (41 U.S.C.

§ 3301 et seq.), the Prompt Payment Act (31 U.S.C. §3901 et seq.), Contracts for Data

Processing or Maintenance (38 USC § 5725), and FAR clauses 52.212-4, 52.227-14, 52.227-19 shall supersede, control, and render ineffective any inconsistent, conflicting, or duplicative provision in any commercial license agreement. In the event of conflict between this Clause and any provision in the Contract/Order or the commercial license agreement or elsewhere, the terms of this Clause shall prevail. Claims of patent or copyright infringement brought against the Government as a party shall be defended by the U.S. Department of Justice (DOJ). 28 U.S.C. § 516. At the discretion of DOJ, the

Contractor may be allowed reasonable participation in the defense of the litigation. Any additional changes to the Contract/Order must be made by contract/order modification

(Standard Form 30) and shall only be effected by a warranted Contracting Officer.

Nothing in this Contract/Order or any commercial license agreement shall be construed as a waiver of sovereign immunity.

SECTION B - CONTINUATION OF SF 1449 BLOCKS

B.1 CONTRACT ADMINISTRATION DATA

(continuation from Standard Form 1449, block 18A.)

1. Contract Administration: All contract administration matters will be handled by the following individuals:

a. CONTRACTOR: MCI Communications Services Inc.

Verizon Business Services

b. GOVERNMENT: Kevin Monahan Contracting Officer 36C10B Department of Veterans Affairs Technology Acquisition Center 23 Christopher Way Eatontown NJ 07724

2. CONTRACTOR REMITTANCE ADDRESS: All payments by the Government to the contractor will be made in accordance with:

[x] 52.232-33, Payment by Electronic Funds Transfer—System For Award Management, or

[] 52.232-36, Payment by Third Party

3. INVOICES: Invoices shall be submitted in arrears:

a. Quarterly []

b. Semi-Annually []

c. Other [X] Monthly upon successful completion of services IAW

Section B.2, Price Schedule]

4. GOVERNMENT INVOICE ADDRESS: All Invoices from the contractor shall be submitted electronically in accordance with VAAR Clause 852.232-72 Electronic Submission of Payment

Requests.

ACKNOWLEDGMENT OF AMENDMENTS: The offeror acknowledges receipt of amendments to the Solicitation numbered and dated as follows:

AMENDMENT NO DATE

B.2 PRICE SCHEDULE

Base Year

The period of performance for the base period shall be twelve (12) months from 02/10/2019 through 02/09/2020.

CLIN Description/ Part Number QTY Unit Unit Price Total Price

0001 PKI Certificate Services for certificate issuance, full digital certificate lifecycle management, and digital certificate validation services in a manner that is compliant with

FIPS 201 and the Federal PKI

Common Policy requirements in accordance with (IAW) PWS

Sections 5.1 through 5.2, inclusive of all subparagraphs.

12 MO $203,225.00 $2,438,700.00

0001AA Contractor Project

Management Plan IAW PWS

5.1.2

Due 30 days after award and updates due monthly thereafter.

Electronic submission to: VA

PM, COR, CO

Inspection/Acceptance:

Destination

1 LO Not

Separately

Priced (NSP)

NSP

0001AB Monthly Teleconference

Meeting Report IAW PWS

5.1.3

Due three calendar days after teleconference.

Electronic submission to: VA

PM, COR, CO

1 LO NSP NSP

Inspection/Acceptance:

Destination

0001AC Ad Hoc Reports IAW PWS

5.1.3

Due two business days after receipt of request, for all reports throughout the PoP

Electronic submission to: VA

PM, COR, CO

Inspection/Acceptance:

Destination

1 LO NSP NSP

0001AD PKI SSP Certificates IAW

PWS 5.2

Due as required, after receipt of Government request.

Electronic submission to: VA

PM, COR, CO

Inspection/Acceptance:

Destination

1 LO NSP NSP

0001AE Certificate Revocation List IAW

PWS 5.2

Due immediately upon PKI

Certificate request

Electronic submission to: VA

PM, COR, CO

Inspection/Acceptance:

Destination

1 LO NSP NSP

0001AF Online Certificate Status

Protocol IAW PWS 5.2

Due immediately upon PKI

SSP Certificate request

Electronic submission to: VA

PM, COR, CO

Inspection/Acceptance:

Destination

0001AG Yearly Audit Report IAW PWS

5.2

Due within three business days after receipt of Government request

Electronic submission to: VA

PM, COR, CO

Inspection/Acceptance:

Destination

1 LO NSP NSP

0001AH Operational Administrative

Certificates and Keys IAW

PWS 5.2.2

Due within one business day after receipt of Government request.

Electronic submission to: VA

PM, COR, CO

Inspection/Acceptance:

Destination

1 LO NSP NSP

0001AJ Contractor Staff Roster IAW

PWS 6.2.2

Due three calendar days after award and updated throughout the PoP

Electronic submission to: VA

PM, COR, CO

Inspection/Acceptance:

Destination

Base Year Total Price: $

Option Period One

Option Period One may be exercised in accordance with FAR 52.217-9, “Option to Extend the

Term of the Contract.” The Option Period may be exercised for any duration not to exceed 12 months.

CLIN Description/ Part Number QTY Unit Unit Price Total Price

1001 PKI Certificate Services for certificate issuance, full digital certificate lifecycle management, and digital certificate validation services in a manner that is compliant with

FIPS 201 and the Federal PKI

Common Policy requirements

IAW PWS Section 5.1 through

5.2, inclusive of all subparagraphs.

12 MO $203,225.00 $2,438,700.00

1001AA Contractor Project

Management Plan IAW PWS

5.1.2

Updates due monthly throughout option period.

Electronic submission to: VA

PM, COR, CO

Inspection/Acceptance:

Destination

1 LO NSP NSP

1001AB Monthly Teleconference

Meeting Report IAW PWS

5.1.3

Due three calendar days after teleconference.

Electronic submission to: VA

PM, COR, CO

Inspection/Acceptance:

Destination

1001AC Ad Hoc Reports IAW PWS

5.1.3

Due two business days after receipt of request, for all reports throughout the PoP

Electronic submission to: VA

PM, COR, CO

Inspection/Acceptance:

Destination

1 LO NSP NSP

1001AD PKI SSP Certificates IAW

PWS 5.2

Due as required, after receipt of Government request.

Electronic submission to: VA

PM, COR, CO

Inspection/Acceptance:

Destination

1 LO NSP NSP

1001AE Certificate Revocation List IAW

PWS 5.2

Due immediately upon PKI

Certificate request

Electronic submission to: VA

PM, COR, CO

Inspection/Acceptance:

Destination

1 LO NSP NSP

1001AF Online Certificate Status

Protocol IAW PWS 5.2

Due immediately upon PKI

SSP Certificate request

Electronic submission to: VA

PM, COR, CO

Inspection/Acceptance:

Destination

1001AG Yearly Audit Report IAW PWS

5.2

Due within three business days after receipt of Government request

Electronic submission to: VA

PM, COR, CO

Inspection/Acceptance:

Destination

1 LO NSP NSP

1001AH Operational Administrative

Certificates and keys IAW

PWS 5.2.2

Due within one business day after receipt of Government request.

Electronic submission to: VA

PM, COR, CO

Inspection/Acceptance:

Destination

1 LO NSP NSP

1001AJ Contractor Staff Roster IAW

PWS 6.2.2

Updated throughout the PoP

Electronic submission to: VA

PM, COR, CO

Inspection/Acceptance:

Destination

1 LO NSP NSP

Option Period One Total Price: $2,438,700.00

Total Order Value: $4,877,400.00

B.3 PERFORMANCE WORK STATEMENT

1.0 BACKGROUND

The mission of the Department of Veterans Affairs (VA), Office of Information & Technology (OI&T), Service Delivery and Engineering (SDE) Program Administration Office (PAO) is to provide benefits and services to Veterans of the United States. In meeting these goals, OI&T strives to provide high quality, effective, and efficient Information Technology (IT) services to those responsible for providing care to the Veterans at the point-of-care as well as throughout all the points of the Veterans’ healthcare in an effective, timely, and compassionate manner. VA depends on Information Management (IM)/IT systems to meet mission goals.

Verizon Business Services (VzB) is a shared service provider (SSP) of Public Key Infrastructure (PKI) encryption certificates and keys and a current contract holder with VA, under Task Order VA118-17-F-1788, Contract Number GS-35F-0328T. Under this task order, VzB issues PKI encryption certificates to VA employees and partners, as well as provides revocation and recovery support for these certificates and associated encryption key pairs.

The ability to issue, revoke, and recover PKI certificates is important because it allows VA to decrypt data in the following circumstances:

1. Issuance of encryption key to new VA employee.

2. VA employee to whom PKI encryption keys were issued has lost them.

3. A legal process (i.e. discovery or litigation) requires that VA access information previously encrypted by a VA employee or partner.

4. An investigation, including those of the Office of Inspector General (OIG), requires access to encrypted information.

2.0 APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. 44 U.S.C. § 3541-3549, “Federal Information Security Management Act (FISMA) of 2002”

2. “Federal Information Security Modernization Act of 2014”

3. Federal Information Processing Standards (FIPS) Publication 140-2, “Security Requirements For Cryptographic Modules”

4. FIPS Pub 199. Standards for Security Categorization of Federal Information and Information Systems, February 2004

5. FIPS Pub 200, Minimum Security Requirements for Federal Information and

Information Systems, March 2016

6. FIPS Pub 201-2, “Personal Identity Verification of Federal Employees and

Contractors,” August 2013

7. 10 U.S.C. § 2224, "Defense Information Assurance Program"

8. Carnegie Mellon Software Engineering Institute, Capability Maturity Model®

Integration for Development (CMMI-DEV), Version 1.3 November 2010; and

Carnegie Mellon Software Engineering Institute, Capability Maturity Model® Integration for Acquisition (CMMI-ACQ), Version 1.3 November 2010

9. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

10. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”

11. 36 C.F.R. Part 1194 “Electronic and Information Technology Accessibility

Standards,” July 1, 2003

12. Office of Management and Budget (OMB) Circular A-130, “Managing Federal

Information as a Strategic Resource,” July 28, 2016

13. An Introductory Resource Guide for Implementing the Health Insurance

Portability and Accountability Act (HIPAA) Security Rule, October 2008

14. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended, January 18, 2017

15. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

16. NIST SP 800-37 Rev 1, Guide for Applying the Risk Management

Framework to Federal Information Systems: a Security Life Cycle Approach, June 5, 2014

17. NIST SP 800-53 Rev. 4, Security and Privacy Controls for Federal Information Systems and Organizations, January 22, 2015

18. OMB Memorandum, “Transition to IPv6”, September 28, 2010

19. VA Directive 0735, Homeland Security Presidential Directive 12 (HSPD-12)

Program, October 26, 2015

20. VA Handbook 0735, Homeland Security Presidential Directive 12 (HSPD-12)

Program, March 24, 2014

21. OMB Memorandum M-06-18, Acquisition of Products and Services for

Implementation of HSPD-12, June 30, 2006

22. OMB Memorandum 04-04, E-Authentication Guidance for Federal Agencies, December 16, 2003

23. OMB Memorandum 05-24, Implementation of Homeland Security

Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors, August 5, 2005

24. OMB memorandum M-11-11, “Continued Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors, February 3,

25. OMB Memorandum, Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation, May 23, 2008

26. Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance, December 2, 2011

27. NIST SP 800-116 Rev 1, Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access, June 2018

28. OMB Memorandum M-07-16, Safeguarding Against and Responding to the Breach of Personally Identifiable Information, May 22, 2007

29. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, Digital Identity Guidelines, June 2017

30. NIST SP 800-157, Guidelines for Derived PIV Credentials, December 2014

31. Draft National Institute of Standards and Technology Interagency Report

(NISTIR) 7981 Mobile, PIV, and Authentication, March 2014

32. VA Memorandum, VAIQ #7100147, Continued Implementation of Homeland Security Presidential Directive 12 (HSPD-12), April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

33. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

34. VA Memorandum “Mandate to meet PIV Requirements for New and Existing Systems” (VAIQ# 7712300), June 30, 2015, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4846

35. VA Memorandum, VAIQ #7497987, Compliance – Electronic Product Environmental Assessment Tool (EPEAT) – IT Electronic Equipment, August 11, 2014 (reference Document Libraries, EPEAT/Green Purchasing Section, https://www.voa.va.gov/documentlistpublic.aspx?NodeID=552)

36. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (Public Law 110–140), December 19, 2007

37. Section 104 of the Energy Policy Act of 2005, (Public Law 109–58), August 8, 2005

38. Executive Order 13834, “Efficient Federal Operations”, dated May 17, 2018

39. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August

2, 2001

40. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

41. https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

42. “Veteran Focused Integration Process (VIP) Guide 3.1”, April 2018, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

43. “VIP Release Process Guide”, Version 1.4, May 2016, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4411

44. “POLARIS User Guide”, Version 1.9, March 2017, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4412

45. Federal Public Key Infrastructure, https://www.idmanagement.gov/IDM/s/article_content_old?tag=a0Gt0000000 SfwP

46. X.509 Certificate Policy for the U.S. Federal PKI Common Policy Framework, Version 1.23, May 7, 2015, https://www.idmanagement.gov/IDM/servlet/fileField?entityId=ka0t0000000T N9iAAG&field=File__Body__s

Regarding the above referenced applicable documents, 36 C.F.R. Part 1194 “Electronic and Information Technology Accessibility Standards,” July 1, 2003 and Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended, January 18, 2017, the following clarification is applicable. Verizon’s SSP service is Section 508 compliant if the front end Card Management System (CMS) processes of the VA are compliant with

Section 508; however, Verizon primary integration with the VA CMS is a machine to machine integration and does not require section 508 compliance. Verizon does provide several direct Web based interfaces to VA PIV Program personnel to allow management of Key recovery of encryption certificate that can support direct revocation of certificates that meet limited Web Content Accessibility Guidelines (WCAG), a globally recognized voluntary consensus standard for web content. That said, with the https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514 https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4846 https://www.voa.va.gov/documentlistpublic.aspx?NodeID=552 https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4411 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4412 https://www.idmanagement.gov/IDM/s/article_content_old?tag=a0Gt0000000SfwP https://www.idmanagement.gov/IDM/s/article_content_old?tag=a0Gt0000000SfwP https://www.idmanagement.gov/IDM/servlet/fileField?entityId=ka0t0000000TN9iAAG&field=File__Body__s https://www.idmanagement.gov/IDM/servlet/fileField?entityId=ka0t0000000TN9iAAG&field=File__Body__s limited scope of VA PIV Programs administrative usage and the security requirements of Managing PKI based certificates, Verizon believes that 508 compliance exception

E202.5 ICT Functions Located in Maintenance or Monitoring Spaces applies. Where status indicators and operable parts for ICT functions are located in spaces that are frequented only by service personnel for maintenance, repair, or occasional monitoring of equipment, such status indicators and operable parts shall not be required to conform to the Revised 508 Standards. Additionally, due to the sensitive nature of the x.509 certificate data as related to the VA PIV program and any management of Verizon supplied x.509 certificates directly by VA PIV program related personnel in support of

Key recovery and other manual certificate lifecycle events through Verizon web interfaces would additionally be qualified under exception E202.3 National Security

Systems. The Revised 508 Standards do not apply to ICT operated by agencies as part of a national security system, as defined by 40 U.S.C. 11103(a).

3.0 SCOPE OF WORK

The Contractor shall perform full spectrum PKI SSP services, which shall include: PKI SSP, configuration, certificate validation, and software certificate registration. These services shall comply with Homeland Security Presidential Directive (HSPD) 12 and Federal Information Processing Standard (FIPS) 201-1. If the option period is exercised, the Contractor shall perform the full spectrum of PKI SSP services.

The Contractor shall also maintain a highly available certificate recovery system, including software updates and upgrades, for recovering encryption certificates. The Contractor shall publish revocation data and provide access to the Certificate Revocation List (CRL) and Online Certificate Status Protocol (OCSP). The Contractor shall also provide 24x7 technical support, including standard changes, to the certificate recovery system.

4.0 PERFORMANCE DETAILS

4.1 PERFORMANCE PERIOD

The period of performance shall be 12-months, with one option period that may be exercised for any duration up to 12 months.

There are ten (10) Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, four are set by date:

New Year's Day January 1 Independence Day July 4 Veterans Day November 11 Christmas Day December 25

If any of the above falls on a Saturday, then Friday shall be observed as a holiday.

Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

Martin Luther King's Birthday Third Monday in January Washington's Birthday Third Monday in February Memorial Day Last Monday in May Labor Day First Monday in September Columbus Day Second Monday in October Thanksgiving Fourth Thursday in November

4.2 PLACE OF PERFORMANCE

Tasks under this PWS shall be performed at Contractor facilities.

4.3 TRAVEL

The Government does not anticipate travel for this task order.

5.0 SPECIFIC TASKS AND DELIVERABLES

The Contractor shall perform the following:

5.1 PROJECT MANAGEMENT

5.1.2 CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, timeline and tools to be used in execution of the contract. The CPMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks and resource support. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPMP shall be concurred upon and updated in accordance with Section B of the contract. The Contractor shall update and maintain the VA PM approved CPMP throughout the PoP.

Deliverable:

A. Contractor Project Management Plan

5.1.3 REPORTING REQUIREMENTS

The Contractor shall provide Project Management support in accordance with following requirements during all exercised periods of performance. The Contractor shall provide and host the Government with a Monthly teleconference meeting. The Contractor shall provide information or data at the teleconference meetings that reflects data as of the last day of the preceding month.

The Contractor shall meet the reporting requirements during the entirety of the period of performance of the task order.

During the Monthly teleconference the Contractor shall report on all work completed during the reporting period and work planned for the subsequent reporting period. The teleconference shall also identify any problems that arose and a description of how the problems were resolved.

If problems have not been completely resolved, the Contractor shall provide an explanation including their plan and timeframe for resolving the issue. It is expected that the Contractor will keep in communication with VA accordingly so that issues that arise are transparent to both parties to prevent escalation of outstanding issues. The Contractor shall document and summarize all teleconference meetings. The summary shall be sent to the Government team within three business days of the conclusion of the monthly teleconference.

The Contractor shall provide Ad Hoc Reports as needed. Reports can be ad hoc or may be regularly scheduled, and may only be requested by the Contracting Officer’s Representative (COR) personnel as identified in this Delivery Order. The reports are for accounting purposes; they will track issuance and card/PKI types from the Certificate Authority.

Deliverables:

A. Monthly Teleconference Meeting Report B. Ad Hoc Reports

5.2 PKI CERTIFICATE SERVICES (BASE AND OPTION PERIOD)

The Contractor shall provide certificate issuance, full digital certificate lifecycle management, and digital certificate validation services in a manner that is compliant with FIPS 201 and the Federal PKI Common Policy requirements. The solution shall be capable of successfully implementing a fully redundant (hot/warm) alternative site that is mutually agreeable, and conforms to compliance audit requirements and approval.

The Contractor shall extend PKI services to the VA enterprise environment. The Contractor shall support the equipment required to perform the services of this PWS and as part of this service to allow for the provision of PKI credentials to VA from both a primary and an alternative disaster recovery site. The Contractor has the option of leveraging their own existing equipment that already supports the provision of PKI services to other Federal Departments and Agencies in order to provide these services to VA.

The Contractor shall issue standard, policy, and PIV compliant X.509v3 digital certificates to VA end-entities (PIV cardholders). The Contractor shall provide certificate management services that allow for the revocation, renewal, and recovery of certificates throughout their lifecycle, whereby VA identified Registration Authorities (RAs) and Local Registration Authorities (LRAs) shall connect to the service to make requests for services. The Contractor shall provide the following PKI certificate services:

1. The PIV roles of PIV Registrar and PIV Issuer are understood to fall within the PKI defined role of RA and shall be authorized to make lifecycle management requests for certificates that have been issued by the PKI SSP. The Contractor shall issue PKI SSP Certificates. Further, the VA PIV System shall support an authoritative and secure system level account with its Certificate Management System (CMS) that shall directly request PKI services of issuance, revocation, renewal, and recovery of certificates, in accordance with the direction set forth in the Federal Common Policy.

The Contractor shall support these roles as part of its offered solution.

A. PKI SSP Services – The Contractor shall provide VA with Federal Common

Certificate Policy PKI SSP Services offered in a per seat pricing model that offers multiple certificates per user. The specific requirements are for multi-year enterprise licenses and are as follows:

i. A seat shall have up to four certificates. Each certificate shall support validity periods of up to three years. The total number of seats required per period of performance is 500,000 seats or 2,000,000 certificates.

B. PKI certificates shall be configured with specific certificate key usage values that restrict how the certificates are applied with VA applications and include the following:

i. PIV Authorization certificates – Federal Common Policy compliant certificates that assert a mandatory hardware identifier that requires smart card storage and protection.

ii. Encipherment certificates – Federal Common Policy compliant certificates that may assert a hardware or software identifier, as needed.

iii. Digital Signing certificates – Federal Common Policy compliant certificates that may assert a hardware or software identifier, as needed.

iv. Authentication certificates – Federal Common Policy compliant certificates that may assert a hardware or software identifier, as needed.

C. Configuration – The Contractor shall provide PKI SSP service(s) that continue supporting direct integration between the servicing Certification Authority (CA) and the existing VA CMS. Specifically, the Contractor shall provide PKI SSP services in a manner that allows the CMS solution to authoritatively bind to the CA with system administrative privileges for the purpose of requesting, issuing, and managing PKI certificates and associated keys. It is important to note, however, that the CMS solution is a separate and distinct system from the CA and the PKI SSP service.

D. Certificate Validation Services – The Contractor shall support Certificate Validation Services. These services shall include the publication of Certificate Revocation Lists (CRLs) that may be referenced to determine (a) the validity of certificates issued from the applicable CA, and (b) Online Certificate Status Protocol (OCSP) services that may be referenced by internal VA applications and services.

E. CRL publication shall support both web based (e.g. HTTP) and directory based (e.g. Lightweight Directory Access Protocol (LDAP)) services, that shall allow for VA to reference certificate status publication with flexibility in the offering of the service. The Directory Publication Services shall also be accessible to VA business partners, Federal partners, and public users. These publication services are required for interoperability and to make available the encryption certificates of users from publicly routable Internet locations to support secure/multipurpose internet mail extensions (S/MIME) services. Border Directory Service Agents are permissible to support this requirement.

Replication of a subset of user information from the VA Enterprise Active Directory shall be supported.

F. Software Certificate Registration Services – The Contractor shall support the Software Certificate Registration Services. Software Certificate Registration Services shall be defined as services that are delivered to VA PKI RAs and LRAs over web interfaces/services through registration portals or similar technologies.

These services shall be thin client based and shall not require dedicated applications or technologies to be installed on VA workstations or laptop environments.

G. The Contractor shall support smart card based logon to authenticate the identity and administrative role of VA’s RAs and LRAs, to ensure adequate security is provided for the request of end entity and device PKI certificates. The software certificate registration services are intended to support the request for S/MIME capable certificates that shall allow VA personnel, contractors, and affiliates to adequately encrypt and digitally sign email messages and attachments using Microsoft Outlook mail clients.

H. When performing distribution of published users’ encryption certificates, the Contractor shall not directly modify the VA Active Directory (AD) Services that serve as the Enterprise Directory for VA (e.g. auto-enrollment services), but shall support a publication strategy that shall allow VA to use existing standards based directory tools and synchronization/replication services to publish encryption end entity certificates to the appropriate user’s Active Directory object store. The Contractor shall not modify the AD schema.

I. Device Certificate Services – The Contractor shall provide VA with device certificates to support cryptographic requirements such as Secure Socket Layer (SSL) certificates for web servers. The total number of device certificates required per 12-month period of performance shall be 10,000 device certificates.

i. The Contractor shall coordinate with the identified VA PKI SSP to validate that the appropriate CRL publications shall continue to be supported throughout the transition to the new service provider.

ii. The Contractor shall provide VA with templates of their existing Registration Practice Statements (RPS), Key Recovery Practice Statements (KRPS), and boiler plate training documentation that are specifically required to support VA RA and VA LRA responsibilities that are common to supporting enterprise PKI service. The Contractor shall also provide VA with base of knowledge to support VA activities for updating any training documentation.

2. The Contractor services shall include directory based publication services which include a Certificate Practice Statement, and key archive and recovery policies required by the Federal PKI Common Policy.

3. The Contractor shall comply with any unscheduled audits within the period of performance of this task order to remain in compliance with the Federal PKI Common Policy. As audits are performed, the Contractor shall provide a Yearly Audit Report that attests to their successful completion of those mandated yearly audits. This report shall identify the date the audit was completed, identify the servicing agency or company that conducted the audit, the date the next audit shall need to be performed, and summarize the findings from that audit authority that allow for continued operation of the PKI SSP services as being compliant with the Federal PKI Common Policy.

Note: A full compliance audit of the Verizon-hosted CAs and the VA RAs must be completed every year. Verizon is responsible for performing an annual audit of the hosted CAs, while the annual RA audit is the responsibility of the contracting agency. The auditor(s) appointed are independent of Verizon and the VA RAs. The auditor does not have any conflict of interest with Verizon or the contracting agency, as defined by the American Institute of Certified Public Accountants (AICPA). The audit procedure will test compliance of the Verizon SSP service and the RAs against the policies and procedures set out in the FCP, Verizon’s CPS, and the VA’s RPS and Key Recovery Practices Statement (KRPS). The audit verifies that Verizon and the VA comply with the requirements of current versions of the FCP.

4. The Contractor shall provide a primary and backup operational capability to support

Disaster Recovery in accordance with Federal Preparedness Circular 65 – Federal Executive Branch Continuity of Operations (COOP). The site shall be located at least 400 miles apart from the Primary secure data center. The Contractor shall ensure Recovery of (a) issuance and lifecycle management functionality is within 72 hours and (b) warm failover validation information is within 18 hours.

5. The Contractor shall support the electronic interfaces between the Government’s data center hosting services and the Contractor’s primary and back up service sites within the cost of the per seat volume licensing requested in this solicitation. The VA data centers are located at Hines, IL and Falling Waters, WV. The Contractor shall operate the PKI services within their own approved facilities. The Contractor shall provide a copy of the appropriate Authority to Operate documentation to meet audit record keeping requirements.

6. The Contractor shall provide services of at least 99.5% service uptime, not including scheduled service outages and maintenance periods. All service outages shall be scheduled during off peak times to minimize operational disruption to the VA operations. Note: VA PIV System Operations team has a pre-approved PIV Systems maintenance window of four hours every Thursday, 9:00 PM thru Friday, 1:00 AM ET. The Contractor shall perform system maintenance activities during this window unless otherwise approved by the COR. For any system changes impacting system performance and availability, the Contractor shall provide VA with three weeks advance notice except in emergency circumstances. The Contractor shall comply with its standard Service Level Agreement for it SSP services incorporated at Section D, Attachment 0001.

Deliverables:

A. PKI SSP Certificates B. Certificate Revocation List C. Online Certificate Status Protocol D. Yearly Audit Report

5.2.1 ENCRYPTION KEY RECOVERY

The Contractor shall provide support for standard changes to the certificate recovery system that may arise during the performance of the contract. Examples of such support include granting access to the system, terminating access to the system for former employees, collaborating with VA to define and instantiate roles or separation of duties, if necessary. The Contractor shall provide VA with access to use these two interfaces to the Verizon services: (a) Unicert programming interface (UPI), and (b) Web Registration Authority Operator (WebRAO). (VA will use the UPI for programmatic access to the Verizon systems over the HTTP protocol; VA will use the WebRAO interface for system administration over the HTTP protocol.)

5.2.2 ENTERPRISE SUPPORT

The Contractor shall provide technical support for the certificate recovery system, and shall make this technical support available 24 hours per day, seven days a week, with a two hour response time to VA requests for support; also, this technical support shall be accessible via telephone and email.

The Contractor shall deliver Operational Administrative Certificates and Keys. While the certificate servers shall not issue new certificates for normal secure email or smart card use, they shall still issue administrative certificates to those authorized by VA.

The Contractor shall provide VA with UPI support. UPI shall be used by VA to support key recovery requests. This UPI support shall include configuration changes to UPI that: (a) are supportive to VA needs, (b) are updates to the certificate recovery system hosted by Verizon, and (c) ensure VA client access to support recovery requests and to remedy security issues.

The Contractor shall provide VA with WebRAO support and updates. WebRAO shall be used by VA along with other methods to support key recovery requests. The Contractor shall provide master RAO and infrastructure credentials to authorized VA employees.

Deliverables:

A. Operational Administrative Certificates and Keys

6.0 GENERAL REQUIREMENTS

6.1 ENTERPRISE AND IT FRAMEWORK

6.1.1 FEDERAL IDENTITY, CREDENTIAL, AND ACCESS

MANAGEMENT (FICAM)

The Contractor shall ensure Commercial Off-The-Shelf (COTS) product(s), software configuration and customization, and/or new software are Personal Identity Verification (PIV) card-enabled by accepting HSPD-12 PIV credentials using VA Enterprise Technical Architecture (ETA), https://www.ea.oit.va.gov/EAOIT/VA_EA/Enterprise_Technical_Architecture.asp, and VA Identity and Access Management (IAM) approved enterprise design and integration patterns, http://www.techstrategies.oit.va.gov/enterprise_dp.asp. The Contractor shall ensure all Contractor delivered applications and systems comply with the VA Identity, Credential, and Access Management policies and guidelines set forth in the VA Handbook 6510 and align with the Federal Identity, Credential, and Access Management Roadmap and Implementation Guidance v2.0.

The Contractor shall ensure all Contractor delivered applications and systems provide user authentication services compliant with the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-63-3, VA Handbook 6500 Appendix F, “VA System Security Controls”, and VA IAM enterprise requirements for direct, assertion based authentication, and/or trust based authentication, as determined by the design and integration patterns.

The Contractor shall ensure all Contractor delivered applications and systems conform to the specific Identity and Access Management PIV requirements set forth in the Office of Management and Budget (OMB) Memoranda M-04-04, M-05-24, M-11-11, and NIST Federal Information Processing Standard (FIPS) 201-2. OMB Memoranda M-04-04, M- 05-24, and M-11-11 can be found at:

https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/omb/memoranda/fy 04/m04-04.pdf, https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/omb/memoranda/fy 2005/m05-24.pdf, and https://obamawhitehouse.archives.gov/sites/default/files/omb/memoranda/2011/m11- 11.pdf respectively. Contractor delivered applications and systems shall be on the FIPS 201-2 Approved Product List (APL). If the Contractor delivered application and system is not on the APL, the Contractor shall be responsible for taking the application and system through the FIPS 201 Evaluation Program.

The Contractor shall ensure all Contractor delivered applications and systems support:

1. Automated provisioning and are able to use enterprise provisioning service.

2. The VA defined unique identity (Secure Identifier [SEC ID] / Integrated Control

Number [ICN]).

3. Two-factor authentication (2FA) through an applicable design pattern as outlined in VA Enterprise Design Patterns.

4. A Security Assertion Markup Language (SAML) implementation if the solution relies on assertion based authentication. Additional assertion implementations, https://www.ea.oit.va.gov/EAOIT/VA_EA/Enterprise_Technical_Architecture.asp http://www.techstrategies.oit.va.gov/enterprise_dp.asp https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/omb/memoranda/fy04/m04-04.pdf https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/omb/memoranda/fy04/m04-04.pdf https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/omb/memoranda/fy2005/m05-24.pdf https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/omb/memoranda/fy2005/m05-24.pdf https://obamawhitehouse.archives.gov/sites/default/files/omb/memoranda/2011/m11-11.pdf https://obamawhitehouse.archives.gov/sites/default/files/omb/memoranda/2011/m11-11.pdf besides the required SAML assertion, may be provided as long as they are compliant with NIST SP 800-63-3 guidelines.

5. Authentication/account binding based on trusted Hypertext Transfer Protocol (HTTP) headers if the solution relies on Trust based authentication.

6. Role Based Access Control.

7. Auditing and reporting capabilities.

8. Compliance with VAIQ# 7712300 Mandate to meet PIV requirements for new and existing systems.

https://www.voa.va.gov/DocumentView.aspx?DocumentID=4846

The required Assurance Levels for this specific effort are Identity Assurance Level 3, Authenticator Assurance Level 3, and Federation Assurance Level 3.

6.1.2 INTERNET PROTOCOL VERSION 6 (IPV6)

The Contractor solution shall support the latest Internet Protocol Version 6 (IPv6) based upon the directives issued by the Office of Management and Budget (OMB) on August 2, 2005 (https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/omb/memoranda/f y2005/m05-22.pdf) and September 28, 2010 (https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/egov_docs/transiti on-to-ipv6.pdf). IPv6 technology, in accordance with the USGv6 Profile, NIST Special Publication (SP) 500-267 (https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication500-267.pdf), the Technical Infrastructure for USGv6 Adoption (https://www.nist.gov/programs-projects/usgv6-program), and the NIST SP 800 series applicable compliance (https://csrc.nist.gov/publications/sp) shall be included in all IT infrastructures, application designs, application development, operational systems and sub-systems, and their integration. In addition to the above requirements, all devices shall support native IPv6 and/or dual stack (IPv6 / IPv4) connectivity without additional memory or other resources being provided by the Government, so that they can function in a mixed environment. All public/external facing servers and services (e.g. web, email, DNS, ISP services, etc.) shall support native IPv6 and/or dual stack (IPv6/ IPv4) users and all internal infrastructure and applications shall communicate using native IPv6 and/or dual stack (IPv6/ IPv4) operations. Guidance and support of improved methodologies which ensure interoperability with legacy protocol and services in dual stack solutions, in addition to OMB/VA memoranda, can be found at:

https://www.voa.va.gov/documentlistpublic.aspx?NodeID=282.

6.1.3 VETERAN FOCUSED INTEGRATION PROCESS (VIP)

The Contractor shall support VA efforts IAW the Veteran Focused Integration Process (VIP). VIP is a Lean-Agile framework that services the interest of Veterans through the efficient streamlining of activities that occur within the enterprise. The VIP Guide can be found at https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371. The VIP framework creates an environment delivering more frequent releases through a deeper https://www.voa.va.gov/DocumentView.aspx?DocumentID=4846 https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/omb/memoranda/fy2005/m05-22.pdf https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/omb/memoranda/fy2005/m05-22.pdf https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/egov_docs/transition-to-ipv6.pdf https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/egov_docs/transition-to-ipv6.pdf https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication500-267.pdf https://www.nist.gov/programs-projects/usgv6-program https://www.nist.gov/programs-projects/usgv6-program https://csrc.nist.gov/publications/sp https://www.voa.va.gov/documentlistpublic.aspx?NodeID=282 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371 application of Agile practices. In parallel with a single integrated release process, VIP will increase cross-organizational and business stakeholder engagement, provide greater visibility into projects, increase Agile adoption and institute a predictive delivery cadence. VIP is now the single authoritative process that IT projects must follow to ensure development and delivery of IT products

6.1.4 PROCESS ASSETT LIBRARY (PAL)

The Contractor shall perform their duties consistent with the processes defined in the OIT Process Asset Library (PAL). The PAL scope includes the full spectrum of OIT functions and activities, such as VIP project management, operations, service delivery, communications, acquisition, and resource management. PAL serves as an authoritative and informative repository of searchable processes, activities or tasks, roles, artifacts, tools and applicable standards and guides to assist the OIT workforce, Government and Contractor personnel. The Contractor shall follow the PAL processes to ensure compliance with policies and regulations and to meet VA quality standards. The PAL includes the contractor onboarding process consistent with Section

6.2.2 and can be found at https://www.va.gov/PROCESS/artifacts/maps/process_CONB_ext.pdf. The main PAL can be accessed at www.va.gov/process.

6.1.5 AUTHORITATIVE DATA SOURCES

The VA Enterprise Architecture Repository (VEAR) is one component within the overall Enterprise Architecture (EA) that establishes the common framework for data taxonomy for describing the data architecture used to develop, operate, and maintain enterprise applications. The Contractor shall comply with the department’s Authoritative Data Source (ADS) requirement that VA systems, services, and processes throughout the enterprise shall access VA data solely through official VA ADSs where applicable, see below. The Information Classes which compose each ADS are located in the VEAR, in the Data & Information domain. The Contractor shall ensure that all delivered applications and system solutions support:

1. Interfacing with Capital Asset Inventory (CAI) to conduct real property record management actions, if the solution relies on real property records data. CAI is the authoritative source for VA real property record management data.

2. Interfacing with electronic Contract Management System (eCMS) for access to contract, contract line item, purchase requisition, offering vendor and vendor, and solicitation information above the micro-purchase threshold, if the solution relies on procurement data. ECMS is the authoritative source for VA procurement actions data.

3. Interfacing with HRSmart Human Resources Information System to conduct personnel action processing, on-boarding, benefits management, and compensation management, if the solution relies on personnel data. HRSmart is the authoritative source for VA personnel information data.

4. Interfacing with Vet360 to access personal contact information, if the solution relies on VA Veteran personal contact information data. Vet360 is the authoritative source for VA Veteran Personal Contact Data.

https://www.va.gov/PROCESS/artifacts/maps/process_CONB_ext.pdf http://www.va.gov/process

5. Interfacing with VA/Department of Defense (DoD) Identity Repository (VADIR) for determining eligibility for VA benefits under Title 38, if the solution relies on qualifying active duty military service data. VADIR is the authoritative source for Qualifying Active Duty military service in the VA.

6.2 SECURITY AND PRIVACY REQUIREMENTS

6.2.1 POSITION/TASK RISK DESIGNATION LEVEL(S)

In accordance with VA Handbook 0710, Personnel Security and Suitability Program, the position sensitivity and the level of background investigation commensurate with the required level of access for the following tasks within the PWS are:

Position Sensitivity and Background Investigation Requirements by Task

Task Number Tier1 / Low Risk Tier 2 / Moderate Risk

Tier 4 / High Risk

5.1

5.2

The Tasks identified above and the resulting Position Sensitivity and Background Investigation requirements identify, in effect, the Background Investigation requirements for Contractor individuals, based upon the tasks the particular Contractor individual will be working. The submitted Contractor Staff Roster must indicate the required Background Investigation Level for each Contractor individual based upon the tasks the Contractor individual will be working, in accordance with their submitted proposal.

6.2.2 CONTRACTOR PERSONNEL SECURITY REQUIREMENTS

Contractor Responsibilities:

a. The Contractor shall prescreen all personnel requiring access to the computer systems to ensure they maintain the…