36C10B20R0013-003.docx

Request for Proposal 36C10B20R0013 Customer Experience, DevOps, Agile Releases (CEDAR) Indefinite Delivery, Indefinite Quantity (IDIQ) Contract

1. REQUISITION NO.

2. CONTRACT NO.

3. AWARD/EFFECTIVE DATE

4. ORDER NO.

5. SOLICITATION NUMBER

6. SOLICITATION ISSUE DATE

a. NAME

b. TELEPHONE NO. (No Collect Calls)

8. OFFER DUE DATE/LOCAL

TIME

9. ISSUED BY

CODE

10. THIS ACQUISITION IS

UNRESTRICTED OR

SET ASIDE:

% FOR:

SMALL BUSINESS

HUBZONE SMALL

BUSINESS

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

WOMEN-OWNED SMALL BUSINESS

(WOSB) ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

EDWOSB

8(A)

NAICS:

SIZE STANDARD:

11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

SEE SCHEDULE

12. DISCOUNT TERMS

13a. THIS CONTRACT IS A

RATED ORDER UNDER

DPAS (15 CFR 700)

13b. RATING

14. METHOD OF SOLICITATION

RFQ

IFB

RFP

15. DELIVER TO

CODE

16. ADMINISTERED BY

CODE

17a. CONTRACTOR/OFFEROR

CODE

FACILITY CODE

18a. PAYMENT WILL BE MADE BY

CODE

TELEPHONE NO.

DUNS:

DUNS+4:

PHONE:

FAX:

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN OFFER 18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK BELOW IS CHECKED

SEE ADDENDUM

19.

20.

21.

22.

23.

24.

ITEM NO.

SCHEDULE OF SUPPLIES/SERVICES

QUANTITY

UNIT

UNIT PRICE

AMOUNT

(Use Reverse and/or Attach Additional Sheets as Necessary)

25. ACCOUNTING AND APPROPRIATION DATA

26. TOTAL AWARD AMOUNT (For Govt. Use Only) 27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1, 52.212-4. FAR 52.212-3 AND 52.212-5 ARE ATTACHED. ADDENDA

ARE

ARE NOT ATTACHED.

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA

ARE

ARE NOT ATTACHED

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN _______________

29. AWARD OF CONTRACT: REF. ___________________________________ OFFER

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND

DATED ________________________________. YOUR OFFER ON SOLICITATION

DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY

(BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE

ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED

SET FORTH HEREIN IS ACCEPTED AS TO ITEMS:

30a. SIGNATURE OF OFFEROR/CONTRACTOR 31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER) 30b. NAME AND TITLE OF SIGNER (TYPE OR PRINT) 30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER (TYPE OR PRINT) 31c. DATE SIGNED

AUTHORIZED FOR LOCAL REPRODUCTION

(REV. 2/2012)

PREVIOUS EDITION IS NOT USABLE

Prescribed by GSA - FAR (48 CFR) 53.212

7. FOR SOLICITATION

INFORMATION CALL:

STANDARD FORM 1449

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 30

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

36C10B20R0013 March 2, 2020 David Melton - Contract Specialist 732-795-1143 March 11, 2020

4:00PM ET

Department of Veterans Affairs Technology Acquisition Center

23 Christopher Way Eatontown NJ 07724

X

541519 $30 Million

N/A

See Delivery Schedule

Department of Veterans Affairs Technology Acquisition Center

23 Christopher Way

Technology Acquisition Center Financial Services Center PO Box 149971 Austin TX 78714-8971

See CONTINUATION Page

Joshua Cohen Contracting Officer

Table of Contents

B.1 CONTRACT ADMINISTRATION DATA………………………………………….7

B.2 PRICE SCHEDULE…………………………………………………………….……8

B.3 PERFORMANCE WORK STATEMENT…………………………………………..9

SECTION C - CONTRACT CLAUSES 56

C.X RESERVED (Clauses - Incorporated By Reference) ………………………………56 C.X RESERVED (Clauses - Full Text)…………………………………………………56

C.X ON-RAMP…………………………………………………………………………56

C.X OFF-RAMP………………………………………………………………………...56

C.X ORGANIZATIONAL CONFLICT OF INTEREST……………………………….56

C.X INCORPORATION OF RATES AND LABOR DESCRIPTIONS………………..58

C.X METRICS…………………………………………………………………………..58

E.X RESERVED (Provisions - Incorporated By Reference)……………………………61 E.X RESERVED (Provisions - Full Text)………………………………………………61

E.X PROPOSAL SUBMISSION………………………………………………………..61

E.X BASIS FOR AWARD………………………………………………………………68

A.2 COMBINED SYNOPSIS/SOLICITATION

**RESERVED**

A.3 GOVERNING LAW

Federal law and regulations, including the Federal Acquisition Regulations (FAR), shall govern this Contract/Order. Commercial license agreements may be made a part of this Contract/Order but only if both parties expressly make them an addendum hereto. If the commercial license agreement is not made an addendum, it shall not apply, govern, be a part of or have any effect whatsoever on the Contract/Order; this includes, but is not limited to, any agreement embedded in the computer software (clickwrap), any agreement that is otherwise delivered with or provided to the Government with the commercial computer software or documentation (shrinkwrap), or any other license agreement otherwise referred to in any document. If a commercial license agreement is made an addendum, only those provisions addressing data rights regarding the Government’s use, duplication and disclosure of data (e.g., restricted computer software) are included and made a part of this Contract/Order, and only to the extent that those provisions are not duplicative or inconsistent with Federal law, Federal regulation, the incorporated FAR clauses and the provisions of this Contract/Order; those provisions in the commercial license agreement that do not address data rights regarding the Government’s use, duplication and disclosure of data shall not be included or made a part of the Contract/Order. Federal law and regulation including, without limitation, the Contract Disputes Act (41 U.S.C. § 7101 et seq.), the Anti-Deficiency Act (31 U.S.C. § 1341 et seq.), the Competition in Contracting Act (41 U.S.C. § 3301 et seq.), the Prompt Payment Act (31 U.S.C. §3901 et seq.), Contracts for Data Processing or Maintenance (38 USC § 5725), and FAR clauses 52.212-4, 52.227-14, 52.227-19 shall supersede, control, and render ineffective any inconsistent, conflicting, or duplicative provision in any commercial license agreement. In the event of conflict between this Clause and any provision in the Contract/Order or the commercial license agreement or elsewhere, the terms of this Clause shall prevail. Claims of patent or copyright infringement brought against the Government as a party shall be defended by the U.S. Department of Justice (DOJ). 28 U.S.C. § 516. At the discretion of DOJ, the Contractor may be allowed reasonable participation in the defense of the litigation. Any additional changes to the Contract/Order must be made by contract/order modification (Standard Form 30) and shall only be effected by a warranted Contracting Officer. Nothing in this Contract/Order or any commercial license agreement shall be construed as a waiver of sovereign immunity.

A.4 SOFTWARE LICENSE, MAINTENANCE AND TECHNICAL SUPPORT:

1. Definitions.

1. Licensee. The term “licensee” shall mean the U.S. Department of Veterans Affairs (“VA”) and is synonymous with “Government.”

1. Licensor. The term “licensor” shall mean the contractor having the necessary license or ownership rights to deliver license, software maintenance and support of the computer software being acquired. The term “contractor” is the party identified in Block 17a on the SF1449. If the contractor is a reseller and not the Licensor, the contractor remains responsible for performance under this order.

1. Software. The term “software” shall mean the licensed computer software product(s) cited in the Schedule of Supplies/Services.

1. Maintenance. The term “maintenance” is the process of enhancing and optimizing software, as well as remedying defects. It shall include all new fixes, patches, releases, updates, versions and upgrades, as further defined below.

1. Technical Support. The term “technical support” refers to the range of services providing assistance for the software via the telephone, email, a website or otherwise.

1. Release or Update. The term “release” or “update” are terms that refer to a revision of software that contains defect corrections, minor enhancements or improvements of the software’s functionality. This is usually designated by a change in the number to the right of the decimal point (e.g., from Version 5.3 to 5.4). An example of an update is the addition of new hardware.

1. Version or Upgrade. The term “version” or “upgrade” are terms that refer to a revision of software that contains new or improved functionality. This is usually designated by a change in the number to the left of the decimal point (e.g., from Version 5.4 to 6).

1. Software License

1. Unless otherwise stated in the Schedule of Supplies/Services, the Performance Work Statement or Product Description, the software license provided to the Government is a perpetual, nonexclusive license to use the software

1. The Government may use the software in a networked environment.

1. Any dispute regarding the license grant or usage limitations shall be resolved in accordance with the Disputes Clause incorporated in FAR 52.212-4(d).

1. All limitations of software usage are expressly stated in the Schedule of Supplies/Services and the Performance Work Statement/Product Description.

1. Software Maintenance and Technical Support

1. Disabling Software Code. The Government requires delivery of computer software that does not contain any code that will, upon the occurrence or the nonoccurrence of any event, disable the software. Such code includes but is not limited to a computer virus, restrictive key, node lock, time-out or other function, whether implemented by electronic, mechanical, or other means, which limits or hinders the use or access to any computer software based on residency on a specific hardware configuration, frequency of duration of use, or other limiting criteria. If any such disabling code is present, the contractor agrees to indemnify the Government for all damages suffered as a result of a disabling caused by such code, and the contractor agrees to remove such code upon the Government’s request at no extra cost to the Government. Inability of the contractor to remove the disabling software code will be considered an inexcusable delay and a material breach of contract, and the Government may exercise its right to terminate for cause. In addition, the Government is permitted to remove the code as it deems appropriate and charge the Contractor for consideration for the time and effort expended in removing the code.

1. Manuals and Publications. Upon Government request, the contractor shall furnish the most current version of the user manual and publications for all products/services provided under this contract or order at no cost.

A.5 RESERVED

SECTION B - CONTINUATION OF SF 1449 BLOCKS

B.1 CONTRACT ADMINISTRATION DATA

(continuation from Standard Form 1449, Block 18A.)

1. Contract Administration: All contract administration matters will be handled by the following individuals:

Contracting Officer 36C10B Joshua Cohen Department of Veterans Affairs Technology Acquisition Center 23 Christopher Way Eatontown NJ 07724

2. CONTRACTOR REMITTANCE ADDRESS: All payments by the Government to the contractor will be made in accordance with:

3. INVOICES: Invoices shall be submitted in arrears:

4. GOVERNMENT INVOICE ADDRESS: All Invoices from the contractor shall be submitted electronically in accordance with VAAR Clause 852.232-72 Electronic Submission of Payment Requests.

5. ACKNOWLEDGMENT OF AMENDMENTS: The offeror acknowledges receipt of amendments to the Solicitation numbered and dated as follows:

B.2 PRICE SCHEDULE

B.3 PERFORMANCE WORK STATEMENT

Customer Experience, DevOps, and Agile Releases (CEDAR) Performance Work Statement (PWS) Program

DATE: February 24, 2020 Version 0.1

Office of Information Technology (OI&T)

1.0 OBJECTIVE

CEDAR will support VA’s modernization initiatives by ensuring VA has streamlined access to the modern commercial services required to deliver excellent products to VA’s internal and external users. Successfully delivering such products often requires VA obtain commercial agile delivery services supported by teams with capabilities in user-centered design, user research, product management, agile application development, API development, automated testing, cloud infrastructure design and management, continuous integration / continuous delivery, and/or DevOps.

The objective of this effort is to provide VA with a streamlined enterprise-wide method to obtain such agile product design and delivery services. Specifically, CEDAR will meet the following goals:

1. Establish a streamlined and common contracting vehicle that will provide VA access to vendors specializing in agile design and delivery services including user-centered design, user research, product management, agile software development, Application Program Interface (API) development, automated testing, cloud infrastructure design and management, continuous integration/continuous delivery, and DevOps.

2. Allow for agile delivery services to be delivered in a rapid-cycle fashion, in accordance with industry best practices.

3. Support the execution of multiple VA digital modernization efforts by providing VA a simplified method to add specific and specialized commercial capabilities to these efforts as needed.

4. Ensure VA can rapidly adopt technology and design-industry best practices such as those described in the Office of Management and Budget’s (OMB’s) Digital Services Playbook[footnoteRef:1] and the TechFAR Handbook.[footnoteRef:2] [1: https://playbook.cio.gov] [2: https://techfarhub.cio.gov/handbook/]

This effort is consistent with several initiatives to strengthen Federal acquisition and technology practices, such as:

· Office of Federal Procurement Policy’s (OFPP’s) December 2017 memo encouraging strategic sourcing and strategies to drive performance such as developing common standards and practices in contracts;

· The Digital Services Playbook, released by OMB in August 2014, as a best practices guide for agencies to use when developing effective digital services; and

· The TechFAR Handbook, released by OFPP in August 2014, as a guide to the procurement of agile design and development services within the Information Technology (IT) Consulting, IT Outsourcing, and IT Security Categories.

2.0 SCOPE

The CEDAR Indefinite Delivery Indefinite Quantity (IDIQ) acquisition will be a VA-wide vehicle providing VA offices and components with commercial, streamlined agile delivery services and teams.

3.0 APPLICABLE DOCUMENTS

The Contractor shall comply with the documents listed below. Additional documents may be listed in individual Task Orders.

1. “Federal Information Security Modernization Act of 2014”

1. Federal Information Processing Standards (FIPS) Publication 140-2, “Security Requirements For Cryptographic Modules”

2. FIPS Pub 199. Standards for Security Categorization of Federal Information and Information Systems, February 2004

3. FIPS Pub 200, Minimum Security Requirements for Federal Information and Information Systems, March 2016

4. FIPS Pub 2012, “Personal Identity Verification of Federal Employees and Contractors,” August 2013

5. VA Directive and Handbook 6102, “Internet/Intranet Services,” July15, 2008

6. 36 C.F.R. Part 1194 “Electronic and Information Technology Accessibility Standards,” July 1, 2003

7. VA Directive 6500, “VA Cybersecurity Program,” January 23, 2019

8. VA Handbook 6500, “Risk Management Framework for VA Information Systems – Tier 3: VA Information Security Program,” March 10, 2015

9. 10.VA Handbook 6500.3, “Assessment, Authorization, And Continuous Monitoring Of VA Information Systems,” February 3, 2014

10. VA Handbook 6500.5, “Incorporating Security and Privacy in System Development Lifecycle”, March 22, 2010

11. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

12. Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance, December 2, 2011

13. Trusted Internet Connections (TIC) Reference Architecture Document, Version 2.0, Federal Interagency Technical Reference Architectures, Department of Homeland Security, October 1, 2013, https://s3.amazonaws.com/sitesusa/wp- content/uploads/sites/482/2015/04/TIC_Ref_Arch_v2-0_2013.pdf

14. OMB Memorandum M-08-05, “Implementation of Trusted Internet Connections (TIC), November 20, 2007

15. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote Access”, January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

16. VA Memorandum, “Implementation of Federal Personal Identity Verification (PIV) Credentials for Federal and Contractor Access to VA IT Systems”, (VAIQ# 7614373) July 9, 2015, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

17. VA Memorandum “Mandatory Use of PIV Multifactor Authentication to VA Information System” (VAIQ# 7613595), June 30, 2015, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

18. VA Memorandum “Mandatory Use of PIV Multifactor Authentication for Users with Elevated Privileges” (VAIQ# 7613597), June 30, 2015; https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

19. VA Memorandum “Use of Personal Email (VAIQ #7581492)”, April 24, 2015, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

20. VA Memorandum “Updated VA Information Security Rules of Behavior (VAIQ #7823189)”, September, 15, 2017, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

21. Experience with incorporating and using open source technologies (https://sourcecode.cio.gov/OSS/).

22. The Agile Manifesto (http://www.agilemanifesto.org/)

23. The U.S. Digital Services Playbook (https://playbook.cio.gov/)

4.0 GENERAL REQUIREMENTS

The Contractor shall provide and/or acquire the services, hardware, and software required by individual Task Orders pursuant to the general requirements specified below.

4.1 Contract Type

This is an Indefinite Delivery/Indefinite Quantity (IDIQ) Multiple Award Task Order (MATO) contract. Individual Task Orders shall be issued on a performance-based T&M and/or FFP basis.

4.2 Ordering Period

The ordering period for the basic contract shall be five years.

4.3 Hours of Work

Work at a Government site shall not take place on Federal holidays or weekends unless directed by the CO. The Contractor may also be required to support 24/7 operations 365 days per year as identified in individual Task Orders.

There are ten (10) Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, four are set by date:

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

4.4 Place of Performance

It is expected that contractor’s teams will be required to frequently interact with system users and program staff in support of this agreement. Support will be required at government facilities (on-site) and at non-government facilities (offsite). Specific site locations will be defined at the task order level. The government anticipates that most of the work will occur in the contiguous United States (CONUS), but OCONUS support by the contractor may be performed as long as the government provides approval in advance. For support provided at government facilities, the government may provide space and equipment (e.g., phone, desktop computer and peripherals, desk and accessories, etc.) for contractor personnel performing work on-site at VA facilities. The contractor personnel may be required to work offsite (i.e. at the prime or subcontractor facilities) when adequate workspace is not available at the Government site.

4.5 Travel

Travel shall be IAW individual Task Order requirements. Travel details must be provided to and approved by the Task Order Contracting Officer’s Representative (COR) or the Government designee prior to the commencement of travel. All travel shall be IAW the Federal Travel Regulations (FTR).

4.6 Materials, Equipment and Locations

4.6.1 Government-Furnished

Government Furnished Property (GFP) which includes Government Furnished Material (GFM), Government Furnished Information (GFI), and Government Furnished Equipment (GFE) may be provided and shall be identified in the individual Task Order. The Contractor shall be responsible for conducting all necessary examinations, inspections, maintenance, and tests upon receipt. The Contractor shall be responsible for reporting all inspection results, maintenance actions, losses, and damage to the Government through the COR.

VA may provide VA specific software as appropriate and required in individual Task Orders. The Contractor may utilize VA provided software development and test accounts, document and requirements repositories and others as required for the development, storage, maintenance and delivery of products. Contractors shall comply with VA security policies and procedures with respect to protecting sensitive data. See Section 7.0 for detailed security requirements.

4.6.2 Contractor-Acquired

The Contractor shall acquire and/or provide any hardware and/or software required to accomplish each Task Order that is not provided as GFP. Software integrity shall be maintained by the Contractor within the licensing agreement of the producer until such software is delivered to the Government, or otherwise disposed of IAW Government direction. Items delivered to the Government shall be approved by the Government in advance of purchase and shall be in compliance with A3.0. See Section 7.0 for detailed security requirements.

4.6.3 Connectivity

VA will provide connectivity to VA specific systems/network as required for execution of the task via VA approved remote access technology. Currently this may include but is not limited to Citrix Access Gateway (CAG), site-to-site VPN, or VA Remote Access Security Compliance Update Environment (RESCUE). This remote access will provide connectivity to VA specific software such as Veterans Health Information System and Technology Architecture (VistA), ClearQuest, PAL, and Primavera including appropriate seat management and user licenses. VA may install equipment at the Contractor’s site to ensure security requirements are in place. The Contractor must meet the requirements of VA Handbook 6500 and will bear the cost to provide connectivity to VA. Other connectivity to VA systems may be authorized as appropriate in individual Task Orders.

4.6.4 Facilities

Work may be performed at either a Government or non-Government facility. Each Task Order shall delineate the location requirements.

4.6.4.1 Government Facilities

Certain Government office or laboratory space may be made available for performance of individual Task Orders. Contractors may be required to establish operations and support Government locations and shall comply with VA and/or Federal assessment and authorization (A&A) requirements. Such facilities shall be specified in the individual Task Order.

4.6.4.2 Non-Government Facilities

Personnel may perform at Contractor or remote facilities if specified in the individual task order. Contractors may be required to establish operations and support Contractor facilities and shall comply with VA and/or Federal A&A requirements. Such facilities shall be specified in the individual Task Order. The Contractor shall disclose specific facility information during the Request for Task Execution Plan (RTEP) process. All facilities shall be approved by VA and in compliance with PWS paragraph 6.0, Security and Privacy.

4.6.5 Warranty

Items acquired under this contract may require warranty protection. Commercial warranties shall be transferred to the Government. The type of warranty and extent of coverage shall be determined on an individual Task Order basis.

4.6.6 Marking, Handling, Storage, Preservation, Packaging, Tracking & Shipping The Contractor shall establish/maintain procedures IAW VA Handbook 6500 and VA Directive 6609 for handling, storage, preservation, packaging, marking, tracking and shipping to protect the quality of products and prevent damage, loss, deterioration, degradation or substitution of products.

4.6.7 Export Control

The Contractor shall comply with all applicable laws and regulations regarding export-controlled information and technology and shall not use, distribute, transfer or transmit technology (even if incorporated into products, software or other information) except in compliance with such laws and regulations. In addition, the Contractor shall plan for, obtain, and maintain any and all export licensing required to satisfy individual Task Order requirements.

4.7 Safety and Environmental

Safety and environmental procedures shall be identified in individual Task Order requirements.

The Contractor shall comply with the Office of Federal Procurement Policy Green Acquisition initiatives as identified in individual Task Orders IAW the policies referenced at http://www.whitehouse.gov/omb/procurement_index_green.

4.8 Enterprise and IT Framework

4.8.1 One-VA Technical Reference Model

For VA specific task orders, the Contractor shall support the VA enterprise management framework. In association with the framework, the Contractor shall comply with OI&T Technical Reference Model (One-VA TRM) and consider the OneVA Enterprise Technology Strategic Plan. One-VA TRM is one component within the overall Enterprise Architecture (EA) that establishes a common vocabulary and structure for describing the IT used to develop, operate, and maintain enterprise applications.

4.8.2 Federal Identity, Credential, And Access Management (FICAM)

The Contractor shall ensure Commercial Off-The-Shelf (COTS) product(s), software configuration and customization, and/or new software are Personal Identity Verification (PIV) card-enabled by accepting HSPD-12 PIV credentials using VA Enterprise Technical Architecture (ETA), http://www.ea.oit.va.gov/VA_EA/VAEA_TechnicalArchitecture.asp, and VA Identity and Access Management (IAM) approved enterprise design and integration patterns, http://www.techstrategies.oit.va.gov/enterprise_dp.asp. The Contractor shall ensure all Contractor delivered applications and systems comply with the VA Identity, Credential, and Access Management policies and guidelines set forth in the VA Handbook 6510 and align with the Federal Identity, Credential, and Access Management Roadmap and Implementation Guidance v2.0.

The Contractor shall ensure all Contractor delivered applications and systems provide user authentication services compliant with the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-63-3, VA Handbook 6500 Appendix F, “VA System Security Controls,” and VA IAM enterprise requirements for direct, assertion based authentication, and/or trust based authentication, as determined by the design and integration patterns. Direct authentication at a minimum must include Public Key Infrastructure (PKI) based authentication supportive of PIV card and/or Common Access Card (CAC), as determined by the business need.

The Contractor shall ensure all Contractor delivered applications and systems conform to the specific Identity and Access Management PIV requirements set forth in the Office of Management and Budget (OMB) Memoranda M-04-04, M-05-24, M-11-11, and NIST Federal Information Processing Standard (FIPS) 201-2. OMB Memoranda M-04-04, M-05-24, and M-11-11 can be found at: https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/omb/memoranda/fy04/m04-04.pdf, https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/omb/memoranda/fy2005/m05-24.pdf, and https://obamawhitehouse.archives.gov/sites/default/files/omb/memoranda/2011/m11-11.pdf respectively. Contractor delivered applications and systems shall be on the FIPS 201-2 Approved Product List (APL). If the Contractor delivered application and system is not on the APL, the Contractor shall be responsible for taking the application and system through the FIPS 201 Evaluation Program.

The Contractor shall ensure all Contractor delivered applications and systems support:

1. Automated provisioning and are able to use enterprise provisioning service.

2. Interfacing with VA’s Master Veteran Index (MVI) to provision identity attributes, if the solution relies on VA user identities. MVI is the authoritative source for VA user identity data.

3. The VA defined unique identity (Secure Identifier [SEC ID] / Integrated Control Number [ICN]).

4. Multiple authenticators for a given identity and authenticators at every Authenticator Assurance Level (AAL) appropriate for the solution.

5. Identity proofing for each Identity Assurance Level (IAL) appropriate for the solution.

6. Federation for each Federation Assurance Level (FAL) appropriate for the solution, if applicable.

7. Two-factor authentication (2FA) through an applicable design pattern as outlined in VA Enterprise Design Patterns.

8. A Security Assertion Markup Language (SAML) implementation if the solution relies on assertion-based authentication. Additional assertion implementations, besides the required SAML assertion, may be provided as long as they are compliant with NIST SP 800-63-3 guidelines.

9. Authentication/account binding based on trusted Hypertext Transfer Protocol (HTTP) headers if the solution relies on Trust based authentication.

10. Role Based Access Control.

11. Auditing and reporting capabilities.

12. Compliance with VAIQ# 7712300 Mandate to meet PIV requirements for new and existing systems. https://www.voa.va.gov/DocumentView.aspx?DocumentID=4846 The required Assurance Levels for this specific effort are Identity Assurance Level 3, Authenticator Assurance Level 3, and Federation Assurance Level 3.

4.8.3 Internet Protocol Version 6 (Ipv6)

The Contractor solution shall support the latest Internet Protocol Version 6 (IPv6) based upon the directives issued by the Office of Management and Budget (OMB) on August 2, 2005 (https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/omb/memoranda/fy2005/m05-22.pdf) and September 28, 2010 (https://cio.gov/wp-content/uploads/downloads/2012/09/Transition-to-IPv6.pdf). IPv6 technology, in accordance with the USGv6 Profile, NIST Special Publication (SP) 500-267 (https://www.nist.gov/programs-projects/usgv6-technical-basis-next-generation-internet), the Technical Infrastructure for USGv6 Adoption (http://www-x.antd.nist.gov/usgv6/index.html), and the NIST SP 800 series applicable compliance (http://csrc.nist.gov/publications/PubsSPs.html) shall be included in all IT infrastructures, application designs, application development, operational systems and sub-systems, and their integration. In addition to the above requirements, all devices shall support native IPv6 and/or dual stack (IPv6 / IPv4) connectivity without additional memory or other resources being provided by the Government, so that they can function in a mixed environment. All public/external facing servers and services (e.g. web, email, DNS, ISP services, etc.) shall support native IPv6 and/or dual stack (IPv6/ IPv4) users and all internal infrastructure and applications shall communicate using native IPv6 and/or dual stack (IPv6/ IPv4) operations. Guidance and support of improved methodologies which ensure interoperability with legacy protocol and services in dual stack solutions, in addition to OMB/VA memoranda, can be found at: https://www.voa.va.gov/documentlistpublic.aspx?NodeID=282.

4.8.4 Trusted Internet Connection (Tic)

The Contractor solution shall meet the requirements outlined in Office of Management and Budget Memorandum M08-05 mandating Trusted Internet Connections (TIC) (https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/omb/memoranda/fy2008/m08-05.pdf), M08-23 mandating Domain Name System Security (NSSEC) (https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/omb/memoranda/fy2008/m08-23.pdf), and shall comply with the Trusted Internet Connections (TIC) Reference Architecture Document, Version 2.0 https://s3.amazonaws.com/sitesusa/wp-content/uploads/sites/482/2015/04/TIC_Ref_Arch_v2-0_2013.pdf.

4.8.5 Standard Computer Configuration

The Contractor IT end user solution that is developed for use on standard VA computers shall be compatible with and be supported on the standard VA operating system, currently Windows 10 (64bit), Internet Explorer 11 and Microsoft Office 2010. In preparation for the future VA standard configuration update, end user solutions shall also be compatible with Office 365 ProPlus and Windows 10. However, Office 365 ProPlus and Windows 10 are not the VA standard yet and are currently approved for limited use during their rollout, we are in-process of this rollout and making them the standard by OI&T. Upon the release approval of Office 365 ProPlus and Windows 10 individually as the VA standard, Office 365 ProPlus and Windows 10 will supersede Office 2010 and Windows 7 respectively. Applications delivered to the VA and intended to be deployed to Windows 7 workstations shall be delivered as a signed .msi package with switches for silent and unattended installation and updates shall be delivered in signed .msp file formats for easy deployment using System Center Configuration Manager (SCCM),’ VA’s current desktop application deployment tool. Signing of the software code shall be through a vendor provided certificate that is trusted by the VA using a code signing authority such as Verizon/Cybertrust or Symantec/VeriSign. The Contractor shall also ensure and certify that their solution functions as expected when used from a standard VA computer, with non-admin, standard user rights that have been configured using the United States Government Configuration Baseline (USGCB) and Defense Information Systems Agency (DISA) Secure Technical Implementation Guide (STIG) specific to the particular client operating system being used.

4.8.6 Enterprise Management Framework

The Enterprise Management Framework (EMF) provides an enterprise-wide view of VA IT systems comprised of tools, reports, databases, dashboards, and analytics. EMF enables OI&T to view the health and performance of systems and provides intelligent analysis and trending that enables proactive enterprise system management. Performance, availability, user experience and reliability of IT service delivery is improved as OI&T is able to make strategic, operational and investment decisions based on real-time information.

EMF supports a unified enterprise service management model including release management, configuration management, change management, and incident management aligned with industry standard IT Infrastructure Library (ITIL) service management best practices. The EMF Federated Data Repository (FDR) includes the implementation of a foundational component. The EMF FDR is a national repository that collects enterprise IT management data from VA Managed Data Repositories (MDRs) and integrates with existing VA monitoring and performance systems.

Additional frameworks may be specified in individual task orders.

4.9 Development Methodologies

The contractor(s) shall provide VA with teams that shall deliver viable, digital solutions in support of VA’s strategic mission and objectives.

The specific nature of the capabilities required for each team will be articulated at the task order level. However, it is expected that a typical agile delivery team requested under the CEDAR IDIQ will require the contractor provide multi-disciplinary teams with members having expertise in product management, agile software development, user research, User Experience (UX) strategy, User Interface (UI) and visual design, and development and operations (DevOps).

The contractor’s support and solutions shall follow the practices described in the Digital Services Playbook (https://playbook.cio.gov). The contractor shall be familiar with the concepts in each play and implement them in its approaches and support. The contractor shall design, develop, configure, customize and deploy solutions to some of VA’s most pressing challenges. Once deployed, the contractor shall provide production support of the solution as required. The contractor shall deliver modern digital services that use DevOps techniques that embrace continuous integration and continuous deployment. The contractor shall deliver secure and tested modern mobile and web application designs using automated testing frameworks. The contractor shall provide support to projects that are building brand new systems as well as projects that are building on top of, or replacing, existing systems. The contractor shall be familiar with current and emerging technologies, COTS products, services, programming languages and processes required to deliver high-quality products.

The Contractor shall:

1. Deliver high-quality, functional products that delight users.

2. Follow the practices described in the “Digital Services Playbook” (https://playbook.cio.gov).

3. Be agile. Incorporate Agile methodologies and ceremonies into work, such as (but not limited to) sprint planning, daily scrum, sprint review, sprint retrospective, backlog grooming, and estimating activities.

4. Actively involve users in the design of all solutions. Incorporate best practices for modern user research and usability testing, such as (but not limited to) creating user personas, problem space definitions, affinity maps, user flow diagrams, wireframes, information architecture diagrams, design prototypes, user research plans, conversation guides, and user research synthesis.

5. Maintain a consistent look, feel, and voice across user facing sites and services. Incorporate best practices defined in the VA Design System and VA Content Style Guide (https://design.va.gov/).

6. Personalize solutions for the individual or team using the product.

7. Optimize web applications for mobile-first operation, with all solutions being equally available on both mobile and desktop.

8. Incorporate robust accessibility principles into design, development and testing for all web applications to deliver high-quality digital experiences to users of assistive devices.

9. Protect user information with best-in-class security, given the constraints of the environment.

10. Use DevOps techniques of continuous integration and continuous deployment across all environments including, at a minimum, development, staging, and production.

11. Use automated testing frameworks to create unit tests, integration tests, functional/black box tests, and load tests (or their equivalents as applicable) to test 100% of functionality delivered. Strive for compliance with Test Driven Development practices.

12. Ensure configuration and sensitive data, including data the VA defines as sensitive, are not present in source code, and are stored in encrypted credential management systems.

13. Deliver all code not containing configuration or sensitive data to an open source repository per OMB Guidance M-16-21.

14. Cultivate a positive, trusting, and cooperative working relationships with the government and all other vendors supporting this work.

4.10 Quality Assurance

The performance of CEDAR contract holders will be measured in two contexts. One will be at the Task Order level using metrics specific to the nature of work required on the Task Order (for instance, a Task Order for a web-based application may use metrics like abandonment rates, load times, etc.). The second context will be at the overall CEDAR base contract level used to meet Contractor Performance Information requirements (e.g. CPARS) in accordance with FAR Part 42.15 and for the evaluation of Past Performance at the Task Order level. In some cases, the Government may specify required metrics for a specific Task Order QASP, while in other cases Contract Holders may be asked to propose metrics as part of their Task Order Execution Plans (TEPs), which may or may not be used for Task Order evaluation purposes. It is the Government’s preference, when appropriate and practical, that performance information be provided via real-time tools (e.g. dashboards) made available to the Government rather than via separate paper or electronic reports.

There will be a relationship between the ratings provided at the Task Order level and those provided at the CEDAR base contract level used for Task Order level Past Performance evaluations and for CPARS assessments. Specifically, the metrics measured in accordance with TO specific QASPs will be used to inform the Quality rating in the Quarterly Performance Assessments (which will be used to calculate the Past Performance scores when evaluating Past Performance for Task Orders) as well as to inform the Quality scores entered into CPARs for each Task Order. The specific performance ratings used for the Past Performance evaluations as well as for CPARs will be in four distinct areas: Quality, Schedule, Cost Control, and Management.

4.11 Government Inspection and Oversight

The Contractor shall cooperate with authorized Government offices in the areas of facilities access, audits, security incident notification, and hosting location.

Specifically, the Contractor (and any Subcontractors) shall:

a. Provide the CO, designated representative of the CO, and representatives of authorized Government offices, full and free physical and remote/logical access to the Contractor's (and Subcontractors') facilities, installations, operations documentation, databases, and personnel used for contract hosting services. This access shall be provided to the extent required to carry out audits, inspections, device scanning utilizing Government prescribed tools, investigations, or other reviews to ensure compliance with contractual requirements for IT and information security, and to safeguard against threats and hazards to the integrity, availability, and confidentiality of agency information in the possession or under the control of the Contractor (or Subcontractor)

b. Fully cooperate with all audits, inspections, investigations, or other reviews conducted by or on behalf of the CO or other authorized Government offices as described in subparagraph (a). Full cooperation includes, but is not limited to, prompt disclosure (per agency policy) to authorized requests of data, information, and records requested in connection with any audit, inspection, investigation, or review, making employees of the Contractor available for interview by auditors, inspectors, and investigators upon request, and providing prompt access (per agency policy) to Contractor facilities, systems, data and personnel to the extent the auditors, inspectors, and investigators reasonably believe necessary to complete the audit, inspection, investigation, or other review. The Contractor's (and any Subcontractors') cooperation with audits, inspections, investigations, and reviews conducted under this clause will be provided at no additional cost to the Government

c. Preserve such data, records, logs and other evidence which are reasonably necessary to conduct a thorough investigation of any computer security incident. A computer security incident (as defined in NIST SP 800-61, Computer Security Incident Handling Guide), including but not limited to, those constituting an actual or potential threat or hazard to the integrity, availability, or confidentiality of agency information in the possession or under the control of the Contractor (or Subcontractor), or to the function of information systems operated by the Contractor (or Subcontractor) in the performance of this contract

d. Promptly notify the designated agency representative in the event of any computer security and privacy incident as described in paragraph (c) above. This notification requirement is in addition to any other notification requirements which may be required by law or this contract. Established Federal agency timeframes for reporting security and privacy incidents to the United States Computer Emergency Readiness Team (US-CERT), although not exhaustive, serve as a useful guideline for determining whether reports under this paragraph are made promptly. (See NIST SP 800-61, Computer Security Incident Handling Guide, Appendix J)

e. Provide to the requestor (CO, a representative of the CO, or authorized Government offices) Government data, information, or records under the control of or in the possession of the Contractor pursuant to this contract, which the Agency or authorized Government offices, including the Office of Inspector General, may request in furtherance of other audits, inspections, investigations, reviews or litigation in which the Agency or other authorized Government offices are involved in the form specified at the task order level. Requests for production under this paragraph shall specify a deadline not less than 10 days for compliance which will determine whether response to the request has been made in a timely manner. Unless expressly provided otherwise elsewhere in this contract, the production of data, information, or records under this paragraph will be at no additional cost to the Government

f. Include the substance of this Section, including this paragraph (f) in any subcontract which would require or otherwise result in Subcontractor employees having access to agency information in the possession or under the control of the Contractor (or Subcontractor), or access to information systems operated by the Contractor (or Subcontractor) in the performance of this contract

g. Ensure that all hosting services pertaining to this contract are performed within the United States of America, including the storage of agency data, information, and records under the control of or in the possession of the Contractor pursuant to this contract

5.0 TECHNICAL FUNCTIONAL AREAS

Individual Task Orders may encompass more than one functional area listed below. Efforts to be performed by the Contractor under this contract are of such a nature that they may create a potential and/or actual organizational conflict of interest as contemplated by Subpart 9.5 of the Federal Acquisition Regulation (FAR). Contractor personnel may be required to sign a non-disclosure agreement.

1. User Research and User Story Collaboration: The contractor shall use a range of qualitative and quantitative user research methods to determine people’s goals, needs, and behaviors. If requested in the call order, the contractor shall have the ability to recruit test users from a variety of backgrounds including Veterans, Servicemembers, family members, and caregivers for the purposing of conducting the research. This research shall be documented in form that VA and other contractors can easily access and learn from. The contractor shall work with the product owner or other VA staff to generate and prioritize user stories based on this research.

2. User-Centered Design: The contractor shall design digital services that help people easily complete the desired tasks. Work will include UX strategy, UI and visual design, rapid prototyping, and front-end engineering. Contractors shall implement the VA Design System (https://design.va.gov/) as a default for work performed.

3. Plain-Language Content Writing: The contractor shall work with VA stakeholders to develop written plain-language content that is easy for people to understand while accurately describing VA processes, requirements and other content. Content shall be tested with users to ensure it is easily understood. Contractors shall implement the VA Content Style Guide (https://design.va.gov/content-style-guide/) as a default for work performed.

4. Agile software development: The contractor shall develop software in an iterative style following the modern best practices described in the Digital Services Playbook (https://playbook.cio.gov).