36C10B23Q0393.docx

Enterprise Security Architecture Support

VA-23-00069469

GENERAL INFORMATION

SET-ASIDE

Technology Acquisition Center

23 Christopher Way Eatontown NJ 07724

POINT OF CONTACT*

Contract Specialist Susan Banasiak susan.banasiak@va.gov

PLACE OF PERFORMANCE

ADDRESS

POSTAL CODE

COUNTRY

ADDITIONAL INFORMATION

AGENCY’S URL

URL DESCRIPTION

AGENCY CONTACT’S EMAIL ADDRESS

EMAIL DESCRIPTION

DESCRIPTION

Request for Information Enterprise Security Architecture Support

VA-23-00069469

1. Introduction

This Request for Information (RFI) is for planning purposes only and shall not be considered an Invitation for Bid, Request for Task Execution Plan, Request for Quotation or a Request for Proposal. Additionally, there is no obligation on the part of the Government to acquire any products or services described in this RFI. Your response to this RFI will be treated only as information for the Government to consider. You will not be entitled to payment for direct or indirect costs that you incur in responding to this RFI. This request does not constitute a solicitation for proposals or the authority to enter into negotiations to award a contract. No funds have been authorized, appropriated or received for this effort. Interested parties are responsible for adequately marking proprietary, restricted or competition sensitive information contained in their response. The Government does not intend to pay for the information submitted in response to this RFI.

This action may be competed under the Transformation Twenty One Total Technology Next Generation multiple award, indefinite delivery, indefinite quantity contract using fair opportunity procedures in accordance with Federal Acquisition Regulation 16.505. One of the main purposes of issuing this RFI is to determine the availability of Small Business Administration (SBA) Veteran Small Business Certification (VetCert) certified Service-Disabled Veteran-Owned Small Businesses (SDVOSBs) and Veteran Owned Small Businesses (VOSBs) that are capable of providing the services identified in the attached Performance Work Statement (PWS) that are not T4NG Contract holders. An SDVOSB/VOSB company that is not listed and certified in the VetCert database (https://veterans.certify.sba.gov/) should not respond to this notice.

The North American Industry Classification System (NAICS) for this requirement is 541512 with a size standard of $34 million.

2. Submittal Information:

All responsible sources may submit a response in accordance with the below information.

There is a page limitation for this RFI of 8 pages. The Government will not review any other information or attachments included, that are in excess of the 8 page limit. NO MARKETING MATERIALS ARE ALLOWED AS PART OF THIS RFI. Generic capability statements will not be accepted or reviewed. Your response must address capabilities specific to the services required in the attached PWS and must include the following:

a. Interested Vendors shall at a minimum, provide the following information in the initial paragraph of the submission:

Name of Company Address Point of Contact Phone Number Fax Number Email address Company Business Size and Status For VOSB and SDVOSBs, proof of verification in VIP.

NAICS code(s) Socioeconomic data Data Universal Numbering System (DUNS) Number Existing Contractual Vehicles (GWAC, FSS, or MAC)

b. Provide a summary of your capability to meet the requirements contained within the draft PWS for the following areas and address the following in your response:

a. Provide a detailed summary of your technical capability and experience with efficiently decomposing business level requirements and delivering security architecture artifacts consumable at the level for new and existing technologies that is scalable as defined in PWS Section 5.3, ESA Security Architectures and Support to VA System Initiatives.

c. Corporate experience or expertise in performing these services and specific examples or references. Specific examples or references provided must include the agency, point of contact, dollar value, and contract number.

d. Your company’s intent and ability to meet the set aside requirement in accordance with VAAR 852.219-73 (JAN 2023) (DEVIATION) VA Notice of Total Set-Aside for Certified SDVOSBs and 13 CFR §125.6, which states the contractor will not pay more than 50 percent of the amount paid by the Government to it to firms that are not certified SDVOSBs listed in VetCert. Your response shall include information as to available personnel and financial resources; full names of proposed team members and the PWS requirements planned to be subcontracted to them, which must include the prime planned percentage or the names of the potential team members that may be used to fulfill the set aside requirement.

e. Has the draft PWS provided sufficient detail to describe the technical requirements that encompass the software development and production operations support services to be performed under this effort.

______ YES _______ NO (if No, answer question f)

f. If “NO”, please provide your technical comments/recommendations on elements of the draft PWS that may contribute to a more accurate proposal submission and efficient, cost effective effort.

Responses are due no later than 1:00 pm EST, July 6, 2023 via email to Susan Banasiak, Contract Specialist at Susan.Banasiak@va.gov and Summer Spalliero, Contracting Officer at Summer.Spalliero@va.gov. Please note “Enterprise Security Architecture Support” in the subject line of your response. Mark your response as “Proprietary Information” if the information is considered business sensitive. The email file size shall not exceed 5 MB.

Sources Sought Notice Sources Sought Notice

Sources Sought Notice

TRANSFORMATION TWENTY-ONE TOTAL TECHNOLOGY NEXT GENERATION (T4NG)

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Office of Information & Technology Office of Information Security

Enterprise Security Architecture Support

Date: June 26, 2023

VA-23-00069469

Task Order PWS Version Number: 1.3

Contents

BACKGROUND

The Department of Veterans Affairs (VA), Office of Information & Technology (OIT), Office of Information Security (OIS) strives to provide high quality, effective, and efficient Information Technology (IT) services to those responsible for providing care to the Veterans at the point-of-care as well as throughout all the points of the Veterans’ health care in an effective, timely and compassionate manner. VA depends on Information Management/Information Technology (IM/IT) systems to meet mission goals.

VA, OIS manages VA’s Enterprise Cybersecurity Strategy Program (ECSP) and is committed to protecting the information of our Veterans, partners, and employees in support of the Department’s mission. Under the ECSP, OIS continues to build upon the goals set forth by the (OIT 2015 Enterprise Cybersecurity Strategy and evolve to combat growing cybersecurity threats, and the rapidly changing IT landscape. The ECSP consists of an updated 2017 version of the Enterprise Cybersecurity Strategy, revisions to VA’s core cybersecurity and risk management policies, the establishment of a centralized policy and implementation guidance repository known as the Knowledge Service, and implementation of the National Institute of Standards and Technology (NIST) Cybersecurity Framework and the Risk Management Framework.

To serve our Veteran, the mission , VA, OI&T, OIS is to ensure Veterans information, VA information systems and infrastructure is cybersecurity ready. The Enterprise Security Architecture (ESA) task order (TO) supports OIS Cybersecurity Strategy and helps accomplish this while ensuring the resiliency of VA’s cybersecurity infrastructure through proactive monitoring, adaptive responses, adherence to Federal requirements and best practices, and the recruitment, retention, and development of a world-class cybersecurity workforce. OIS must continue to evolve its information security program to address existing deficiencies, match the growing and evolving cybersecurity threat landscape, minimize risks from the use of new technologies, address existing deficiencies, and align with Federal cybersecurity strategies and direction. VA Health, Benefits, Memorial, and corporate business functions that provide services that our Veterans depend on for VA’s information systems and data. Protecting these information systems and data is critical to execute VA’s mission. OIS manages, oversees, and directs VA’s Information Security Program and provides expert products and services in Information Security Strategy, Information Security Policy & Compliance, Cybersecurity Architecture, Cybersecurity Technology and Metrics, Cybersecurity Operations Center, Information Security Risk Management, and Cybersecurity Workforce Development.

To protect Veteran’s and VA information, OIS has developed a strategic plan, and is maturing an ESA with artifacts that link the organizational and business levels to lower technical, logical-structure and systems levels that enables the deployment of new and secure technologies with consistency. As part of its strategic direction and in accordance with the Presidential Executive Order on Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure, the VA is looking to strengthen the cybersecurity of its IT infrastructure and solutions to support and enhance the Department’s mission.

The ESA, for the purpose of this document, focuses on information security and privacy throughout the VA enterprise and represents an overarching effort to implement a cohesive security architecture that utilizes national security standards and guidelines, policies, ESA Framework (i.e., representation Cybersecurity Framework), Enterprise Architecture Design Patterns, and industry standards. To ensure mission success, OIS requires Contractor support to define, develop, and implement the various aspects of ESA required to maintain the confidentiality, integrity, and availability of Veteran and VA information. The support provided shall help the VA create, discover, and architect (emphasizing the importance of aligning enterprise architecture requirements to the reference security architecture), document, and assess cybersecurity solutions that will ensure Veteran and VA information is not subjected to unacceptable risk when new technologies and solutions are employed. The expertise needed to satisfy this requirement will span a broad range of technologies, technical challenges, and user experience to include mobile and medical devices, cloud ecosystem, internet of things (IOT), software defined networks, enterprise architecture; application testing and deployment, assessments, defining business processes, and systems design.

APPLICABLE DOCUMENTS

The Contractor shall comply with the following documents, in addition to the documents in Paragraph 2.0 in the T4NG Basic Performance Work Statement (PWS), in the performance of this effort:

1. Cloud Security Architecture Security Patterns (Attachment A)

2. Cloud Security Architecture Strategy (Attachment B)

3. Cloud Security Architecture and Privacy Requirements Framework (Attachment C)

4. VA Affairs Office of Inspector General Audit and Evaluation (Attachment D)

5. VA Veteran-Focused Integration Process Guide 3.2 (Attachment E)

6. National Institute of Standards and Technology (NIST) Special Publication 800-207 Zero Trust Architecture (Attachment F)

7. VA ESA Framework v1 (Attachment G)

8. Executive Order 14028: Improving the Nation's Cybersecurity | GSA

SCOPE OF WORK

The Contractor shall provide technical and programmatic support services to include the development, maintenance of the ESA artifacts, administrative engineering support, and the facilitation of the enterprise-wide use of the VA ESA. The VA ESA shall support an integrated VA-wide risk management program in accordance with NIST SP 800-39, Managing Information Security Risk, Organization (High Level), Mission (Business), and the Information System View (System views may include but would not be limited to logical, data, and tactical). The VA ESA shall be comprehensive and consist of artifacts that support the VA risk management process at the: (i) organization level (VA-level); (ii) mission/business process level (VHA, VBA, NCA, and VACO); and (iii) information system level.

The VA ESA has an approved VA ESA Strategy and shall adhere to the strategy to address the evolving threat landscape, support VA Business and IT Modernization initiatives, and take advantage of new and emerging security approaches and technologies. The Contractor shall provide multi-domain support to address VA’s scope, size and complexity, which includes but is not limited to enterprise architecture, emerging technologies, networks, mobile, specialized domain areas (healthcare, medical devices, cybersecurity, IT Modernization, large-scale architecture, risk management, etc.). The Contractor shall have the specialized technical and cybersecurity expertise needed to advance the new technologies that VA introduces such as: the merging of Electronic Health Records (EHR), cloud computing, Application Programming Interfaces (APIs), specialized networks (i.e., software and security perimeter and defined networks), IoT, analytic ecosystems, 5G, medical devices and extended reality/virtual reality (XR/VR).

1.1 APPLICABILITY

This TO effort PWS is within the scope of paragraph(s) 4.1.1 Strategy and Planning, 4.1.2 Standards, Policy, Procedure and Process Development, and Implementation Support, 4.1.3 Requirements Development and Analysis Support, 4.1.4 Technology Refresh and Configuration Reviews, 4.1.5 Studies and Analyses, 4.2.2 Architecture Development, 4.7 Enterprise Management Framework, 4.8.4 Security Management, 4.9 Cyber Security, 4.9.1 Information Assurance, and 4.9.2 Logical Security of the T4NG Basic PWS.

1.2 ORDER TYPE

The effort shall be proposed on a Firm Fixed Price (FFP) basis.

PERFORMANCE DETAILS

1.3 PERFORMANCE PERIOD

The PoP shall be 12 months from the date of award, with three 12-month option periods and two Optional Tasks. The overall Period of Performance shall not exceed 49 months.

1.4 PLACE OF PERFORMANCE

Efforts under this TO shall be performed at Contractor facilities. The Contractor shall identify the Contractor’s place of performance in their Task Execution Plan submission. The Contractor staff shall be available to coordinate with VA staff on normal Federal Government workdays and shall be responsive between the core hours of 8:00am and 5:00pm Eastern Time.

1.5 TRAVEL OR SPECIAL REQUIREMENTS

The Government anticipates travel to perform the tasks associated with the effort, as well as to attend program-related meetings or conferences throughout the PoP. Include all estimated travel costs in your firm-fixed price line items. These costs will not be directly reimbursed by the Government.

The total estimated number of trips in support of the program related meetings for this effort is three in the base period and three in each option period of performance. After TO award, a two-day trip is anticipated for program management (Section 5.1) familiarization, coordination, and facilitation purposes to Washington, DC. Trips are projected to be four days in duration to Martinsburg, WV and Austin, TX. However, additional travel to other VA Facilities may be warranted depending on the initiative. Local travel within a 50-mile radius from the Contractor’s normal duty location is considered the cost of doing business and will not be reimbursed.

1.6 CONTRACT MANAGEMENT

All requirements of Sections 7.0 and 8.0 of the T4NG Basic PWS apply to this effort. This TO shall be addressed in the Contractor’s Progress, Status and Management Report as set forth in the T4NG Basic contract.

1.7 GOVERNMENT FURNISHED PROPERTY

The Government has multiple remote access solutions available to include Citrix Access Gateway (CAG), Site-to-Site Virtual Private Network (VPN), and RESCUE VPN.

The Government’s issuance of Government Furnished Equipment (GFE) is limited to Contractor personnel requiring direct access to the network to:

access development environments and VA data sources and repositories; install, configure, and run TRM-approved software and tools (e.g., Project Server, PowerBI Visio, Security Architect, Vovici, Fortify, Eclipse, SoapUI, WebLogic, LoadRunner, etc.); upload/download/ manipulate code, run scripts, apply patches, etc.; configure and change system settings; check logs, troubleshoot/debug, and test/QA.

When necessary, the Government will furnish laptops, for use by the Contractor to access VA networks, systems, or applications to meet the requirements of this PWS. The overarching goal is to determine the most cost-effective approach to providing needed access to the VA environment coupled with the need to ensure proper Change Management principles are followed. Contractor personnel shall adhere to all VA system access requirements for remote users in accordance with VA standards, local security regulations, policies and rules of behavior. GFE shall be approved by the COR and Program Manager (PM) on a case-by-case basis prior to issuance.

Based upon the Government assessment of remote access solutions and requirements of this TO, the Government estimates that the following GFE will be required by this TO:

1. 30 laptops

The Government will not provide IT accessories including but not limited to Mobile Wi-Fi hotspots/wireless access points, additional or specialized keyboards or mice, laptop bags, extra charging cables, extra Personal Identity Verification card readers, peripheral devices, or additional Random Access Memory (RAM). The Contractor is responsible for providing these types of IT accessories in support of the TO as necessary and any VA installation required for these IT accessories shall be coordinated with the COR.

The Status of Government Furnished Equipment Report under the T4NG Basic Contract requirements is applicable to this TO and shall be delivered to the COR/ESA PM as required.

1.8 SECURITY AND PRIVACY

All requirements in Section 6.0 of the T4NG Basic PWS apply to this effort. Specific TO requirements relating to Addendum B, Section B4.0 paragraphs j and k supersede the corresponding T4NG Basic PWS paragraphs, and are as follows:

j. The vendor shall notify VA within 24 hours of the discovery or disclosure of successful exploits of the vulnerability which can compromise the security of the Systems (including the confidentiality or integrity of its data and operations, or the availability of the system). Such issues shall be remediated as quickly as is practical, based upon the severity of the incident.

k. When the Security Fixes involve installing third party patches (such as Microsoft OS patches or Adobe Acrobat), the vendor will provide written notice to VA that the patch has been validated as not affecting the Systems within 10 working days. When the vendor is responsible for operations or maintenance of the Systems, they shall apply the Security Fixes based upon the requirements identified within the TO.

1.8.1 POSITION/TASK RISK DESIGNATION LEVEL(S)

In accordance with VA Handbook 0710, Personnel Security and Suitability Program, the position sensitivity and the level of background investigation commensurate with the required level of access for the following tasks within the PWS are:

Position Sensitivity and Background Investigation Requirements by Task

The Tasks identified above, and the resulting Position Sensitivity and Background Investigation requirements identify, in effect, the Background Investigation requirements for Contractor individuals, based upon the tasks that individual will be working. The submitted Contractor Staff Roster must indicate the required Background Investigation Level for each Contractor individual based upon the tasks the Contractor individual will be working, in accordance with their submitted proposal.

SPECIFIC TASKS AND DELIVERABLES

The Contractor shall perform the following tasks in the Base Period and PWS Paragraphs 5.1-5.5, including all subparagraphs (except 5.1.4) in each Option Period, if exercised:

1.9 PROJECT MANAGEMENT

The Contractor shall ensure management of IT projects both large and small and shall be able to manage a portfolio of diverse projects. The Contractor shall provide support in the full range of systems’ development life cycle phases, enterprise-wide network engineering, strategic information planning, business process reengineering, structure, and management practices. The Contractor shall identify and mitigate risks to the program and assist in the management of cost, schedule, and performance.

The Contractor shall assist VA in managing projects (of all sizes) through intake, initiation, planning, managing, and monitoring, execution and closing while assisting VA in managing the constraints of cost, time, resources, scope, and quality with administrative, project management, graphic artist, and engineering expertise.

Additionally, the Contractor shall utilize and support the Program Management Office’s Agile methodology for initiating, managing, and deploying projects and assist in the creation of project charters to assist project sponsors in business case creation, including scoping, and financial justification. These items as a minimum shall be captured in the Contractor Project Management Plan that provides insights to how the Contractor plans to structure for work products, manage constraints, and reporting aspects needed to accomplish the various ESA Support contract requirements. (See deliverable in Section 5.1.2).

1.9.1 KEY PERSONNEL

The Contractor shall provide resources that have the requisite skills and experience required to perform the tasks within the PWS.

It is the responsibility of the Contractor to provide Contractor support personnel and subcontractors who have the required educational background, experience, security clearance, and access authorization or thereof to meet the labor category descriptions under this TO for the required PWS tasks.

If any change to the Key Personnel assigned to the labor categories identified below becomes necessary (substitutions or additions), the Contractor shall immediately notify the COR in writing, accompanied by the resume, if applicable, of the proposed replacement personnel who shall be of at least substantially equal ability and qualifications as the individuals currently performing in that category and that the proposed replacement meets or exceeds the qualifications designated for that Key Personnel position. It is expected that substitution or replacement of the personnel will not occur within the first year (twelve months) after date of contract award.

The Contractor shall mitigate the consequences of the loss of Key Personnel and shall promptly secure any necessary replacements in accordance with (IAW) the PWS section. Failure to replace a Key Personnel pursuant to this paragraph and without a break in performance of the labor category at issue shall be considered a condition endangering contract performance and may provide grounds for default termination.

If at any time the assigned key personnel is unavailable, the Contractor shall notify the VA in writing and provide an alternate point of contact no later than 48 hours from first notice of unavailability.

The labor categories below have been identified as Key Personnel by the Government. However, the Contractor may make modifications or put forward different labor categories than the proposed labor categories. The requirements and stated functions of ESA Support may be achieved by leveraging the following labor categories:

A. IT PM

B. ESA Leads/Chief Architect C. Senior Enterprise Security Analyst D. Functional Area Expert II E. Project Analyst F. Cybersecurity Analyst Expert

IT PROGRAM MANAGER

The Contractor shall provide an IT PM that has the requisite skills as detailed below:

· Master’s Degree in Engineering, Computer Science, Math or related scientific /technical discipline.

· 10 years of additional relevant experience may be substituted for education

· 15+ years of both large and small IT Project Management experience preferably supporting government agencies

· Must be able to manage a portfolio of projects.

· Must be well versed in full systems development life cycle, enterprise-wide network engineering, strategic information planning, business process reengineering, structure, and management practices.

· Must be able to identify and mitigate risks.

· Must be able to track and manage costs, schedule, and performance progress.

· 5+ years of experience as a PM for security projects

· 3+ years of experience in Agile development specifically Lean and/or Kanban

· PMP Certification including all continuing education credits is desired

ESA LEADS/CHIEF ARCHITECT

The Contractor shall provide a subject matter expert (SME) in the ESA Lead role who serves as the Chief Architect overseeing the technical areas lead by other ESA Leads. This SME works to ensure that deliverables not only maintain technical merits but also have high fidelity to stated VA strategies, goals, and objectives. The Chief Architect ensures that deliverables address Customer specific needs, and provides the overall technical strategy for guidance, policy and implementation that supports ESA Program Management Office (PMO) mission needs. The Chief Architect acts as the technical lead for ESA projects. They guide the execution of specific tasks and the development of deliverables in accordance with the PWS. They contribute to both scheduled and unscheduled deliverables. They may function as the primary or contributing author of deliverables. They shall participate in peer reviews of VA ESA to ensure technical adequacy and alignment to Customer strategic and mission advancement.

The Contractor shall Provide an ESA Lead that has the requisite skills as detailed below:

· Extensive experience in design and development of IT architecture. Experience must include a wide range of work in creating diagrams and documentation with all components that comprise IT systems including network topology.

· Master’s Degree in Computer Science, Engineering, Math, or technical equivalent (e.g., Information Technology, Information Systems Architecture, Telecommunications Systems Design, Architecture, Implementation, Information Systems Integration, Software Development Methodologies, Security Engineering, Communications and Network Systems Management)

· 10 years of relevant experience (additional experience may be substituted for education if IT security related)

· Must have a minimum of 10 years of enterprise architecture experience (a minimum of 15 years desired)

· Ability to support legacy and new health IT digital architectures including cloud, mobile, IoT, APIs, and AI technologies.

· Ability to perform analysis and research of complex problems and processes relating to the subject matter

SENIOR ENTERPRISE SECURITY ANALYST

The Contractor shall provide Senior Enterprise Security Analysts that have the requisite skills as detailed below:

· Master’s Degree in Engineering or related scientific or technical discipline (e.g., Information Technology, Information Systems Architecture, Telecommunications Systems Design, Architecture, Implementation, Information Systems Integration, Software Development Methodologies, Security Engineering, Communications and Network Systems Management)

· Has thorough knowledge of security principles, concepts, policy, and regulations.

· Ability to identify risks in security systems and work with technical experts to resolve security issues.

· Ability to identify key concepts, factors and risks based on conversations and document these in clear and concise narrative or graphic reports.

· Minimum 10 years of IT Security experience

· Minimum of 5 years of enterprise architecture experience may be substituted for education

· Experience with legacy and new health IT digital architectures including cloud, mobile, IoT, APIs, and AI technologies.

FUNCTIONAL AREA EXPERT II

The Contractor shall provide a Functional Area Expert II that has the requisite skills as detailed below:

· Engineering Degree or related scientific or technical discipline (e.g., Information Technology, Information Systems Architecture, Telecommunications Systems Design, Architecture, Implementation, Information Systems Integration, Software Development Methodologies, Security Engineering, Communications and Network Systems Management)

· Minimum 10 years of experience

· Minimum of 8 years of additional relevant experience may be substituted for education

· Ability to support legacy and new health IT digital architectures including cloud, mobile, IoT, APIs, and AI technologies.

· Ability to analysis and research of complex problems, and processes relating to the subject matter

PROJECT ANALYST

The position shall provide administrative support to the ESA Director and Deputy. This resource is needed to enable the successful facilitation of the ESA PMO. The Contractor shall support responses to inquiries, consolidating status, capturing minutes of technical forums, posting information, build templates and ensure consistent use, and data entry. The Project Analyst shall have the requisite skills as detailed below:

· Bachelor’s Degree in Business or IT Discipline.

· 8 years of additional relevant experience may be substituted for education

· Minimum 5 years of experience in IT discipline

· Must be proficient with graphic and office automation tools and to produce documents without errors. Specifically, expertise in using Microsoft Suite Tools (MS Project, Excel, Word, SharePoint, MS Teams, and PowerPoint).

· Must have experience and knowledge in proofreading and editing documents that are highly technical in nature which was created by others to ensure proper format, grammar, and style.

· Strong communication skills (mastery of English language written and verbal)

· Provide documentation support (notetaking, capturing minutes, posting to SharePoint site)

· Perform as a communications officer (collaborating with ESA team members and other communications officers to respond to action items in action tracking tool)

· Must be able to plan, maintain and manage schedules for ESA Director and Deputy.

· Create templates for quarterly reporting for ESA

· Be able to construct memos or other correspondence.

CYBERSECURITY ANALYST, EXPERT

The Cyber Security Analyst, Expert has extensive IT experience with Cyber Security Policy and threat mitigation. Must be well versed in Cyber Security Tools, network topologies, intrusion detection, Public Key Infrastructure and secured networks. The Cyber Security Analyst, Expert must possess a high level of expertise in developing long term strategies and be knowledgeable about various cyber threats and their mitigation. The cybersecurity analyst shall have the requisite skills as detailed below:

· At least a Master’s Degree in Computer Science, electronics engineering or other engineering or technical discipline (such as Information Technology, Information Systems Architecture, Telecommunications Systems Design, Architecture, Implementation, Information Systems Integration, Software Development Methodologies, Security Engineering, Communications and Network Systems Management) is required

· Minimum 15 years of experience

· Minimum of 12 years of additional relevant experience may be substituted for education

1.9.2 CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, timeline, and tools to be used in execution of this TO effort. The CPMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks, and resource support. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPMP shall be concurred upon and updated in accordance with Section B and presented during the Contractor Kick-Off meeting. Any discrepancies or items that require clarification must be discussed during that time. The Contractor shall update and maintain the ESA PM approved CPMP throughout the PoP.

Deliverable:

A. Contractor Project Management Plan

1.9.3 REPORTING REQUIREMENTS

The Reporting Requirements section identifies various work products and deliverables to be provided by, or coordinated with, the Contract PM to meet contract requirements and ensure the Customer has insights needed to support effective contract management. The Contractor shall provide a Weekly Activity Report (WAR) to the COR and/or PM. The WAR shall include all work completed during the preceding reporting period/week and shall present the work to be accomplished during the subsequent period(s)/week(s) for each task/requirement in Section 5.0. The Contractor shall consolidate and facilitate the briefing of project status weekly and archive the presentations. The status reporting in the WAR shall highlight performance of activities and accomplishments towards the various requirements addressed within this contract and relevant actions items, inquiries, and technical exchanges/consultations. Contractor members shall attend weekly teleconference meetings with the Government PM or represent the PM, as required. Contractors shall discuss and document risk mitigation considerations and any issues with pending deliverables and other pertinent topics concerning the task areas in weekly, monthly, Program Management Reviews (PMR) and planning documents/reports. Each report shall include the work schedule by name for each person assigned to this contract (e.g.: John Doe is working requirement 5.x). Each report shall identify resolved and unresolved issues with and an explanation for each issue. There is the expectation that changes to contractor alignments to requirements will be in coordination with the Government in advance of the change to add or remove resources.

Additionally, the Contractor shall capture Lessons Learned along with any Best Practices that have not been implemented and present them for inclusion in the annual coordination of ESA Implementation Plans for 5.0 requirements. The Contractor shall support collaboration with Government Technical Leads to update the annual ESA Implementation Plans. The Government requires the contractor products to be 508 compliant to the greatest extent possible and that reports will not have bias or perception of conflict of interest. The Contractor shall document and post minutes of ESA technical meeting forums to afford a consistent approach and timely facilitation of ESA work. The Contractor shall support Weekly Posting of ESA Technical Forum Data (status, metrics, minutes, document versions, architecture artifacts, deliverables, etc.) this information weekly to the ESA SharePoint site and via email. The Contractor shall provide a summary Monthly Manpower Report of an execution period of performance. The Contractor shall account for GFE in a Monthly GFE Inventory Report. The report should include, minimally, information on GFE requested, in their inventory, projections of need, issue encountered with GFE, and items recovered upon the loss of a resource on this contract. The Contractor shall provide the Government with a Contractor’s Quality Assurance Plan that explains their process to ensure products received meet the customer’s expectation of proper English, scope match (appropriate level of depth and content) and reading cohesion (no cut and paste disjoint sections), graphics are conflict free, the appropriate template(s) are used, etc.

Frequently, the Government is required to provide status of high visibility requirements, high risk efforts, and overall, ESA program status at PMR, town halls, and quarterly data call requests. The Contractor shall support preparation and delivery of PMR Status which could take the form of a briefing or presentation and could be monthly to quarterly depending on the profile of requirements within 5.0 and the other data calls mentioned. The Contractor shall coordinate with the ESA Director to facilitate these status formats. The Government is also concerned about the flow of requirements and communications to and between Contractor and subcontractor team members. The Contractor shall provide a Communication Plan that articulates how the prime will convey, share, and ensure accurate and timely information exchanges between the prime and its subcontractors as well as with other ESA Support contractors and/or Federally Funded Research and Development Center (FFRDC) contractors. These are some of the products that will help the Government have the insights and the appropriate level of oversight for the successful management of the contract.

Deliverables:

A. WAR and Monthly Status B. PMR Status C. Monthly Manpower Reports D. Monthly GFE Inventory Report E. Contractor’s Quality Assurance Plan F. Communication Plan

1.9.4 TECHNICAL KICKOFF MEETING

A technical kickoff meeting shall be held within 10 days after TO award. The Contractor shall coordinate the date, time, and location (can be virtual) with the CO, as the Post-Award Conference Chairperson, the ESA PM, as the Co-Chairperson, the Contract Specialist (CS), and the COR. The Contractor shall provide a draft agenda to the Contracting Officer and ESA PM at least five calendar days prior to the meeting. Upon Government approval of a final agenda, the Contractor shall distribute to all meeting attendees. During the kick-off meeting, the Contractor shall present, for review and approval by the Government, the details of the intended approach, work plan, and project schedule for each effort via a Microsoft Office PowerPoint. At the conclusion of the meeting, the Contractor shall update the presentation with a final slide entitled “Summary Report” which shall include notes on any major issues, agreements, or disagreements discussed during the kickoff meeting and the following statement, “As the Post-Award Conference Chairperson, I have reviewed the entirety of this presentation and assert that it is an accurate representation and summary of the discussions held during the Technical Kickoff Meeting for the “ESA Support.” The Contractor shall submit the final updated presentation to the CO for review and signature within three (3) calendar days after the meeting. The Contractor shall also work with the CS, the Government’s designated note taker, to prepare and distribute the meeting minutes of the kickoff meeting to the CO, COR, and all attendees within three calendar days after the meeting. The Contractor shall request concurrence from the CO/COR on the content of the meeting minutes prior to distribution of the document.

1.9.5 VA MANDATORY TRAINING

The Contractor and ESA PM shall determine which team members require access to the VA network and Rational/GitHub. All Contractors that require access shall complete all the required VA Talent Management System (TMS) training courses within 14 days of the identification of the access need. The Contractor shall work with its respective point of contact, to obtain access to TMS to complete the mandatory training courses.

As an action under the Continuous Readiness in Information Security Program, VA's Assistant Secretary for Information and Technology issued a memorandum requiring all VA government and contract staff to complete information security awareness and applicable role-based training. The Contractor shall submit TMS Training Certificates of completion for VA Privacy and Information Security Awareness, Rules of Behavior, Health Insurance Portability and Accountability Act, and Role-Based trainings. The Contractor shall provide signed copies of the Contractor Rules of Behavior in accordance with Section 9, Training, from Appendix C of the VA Handbook 6500.6, “Contract Security”.

Contractors who have completed these VA training courses within the past 12 or 24 months, depending on the training requirements, and have furnished training certificates to VA, will not be required to re-take the training courses.

Deliverables:

A. TMS Training Certificates B. Signed Contractor Rules of Behavior

1.9.6 ONBOARDING

The Contractor shall manage the onboarding of its staff. Onboarding includes steps to obtain a VA PIV card, network and email account, complete training, initiate background investigations, and gain physical and logical access. In addition, the Contractor shall identify individuals which may require elevated privileges to the necessary development and test environments for the various systems to be enhanced. After review between the Contractor and VA COR, a decision will be made as to the necessity of obtaining GFE for the onboarding staff. If approved, Contractor shall follow the appropriate steps to obtain the equipment.

A single Contractor Onboarding point of contact (POC) shall be designated by the Contractor that tracks the onboarding status of all Contractor personnel. The Contractor Onboarding POC shall be responsible for accurate and timely submission of all required VA onboarding paperwork to the VA COR. The Contractor shall be responsible for tracking the status of all its staff’s onboarding activities to include the names of all personnel engaged on the task, their initial training date for VA Privacy and Information Security training, and their next required training date. The Contractor Onboarding POC shall also report the status at the staff level during onboarding status meetings. The Contractor shall provide an Onboarding Status Report weekly for any staff with outstanding onboarding requests for review by the COR, ESA PM and PM.

Deliverable:

A. Weekly Onboarding Status Report

1.10 ESA GOVERNANCE, PROCESS, ORGANIZATION, AND INTEGRATION

The Contractor shall support the development of the ESA Concept of Operations (ConOps) artifact. The ConOps provides the governing vision, drivers, services, and products of ESA. The ConOps details the role of ESA, its functions, its mission, strategic goals, objectives, structure, and products and/or services. It also serves to establish and influence a procedural integration baseline for implementing ESA services and products across the Department. In support of this artifact, the Contractor shall support, facilitate, and participate with governance impactful boards as determined by the Government. The Contractor shall assess current and new processes to identify integration points at the business and lower (technical information) system level. The Contractor shall review, compare, check for consistency, alignment, etc. and advise their Government counterpart on suggested improvements as well as offer drafted recommendations. As VA/OIT transitions to an Agile construct, ESA will need to define how stakeholders can engage and leverage ESA services more effectively. The Contractor shall work with ESA leadership to develop the ESA Organizational Playbook which provides ESA structures, workflows, engagements, services, activities, and guidance needed to enhance the VA’s IT security posture.

The ESA Organizational Playbook will encompass how ESA performs its work products, the methodology and prescribed operating procedures. It will include the eight main elements that have been identified to solve for in organizational design (Within the structure, solve for 1. organizing principles, 2. framing, 3. overall size and team size, 4. layers and span of control, and 5. reporting structure. For roles and competencies, solve for the three levels of 6. team, 7. individual, and 8. cross functional.) The workflows and diagrams in the Playbook will depict interactions with stakeholders (boards, processes, organizations, higher level directives, etc.), how progress is measured and how success is defined. This should be accomplished by leveraging the various design patterns, frameworks, and threat models to determine where efficiencies through consolidation around consistent approaches/standards to address cybersecurity risks, effective templates (understanding that there may be a need for some portions that can be nuanced for unique aspects) for ESA security enabling products. The Contractor shall identify, analyze, facilitate, and incorporate mappings to cybersecurity processes, policies, and standards to create architecture reference models, architecture flows and diagrams fully using the selected VA Security Architecture tool.

The Contractor shall leverage the current ESA Threat Model Methodology (TMM) Template and Threat Analysis Process when determining investment, capability, and security risks for new and existing IT, OT, and Healthcare services to improve guidance for acquiring and designing products securely. The current Mobile Architecture Threat Model and Network Security Architecture Threat Model are to be leveraged as a reference in crafting a template that ESA and others can utilize as a best practice and standard. Once these artifacts become current and actionable, support will be scaled back for steady state. The Contractor shall ensure the ESA Framework (ESAF) is updated to remain consistent with and supports the NIST Cybersecurity Framework. As cybersecurity considerations are incorporated, that are to be tied back to the ESA and Cybersecurity Frameworks, the Contractor shall ensure there is a feedback loop created using the results from the risk assessment and Enterprise Security Risk Assessment Model to improve the standards and requirements.

The Contractor shall also collaborate on the planning for maturing and implementing appropriate risk mitigation activities in an annual ESA Implementation Plan. The Implementation plan includes the priorities, activities, and schedules for the upcoming Period of Performance. The Government Technical Lead is responsible for the development and management of the ESA Implementation Plan. The Contractor shall work collaboratively with the Government lead(s), providing recommendations in the development of the VA ESA Strategic Plan.

Deliverables:

A. ESA ConOps B. ESA Organization Playbook C. ESA TMM Template and Threat Assessment Process

D. ESAF

1.11 ESA SECURITY ARCHITECTURES AND SUPPORT TO VA SYSTEM INITIATIVES

The Contractor shall provide specialized cybersecurity knowledge and expertise to identify threats and manage risks for the adoption of new technologies including but not limited to the integration of ZTA principles, IT Modernization and Digital Transformation, Healthcare Services and Operational Technologies, and IoT (i.e.: medical devices, Research, and Telehealth). The Contractor shall provide specialized knowledge and expertise for Enterprise and Security Architecture in accordance with the NIST, Committee on National Security Systems (CNSS), and Federal Risk and Authorization Management Program publications and requirements. The Contractor shall take into consideration, where applicable, the Cybersecurity Framework and OIG findings when proposing changes to and for determining ESA Policies, Standards, Requirements, Reference Architecture, Security Patterns and Implementing Guidelines to represent a comprehensive ESA that aligns and integrates with VA Office Information Security Enterprise Cybersecurity Strategy, Enterprise Architecture (EA) and EA Design Patterns, and ESA Strategy and Charter. The Contractor shall provide specialized cybersecurity knowledge to incorporate new security architecture concepts to adequately address the changing security risk landscape including, but not restricted to, Trusted Internet Connections (TIC) 3.0, Mobile, Virtual Reality and Cyber Operations in the cybersecurity domain.

The Contractor shall ensure the ESAF is consistent with, and supports, the NIST Cybersecurity Framework. As cybersecurity considerations are incorporated, they are to be tied back to the ESA and Cybersecurity Frameworks.