36C10B24Q0124.docx

VA Supply Chain Master Catalog (SCMC) Operations and Maintenance Support

VA-24-00003606

GENERAL INFORMATION

SET-ASIDE

Technology Acquisition Center

23 Christopher Way Eatontown NJ 07724

POINT OF CONTACT*

Contract Specialist Liliana Morales Liliana.Morales@va.gov 848-377-5207

PLACE OF PERFORMANCE

ADDRESS

POSTAL CODE

COUNTRY

ADDITIONAL INFORMATION

AGENCY’S URL

URL DESCRIPTION

AGENCY CONTACT’S EMAIL ADDRESS

EMAIL DESCRIPTION

DESCRIPTION

Request for Information VA Supply Chain Master Catalog (SCMC) Operations and Maintenance Support

VA-24-00003606

1. Introduction

This Request for Information (RFI) is for planning purposes only and shall not be considered an Invitation for Bid, Request for Task Execution Plan, Request for Quotation or a Request for Proposal. Additionally, there is no obligation on the part of the Government to acquire any products or services described in this RFI. Your response to this RFI will be treated only as information for the Government to consider. You will not be entitled to payment for direct or indirect costs that you incur in responding to this RFI. This request does not constitute a solicitation for proposals or the authority to enter into negotiations to award a contract. No funds have been authorized, appropriated or received for this effort. Interested parties are responsible for adequately marking proprietary, restricted or competition sensitive information contained in their response. The Government does not intend to pay for the information submitted in response to this RFI.

This action may be competed under the Transformation Twenty-One Total Technology Next Generation (T4NG) multiple award, indefinite delivery, indefinite quantity contract using fair opportunity procedures in accordance with Federal Acquisition Regulation (FAR) 16.505. However, other contract vehicles may be considered based on the responses received from this RFI.

Additionally, one of the purposes of issuing this RFI is to determine the availability of Small Business Administration (SBA) Veteran Small Business Certification (VetCert) verified Service-Disabled Veteran-Owned Small Businesses (SDVOSBs) and Veteran Owned Small Businesses (VOSBs) that may be capable of providing the services identified in the attached Performance Work Statement (PWS) However, an SDVOSB/VOSB company that is not VetCert registered and verified (https://veterans.certify.sba.gov/) should not respond to this notice.

The North American Industry Classification System (NAICS) for this requirement is 541512 with a size standard of $34 million.

2. Submittal Information:

All responsible sources may submit a response in accordance with the below information.

There is a page limitation for this RFI of ten (10) pages. The Government will not review any other information or attachments included, that are in excess of the ten (10) page limit. NO MARKETING MATERIALS ARE ALLOWED AS PART OF THIS RFI.

Generic capability statements will not be accepted or reviewed. Your response must address capabilities specific to the services required in the attached PWS and must include the following:

a. Interested Vendors shall at a minimum, provide the following information in the initial paragraph of the submission:

Name of Company Address Point of Contact Phone Number Fax Number Email address Company Business Size and Status For VOSB and SDVOSBs, proof of verification VetCert.

NAICS code(s) Socioeconomic data Data Universal Numbering System (DUNS) Number Existing Contractual Vehicles (GWAC, FSS, or MAC)

b. Provide a summary of your capability to meet the requirements contained within the draft PWS for the following areas:

1. A description of the resources and capabilities that your company can provide to accomplish the tasks and deliverables described within the PWS.

2. Describe your experience and expertise with the GHX Marketplace, the VA’s existing Software as a Service (SaaS) solution for its SCMC. Specifically, highlight your ability to provide the necessary Operations and Maintenance for VA’s current SCMC solution.

3. Describe your experience and expertise with development of Federal Risk and Authorization Management Program (FedRAMP) Authorization at a level (Low, Moderate, High) process.

4. A description of your capability of introducing new data sources and maintaining the current data in VA’s SCMC.

5. Provide examples of industry standard data attributes in your ‘Authoritative Sources’ to increase the quality and accuracy of VA data.

c. Corporate experience or expertise in performing these services and specific examples or references. Specific examples or references provided must include the agency, point of contact, dollar value, and contract number.

d. Your company’s intent and ability to meet the set aside requirement in accordance with VAAR 852.219-73 “VA Notice of Total Set-Aside for Certified Service Disabled Veteran-Owned Small Businesses” (JAN 2023)(DEVIATION), VAAR 852.219-75 “VA Notice of Limitations on Subcontracting – Certificate of Compliance for Services and Construction” (JAN 2023)(DEVIATION), and 13 CFR §125.6, which states the contractor will not pay more than 50 percent of the amount paid by the Government to it to firms that are not SDVOSBs. Your response shall include information as to available personnel and financial resources; full names of proposed team members and the PWS requirements planned to be subcontracted to them, which must include the prime planned percentage or the names of the potential team members that may be used to fulfill the set aside requirement.

e. Has the draft PWS provided sufficient detail to describe the technical requirements that encompass the software development and production operations support services to be performed under this effort.

______ YES _______ NO (if No, answer question f)

f. If “NO”, please provide your technical comments/recommendations on elements of the draft PWS that may contribute to a more accurate proposal submission and efficient, cost-effective effort.

Responses are due no later than 3:00PM EST on January 25, 2024, via email to Liliana Morales, Contract Specialist at Liliana.Morales@va.gov and Dana Newcomb, Contracting Officer at Dana.Newcomb@va.gov. Please note “VA Supply Chain Master Catalog (SCMC) Operations and Maintenance Support” in the subject line of your response. Mark your response as “Proprietary Information” if the information is considered business sensitive. The email file size shall not exceed 5 MB.

Sources Sought Notice Sources Sought Notice

Sources Sought Notice

TRANSFORMATION TWENTY-ONE TOTAL TECHNOLOGY NEXT GENERATION (T4NG)

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Supply Chain Data & Informatics Office (SCDIO) VA Supply Chain Master Catalog (SCMC) Operations and Maintenance Support

Date: January 10, 2024

TAC-24-0003606

Task Order PWS Version Number: 1.0

1.0 BACKGROUND

The Department of Veterans Affairs (VA) supply chain manages all aspects of the supply and equipment flow from identification through fulfillment. VA Supply Chain must track all VA medical commodities, prosthetic devices (to include durable medical equipment), expendable equipment, non-expendable, and non-clinical products on contract in VA. Currently, the VA’s supply chain is not integrated with other VA data systems/processes and is supported by multiple discrete/antiquated systems. This leads to incomplete and inadequate finance, inventory, and purchasing analytics making efficient supply chain management challenging. This makes it hard to efficiently manage the supply chain. These products and analytics need to be accessed by VA Supply Chain staff through a single interactive master catalog.

The Supply Chain Data and Informatics Office (SCDIO) manages the existing VA Supply Chain Master Catalog (SCMC), initiated in 2019. The SCMC provides an authoritative source for items and services on a VA contract, through the approved Software as a Service (SaaS) GHX Marketplace, previously Prodigo Marketplace. The SCMC is a searchable, user-friendly application for contracting, logisticians, clinicians, and their direct support staff to locate products and services on VA contracts. Additionally, contract and other non-public VA Supply Chain data is harmonized, enriched, and standardized, using the GHX Data Connect, and given back to VA to be hosted in a Structured Query Language (SQL) database. This data, along with other data sources are used to create tools, reports, and other efforts across VA. SCMC training has been provided to ~12,000 total users across the Enterprise. The VA plans to utilize the SCMC until it is replaced by a future Supply Chain Modernization solution.

The SCMC conducts weekly and monthly processes for new data ingestion and receives data outputs of raw and harmonized, enriched, and standardized data that go into the SQL database. The SCMC collects the new/modified contract data within Electronic Contract Management System (eCMS) and publishes that data in the GHX Marketplace, so users and stakeholders have the most updated information VA can provide. Part of the data output includes an Automated Data Extraction report that feeds the SQL database to support data analytics and shared across the Enterprise. The SCMC has achieved over 5,600 Users and 150,000+ Searches, the value to these Users is critical to ensure they have the most accurate and updated information.

2.0 APPLICABLE DOCUMENTS

The Contractor shall comply with the following documents, in addition to the documents in Paragraph 2.0 in the T4NG Basic Performance Work Statement (PWS), in the performance of this effort:

1. National Institute of Standards and Technology (NIST) Special Publication 800-144 – “Guidelines on Security and Privacy in Public Cloud Computing”.

2. NIST Special Publication (SP) 800-53 - “Security and Privacy Controls for Federal Information Systems and Organizations”.

3. NIST SP 800-53A - “Assessing Security and Privacy Controls in Federal Information Systems and Organizations: Building Effective Assessment Plans”.

4. VA Handbook 6500, “Risk Management Framework for VA Information Systems – VA Information Security Program,” February 24, 2021 (VA Publications).

5. VA Handbook 6517, “Risk Management Framework for Cloud Computing Services”, November 15, 2016.

6. Plan of Action and Milestones (POA&M) Management Guide.

7. Authorization Requirements SOP Guide.

8. Federal Information Processing Standards (FIPS) Publication 140-2, “Security Requirements For Cryptographic Modules”.

9. FIPS Pub 201-3, “Personal Identity Verification of Federal Employees and Contractors,” January 24, 2022.

10. 10 U.S.C. § 2224, "Defense Information Assurance Program".

11. Software Engineering Institute, Software Acquisition Capability Maturity Modeling (SA CMM) Level 2 procedures and processes.

12. 5 U.S.C. § 552a, “Records Maintained on Individuals”.

13. 42 U.S.C. § 2000d “Prohibition Against Exclusion From Participation in, Denial of Benefits of, And Discrimination Under Federally Assisted Programs on Ground of Race, Color, or National Origin”.

14. Department of Veterans Affairs (VA) Directive 0710, “Personnel Suitability and Security Program,” June 4, 2010.

15. VA Directive 6102, “Internet/Intranet Services,” August 5, 2019.

16. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and Guidelines,” August 28, 2023.

17. OMB Circular A-130, “Managing Information as a Strategic Resource,” July 28, 2016.

18. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed Services (CHAMPUS)” August 31, 2023.

19. NIST SP 800-66, Rev 1, “An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule”, October 23, 2008.

20. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended by the Workforce Investment Act of 1998 (P.L. 105-220), July 16, 1998.

21. Homeland Security Presidential Directive (12) (HSPD-12) “Policy for a Common Identification Standard for Federal Employees and Contractors”, Jan 27, 2022.

22. VA Directive 6500, “VA Cybersecurity Program”, February 24, 2021.

23. VA Handbook 6500.1, “Electronic Media Sanitization”, November 3, 2008.

24. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI)”, June 30, 2023.

25. VA Handbook 6500.3, “Certification and Accreditation of VA Information Systems”, November 24, 2008.

26. VA Handbook, 6500.5, “Incorporating Security and Privacy into the System Development Life Cycle”, March 22, 2010.

27. VA Handbook 6500.6, “Contract Security”, March 12, 2010.

28. Project Management Accountability System (PMAS) portal (reference PWS References -Technical Library at https://www.voa.va.gov/).

29. Technical Reference Model (TRM) (reference at https://www.voa.va.gov/).

30. National Institute Standards and Technology (NIST) Special Publications.

31. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment”, October 15, 2014.

32. VA Directive 6300, “Records and Information Management”, September 21, 2018.

33. VA Handbook, 6300.1, “Records Management Procedures”, March 24, 2010.

34. OMB Memorandum M-21-07, “Transition to Internet Protocol Version 6 (IPv6)”, November 19, 2020.

35. NIST SP 800-116, Rev 1, “Guidelines for the Use of PIV Credentials in Facility Access”, June 29, 2018.

36. OMB Memorandum M-07-16, “Safeguarding Against and Responding to the Breach of Personally Identifiable Information”, May 22, 2007.

37. NIST SP 800-63-A, “Digital Identity Guidelines”, March 02, 2020.

38. NIST SP 800-157, “Guidelines for Derived Personal Identity Verification (PIV) Credentials”, December 19, 2014.

39. VA Memorandum, VAIQ #7100147, Continued Implementation of Homeland Security Presidential Directive 12 (HSPD-12), April 29, 2011 (reference Enterprise Architecture Section, PIV / IAM https://www.voa.va.gov/).

40. VA Memorandum, VAIQ # 7100145, VA Identity Management Policy, June 28, 2010 (reference Enterprise Architecture Section, PIV/IAM https://www.voa.va.gov/).

41. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM https://www.voa.va.gov/)

3.0 SCOPE OF WORK

The Contractor shall provide all resources necessary to accomplish the tasks and deliverables described within this PWS to include operations and maintenance, assessment and authorization and continuous monitoring, and providing help desk support for VA’s existing SCMC which utilizes GHX Marketplace/Data Connect as the Software as Service (SaaS) solution. Introduction of new data sources and/or data is expected and included in the performance of Operations and Maintenance for the SCMC. Additionally, if the optional task is exercised, the contractor shall provide transition support and transition of assets.

The Contractor shall already have, or shall achieve, Federal Risk and Authorization Management Program (FedRAMP) Authorization at a level (Low, Moderate, High) commensurate to the security and privacy level of information processed, stored, and exchanged, by the proposed segment of the solution. While VA prefers a solution composed of applications where FedRAMP Authorization already exists, it will support sponsoring of new FedRAMP approvals and/or other necessary approvals should they be necessary.

3.1 APPLICABILITY

This Task Order (TO) effort PWS is within the scope of paragraph(s) 4.1.6 Program Management Support, 4.1.8 IT Services Management Support, 4.2.5 Cloud Computing, 4.8 Operations and Maintenance, 4.8.1 Systems/Network Administration, 4.8.7 Service/Help Desk/Call Center Support, 4.8.9 License Maintenance, 4.8.10 Database and Data Warehouse Administration, 4.10 Training of the T4NG Basic PWS.

3.2 ORDER TYPE

The effort shall be performed on a Firm-Fixed-Price basis.

4.0 PERFORMANCE DETAILS

4.1 PERFORMANCE PERIOD

The period of performance (PoP) shall be a 12-month base period with four, 12-month option periods to be exercised at the Government’s discretion. Additionally, this TO includes an Optional Task with a performance period of 60 days. The overall PoP of the TO shall not exceed 60 months.

4.2 PLACE OF PERFORMANCE

Efforts under this TO shall be performed at Contractor facilities. The Contractor shall identify the Contractor’s place of performance in their Task Execution Plan (TEP) submission.

4.3 TRAVEL OR SPECIAL REQUIREMENTS

The Government anticipates travel to perform the tasks associated with the effort, as well as to attend program-related meetings or conferences throughout the PoP. Include all estimated travel costs in the firm-fixed price line items. These costs will not be directly reimbursed by the Government. Microsoft Teams meetings shall be utilized whenever possible.

The total estimated number of trips per year in support of program related meetings for this effort is as detailed below:

4.4 CONTRACT MANAGEMENT

All requirements of Sections 7.0 and 8.0 of the T4NG Basic PWS apply to this effort. This TO shall be addressed in the Contractor’s Progress, Status and Management Report as set forth in the T4NG Basic contract.

4.5 GOVERNMENT FURNISHED PROPERTY

The Government has multiple remote access solutions available to include Citrix Access Gateway (CAG), Site-to-Site Virtual Private Network (VPN), and RESCUE VPN.

The Government’s issuance of Government Furnished Equipment (GFE) is limited to Contractor personnel requiring direct access to the network to: development environments; install, configure and run Technical Reference Model (TRM) approved software and tools (e.g., Oracle, Fortify, Eclipse, SoapUI, WebLogic, LoadRunner); upload/download/ manipulate code, run scripts, and apply patches; configure and change system settings; check logs, troubleshoot/debug, and test/QA.

When necessary, the Government will furnish desktops or laptops, for use by the Contractor to access VA networks, systems, or applications to meet the requirements of this PWS. The overarching goal is to determine the most cost-effective approach to providing needed access to the VA environment coupled with the need to ensure proper Change Management principles are followed. Contractor personnel shall adhere to all VA system access requirements for on-site and remote users in accordance with VA standards, local security regulations, policies, and rules of behavior. GFE shall be approved by the COR and Program Manager on a case-by-case basis prior to issuance.

Based upon the Government assessment of remote access solutions and requirements of this TO, the Government estimates that the following GFE will be required by this TO:

1. Up to five laptops

The Government will not provide IT accessories including but not limited to Mobile Wi-Fi hotspots/wireless access points, additional or specialized keyboards or mice, laptop bags, extra charging cables, extra Personal Identity Verification card readers, peripheral devices, or additional Random Access Memory (RAM). The Contractor is responsible for providing these types of IT accessories in support of the TO as necessary and any VA installation required for these IT accessories shall be coordinated with the COR.

The Status of Government Furnished Equipment Report under the T4NG Basic Contract requirements is applicable to this TO and shall be delivered to the COR/VA PM as required.

Government Furnished Information modified, updated, revised, or changed in any manner by the Contractor during performance of the contract is Technical Data as that term is used in FAR 52.227-14, Rights in Data—General (May 2014) and VA shall receive unlimited rights to all such data.

All data, and all data elements, as well all data reference artifacts (to include, but not limited to, data dictionaries, data flow diagrams, algorithms & models, data mappings, and business logic) first produced by the Contractor during performance of this contract contained in the Contractor’s data reports, Contractor’s databases, and in the Contractor’s systems provided to VA in support of SCM shall be deemed technical data as that term is defined in FAR 52.227-14, Rights in Data—General (May 2014) and VA shall receive unlimited rights to all such data.

At the conclusion of the contract, Contractor shall return to VA in a format acceptable to VA all data, including but not limited to the Government Furnished Information and technical data, entered into and processed by the Contractor in performance of this Contract in order that such data can be used, stored, understood, and/or maintained by the Government or a third party at VA’s request.

The Contractor shall deliver to VA all data first produced under the specified Task Orders with unlimited rights as those terms are defined by and in accordance with FAR 52.227-14.

The parties agree that the technical data generated, stored, and processed by the Contractor pursuant to this Contract may contain both Sensitive Information and identifiable health information or personal health information of Veterans such that the disclosure thereof would violate the right of privacy or publicity of the individual to whom the information relates or the right of privacy and publicity of VA. Accordingly, the Contractor relinquishes its reservation of rights set forth in FAR 52.227-14(b)(2) for all technical data delivered to the Contracting Officer at the conclusion of this contract.

4.6 SECURITY AND PRIVACY

All requirements in Section 6.0 of the T4NG Basic PWS apply. Addendum B requirements have been tailored to reflect the security and privacy requirements of this specific TO.

4.6.1 POSITION/TASK RISK DESIGNATION LEVEL(S)

In accordance with VA Handbook 0710, Personnel Security and Suitability Program, the position sensitivity, and the level of background investigation commensurate with the required level of access for the following tasks within the PWS are:

Position Sensitivity and Background Investigation Requirements by Task

The Tasks identified above, and the resulting Position Sensitivity and Background Investigation requirements identify, in effect, the Background Investigation requirements for Contractor individuals, based upon the tasks the Contractor individual will be working. The submitted Contractor Staff Roster must indicate the required Background Investigation Level for each Contractor individual based upon the tasks the Contractor individual will be working, in accordance with their submitted proposal.

5.0 SCMC SPECIFIC TASKS AND DELIVERABLES

Please see the attached: Attachment A-VALIP Architecture, Attachment B-HELM Data Fabric Overview, and Attachment C- Authorization Requirements SOP

The Contractor shall complete the specified tasks and provide the deliverables described below:

5.1 PROJECT MANAGEMENT

5.1.1 CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, timeline, and tools to be used in execution of this TO effort. The CPMP shall have both a narrative and graphic format that displays the configuration schedule, milestones, risks, and resource support. The CPMP shall also include a description of how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPMP shall be concurred upon and updated in accordance with Section B of the TO. The Contractor shall update and maintain the Contracting Officer Representative (COR) and the VA Program Manager (PM) approved CPMP throughout the PoP. The Contractor shall follow a VA approved framework. The Contractor shall provide an Interface Control Document (ICD) describing the relationship between the SCMC solution and the Department of Veterans Affairs (VA) in terms of data exchange, messages passed, protocols observed, interaction between a user and system, and software components, to include current and future VA systems and software.

Deliverables:

A. Contractor Project Management Plan (CPMP) B. Interface Control Document (ICD)

5.1.2 REPORTING REQUIREMENTS

The Contractor shall provide the COR with Weekly Progress Reports in electronic form in Microsoft Word, Project, or similar formats. The report shall include detailed instructions/explanations for each required data element, to ensure that data is accurate and consistent. These reports shall reflect data as of the last day of the preceding week.

The Weekly Progress Reports shall cover all work completed during the reporting period and work planned for the subsequent reporting period. The report shall also identify any problems that arose and a description of how the problems were resolved. If problems have not been completely resolved, the Contractor shall provide an explanation including their plan and timeframe for resolving the issue. The report shall also include an itemized list of all Electronic and Information Technology deliverables and their current Section 508 conformance status. The Contractor shall monitor performance against the CPMP and report any deviations. It is expected that the Contractor will keep in communication with VA accordingly so that issues that arise are transparent to both parties to prevent escalation of outstanding issues.

The Weekly Progress Report is designed to identify the effect of any issues on the project timeline and meeting minutes.

Deliverable:

A. Weekly Progress Reports

5.1.3 TECHNICAL KICKOFF MEETING

A Technical Kickoff Meeting shall be held within 10 days after TO award. The Contractor shall coordinate the date, time, and location (can be virtual) with the Contracting Officer (CO), as the Post-Award Conference Chairperson, the VA PM, as the Co-Chairperson, the Contract Specialist (CS), and the COR. The Contractor shall provide a draft agenda to the CO and COR/VA PM at least five calendar days prior to the meeting. Upon Government approval of a final agenda, the Contractor shall distribute it to all meeting attendees. During the kickoff-meeting, the Contractor shall present, for review and approval by the Government, the details of the intended approach, work plan, and project schedule for each effort via a Microsoft Office PowerPoint presentation. At the conclusion of the meeting, the Contractor shall update the presentation with a final slide entitled “Summary Report” which shall include notes on any major issues, agreements, or disagreements discussed during the kickoff meeting and the following statement “As the Post-Award Conference Chairperson, I have reviewed the entirety of this presentation and assert that it is an accurate representation and summary of the discussions held during the Technical Kickoff Meeting for the SCMC Operations and Maintenance effort.” The Contractor shall submit the final updated presentation to the CO for review and signature within three calendar days after the meeting. The Contractor shall also work with the CS, the Government’s designated note taker, to prepare and distribute the meeting minutes of the kickoff meeting to the CO, COR and all attendees within three calendar days after the meeting. The Contractor shall obtain concurrence from the CS on the content of the meeting minutes prior to distribution of the document.

5.1.4 QUARTERLY BUSINESS REVIEW

As part of Project Management, a Quarterly Business Review (QBR) will be conducted between Contractor and VA staff. The QBR will discuss the past 90 days of work, backlog, issues, etc. and the next 90 days of work to be conducted. QBR’s will alternate between virtual and face-to-face. The Contractor shall provide a draft agenda to the COR/VA PM at least five calendar days prior to the QBR. Upon Government approval, the Contractor shall provide the QBR Agenda to the COR and distribute it to all meeting attendees. The Contractor shall prepare and distribute the QBR Meeting Minutes to the COR and all attendees within three calendar days after the meeting. The Contractor shall submit the final QBR Brief in PowerPoint within three calendar days after the QBR.

Deliverables:

A. QBR Agenda B. QBR Meeting Minutes C. Final QBR Brief

5.2 SCMC OPERATIONS AND MAINTENANCE REQUIREMENTS

VA will provide the data in various file types throughout the contract lifecycle for a rolling total of an estimated 2,000,000 products and will provide additional files for continual data enrichment over the life of the TO to maintain currency of the Catalog. Continual data enrichment shall continue throughout Section 5.2.

The Contractor shall perform the following tasks.

5.2.1 DATA INGESTION

The Contractor shall maintain VA’s SCMC solution to ensure continued performance of the following functions, at a minimum:

1. The ability to receive data for an estimated total of 2,000,000 products, from multiple VA sources for harmonization, enrichment, and standardization based on a master ‘Authoritative Sources’ (determined by the Contractor and approved by VA). These authoritative sources will be a culmination of various external data sources of data standards, manufacturer information, industry groupings of like items, and other standards/naming conventions as they become available/adopted by industry. The Contractor shall ingest data from the following sources (in the formats identified below), at a minimum:

a. Medical Product Data Bank (MedPDB)

b. Electronic Contract Management System (eCMS)

c. Integrated Financial and Acquisition Management Systems (iFAMS)

d. Financial Management System (FMS)

e. Vendor Tables

f. Manufacturer Tables

g. Corporate Data Warehouse (CDW) Tables

h. Veterans Affairs Logistics Integration Platform (VALIP) Tables

i. Other Federal government source(s)

2. The ability to ingest and manage various data source formats such as Application Programming Interfaces (APIs) ((ex. JavaScript Object Notation, Extensible Markup Language (XML)), databases, and flat file formats (ex. Comma Separated Values, Excel, tab delimited, Portable Document Formats (PDF)s, Fast Healthcare Interoperability Resources (FHIR) HL7, and unstructured data.

3. The ability to receive the data sources above daily, weekly, and/or monthly depending on data source.

The Contractor shall perform an analysis of the data ingested and shall provide a report of the findings, named the Ingested Data Analysis Report. The Contractor and the VA Business Owner will develop Data and Business Rules that will be followed and accept recommendations from the Contractor. The analysis shall include inventory of the sources ingested, and data gaps relative to data harmonization and standardization effort. The Contractor shall provide an Exception Report for data that doesn’t qualify to a standard.

Deliverables:

A. Ingested Data Analysis Report B. Exception Report

5.2.2 DATA HARMONIZATION, ENRICHMENT, AND STANDARDIZATION

The Contractor shall provide, operate, and maintain the SCMC solution and fully utilize their master ‘Authoritative Sources’ to increase the quality and accuracy of VA data to industry standards. Data quality is defined by ensuring that data is fit for use, and can address multiple dimensions such as: accuracy, completeness, consistency, timeliness, traceability, uniqueness, and validity. Data fit for use will be determined by VA, in partnership with the Contractor. The Contractor shall ensure the solution provides the following functions at a minimum:

1. The ability to harmonize, enrich, and standardize data for VA products and services, if applicable, estimated at a total of 2,000,000 items. Examples include medical commodities, prosthetic device (to include durable medical equipment), expendable equipment, non-expendable, and non-clinical products. Additionally, these items may be on a VA Contract, items in inventory, or items in neither.

2. The ability to identify and integrate commercial/industry unique identifiers using the Food and Drug Administration (FDA) Unique Device Identification (UDI) - Device Identifier (DI) via approved issuing agencies such as Global Standards 1 (GS1), Health Industry Business Communications Council (HIBCC), and International Council for Commonality in Blood Banking Automation (ICCBBA).

3. The ability to provides product photos, short description with custom character lengths, standardized short and long descriptions, standardized manufacturer and vendor names, master packaging, United Nations Standard Product and Service Codes (UNSPSC)/ UNSPSC descriptions, Healthcare Common Procedure Coding System (HCPCS) Codes, Brand Name, and other required data elements.

4. The ability to identify related items from VA data that are clinically vetted that would produce a one-to-one similar function i.e., functional equivalent.

5. The ability to provide Continual Data Enrichment for information exchange, change control, normalization of item and contract data, new and expiring contracts, recalls, updates and duplicates, helping improve consistency and accuracy, and reducing product information inconsistences across the Enterprise.

6. The ability to source data from a Global Data Synchronization Network (GDSN), FDA Global Unique Device Identification Database (GUDID) certified data pool, UDI-DI (e.g., Global Trade Identification Number), Global Location Number (GLN), Company Name, Description, Unit of Measure (UOM), Quantity of Each, Ordering UOM, Next Level UDI-DI, Global Medical Device Nomenclature (GMDN), and to include all other relevant data attributes.

7. The ability to continuously build the master ‘Authoritative Sources’ aligned to VA data they are receiving.

8. The ability to cross reference Vendors to Manufactures and vice versa.

9. The ability to source data from ECRI as an industry standard, map and integrate with VA data, and retain applicable VA data i.e. Universal Medical Device Nomenclature System (UMDNS)

The Contactor shall ensure the following data quality criteria are met:

a. Identify duplication of entries based on approved criteria between VA and Contractor rules

b. Standardize the data elements where appropriate

c. Ensure appropriate categorization, grouping, and pattern matching

d. Work with VA to ensure data integrity

e. Provide required fields in any product and vendor set retrieved from the SCMC

The Contractor shall:

1. Harmonize, enrich, and standardize data ingested between the SCMC and other identified Government approved system(s). The Contractor shall provide a Statistics Report for all VA data that has been harmonized, enriched, and standardized. The Contractor shall provide a Plan of Action for any data not captured in the Statistics Report, to include reasoning on why data was not in Statistics Report, recommendations and a timeline for completion i.e. Continual Data Enrichment.

2. Document the VA Approved Data and Business Rules, which is the data logic from raw sources to standardized data which will be used throughout Section 5.2

3. Recommend additional product and/or packaging attributes within VA provided data sets, if applicable, that would enhance supply chain (Procurement/Distribution) efficiencies of the VA commodity data in the catalog

4. Perform Continual Data Enrichment for 365 days beyond last receipt of data

Deliverables:

A. VA Approved Data and Business Rules B. Statistics Report C. Plan of Action

5.2.3 SCMC USER INTERFACE

The Contractor shall maintain the following functions, at a minimum, of the VA’s SCMC solution:

1. A configurable, searchable user-friendly user interface that is Section 508 Compliant.

2. The catalog interface shall provide the capability to search as well as refine results by data attributes or Boolean logic. Examples of searchable attributes include; Categories, UDI-DI, UNSPSC, HCPCS, Manufacture, Descriptions, size, color, etc.

3. Ability to filter by price, tag, and vendor.

4. Ability to sort by price, vendor name, vendor part number, manufacture name, manufacturer part number, contract title, and description.

5. Ability to array catalog search results based on VA Contract Hierarchy and Order of Precedence.

6. Ability to provide a customized Tag or icon to represent a contract or line-item attribute. The use of Tags is embedded in our contract process and may include logic.

7. Ability to hyperlink specific data attributes related to the contract, vendor, manufacturer, or item details.

8. Ability to attach documents to line items and retain based on VA guidance.

9. Ability to select any or all results for print or export to Excel.

10. Ability to configure fields based on VA requirements.

11. Ability to link to various VA SharePoint, Intranet, and Internet sites.

12. Ability to provide an image on the catalog home page to provide news and updates to end users. An example would be a Joint Photographic Experts Group (jpg) or Portable Network Graphics (png) file format.

13. Ability to provide hyperlinks such as reference materials, training materials, or Help Desk support.

14. Ability to create Favorite Lists/Items and be shared within the application

15. Ability for a user to export data via an Application Programming Interface (API) to interface to another VA system i.e., Veterans Affairs Logistics Integration Platform (VALIP)

16. The ability to have authorized user profiles with business rules and controls that are unique to role, responsibilities, and functions that will limit access to products outside of authorization but remain visible for data and market research purposes

5.2.4 DATA EXCHANGE

The Contractor shall:

1. Provide the ability to export data out of the User Interface/Marketplace via Excel, API, or other approved file types

2. Provide the ability to export User and SCMC data to the Business Intelligence Tool

3. Provide the ability to export all data back to VA using a VA approved file type. This includes raw data and all harmonized, enriched, and standardized data from the Contractor i.e., Automated Data Exchange between the Contractor and VALIP

4. Provide the ability to identify the source of raw data and source of the harmonized, enriched, and standardized data in the Data Lineage Report

5. Provide the needed personnel with expertise to interconnect with the VALIP to create an automated end-to-end data exchange mechanism, see Attachments A&B. The Contractor shall build appropriate message types for different data types (ex FHIR HL7, REST, XML, JSON, etc.) based on business needs.

Deliverable:

A. Data Lineage Report

5.2.5 BUSINESS INTELLIGENCE TOOL

The Contractor shall provide a VA approved business intelligence tool such as Microsoft Power BI that includes dashboards for aggregating, analyzing, visualizing, and sharing data.

The Contractor shall provide the following functions at a minimum:

User Dashboard:

1. Number of Logins and Searches by Users

2. Breakout by Business Unit and Location of Users

3. Tracking of Keywords used by Users

4. Inactive Users

5. Updated weekly

Catalog Dashboard:

1. Ability to search/sort/filter all data and attributes that are the SCMC

2. Serves as a complementary tool to SCMC, the data must be aligned and cohesive

3. Breakdown of items and related attributes and/or Tags

4. Updated at the same frequency as the SCMC

5.2.6 CLOUD INFRASTRUCTURE

The Contractor shall provide, operate, and maintain VA’s SCMC solution for approximately 6,000 VA employees, with the concurrent numbers of users to be estimated around 10% of total. No software shall be downloaded onto VA computers to access the VA SCMC. Also, the VA SCMC shall not require any servers be hosted within VA. User specific application configuration settings are allowed in the Contractor hosted solution.

The Contractor shall:

1. Provide approved Interconnection Security Agreements (ISA) and supporting Memorandum of Understanding (MOU) for each new VA backend system, completed in accordance with VA Handbook 6500, Appendix D, Minimum Security Controls for VA Information Systems.

2. Complete the Web Application Security Assessment (WASA) checklist required when VA applications are hosted in an external environment for their application to be publicly accessible on the Internet or if required by the Assessment & Authorization (A&A)/Authority to Operate (ATO) process. When this is the case, either a Privacy Threshold Analysis (PTA) or Privacy Impact Assessment (PIA) and WASA report will need to be attached to the EECCB request. In addition, the WASA checklist includes a passing secure code review validation (e.g., Fortify scan result file) performed by the VA Information Security (OIS) Software Assurance (SwA) Program. Finally, the WASA report also must address all Critical, High, and Medium findings before the EECCB request will be approved and implemented.

3. Assist VA Network and Security Operations Center in any inquiry during the technical review within the EECCB process.

4. Submit Physical Access Review Report detailing physical access to the Cloud Service Provider data center.

Deliverables:

A. ISA and MOU B. WASA Report

C. PTA/PIA

D. Physical Access Review Report

5.2.6.1 SECURITY APPROACH

The Contractor shall:

1. Provide, operate, and maintain VA’s SCMC solution in compliance and alignment with Federal Risk and Authorization Management Program (FedRAMP) standardized security assessment, authorization, and continuous monitoring policies as required by the scope of the project. Office of Information Security Authorization Requirements Standard Operating Procedure activities shall be included.

2. Provide, operate, and maintain the SCMC cloud solution’s security and privacy that is consistent with:

a. NIST Special Publication 800-144 – “Guidelines on Security and Privacy in Public Cloud Computing”

b. NIST Special publication 800-53 - “Security and Privacy Controls for Federal Information Systems and Organizations.”

c. NIST Special publication 800-53A - “Assessing Security and Privacy Controls in Federal Information Systems and Organizations: Building Effective Assessment Plans.”

3. Provide, operate, and maintain the SCMC solution’s trusted secure communication channel, which supports VA Personal Identity Verification Card/ Common Access Card authentication (or other forms of 2 factor authentication) for remote access in accordance with Office of Management and Budget M-11-11.

4. Provide, operate, and maintain the SCMC solution’s security of data transfers in the course of migrating applications or services to, from, or between providers, whether internally or externally hosted.

5. Provide Information Assurance expertise in the areas of assessments, monitoring, maintaining, reviewing, and processing, accreditation/certification, Program Protection Plan evaluation, and other cyber security related activities and mandates.

5.2.6.2 MANAGEMENT APPROACH

The Contractor shall:

1. Manage program cost, schedule, performance, risks, warranties, contracts and subcontracts, licenses and data required.

2. Provide operational expertise and support for the business implementation as well as the user support. This includes but is not limited to communications to the workforce and external stakeholders, training, and documentation.

3. Develop a customer responsibility matrix in a standardized format that enables clear delineation of roles and responsibilities and that satisfies all aspects of a cloud implementation.

4. Provide a Quality Assurance Plan and/or Quality Control Plan that includes details for measuring data availability, storage capacity, uptime, and Service Level Agreement (SLA) compliance.

5. Provide multiple identical environments for testing of new logic and functionality prior to moving to a production environment.

Deliverables:

A. Customer Responsibility Matrix B. Quality Assurance Plan/Quality Control Plan

5.3 ASSESSMENT, AUTHORIZATION, AND CONTINUOUS MONITORING

The Contractor shall ensure VA’s SCMC solution complies with the Federal Information Security Management Act (FISMA) and shall be responsible for maintaining and renewing VA authorization, as necessary, throughout the life of the TO. The Contractor shall perform the following:

1. The Contractor shall comply with FedRAMP requirements as mandated by Federal laws and policies, including making available any documentation, physical access, and logical access needed to support this requirement

2. The Contractor shall, where applicable, assist with the VA ATO Sustainment Process to help maintain health and quality of agency authorization of the cloud service or migrated application.

3. The Contractor shall provide access to FedRAMP authorized and VA authorized environment.

4. The Contractor shall afford VA access to the Contractor’s and Cloud Service Provider’s (CSP) facilities, installations, technical capabilities, operations, documentation, records, and databases

5. If new or unanticipated threats or hazards are discovered by either VA or the Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party in accordance with the security addendum B

6. The Contractor shall not release any data without the consent of VA in writing. All requests for release must be submitted in writing to the COR/CO

7. In order for live VA data to be used in this system, the Contractor shall provide access to the FedRAMP Authorized and Agency Authorized environment

8. The Contractor shall participate in monthly Agency and FedRAMP Sustainment meetings

9. The Contractor shall perform and provide monitoring and reoccurring security artifacts, including monthly Plan of Action and Milestones (POAM) Reports

The Contractor shall be responsible for maintaining the A&A ATO Package that includes the following security documentation IAW Attachment C Authorization Requirements SOP:

a. System Security Plan (SSP),

b. Risk Assessment (RA),

c. Incident Response Plan (IRP),

d. Information Security Contingency Plan (ISCP),

e. Disaster Recovery Plan (DRP),

f. Configuration Management Plan (CMP),

g. Interconnection Security Agreement/Memorandum of Understanding (ISA/MOU),

h. Additional system description/and diagrams required by VA to gain access to VA network and receive an ATO.

Deliverables:

5.4 HELP DESK

The Contractor shall provide Tier 1, Tier 2, and Tier 3 Help Desk and defect repair support to VA from 7AM EST to 7PM EST Monday through Friday to respond to inquiries from VA employees. For each defect identified, the Contractor shall triage the defect in accordance with Table 1 and 2 below, identify a resolution for the defect, and execute the resolution.

The Tier 1, Tier 2, and Tier 3 Help Desk support shall include:

a. The Contractor shall provide a detailed Help Desk Support Plan, that includes SOPs for the support provided.

b. Providing help to authorized users via email.

c. Managing and tracking all environment outages.

d. Managing Help Desk request fulfillment, access management, and planned and preventive maintenance.

e. Providing problem management tracking for three severity (SEV) levels of problem requests and timely resolutions for infrastructure problems in accordance with the SLA:

i. A SEV A Incident shall be defined as system down or capacity diminished by greater that 10%.

ii. A SEV B Incident shall be defined as system down or capacity diminished by less than 10% or change order not requiring additional resources.

iii. A SEV C Incident shall be defined as routine maintenance or schedulable activity.

f. Notifying the VA PM of scheduled maintenance windows per the SLA.

g. Coordinating with VA for network outage, reconfiguration, and network troubleshooting issues.

h. The Contractor shall provide a Help Desk Report to include the number of tickets opened, number of tickets closed, status of remaining open tickets, and outages.

TABLE 1 - RESPONSE TIMES FOR TIERS 1, 2 AND 3

Table 2 - Severity Code Level Definitions for Defects

Deliverables:

A. Help Desk Support Plan B. Help Desk Report

5.5 SERVICE LEVEL AGREEMENT (SLA) REQUIREMENTS

The Contractor shall be responsible for the execution and reporting of routine environmental health checks and monitoring of the environment to ensure performance requirements and SLAs are met. Status of conformance to SLAs shall be reported and delivered as part of the Contractor’s Weekly Progress Report.

The Contractor shall provide the SCMC production capabilities 24 hours a day/7 day a week/365 days per year with a recovery time of four business hours.

The Contractor shall…