36C10B20R0013 0002.docx

Request for Proposal 36C10B20R0013 Customer Experience, DevOps, Agile Releases (CEDAR) Indefinite Delivery, Indefinite Quantity (IDIQ) Contract

5. PROJECT NUMBER (if applicable)

CODE

7. ADMINISTERED BY

2. AMENDMENT/MODIFICATION NUMBER

CODE

6. ISSUED BY

8. NAME AND ADDRESS OF CONTRACTOR

4. REQUISITION/PURCHASE REQ. NUMBER

3. EFFECTIVE DATE

9A. AMENDMENT OF SOLICITATION NUMBER

9B. DATED

PAGE OF PAGES

10A. MODIFICATION OF CONTRACT/ORDER NUMBER

10B. DATED

BPA NO.

1. CONTRACT ID CODE

FACILITY CODE

CODE

Offers must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended, by one of the following methods:

The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offers

E. IMPORTANT:

is extended,

(a) By completing Items 8 and 15, and returning __________ copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted; or (c) By separate letter or electronic communication which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGMENT TO BE RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY is not extended.

12. ACCOUNTING AND APPROPRIATION DATA

(REV. 11/2016)

is required to sign this document and return ___________ copies to the issuing office.

is not, A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE CONTRACT ORDER NO. IN ITEM 10A.

15C. DATE SIGNED

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(b).

RESULT IN REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by letter or electronic communication, provided each letter or electronic communication makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER

Contractor

16C. DATE SIGNED

14. DESCRIPTION OF AMENDMENT/MODIFICATION

16B. UNITED STATES OF AMERICA

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15A. NAME AND TITLE OF SIGNER

16A. NAME AND TITLE OF CONTRACTING OFFICER

15B. CONTRACTOR/OFFEROR

STANDARD FORM 30

PREVIOUS EDITION NOT USABLE

Prescribed by GSA - FAR (48 CFR) 53.243 (Type or print) (Type or print) (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

(Number, street, county, State and ZIP Code) (If other than Item 6) (Specify type of modification and authority) (such as changes in paying office, appropriation date, etc.)

(If required)

(SEE ITEM 11)

(SEE ITEM 13)

(X)

CHECK

ONE

13. THIS ITEM APPLIES ONLY TO MODIFICATIONS OF CONTRACTS/ORDERS,

IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

(Signature of person authorized to sign) (Signature of Contracting Officer)

TAC-20-51726

Department of Veterans Affairs Technology Acquisition Center

23 Christopher Way Eatontown NJ 07724

Technology Acquisition Center

23 Christopher Way Eatontown NJ 07724 To all Offerors/Bidders

36C10B20R0013 06-04-2020

X

X

See Continuation Page Below

Joshua Cohen Contracting Officer

CONTINUATION PAGE FOR AMENDMENT 0002

1. The following are a summary of the changes made in Amendment 0002:

a. To administratively correct Section A.2(xv) to reflect the new Technical Factor 1 Submission date posted in Amendment 0001 and revise the submission instructions in that section which now refer to Section E.7 for the updated submission instructions.

b. To update Section B.3 to Version 0.3 dated June 17, 2020 specifically:

i. revising language in Paragraph 7.2g

ii. revising language in Paragraph 8.3.2B.1

iii. revising hyperlink in Paragraph 9.1

iv. revising hyperlink in Paragraph 9.2

c. To add Attachments 006 and 007 to Section D as D.6 and D.7 respectively.

d. To delete FAR 52.215-1 Instructions to Offerors—Competitive Acquisition and its Alternate I.

e. To update Section E.7, specifically:

i. To modify the submission instructions in Section E.7

ii. To modify the formatting instructions in Section E.7.2.a.

iii. To clarify the Page Limitations for Volume I

iv. To clarify instructions for submitting artifacts for Technical Factor 1.

v. Added a clarification regarding Joint Ventures.

vi. To add a requirement for Prime Offerors and Joint Ventures to add their DUNS to the list of all major subcontractors.

vii. To update the instructions for Volume IV.

f. To update Section E.8, specifically:

i. To edit the basis for award in Section E.8.A

ii. To strike reference to FAR 52.215-1 in Section E.8.A

Table of Contents

A.2 COMBINED SYNOPSIS/SOLICITATION

This is a combined synopsis/solicitation for commercial items prepared in accordance with the format in Subpart 12.6, as supplemented with additional information included in this notice. This announcement constitutes the only solicitation; proposals are being requested and an additional solicitation will not be issued.

(ii) Request for Proposal (RFP) 36C10B20R0013

(iii) The solicitation document and incorporated provisions and clauses are those in effect through Federal Acquisition Circular 2020-06

(iv) Notice of total Service-Disabled Veteran-Owned Small Business (SDVOSB) set-aside

(v) See Section B below for the Price Schedule.

(vi) See Section B below for the Performance Work Statement.

(vii) The ordering period for the basic contract shall be five years. Freight-On-Board (FOB) is Destination.

(viii) The provision at 52.212-1, “Instructions to Offerors -- Commercial,” applies to this acquisition. See Section E below for addenda.

(ix) The provision at 52.212-2, “Evaluation -- Commercial Items,” does not apply to this acquisition. See Section E below for the Evaluation procedures and Basis for Award.

(x) Offerors shall include a completed copy of the provision at 52.212-3, “Offeror Representations and Certifications -- Commercial Items,” with its offer. See Section E below for addenda.

(xi) The clause at 52.212-4, “Contract Terms and Conditions -- Commercial Items,” and its Alternate I, applies to this acquisition. See Section C below for the addenda.

(xii) The clause at 52.212-5, “Contract Terms and Conditions Required To Implement Statutes Or Executive Orders -- Commercial Items,” applies to this acquisition. See Section C below for the addenda.

(xiii) See Section B below regarding requirements for Software License, Maintenance, and Technical Support. See PWS paragraph 4.6.5 in Section C for Warranty requirements.

(xv) Technical Factor 1—Case Study Proposals are due by 4:00PM10:00AM ET on June 1823, 2020. Please see revised submission instructions in Section E.7.Offerors shall submit Proposals via email to David.Melton@va.gov and HYPERLINK "mailto:Joshua.Cohen2@va.gov" Joshua.Cohen2@va.gov. Offerors who notify the Government of their intent to remain in the competition after the Advisory Step will then be provided the date and time of each Offeror’s Technical Factor 2 –Remote Design Challenge, and the due date for the Technical Factor 3--Written Technical Approach, Price, and Solicitation, Offer & Award Documents, Certifications and Representations Volumes.

(xvi) Please contact Contract Specialist David Melton, David.Melton@va.gov, (732) 795-1143, or Contracting Officer Joshua Cohen, Joshua.Cohen2@va.gov, (732) 440-9696 for information regarding the solicitation.

A.3 GOVERNING LAW

Federal law and regulations, including the Federal Acquisition Regulations (FAR), shall govern this Contract/Order. Commercial license agreements may be made a part of this Contract/Order but only if both parties expressly make them an addendum hereto, as permitted by FAR 12.212. If the commercial license agreement is not made an addendum, it shall not apply, govern, be a part of or have any effect whatsoever on the Contract/Order; this includes, but is not limited to, any agreement embedded in the computer software (clickwrap), any agreement that is otherwise delivered with or provided to the Government with the commercial computer software or documentation (shrinkwrap), or any other license agreement otherwise referred to in any document. If a commercial license agreement is made an addendum, only those provisions addressing data rights regarding the Government’s use, duplication and disclosure of data (e.g., restricted computer software) are included and made a part of this Contract/Order, and only to the extent that those provisions are not duplicative or inconsistent with Federal law, Federal regulation, the incorporated FAR clauses and the provisions of this Contract/Order; those provisions in the commercial license agreement that do not address data rights regarding the Government’s use, duplication and disclosure of data shall not be included or made a part of the Contract/Order. Federal law and regulation including, without limitation, the Contract Disputes Act (41 U.S.C. § 7101 et seq.), the Anti-Deficiency Act (31 U.S.C. § 1341 et seq.), the Competition in Contracting Act (41 U.S.C. § 3301 et seq.), the Prompt Payment Act (31 U.S.C. § 3901 et seq.), Contracts for Data Processing or Maintenance (38 USC § 5725), and FAR clauses 52.212-4, 52.227-14, 52.227-19 shall supersede, control, and render ineffective any inconsistent, conflicting, or duplicative provision in any commercial license agreement. In the event of conflict between this clause and any provision in the Contract/Order or the commercial license agreement or elsewhere, the terms of this clause shall prevail. The Contractor shall deliver to the Government all data first produced under this Contract/Order with unlimited rights as defined by FAR 52.227-14. Claims of patent or copyright infringement brought against the Government as a party shall be defended by the U.S. Department of Justice (DOJ) in accordance with 28 U.S.C. § 516; at the discretion of DOJ, the Contractor may be allowed reasonable participation in the defense of the litigation. Any additional changes to the Contract/Order must be made by modification (Standard Form 30) and shall only be made by a warranted Contracting Officer. Nothing in this Contract/Order or any commercial license agreement shall be construed as a waiver of sovereign immunity.

A.4 SOFTWARE LICENSE, MAINTENANCE AND TECHNICAL SUPPORT:

1. Definitions.

1. Licensee. The term “licensee” shall mean the U.S. Department of Veterans Affairs (“VA”) and is synonymous with “Government.”

1. Licensor. The term “licensor” shall mean the contractor having the necessary license or ownership rights to deliver license, software maintenance and support of the computer software being acquired. The term “contractor” is the party identified in Block 17a on the SF1449. If the contractor is a reseller and not the Licensor, the contractor remains responsible for performance under this order.

1. Software. The term “software” shall mean the licensed computer software product(s) cited in the Schedule of Supplies/Services.

1. Maintenance. The term “maintenance” is the process of enhancing and optimizing software, as well as remedying defects. It shall include all new fixes, patches, releases, updates, versions and upgrades, as further defined below.

1. Technical Support. The term “technical support” refers to the range of services providing assistance for the software via the telephone, email, a website or otherwise.

1. Release or Update. The term “release” or “update” are terms that refer to a revision of software that contains defect corrections, minor enhancements or improvements of the software’s functionality. This is usually designated by a change in the number to the right of the decimal point (e.g., from Version 5.3 to 5.4). An example of an update is the addition of new hardware.

1. Version or Upgrade. The term “version” or “upgrade” are terms that refer to a revision of software that contains new or improved functionality. This is usually designated by a change in the number to the left of the decimal point (e.g., from Version 5.4 to 6).

1. Software License

1. Unless otherwise stated in the Schedule of Supplies/Services, the Performance Work Statement or Product Description, the software license provided to the Government is a perpetual, nonexclusive license to use the software

1. The Government may use the software in a networked environment.

1. Any dispute regarding the license grant or usage limitations shall be resolved in accordance with the Disputes Clause incorporated in FAR 52.212-4(d).

1. All limitations of software usage are expressly stated in the Schedule of Supplies/Services and the Performance Work Statement/Product Description.

1. Software Maintenance and Technical Support

1. Disabling Software Code. The Government requires delivery of computer software that does not contain any code that will, upon the occurrence or the nonoccurrence of any event, disable the software. Such code includes but is not limited to a computer virus, restrictive key, node lock, time-out or other function, whether implemented by electronic, mechanical, or other means, which limits or hinders the use or access to any computer software based on residency on a specific hardware configuration, frequency of duration of use, or other limiting criteria. If any such disabling code is present, the contractor agrees to indemnify the Government for all damages suffered as a result of a disabling caused by such code, and the contractor agrees to remove such code upon the Government’s request at no extra cost to the Government. Inability of the contractor to remove the disabling software code will be considered an inexcusable delay and a material breach of contract, and the Government may exercise its right to terminate for cause. In addition, the Government is permitted to remove the code as it deems appropriate and charge the Contractor for consideration for the time and effort expended in removing the code.

1. Manuals and Publications. Upon Government request, the contractor shall furnish the most current version of the user manual and publications for all products/services provided under this contract or order at no cost.

SECTION B - CONTINUATION OF SF 1449 BLOCKS

B.1 CONTRACT ADMINISTRATION DATA

(continuation from Standard Form 1449, Block 18A.)

1. Contract Administration: All contract administration matters will be handled by the following individuals:

Contracting Officer 36C10B Joshua Cohen Department of Veterans Affairs Technology Acquisition Center 23 Christopher Way Eatontown NJ 07724

2. CONTRACTOR REMITTANCE ADDRESS: All payments by the Government to the contractor will be made in accordance with:

3. INVOICES: Invoices shall be submitted in arrears:

4. GOVERNMENT INVOICE ADDRESS: All Invoices from the contractor shall be submitted electronically in accordance with VAAR Clause 852.232-72 Electronic Submission of Payment Requests.

5. ACKNOWLEDGMENT OF AMENDMENTS: The offeror acknowledges receipt of amendments to the Solicitation numbered and dated as follows:

B.2 PRICE SCHEDULE

BASE PERIOD

CLIN

DESCRIPTION

QTY

UNIT

UNIT PRICE

TOTAL PRICE

SECURITY CLASS: Determined at the Task Order Level

This CLIN will provide commercial, streamlined agile delivery services and teams and incidental supplies on a Firm-Fixed-Price basis for a period of 60 months from date of award in accordance with (IAW) the Customer Experience, DevOps, Agile Releases (CEDAR) Performance Work Statement (PWS).

Specific requirements and pricing shall be set forth under each individual Task Order.

Inspection, Acceptance and FOB Points shall be determined at the Task Order Level.

The delivery or performance schedule shall be determined on each individual Task Order.

SECURITY CLASS: Determined at the Task Order Level

This CLIN will provide commercial, streamlined agile delivery services and teams and incidental supplies on a Time-and-Materials/Labor-Hour basis for a period of 60 months from date of award IAW the Customer Experience, DevOps, Agile Releases (CEDAR) Performance Work Statement (PWS).

Specific requirements and pricing shall be set forth under each individual Task Order.

Inspection, Acceptance and FOB Points shall be determined at the Task Order Level.

The delivery or performance schedule shall be determined on each individual Task Order.

Monthly Status Report shall be provided IAW Section B.3, PWS, Paragraph 9.1.1 and Section D, Attachment 002

FOB Point: Destination Inspection: Destination Acceptance: Destination

Contract Maximum/Minimum Ceiling:

IAW Section C, clause 52.216-22, “Indefinite Quantity,” the Maximum Overall Value of the CEDAR IDIQ contracts is $247,260,000.00. IAW Section C, clause 52.216-22 entitled, “Indefinite Quantity” the Minimum guaranteed value under any CEDAR contract is $50,000.00. The Government reserves the right to award initial orders at the time of the basic contract award on a sole source basis pursuant to FAR 16.505(b)(2)(D) at amounts which may exceed the minimum guaranteed value. No order under the CEDAR IDIQ shall be awarded in excess of $10,000,000.00.

The ceiling price as set forth in Section C, clause 52.212-4 “Contract Terms and Conditions-Commercial Items, Alternate I,” paragraph (i)(3) will be established for each individual Time-and Materials/Labor-Hour Task Order.

B.3 PERFORMANCE WORK STATEMENT

Customer Experience, DevOps, and Agile Releases (CEDAR) Performance Work Statement (PWS) Program

DATE: June 4, 2020 Version 0.2

Office of Information Technology (OI&T)

1. OBJECTIVE

CEDAR will support VA’s modernization initiatives by ensuring VA has streamlined access to the modern commercial services required to deliver digital products to VA’s internal and external users. Successfully delivering such products often requires VA obtain commercial agile delivery services supported by teams with capabilities in user-centered design, user research, product management, agile application development, Application Programming Interface (API) development, automated testing, cloud infrastructure design and management, continuous integration/continuous delivery (CI/CD), and/or Development Operations (DevOps).

The objective of this effort is to provide VA with a streamlined enterprise-wide method to obtain such agile product design and delivery services. Specifically, CEDAR will meet the following goals:

1. Establish a streamlined and common contracting vehicle that will provide VA access to contractors specializing in agile design and delivery services including user-centered design, user research, product management, agile software development, API development, automated testing, cloud infrastructure design and management, continuous integration/continuous delivery, and DevOps.

2. Allow for agile delivery services to be delivered in a rapid-cycle fashion, in accordance with industry best practices.

3. Support the execution of multiple VA digital modernization efforts by providing VA a simplified method to add specific and specialized commercial capabilities to those efforts as needed.

4. Ensure VA can rapidly adopt technology and design-industry best practices such as those described in the Office of Management and Budget’s (OMB) Digital Services Playbook[footnoteRef:1] and the TechFAR Handbook.[footnoteRef:2] [1: https://playbook.cio.gov] [2: https://techfarhub.cio.gov/handbook/]

This effort is consistent with several initiatives to strengthen Federal acquisition and technology practices, such as:

· Office of Federal Procurement Policy’s (OFPP) December 2017 memo encouraging strategic sourcing and strategies to drive performance such as developing common standards and practices in contracts;

· The Digital Services Playbook, released by OMB in August 2014, as a best practices guide for agencies to use when developing effective digital services; and

· The TechFAR Handbook, released by OFPP in August 2014, as a guide to the procurement of agile design and development services within the Information Technology (IT) Consulting, IT Outsourcing, and IT Security Categories.

SCOPE

The CEDAR Indefinite Delivery Indefinite Quantity (IDIQ) acquisition will be a VA-wide vehicle providing VA offices and components with commercial, streamlined agile delivery services and teams.

APPLICABLE DOCUMENTS

The Contractor shall comply with the documents listed below. Additional documents may be listed in individual Task Orders.

1. “Federal Information Security Modernization Act of 2014”

1. Federal Information Processing Standards (FIPS) Publication 140-2, “Security Requirements For Cryptographic Modules”

2. FIPS Pub 199. Standards for Security Categorization of Federal Information and Information Systems, February 2004

3. FIPS Pub 200, Minimum Security Requirements for Federal Information and Information Systems, March 2016

4. FIPS Pub 2012, “Personal Identity Verification of Federal Employees and Contractors,” August 2013

5. VA Directive and Handbook 6102, “Internet/Intranet Services,” July15, 2008

6. 36 C.F.R. Part 1194 “Electronic and Information Technology Accessibility Standards,” July 1, 2003

7. VA Directive 6500, “VA Cybersecurity Program,” January 23, 2019

8. VA Handbook 6500, “Risk Management Framework for VA Information Systems – Tier 3: VA Information Security Program,” March 10, 2015

9. 10.VA Handbook 6500.3, “Assessment, Authorization, And Continuous Monitoring Of VA Information Systems,” February 3, 2014

10. VA Handbook 6500.5, “Incorporating Security and Privacy in System Development Lifecycle”, March 22, 2010

11. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

12. Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance, December 2, 2011

13. Trusted Internet Connections (TIC) Reference Architecture Document, Version 2.0, Federal Interagency Technical Reference Architectures, Department of Homeland Security, October 1, 2013, https://s3.amazonaws.com/sitesusa/wp- content/uploads/sites/482/2015/04/TIC_Ref_Arch_v2-0_2013.pdf

14. OMB Memorandum M-08-05, “Implementation of Trusted Internet Connections (TIC), November 20, 2007

15. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote Access”, January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

16. VA Memorandum, “Implementation of Federal Personal Identity Verification (PIV) Credentials for Federal and Contractor Access to VA IT Systems”, (VAIQ# 7614373) July 9, 2015, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

17. VA Memorandum “Mandatory Use of PIV Multifactor Authentication to VA Information System” (VAIQ# 7613595), June 30, 2015, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

18. VA Memorandum “Mandatory Use of PIV Multifactor Authentication for Users with Elevated Privileges” (VAIQ# 7613597), June 30, 2015; https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

19. VA Memorandum “Use of Personal Email (VAIQ #7581492)”, April 24, 2015, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

20. VA Memorandum “Updated VA Information Security Rules of Behavior (VAIQ #7823189)”, September, 15, 2017, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

21. Experience with incorporating and using open source technologies (https://sourcecode.cio.gov/OSS/).

22. The Agile Manifesto (http://www.agilemanifesto.org/)

23. The U.S. Digital Services Playbook (https://playbook.cio.gov/)

GENERAL REQUIREMENTS

The Contractor shall provide and/or acquire the services, hardware, and software required by individual Task Orders pursuant to the general requirements specified below.

0.1 Contract Type

This is an IDIQ Multiple Award Task Order (MATO) contract. Individual Task Orders shall be issued on a performance-based T&M/Labor Hour and/or FFP basis.

0.2 Ordering Period

The ordering period for the basic contract shall be five years.

0.3 Hours of Work

Work at a Government site shall not take place on Federal holidays or weekends unless directed by the CO. The Contractor may also be required to support 24/7 operations 365 days per year as identified in individual Task Orders.

There are ten (10) Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, four are set by date:

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

0.4 Place of Performance

It is expected that contractor’s teams will be required to frequently interact with system users and program staff in support of this agreement. Support will be required at government facilities (on-site) and at non-government facilities (offsite). Specific site locations will be defined at the Task Order level. The government anticipates that most of the work will occur in the contiguous United States (CONUS), but OCONUS support by the Contractor may be performed as long as the Government provides approval in advance at the Task Order level. For support provided at Government facilities, the Government may provide space and equipment (e.g., phone, desktop computer and peripherals, desk and accessories, etc.) for Contractor personnel performing work on-site at VA facilities. The Contractor personnel may be required to work offsite (i.e. at the prime or subcontractor facilities) when adequate workspace is not available at the Government site.

0.5 Travel

Travel shall be IAW individual Task Order requirements. Travel details must be provided to, and approved by, the Task Order Contracting Officer’s Representative (COR) or the Government designee prior to the commencement of travel. All travel shall be IAW the Federal Travel Regulations (FTR).

0.6 Materials, Equipment and Locations

0.6.1 Government-Furnished

The Government has multiple remote access solutions available to include Citrix Access Gateway (CAG), Site-to-Site Virtual Private Network (VPN), and RESCUE VPN.

The Government’s issuance of Government Furnished Equipment (GFE) is limited to Contractor personnel requiring direct access to the network to: development environments; install, configure and run Technical Reference Model (TRM) approved software and tools (e.g., Oracle, Fortify, Eclipse, SoapUI, WebLogic, LoadRunner); upload/download/manipulate code, run scripts, and apply patches; configure and change system settings; check logs, troubleshoot/debug, and test/QA.

When necessary, the Government will furnish desktops or laptops, for use by the Contractor to access VA networks, systems, or applications to meet the requirements of this PWS. The overarching goal is to determine the most cost-effective approach to providing needed access to the VA environment coupled with the need to ensure proper Change Management principles are followed. Contractor personnel shall adhere to all VA system access requirements for on-site and remote users in accordance with VA standards, local security regulations, policies and rules of behavior. GFE shall be approved by the COR and Program Manager on a case-by-case basis prior to issuance at the Task Order level.

Government Furnished Property (GFP) which includes Government Furnished Material (GFM), Government Furnished Information (GFI), and Government Furnished Equipment (GFE) may be provided and shall be identified in the individual Task Order. The Contractor shall be responsible for conducting all necessary examinations, inspections, maintenance, and tests upon receipt. The Contractor shall be responsible for reporting all inspection results, maintenance actions, losses, and damage to the Government through the COR.

VA may provide VA specific software as appropriate and required in individual Task Orders. The Contractor may utilize VA provided software development and test accounts, document and requirements repositories and others as required for the development, storage, maintenance and delivery of products. Contractors shall comply with VA security policies and procedures with respect to protecting sensitive data. See Section 7.0 for detailed security requirements.

0.6.2 Contractor-Acquired

The Contractor shall acquire and/or provide any hardware and/or software required to accomplish each Task Order that is not provided as GFP. Software integrity shall be maintained by the Contractor within the licensing agreement of the producer until such software is delivered to the Government, or otherwise disposed of IAW Government direction. Items delivered to the Government shall be approved by the Government in advance of purchase and shall be in compliance with Addendum A section A3.0. See Section 7.0 for detailed security requirements.

0.6.3 Connectivity

VA will provide connectivity to VA specific systems/network as required for execution of the task via VA approved remote access technology. Currently this may include but is not limited to Citrix Access Gateway (CAG), site-to-site VPN, or VA Remote Access Security Compliance Update Environment (RESCUE). This remote access will provide connectivity to VA specific software such as Veterans Health Information System and Technology Architecture (VistA), ClearQuest, PAL, and Primavera including appropriate seat management and user licenses. The Contractor must meet the requirements of VA Handbook 6500 and will bear the cost to provide connectivity to VA. Other connectivity to VA systems may be authorized, as appropriate, in individual Task Orders.

0.6.4 Facilities

Work may be performed at either a Government or non-Government facility. Each Task Order shall delineate the location requirements.

0.6.4.1 Government Facilities

Certain Government office or laboratory space may be made available for performance of individual Task Orders. Contractors may be required to establish operations and support Government locations and shall comply with VA and/or Federal assessment and authorization (A&A) requirements. Such facilities shall be specified in the individual Task Order.

0.6.4.2 Non-Government Facilities

Personnel may perform at Contractor or remote facilities if specified in the individual Task Order. Contractors may be required to establish operations and support Contractor facilities and shall comply with VA and/or Federal A&A requirements. Such facilities shall be specified in the individual Task Order. The Contractor shall disclose specific facility information during the Request for Task Execution Plan (RTEP) process.

0.6.5 Warranty

Items acquired under this contract may require warranty protection. Commercial warranties shall be transferred to the Government. The type of warranty and extent of coverage shall be determined on an individual Task Order basis.

0.6.6 Marking, Handling, Storage, Preservation, Packaging, Tracking & Shipping The Contractor shall establish/maintain procedures IAW VA Handbook 6500 and VA Directive 6609 for handling, storage, preservation, packaging, marking, tracking and shipping to protect the quality of products and prevent damage, loss, deterioration, degradation or substitution of products.

0.6.7 Export Control

The Contractor shall comply with all applicable laws and regulations regarding export-controlled information and technology and shall not use, distribute, transfer or transmit technology (even if incorporated into products, software or other information) except in compliance with such laws and regulations. In addition, the Contractor shall plan for, obtain, and maintain any and all export licensing required to satisfy individual Task Order requirements.

0.7 Safety and Environmental

Safety and environmental procedures shall be identified within individual Task Order requirements.

The Contractor shall comply with the OFPP Green Acquisition initiatives as identified in individual Task Orders IAW the policies referenced at http://www.whitehouse.gov/omb/procurement_index_green.

0.8 Enterprise and IT Framework

0.8.1 One-VA Technical Reference Model

For VA specific Task Orders, the Contractor shall support the VA enterprise management framework. In association with the framework, the Contractor shall comply with OI&T Technical Reference Model (One-VA TRM) and consider the OneVA Enterprise Technology Strategic Plan. One-VA TRM is one component within the overall Enterprise Architecture (EA) that establishes a common vocabulary and structure for describing the IT used to develop, operate, and maintain enterprise applications.

0.8.2 Federal Identity, Credential, And Access Management (FICAM) The Contractor shall ensure Commercial Off-The-Shelf (COTS) product(s), software configuration and customization, and/or new software are Personal Identity Verification (PIV) card-enabled by accepting HSPD-12 PIV credentials using VA Enterprise Technical Architecture (ETA), https://www.ea.oit.va.gov/EAOIT/VA-EA/Enterprise/Technical_Architecture.asp, and VA Identity and Access Management (IAM) approved enterprise design and integration patterns. The Contractor shall ensure all Contractor delivered applications and systems comply with the VA Identity, Credential, and Access Management policies and guidelines set forth in the VA Handbook 6510 and align with the Federal Identity, Credential, and Access Management Roadmap and Implementation Guidance v2.0.

The Contractor shall ensure all Contractor delivered applications and systems provide user authentication services compliant with the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-63-3, VA Handbook 6500 Appendix F, “VA System Security Controls,” and VA IAM enterprise requirements for direct, assertion based authentication, and/or trust based authentication, as determined by the design and integration patterns. Direct authentication at a minimum must include Public Key Infrastructure (PKI) based authentication supportive of PIV card and/or Common Access Card (CAC), as determined by the business need.

The Contractor shall ensure all Contractor delivered applications and systems conform to the specific Identity and Access Management PIV requirements set forth in the OMB Memoranda M-04-04, M-05-24, M-11-11, and NIST Federal Information Processing Standard (FIPS) 201-2. OMB Memoranda M-04-04, M-05-24, and M-11-11 can be found at: https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/omb/memoranda/fy04/m04-04.pdf, https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/omb/memoranda/fy2005/m05-24.pdf, and https://obamawhitehouse.archives.gov/sites/default/files/omb/memoranda/2011/m11-11.pdf respectively. Contractor delivered applications and systems shall be on the FIPS 201-2 Approved Product List (APL). If the Contractor delivered application and system is not on the APL, the Contractor shall be responsible for taking the application and system through the FIPS 201 Evaluation Program.

The Contractor shall ensure all Contractor delivered applications and systems support:

1. Automated provisioning and are able to use enterprise provisioning service.

2. Interfacing with VA’s Master Veteran Index (MVI) to provision identity attributes, if the solution relies on VA user identities. MVI is the authoritative source for VA user identity data.

3. The VA defined unique identity (Secure Identifier [SEC ID]/Integrated Control Number [ICN]).

4. Multiple authenticators for a given identity and authenticators at every Authenticator Assurance Level (AAL) appropriate for the solution.

5. Identity proofing for each Identity Assurance Level (IAL) appropriate for the solution.

6. Federation for each Federation Assurance Level (FAL) appropriate for the solution, if applicable.

7. Two-factor authentication (2FA) through an applicable design pattern as outlined in VA Enterprise Design Patterns.

8. A Security Assertion Markup Language (SAML) implementation if the solution relies on assertion-based authentication. Additional assertion implementations, besides the required SAML assertion, may be provided as long as they are compliant with NIST SP 800-63-3 guidelines.

9. Authentication/account binding based on trusted Hypertext Transfer Protocol (HTTP) headers if the solution relies on Trust based authentication.

10. Role Based Access Control.

11. Auditing and reporting capabilities.

12. Compliance with VAIQ# 7712300 Mandate to meet PIV requirements for new and existing systems.

The required Assurance Levels for this specific effort are Identity Assurance Level 3, Authenticator Assurance Level 3, and Federation Assurance Level 3.

0.8.3 Internet Protocol Version 6 (Ipv6)

The Contractor solution shall support the latest Internet Protocol Version 6 (IPv6) based upon the directives issued by the Office of Management and Budget (OMB) on August 2, 2005 (https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/omb/memoranda/fy2005/m05-22.pdf) and September 28, 2010 (https://cio.gov/wp-content/uploads/downloads/2012/09/Transition-to-IPv6.pdf). IPv6 technology, in accordance with the USGv6 Profile, NIST Special Publication (SP) 500-267 (https://www.nist.gov/programs-projects/usgv6-technical-basis-next-generation-internet), the Technical Infrastructure for USGv6 Adoption (http://www-x.antd.nist.gov/usgv6/index.html), and the NIST SP 800 series applicable compliance (http://csrc.nist.gov/publications/PubsSPs.html) shall be included in all IT infrastructures, application designs, application development, operational systems and sub-systems, and their integration. In addition to the above requirements, all devices shall support native IPv6 and/or dual stack (IPv6/IPv4) connectivity without additional memory or other resources being provided by the Government, so that they can function in a mixed environment. All public/external facing servers and services (e.g. web, email, DNS, ISP services, etc.) shall support native IPv6 and/or dual stack (IPv6/IPv4) users and all internal infrastructure and applications shall communicate using native IPv6 and/or dual stack (IPv6/IPv4) operations. Guidance and support of improved methodologies which ensure interoperability with legacy protocol and services in dual stack solutions, in addition to OMB/VA memoranda, can be found at: https://www.voa.va.gov/documentlistpublic.aspx?NodeID=282.

0.8.4 Trusted Internet Connection

The Contractor solution shall meet the requirements outlined in Office of Management and Budget Memorandum M08-05 mandating Trusted Internet Connections (TIC) (https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/omb/memoranda/fy2008/m08-05.pdf), M08-23 mandating Domain Name System Security (NSSEC) (https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/omb/memoranda/fy2008/m08-23.pdf), and shall comply with the Trusted Internet Connections (TIC) Reference Architecture Document, Version 2.0 https://s3.amazonaws.com/sitesusa/wp-content/uploads/sites/482/2015/04/TIC_Ref_Arch_v2-0_2013.pdf.

0.8.5 Enterprise Management Framework

The Enterprise Management Framework (EMF) provides an enterprise-wide view of VA IT systems comprised of tools, reports, databases, dashboards, and analytics. EMF enables OI&T to view the health and performance of systems and provides intelligent analysis and trending that enables proactive enterprise system management. Performance, availability, user experience and reliability of IT service delivery is improved as OI&T is able to make strategic, operational and investment decisions based on real-time information.

EMF supports a unified enterprise service management model including release management, configuration management, change management, and incident management aligned with industry standard IT Infrastructure Library (ITIL) service management best practices. The EMF Federated Data Repository (FDR) includes the implementation of a foundational component. The EMF FDR is a national repository that collects enterprise IT management data from VA Managed Data Repositories (MDRs) and integrates with existing VA monitoring and performance systems.

Additional frameworks may be specified in individual Task Orders.

0.9 Development Methodologies

The contractor(s) shall provide VA with teams that shall deliver viable, digital solutions in support of VA’s strategic mission and objectives.

The specific nature of the capabilities required for each team will be articulated at the Task Order level. However, it is expected that a typical agile delivery team requested under the CEDAR IDIQ will require the contractor provide multi-disciplinary teams with members having expertise in product management, agile software development, user research, UX strategy, User Interface (UI) and visual design, and DevOps.

The Contractor’s support and solutions shall follow the practices described in the Digital Services Playbook (https://playbook.cio.gov). The Contractor shall be familiar with the concepts in each play and implement them in its approaches and support. The Contractor shall design, develop, configure, customize and deploy solutions to some of VA’s most pressing challenges. Once deployed, the Contractor shall provide production support of the solution as required. The Contractor shall deliver modern digital services that use DevOps techniques that embrace CI/CD. The Contractor shall deliver secure and tested modern mobile and web application designs using automated testing frameworks. The Contractor shall provide support to projects that are building brand new systems as well as projects that are building on top of, or replacing, existing systems. The Contractor shall be familiar with current and emerging technologies, COTS products, services, programming languages and processes required to deliver high-quality products.

The Contractor shall:

1. Deliver high-quality, functional products that are measured by user feedback from surveys, research, etc.

2. Follow the practices described in the “Digital Services Playbook” (https://playbook.cio.gov).

3. Be agile. Incorporate Agile methodologies and ceremonies into work, such as (but not limited to) sprint planning, daily scrum, sprint review, sprint retrospective, backlog grooming, and estimating activities.

4. Actively involve users in the design of all solutions. Incorporate best practices for modern user research and usability testing, such as (but not limited to) creating user personas, problem space definitions, affinity maps, user flow diagrams, wireframes, information architecture diagrams, design prototypes, user research plans, conversation guides, and user research synthesis.

5. Maintain a consistent look, feel, and voice across user facing sites and services. Incorporate best practices defined in the VA Design System and VA Content Style Guide (https://design.va.gov/).

6. Personalize solutions for the individual or team using the product.

7. Optimize web…