36C10B24Q0207.docx

VA Event Management System Software as a Service

VA-24-00045626

GENERAL INFORMATION

SET-ASIDE

PLACE OF PERFORMANCE

POSTAL CODE

COUNTRY

CONTACT INFORMATION

Technology Acquisition Center

23 Christopher Way Eatontown NJ 07724

POINT OF CONTACT*

Contract Specialist Michael Gruen Michael.Gruen@va.gov 848-377-5251

ADDITIONAL INFORMATION

AGENCY’S URL

URL DESCRIPTION

AGENCY CONTACT’S EMAIL ADDRESS

EMAIL DESCRIPTION

DESCRIPTION

The Department of Veterans Affairs (VA) Technology Acquisition Center (TAC) is seeking information concerning the availability of capable contractors to provide the Event Management System Software as a Service identified in the Performance Work Statement (PWS).

This is a Request For Information (RFI) only and is limited to ten pages. Do not submit a proposal or quote. There is no obligation on the part of the Government to acquire any products or services described in this RFI. Your response to this RFI will be treated only as information for the Government to consider. You will not be entitled to payment for direct or indirect costs that you incur in responding to this RFI. This request does not constitute a solicitation for proposals or the authority to enter into negotiations to award a contract. No funds have been authorized, appropriated or received for this effort. Interested parties are responsible for adequately marking proprietary, restricted or competition sensitive information contained in their response. The Government does not intend to pay for the information submitted in response to this RFI. Page limit (excluding PWS feedback) is 10 pages.

If interested, please provide the following:

1. A capabilities statement that addresses the questions below and draft PWS. If additional information is required by VA to determine a contractor’s capability to provide the full requirement and the economic feasibility of the information provided, additional information may be requested at a later date. Technical questions may be submitted as part of your response. A draft version of the requirement is below. Please direct all responses to Michael Gruen, michael.gruen@va.gov and Debra Clayton, debra.clayton2@va.gov

2. Has the draft PWS provided sufficient detail to describe the technical requirements that encompass the services to be performed under this effort?

______ YES _______ NO (if No, answer question below) If “NO”, please provide your technical comments/recommendations on elements of the draft PWS that may contribute to a more accurate proposal submission and efficient, cost effective effort.

3. Any Contract Vehicle of which you are a part that can be used to acquire your solution as well as the company business size and status for each vehicle as designated by the NAICS 541611, Administrative Management and General Management Consulting Services, and the associated U.S. Small Business Administration size status (i.e., Large Business, Small Business, Service-Disabled Veteran Owned Small Business, Small Disadvantaged Business, Women-Owned Small Business, Hub Zone Small Business, etc.)

4. If your company is a small business, please confirm that in the solution provided, your company will be performing at least 50% of the work in accordance with the set aside regulations.

5. Please provide response to attached Industry Questionnaire Response Submission Form.

Presolicitation Notice Presolicitation Notice

Presolicitation Notice

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Office of Small and Disadvantaged Business Utilization (OSDBU)

Event Management System Software as a Service (EMSS)

Date: January 31, 2024

VA-24-00045626

PWS Version Number: 1.0

Contents

BACKGROUND

The Department of Veterans Affairs (VA), Office of Small and Disadvantaged Business Utilization (OSDBU) provides services to Veteran Owned Small Businesses (VOSB) and Service-Disabled Veteran Owned Small Businesses (SDVOSB) who seek to gain access to economic opportunity by leveraging the Federal procurement system.As part of its mission, OSDBU provides training outreach and liaison support to businesses (small and large) and other members of the public and private sectors concerning Small Business Acquisition issues. OSDBU is responsible for monitoring the VA implementation and execution of VA’s socioeconomic goals.

To meet its core mission and objectives, OSDBU intends to procure a fully customizable cloud-based Event Management Software as a Service (EMSS) solution to provide web-based tools to plan and execute events, including large-scale national events, as well as regional and local events. OSDBU events bring businesses together with Procurement Decision Makers (PDM) and other buyers, from Government and industry. The goal is to facilitate a meaningful dialogue and to primarily identify business opportunities for Small Businesses across VA, federal agencies and the commercial sector.

APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. 44 U.S.C. § 3541-3549, “Federal Information Security Management Act (FISMA) of 2002”

2. “Federal Information Security Modernization Act of 2014”

3. Federal Information Processing Standards (FIPS) Publication 140-2, “Security Requirements for Cryptographic Modules”

4. FIPS Pub 199. “Standards for Security Categorization of Federal Information and Information Systems,” February 2004

5. FIPS Pub 200, “Minimum Security Requirements for Federal Information and Information Systems,” March 2006

6. FIPS Pub 201-2, “Personal Identity Verification of Federal Employees and Contractors,” August 2013

7. 10 U.S.C. § 2224, "Defense Information Assurance Program"

8. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

9. Public Law 109-461, Veterans Benefits, Health Care, and Information Technology Act of 2006, Title IX, Information Security Matters

10. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”

11. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, https://www.va.gov/vapubs/index.cfm

12. VA Handbook 0710, “Personnel Security and Suitability Program,” May 2, 2016, https://www.va.gov/vapubs/index.cfm

13. VA Directive and Handbook 6102, “Internet/Intranet Services,” August 5, 2019

14. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and Guidelines,” January 18, 2017

15. Office of Management and Budget (OMB) Circular A-130, “Managing Federal Information as a Strategic Resource,” July 28, 2016

16. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed Services (CHAMPUS)”

17. NIST SP 800-66 Rev. 1, “An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule,” October 2008

18. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended, January 18, 2017

19. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

20. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021

21. VA Handbook 6500, “Risk Management Framework for VA Information Systems VA Information Security Program,” February 24, 2021

22. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI),” March 12, 2019

23. VA Handbook 6500.5, “Incorporating Security and Privacy into the System Development Lifecycle,” March 22, 2010

24. VA Handbook 6500.6, “Contract Security,” March 12, 2010

25. VA Handbook 6500.8, “Information System Contingency Planning,” April 6, 2011

26. VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018

27. VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017

28. OIT Process Asset Library (PAL), https://www.va.gov/process/ . Reference Process Maps at https://www.va.gov/process/maps.asp and Artifact templates at https://www.va.gov/process/artifacts.asp

29. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

30. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014

31. VA Handbook 6508.1, “Procedures for Privacy Threshold Analysis and Privacy Impact Assessment,” July 30, 2015

32. VA Handbook 6510, “VA Identity and Access Management,” January 15, 2016

33. VA Directive and Handbook 6513, “Secure External Connections,” October 12, 2017

34. VA Directive 6300, “Records and Information Management,” September 21, 2018

35. VA Handbook, 6300.1, “Records Management Procedures,“ March 24, 2010

36. NIST SP 800-37 Rev 2, “Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy,” December 2018

37. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020)

38. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015

39. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” March 24, 2014

40. OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005

41. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019

42. OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008

43. Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance, December 2, 2011, (NOTE: Part A of the FICAM Roadmap and Implementation Guidance, v2.0, was replaced in 2015 with an updated Architecture (https://arch.idmanagement.gov/#what-is-the-ficam-architecture)

44. NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access,“ June 2018

45. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, “Digital Identity Guidelines,” updated March 02, 2020

46. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014

47. NIST SP 800-164, “Guidelines on Hardware-Rooted Security in Mobile Devices (Draft),” October 2012

48. Draft National Institute of Standards and Technology Interagency Report (NISTIR) 7981, “Mobile, PIV, and Authentication,” March 2014

49. VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

50. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

51. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

52. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

53. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019

54. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008

55. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (Public Law 110–140), December 19, 2007

56. Section 104 of the Energy Policy Act of 2005, (Public Law 109–58), August 8, 2005

57. Executive Order 13834, “Efficient Federal Operations,” dated May 17, 2018

58. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 2, 2001

59. VA Directive 0058, “VA Green Purchasing Program,” July 19, 2013

60. VA Handbook 0058, “VA Green Purchasing Program,” July 19, 2013

61. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

62. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

63. “Veteran Focused Integration Process (VIP) Guide 4.0,” January 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

64. VA Memorandum “Proper Use of Email and Other Messaging Services,” January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

65. “DevSecOps Product Line Management Playbook” version 2.0, May 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

66. NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020

67. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol Version 6 (IPv6),” November 19, 2020

68. Social Security Number (SSN) Fraud Prevention Act of 2017

69. Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23, 2018

SCOPE OF WORK

The Contractor shall provide a customizable, turn-key, user-friendly, mobile ready, web-based, cloud-hosted EMSS solution to support the planning, management, and execution of VA national, regional, and local events. The EMSS solution shall address the VA’s need to provide a collaborative event management platform where stakeholders at all levels across the organization have access to timely and accurate information required for planning, management and enhanced decision-making. The platform should allow for enhancements throughout the performance period.

The Contractor shall provide remote technical support (call center) as well as on-site support for major events, as needed.

PERFORMANCE DETAILS

1.1 PERFORMANCE PERIOD

The period of performance (PoP) shall be 12-months from date of award, with four 12-month option periods and three optional tasks. Optional tasks are as follows:

· Optional Task One “Phase-Out Transition Support”: This option may be exercised once during the duration of the contract in either the base or one of the option periods.

· Optional Task Two: “Remote Technical Support Surge” This option may be exercised one time during each of the base and each option periods.

· Optional Task Three: “Additional EMSS Enhancements” This optional task may be exercised at any time and from time to time during the performance of the task order, up to the maximum price specified in the Price Schedule. If exercised, the PoP of each Optional Task shall not exceed the period of performance of the Base or Option Year in which it is exercised.

There are eleven (11) Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, four are set by date:

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

Dates observed only by the District of Columbia as a holiday:

If any of the holidays that are set by date falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if any of the dates falls on a Sunday, then Monday shall be observed as a holiday.

1.2 PLACE OF PERFORMANCE

Tasks under this PWS shall be performed at Contractor facilities. The Contractor shall identify the Contractor’s place of performance in their proposal submission.

1.3 TRAVEL

The Government anticipates travel under this effort to perform the tasks associated with the effort, as well as to attend program-related meetings or conferences throughout the PoP.

Annual Trip Destination and purpose

Duration (days)

SPECIFIC TASKS AND DELIVERABLES

The Contractor shall perform the following:

1.4 PROJECT MANAGEMENT

1.4.1 REPORTING REQUIREMENTS

The Contractor shall provide the COR with Monthly Progress Reports in electronic form in Microsoft Word and Project formats. The report shall include detailed instructions/explanations for each required data element, to ensure that data is accurate and consistent. These reports shall reflect data as of the last day of the preceding Month.

The Monthly Progress Reports shall cover all work completed during the reporting period and work planned for the subsequent reporting period. The report shall also identify any problems that arose and a description of how the problems were resolved. If problems have not been completely resolved, the Contractor shall provide an explanation including their plan and timeframe for resolving the issue. The report shall also include an itemized list of all Information and Communication Technology (ICT) deliverables and their current Section 508 conformance status. It is expected that the Contractor will keep in communication with VA accordingly so that issues that arise are transparent to both parties to prevent escalation of outstanding issues.

Deliverable:

A. Monthly Progress Report

1.4.2 TECHNICAL KICKOFF MEETING

The Contractor shall hold a technical kickoff meeting within 5 days after contract award. The Contractor shall present, for review and approval by the Government, the details of the intended approach, work plan, and project schedule for each effort. The Contractor shall specify dates, locations (in-person preferred but can be virtual), agenda (shall be provided to all attendees at least one calendar days prior to the meeting), and meeting minutes (shall be provided to all attendees within three calendar days after the meeting). The Contractor shall invite the Contracting Officer (CO), Contract Specialist (CS), and COR.

The Contractor shall deliver the kick-off meeting package three days after the kickoff meeting. The package shall include a work planning and delivery approach, milestone schedule, and constraints.

1.4.3 ONBOARDING

The Contractor shall manage the onboarding of its staff. Onboarding includes steps to obtain a VA PIV card, network and email account, complete training, initiate background investigations, and gain physical and logical access. In addition, the Contractor shall identify individuals that may require elevated privileges to the necessary development and test environments for the various systems to be enhanced. After review by the Contractor and VA, a decision will be made as to the necessity of obtaining GFE for the onboarding staff. If approved, Contractor shall follow the appropriate steps to obtain the equipment.

A single Contractor Onboarding point of contact (POC) shall be designated by the Contractor that tracks the onboarding status of all Contractor personnel. The Contractor Onboarding POC shall be responsible for accurate and timely submission of all required VA onboarding paperwork to the VA COR. The Contractor shall be responsible for tracking the status of all their staff’s onboarding activities to include the names of all personnel engaged on the task, their initial training date for VA Privacy and Information Security training, and their next required training date. The Contractor Onboarding POC shall also report the status at the staff level during onboarding status meetings. The Contractor shall provide an Onboarding Status Report weekly for any staff with outstanding onboarding requests for review by the COR, VA Program Manager and Project Manager.

Deliverable:

A. Monthly Onboarding Status Report

1.5 EVENT MANAGEMENT SOFTWARE AS A SERVICE (EMSS)

The Contractor shall provide a fully functional customized EMSS solution that is FedRAMP Authorized with all features and capabilities as outlined in Attachments A through E to support all VA OSDBU events, including local, regional, and National events, for up to 5,000 simultaneous users within 90 days of contract award. The system shall have the potential to store up to 50,000 unique contact profiles during performance period.

The EMSS solution shall guarantee a 99.96% uptime access to all functionality, content, provide back-up, continuity of operations (COOP), and enable mobile access via iPad, tablets, and Smartphones from anywhere at any time.

The Contractor shall provide access to EMSS data via one or more application programming interfaces (API) or web services.

The Contractor shall provide user documentation detailing the minimum requirements for correctly using the Web Service and API. The documentation shall minimally contain examples showing the correct syntax of API requests and their corresponding responses. The Contractor shall ensure that contact information for users seeking technical support is prominently displayed in the online Web API documentation. The Contractor shall provide online, user-facing documentation that clearly distinguishes differences in usage between the current version of the Web API and its previous versions.

Deliverable:

A. User Documentation for Web API

1.5.1 FedRAMP Requirements

The following 2 Sections (paras. 5.2.1.1 and 5.2.1.2 provide the requirements for EMSS based upon the status of FedRAMP for the proposed solution. The contractor shall provide validation of appropriate status and propose against 5.2.1.1 OR 5.2.1.2.

SOLUTION is FedRAMP AUTHORIZED and VA AUTHORIZED

The information system solution selected by the Contractor shall comply with the Federal Information Security Management Act (FISMA) and have a current VA authorization.

The Contractor shall comply with FedRAMP requirements as mandated by Federal laws and policies, including making available any documentation, physical access, and logical access needed to support this requirement.

The FedRAMP Authorization level and existing VA ATO should be no less than the level required for this use case which has been defined as Medium.

The Contractor shall, where applicable, assist with the VA ATO Sustainment Process to help maintain health and quality of agency authorization of the cloud service or migrated application.

The Contractor shall exclusively provide licenses and/or accounts to FedRAMP authorized and VA authorized environments.

The Contractor shall afford VA access to the Contractor’s and Cloud Service Provider’s (CSP) facilities, installations, technical capabilities, operations, documentation, records, and databases.

If new or unanticipated vulnerabilities are discovered by either VA or the Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party in accordance with Addendum B, VA Information and Information System Security/Privacy Language.

The Contractor shall comply with data management requirements.

Successful issuance of a VA ATO will be required before live VA data can be used in the system.

The Contractor shall participate in monthly Agency and FedRAMP Sustainment meetings following the granting of a VA ATO.

The Contractor shall provide continuous monitoring activities including scans, security artifacts, and monthly Plan of Action and Milestones (POAM) reports as outlined by FedRAMP requirements.

Deliverables:

A. Continuous Monitoring Security Artifacts B. Continuous Monitoring Scans C. Plan of Action and Milestones Reports

SOLUTION is FedRAMP AUTHORIZED BUT NOT VA AUTHORIZED

1. The information system solution selected by the Contractor shall comply with the Federal Information Security Management Act (FISMA).

The Contractor shall comply with FedRAMP requirements as mandated by Federal laws and policies, including making available any documentation, physical access, and logical access needed to support this requirement.

The system must be FedRAMP Authorized at no less than Medium.

The Contractor shall, where applicable, assist with the VA ATO Process to help achieve agency authorization of the cloud service or migrated application.

The Contractor shall develop a VA specific system boundary diagram including any integration and connectivity components that will be known as a VA Implementation Diagram (VAID) demonstrating the proposed implementation of this system at VA. The Contractor shall provide the VAID within 10 calendar days of contract award.

The Contractor shall provide confirmation of their FedRAMP System Security Plan (SSP) and supporting documentation completion via their repository ID number and a link for VA to download the SSP and all required artifacts within 5 calendar days of contract award.

The Contractor shall provide the results of their most recent Third-Party Assessment Organization (3PAO) Security Assessment Plan (SAP) within 10 calendar days of contract award.

The Contractor shall complete a 3PAO Security Assessment Report (SAR) within 10 calendar days after the SSP is accepted by VA.

The Contractor shall provide VA with the most recent monthly scans for the production environment within the authorization boundary and their scan upload schedule for FedRAMP within 30 calendar days of contract award.

The Contractor shall provide their availability to participate in monthly continuous monitoring meetings to be scheduled following successful VA ATO within 30 calendar days of contract award.

Contractor shall work with assigned VA SME to develop a VA specific Incident Response Plan (IRP) and perform an IRP Table Top Exercise with VA Stakeholders. This should be completed within 30 calendar days of the SAR being delivered.

If new or unanticipated vulnerabilities are discovered by either VA or the Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party in accordance with Addendum B, VA Information and Information System Security/Privacy Language The Contractor shall comply with data management requirements.

Successful issuance of a VA ATO will be required before live VA data can be used in the system.

Deliverables:

A. VA Implementation Diagram B. FedRAMP System Security Plan (SSP) and Supporting Documentation C. 3PAO Security Assessment Plan (SAP) D. 3PAO Security Assessment Report (SAR) E. IRP Scenario

1.5.2 EMSS CORE CAPABILITIES

The EMSS solution shall integrate data and services with a wide variety of internal and external data sources tosupport the planning, execution, and and reporting of VA events. . The EMSS solution shall provide a variety of customizable user dashboards in order to present data for decision making including: metrics, key performance indicators, graphical displays, interactive reports, and self-service ad-hoc reporting.

The EMSS solution shall operate in all standard web browsers and micro-browsers including at a minimum; Safari, Microsoft Edge, Chrome, and Firefox. The EMSS solution shall be able to both publish and consume information and data via standard web services interfaces or API. The mobile solution shall be compatible with Google Android and Apple IOS mobile operating system for smart phones, tablets, and other mobile devices.

The EMSS solution shall include configuration, upgrades, software patches, updates, enhancements/customizations, helpdesk support and architectural support to sustain and expand existing EMSS capabilities. The EMSS solution shall deliver business functionality through a number of configured web-based tools to key stakeholders.

At a minimum, for Event Management Operations, the Contractor shall include:

1. Creation and management of virtual and in-person events with high volume of events in different facilities (configs) via internet, mobile and phone, in a quick and efficient manner.

Providing responsive EMSS platform with user friendly interface for roles-based access for internal users and contacts Providing branded VA website for seamless online inquires, registration, payments, which seamlessly integrates with the EMSS platform.

Generation of confirmation emails and receipts A support team for troubleshooting, general upkeep of system and long-term vision of ways to use the system that can improve users experience.

An innovative approach to client services and creative solutions for growth based upon customer feedback.

Interfacing with third-party payment processing and invoicing capability

At a minimum, the end users of EMSS shall include the following:

1. Acquisition Professionals (AQP) Small Business Professionals (SBP) Program Office Professionals (POP) External Data Users (EDU)

Small and socioeconomic category businesses (VOSB, SDVOSB, HUBZone, SDB, 8(a), WOSB, EDWOSB) Other-than-Small (“Large Prime”) Businesses (OTSB)

Hosting services consists of provisioning the environments to allow VA end users to utilize the EMSS system. The Contractor shall setup and configure the testing non-production and production hosting environments IAW VA Directive 6551 within 30 calendar days of award.

Deliverables:

A. Hosted Non-Production Environments B. Hosted Production Environment

1.5.3 INTEGRATION

The Contractor shall ensure EMSS applications can integrate with and consume services provided by VA and other third-party applications, as well as share data with other VA applications. The EMSS solution must support the interface to other systems, including the VetBiz portal, Enhanced Vendor Information Pages (VetBiz Portal), Veterans Enterprise Management System (VEMS), VA Enterprise Market Research Platform, Systems of Awards Management (SAM), Federal Procurement Data System Next Generation (FPDS-NG), SBA Dynamic Small Business Search (DSBS), , and other internal VA or external third-party data sources or application via standard API or common web services.

The Contractor shall collaborate with integration partners on the development and execution of integration testing of all interfaces and support demonstrations and coordinate environment setup for demonstrations and functionalities.

The Contractor shall:

1. Integrate data from the following internal VA web services, Applications Programming Interface and/or data sources:

VEMS;

VetBiz Portal Identity, Credential, and Access Management’s (IAM) and Single Sign-On (VAAFI)

2. Integrate data from the following external web services, Applications Programming Interface and/or data sources:

Systems of Awards Management Dynamic Small Business Search (DSBS)

1.5.4 EMSS TRAINING

The Contractor shall provide instructor led training, self-service webinars, training videos, and user guides, including Administration, Graphical User Interface (GUI) menu structure and navigation procedures, help resources, explanation of error messages, troubleshooting steps, and interaction with other applications (See Attachment A, Required Capabilities Summary, Section 2.0 for a detailed set of requirements).

The Contractor shall:

1. Provide an Admin/Super User Training Package for use by OSDBU personnel which consists of a system overview presentation, knowledge-based articles, and troubleshooting procedures and instructions.

Perform training with System Administrators/Operations staff (not to exceed a total of 30 users) prior to the delivery of the EMSS solution. The training shall be for no more than 12 hours and should be offered at least annually during the PoP. The Contractor shall provide minutes of the training session to include a list of attendees and time attended.

Provide an End-User Training Package (i.e., train-the-trainer), which consists of Videos, and On-line Users Guide(s), Provide a minimum of two facilitated webinars not to exceed two hours. The first webinars shall be conducted within 10 days after delivery of the full solution as outlined Section 5.2, with follow-on webinars offered quarterly during the PoP. The webinars shall address use of the Web/mobile App, Graphical User Interface (GUI) menu structure and navigation procedures, help resources, explanation of error messages, troubleshooting steps and interactions with other applications as outlined in Attachment A. Each webinar shall accommodate up to 200 participants.

EMSS System update training. Upon changes to functionality, develop and deliver trainings for Admin/Super User and Operations staff within 7 days of deployment into production. Update training materials as needed to include revisions resulting from changes and enhancements to the EMSS solution.

Deliverables:

A. Super User/Admin Training Package B. End-User Training Package C. Online User Guides/Videos

1.5.5 REMOTE TECHNICAL SUPPORT/HELP DESK

The Contractor shall provide pre-event, during-event, and post event remote technical support/help desk for password reset, user support, and other technical issues during the period of performance. User support includes all activities which enable the user to take advantage of the full functionality and capabilities of the EMSS solution.

1. The Contractor shall provide remote technical support/help desk for password reset, and other technical issues during the period of performance.

The Contractor shall provide a toll-free telephone number and email address to be used for end user support.

The Contractor shall respond within two (2) hours from receipt of users’ requests submitted Monday through Friday, between 7:00 a.m. to 3 p.m. Eastern Standard Time. All user request submitted after 3 p.m. Monday – Friday must be responded to the next business day. User request submitted on weekends or designated holidays must be responded to the next business day.

The Contractor shall provideTechnical Support Reports at least weekly for review and download in .CSV or .XLS format from the EMSS Admin Dashboard with Metrics identifying:

1. Number of Open/Closed Tickets

2. Request type

3. Submission type (email, phone, chat, walk-in)

4. Response time The following table includes the required response times for Remote Technical Support/Help Desk during regular business hours:

•Major function or service is not operational for multiple users •Critical Technology issues during VA event 1 business hours

•A major function or service within the EMSS application is not operational for a few users •A few users experiencing an issue but are still able to perform application function.

2-4 business hours

•Requests for profile changes or business opportunity changes •Request for password changes or visitor identification login assistance •Questions about system functionality 1 business day

Table 6: Remote Support Response Times

REMOTE TECHNICAL MAJOR EVENT SUPPORT

The Contractor shall provide increased remote support operations for major VA events from registration open to event end date. The Call Center Major Event support will assist contacts in completing their registration, building their profile, (including opportunities and schedule), assisting with Native Mobile or Web App upload and navigation, uploading documents, correcting or editing profiles, making business rule changes, host profile changes, host/co-host changes, developing standard and adhoc reports, as well as general support to the OSDBU staff and other VA officials. This support shall also include calling participants/registrants/hosts directly to provide instructions and assist them to build their schedule, complete registration, complete profile, or upload presentations.

Based upon historical call volume the Government anticipates up to 5,000 calls related to major VA events, with an average on 1,250 calls per month, 56 calls per day, Mon-Fri, 7 AM – 6 PM EST. The Government estimates the number of call agents needed is between 3-5, including 30% shrinkage (3 agents before shrinkage). This will provide a service level of 84.8% answered in 20 seconds with an average speed of answer of 30.1 seconds.

1.5.6 ON-SITE TECHNICAL SUPPORT/HELP DESK

The Contractor shall provide on-site support for designated VA events. Based upon current estimates, the Government anticipates the need for on-site support for a maximum of up to eight (8) events per year. This includes regional, industry specific, and national events. Based upon the size and complexity of the event, the Contractor shall provide the necessary on-site technical support personnel commencing two hours (2) prior to start of event activities each day for up to 10 hours per workday of the event. The on-site technical support shall be designed in scalable packages of personnel depending on the size and complexity of the event. Each package will include at least 1 but not more than 25 support personnel lasting one day prior to the event and through each day of the event as designated by the Government.

The following table of estimates for OSDBU Event Categories is provided for planning and estimation purposes.

Table 7: Table of Estimates for OSDBU Event Categories The Contractor shall provide all management, personnel, equipment, supplies and services necessary to perform all on-site technical/help desk support. The Contractor shall work closely with the COR to coordinate the scheduling of on-site technical support/help desk personnel to ensure adequate coverage prior to the start of and during each scheduled day of activities. The Contractor shall closely coordinate the activities of the remote help desk and on-site technical support/help desk to ensure synchronization and consistency in the delivery of services. The Contractor shall use the same toll-free number and email address for both on-site and remote support services. During large events, the Contractor shall respond within 30 minutes from receipt of users’ requests for registration, scheduling or profile assistance received via phone, email, or instant messaging. See Attachments A through E for specific capabilities required. During small events, the Contractor shall respond within no more than five minutes’ wait time for walk-in assistance through on-site helpdesk located in/or near registration area (as designated by the Government).

1.5.7 OPERATIONS AND MAINTENANCE SUPPORT

EMSS operation and maintenance (O&M) support activities are related to the on-going support for the performance of routine, preventive, predictive, scheduled, and unscheduled actions aimed at maintaining the system performance by supporting the application from desktop to server, real time monitoring system performance metrics, and coordinating with other VA and non-VA systems. This includes performance monitoring and bug fixes and preventing system/production failure by working with the hosting and development staff to properly size and deploy capabilities to support performance. In addition, O&M support activities include correcting production software defects with the goal of increasing efficiency and reliability on a continuous basis via bug fix/hotfix releases and deploying patches/upgrades as needed.

In support of these activities, the Contractor shall configure, develop, maintain, test, and deploy EMSS maintenance releases and/or bug fix/hotfix releases. Releases may occur after hours and/or on during the weekend. For Production releases, Contractor support staff shall be identified and available if there is a problem.

The Contractor shall provide Corrective Maintenance services, including application bug fixes, fixes to standard or custom reports that are inaccurate, correcting business rules that contain bad logic, including all subparagraphs, to include Data integration with agency data sets, using web services to create agency side data reports.

The Contractor shall provide continued hosting support for the test non-production and production environment.

The Contractor Shall:

1. Support the activities related to acquiring the Authority to Operate (ATO) for production environments within the VA network.

Ensure all documentation is current in the VA’s Governance, Risk and Compliance (GRC) tool, currently RiskVision.

Assist in the development of Enterprise Architecture (EA) checklists to support Operational Readiness Testing.

Update all technical artifacts to reflect current maintenance procedures related to servers and product support.

1.6 EMSS ENHANCEMENTS

The EMSS solution as described in this PWS and Attachments A through E will continue to evolve to meet VA priorities and may require implementation of enhancements throughout the PoP. The specific scope of functionality to be delivered will be determined based upon a Level of Effort (LOE) categorization of Low, Medium, or High. A Low LOE requires the solution to implemented in no more than two (2) weeks, a Medium LOE will require the implementation of a solution in no more than four (4) weeks, and a High LOE will require the implementation of a solution in no more than eight (8) weeks. During the Base Period of Performance and Options Period of Performance the Government estimates the following LOEs:

Base Period LOEs:

Option Period(s) LOEs:

Deliverable A. Monthly status report of completed, ongoing, and planned enhancements

1.6.1 SECURITY

EMSS shall meet the rigorous security standards of VA including ATO, Trusted Internet Connection (TIC) compliant, Identity and Access Management services for single sign-on internal and external, as well as enable the integration of external data sources, web services, and/or Application Programming Interfaces.

The Contractor shall coordinate with applicable VA stakeholders for an ATO to interface the hosted environments to the VA Network. The Contractor shall provide all Assessment and Authorization (A&A) support and documentation required to achieve and maintain full A&A certification using the process specified in the FedRAMP Program Requirements.

The Contractor shall:

1. Be fully responsible and accountable for ensuring compliance with all HIPAA, Privacy Act, FISMA, NIST, FIPS, and VA security and privacy directives and handbooks. This includes conducting compliant risk assessments, routine vulnerability scanning, continuous monitoring, system patching and change management procedures, and the completion of an acceptable contingency plan for each system. The Contractor’s security control procedures must be equivalent to those procedures used to secure VA systems.

Ensure adequate security controls for collecting, processing, transmitting, and storage and removal of Personally Identifiable Information (PII) and Personal Health Information (PHI), as determined by the VA Privacy Service, must be in place, tested, and approved by VA prior to hosting, operation, maintenance, or use of the information system, or systems by or on behalf of VA.

Ensure these security controls are to be assessed and stated within the Privacy Impact Assessment (PIA) and if these controls are determined not to be in place, or inadequate, a Plan of Action and Milestones (POA&M) shall be submitted and approved prior to the collection of PII and PHI.

Deliverable:

A. Plan of Action and Milestones

1.7 OPTIONAL TASK 1 - PHASE-OUT TRANSITION SUPPORT

The Contractor shall develop and deliver a Phase-Out Transition Plan in the event that all or part of the tasks are terminated or completely transitioned to the Government or a new Contractor at the end of the period of performance. The Contractor shall submit details for the Phase-Out portion of the Transition Plan, and execute the Phase-Out Transition Plan upon Government approval. The Transition Plan may be exercised by the Government anytime during the base and/or option periods. All transition actions shall be completed prior to end of PoP. The Contractor shall provide SME support for up to 90 days to affect the requisite knowledge transfer in accordance with the resulting Transition Plan and schedule. At a minimum, the Transition Plan shall include the following:

1. Roster of key POCs with email address and telephone numbers Transition timeline with key milestones Data/databases Inventory and transition of historical data (e.g., memos, letters, correspondence, regulations, reports, documents, transition agreement documents, software licensing agreements, hardware maintenance agreement, memorandums of agreement/ understanding, and inter-service agreements) Procedural manuals/guidelines Operating instructions Data and workflow process Application scheduling process Templates used in day-to-day operations Orientation to introduce incumbent Contractor team, programs, and users to the incoming team, explaining tools, methodologies and business processes Procedures to introduce Government personnel, programs and users to the Contractor team’s tools, methodologies and business processes Strategy and approach regarding personnel staffing and training during the transition period Process for transfer of on-hand inventory, if applicable Transition checklist Signed turnover agreements Work collaboratively with other support Contractors and/or Government personnel. As part of collaboration, the Contractor shall convey any and all information, as it pertains to EMSS projects, its processes, diagrams and any reports that emanates from the system that may be requested to support this collaboration. This support shall also consist of providing advice, clarification or explanation to facilitate the understanding of the information presented.

Deliverable:

A. Phase-out Transition Plan

OPTIONAL TASK 3 –

GENERAL REQUIREMENTS

1.8 ENTERPRISE AND IT FRAMEWORK

1.8.1 VA TECHNICAL REFERENCE MODEL

The Contractor shall support the VA enterprise management framework. In association with the framework, the Contractor shall comply with OIT Technical Reference Model (VA TRM). The VA TRM is one component within the overall Enterprise Architecture (EA) that establishes a common vocabulary and structure for describing the information technology used to develop, operate, and maintain enterprise applications. Moreover, the VA TRM, which includes the Standards Profile and Product List, serves as a technology roadmap and tool for supporting OIT. Architecture & Engineering Services (AES) has overall responsibility for the VA TRM.

1.8.2 FEDERAL IDENTITY, CREDENTIAL, AND ACCESS MANAGEMENT (FICAM)

The Contractor shall ensure Commercial Off-The-Shelf (COTS) product(s), software configuration and customization, and/or new software are Personal Identity Verification (PIV) card-enabled by accepting HSPD-12 PIV credentials using VA Enterprise Technical Architecture (ETA), https://www.ea.oit.va.gov/EAOIT/VA_EA/Enterprise_Technical_Architecture.asp, and VA Identity and Access Management (IAM) approved enterprise design and integration patterns, https://www.oit.va.gov/library/recurring/edp/index.cfm. The Contractor shall ensure all Contractor delivered applications and systems comply with the VA Identity, Credential, and Access Management policies and guidelines set forth in VA Handbook 6510 VA Identity and Access Management, VA Handbook 0735 Homeland Security Presidential Directive 12 (HSPD-12) Program, and align with the Federal Identity, Credential, and Access Management Roadmap and Implementation Guidance v2.0.

The Contractor shall ensure all Contractor delivered…