36C10B19Q0582-001.docx

VPS Operations and Sustainment Support Services TAC Number:

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Office of Veterans Access to Care (OVAC)

Veterans Point of Service (VPS) Program Office Operations and Sustainment Support Services

Date: June 10, 2019

TAC- 19-54848

PWS Version Number: 2.0

Contents

BACKGROUND

Department of Veterans Affairs (VA) contracted for and implemented an integrated, enterprise Point of Service (POS) software solution to support Veterans Health Administration (VHA). The POS solution is made up of hardware and software components geared towards enhancing the Veteran experience and their relationship with VHA, as well as improving workplace efficiency. Currently the solution is operating with VetLink hardware and VetLink proprietary software provided by Vecna Technologies, Inc., within the platform, which has a patient-facing User Interface (UI), a VHA staff-facing UI, and a provider-facing UI.

The Veterans Point of Service (VPS) Program Office aligned under Office of Veterans Access to Care (OVAC) manages the nationally-deployed patient information exchange software platform that provides Veterans with convenient control of their own health information, while streamlining and standardizing frontline staff and provider activities at VA Medical Centers (VAMCs) and Community-Based Outpatient Clinics (CBOCs) nationwide. Leveraging kiosk capabilities affords Veterans more opportunities to elevate the role they play in ensuring the accuracy of information critical to the continued delivery of services.

VPS completed national deployment of over 6,300 kiosks in three placement styles (e.g. floor, desktop and wall-mounted) to ≈ 161 VAMCs and their CBOCs; as well as deployment of digital signage; intelligent queuing monitors, and 320 servers. The mission of VPS is to provide benefits and services to Veterans of the United States, includes Alaska, Puerto Rico, Guam, Honolulu, and the Philippines while safeguarding their privacy and enhancing their healthcare experience by providing enhanced capabilities to self-report and participate more fully in their care. In meeting these goals, VPS strives to provide high quality, effective, and efficient clinical and business capabilities, along with Information Technology (IT) services to those persons who are responsible for providing care to the Veterans at the point-of-care. In addition, VPS strives to provide high quality health care to Veterans throughout all points of their experience in an effective, timely, and compassionate manner. VA depends on a strong business backing, Information Management (IM), and IT systems to meet mission goals.

APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. 44 U.S.C. § 3541-3549, “Federal Information Security Management Act (FISMA) of 2002”

2. “Federal Information Security Modernization Act of 2014”

3. Federal Information Processing Standards (FIPS) Publication 140-2, “Security Requirements for Cryptographic Modules”

4. FIPS Pub 199. Standards for Security Categorization of Federal Information and Information Systems, February 2004

5. FIPS Pub 200, Minimum Security Requirements for Federal Information and Information Systems, March 2016

6. FIPS Pub 201-2, “Personal Identity Verification of Federal Employees and Contractors,” August 2013

7. 10 U.S.C. § 2224, "Defense Information Assurance Program"

8. Carnegie Mellon Software Engineering Institute, Capability Maturity Model® Integration for Development (CMMI-DEV), Version 1.3 November 2010; and Carnegie Mellon Software Engineering Institute, Capability Maturity Model® Integration for Acquisition (CMMI-ACQ), Version 1.3 November 2010

9. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

10. Public Law 109-461, Veterans Benefits, Health Care, and Information Technology Act of 2006, Title IX, Information Security Matters

11. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”

12. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, http://www.va.gov/vapubs/

13. VA Handbook 0710, Personnel Security and Suitability Security Program, May 2, 2016, http://www.va.gov/vapubs

14. VA Directive and Handbook 6102, “Internet/Intranet Services,” July 15, 2008

15. 36 C.F.R. Part 1194 “Electronic and Information Technology Accessibility Standards,” July 1, 2003

16. Office of Management and Budget (OMB) Circular A-130, “Managing Federal Information as a Strategic Resource,” July 28, 2016

17. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed Services (CHAMPUS)”

18. An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule, October 2008

19. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended by the Workforce Investment Act of 1998 (P.L. 105-220), August 7, 1998

20. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

21. VA Directive 6500, “Managing Information Security Risk: VA Information Security Program,” September 20, 2012

22. VA Handbook 6500, “Risk Management Framework for VA Information Systems – Tier 3: VA Information Security Program,” March 10, 2015

23. VA Handbook 6500.1, “Electronic Media Sanitization,” November 03, 2008

24. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI)”, July 28, 2016

25. VA Handbook 6500.3, “Assessment, Authorization, And Continuous Monitoring of VA Information Systems,” February 3, 2014

26. VA Handbook 6500.5, “Incorporating Security and Privacy in System Development Lifecycle”, March 22, 2010

27. VA Handbook 6500.6, “Contract Security,” March 12, 2010

28. VA Handbook 6500.8, “Information System Contingency Planning”, April 6, 2011

29. Office of Information and Technology (OI&T) Process Asset Library (PAL), https://www.va.gov/process/ . Reference Process Maps at https://www.va.gov/process/maps.asp and Artifact templates at https://www.va.gov/process/artifacts.asp

30. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

31. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014

32. VA Handbook 6508.1, “Procedures for Privacy Threshold Analysis and Privacy Impact Assessment,” July 30, 2015

33. VA Handbook 6510, “VA Identity and Access Management”, January 15, 2016

34. VA Directive 6300, Records and Information Management, February 26, 2009

35. VA Handbook, 6300.1, Records Management Procedures, March 24, 2010

36. NIST SP 800-37, Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach, June 10, 2014

37. NIST SP 800-53 Rev. 4, Security and Privacy Controls for Federal Information Systems and Organizations, January 22, 2015

38. OMB Memorandum, “Transition to IPv6”, September 28, 2010

39. VA Directive 0735, Homeland Security Presidential Directive 12 (HSPD-12) Program, October 26, 2015

40. VA Handbook 0735, Homeland Security Presidential Directive 12 (HSPD-12) Program, March 24, 2014

41. OMB Memorandum M-06-18, Acquisition of Products and Services for Implementation of HSPD-12, June 30, 2006

42. OMB Memorandum 04-04, E-Authentication Guidance for Federal Agencies, December 16, 2003

43. OMB Memorandum 05-24, Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors, August 5, 2005

44. OMB memorandum M-11-11, “Continued Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors, February 3, 2011

45. OMB Memorandum, Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation, May 23, 2008

46. Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance, December 2, 2011

47. NIST SP 800-116, A Recommendation for the Use of Personal Identity Verification (PIV) Credentials in Physical Access Control Systems, November 20, 2008

48. OMB Memorandum M-07-16, Safeguarding Against and Responding to the Breach of Personally Identifiable Information, May 22, 2007

49. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, Digital Identity Guidelines, June 2017

50. NIST SP 800-157, Guidelines for Derived PIV Credentials, December 2014

51. NIST SP 800-164, Guidelines on Hardware-Rooted Security in Mobile Devices (Draft), October 2012

52. Draft National Institute of Standards and Technology Interagency Report (NISTIR) 7981 Mobile, PIV, and Authentication, March 2014

53. VA Memorandum, VAIQ #7100147, Continued Implementation of Homeland Security Presidential Directive 12 (HSPD-12), April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

54. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

55. VA Memorandum “Mandate to meet PIV Requirements for New and Existing Systems” (VAIQ# 7712300), June 30, 2015, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4846

56. Trusted Internet Connections (TIC) Reference Architecture Document, Version 2.0, Federal Interagency Technical Reference Architectures, Department of Homeland Security, October 1, 2013, https://s3.amazonaws.com/sitesusa/wp-content/uploads/sites/482/2015/04/TIC_Ref_Arch_v2-0_2013.pdf

57. OMB Memorandum M-08-05, “Implementation of Trusted Internet Connections (TIC), November 20, 2007

58. OMB Memorandum M-08-23, Securing the Federal Government’s Domain Name System Infrastructure, August 22, 2008

59. VA Memorandum, VAIQ #7497987, Compliance – Electronic Product Environmental Assessment Tool (EPEAT) – IT Electronic Equipment, August 11, 2014 (reference Document Libraries, EPEAT/Green Purchasing Section, https://www.voa.va.gov/documentlistpublic.aspx?NodeID=552)

60. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (Public Law 110–140), December 19, 2007

61. Section 104 of the Energy Policy Act of 2005, (Public Law 109–58), August 8, 2005

62. Executive Order 13693, “Planning for Federal Sustainability in the Next Decade”, dated March 19, 2015

63. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 2, 2001

64. VA Directive 0058, “VA Green Purchasing Program”, July 19, 2013

65. VA Handbook 0058, “VA Green Purchasing Program”, July 19, 2013

66. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote Access”, January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

67. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

68. VA Memorandum, “Implementation of Federal Personal Identity Verification (PIV) Credentials for Federal and Contractor Access to VA IT Systems”, (VAIQ# 7614373) July 9, 2015, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

69. VA Memorandum “Mandatory Use of PIV Multifactor Authentication to VA Information System” (VAIQ# 7613595), June 30, 2015, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

70. VA Memorandum “Mandatory Use of PIV Multifactor Authentication for Users with Elevated Privileges” (VAIQ# 7613597), June 30, 2015; https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

71. “Veteran Focused Integration Process (VIP) Guide 2.0”, May 2017, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

72. “VIP Release Process Guide”, Version 1.4, May 2016, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4411

73. “POLARIS User Guide”, Version 1.2, February 2016, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4412

74. VA Memorandum “Use of Personal Email (VAIQ #7581492)”, April 24, 2015, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

75. VA Memorandum “Updated VA Information Security Rules of Behavior (VAIQ #7823189)”, September, 15, 2017, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

76. Attachment A

77. Attachment B

78. Attachment C

79. Attachment D

80. Attachment E

81. Attachment F

SCOPE OF WORK

The Contractor shall provide a comprehensive range of project management, system administration support, extended warranty, and performance management sustainment support. The Contractor shall have the single point of responsibility for the system solution.

The Contractor shall provide project management to include project planning, meeting coordination and participation, monthly status reporting and service desk reporting.

The Contractor shall provide system administration support to include operations and maintenance support services, inclusive of a three-tier service desk as well as technical sustainment and system performance and capacity monitoring. The Contractor shall provide information assurance support to include information system authorization, testing, and continuous monitoring.

The Contractor shall provide extended warranty support to include repair and replacement in accordance with extended warranty terms and conditions.

The Contractor shall provide performance management sustainment support to include performance data management, performance data analytics, data reporting, maintenance of current performance dashboards, site specific end user sustainment support, and end user sustainment training.

The Contractor shall perform all services in accordance with VA and VHA regulations, policies, procedures, and instructions as provided in the Applicable Documents Section 2.0 above

The Contractor shall perform all services in accordance with VA and VHA regulations, policies, procedures, and instructions as provided in the Applicable Documents Section 2.0 above.

PERFORMANCE DETAILS

PERFORMANCE PERIOD

The period of performance shall be one (1), six (6)-month base period and four (4) 6-month option periods.

All tasks shall be performed in the base and option periods, if exercised.

The overall period of performance shall not exceed thirty (30) months.

Any work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO).

There are ten (10) Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, four are set by date:

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

PLACE OF PERFORMANCE

Tasks under this PWS shall be performed at both Contractor and Government facilities. The Contractor shall be on site when required to provide operations and maintenance support throughout VAMCs/CBOCs as required by the operations and sustainment tasks contained in the Performance Work Statement (PWs. As needed and with approval of the Contracting Officer’s Representative (COR), the Contractor staff shall visit VA locations identified in Attachment B VPS Parent Site Locations which is a complete list of all VAMCs and CBOCs to provide the support requirements in the PWS tasks below. Unless otherwise stated in the PWS tasks, tasks shall be performed remotely at Contractor facilities. No more than six (6) Contractor staff may be supported on-site at a given time.

TRAVEL

All authorized travel shall be on a Cost Reimbursement, no fee, basis. The Government anticipates travel under this effort to perform work at various VA locations with prior approval of the COR. Travel shall be in accordance with the Federal Travel Regulations (FTR) and requires advanced concurrence by the VPS COR. Contractor within the local commuting area will not be reimbursed. Contractor is required to complete and submit a VPS Program Office Travel Authorization Form v 1 no later than fourteen (14) business days before travel for approval. Any travel required due to a change in location or adjustment shall be reviewed and approved by the COR in advance of travel as well in accordance with Attachment A: Template VPS Program Office Travel Auth Form v1).

SPECIFIC TASKS AND DELIVERABLES

The Contractor shall perform the tasks required in the PWS. The Contractor shall be responsible for providing all the support services and deliverables as described in the sections below.

For delivery of all project artifacts, the Contract shall utilize approved Process Asset Library (PAL) templates (refer to Section 2.0). When no PAL template exists, the Contractor shall design and develop a template that must be reviewed and approved by the VA Project Manager (PM)/COR prior to delivery of the associated artifact.

All documents shall be created using Microsoft Word, Microsoft Excel, Microsoft PowerPoint, and/or Microsoft Project. All draft documents shall be delivered in one of these formats. All final documents shall be delivered in one of these formats as well as PDF. Additionally, all shared documents shall also be in one of the above formats.

PROJECT MANAGEMENT

CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, timeline, and tools to be used in execution of the contract. The CPMP should take the form of both a narrative and graphic format that displays the milestones, risks, and resource support. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPMP shall be concurred upon and updated monthly thereafter by the Contractor. The Contractor shall update and maintain the VA PM/COR approved CPMP throughout the period of performance. The Contractor shall deliver a briefing on the CPMP to the Government within fourteen (14) business days of the contract award.

The Contractor shall conduct a CPMP briefing meeting with the Government to present details of the intended approach and work plan. The Contractor shall identify to the Government at the briefing meeting how they intend to ramp-up personnel on the contract until full personnel execution is reached on the contract for planning purposes. The Contractor shall present a Briefing presentation during the meeting. The Contractor shall provide an agenda three (3) business days prior to the meeting to include a briefing presentation. and meeting minutes (shall be provided to all attendees within three (3) calendar days after the meeting).

As part of project management, the Contractor shall manage its performance in accordance with the established Key Performance Metrics Table in Section B.X.

Deliverables:

A. Contractor Project Management Plan w/updates

REPORTING REQUIREMENTS

The Contractor shall provide the VA PM/COR with a Monthly Contractor’s Progress, Status, and Management Report in electronic form in Microsoft Word and Project formats to include Gantt charts from Microsoft Project. (Reference Attachment D: Template Contractor’s Progress, Status, and Management Report). The report shall include detailed instructions/explanations for each required data element, to ensure that data is accurate and consistent. These reports shall reflect data as of the last day of the preceding month.

The Contractor’s Progress, Status, and Management Report shall cover all work completed during the reporting period and work planned for the subsequent reporting period. The report shall be based upon a reporting period of Sunday through Saturday.

The report shall also include an itemized list of all deliverables and their status. The Contractor shall monitor performance against the CPMP and report any deviations. The report shall also identify any problems that arose and a description of how the problems were resolved. If problems have not been completely resolved, the Contractor shall provide an explanation.

The Contractor shall also be responsible for measuring and monitoring its conformance to the Key Performance Metrics IAW Section 6.X and reporting results in the Monthly Contractor’s Progress Status and Management Report to ensure long-term consistency and results.

It is expected that the Contractor shall keep in communication with VA accordingly so that issues that arise are transparent to both parties to prevent escalation of outstanding issues.

The Contractor shall identify, and report issues and risk associated with software and report risks/issues and status of any mitigation actions in the Monthly Contractor’s Progress Status and Management Report.

The Contractor shall provide performance and availability trend analysis and supporting data in the Monthly Contractor’s Progress Status and Management Report to show prediction, trending, and monitoring of system’s performance trends.

The Contractor shall report on all sustainment activities in the Monthly Contractor’s Progress Status and Management Report during the reporting period.

The Contractor shall track the number and trends in incident tickets both functional and technical in the Monthly Contractor’s Progress Status and Management Report.

The Contractor shall continuously monitor performance and report any deviation from the previous Monthly Contractor’s Progress, Status, and Management Report to the VA COR and VPS PM during routine, regular communications.

The Contractor shall participate in weekly status meetings with the VPS team. Weekly status meetings shall address requirements for that week, important topics and other administrative topics needed to carry out operations.

The Contractor shall notify the VPS PM and VA COR, in writing, immediately if problems arise adversely impacting the performance of the PWS.

Deliverable:

A. Monthly Contractor Progress, Status, and Management Report

SERVICE DESK REPORTING

The Contractor shall provide detailed Bi-Weekly Service Desk Ticket Reports. For each bi-weekly service desk ticket report, the Contractor shall provide summary information regarding kiosk usage, uptime, downtime, bandwidth, and resource utilization. The Contractor shall provide help desk support response and operational metrics for all tickets, interactions, and resolutions. The Contractor shall provide VPS with access to its commercially available business intelligence tool(s) used to analyze, review and monitor data. The Contractor shall assist VPS with designing and developing reports from available data when needed for fact-based decision making.

The Contractor shall provide a Daily Kiosk Offline/Online Report that includes the following information 1) the specific kiosks that are offline for that day and 2) the action(s) that is being taken or have been completed for resolution as well as the number of kiosks online at each facility. Online indicates that the machine is functioning as expected. Offline means that Pulse, a utility within the VetLink software, cannot properly reach the kiosk and that there may be a problem. Pulse allows users to monitor the health of kiosk groups that are registered in VetLink. The Pulse utility shows at a glance how VetLink system hardware is functioning and identifies or provides diagnostic information for issues that may be affecting the performance of devices. Local site and remote Vecna Technical Support personnel use Pulse for daily monitoring of:

· Systemwide, group-level, and device-level kiosk activity

· Systemwide, group-level, and device-level display activity

· Systemwide, group-level, and device-level signage activity

Pulse is accessed as a collection of web pages within the VetLink app. The systemwide page for each device type is a dashboard that shows groups containing at least one active device. The data for each group provides insight into the operational status of its devices. Group-level information is accessible from the dashboard, device-level information, from the group-level view.

Deliverables:

A. Bi-Weekly Service Desk Ticket Report B. Daily Kiosk Offline/Online Report

PRIVACY TRAINING

The Contractor shall submit status of VA Privacy and Information Security Awareness training for all individuals engaged on the task. The status reporting shall identify; a single Contractor Security Point of Contact (POC), the names of all personnel engaged on the task, their initial training date for VA Privacy and Information Security training, and their next required training date. This information shall be submitted as part of the Monthly Contractor’s Progress Status and Management Report.

The Contractor shall submit VA Privacy and Information Security training certificates in accordance with Section 9, Training, from Appendix C of the VA Handbook 6500.6, “Contract Security”.

Deliverable:

A. VA Privacy and Information Security Training Certificates system administration SUPPORT SERVICES

OPERATIONS AND MAINTENANCE SUPPORT

The Contractor shall perform operations and maintenance support services for the VetLink system as part of system administration, which includes security support. The Contractor shall work with VPS to establish and deliver an updated Operations and Maintenance (O&M) Plan for sustainment. The Plan is intended to be used by O&M personnel as a guide for operating, maintaining, and monitoring the system.

The Contractor shall work with VPS, Office of Information and Technology (OI&T) and other relevant stakeholders to coordinate the day to day operation and maintenance of the VetLink system.

As part of the operations and maintenances performed, the Contractor shall be required to perform the services below for the VetLink system:

· System Administration

· System Architecture- single point of responsibility for the system solution

· Availability Management

· Business (Service) Continuity Management

· Capacity Management

· Change Management

· Database Administration

· Client Support

· Incident Management

· Problem Management

· Security Management

For the operational VetLink system, the Contractor shall perform the following functions:

· Document, implement and maintain standard operating procedures for the VetLink environment

· Provide and maintain event management functions

· Monitor system efficiency and perform troubleshooting and tuning of system, components, peripherals and interfaces

· Perform regular and scheduled maintenance, which includes but is not limited to patches, upgrades and performance tuning

In addition to the O&M activities described above, the Contractor is required to perform the following:

· Monitor and report to VPS Program Office on systems usage and other key performance indicators (KPIs)

· benchmark, analyze, report on, and make recommendations for the improvement and growth of infrastructure and system

· Analyze and provide a Quarterly User Satisfaction Review Findings report on customer satisfaction from the user community regarding the performance of the VetLink system on a regular basis (quarterly)

· Review and update all system documentation as changes occur or on a regularly scheduled basis (e.g. Disaster Recovery Plan, User Manuals).

A. Updated Operations and Maintenance Plan B. Quarterly User Satisfaction Review Findings

TECHNICAL SUSTAINMENT

SOFTWARE TECHNICAL SUPPORT

The Contractor shall provide technical maintenance and sustainment support services for VetLink proprietary software, and VPS-provided hardware at all deployed VA locations. The Contractor shall ensure that software and hardware maintenance requirements are met. The Contractor shall perform software maintenance which includes patches, fixes, and correcting defect/faults.

The Contractor shall provide technical software sustainment services to support, maintain and operate the current software capabilities of the system. This includes but is not limited to configurations management/control, updated existing manuals and training; as well as release management, if necessary (distribution processes)

The Contractor shall be responsible for technically maintaining and modifying the VetLink infrastructure system configuration to address functionality, security, connectivity or load issues.

The Contractor shall perform technical sustainment services on the software which includes corrections of any substantial defects/faults, fixes of any minor bugs, and fixes due to any conflicts with mandatory operating system security patches. If a defect/fault or fix appears in the existing code during the period of performance, the Contractor shall repair the defect/fault or fix during performance (base and all option periods). Defects/faults or fixes may be identified by the Government and its designees, to include all necessary personnel as designated by the COR.

The Contractor shall provide all services and materials necessary to perform VetLink sustainment, including sustainment testing for all bug fixes and patch releases. It shall be noted that if a software code freeze is implemented, any further fixes or changes to the software code shall require prior approval of the VA change control board.

The Contractor shall achieve a code freeze forty-four (44) calendar days prior to the end of the period of performance on the current O&M contract, September 30, 2019. This would be the period of a stabilization moving the VetLink software towards a sustainment state.

The Contractor shall adhere to the defect severity level 1- Critical, Institute of Electrical and Electronics Engineers (IEEE) definition: The defect results in the failure of the complete software system, of a subsystem, or of a software unit (program or module) within the system. Further defined as:

Loss of functionality resulting in erroneous eligibility/enrollment determinations or communications not being sent.

The Contractor shall track and trace defects/faults and fixes into the necessary requirements and design improvement cycles until complete resolution is reached to the satisfaction of VPS. When an end user reveals a defect or fault (anomaly) in the VetLink system, including hardware and software, the Contractor shall document the defect or fault (anomaly) in a commercially available defect tracking tool with access made available to VPS and develop the remedy and corrective action. At a minimum, the Contractor’s process shall include 1) identification and logging of defect, 2) evaluation of severity, and impact, 3) assignment to component or components, and when appropriate, a patch, 4) investigation of probable causes, 5) analysis of problem, 6) corrective action (fixes to Software Source Code), and 7) test results for fix. The Contractor shall document and maintain defects and change requests in a Bi-Monthly VetLink System Defect Repair Log which shall be provided in Microsoft Excel format.

As part of technical sustainment support, the Contractor shall also perform preventive and corrective maintenance as described below:

For preventive maintenance, the Contractor shall:

1. Perform modification to VetLink software installations and operational configurations to maintain and improve system performance, and to detect and correct latent faults in software and hardware products before they become operative faults.

2. Monitor the performance of the VetLink infrastructure and verify that performance thresholds are within nominal operating range and take corrective action necessary to mitigate or relieve VetLink performance deviations. The Contractor shall log and notify VPS of any performance deviation, and any known or suspected rationale for the deviation.

3. Engage in an ongoing inspection of VetLink system to identify operative and latent defects in VetLink functions, software scripts, and software and hardware configuration. The Contractor shall make actionable recommendations that address any defects detected. Recommendations shall be communicated and documented in a Quarterly System Improvement Recommendation Reports, which includes Root Cause Analysis Findings.

4. Perform root cause analysis to determine fundamental causes of events (e.g. frequent equipment failures may be the result of deficiencies in maintenance, equipment operating conditions or abnormal events) and recommend solutions back to VPS PM and VA COR. Recommendations shall be communicated and documented in a Quarterly System Improvement Recommendation Reports, which includes Root Cause Analysis Findings.

For corrective maintenance, the Contractor shall:

1. Perform corrective maintenance for any defects reported by users.

1. Perform troubleshooting to identify and isolate faults causing any failure or degradation and/or loss of service and/or functionality in VetLink components and system.

1. Address and resolve all security remediation and vulnerabilities from Federal Information Security Management Act (FISMA) compliance audits and Nessus scans.

4. Respond to and resolve server offline events and connection outages.

5. Submit a configuration/change request (CR) for approval from a Change Approval Board (CAB) prior to any system software fixes or patches. All system software fixes must be coordinated with the VA Office of Information and Technology (OIT) and all associated stakeholders/vendors within the VPS Program.

6. Perform corrections and alterations to the system based upon reported feedback impacting usability and 508 Compliance.

7. Coordinate with VA and designated VA Contractors to address security issues to achieve and maintain secure code, create work-around solutions, and/or apply critical bug fixes.

8. Provide input, code corrections, and documentation updates as required for significant system/application/interface fixes or changes

The Contractor shall also perform adaptive maintenance of the VetLink system. Adaptive maintenance is the implementation of fixes or changes in a part of the VetLink system. Adaptive maintenance may be required by a change of the law/legal or other regulations in the VA.

The Contractor shall plan, build, test and deploy VetLink software releases including system security patches and security patching management. The Contractor shall identify and manage risks to successfully deploy each VetLink system release. The Contractor shall establish a clear understanding of each VetLink System release between all stakeholders as well as coordinate release with VPS PM, VA COR, VPS Product Development and OI&T.

Maintenance time (Blue time) shall be handled and tested within a development testing environment (DevTest) or site environment prior to national release. System and Security patching shall be executed on Fridays in non-core hours and as needed. System patching shall go through the VA change board approval process prior to deployment.

The Contractor shall provide validation of issues or configuration resolutions, and proactively work with VetLink end-users to improve user experience.

The Contractor shall ensure existing functionality of VetLink including Contractor-developed interfaces is not comprised due to enhancements or updates unless specifically approved by the Government.

The Contractor shall provide deployment and implementation support of VetLink software releases into all environments.

The Contractor shall provide VetLink Pre-Release documentation for the VetLink software system via a Microsoft Excel Workbook (the file must be created and maintained in Excel) and Microsoft PowerPoint. The pre-release documentation shall be coordinated and distributed among all VetLink facilities to ensure notification of the software updates and the potential impact to current business processes once the sites have activated the kiosks. The Contractor shall work with the existing VetLink software release Contractor to acquire the required release information to perform this task. It is anticipated that there will be approximately one software release per quarter. The Contractor shall create a Microsoft Excel Workbook that includes the name of the releases, the functionality, whether the release is a critical defect, “bug fix”, or security patch to released functionality, the release date, and issue number for the Contractor’s ticketing system. The Contractor shall provide release notes in Microsoft PowerPoint, which outlines the change/fix, describes the change/fix, and provides screenshots where necessary.

For software releases (e.g. defect repair, security patches), the Contractor shall ensure required documentation complies with the PMAS requirements and VA template standards. Release planning and testing shall comply with the release schedule and plan which shall be submitted for approval five (5) days before the release process begins. Test cases and test information shall be shared at least three (3 days) in advance of User Acceptance Testing (UAT) or other test situations. Documentation shall be submitted to VA or and other vendors at least three (3) days in advance of submission for Initial Operating Capabilities (IOC), Operational Readiness Review (ORR), or other VA release approval dates

The Bi-Monthly Defect Tracking Management Log shall be an output of the Contractor’s commercially available ticketing system, access shall be available 24/7. The Contractor shall be responsible to provide an update on all tickets on a recurring weekly basis in Microsoft Excel format. The Contractor shall be responsible for clearly identifying new defects added for review by VA to ensure the severity and impact are appropriately scored by the Contractor.

The Contractor shall also be responsible for entering VA Your IT/ESD (Enterprise Service Desk) tickets when it’s identified by the Contractor, VPS PM/COR or VPS Product Development that one is necessary, such as a connection loss between VistA (Veterans Health Information Systems and Technology Architecture) and VetLink.

The Contractor shall deliver to the Government, upon expiration date of the contract, all source code and object code developed, modified and/or enhanced under this contract. As well as required documentation for release within VA and use the VA approved tool/software code repository which currently is the Rational tool suite.

Technical data and software data produced in the performance of this contract belongs to the Government. The Government has unlimited rights to the data. Data shall be provided in an open, interoperable, agreed upon, and portable format.

Deliverables:

A. Bi-Monthly Software Defect Tracking Management Log B. Quarterly System Improvement Recommendation Reports includes Root Cause Analysis Findings C. VetLink Pre-Release Workbook D. VetLink Pre-Release Notes E. Development Source Code and Object Code F. Software Release Planning and Testing Documentation

SERVICE DESK SUPPORT

The Contractor shall provide direct service desk support of VetLink system users in a service desk environment. The Contractor’s Service Desk shall support VPS Monday through Friday (16hr) for Tier 1; and for Tier 2 and Tier 3 Monday through Friday (8hr) and both Tiers to support On-Call in off hours/weekends and holidays, leveraging best practices including Information Technology Infrastructure Library (ITIL).

The Contractor shall provide and maintain a three-tier service desk, with a Contractor Service Manager coordinating with the VPS program office to define the tier boundaries. The scope includes support for all hardware and software deployed for VPS throughout the country and the connectivity and network behavior of the hardware and VetLink software.

· Tier 1 Support: Is defined as first level customer support for services. This support includes technical advice, trouble analysis, problem detection, problem resolution and general information systems support to users. Supported services include kiosk hardware, peripherals, software, network connectivity, relevant policies, kiosk metrics and reports generated by vKiosk, software/hardware troubleshooting, installation support, and equipment services and documentation

· Tier 2 Support: Requires the inclusion of a Vecna Technologies Inc., involvement (e.g., VetLink software engineer) or the involvement of VPS management.

· Tier 3 Support: Entirely requires a Vecna engineer or VA management to resolve. It also could require collaboration with other VA entities (e.g. OI&T)

The Contractor shall provide personnel and management support to perform service desk support and issue resolution for all VetLink kiosk hardware and software deployed by VPS throughout the VA enterprise as well as the connectivity and network behavior of the VetLink kiosk hardware and software. The Contractor shall be responsible for all activities associated with the service desk including the hiring and training of service desk staff; establishing, directing and managing service desk operations, and providing customer service.

The service desk staff shall be knowledgeable with all applications available for use on or with kiosks and with all utilized internal applications. Staff shall be proficient in vKiosk and all its modifications and customizations made for and by VA and be familiar with reference materials related to VetLink information, processes, and procedures.

The Service Desk shall receive requests for assistance via the following means – telephone number (TTY/TTD included), voicemail, email, and website portal, all of which are required to be provided by the Contractor. The Contractor shall provide technical advice, trouble analysis, problem detection, problem resolution and general information systems support to users.

The Contractor shall review and update if needed all customer facing service desk scripts. All customer facing service desk scripts must be reviewed and approved by the VA PM/COR prior to implementation.

The Contractor shall ensure the Service Desk can receive requests for service from the following sources:

· Telephone Number: Users shall have the option of reporting incidents/problems with any of the supporting systems via telephone and TTY/TDD.

· Voicemail: Users shall be able to leave a voicemail incident/problem report if they are put on hold.

· E-mail Support: Users shall have the option of reporting incidents/problems with any of the supported systems by means of electronic mail. Electronic mail will be addressed to the Help Desk mailbox. Users shall receive automated responses of receipt of their inquiry.

· Service Desk Ticketing System: Users shall have the option of opening a Help Desk ticket through a website support portal, through which all users will be able to track their open and closed tickets.

The Contractor shall be required to contact the VPS PM, VA COR and appropriate stakeholder(s) within eight (8) hours of not resolving an open Tier 1, Tier 2 or Tier 3, support ticket within the stated timeframes with Attachment E: Key Performance Metrics Table and provide an estimated time for resolution.

The Contractor shall provide daily by 4:00 pm EST, Service Desk status updates regarding open tickets to the VPS PM. Status updates can be provided via email.

The Contractor shall be required to work with OI&T (e.g. IT Operations and Services (ITOPS, Identity and Access Management (IAM)), ESD, VHA site staff and VA Contractors to resolve Tier 3 level tickets. The Contractor shall be responsible for developing VPS-approved workarounds for system defects when needed.

The Contractor shall review and update if needed the Service Desk Standard Operating Procedure (SOP). The Contractor shall have a clearly articulated procedure for escalating problems when target response or resolution times are not met. The updated Service Desk SOP shall be reviewed and approved by the VPS PM and VA COR.

The Contractor shall provide, configure, and manage a service desk tracking system, manage the escalation process, monitor performance metrics and report on the progress of all inquiries made to the service desk. The Contractor shall provide designated VA personnel (e.g. VPS PM, VA COR) access to the service desk tracking system.

The Contractor shall ensure all Service Desk personnel maintain communications with customers during the problem resolution process as well as provide accurate and timely logging of problems and resolutions for problems.

The Contract shall manage the escalation and resolution of non-tiered issues such as possible Congressional complaints.

The Contractor shall review and update if needed the Communication Plan for expediting messaging to the user community during site(s) performance degradation and outages. The Contractor shall be responsible for producing and delivering content for such messaging to VPS management for approval and distribution.

Deliverables:

A. Updated VetLink System Service Desk Standard Operating Procedure (SOP) B. Monthly Resolution Operation Support/Help Desk Ticket Report inclusive of Tier 1, Tier 2 and Tier 3 C. Updated Customer Facing Service Desk Scripts D. Updated Communication Plan E. Daily Service Desk Status Updates Notification/Report

SYSTEM PERFORMANCE AND CAPACITY METRICS

The Contractor shall provide system performance and capacity support to include creating and maintaining documentation of system performance (Service Level Agreement (SLA), metrics, trending, etc.) and capacity testing, monitoring and evaluation including information about system additions, enhancements, revision and usage changes that have impacted performance and capacity.

The Contractor shall provide operations analysis to the system. This shall include identifying, analyzing, and reporting on system performance in response to inquiries and data calls.

The Contractor shall provide server monitoring services which includes the the process of reviewing and analyzing each of the 320 servers for availability, operations, performance, security and other operations-related processes monthly. The Contractor shall be responsible of ensuring each of the 320 servers are performing as expected and to mitigate problems as they become apparent.

The Contractor shall be responsible for capacity planning activities which includes determining service level requirements, analyzing current capacity, and future planning.

The Contractor shall deliver a VetLink System Capacity Plan and update within each performance period of six (6) months to capture the resources required to support the functionality and performance requirements of VetLink system when operating at full capacity including servers. The Contractor shall identify customer and technical VetLink system requirements and prepare an analysis for capacity utilization assessments. The Contractor shall perform traffic VetLink technology infrastructure studies and make appropriate recommendations according to capacity needed to ensure resources will be in place to handle an increasing number of requests as the number of users or interactions increase.

The Contractor shall perform system performance studies, recommending appropriate changes to eliminate potential system bottlenecks, resource…