IAM MASTER PWS for RFI.docx

Identity and Access Management Enterprise and Sustainment Services

VA-24-00001896

TRANSFORMATION TWENTY-ONE TOTAL TECHNOLOGY NEXT GENERATION (T4NG)

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Office of Information & Technology Infrastructure Operations Identity and Access Management Enterprise and Sustainment Services

Date: December 8, 2023

VA-24-00001896

Task Order PWS Version Number: 0.1

Contents

BACKGROUND

The Department of Veterans Affairs (VA), Office of Information & Technology (OIT) strives to provide high quality, effective, efficient, and secure Information Technology (IT) services to those responsible for providing care and benefits to Veterans in an effective, timely and compassionate manner. VA depends on Information Management/Information Technology (IM/IT) systems to meet mission goals.

Identity and Access Management (IAM) is a suite of enterprise services hosted in the VA Enterprise Cloud (VAEC).

Identity Services (IdS) provide the VA business lines a service that:

1. Uniquely identifies all persons of interest.

2. Enables assignment of universal VA identifiers to service members

3. Facilitates data sharing between VA Lines of Business (LOB's) and external partners.

Access Services (AcS) provide VA business lines a service that:

1. Streamlines the granting and removing of electronic permissions to access VA technology systems, resources and data.

2. Ensures only authorized users are granted access; supports role-based/attribute-based and Single Sign-On (SSO) access.

3. Allows beneficiaries to use electronic or digital signatures.

4. Allows Veterans to receive a VA credential without having to appear at a VA facility.

IAM sustainment activities consists of those services necessary to support production and non-production enterprise services hosted in the IAM VAEC environments to include: system administration; maintenance support and updates required to sustain enterprise identity, authentication, and authorization services; integrations with consuming applications; and maintenance and support for IAM virtual hardware and software.

IAM services include the following:

1. VA Master Person Index (VA MPI)

a. Provides the authoritative enterprise service for Identity Management in VA.

b. Serves as an authoritative source for persons’ identity traits, known as the Primary View of Master Data for VA.

c. Provides initial VA/DoD identity correlation with external partners with probabilistic matching capabilities provided by the IBM Master Data Management (MDM) Commercial-Off-The-Shelf Product (COTS) product.

d. Validates VA person population against external identity data services.

e. Maintains a record locator service for all client records known in VA.

f. Provides the identity resolution tools for the enterprise to address any integrity or linkage issues.

g. Supports Identity theft flagging.

2. Provisioning - Provides enterprise workflows that automate: the on and off-boarding approval process, sharing of on and off-boarding data, and granting and removal of application privileges.

3. Authorization Management Service (AMS) - Provides enterprise service for managing creation, activation, revocation, and acceptance of Veteran authorization/delegation of permissions for another user to access to their data.

4. Single Sign-On Internal (SSOi) - Provides secure enterprise sign-on for internal users such as employees, contractors, affiliates, and volunteers.

5. Single Sign-On External (SSOe) - Provides secure enterprise federated sign-on for external users such as Veterans, beneficiaries, and Veteran Service Officers (VSO) accessing VA applications.

6. Veteran Health Identification Card (VHIC) - Issues health identification cards for use at VA medical facilities to streamline the appointment check-in process. VHIC also serves as the system of record for Veteran photographs.

7. Compliance Auditing and Reporting (CAR) - Provides enterprise service for auditing, reporting and monitoring enabled applications to adhere to Government Authentication and Authorization Policies and Regulations.

IAM services are hosted in the VAEC in the Microsoft Azure Government (MAG) Cloud. VAEC environments are configured to support a minimum of 99.9% availability for each of the IAM services listed above. The VAEC environments IAM supports in the Eastern and Central Time zones include:

1. Development (Dev) Environment - Supports IAM development of code of required enterprise functionality and integrations.

2. Integrated Development Environment (iDEV) - Supports initial functionality and connectivity testing for integrations with consuming applications.

3. Software Quality Assurance (SQA) - Supports software quality assurance and regression testing of code and configuration released from development.

4. Pre-Production (PreProd) - Supports User Acceptance Testing (UAT) and performance testing.

5. Production (Prod) - Supports production operations.

6. Disaster Recovery (DR) - Supports DR operations.

APPLICABLE DOCUMENTS

The Contractor shall comply with the following documents, in addition to the documents in Paragraph 2.0 in the T4NG Basic Performance Work Statement (PWS), in the performance of this effort:

1. Authorization Requirements Standard Operating Procedures, Version 1.55, October 13, 2023.

2. Federal Risk and Authorization Management Program (FedRAMP), “FedRAMP Standard Contractual Clauses”, June 2012.

3. Presidential Decision Directive 63 and National Institute of Standards and Technology (NIST) Special Publication 800-34 Rev 1, “Contingency Planning Guide” for Federal Information Systems”

4. CyberSecurity & Infrastructure Security Agency (CISA) website located at: https://www.cisa.gov/uscert/incident-notification-guidelines.

5. Veterans Affairs Enterprise Architecture (http://www.ea.oit.va.gov/)

6. IAM Conceptual Architecture

7. IAM Design and Architecture Management Plan, April 2021

8. IAM-VAEC Configuration Management Plan, Version 3.0, June 2011

9. IAM Playbooks

10. IAM Business Requirements Document (BRD), June 19, 2019

11. IAM Master Glossary

12. COTS Product Roadmap

13. IAM Requirements Backlog

14. Your IT Service Portal Quick Reference Guide

15. Information Technical Service Management (ITSM) Tool Quick Start Guide

16. Monthly Status Report Template

17. User Guide-Example

18. AcS Application Integration Summary Form

19. After Actions Report Template

20. VA OIT Change Control SOP

21. Standard Change Process

22. IAM Requirements Traceability Matrix (RTM) of Released Functionality

23. VA Enterprise Cloud (VAEC) Technical Reference Guide, Version 2.0, November 2022

24. VA Directive and Handbook 6510, Identity and Access Management, January 2016

25. Business Associate Agreement (BAA)

26. Identity Verification Interface Control Document (ICD)

SCOPE OF WORK

The requirements identified in this Performance Work Statement (PWS) are intended to support current and future projects within the Identity and Access Management program.

The VA is seeking a Contractor that will be responsible to provide project management for the entirety of the effort and solution, Commercial of the Shelf (COTS) enterprise service delivery, identity verification services, consuming application integration/enablement, system administration, sustainment support, operation and maintenance services, and network and resource monitoring for the IAM services stated in Section 1.0 in order to provide a complete and managed services solution. Specifically, the Contractor will provide the following services and functions:

1. Maintain the current IAM solution and provide customization and development as needed to support the requirements in the Requirements Traceability Matrix (RTM) and backlog.

2. Follow the Agile Methodology, as defined within the Process Access Library (PAL) established by OIT and follow the Lifecycle (described in Section 5.3, including all subparagraphs, of this PWS). The development builds shall consist of various sizes to meet the business needs as identified in the prioritized Product Backlog.

3. Maintain the current solution (Experian Precise ID) that provides Identity Verification Services to verify VA MPI identities and provide VA with information (data feeds and reports) related to potential matches, non-matches, duplicates and updates of identity information.

4. Provide post deployment support and sustainment for the IAM services developed under this TO and all existing IAM services that have been developed and are currently supported in all IAM VAEC Production Environments.

5. Provide System Administration, Incident Response and Information Assurance, Operation and Maintenance, and System Monitoring for all IAM VAEC environments. Specifically, the Contractor will: manage IAM application hardware, monitor and tune resource utilization, allocate resources to development teams, administer virtual servers, oversee backups, perform COTS installation and configuration, patch management to include security patching (server, application, and security), Operating System (O/S) patching, and daily operations tasks required to sustain IAM Services and functionality in production, access management, certificate management, Information Assurance, remedy security vulnerabilities, IP management, system performance management, project work scheduling, documentation management and perform operating system administration for the above cited VAEC environments.

6. Work with VAEC Operations to manage application access, virtual servers, virtual hosts, memory, disk storage provisioning, networking, installation of COTS products, monitoring, tuning, certificate management and installation of patch deployment/upgrades.

7. Implement IAM application functionality in all IAM VAEC environments.

In addition, through Optional Task execution, the Contractor will provide: support for additional enterprise service capabilities/features enhancements, per Section 5.8; support identity and access management services application integration, per Section 9; extended hours for the lower environments, per section 5.10; Batch Identity Verification, per Section 5.11; and transition support to include the transfer of knowledge and information at the end of the Task Order (TO), per Section 5.12.

APPLICABILITY

This TO effort PWS is within the scope of the following paragraph(s) of the T4NG Basic PWS:

1. 4.1 Program Management, Strategy, Enterprise Architecture and Planning Support

a. 4.1.1 Strategy and Planning

b. 4.1.4 Technology Refresh and Configuration Reviews

c. 4.1.5. Studies and Analyses

d. 4.1.8 IT Services Management Support

2. 4.2 Systems/Software Engineering

a. 4.2.1 Design, Develop and Configure

b. 4.2.2 Architecture Development

c. 4.2.3 IT Service Management Implementation

d. 4.2.4 Enterprise Application/Services

e. 4.2.6 Web Application Design and Development

f. 4.2.9 System/Software Integration

g. 4.2.12 Engineering and Technical Documentation

h. 4.2.14 Development Toolkit Support

3. 4.4 Test and Evaluation (T&E)

4. 4.8 Operations and Maintenance (O&M)

a. 4.8.1 Systems/Network Administration

b. 4.8.2 Application Support

c. 4.8.3 Hardware Support

d. 4.8.4 Security Management

e. 4.8.5 Disaster Recovery (DR) and Continuity of Operations (COOP)

f. 4.6.6 Capacity/Availability Planning and Management

g. 4.6.10 Database and Data Warehouse Administration

5. 4.9 Cyber Security

a. 4.9.1 Information Assurance

b. 4.9.2 Logical Security

c. 4.9.3 Assessment and Authorization

d. 4.9.4 Security Operating Support

ORDER TYPE

The effort shall be proposed on a Firm Fixed Price (FFP) basis with a Cost Reimbursable travel line item.

PERFORMANCE DETAILS

PERFORMANCE PERIOD

The period of performance (PoP) shall be for one 12-month Base Period and four 12-month option periods, if exercised. The PoP also includes five optional tasks to be exercised at the Government’s discretion. The total PoP shall not exceed 60 months.

5.4 Sustainment

5.5 IAM System Administration Support

5.6 IAM Operations and Maintenance Support

(List above includes all sub-paragraphs)

These Optional Tasks may be exercised at any time during the Base Period or Option Periods 1-4.

5.7 Additional Enterprise Service Capabilities / Features / Enhancements (Optional Task A)

5.2.1 IAM Enterprise Services Capabilities

5.2.2 IAM Data Repositories

5.3 Enterprise Service Delivery Lifecycle

(List above includes all sub-paragraphs)

These Optional Tasks may be exercised at any time during the Base Period or Option Periods 1 - 4.

5.8 IAM Services Application Integration (Optional Task B), including all subparagraphs.

PLACE OF PERFORMANCE

Efforts under this TO shall be performed at Contractor facilities, remote locations or at VA facilities. The Contractor shall identify the Contractor’s place of performance in their Task Execution Plan submission.

The Contractor shall provide after hours and weekend support, as needed, for the system and development support tasks listed in Sections 5.3.2 Release and Deployment, 5.6 System Administration Support, 5.7 IAM Operations and Maintenance Support, 5.9 IAM Services Application Integration (Optional Task B), if exercised, and 5.10 Extended Hours for Lower Environment Operational Support (Optional Task C), if exercised.

TRAVEL OR SPECIAL REQUIREMENTS

The Government anticipates travel to perform the tasks associated with the effort, as well as to attend program-related meetings or conferences and conduct site visits to IAM VAEC data centers throughout the PoP. Travel to Washington DC, Austin, Texas, Hines, Illinois and Orlando, Florida would typically involve program-related meetings. Travel shall be on a cost reimbursable basis and in accordance with the Federal Travel Regulations (FTR) and shall require advanced concurrence by the Contracting Officer’s Representative (COR). Contractor travel within the local commuting area will not be reimbursed. Local commuting area is defined as within 50 miles of the location of performance.

CONTRACT MANAGEMENT

All requirements of Sections 7.0 and 8.0 of the T4NG Basic PWS apply to this effort. This TO shall be addressed in the Contractor’s Progress, Status and Management Report as set forth in the T4NG Basic contract.

GOVERNMENT FURNISHED PROPERTY

The Government has multiple remote access solutions available to include Citrix Access Gateway (CAG), Site-to-Site Virtual Private Network (VPN), and RESCUE VPN.

The Government’s issuance of Government Furnished Equipment (GFE) is limited to Contractor personnel requiring direct access to the network to: development environments; install, configure and run Technical Reference Model (TRM) approved software and tools (e.g., Oracle, WebLogic); upload/download/ manipulate code, run scripts, and apply patches; configure and change system settings; check logs, troubleshoot/debug, and test/QA.

When necessary, the Government will furnish desktops or laptops, for use by the Contractor to access VA networks, systems, or applications to meet the requirements of this PWS. The overarching goal is to determine the most cost-effective approach to providing needed access to the VA environment coupled with the need to ensure proper Change Management principles are followed. Contractor personnel shall adhere to all VA system access requirements for on-site and remote users in accordance with VA standards, local security regulations, policies, and rules of behavior. GFE shall be approved by the COR and Program Manager on a case-by-case basis prior to issuance.

Based upon the Government assessment of remote access solutions and requirements of this TO, the Government estimates that the following GFE will be required by this effort:

1. 90 Developer laptops

2. 40 Standard laptops

The Government will not provide IT accessories including but not limited to Mobile Wi-Fi hotspots/wireless access points, additional or specialized keyboards or mice, laptop bags, extra charging cables, extra Personal Identity Verification card readers, peripheral devices, or additional Random Access Memory (RAM). The Contractor is responsible for providing these types of IT accessories in support of this effort as necessary and any VA installation required for these IT accessories shall be coordinated with the COR.

The Status of Government Furnished Equipment Report under the T4NG Basic Contract requirements is applicable to this TO and shall be delivered to the COR/VA PM as required.

Additionally, the Contractor shall provide a status of all reportable GFE as part of the IO Monthly Status Report as required by PWS paragraph 5.1. For purposes of this report, reportable GFE includes equipment that is furnished by the Government as tangible “personal” property which the Contractor takes possession of, physically leaves a government facility, and needs to be returned the end of Contractor performance. The following information shall be provided for each piece of GFE:

1. Name of contractor employee assigned to the GFE

2. Type of Equipment (Make and Model)

3. Tracking Number/Serial Number

4. VA Bar Code

5. Location

6. Value

7. Total Value of Equipment

8. Anticipated Transfer Date to Government

9. Anticipated Transfer Location The Government will provide access to VA’s Jira instance to provide a single Agile product application lifecycle management toolset to track execution details after contractors complete the training as required in Section 5.1.4. To access VA’s Jira tools, the Contractor will require VA access. If the mandated toolset changes throughout the PoP of this TO, then VA will provide access to the new toolset.

Personal Identification Verification (PIV) Cards will be issued to all contract staff and must be utilized for secure authentication and access to the VA network.

Additionally, the government shall provide: cloud capacity in and connectivity to the VA Enterprise Cloud (VAEC) environments; VA Enterprise Cloud Operational Tools (VAECOT) comprised of a suite of COTS cloud management tools as identified in the VAEC Technical Reference Guide; and Enterprise Development Environment (EDE) and Tools as identified in the VAEC Technical Reference Guide.

GOVERNMENT FURNISHED DOCUMENTATION

The Contractor shall be provided access to the following IAM documentation upon award.

1. Identity Management ToolKit User Manual

2. Access Services User Manual

3. Access to VA Project Management Tools and Repositories including:

a. PAL

b. Jira or VA-approved tool

c. Project or VA-approved tool

4. IAM Integration Guide

5. IAM Schedule Guide

6. IAM Development Guide

7. AcS Developers Guide

8. Requirements Specifications Document (RSD)

9. VA MPI Service Description Document

10. VA MPI System Design Document (SDD)

11. VHIC SDD

12. AcS SDD

13. IAM Governance Guide

14. IAM VA MPI Integration Patterns Document

15. IAM Access Services Playbooks

16. System Security Plan(s)

17. IAM Identity Services User Interface Style Guide

18. VA MPI Business Rules

19. Disaster Recovery Plan

20. System Documentation associated with software

21. Accreditation Requirements Guide SOP v.2.2

22. Procedural manuals, operating instructions and guidelines related to the Management and System Administration, and Operation and Maintenance Support

23. Production Deployment Plan

24. List of transferable software licenses

25. IAM Reference Architecture

26. VA eMASS Authorization Requirements SOP

27. Access to VA monitoring tools such as SPLUNK, AppsDynamic, Dynatrace and Enterprise Command Operations (ECO) Dashboard.

28. Existing system install guides, configuration guides, and user manuals.

29. Release Install and Backout Rollout Plan

30. IAM SharePoint site access

31. VA Account and Network Access (Virtual Private Network (VPN), or Citrix Access Gateway

32. Cloud capacity in and connectivity to the VA Enterprise Cloud (VAEC) environments

33. VA Enterprise Cloud Operational Tools (VAECOT) comprised of a suite of COTS cloud management tools as identified in the VAEC Technical Reference Guide

34. Enterprise Development Environment (EDE) and Tools as identified in the VAEC Technical Reference Guide

SECURITY AND PRIVACY

All requirements in Section 6.0 of the T4NG Basic PWS apply. Specific TO requirements relating to Addendum B, Section B.4.0 paragraphs j and k supersede the corresponding T4NG Basic PWS paragraphs, and are as follows:

i. The vendor shall notify VA within 1 hour of the discovery or disclosure of successful exploits of the vulnerability which can compromise the security of the Systems (including the confidentiality or integrity of its data and operations, or the availability of the system). Such issues shall be remediated as quickly as is practical, but in no event longer than 3 days.

j. When the security fixes involve installing third party patches (such as Microsoft OS patches or Adobe Acrobat), the vendor will provide written notice to VA that the patch has been validated as not affecting the Systems within 10 working days. When the vendor is responsible for operations or maintenance of the Systems, they shall apply the Security Fixes as part of the monthly maintenance release.

All requirements in Section 6.0 of the T4NG Basic PWS apply. Addendum B requirements have been tailored to reflect the security and privacy requirements of this specific TO.

It has been determined that protected health information may be disclosed or accessed and a signed Business Associate Agreement (BAA) shall be required. The Contractor shall adhere to the requirements set forth within the BAA, referenced in Section D of the Request for Task Execution Plan (RTEP) and shall comply with VA Directive 6066.

In accordance with VA Handbook 0710, Personnel Security and Suitability, the position sensitivity, and the level of background investigation commensurate with the required level of access for the following tasks within the PWS are:

Position Sensitivity and Background Investigation Requirements

The Tasks identified above and the resulting Position Sensitivity and Background Investigation requirements identify, in effect, the Background Investigation requirements for Contractor individuals, based upon the tasks the particular Contractor individual will be working. The submitted Contractor Staff Roster must indicate the required Background Investigation Level for each Contractor individual based upon the tasks the Contractor individual will be working, in accordance with their submitted proposal.

SPECIFIC TASKS AND DELIVERABLES

The Contractor shall perform the following:

PROJECT MANAGEMENT

The Contractor shall follow PAL to support frequent delivery of new functionality to customers. The Contractor shall deliver all artifacts in support of PAL requirements at several intervals and milestones. The Contractor shall execute monitoring and reporting on project performance under PAL and coordinate and provide support with the Government leadership to plan, conduct, and document a variety of Program technical and management reviews.

CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, timeline and tools to be used in execution of this TO effort. The current VA tool set for project schedules are provided by Microsoft Project and release/scheduling calendars utilize Jira. The CPMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks and resource support. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPMP shall be concurred upon and updated in accordance with Section B of the TO. The Contractor shall update and maintain the VA Program Manager (PM) approved CPMP throughout the PoP. The CPMP shall include the following:

1. The Quality Assurance (QA) Plan section of the CPMP shall serve as the foundation upon which the Master Test Plan will be based. The Contractor shall describe the overall approach to QA activities for the project but shall not include specific testing. This QA Plan shall document how testing will occur, not what will be tested. This plan shall document how the Contractor defines, implements, and assures quality for all project deliverables. System Assurance, including testing of software code, shall be documented in the Master Test Plan.

2. The Configuration Management Plan section of the CPMP shall describe the process for identifying configuration items (such as documentation and source code), placing them under Configuration Management control, and maintaining them under Configuration Management control.

3. The System Communication Management Plan section of the CPMP shall describe the processes that will be used to ensure timely and appropriate generation, collection, dissemination, storage, and ultimate disposition of project information (to include processes for the dissemination of information regarding system outages and updates and/or fixes). The processes should provide the links between stakeholders, ideas, and information that will be necessary for project success. The Communication Management Plan component of the CPMP shall identify processes for ensuring succinct, responsive, and timely messaging during critical events or issues that may be encountered by the project.

4. Provide detail in the CPMP as to how the Contractor will manage staff, schedule and quality. The initial baseline CPMP shall be approved by the COR and updated in the next Build. The Contractor shall provide adequate development support staffing that mitigates resource dependencies/conflicts and ensures development, sustainment, and integration work is properly supported.

Deliverable:

A. Contractor Project Management Plan (CPMP)

REPORTING REQUIREMENTS

Infrastructure Operations (IO) Management The Contractor shall use the VA’s implementation of Jira or other VA-approved tool to track execution details of Agile product lifecycle management. Jira will be used to provide a single authoritative product data and artifact repository. The Contractor shall manage all project data and artifacts in this data and artifact repository daily. All checked out artifacts shall be checked back in daily and any data updated daily. Jira synchronizes all changed information immediately for all team members to access work without the concern of working on aged information.

The Contractor shall use Jira to:

1. Input and manage scheduled product sprints and backlog.

2. Input and manage epics, user stories, and requirements.

3. Input and manage product risks and issues.

4. Input and manage product configurations, changes and releases.

5. Input and manage product test plans and execution.

6. Input and manage product planning and engineering documentation.

7. Input and manage linkages between requirements, code, tests and defects to correlate requirements to change orders to configurable items to risks, impediments, and issues to test cases and test results to show full traceability.

The Contractor shall enter all Agile requirements, changes, tests performed and test results in Jira to show evidence of code coverage and test coverage of all the requirements specified. This will allow VA to have high confidence in a fully documented requirement, as evidenced by data in the tools and requirements traceability matrix.

IO Monthly Status Report The Contractor shall deliver IO Monthly Status Reports detailing the status of all work efforts. These reports shall provide accurate, timely, and complete project information supporting IO reporting Requirements. The IO Monthly Status Report shall include the following data elements:

1. Project Name and Contract/TO Name.

2. Overview and description of the Contract/TO Name.

3. Overall high-level assessment of Contract/TO Name progress.

4. All work in-progress and completed during the reporting period.

5. Identification of any Contract/TO Name related issues uncovered during the reporting period and especially highlight those areas with a high probability of impacting schedule, cost or performance goals and their likely impact on schedule, cost, or performance goals.

6. Explanations for any unresolved issues, including possible solutions and any actions required of the Government and/or Contractor to resolve or mitigate any identified issue, including a plan and timeframe for resolution.

7. Status of previously identified issues, actions taken to mitigate the situation and/or progress made in rectifying the situation.

8. Work planned for the subsequent two reporting periods, when applicable.

9. Current Contract/TO Name schedule overlaid on original Contract/TO Name schedule showing any delays or advancement in schedule.

10. Workforce staffing data showing all Contractor personnel performing on the effort during the current reporting period. After the initial labor baseline is provided, each Monthly IO Status Report shall identify any changes in staffing identifying each person who was added to the contract or removed from the contract.

11. Inventory of GFE.

12. Original schedule of deliverables and the corresponding deliverables made during the current reporting period.

13. Identification of a single Contractor Onboarding POC, the names of all personnel engaged on the task, their initial training date for VA Privacy and Information Security training, and their next required training date.

14. SLA Status Report.

15. Security and operational incident response exercise outcomes.

16. Summary of security findings by application and by environment.

17. Summary of security remediation by applications and by environment.

18. Summary of problems within the environments from the prior month.

19. Summary of (COTS product and OS) patches applied.

20. Configuration Management Status Updates, Engineering Change Updates, and Risk Ledger updates as attachments or addendums to the Monthly Progress Report.

21. DR test results (Performed as full non-virtual DR test).

22. Failover test results (Performed as full non-virtual Failover test).

These reports shall not be the only means of communication between the Contractor, COR and the VA Program/Project Manager to advise of performance/schedule issues and to develop strategies for addressing the issues. The Contractor shall continuously monitor performance and report any deviation from the CPMP or previous Monthly IO Status Report to the COR and VA Program/Project Manager during routine, regular communications.

Deliverable:

A. IO Monthly Status Report

TECHNICAL KICKOFF MEETING

A technical kickoff meeting shall be held within 10 business days after TO award. The Contractor shall coordinate the date, time, and location (can be virtual) with the Contracting Officer (CO), as the Post-Award Conference Chairperson, the VA PM(s), Information System Owner (SO), as Co-Chairpersons, the Contract Specialist (CS), and the COR. The Contractor shall provide a draft agenda to the CO and VA PM at least five (3) calendar days prior to the meeting. Upon Government approval of a final agenda, the Contractor shall distribute to all meeting attendees. During the kickoff-meeting, the Contractor shall present, for review and approval by the Government, the details of the intended approach, work plan, and project schedule for each effort via a Microsoft Office PowerPoint presentation. At the conclusion of the meeting, the Contractor shall update the presentation with a final slide entitled “Summary Report” which shall include notes on any major issues, agreements, or disagreements discussed during the kickoff meeting and the following statement “As the Post-Award Conference Chairperson, I have reviewed the entirety of this presentation and assert that it is an accurate representation and summary of the discussions held during the Technical Kickoff Meeting for the Identity and Access Enterprise and Sustainment Services Contract. The Contractor shall submit the final updated presentation to the CO for review and signature within three (3) calendar days after the meeting. The Contractor shall also work with the CS, the Government’s designated note taker, to prepare and distribute the meeting minutes of the kickoff meeting to the CO, COR and all attendees within three (3) calendar days after the meeting. The Contractor shall obtain concurrence from the CS on the content of the meeting minutes prior to distribution of the document.

JIRA AND SERVICE NOW TOOLS AND TRAINING

The Contractor and VA PM shall determine which team members require access to Jira and Service NOW (SNOW). All Contractors that require access shall complete all of the following VA Talent Management System (TMS) training courses within seven (7) business days of the identification of the access need to be able to successfully manage the project and data in the Jira:

1. Leveraging the Jira Platform for Development Projects.

2. Jira Cloud: Creating & Setting Up Project.

3. Jira Cloud: Planning & Working on a Software Project.

4. Development and Testing with Agile: Project Management.

5. Jira Cloud: Configuring & Managing Boards.

6. Jira Cloud: Reporting in Jira Software.

SNOW Courses, which are designated by role, include the following:

1. your IT Service Portal – All users.

2. Service Request – All users.

3. Configuration Management Database (CMDB) – All users who access CMDB applications.

4. Change Enablement – All users who access Change Module and Change Enablement stakeholders.

5. Visual Task Boards (VTB) – All users who use/create VTB.

Contractors who have completed these VA training courses and have furnished valid certificates will not be required to re-take the training courses.

Deliverable:

A. Jira and Service NOW Training Certificates

PRIVACY & HIPAA TRAINING

The Contractor shall submit TMS Training Certificates of completion for VA Privacy and Information Security Awareness, Rules of Behavior and Health Insurance Portability and Accountability Act (HIPAA) training. The Contractor shall complete the Contractor Rules of Behavior in the Talent Management System (TMS). The Contractor shall submit status of VA Privacy and Information Security Awareness training for all individuals engaged on the task.

In addition, all personnel requiring elevated privileges shall complete training as required by TMS and submit certificates.

Deliverables:

A. TMS Training Certificates B. Signed Rules of Behavior

ONBOARDING

The Contractor shall manage the onboarding of its staff. Onboarding includes steps to obtain a VA network and email account, complete training, initiate background investigations, and gain physical and logical access, which may include elevated privileges to the necessary VAEC environments for the various systems to be enhanced.

A single Contractor Onboarding POC responsible to track the onboarding status of all Contractor personnel shall be designated by the Contractor at the kick-off meeting. The Contractor Onboarding POC shall be responsible for accurate and timely submission of all required VA onboarding paperwork to the COR. The Contractor shall be responsible for tracking the status of all its staff’s onboarding activities and report the status at the staff level during onboarding status meetings. The Contractor shall provide a Monthly Onboarding Status Report for any staff with outstanding onboarding requests for review by the COR, VA PM and Project Manager.

Deliverable:

A. Onboarding Status Report

SCHEDULE MANAGEMENT

The Contractor shall create, maintain, analyze, and report integrated schedules. The schedules shall contain tasks with estimates not greater than 40 hours, with all predecessors, successors, and resources-leveled assignments. A schedule shall be developed for each build and sprint. The Contractor shall provide schedule updates on a weekly basis. The Build and Integrated Master Schedule shall be delivered monthly.

The Contractor shall provide an Integrated Master Schedule (IMS) for each Build to depict dependencies and relationships across each functional area. The Contractor shall provide a detailed project schedule for each functional area, as follows, but not limited to:

1. Identity Services

a. VA Master Person Index (VA MPI)

b. Veterans Health Identity Card (VHIC)

c. Provisioning

2. Access Services

a. VA Single Sign On

i. SSO internal (SSOi)

ii. SSO external (SSOe)

b. Compliance Auditing and Reporting (CAR)

c. Provisioning

d. Authorization Management Service (AMS)

3. System Administration

a. Operations and Maintenance

b. Monthly Security Patches

c. Authority to Operate (ATO) accreditation Deliverables:

A. Build Schedule and Integrated Master Schedule

PROGRAM RISK AND ISSUE MANAGEMENT

The Contractor shall conduct program risk and issue management of all work performed under this TO and provide input to the product Risk and Issue Management registry within Jira maintained by VA.

The Contractor shall:

1. Report, monitor, actively manage and mitigate risks and issues for each respective product.

2. Enter and update risks and issues in VA’s Risk and Issue Jira tool.

3. Provide the COR and VA PM a weekly Risk and Issue Management Status Report.

Deliverable:

A. Program Risk and Issue Management Status Report

CONFIGURATION MANAGEMENT

The Contractor shall:

1. Identify the standard and unique aspects of configuration management to be performed for each project by establishing a Configuration Management (CM) Plan which meets IO CM plan requirements. The Contractor shall reflect all CM required activities and standards in each project-level CM plan while determining the unique aspects of the project which require individualized procedures. Upon approval of the CM Plan, the Contractor shall provide weekly updates in a Configuration Management Report.

2. Provide a List of Configuration Items to be placed under configuration and change control, which shall be documented in the Configuration Management Plan. The Contractor shall identify types of configuration items pertaining to each product to be placed under configuration management. Based on IO requirements, and the unique needs or nature of each project, the Contractor shall determine the components within each project that must be under configuration control.

3. Participate in Change Control meetings to support reviews and recommend changes to authoritative project artifacts, software, and infrastructure. Review work items, provide input on technical feasibility of requests, provide technical Level of Effort (LOE) estimates, contribute expertise, and provide analysis of alternatives (AOA). Follow all Change Management processes and properly report any production changes through the appropriate change management review boards prior to production implementation. Implement changes upon VA approval.

4. Use Jira as the VA approved tool and repository for all software source code and electronic artifact configuration and version management. The Contractor shall use the Jira and SNOW tool to manage change, activity, issue, action, risk, and other project data as prescribed by VA standards and processes.

5. Ensure that all project software and non-software artifacts are versioned correctly in accordance with the approved Configuration Management Plan.

6. Create Project and Product Artifacts baselined and versioned in the Jira repository to allow the tool to show active and past histories of the check-ins and check-outs of all software components, data, and software product engineering documents. Maintain all baselines of software, software builds, and electronic artifacts in the repository, labeling updates and versions according to CM procedures.

7. Manage version control between COTS product(s) - (reference the COTS Product Roadmap-Attachment X), and IAM application software delivery to generate the Version Control Report to be included as an attachment to the Monthly IO Status Report (Section 5.1.2.2).

8. Establish and maintain status reporting on change and configuration management activity and ensure Jira data records and artifacts are filed and updated daily.

Deliverables:

A. Configuration Management Plan B. Configuration Management Report

IAM ENTERPRISE SERVICE DELIVERY

The Contractor shall maintain the current solution and provide solution modifications as needed to support the requirements in the Requirements Traceability Matrix (RTM) and backlog. The requirements may be satisfied by either an “out-of-the-box” capability, robust configuration capabilities to accommodate VA business requirements, or customized code.

The following sections identify the requirements associated with IAM and provide an overview of the support services required for success. The requirements associated with these efforts will be further identified in the IAM RTM and IAM backlog. Requirements will be prioritized by VA to determine the content of each build.

Identity Services (IdS) controls the assignment, maintenance, and sharing of unique identifiers and traits of persons within an identity domain. As VA incorporates multiple models of benefits delivery, including collaboration with Department of Defense (DoD) and external partners, it is critical that the identity of VA persons of interest are maintained. The IAM Identity Services provide a unique identifier for each VA identity of interest (Veteran, Beneficiary, Employee, Contractor, Partner, Health Care Provider, or Volunteer) that reduces duplication, reduces data quality issues, and improves interoperability across the enterprise and with external partners such as DoD. IdS’s role is to:

1. Uniquely identify VA persons of interest.

2. Provide a service-based correlation service.

3. Provide a single authoritative source for VA persons of interest.

4. Create a trusted identity between VA, DOD, and external partners.

5. Configure and integrate a probabilistic matching algorithm into Identity services to support Business auto-matching and review process requirements.

6. Enumerate and correlate data from VA internal or external systems into the VA Master Person Index (VA MPI).

7. Validate VA person population against external identity data services to notify of identity trait changes and potential identity theft cases.

8. Provide Identity proofing services of persons as an automated process for recording and storing person status and data.

9. Provide ongoing configuration and development services for Identity Management ToolKit.

10. Provide ongoing configuration and development services for Veteran’s Health Identification Card.

11. Provide ongoing configuration and development services for the Provisioning User Interface.

12. Provide ongoing configuration and development services for the Authorization Management Services solution.

13. Provide ongoing configuration and development services for Relationship Management.

Access Services (AcS) provides enterprise authentication and authorization services in support of VA’s internally and externally facing applications and consumers. The purpose for AcS services is to ease the burden on users, improve enterprise security and improve process efficiencies. AcS’s role is to:

1. Provide Single Sign-on functionality for internal users utilizing the Personal Identification Verification (PIV) card, Common Access Card (CAC), Active Directory (AD) or Windows Authentication.

2. Provide Single Sign-on functionality for external users with a credential issued by VA approved entities to be seamlessly authenticated into integrated partner applications.

3. Provide trusted credentials to persons of interest to VA.

4. Provide electronic or digital signatures to external users such as Veterans, Delegates, Beneficiaries, and VA Partners.

5. Automate processes, rules and procedures for creating, approving, granting and removing system access.

6. Provide the capability to manage access control policies and generate and enforce access control decisions.

7. Provide audit and reporting capability based on data made available to the Access Services.

8. Provide ongoing configuration and development services for Single Sign On internal (SSOi).

9. Provide ongoing configuration and development services for Single Sign On external (SSOe).

10. Provide ongoing configuration and development services for Electronic Signature (E-sig).

11. Provide ongoing configuration and development services for Provisioning (Prov).

12. Provide ongoing configuration and development services for Compliance Auditing and Reporting (CAR).

IAM ENTERPRISE SERVICES CAPABILITIES

The tasks and deliverables described in this Section and Section 5.3 shall be performed for each build and bundled together to comprise the activities and deliverables required to successfully complete each product build. The Contractor shall configure, enhance, test, deploy, maintain, and support enterprise services identified in Sections 5.3.1 through 5.3.2 with a minimum, service level availability of 99.9% for the relevant IAM Service(s) impacted.

This shall be done in a manner which preserves and enhances system performance, integrity, reliability, and stability and shall be done in accordance with an overall architecture that is standards-based and in accordance with the One-VA Technical Reference Model (One-VA TRM) and VAEC Technical Reference Architecture. Changes and implementation of VistA patches at the enterprise and/or local sites must follow the PAL guidance for development, reviews, quality assurance and production implementation. (Currently, it is estimated that 10% of the requirement changes require VA MPI and VistA patches, more frequently VA MPI enterprise patches. Typically changes for VA MPI enterprise patches are needed for each incremental release.)

Technologies currently utilized by the Identity and Access Services architecture consist of the following:

1. DataPower XML Security…