36C10B24Q0064_1.docx

Controlled Unclassified Information (CUI) Implementation Program Support

VA-24-00009866

GENERAL INFORMATION

SET-ASIDE

PLACE OF PERFORMANCE

POSTAL CODE

COUNTRY

CONTACT INFORMATION

Technology Acquisition Center 23 Christopher Way Eatontown NJ 07724 Eatontown NJ 07724

POINT OF CONTACT*

Contract Specialist Michael Gruen michael.gruen@va.gov 848-377-5251

ADDITIONAL INFORMATION

AGENCY’S URL

URL DESCRIPTION

AGENCY CONTACT’S EMAIL ADDRESS

EMAIL DESCRIPTION

DESCRIPTION

The Department of Veterans Affairs (VA) Technology Acquisition Center (TAC) is seeking information concerning the availability of capable contractors to provide the implementations and monitoring of Controlled Unclassified Information (CUI) Self-Inspection and Incident Management programs identified in the Performance Work Statement (PWS).

This is a Request For Information (RFI) only and is limited to ten pages. Do not submit a proposal or quote. There is no obligation on the part of the Government to acquire any products or services described in this RFI. Your response to this RFI will be treated only as information for the Government to consider. You will not be entitled to payment for direct or indirect costs that you incur in responding to this RFI. This request does not constitute a solicitation for proposals or the authority to enter into negotiations to award a contract. No funds have been authorized, appropriated or received for this effort. Interested parties are responsible for adequately marking proprietary, restricted or competition sensitive information contained in their response. The Government does not intend to pay for the information submitted in response to this RFI. Page limit (excluding PWS feedback) is 10 pages.

If interested, please provide the following:

1. A capabilities statement that addresses the questions below and draft PWS. If additional information is required by VA to determine a contractor’s capability to provide the full requirement and the economic feasibility of the information provided, additional information may be requested at a later date. Technical questions may be submitted as part of your response. A draft version of the requirement is below. Please direct all responses to Michael Gruen, michael.gruen@va.gov and Debra Clayton, debra.clayton2@va.gov

2. Has the draft PWS provided sufficient detail to describe the technical requirements that encompass the services to be performed under this effort?

______ YES _______ NO (if No, answer question below) If “NO”, please provide your technical comments/recommendations on elements of the draft PWS that may contribute to a more accurate proposal submission and efficient, cost effective effort.

3. Any Contract Vehicle of which you are a part that can be used to acquire your solution as well as the company business size and status for each vehicle as designated by the NAICS 541611, Administrative Management and General Management Consulting Services, and the associated U.S. Small Business Administration size status (i.e., Large Business, Small Business, Service-Disabled Veteran Owned Small Business, Small Disadvantaged Business, Women-Owned Small Business, Hub Zone Small Business, etc.)

4. If your company is a small business, please confirm that in the solution provided, your company will be performing at least 50% of the work in accordance with the set aside regulations.

5. Please provide the labor categories that you think will be required to perform the work described in the PWS. Also include the labor category descriptions and estimated number of annual hours for each labor category.

6. Please describe your past performance in providing the type of services described in the PWS.

Presolicitation Notice Presolicitation Notice

Presolicitation Notice

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Office of Information & Technology Compliance, Risk and Remediation (CRR) Enterprise Record Service (ERS)

Controlled Unclassified Information (CUI) Implementation Program Support

Date: 08/31/2023

VA-24-00009866

PWS Version Number: 1.1

Contents

BACKGROUND

The Department of Veterans Affairs (VA), Office of Information & Technology (OIT), Compliance, Risk and Remediation (CRR) Enterprise Record Service (ERS) strives to provide high quality, effective, and efficient Information Technology (IT) services to those responsible for providing care to the Veterans at the point-of-care as well as throughout all the points of the Veterans’ health care in an effective, timely and compassionate manner. The VA depends on Information Management/Information Technology (IM/IT) systems to meet mission goals.

The Executive Order (E.O.) 13556, Controlled Unclassified Information establishes an open and uniform program for managing unclassified information requiring safeguarding or dissemination controls pursuant to and consistent with law, regulations, and Government-wide policies. In accordance with 32 CFR 2002, the VA must establish Controlled Unclassified Information (CUI) Self-Inspection and Incident Management programs.

In support of these programs, the VA requires the development of program implementation plans and support in executing these plans. The VA is actively involved in the project implementation phase of this effort. Several key deliverables have been developed since 2016, which require updates based on Office of Management and Budget (OMB) mandates and National Archives and Records Administration (NARA) policy. As VA moves beyond the implementation phase, it requires support to implement program sustainment activities, and the ability to measure program success and optimize program activities.

APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. 44 U.S.C. § 3541-3549, “Federal Information Security Management Act (FISMA) of 2002”

2. “Federal Information Security Modernization Act of 2014”

3. Federal Information Processing Standards (FIPS) Publication 140-2, “Security Requirements for Cryptographic Modules”

4. FIPS Pub 199. “Standards for Security Categorization of Federal Information and Information Systems,” February 2004

5. FIPS Pub 200, “Minimum Security Requirements for Federal Information and Information Systems,” March 2006

6. FIPS Pub 201-2, “Personal Identity Verification of Federal Employees and Contractors,” August 2013

7. 10 U.S.C. § 2224, "Defense Information Assurance Program"

8. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

9. Public Law 109-461, Veterans Benefits, Health Care, and Information Technology Act of 2006, Title IX, Information Security Matters

10. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”

11. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, https://www.va.gov/vapubs/index.cfm

12. VA Handbook 0710, “Personnel Security and Suitability Program,” May 2, 2016, https://www.va.gov/vapubs/index.cfm

13. VA Directive and Handbook 6102, “Internet/Intranet Services,” August 5, 2019

14. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and Guidelines,” January 18, 2017

15. Office of Management and Budget (OMB) Circular A-130, “Managing Federal Information as a Strategic Resource,” July 28, 2016

16. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed Services (CHAMPUS)”

17. NIST SP 800-66 Rev. 1, “An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule,” October 2008

18. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended, January 18, 2017

19. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

20. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021

21. VA Handbook 6500, “Risk Management Framework for VA Information Systems VA Information Security Program,” February 24, 2021

22. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI),” March 12, 2019

23. VA Handbook 6500.5, “Incorporating Security and Privacy into the System Development Lifecycle,” March 22, 2010

24. VA Handbook 6500.6, “Contract Security,” March 12, 2010

25. VA Handbook 6500.8, “Information System Contingency Planning,” April 6, 2011

26. VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018

27. VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017

28. OIT Process Asset Library (PAL), https://www.va.gov/process/ . Reference Process Maps at https://www.va.gov/process/maps.asp and Artifact templates at https://www.va.gov/process/artifacts.asp

29. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

30. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014

31. VA Handbook 6508.1, “Procedures for Privacy Threshold Analysis and Privacy Impact Assessment,” July 30, 2015

32. VA Handbook 6510, “VA Identity and Access Management,” January 15, 2016

33. VA Directive and Handbook 6513, “Secure External Connections,” October 12, 2017

34. VA Directive 6300, “Records and Information Management,” September 21, 2018

35. VA Handbook, 6300.1, “Records Management Procedures,“ March 24, 2010

36. NIST SP 800-37 Rev 2, “Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy,” December 2018

37. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020)

38. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015

39. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” March 24, 2014

40. OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005

41. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019

42. OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008

43. Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance, December 2, 2011, (NOTE: Part A of the FICAM Roadmap and Implementation Guidance, v2.0, was replaced in 2015 with an updated Architecture (https://arch.idmanagement.gov/#what-is-the-ficam-architecture)

44. NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access,“ June 2018

45. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, “Digital Identity Guidelines,” updated March 02, 2020

46. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014

47. NIST SP 800-164, “Guidelines on Hardware-Rooted Security in Mobile Devices (Draft),” October 2012

48. Draft National Institute of Standards and Technology Interagency Report (NISTIR) 7981, “Mobile, PIV, and Authentication,” March 2014

49. VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

50. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

51. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

52. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

53. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019

54. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008

55. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (Public Law 110–140), December 19, 2007

56. Section 104 of the Energy Policy Act of 2005, (Public Law 109–58), August 8, 2005

57. Executive Order 13834, “Efficient Federal Operations,” dated May 17, 2018

58. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 2, 2001

59. VA Directive 0058, “VA Green Purchasing Program,” July 19, 2013

60. VA Handbook 0058, “VA Green Purchasing Program,” July 19, 2013

61. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

62. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

63. “Veteran Focused Integration Process (VIP) Guide 4.0,” January 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

64. VA Memorandum “Proper Use of Email and Other Messaging Services,” January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

65. “DevSecOps Product Line Management Playbook” version 2.0, May 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

66. NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020

67. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol Version 6 (IPv6),” November 19, 2020

68. Social Security Number (SSN) Fraud Prevention Act of 2017

69. Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23, 2018

SCOPE OF WORK

The Contractor shall provide the resources necessary to accomplish implementation of the CUI program for the Department of VA, Office of Privacy and Records Management (OPRM) as described in this Performance Work Statement (PWS). Specifically, the Contractor shall tailor VA specific CUI policy based on the NARA policy, stand-up executive steering committee, sustain CUI working group, develop CUI training, review IT systems, conduct self-inspections and prepare monthly status reports."

PERFORMANCE DETAILS

1.1 PERFORMANCE PERIOD

The Period of Performance (PoP) shall be one 12-month base period with four (4) 12-month option periods and two optional tasks. The PoP for the optional tasks shall not exceed the POP for the base or option period for which it was exercised. All base tasks shall be performed in the base and option periods, if exercised. In addition, the requirement includes two optional tasks, one for Web-based CUI Training and the other for 60 days of Transition support. The overall Task Order (TO) PoP shall not exceed 60 months.

Any work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO).

There are eleven (11) Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, four are set by date:

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

1.2 PLACE OF PERFORMANCE

Efforts under this Task Order (TO) shall be considered onsite at the Government facility but the work shall be performed virtual or at the Government facility, 811 Vermont Avenue, NW, Washington, DC 20420.

1.3 TRAVEL

The Government does not anticipate travel under this effort to perform the tasks associated with the effort. Local travel to the duty location will not be reimbursed.

SPECIFIC TASKS AND DELIVERABLES

The Contractor shall perform the following tasks:

1.4 PROJECT MANAGEMENT

1.4.1 CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, timeline, and tools to be used in execution of the contract. The CPMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks, and resource support. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPMP shall be concurred upon and updated in accordance with Section B of the contract. The Contractor shall update and maintain the VA PM approved CPMP throughout the PoP.

Deliverable:

A. Contractor Project Management Plan

1.4.2 REPORTING REQUIREMENTS (Base, All Options Periods, and Optional Tasks) The Contractor shall submit a Weekly Status Report, and Monthly Activities Report. The Contractor shall submit Weekly Status Reports to support the Weekly Status Meetings. The Monthly Activities Report will support the activities performed for the month and will report activities, accomplishments and risk mitigation actions as well as planned activities for the next reporting period. This is accomplished by reviewing the progress and issues with respect to CUI implementation. In these Weekly Status Meetings, the CUI PM will review the progress made on the CUI implementation. In preparation of these weekly meetings, the Contractor shall submit status via Weekly Status Reports and the progress and issues will be discussed during the meeting.

The Contractor shall submit status of VA CUI and Information Security Awareness and Rules of Behavior training for all individuals engaged on the task. The status reporting shall identify a single Contractor Security Point of Contact (POC), the names of all personnel engaged on the task, the initial training date for VA CUI and Information Security Awareness and Rules of Behavior training for each person engaged on the task, and the next required training date training for each person engaged on the task.

To perform the tasks identified in the TO, each Contractor staff personnel must read, accept, and submit a copy of the VA CUI and Information Security Awareness and Rules of Behavior Certificate to the COR.

Deliverables:

A. Weekly Status Report B. Monthly Activities Report (IT Systems, Policies) C. VA CUI and Information Security and Rules of Behavior Training Certificates

5.1.3. Technical Kickoff Meeting

A technical kickoff meeting shall be held within 10 days after TO award. The Contractor shall coordinate the date, time, and location (can be virtual) with the Contracting Officer (CO), as the Post-Award Conference Chairperson, the VA PM, as the Co-Chairperson, the Contract Specialist (CS), and the COR. The Contractor shall provide a draft agenda to the CO and VA PM at least five (5) calendar days prior to the meeting. Upon Government approval of a final agenda, the Contractor shall distribute to all meeting attendees. During the kickoff-meeting, the Contractor shall present, for review and approval by the Government, the details of the intended approach, work plan, and project schedule for each effort via a Microsoft Office PowerPoint presentation. At the conclusion of the meeting, the Contractor shall update the presentation with a final slide entitled “Summary Report” which shall include notes on any major issues, agreements, or disagreements discussed during the kickoff meeting and the following statement “As the Post-Award Conference Chairperson, I have reviewed the entirety of this presentation and assert that it is an accurate representation and summary of the discussions held during the Technical Kickoff Meeting for the CUI Implementation Support.” The Contractor shall submit the final updated presentation to the CO for review and signature within three (3) calendar days after the meeting. The Contractor shall also work with the CS, the Government’s designated note taker, to prepare and distribute the meeting minutes of the kickoff meeting to the CO, COR and all attendees within three (3) calendar days after the meeting. The Contractor shall obtain concurrence from the CS on the content of the meeting minutes prior to distribution of the document.

Deliverables:

A. Kick Off Meeting Agenda B. Kick Off Meeting Presentation Slide Deck C. Kick Off Meeting Minutes

1.5 Tailor the CUI policy developed by the executive agent for va cui directive and handbook (base and all options) The CUI policy is currently being developed for all Federal agencies by the Executive Agent, the National Archives and Records Administration (NARA). The Contractor shall review the policy guidance issued to Executive Branch departments and in coordination and consultation with Government personnel, tailor the guidance for the development of the VA CUI Directive and VA CUI Handbook concerning markings, safeguarding, dissemination and decontrol of CUI that, to the extent practicable and permitted by law, regulation, and Government-wide policies, shall remain consistent across categories and subcategories of CUI throughout the Executive Branch. VA does not currently have an electronic marking tool. The requirement is to review VA IT systems & toolsets to identify systems impacted by CUI and the contractor is to develop a plan will utilize an existing COTS solution. Additionally, the Contractor shall develop and finalize a CUI process guide (standard operating procedure).

The Contractor shall review the NARA (Executive Agent for CUI) policies quarterly, and apply updates and tailoring to the VA policy, communications plans, training, CUI Directive and CUI Handbook as required. Moreover, the Contractor shall maintain the current VA CUI Decision Matrix in order to ensure senior VA leaders provide the critical decisions according to a CUI milestone or event.

Deliverables:

A. Updated VA CUI Directive B.VA CUI Handbook C. CUI process guide

5.3 REVIEW OF VA INFORMATION TECHNOLOGY SYSTEMS TO IDENTIFY SYSTEMS IMPACTED BY CUI

The VA requires critical support to ensure that the VA enterprise information system portfolio (currently over 700 information systems) continues to meet CUI compliance requirements. Under this task, the VA requires development of compliance strategies and system change requirements, and coordination with the VA OIT to conduct system impact assessments.

The Contractor shall review IT systems and toolsets, Personally Identifiable Information (PII) inventory, and artifacts created by Risk Vision and VA Systems Inventory (VASI) to identify systems impacted by CUI. The Contractor shall document the information describing all IT systems impacted by CUI in a written report, titled: Information Technology Systems Impacted by CUI Report. The Contractor shall prepare a report based on the plan for electronic marking solutions, titled “Plan for Electronic Marking Solutions Report” as required by the CUI registry and develop target dates for phased implementation in a Phased Implementation Target Dates Report.

The Contractor shall review VA Information Technology Systems Inventories, and tools for new or unidentified IT systems that must be added to the Information Technology Systems Impacted by CUI Report, and Plan for Electronic Markings Solutions Report. The Contractor shall update the Information Technology Systems Inventories Impacted by CUI Report, Plan for Electronic Markings Report and shall provide Phased Implementation Target dates for any new or unidentified IT systems as required. Furthermore, the Contractor shall implement the Electronic Marking Solutions across VA.

In support of this requirement, the Contractor shall utilize a three-phased IT Systems Assessment Process approach that includes an update to the Baseline Assessment (Phase 1), an update to the Compliance Analysis (Phase 2), and an update to the Corrective Action Plan (Phase 3). These phases shall be completed in accordance with the following target dates:

Phase 1 - 12 months, Phase 2a 12 months Phase 2b 12 months, Phase 3 - 12 months.

The contractor shall develop and maintain the IT Systems Marking Strategic Plan. The Contractor shall coordinate with OIT, system owners, and other program offices to identify and assess IT systems for CUI compliance. The Contractor shall provide OIT and system owners with system-specific marking recommendations, as needed. The Contractor shall define CUI Impact Assessment criteria for any new systems or tools which may contain CUI and support completion CUI Impact Assessments, as needed

The Contractor shall review and update the Baseline Assessment of initial inventory of all existing VA systems that likely contain CUI; the Compliance Analysis of the Baseline Assessment to determine if system security controls comply with CUI program and its categories; and thirdly, the Corrective Action Plan to include identification of gaps and a strategy to achieve compliance.

Deliverables:

A. A. Information Technology Systems Impacted by CUI Report B. IT Systems Marking Strategic Plan C. Electronic Marking Solutions Report D. Bimonthly System Completion Report E. Phased Implementation Target Dates Report F. Updated Baseline Assessment G. Updated Compliance Analysis H. Updated Corrective Action Plan

5.4 SELF-INSPECTION

The Contractor shall support the implementation of the Self-Inspection program by identifying offices, coordinating communications, responding to questions, and developing and executing actions and next steps. The Contractor shall document VA agency-level plans and target dates for the creation of a Self-Inspection Program Plan including reviews and assessments, to evaluate program effectiveness, measure the level of compliance with the Order and Notice, and monitor the progress of CUI implementation. The review and assessments in the Self-Inspection Program Plan shall be integrated with VA department policies and guidance.

The Contractor shall describe and document plans to integrate lessons learned from reviews, and assessments to improve operational policies, procedures, and training. The Contractor shall provide Lessons Learned Reports. The Contractor shall establish a system for corrective action to prevent and respond to non-compliance with the Order and Notice. The Contractor shall provide documentation in the form of a Corrective Action Plan that reflects the analysis, and conclusions of the self-inspection program to the Executive Agent (EA) on an annual basis and as requested by the EA.

The contractor shall provide a review of the self-inspection program every 60 days and shall provide updates to the Self-Inspections Program Plan, Lessons Learned Reports, and Corrective Actions Plan as required as referenced in para 5.3. The Contractor shall apply lessons learned from the previous self-inspection efforts to the Self-Inspection Program Plan and the Corrective Action Plan.

The contractor shall develop VA CUI Incident Management procedures, responsibilities, and escalation criteria. The Contractor shall support the review of and response to CUI incidents and challenges and support the development of requirements for a CUI Incident Management tool. The Contractor shall develop Self-Inspection and Incident Management metrics and reporting mechanisms to report on and track open and completed items. The Contractor shall develop and implement a CUI Compliance Dashboard that measures implementation of all requirements defined in 32 CFR 2002. The Contractor shall support other program implementation and sustainment activities as needed as defined by NARA (National Archives Registry Administration).

Deliverables:

A. Self-Inspection Program Plan Update B. Lessons Learned Reports C. VA Incident Management Program Plan D. Updates to the CUI Compliance Dashboard

5.5 WEB BASED CUI TRAINING (Optional Task 1)

Upon approval of the CUI Enterprise Directive, the Contractor shall review agency-level development plans to ensure that VA personnel or Contractors and other information-sharing partners who create or handle CUI have a satisfactory knowledge and understanding of relevant CUI categories and associated markings, applicable safeguarding, dissemination including CUI handling agreements, and decontrol policies and procedures. The Contractor shall coordinate and consult with Government personnel to describe plans and tailor the CUI Training Plan for the Talent Management System (TMS) to meet the specific needs of the agency and the activities that VA personnel or Contractors and other information-sharing partners are expected to perform as determined by the agency. CUI training has been developed by the Executive Agent. The Contractor shall tailor the already developed training to meet specific VA requirements for training VA personnel and contractors who handle CUI. Upon completion of the tailored training, this training shall be turned over to the Office of Information Technology, Information Technology Workforce Development (ITWD), for deployment and sustainment in the TMS.

The Contractor shall review the training materials on a quarterly basis for changes to the NARA policy and provide any required updates to the training management plan and training and for delivery to ITWD.

This optional task can be exercised at the beginning of each optional period.

Deliverable:

A. CUI Training Plan B. CUI Training Materials for the TMS

5.6 TRANSITION PLAN (OPTIONAL TASK 2)

The VA may exercise this optional task once, at any time during the base or option periods. If exercised, the PoP will be two months and will not exceed the overall TO POP of 60 months. The Contractor shall transition activities and services to the Federal Government or to a follow-on Contractor at the end of this TO period of performance for a period of 60 calendar days. The Contractor shall perform the following activities:

1. Create a Transition Plan that describes the Contractor’s transition approach and activities.

2. Provide all pertinent information needed to continue the services being performed by the Contractor.

3. Provide current inventory of all Government-owned information or assets used by the Contractor along with full support in the reconciliation of this inventory.

4. Provide “shadowing” and other knowledge transfer meetings and opportunities to facilitate the transfer of information, processes, and data needed to continue the services being performed by the Contractor.

5. Provide up-to-date program management documents, reports, process flows, dashboard, templates, training master materials, and any other artifact as requested.

Deliverable:

A. Transition Plan

5.7 OPTION PERIOD ONE

If Option Period One is exercised, the Contractor shall perform the requirements described in PWS Paragraphs 5.1 through 5.5.

5.8 OPTION PERIOD TWO

If Option Period Two is exercised, the Contractor shall perform the requirements described in PWS Paragraphs 5.1 through 5.5.

5.9 OPTION PERIOD THREE

If Option Period Two is exercised, the Contractor shall perform the requirements described in PWS Paragraphs 5.1 through 5.5.

5.10 OPTION PERIOD FOUR

If Option Period Two is exercised, the Contractor shall perform the requirements described in PWS Paragraphs 5.1 through 5.5.

GENERAL REQUIREMENTS

1.6 ENTERPRISE AND IT FRAMEWORK

1.6.1 VA TECHNICAL REFERENCE MODEL

The Contractor shall support the VA enterprise management framework. In association with the framework, the Contractor shall comply with OIT Technical Reference Model (VA TRM). The VA TRM is one component within the overall Enterprise Architecture (EA) that establishes a common vocabulary and structure for describing the information technology used to develop, operate, and maintain enterprise applications. Moreover, the VA TRM, which includes the Standards Profile and Product List, serves as a technology roadmap and tool for supporting OIT. Architecture & Engineering Services (AES) has overall responsibility for the VA TRM.

1.6.2 FEDERAL IDENTITY, CREDENTIAL, AND ACCESS MANAGEMENT (FICAM)

The Contractor shall ensure Commercial Off-The-Shelf (COTS) product(s), software configuration and customization, and/or new software are Personal Identity Verification (PIV) card-enabled by accepting HSPD-12 PIV credentials using VA Enterprise Technical Architecture (ETA), https://www.ea.oit.va.gov/EAOIT/VA_EA/Enterprise_Technical_Architecture.asp, and VA Identity and Access Management (IAM) approved enterprise design and integration patterns, https://www.oit.va.gov/library/recurring/edp/index.cfm. The Contractor shall ensure all Contractor delivered applications and systems comply with the VA Identity, Credential, and Access Management policies and guidelines set forth in VA Handbook 6510 VA Identity and Access Management, VA Handbook 0735 Homeland Security Presidential Directive 12 (HSPD-12) Program, and align with the Federal Identity, Credential, and Access Management Roadmap and Implementation Guidance v2.0.

The Contractor shall ensure all Contractor delivered applications and systems provide user authentication services compliant with the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-63-3, VA Handbook 6500 Appendix F, “VA System Security Controls”, and VA IAM enterprise requirements for direct, assertion based authentication, and/or trust based authentication, as determined by the design and integration patterns. Direct authentication at a minimum must include Public Key Infrastructure (PKI) based authentication supportive of PIV card and/or Common Access Card (CAC), as determined by the business need.

The Contractor shall ensure all Contractor delivered applications and systems conform to the specific Identity and Access Management PIV requirements set forth in the Office of Management and Budget (OMB) Memoranda M-05-24, M-19-17, and NIST Federal Information Processing Standard (FIPS) 201-2. OMB Memoranda M-05-24 and M-19-17 can be found at: https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2005/m05-24.pdf, and https://www.whitehouse.gov/wp-content/uploads/2019/05/M-19-17.pdf respectively. The Contractor delivered applications and systems shall be on the FIPS 201-2 Approved Product List (APL). If the Contractor delivered application and system is not on the APL, the Contractor shall be responsible for taking the application and system through the FIPS 201 Evaluation Program.

The Contractor shall ensure all Contractor delivered applications and systems support:

1. Automated provisioning and are able to use enterprise provisioning service.

2. Interfacing with VA’s Master Person Index (MPI) to provision identity attributes, if the solution relies on VA user identities. MPI is the authoritative source for VA user identity data.

3. The VA defined unique identity (Secure Identifier [SEC ID] / Integrated Control Number [ICN]).

4. Multiple authenticators for a given identity and authenticators at every Authenticator Assurance Level (AAL) appropriate for the solution.

5. Identity proofing for each Identity Assurance Level (IAL) appropriate for the solution.

6. Federation for each Federation Assurance Level (FAL) appropriate for the solution, if applicable.

7. Two-factor authentication (2FA) through an applicable design pattern as outlined in VA Enterprise Design Patterns.

8. A Security Assertion Markup Language (SAML) implementation if the solution relies on assertion-based authentication. Additional assertion implementations, besides the required SAML assertion, may be provided as long as they are compliant with NIST SP 800-63-3 guidelines.

9. Authentication/account binding based on trusted Hypertext Transfer Protocol (HTTP) headers if the solution relies on Trust based authentication.

10. Role Based Access Control.

11. Auditing and reporting capabilities.

12. Compliance with VIEWS 00155984, PIV Logical Access Policy Clarification https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896.

The required Assurance Levels for this specific effort are Identity Assurance Level 3, Authenticator Assurance Level 3, and Federation Assurance Level 3.

1.6.3 INTERNET PROTOCOL VERSION 6 (IPV6)

The Contractor solution shall support Internet Protocol Version 6 (IPv6) based upon the memo issued by the Office of Management and Budget (OMB) on November 19, 2020 (https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-07.pdf). IPv6 technology, in accordance with the USGv6 Program (https://www.nist.gov/programs-projects/usgv6-program/usgv6-revision-1), NIST Special Publication (SP) 500-267B Revision 1 “USGv6 Profile” (https://doi.org/10.6028/NIST.SP.500-267Br1), and NIST SP 800-119 “Guidelines for the Secure Deployment of IPv6” (https://doi.org/10.6028/NIST.SP.800-119), compliance shall be included in all IT infrastructures, application designs, application development, operational systems and sub-systems, and their integration. In addition to the above requirements, all devices shall support native IPv6 and dual stack (IPv6 / IPv4) connectivity without additional memory or other resources being provided by the Government, so that they can function in a mixed environment. All public/external facing servers and services (e.g. web, email, DNS, ISP services, etc.) shall support native IPv6 and dual stack (IPv6 / IPv4) users and all internal infrastructure and applications shall communicate using native IPv6 and dual stack (IPv6 / IPv4) operations.

1.6.4 TRUSTED INTERNET CONNECTION (TIC)

The Contractor solution shall meet the requirements outlined in Office of Management and Budget Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative“ (https://www.whitehouse.gov/wp-content/uploads/2019/09/M-19-26.pdf), VA Directive 6513 “Secure External Connections”, and shall comply with the TIC 3.0 Core Guidance Documents, including all Volumes and TIC Use Cases, found at the Cybersecurity & Infrastructure Security Agency (CISA) (https://www.cisa.gov/publication/tic-30-core-guidance-documents). Any deviations must be approved by the VA TIC 3.0 Working Group at vaoisesatic30team@va.gov.

1.6.5 STANDARD COMPUTER CONFIGURATION

The Contractor IT end user solution that is developed for use on standard VA computers shall be compatible with and be supported on the standard VA operating system, currently Windows 10 (64bit), Edge (Chromium based), and 365 Apps for enterprise. Applications delivered to VA and intended to be deployed to Windows 10 workstations shall be delivered as a signed .msi package with switches for silent and unattended installation and updates shall be delivered in signed .msp file formats for easy deployment using Microsoft Endpoint Configuration Manager (CM) VA’s current desktop application deployment tool. Signing of the software code shall be through a vendor provided certificate that is trusted by VA using a code signing authority such as Verizon/Cybertrust or Symantec/VeriSign. The Contractor shall also ensure and certify that their solution functions as expected when used from a standard VA computer, with non-admin, standard user rights that have been configured using the United States Government Configuration Baseline (USGCB) and Defense Information Systems Agency (DISA) Secure Technical Implementation Guide (STIG) specific to the particular client operating system being used.

1.6.6 VETERAN FOCUSED INTEGRATION PROCESS (VIP) AND PRODUCT LINE MANAGEMENT (PLM)

The Contractor shall support VA efforts IAW the updated Veteran Focused Integration Process (VIP) and Product Line Management (PLM). The major focus of the new VIP is on Governance and Reporting and is less prescriptive, with a focus on outcomes and continuous delivery of value. PLM is a framework that focuses on delivering functional products that provide the highest priority work to customers while delivering simplified, reliable, and practical solutions to the business, medical staff, and our Veterans. The VIP Guide is a companion guide to the PLM Playbook and can be found at: https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371 and the PLM Playbook can be found at https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946. The PLM Playbook pivots from project-centric to product-centric delivery and contains descriptive practices that focuses on outcomes. The PLM Playbook contains a set of “plays” that implement Development, Security, and Operations (DevSecOps) principles and processes such as automated development, continuous integration/continuous delivery, and release on demand. The PLM Playbook details how product lines implement Lean-Agile principles, methods, practices, and techniques through levels of maturity. VIP and PLM are the authoritative processes that IT projects must follow to ensure development and delivery of IT products.

1.6.7 PROCESS ASSET LIBRARY (PAL)

The Contractor shall perform their duties consistent with the processes defined in the OIT Process Asset Library (PAL). The PAL scope includes the full spectrum of OIT functions and activities, such as VIP project management, operations, service delivery, communications, acquisition, and resource management. PAL serves as an authoritative and informative repository of searchable processes, activities or tasks, roles, artifacts, tools and applicable standards and guides to assist the OIT workforce, Government and Contractor personnel. The Contractor shall follow the PAL processes to ensure compliance with policies and regulations and to meet VA quality standards. The PAL includes the contractor onboarding process consistent with Section 6.2.2 and can be found at https://www.va.gov/PROCESS/artifacts/maps/process_CONB_ext.pdf. The main PAL can be accessed at www.va.gov/process.

1.6.8 AUTHORITATIVE DATA SOURCES

The VA Enterprise Architecture Repository (VEAR) is one component within the overall EA that establishes the common framework for data taxonomy for describing the data architecture used to develop, operate, and maintain enterprise applications. The Contractor shall comply with the department’s Authoritative Data Source (ADS) requirement that VA systems, services, and processes throughout the enterprise shall access VA data solely through official VA ADSs where applicable, see below. The Information Classes which compose each ADS are located in the VEAR, in the Data & Information domain. The Contractor shall ensure that all delivered applications and system solutions support:

1. Interfacing with VA’s Master Person Index (MPI) (formerly the Master Veteran Index (MVI)) to provision identity attributes, if the solution relies on VA user identities. MPI is the authoritative source for VA user identity data.

2. Interfacing with Capital Asset Inventory (CAI) to conduct real property record management actions, if the solution relies on real property records data. CAI is the authoritative source for VA real property record management data.

3. Interfacing with electronic Contract Management System (eCMS) for access to contract, contract line item, purchase requisition, offering vendor and vendor, and solicitation information above the micro-purchase threshold, if the solution relies on procurement data. ECMS is the authoritative source for VA procurement actions data.

4. Interfacing with HRSmart Human Resources Information System to conduct personnel action processing, on-boarding, benefits management, and compensation management, if the solution relies on personnel data. HRSmart is the authoritative source for VA personnel information data.

5. Interfacing with Vet360 to access personal contact information, if the solution relies on VA Veteran personal contact information data. Vet360 is the authoritative source for VA Veteran Personal Contact Data.

6. Interfacing with VA/Department of Defense (DoD) Identity Repository (VADIR) for determining eligibility for VA benefits under Title 38, if the solution relies on qualifying active-duty military service data. VADIR is the authoritative source for Qualifying active-duty military service in VA.

1.6.9 SOCIAL SECURITY NUMBER (SSN) REDUCTION

The Contractor solution shall support the Social Security Number (SSN) Fraud Prevention Act (FPA) of 2017 which prohibits the inclusion of SSNs on any document sent by mail. The Contractor support shall also be performed in accordance with Section 240 of the Consolidated Appropriations Act (CAA) 2018, enacted March 23, 2018, which mandates VA to discontinue using SSNs to identify individuals in all VA information systems as the Primary Identifier. The Contractor shall ensure that any new IT solution discontinues the use of SSN as the Primary Identifier to replace the SSN with the ICN in all VA information systems for all individuals. The Contractor shall ensure that all Contractor delivered applications and systems integrate with the VA Master Person Index (MPI) for identity traits to include the use of the ICN as the Primary Identifier. The Contractor solution may only use a Social Security Number to identify an individual in an information system if and only if the use of such number is required to obtain information VA requires from an information system that is not under the jurisdiction of VA.

1.7 SECURITY AND PRIVACY REQUIREMENTS

It has been determined that protected health information may be disclosed or accessed and a signed Business Associate Agreement (BAA) shall be required. The Contractor shall adhere to the requirements set forth within the BAA, referenced in Section D of the contract, and shall comply with VA Directive 6066.

1.7.1 POSITION/TASK RISK DESIGNATION LEVEL(S)

In accordance with VA Handbook 0710, Personnel Security and Suitability Program, the position sensitivity and the level of background investigation commensurate with the required level of access for the following tasks within the PWS are:

Position Sensitivity and Background Investigation Requirements by Task

The Tasks identified above and the resulting Position Sensitivity and Background Investigation requirements identify, in effect, the Background Investigation requirements for Contractor individuals, based upon the tasks the particular Contractor individual will be working. The submitted Contractor Staff Roster must indicate the required Background Investigation Level for each Contractor individual based upon the tasks the Contractor individual will be working, in accordance with their submitted proposal.

1.7.2 CONTRACTOR PERSONNEL SECURITY REQUIREMENTS

Contractor Responsibilities:

1. The Contractor shall prescreen all personnel requiring access to the computer systems to ensure they maintain the appropriate Background Investigation, and are able to read, write, speak, and understand the English language.

Within 3 business days after award, the Contractor shall provide a roster of Contractor and Subcontractor employees to the COR to begin their background investigations in accordance with the PAL template artifact. The Contractor Staff Roster shall contain the Contractor’s Full Name, Date of Birth, Place of Birth, individual background investigation level requirement (based upon Section 6.2 Tasks), etc. The Contractor shall submit full Social Security Numbers either within the Contractor Staff Roster or under separate cover to the COR. The Contractor Staff Roster shall be updated and provided to VA within 1 day of any changes in employee status, training certification completion status, Background Investigation level status, additions/removal of employees, etc. throughout the Period of Performance. The Contractor Staff Roster shall remain a historical document indicating all past information and the Contractor shall indicate in the Comment field, employees no longer supporting this contract. The preferred method to send the Contractor Staff Roster or Social Security Number is by encrypted e-mail. If unable to send encrypted e-mail, other methods which comply with FIPS 140-2 are to encrypt the file, use a secure fax, or use a traceable mail service.

1. The Contractor should coordinate with the location of the nearest VA fingerprinting office through the COR. Only electronic fingerprints are authorized. The Contractor shall bring their completed Security and Investigations Center (SIC) Fingerprint request form with them (see paragraph d.4. below) when getting fingerprints taken.

b. The Contractor shall ensure the following required forms are submitted to the COR within 5 days after contract award:

1)…