T4NG PWS VBECS draft.pdf

TRANSFORMATION TWENTY-ONE TOTAL TECHNOLOGY

NEXT GENERATION (T4NG)

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Office of Information & Technology Software Product Management (SPM)

VistA - Blood Establishment Computer Software (VBECS) - DevOps Support

Date: December 4, 2023

VA-24-00008574

Task Order PWS Version Number: 2.0

VistA - Blood Establishment Computer Software (VBECS) – DevOps Support

Contents

1.0 BACKGROUND

2.0 APPLICABLE DOCUMENTS

3.0 SCOPE OF WORK

3.1 APPLICABILITY

3.2 ORDER TYPE

4.0 PERFORMANCE DETAILS

4.1 PERFORMANCE PERIOD

4.2 PLACE OF PERFORMANCE

4.3 TRAVEL OR SPECIAL REQUIREMENTS

4.4 CONTRACT MANAGEMENT

4.5 GOVERNMENT FURNISHED PROPERTY

4.6 SECURITY AND PRIVACY

4.6.1 POSITION/TASK RISK DESIGNATION LEVEL(S)

4.7 CONTRACT PERSONNEL

5.0 SPECIFIC TASKS AND DELIVERABLES

5.1 PROJECT MANAGEMENT

5.1.1 CONTRACTOR PROJECT MANAGEMENT PLAN

5.1.2 MONTHLY REPORTING REQUIREMENTS

5.1.3 TECHNICAL KICKOFF MEETING

5.1.4 VA MANDATORY TRAINING

5.1.5 FDA TRAINING

5.1.6 ONBOARDING / OFFBOARDING PROCESSING

5.2 AGILE SOFTWARE ENHANCMENT AND SUSTAINMENT SUPPORT

5.2.1 STANDARDS AND TECHNICAL GUIDELINES

5.2.2 JIRA/AZURE DEVOPS

5.2.3 PRODUCT BACKLOG SUPPORT

5.2.4 TIER 3 DEFECT ANALYSIS AND REMEDIATION

5.2.5 VBECS ENHANCEMENT SUPPORT

5.2.6 VBECS SOFTWARE RELEASE SUPPORT

5.2.7 SOFTWARE CODE AND DATABASE STRUCTURE SUPPORT

5.2.8 DEVELOPMENT CYCLES SUPPORT

5.2.9 VBECS NETWORK CONFIGURATION SUPPORT

5.2.10 SOFTWARE MAINTENANCE TESTING

5.3 QUALITY SYSTEM DOCUMENT SUPPORT FOR VBECS

5.3.1 SYSTEM DOCUMENTATION SUPPORT

5.3.2 CHANGE MANAGEMENT SYSTEM SUPPORT

5.3.3 CONFIGURE MANAGEMENT SUPPORT

5.3.4 CHANGE MANAGEMENT COMMITTEE SUPPORT

5.3.5 VBECS TEST DOCUMENTATION SUPPORT

5.3.6 UNIT TESTING SUPPORT

5.4 USER ACCEPTANCE TESTING (UAT) AND INITIAL OPERATING

CAPABILITY (IOC) PHASE

5.4.1 DEVELOPMENT/FUNCTIONAL TESTING

5.4.2 IOC TESTING

5.4.3 IOC DOCUMENTATION SUPPORT

5.4.4 IOC ENTRY EFFORTS

5.4.5 IOC SUCCESSFUL TEST CYCLE COMPLETION

5.4.6 IOC DEFECTS AND ISSUES SUPPORT

5.4.7 REGRESSION TESTING SUPPORT

5.5 FDA MEDICAL DEVICE CERTIFICATION

5.5.1 VBECS COMPLIANCE DOUMENTATION

5.5.2 CORRECTIVE AND PREVENTIVE ACTION (CAPA) SUPPORT

5.5.3 QUALITY SYSTEM AUDIT SUPPORT

5.5.4 FDA 510(k) SUBMISSION DOCUMENTS

5.6 OPTIONAL TASK

5.6.1 TRANSITION SUPPORT (OPTIONAL TASK 1)

5.7 OPTION PERIOD ONE

5.8 OPTION PERIOD TWO

6.0 GENERAL REQUIREMENTS

6.1 PERFORMANCE METRICS

6.2 SECTION 508 – INFORMATION AND COMMUNICATION TECHNOLOGY

(ICT) STANDARDS

6.2.1 COMPATIBILITY WITH ASSISTIVE TECHNOLOGY

6.2.2 ACCEPTANCE AND ACCEPTANCE TESTING

6.3 ENTERPRISE AND IT FRAMEWORK

6.3.1 FEDERAL IDENTITY, CREDENTIAL, AND ACCESS MANAGEMENT

(FICAM)

6.4 INFORMATION TECHNOLOGY USING ENERGY-EFFICIENT PRODUCTS . 44

6.4.1 EPEAT

6.4.2 ENERGY STAR

6.4.3 FEMP

ADDENDUM B- VA INFORMATION AND INFORMATION SYSTEM SECURITY /

PRIVACY LANGUAGE

1.0 BACKGROUND

The Department of Veterans Affairs (VA), Office of Information & Technology (OIT), Software Product Management (SPM) strives to provide high quality, effective, and efficient Information Technology (IT) services to those responsible for providing care to the Veterans at the point-of-care as well as throughout all the points of the Veterans’ health care in an effective, timely and compassionate manner. VA depends on Information Management/Information Technology (IM/IT) systems to meet mission goals.

The purpose is to provide continuous Development and operations (DevOps) support that includes agile software development, and sustainment services in the Veterans Health Information Systems and Technology Architecture (VistA), VistA Blood Establishment Computer Software (VBECS), including support to previous, current, and future versions of, and interface support to maintain communications with other VistA or vendor applications such as Data Innovations for automated instrument interfacing.

Agile software development, and sustainment services ensure these applications continue to provide effective support to clinicians in delivering patient care, laboratory staff in providing safe blood transfusions, meeting blood bank regulatory agency requirements, and required hospital reporting services.

VBECS facilitates ongoing compliance with the Food and Drug Administration (FDA) standards for medical devices, enhances VA’s ability to produce high-quality blood products and services to Veterans, and meets the needs of the user community. The system follows blood bank standards, standards of national accrediting agencies, FDA regulations, and VA policies. VBECS software has been classified by the FDA as a Class II medical device. Because of that, the FDA requires that its Good Manufacturing Practice regulations be followed.

The objective of this acquisition is to provide agile software development and sustainment services for the VBECS product. VBECS is a VA-developed, Class II Medical Device that is FDA 510(k) certified to meet the needs of blood banking services to Veterans. VBECS provides VA sites with application and database servers to perform automated blood banking duties, thus eliminating human error.

The major goals of the VBECS product are:

1. Blood transfusion services that electronically perform: Cross and Type, utilize Blood Truth Tables, Coombs testing, Antibody Serology Tests, Immediate Spin Crossmatch, patient transfusion processing and blood inventory management.

2. Supply VA healthcare providers with the blood and/or blood components required based on patient history and interactions with blood products.

3. Improve the safety of blood/blood component transfusions by decreasing the risk of errors through effective use of current technology such as barcode scanning, retrieval of previous records used for comparison, and detection of inconsistencies in data input.

4. Improve the quality of patient care through evaluation of transfusion appropriateness and follow-up on the effectiveness of transfusions.

5. Provide comprehensive reporting capabilities for quality monitoring within the VBECS transfusion service and for clinicians.

Interface expertise is required to maintain communications with VistA and vendor applications such as Data Innovations for automated instruments. Maintenance and support, ensures these applications continue to provide effective support to clinicians in delivering patient care, laboratory staff in providing safe blood transfusions, meeting blood bank Food and Drug Administration (FDA), International Council for Commonality in Blood Bank Automation (ICCBBA), and American Association of Blook Banks (AABB) regulatory agencies regulations, standards, requirements, and required hospital reporting services.

2.0 APPLICABLE DOCUMENTS

The Contractor shall comply with the following documents, in addition to the documents in Paragraph 2.0 in the T4NG Basic Performance Work Statement (PWS), in the performance of this effort:

a. FDA Blood Guidance: Blood Guidances | FDA

b. FDA Title 21 Code of Federal Regulation (CFR), Part 11, Electronic Records;

Electronic Signature

c. FDA Title 21 CFR, Part 803, Medical Device Reporting

d. FDA Title 21 CFR, Part 806, Medical Devices; Reports of Corrections and

Removals

e. FDA Title 21 CFR, Part 820, Quality System Regulation

f. FDA Title 21 CFR, Part 821, Medical Device Tracking Requirements

g. VA Directive 6066, “Protected Health Information (PHI) And Business Associate

Agreements Management”, September 2, 2014, Contractor shall follow FDA Title 21 CFR Part 11, Part 803, Part 806, Part 820, and Part 821 regulations, VA PAL, and internal project procedures which follows the FDA Title 21 CFR regulations addressed in Paragraph 2.0 Applicable Documents.

h. ICCBBA - Version 6.2.2: ST-001 ISBT 128 STANDARD TECHNICAL SPECIFICATION and later

i. AABB Standards 33rd edition and later

j. AABB Technical Manual, 21st edition and later

k. 508 Compliance Reference: Revised 508 Standards and 255 Guidelines

(access-board.gov)

l. VA Technical Reference Model: Home Page (va.gov)

3.0 SCOPE OF WORK

The Contractor shall support the full VBECS development and sustainment cycle (herein referred to as the “DevOps” lifecycle). This includes agile software development, testing, and deployment services, as well as sustainment services, for the VBECS product. This includes sustaining patch releases, maintenance, and enhancement patch https://www.fda.gov/vaccines-blood-biologics/biologics-guidances/blood-guidances https://www.access-board.gov/ict/ https://www.access-board.gov/ict/ https://www.oit.va.gov/services/trm/ releases, system testing, system administration, configuration management, all system documentation, ServiceNow (SNOW) ticket resolution and disaster recovery solutions.

These systems are currently hosted in the Azure cloud environment. Enhancement, sustainment, and maintenance support includes assessing and complying with updates from AABB Standards, ICCBBA Standards, software maintenance support, testing, network support, quality system support, and FDA 510(k) Class II medical device certification sustainment.

3.1 APPLICABILITY

This Task Order (TO) effort PWS is within the scope of paragraph(s) 4.1 Program Management, Strategy, Enterprise Architecture and Planning Support, 4.2 Systems/Software Engineering, 4.3 Software Technology Demonstration and Transition,

4.4 Test & Evaluation (T&E), 4.8 Operations and Maintenance (O&M); 4.9 Cyber Security; and 4.10 Training of the T4NG Basic PWS.

3.2 ORDER TYPE

The effort shall be proposed on a Firm Fixed Price (FFP) basis.

4.0 PERFORMANCE DETAILS

4.1 PERFORMANCE PERIOD

The period of performance (PoP) shall be 12 months from date of award with two (2) 12-month option periods. Any work at a Government site shall not take place on Federal Holidays or weekends unless directed by the Contracting Officer (CO).

4.2 PLACE OF PERFORMANCE

Efforts under this TO shall be performed in Contractor provided facilities or located at approved remote locations. During required FDA audits and inspections, internal, and external audits select contractor staff will be required to work at the Hines Office of Information Field Office (OIFO), Hines, IL 60141. The Contractor shall identify the Contractor’s place of performance in their Task Execution Plan submission.

4.3 TRAVEL OR SPECIAL REQUIREMENTS

The Government encourages the Contractor to maximize its use of teleconferencing and video conferencing for meetings. The Government does anticipate travel for FDA and internal audits to perform the tasks associated with this effort under PWS 5.5.3.

Include all estimated travel costs in your firm-fixed price line items. These costs will not be directly reimbursed by the Government.

The total estimated number of trips in support of the program related audits for this effort is up to one (1) trip per year with four (4) people traveling for an average of five (5) days per trip. Anticipated location(s) include, but are not limited to, the following:

A. Hines, IL, or location mandated by the FDA.

Round Trip

Location Number of

Trips Number of Persons Number of Days

Hines, IL, or location mandated by the FDA 3 4 5 Business Days

Local travel within a 50-mile radius from the Contractor’s normal duty location is considered the cost of doing business and will not be reimbursed. This includes travel, subsistence, and associated labor charges for travel time. Travel performed for personal convenience and daily travel to and from work at the Contractor’s facility will not be reimbursed.

4.4 CONTRACT MANAGEMENT

All requirements of Sections 7.0 and 8.0 of the T4NG Basic PWS apply to this effort.

This TO shall be addressed in the Contractor’s Progress, Status and Management Report as set forth in the T4NG Basic contract.

4.5 GOVERNMENT FURNISHED PROPERTY

The Government has multiple remote access solutions available to include Citrix Access Gateway (CAG), Site-to-Site Virtual Private Network (VPN), and RESCUE VPN.

The Government’s issuance of Government Furnished Equipment (GFE) is limited to Contractor personnel requiring direct access to the network to: development environments; install, configure and run Technical Reference Model (TRM) approved software and tools (e.g., Oracle, Fortify, Eclipse, SoapUI, WebLogic, LoadRunner);

upload/download/ manipulate code, run scripts, and apply patches; configure and change system settings; check logs, troubleshoot/debug, and test/QA.

When necessary, the Government will furnish desktops or laptops, for use by the Contractor to access VA networks, systems, or applications to meet the requirements of this PWS. The overarching goal is to determine the most cost-effective approach to providing needed access to the VA environment coupled with the need to ensure proper Change Management principles are followed. Contractor personnel shall adhere to all VA system access requirements for on-site and remote users in accordance with VA standards, local security regulations, policies, and rules of behavior. GFE shall be approved by the COR and Program Manager on a case-by-case basis prior to issuance.

Based upon the Government assessment of remote access solutions and requirements of this TO, the Government estimates that the following GFE will be required by this TO:

1. Eight (8) standard laptops

2. Fourteen (14) developer-grade laptops

The Government will not provide IT accessories including but not limited to Mobile Wi-Fi hotspots/wireless access points, additional or specialized keyboards or mice, laptop bags, extra charging cables, extra Personal Identity Verification card readers, peripheral devices, or additional Random Access Memory (RAM). The Contractor is responsible for providing these types of IT accessories in support of the TO as necessary and any VA installation required for these IT accessories shall be coordinated with the COR.

The Status of Government Furnished Equipment Report under the T4NG Basic Contract requirements is applicable to this TO and shall be delivered to the COR/VA PM as required.

The Government will provide access to the VA approved software and document repositories to provide appropriate Agile project/product application lifecycle management toolsets to track execution details after Contractor personnel complete the training as required in PWS Section 5.1.4. To access VA’s repositories, the Contractor will require VA access. If the mandated toolset changes throughout the PoP of this TO, then the Government will provide access to the new toolset.

The Contractor will be provided access to Government equipment such as servers, networks, and information. The Contractor shall utilize VA provided accounts, document and requirements repositories and others as required for the configuration, storage, maintenance, and delivery of products. The Contractor shall comply with VA information security and privacy policies and procedures as described in Section 6.1 of the T4NG Basic PWS.

4.6 SECURITY AND PRIVACY

All requirements in Section 6.0 of the T4NG Basic PWS apply. Addendum B requirements have been tailored to reflect the security and privacy requirements of this specific TO.

It has been determined that protected health information may be disclosed or accessed, and a signed Business Associate Agreement (BAA) shall be required. The Contractor shall adhere to the requirements set forth within the BAA, referenced in Section D of the Request for Task Execution Plan (RTEP) and shall comply with VA Directive 6066.

4.6.1 POSITION/TASK RISK DESIGNATION LEVEL(S)

In accordance with VA Handbook 0710, Personnel Security and Suitability Program, the position sensitivity, and the level of background investigation commensurate with the required level of access for the following tasks within the PWS are:

Position Sensitivity and Background Investigation Requirements by Task

Task Number Tier1 / Low Risk /

NACI

Tier 2 / Moderate Risk/ MBI

Tier 4 / High Risk /

BI

5.1 5.2

Task Number Tier1 / Low Risk /

NACI

Tier 2 / Moderate Risk/ MBI

Tier 4 / High Risk /

BI

5.3 5.4 5.5

The Tasks identified above, and the resulting Position Sensitivity and Background Investigation requirements identify the Background Investigation requirements for Contractor individuals based upon the tasks the Contractor individual will be working.

The submitted Contractor Staff Roster must indicate the required Background Investigation Level for each Contractor individual based upon the tasks the Contractor individual will be working, in accordance with their submitted proposal.

4.7 CONTRACT PERSONNEL

The Contractor shall provide highly-experienced resources in each role to perform the tasks within the PWS, that have the Blood Bank and VBECS requisite skills, experience, and demonstrated knowledge in Food and Drug Administration (FDA) Title 21 Food and Drugs, Chapter I Food and Drugs Administration Department of Health and Human Services, Subchapter H – Medical Devices.

The Contractor agrees that any personnel being added to the TO shall be approved by the VBECS Management Representative (MR).

It is the responsibility of the Contractor to provide Contractor support personnel or subcontractors to meet this task order for all required PWS tasks.

The project schedule does not allow VA time to train Contractor resources on FDA regulations/processes. Contractor shall on day one be able to execute the full DevOps lifecycle of VBECS in accordance with FDA regulations/process.

The Contractor agrees that it has a contractual obligation to mitigate the consequences of the loss of Personnel and shall promptly secure any necessary replacements in accordance with (IAW) this PWS section.

The Contractor has authority to remove/terminate contractual personnel on the contract at will. The Contractor agrees to notify the MR within 24 hours of terminating an individual on staff. `

5.0 SPECIFIC TASKS AND DELIVERABLES

The Contractor shall perform the following:

5.1 PROJECT MANAGEMENT

5.1.1 CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Project Management Plan (CPMP) that defines the Contractor’s approach, timeline, and tools to be used in execution of this TO. The CPMP shall take the form of both a narrative and graphic format that displays the schedule, milestones, and resource support. The Contractor shall describe how the project management plan manages resources and personnel to accomplish the defined deliverables in this TO and as outlined in “21 CFR 820.20 -- Management responsibility

- (1) Responsibility and authority. Each manufacturer shall establish the appropriate responsibility, authority, and interrelation of all personnel who manage, perform, and assess work affecting quality, and provide the independence and authority necessary to perform these tasks. (2) Resources. Each manufacturer shall provide adequate resources, including the assignment of trained personnel, for management, performance of work, and assessment activities, including internal quality audits, to meet the requirements of this part”.

The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPMP shall be concurred upon and updated in accordance with Section B of the TO. The Contractor shall update and maintain the VA Program Manager (PM) approved CPMP throughout the PoP. The CPMP shall include any other information deemed necessary for tracking by the Contractor, VA PM, or COR.

Within this CPMP, the Contractor shall describe how they will adhere to the Code of Federal Regulations (FCR), Section 820.20 (eCFR :: 21 CFR 820.20 -- Management responsibility.) and Section 820.25 (eCFR :: 21 CFR 820.25 – Personnel). This shall be explicitly documented in the CPMP. This shall be explicitly documented in the CPMP and kept up to date with any changes.

This shall be explicitly documented in the PMP. eCFR :: 21 CFR 820.25 – Personnel).

This shall be explicitly documented in the PMP and kept up to date with any changes.

Deliverable:

A. Contractor Project Management Plan o Deliver To: COR o Initial Delivery: Within ten (10) business days from initial TO award o Delivery Frequency: Monthly

5.1.2 MONTHLY REPORTING REQUIREMENTS

The Contractor shall provide a monthly VBECS Progress Report in electronic form.

Acceptable formats include VA approved dashboards, Microsoft Word, and Project formats. The report shall include detailed instructions/explanations for each required data element, to ensure that data is accurate and consistent. These reports shall reflect data as of the last day of the preceding report.

https://www.ecfr.gov/current/title-21/chapter-I/subchapter-H/part-820/subpart-B/section-820.20 https://www.ecfr.gov/current/title-21/chapter-I/subchapter-H/part-820/subpart-B/section-820.20 https://www.ecfr.gov/current/title-21/chapter-I/subchapter-H/part-820/subpart-B/section-820.25 https://www.ecfr.gov/current/title-21/chapter-I/subchapter-H/part-820/subpart-B/section-820.25

These reports shall provide accurate, timely, and complete project information. The Monthly VBECS Progress Report shall cover all work completed during the reporting period and work planned for the subsequent reporting period. The report shall also include the following data elements:

A. Workforce staffing data showing all Contractor personnel performing on the effort during the current reporting period. After the initial labor baseline is provided, each monthly VBECS Status Report shall identify any changes in staffing identifying each person who was added to the contract or removed from the contract.

B. All Contract personnel status according to FDA 820.25 that includes: Role, Competency Levels, Training Course, Due Date, Last training date completed, Training Material Location, Verification Completed.

C. Identify any problems that arose and a description of how the problems were resolved. If problems have not been completely resolved, the Contractor shall provide an explanation including their plan and timeframe for resolving the issue.

D. Original schedule of deliverables and the corresponding deliverables made during the current reporting period.

E. Status of Government Furnished Equipment Report F. VA mandatory training status for each staff member assigned to the contract.

G. Verification of two (2) staff members being HL-7 Standard Certified

(minimum standard version of 2.6).

These reports shall not be the only means of communication between the Contractor, COR, and the Program/Product Manager to advise of performance/schedule issues and to develop strategies for addressing the issues. The Contractor shall continuously monitor performance and report any deviation from the CPMP or previous monthly VBECS Status Report to the COR and Program/Project Manager during routine, regular communications.

Deliverable:

A. Monthly VBECS Progress Report

• Deliver To: COR

• Initial Delivery: Within twenty (20) business days from initial TO award

• Delivery Frequency: Monthly

5.1.3 TECHNICAL KICKOFF MEETING

A technical kickoff meeting shall be held within ten (10) business days after TO award.

The Contractor shall coordinate the date, time, and location (can be virtual) with the Contracting Officer (CO), as the Post-Award Conference Chairperson, the VA PM, as the Co-Chairperson, the Contract Specialist (CS), and the COR. The Contractor shall provide a draft agenda to the CO and VA PM at least five (5) calendar days prior to the meeting. Upon Government approval of a final agenda, the Contractor shall distribute to all meeting attendees.

During the kickoff-meeting, the Contractor shall present, for review and approval by the Government, the details of the intended approach, work plan, and project schedule for each effort via a Microsoft Office PowerPoint presentation. At the conclusion of the meeting, the Contractor shall update the presentation with a final slide entitled “Summary Report” which shall include notes on any major issues, agreements, or disagreements discussed during the kickoff meeting.

The Summary Report slide shall include the following statement: “As the Post-Award Conference Chairperson, I have reviewed the entirety of this presentation and assert that it is an accurate representation and summary of the discussions held during the Technical Kickoff Meeting for VistA Imaging.”

The Contractor shall submit the final updated presentation to the CO for review and signature within three (3) calendar days after the meeting.

The Contractor shall also work with the CS, the Government’s designated note taker, to prepare and distribute the meeting minutes of the kickoff meeting to the CO, COR, and all attendees within three (3) calendar days after the meeting.

The Contractor shall obtain concurrence from the CS on the content of the meeting minutes prior to distribution of the document.

Deliverables:

A. Draft and Final Agendas

• Deliver To: COR

• Initial Delivery: Within twenty (20) business days from initial TO award

• Delivery Frequency: Monthly

B. Draft and Final PowerPoint Presentation

• Deliver To: COR

• Initial Delivery: Within twenty (20) business days from initial TO award

• Delivery Frequency: Monthly

C. Draft and Final Meeting Minutes

• Deliver To: COR

• Initial Delivery: Within twenty (20) business days from initial TO award

• Delivery Frequency: Monthly

5.1.4 VA MANDATORY TRAINING

The Contractor and VA lead(s) shall determine which team members require access to the VA network and VA approved toolset. All Contractors that require access shall complete all required VA Talent Management System (TMS) training courses within ten

(10) business days of the identification of the access need. The Contractor shall work with its respective point of contact to obtain access to TMS to complete the mandatory courses.

As an action under the Continuous Readiness in Information Security Program (CRISP), VA's Assistant Secretary for Information and Technology issued a memorandum requiring all VA Government and contract staff to complete information security awareness and applicable role-based training:

1. TMS ID 10176: VA Privacy and Information Security Awareness and Rules of Behavior:

2. TMS ID 10204: Privacy and HIPAA Focused Training

The Contractor shall provide signed copies of the Contractor Rules of Behavior in accordance with Section 9, Training, from Appendix C of the VA Handbook 6500.6, “Contract Security.”

The Contractor shall complete the appropriate VA TMS role-based training courses for all Contractors with required access to Elevated Privileges:

1. TMS ID 3197: Information Security Role-Based Training for IT Specialist (Web Based Training [WBT])

2. TMS ID 3867205: Training for Elevated Privileges for System Access (WBT)

3. TMS ID 3867207: Information Security Role-Based Training for System Owners

(WBT)

4. TMS ID 1016925: Information Security Role-Based Training for Software

Developers (WBT)

5. TMS ID 1357076: Information Security and Privacy Role-Based Training for

System Administrators (WBT)

6. TMS ID 1357084: Information Security Role-Based Training for Data Managers

(WBT)

7. TMS ID 1357083: Information Security Role-Based Training for Network

Administrators (WBT)

8. TMS ID 64899: Information Security Role-Based Training for IT Project

Managers (WBT) All training certificates shall be included as part of the monthly VBECS Progress Report.

The Contractor shall expedite all requests for information or documents related to background checks, Personal Identity Verification (PIV) card application forms, project training, and any other artifacts that must be generated or shared for Contractors to be on boarded for this TO. The Contractor Project Manager shall be responsible for coordinating and completing all on boarding to facilitate a rapid state of readiness.

Deliverables:

A. VA TMS Required Training Certificates o Deliver To: COR o Initial Delivery: Within ten (10) business days from initial TO award o Delivery Frequency: Monthly

5.1.5 FDA TRAINING

The VBECS system is formally FDA regulated. All personnel that work on VBECS must be FDA-certified before doing any work with VBECS. For new employees, this certification requires approximately six (6) months of FDA-specific training, testing, and onboarding activities. This approval process is unique to VBECS, implemented by the VA, and approved by the FDA. NOTE: this certification process is applicable to FDA regulated Class II medical device software and the VA-developed VBECS quality system regulations. This training is essential to the Contractors ability to provide mission-critical blood bank/VBECS sustainment support. As such, it is critical that the Contractor have this training and knowledge at the start of the TO.

Further the Contractor shall have expertise in submitting FDA 510(k) submissions and with preparing and submitting Quality System Management Reviews to the Manager with Executive Responsibility (MWER).

VBECS facilitates ongoing compliance with the FDA standards for medical devices, enhances VA’s ability to produce high-quality blood products and services to Veterans, and meets the needs of the user community. The system follows blood bank standards, standards of national accrediting agencies (AABB standards listed in Section 2.0 of this document, for example), FDA regulations, and VA policies. VBECS software has been classified by the FDA as a Class II medical device. Because of that the FDA requires that its Good Manufacturing Practice regulations be followed.

Deliverables:

A. VBECS FDA Training Certifications o Deliver To: COR o Initial Delivery: Within ten (10) business days from initial TO award o Delivery Frequency: Monthly

B. Internal Operating Procedures and Work Instructions to support Section 5.1.5 o Deliver To: COR o Initial Delivery: Within ten (10) business days from initial TO award o Delivery Frequency: Annually

C. Training matrix/curriculum and certification tests that certify knowledge of the IOP/Work instructions.

o Deliver To: COR o Initial Delivery: Within ten (10) business days from initial TO award o Delivery Frequency: Monthly

D. FDA-certification of current and/or proposed contractual personnel.

o Deliver To: COR o Delivery Frequency: Monthly

5.1.6 ONBOARDING / OFFBOARDING PROCESSING

The Contractor shall manage the on-boarding and off-boarding of its staff. The Contractor shall use the VA provided electronic On/Offboard Service (OBS) application in this regard.

On-boarding includes steps to initiate and secure timely background investigations, complete required training, requesting network and email accounts, ensuring VA PIV card sponsorship and issuance to ensure physical and logical access, and requesting

GFE.

The Contractor shall identify individuals who may require elevated privileges to the necessary development and test environments for the various systems to be managed or worked on.

A single Contractor Onboarding POC shall be designated by the Contractor who tracks and reports the onboarding status of all Contractor personnel. The Contractor Onboarding POC shall be responsible for accurate and timely submission of all required VA onboarding paperwork to the COR. The Contractor shall provide an Onboarding Status Report as part of the Monthly Progress Report to include the status for any contract staff with outstanding onboarding requests for review by the COR and VA PM.

At the conclusion of this task order the Contractor shall be responsible for executing and managing the contactor requirements for off-boarding using the VA provided electronic OBS application. All contractor staff shall return issued GFE and VA PIV cards to the office that issued each respective item to them when they either resign or the contract transitions to closure.

To speed onboarding, VA may authorize the Contractor to use the Contractor’s tools for managing the work; however, at any point, VA can mandate that the Contractor move all the information housed in those tools to the approved VA toolset.

NOTE: The VBECS system is formally FDA regulated. All personnel that work on VBECS must be FDA-certified before doing any work with VBECS. This certification requires approximately six (6) months of VBECS-specific training, testing, and onboarding activities. This approval process is unique to VBECS, implemented by the VA, and approved by the FDA. NOTE: this certification process is applicable to FDA regulated Class II medical device software and the VA-developed VBECS quality system regulations. The Contractor shall work and coordinate with VHA to support an annual VHA-driven audit of the VBECS system. The Contractor shall facilitate at least one annual audit of the quality system. The audit shall be conducted by individuals not having direct responsibility for the area audited to assure compliance with FDA regulations. The Contractor shall create a Response to any Audit Report detailing the corrective actions the project intends to take to come back into compliance. The Contractor shall perform corrective actions for audit findings and re-audit any deficiencies.

Deliverables:

A. Onboarding SOP o Deliver To: COR o Initial Delivery: Within ten (10) business days from initial TO award o Delivery Frequency: Annually

B. Audit Response to VHA o Deliver To: COR o Initial Delivery: Within ten (10) business days from request or audit close o Delivery Frequency: As required by audit schedule

5.2 AGILE SOFTWARE ENHANCMENT AND SUSTAINMENT SUPPORT

The Contractor shall meet the regulations and processes specified within this PWS immediately upon award of this TO. The project schedule does not allow time for training Contractor resources on tools or regulations/processes. The Government will not provide training on the pre-existing VBECS application. The Contractor shall not utilize the reverse engineering methodology to reproduce source code to enhance its functionality as an approach under this effort.

The Contractor shall support all VBECS software which currently is at Version 2.3.4.1B. In execution of this task, the Contractor shall provide personnel with expert-level knowledge of the VBECS system (as deployed) and underlying technologies:

Specifics:

o Microsoft Azure Government Cloud o Microsoft SQL Server 2016 SP2 o Microsoft SQL Server Always On o RedGate o Toad Data Modeler o xUnit, NAnt, NCover, and NUnit o Azure Availability Sets and Load Balancers o RDS Gateway in Microsoft Azure Government o Azure DevOps CI/CD Pipelines o Infrastructure as Code (IaC) o Azure Automation Runbooks o Microsoft .Net Framework 4.5 or greater o C# programming language o Azure Dev Ops o Microsoft Thread Modeler o Microsoft Remote Desktop Services o SQL Server Reporting Services Enterprise Edition o Microsoft SharePoint 2016 or later and related technologies o SharePoint tools and web parts including MS Teams o HL7 Version 2.3-2.5 o Powershell o Json o Zebra

Deliverables:

A. VBECS Agile Software Development SOP

• Deliver To: COR

• Initial Delivery: Within ten (10) business days from initial TO award

• Delivery Frequency: Annually

B. VBECS Agile Software Sustainment SOP

• Deliver To: COR

• Initial Delivery: Within ten (10) business days from initial TO award

• Delivery Frequency: Annually

5.2.1 STANDARDS AND TECHNICAL GUIDELINES

The Contractor shall comply with all standards and technical guidelines for programming and software security defined in internal project documents to include the FDA Quality System Regulations (QSR), FDA Current Good Manufacturing Practices (CGMP), Federal Information Security Management Act (FISMA), Health Insurance Portability and Accountability Act (HIPAA), National Institute of Standards and Technology (NIST). The Contractor shall ensure that all software tools used to support VBECS are VA approved. The Contractor shall provide evidence of this compliance in the VBECS Agile Software Development SOP and VBECS Agile Software Sustainment SOP. The list of approved tools is available at http://www.va.gov/trm/TRMHomePage.asp. Prior approval in writing by the COR shall be required to use a non-approved tool. The Contractor shall ensure that all software is free from identified patient safety deficiencies (defined as direct or indirect injury to a Veteran patient) that arise within the scope of the project/assignment.

A. Deliverables: Covered in the VBECS Agile Software Development SOP and VBECS Agile Software Sustainment SOP. Deliverables covered in Section 5.2.

5.2.2 JIRA/AZURE DEVOPS

The Contractor shall use VA’s implementation of JIRA and the native JIRA/Azure DevOps to provide project/product lifecycle management, automation, and to track execution details. Specifically, JIRA and JIRA/Azure DevOps allow for the following:

1. Input and manage project/product risks and issues.

2. Input and manage project/product configurations and changes.

3. Input and manage project/product test plans and execution.

4. Input and manage project/product planning and engineering documentation.

5. Input and manage linkages to correlate requirements to change orders to configurable.

6. Items to risks, impediments, and issues to test cases and test results to show traceability.

7. Create and manage backlog and NSR lists and associated prioritization. The Contractor shall show full traceability in both documents (e.g., backlog and NSR).

a. The Contractor shall review all NSRs and Backlog items with OIT and the VHA customer on a quarterly basis.

b. The Contractor shall ensure all NSRs have an associated item in the backlog with a target FY for implementation.

c. METRIC: the Contractor shall show backlog reduction with the following criterial set:

i. Backlog items at the beginning of the month compared to backlog items at the end of the month.

ii. New items added to a backlog in each month will be represented at the following months beginning count. This is to ensure the contractor can show backlog progress of items that were known at the beginning of the month.

iii. The Contractor shall create and maintain two (2) categories of backlog data – Customer and Technical. The customer backlog will apply to customer-driven backlog items and prioritizations. The technical backlog will apply to technical issues driving the development and sustainment tasks. All backlog items (e.g., both customer and technical) shall be date-driven – specifically listing a Fiscal Year and Quarter for implementation.

8. Create, maintain, and prioritize (via business prioritization) a VBECS backlog.

The Contractor shall review this document with the customer on a quarterly basis.

The Contractor shall show all requirements, changes, tests performed and test results in JIRA/Azure DevOps to show evidence of code coverage and test coverage of all the requirements specified. This requirement will allow VA to have high confidence in a fully documented, as evidenced by data in the tools, requirements traceability matrix. This information shall be submitted as part of the Bi-Weekly VBECS Status Report.

Deliverables:

A. VBECS Risk Log

a. Deliver To: COR

b. Initial Delivery: Within ten (10) business days from initial TO award

c. Delivery Frequency: weekly

B. Configuration and Change Management Plan/SOP

a. Deliver To: COR

b. Initial Delivery: Within ten (10) business days from initial TO award

c. Delivery Frequency: annually

C. Configuration and Change Management Log

a. Deliver To: COR

b. Initial Delivery: Within ten (10) business days from initial TO award

c. Delivery Frequency: weekly

D. VBECS Test Plans and Execution Log

a. Deliver To: COR

b. Initial Delivery: Ten (10) business days prior to test start

c. Delivery Frequency: as required by testing schedule

E. Integrated Master Schedule

a. Deliver To: COR

b. Initial Delivery: Within ten (10) business days from initial TO award

c. Delivery Frequency: weekly

F. Requirements Traceability Matrix

a. Deliver To: COR

b. Initial Delivery: Within ten (10) business days from initial TO award

c. Delivery Frequency: weekly

G. Product Backlog – Customer

a. Deliver To: COR

b. Initial Delivery: Within ten (10) business days from initial TO award

c. Delivery Frequency: Monthly

H. Product Backlog – Technical

a. Deliver To: COR

b. Initial Delivery: Within ten (10) business days from initial TO award

c. Delivery Frequency: Monthly

I. Backlog and NSR Review

a. Deliver To: COR

b. Initial Delivery: Within ten (10) business days from initial TO award

c. Delivery Frequency: quarterly

J. VBECS Status Report

a. Deliver To: COR

b. Initial Delivery: Within ten (10) business days from initial TO award

c. Delivery Frequency: every ten (10) business days

5.2.3 PRODUCT BACKLOG SUPPORT

The Contractor shall keep backlog that clearly delineates between IT/OIT backlog items and customer/VHA backlog items. The Contractor shall plan, schedule, and conduct a monthly Product Backlog meeting with VA stakeholders to analyze, refine, and prioritize VBECS requirements. The Contractor shall document, maintain, and populate the Product Backlog epics, user stories, assigned Service Now Incident Tickets, work, items and acceptance criteria throughout the PoP in JIRA/Azure DevOps. The priority of the customer/VHA items on the product backlog shall be determined based on input from the VHA customer. The priority of the IT/OIT items on the product backlog shall be determined based on input from OIT and Security stakeholders. The Contractor shall ensure that the VA PM has access to the current product backlog throughout the execution of this TO.

Deliverables:

B. VBECS Agile Software Development SOP and VBECS Agile Software Sustainment SOP – Deliverables defined in Section 5.2.

5.2.4 TIER 3 DEFECT ANALYSIS AND REMEDIATION

The Contractor shall provide for the maintenance, sustainment, and, in the case of releases, warranty services for the VBECS product. The Government will provide both Tier 1 (local) and Tier 2 (application customer support) trouble ticket analysis. If Tier 2 personnel cannot resolve a trouble ticket, such tickets will be assigned to the Contractor (Tier 3) for resolution. Tier 3 support is defined as problem analysis and defect management functions that usually require specialized resolution, such as software defect and code changes that cannot be resolved by Tier 1 or Tier 2.

Historically, five (5) – ten (10) tickets have been referred to the Contractor for remediation monthly. Services for referred tickets shall be delivered during normal operating hours being 7:00 am eastern time through 7:00 pm eastern time, Monday through Friday less government holidays. The Contractor shall support resolution of critical severity code tickets and/or High Priority Incident (HPI) / Critical Priority Incident (CPI) calls for Tier 3 VBECS issues as prioritized by Table 1. The Contractor shall adhere to Table 2 for Defect Remediation Processing.

The Contractor may determine as an outcome of defect analysis that an enhancement is required to properly address the validated defect. If a defect is determined to be an enhancement, the Contractor shall provide the VA PM a Defect Analysis Report for the subject defect to include their Enhancement classification reasoning.

Examples of potential VBECS sustainment defects include:

• Example 1: Service Now entry INC28702557 - When AEU enters the information in specimen check section in VBECS user states that the option to go to the next screen is grayed out.

• Example 2: Service Now entry INC27833540 - VBECS will not connect to CPRS which is affecting patient testing

Table 1 – Ticket Maintenance Priority and Defect Severity

Maintenance Priority Defect Severity

P1 - Patient Safety Adversely Affected 1 – Critical

P2 - Logging Software Errors, Functionally Essential

P3 - Systems/Resource Issue

2 – High P4 - Patient Personally Affected

P5 - Logging Software Error, Functionality Needed

P6 - Functionality Called into Question 3 – Medium

P7 - External Database Interface Issue

P8 - Nuisance Problem, Work Around in Place 4 – Low

P9 - Miscellaneous/Housekeeping Problems

Table 2 - Performance Standards for Tier 3 Ticket and Defect Remediation Processing by Ticket Defect Priority

Activity Critical High

Medium, Low, and

Unclassifiable Maintenance

Phase Maintenance Priority: P1/P2 P3/P4/P5 P6/P7/P8/P9

Ticket Referral to Assignment operational hour from time of referral operational hours from time of referral

16 operational hours from time of referral Null

Temporary Workaround (*see emergency footnote below)

Within 4 operational hours of assignment during current business day

Within 12 operational hours of assignment

Within 24 operational hours of assignment

1.Triage Problem Assessment (Ticket Analysis - Traceability, Analysis, Classification & Processing, Reproduce Problem, Code Evaluation & Review)

Same day plus < 8 operational hours

Next business day plus < operational hours

Next business day plus < 36 operational hours

Propose Solution and Create Patch stub if proposed change is approved by the VI CCB

2 days plus < 4 hours < 30 days < 30 days

Obtain Committed Test Site(s) < 5 days < 60 days < 150 days

2.Core Work Register Release

5 days from ticket referral to assignment

45 days from ticket referral to assignment

45 days from ticket referral to assignment

Activity Critical High

Medium, Low, and

Unclassifiable Maintenance

Phase Maintenance Priority: P1/P2 P3/P4/P5 P6/P7/P8/P9

Problem Remediation (Repair, Internal Testing, Attach Build to Patch Stub, SQA Review)

< 10 days from acceptance of ticket referral to assignment

Within 60 days from acceptance of ticket referral to assignment

Within 60 to 120 days from ticket acceptance of referral to assignment

MOU Approval. May occur any time after Core Work begins. 1. Test Site Obtained

Occurs when Core Work is complete. 4. Core Work Exit

Conduct IOC

Within 10 - 20 days from ticket referral to assignment

Within 60 - 120 days from ticket referral to assignment

Within 60 - 120 days from ticket referral to assignment

5. IOC Testing

Approval to proceed to release (Submit IOC Findings, integration of findings, release readiness reports, etc.)

Within 1 day of customer acceptance of IOC

Within 5 business days of customer acceptance of IOC

Within 5 business days of customer acceptance of

IOC

6. Release Approval

End State – successful package release or determination that no patch is required

7. Remediation Complete

Days shown are Calendar Days unless otherwise noted.

Deliverables:

A. VBECS Ticket, Triage, and Resolution Log o Deliver To: COR o Initial Delivery: Within ten (10) business days from initial TO award o Delivery Frequency: Weekly

B. Defect Analysis Report o Deliver To: COR o Initial Delivery: Within ten (10) business days from initial TO award o Delivery Frequency: within five (5) business days of identification of a new defect

5.2.5 VBECS ENHANCEMENT SUPPORT

The Contractor shall provide for the software enhancements of the VBECS software applications and utilities. Enhancements are defined in OMB Circular A-11 as “activities that change or modify existing IT assets to substantively improve capability or performance, implement legislative or regulatory requirements, or meet an agency leadership request”. It also includes “activities aimed at expanding the capacity of an asset or otherwise upgrading it to serve needs different from or significantly greater than those originally intended”.

Examples of potential VBECS enhancements include:

C. Example 1: NSR 20170205: Change expiration date of Bacterial tested platelets - Provide the ability to edit the unit barcode expiration date in compliance with FDA mandates related to bacterial detection for apheresis platelets over three days old and in compliance with bacterial detection documentation standards and regulations from FDA, College of American Pathologist (CAP), American Association of Blood Banks (AABB), and JC (Joint Commission).

D.

E. Example 2: NSR 20120402: VBECS - add or edit comment fields - The existing

VBECS software does not allow for addition to or editing of the comment fields once the test has been validated as complete. In order to add or edit comments, the test results have to be invalidated completely and reentered.

The correct data and times must be accurate or can lead to significant errors in patient files. This is an enhancement to the comment field that allows the addition or editing of comments as it is allowed in VistA applications.

F.

G. Example 3: NSR 20120902: Clone (Rh) control data entry - Provide the ability to require users to enter a value for Rhesus (RH) control tests when initial blood type test results are AB Positive

Deliverables:

A. VBECS Agile Software Development SOP, VBECS Agile Software Sustainment SOP, Backlogs, Requirements Traceability, Integrated Master Schedule – Concepts and deliverables defined in Section 5.1 and 5.2 of this TO.

5.2.6 VBECS SOFTWARE RELEASE SUPPORT

The Contractor shall be responsible for release coordination, planning, and execution for all VBECS releases. The Contractor shall adhere to the VA Release Readiness process in execution of this TO. The Contractor shall support and maintain VBECS releases after release and assist with implementation by resolving problems that arise during the deployment. The Contractor shall revise and maintain (per VBECS release) the following:

a. Software Design Documents (SDD) – the Contractor shall include comprehensive system architecture and system interface specifics in the SDD showing Application Architecture, Hardware and Infrastructure, Security Architecture, and Disaster Recovery Architecture.

b. Database Models,

c. Architecture documents (Application Architecture, Hardware and Infrastructure, Security Architecture, and Disaster Recovery Architecture),

d. System Interface Descriptions,

e. ATO documentation,

f. Technical Manual-Security Guides,

g. Installation Guides,

h. System Security Plans,

i. Operations and Maintenance Plans,

j. Disaster Recovery Plans, and

k. Development System Configuration Logs

Contractor shall conduct software tool validation (assessed monthly), system performance testing, installation and integration testing, and disaster recovery testing for each release. The Contractor shall follow the Agile methodology and VA management guidelines for all software development. Releases shall include Source Code, Executable Code, Databases, and Executable Database Code. Additionally, the need may arise for a patient safety/critical release which shall require an accelerated schedule. Historically, there has been one patient safety critical release within three years.

Deliverables:

A. Software Design Documents (SDD) o Deliver To: COR o Initial…