RFI PD Amend 1 - 08.08.2024.docx

Conference Room Scheduling Software System TAC Number: VA-24-00045496

PRODUCT DESCRIPTION (PD)

DEPARTMENT OF VETERANS AFFAIRS

Veteran Health Administration Office of Integrated Veteran Care (VHA/IVC)

Conference Room Scheduling Software System

Date: April 3, 2024

VA-24-00045496

PD Version Number: 1.0

Contents

PRODUCT REQUIREMENTS

The Veterans Health Administration Office of Integrated Veteran Care (VHA/IVC) requires the FMS Workplace Facility Management software or a software system meeting equal specifications for installation at Department of Veterans Affairs (VA) facilities in Buildings 44 and 53 located at the Denver Federal Center, West 6th Avenue and Kipling Street, Lakewood, Colorado 80225. This software will automate conference room and cubicle scheduling and reservations.

SALIENT CHARACTERISTICS

The contractor shall provide all software, system integration, cable management and training detailed below. Hardware is not currently part of the acquisition but depending on the successful vendor it may be added to the procurement. The conference and multipurpose rooms will require a scheduling system that allows for utilization tracking.

General System Design and Planning

Basis of Design

The basis of design for the system being proposed is detailed below. Exact matches or equivalent components are required for the outfitting and activation of the selected conference room scheduling/reservation tracking system throughout VHA/IVC. The awarded contractor shall deliver a fully functioning and integrated system.

General Requirements

The system must meet or exceed the following specifications:

· MS Outlook Exchange and Synchronization shall connect to Outlook Exchange so both platforms always remain synched.

· Shall allow multi-level administrative levels and permissions. The administrative design shall be such that users can be assigned to a specific “tier” that allows for controls to be set such as: overriding/deleting reservations, reserving only certain rooms, request/approving reservations for specific rooms, reassign standing reservations for individuals departing the organization that avoids the reservation from being deleted, etc.

· Shall allow for segmenting – only specified users can schedule cubes within their segment of cubes.

· Organization assigns personnel to administrative levels without vendor involvement.

· System design shall be designed such that the booking of key rooms (i.e., selected cubes/offices) will be based on a request that is approved by assigned staff members.

· The vendor shall have the ability to limit a reservation to a specific number of reoccurrences or for no more than a certain number of days. These parameters will be determined by the organization.

· Rooms with dividers shall be able to be assigned separately.

· User Interface

· Required feature - ability to search and filter room database by availability, seating capacity, and audio/video configuration.

· The vendor shall have the following:

· ability to display layout of rooms with photo and to provide a floor plan to guide attendees to the meeting location.

· PC web based application that allows users to make room reservations.

· ability to make reservations using either Outlook on VA provided computers or with vendor web-based platform.

· Ability to report usage and room/cube utilization from the individual to the organizational level.

· System design and Configuration

· Required to have a web-based solution with no server equipment required on premises.

· Shall have an enterprise-level solution that will allow for maximum flexibility to add and remove rooms as needed without vendor involvement or change to pricing structure.

· The vendor shall notify the requiring service and contracting officer at least 120 days in advance of the need to expand or modify the system to maintain performance requirements. The modifications to software or hardware (i.e., exterior room displays, “room in use” identifiers, etc.) shall be cost approved and technically accepted prior to any such modification being performed.

· Install and interface tablet sized displays per conference room, meeting room, telephone room to indicate if in use/reserved or available.

Server Hosting Requirements

· Vendor hosted solution.

Initial Set-up/configuration

· Contractor shall provide initial system setup to including programming the inventory of reservable spaces inclusive of various room/cube types.

· Up to three locations and an aggregate of 500 reservable spaces.

Documentation

Document Requirements

· Detailed product brochures, technical data and/or product cutsheets for each display type submitted shall be provided with the submittal.

Deliverables:

A. Product brochures, technical data and/or product cutsheets

General Site Conditions

General Operation

· As required per Contract Project Management Plan (CPMP), on-site assembly, installation of tablet displays and performance of services identified in this document shall take place during normal business hours which are defined as: 7:00am to 4:00pm Mountain Standard Time, Monday through Friday, excluding Federal Holidays.

· The vendor shall protect all finished spaces and surfaces at no additional cost to VHA/IVC. The vendor shall be responsible for paying for and repairing any damage or noted deficiencies to finished spaces and surfaces that occur as a result of the vendor’s (or associated sub-contractors) installation.

· There are no dumpsters available for vendor use. Vendor shall be responsible for removal of all trash generated from installation of tablet displays.

Project Management Requirements

· Project Management Plan

· The Contractor shall draft a CPMP that lays out the Contractor’s approach, timeline and tools to be used in execution of the contract. The CPMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks and resource support as well as detailed specifications for each product type to be installed. The CPMP shall include the contractor’s plans for managing all subcontractors, if applicable.

· This plan will be submitted for VA approval within 30 days of award.

· Verification and Validation Requirement (Testing)

· The Contractor shall perform testing following installation to ensure connectivity between training spaces and control rooms.

· The Contractor shall demonstrate functionality in each room type, including conference rooms, multipurpose rooms, etc.

· The Contractor shall draft an End User Acceptance Report that successfully demonstrates the system features to the Government.

Deliverables:

A. CPMP

B. End User Acceptance Report

Technical Support

· Provide onsite support for the first five full days of the system launch.

· Provide solution that will pull in all staff from Lightweight Directory Access Protocol into the awarded system.

· Provide telephone technical support and remedy during normal business hours.

· Provide on-site remedy if required for resolution of issues.

· Provide system configuration support as needed by the organization.

Training Requirements

Onsite/Offsite and Web-based Training

· The contractor shall provide onsite training for the first two days of the system launch.

· The contractor shall provide onsite training for up to 7 system administrators and 30 “power/super users” or service level administrators. Onsite training shall be a minimum of four hours.

· Provide electronic version of a training brochure/handout that is detailed and unique to configured system and application.

· The contractor shall provide a second day of onsite training (additional 8 hours) or 16 hours of offsite, web-based training to be made available during the first 120 days upon the organization’s request for such. A minimum of 14 days’ notice shall be provided for the additional onsite visit by VHA/IVC.

Deliverables:

A. Training brochures/handouts

Support

· Contractor shall provide a plan for support. This may include license fees, technical support via telephone, application support via telephone, and onsite support as necessary for escalation.

· Phone technical and application support shall be Monday through Friday from 8-5 local time, Mountain Standard time.

· Support shall be during the base period and for 4 option periods

· Support includes the replacement of broken equipment and tablets.

Software as a service FedRAMPRequirements

If the solution is not FedRAMP authorized:

1. The information system solution selected by the Contractor shall comply with the Federal Information Security Management Act (FISMA).

2. The Contractor shall comply with FedRAMP requirements FedRAMP LOW as mandated by Federal laws and policies, including making available any documentation, physical access, and logical access needed to support this requirement.

3. The Contractor shall provide a SaaS product as defined by the following criteria: Software as a Service (SaaS) is an application delivery model in which the application is hosted on a cloud infrastructure outside the security boundary of VA and is provided to the Cloud Service Customer (CSC) over the internet. The CSC uses the SaaS offering via a thin-client interface, such as a web-browser or a program interface. The CSC subscribes to the SaaS offering and is only responsible for minor in-app customizations. The Cloud Service Provider (CSP) offering the application is responsible for management of the application, safeguarding of data stored or processed by the application, and all elements of the underlying infrastructure. Additionally, the CSP is responsible for all on-going compliance. In order to qualify as SaaS for use at VA, and to align with FedRAMP requirements, the hosting for the offering must conform to the NIST 800-145 definition of Cloud Computing and thus contain following key characteristics:

· On-Demand Self-Service: The CSP fully automates the provisioning of both the customer interface and the underlying cloud components of the SaaS offering. In some cases, to the CSP may provision internal resources manually, while providing the CSC an automated interface to request and track the service.

· Broad Network Access: The SaaS capabilities are available over the internet or over a network that is available from all access points the CSC requires. The SaaS offering is accessible through common platforms (e.g., mobile phones, tablets, laptops, and workstations).

· Resource Pooling: The computing infrastructure supporting the SaaS offering is shared among more than one CSC using a multi-tenant model, and resources are dynamically assigned depending on customer demand.

· Rapid Elasticity: Computing capabilities are automatically provisioned and released in a manner that scales with customer demand. In some cases, the scaling of resources may not be fully automated, but it should be fast enough to support the needs of the CSC, which the CSC would have to define.

· Measured Service: Resource usage, such as storage, processing, bandwidth, and user activity are measured and reported on in a manner that is relevant to the SaaS offering.

The SaaS offering must be hosted within the United States and data stored/processed/transmitted within the offering must remain within the United States. CSPs should be aware of FedRAMP and ready to partner with VA through the SaaS FedRAMP Authorization process.

4. Following guidance from the Federal Chief Information Officer (CIO), VA will utilize existing Joint Authorization Board Authority to Operate (ATO) or agency ATO issued by another agency as a starting point for FedRAMP requirements. If neither of those exist, VA will sponsor The Cloud Service Provider for a FedRAMP Authorization. VA will be using the FedRAMP baselines as a starting point, since they are specifically tailored for cloud services.

5. The Contractor shall, where applicable, assist with the VA ATO process to help achieve agency authorization of the cloud service or migrated application at the impact level required by VA to utilize the product. For this solution the required impact level is: FedRAMP Low

6. The Contractor shall complete a FedRAMP System Security Plan (SSP) and supporting documentation including required attachments within 75 calendar days after contract award.

7. The Contractor shall develop a VA specific system boundary diagram including any integration and connectivity components that will be known as a VA Implementation Diagram (VAID) demonstrating the proposed implementation of this system at VA. The Contractor shall provide the VAID within 10 calendar days of contract award.

8. The Contractor shall complete a Third-Party Assessment Organization (3PAO) Security Assessment Plan (SAP) within 90 calendar days after contract award.

9. The Contractor shall complete a 3PAO Security Assessment Report (SAR) within 90 calendar days after the SSP is accepted by VA.

10. The Contractor shall work with assigned VA subject matter expert (SME) to develop a VA specific Incident Response Plan (IRP) and perform an IRP Table Top Exercise with VA Stakeholders. This should be completed within 30 calendar days of the SSP being delivered.

11. The Contractor shall afford VA access to the Contractor’s and CSP‘s facilities, installations, technical capabilities, operations, documentation, records, and databases.

12. If new or unanticipated vulnerabilities are discovered by either VA or the Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party in accordance with Addendum B, VA Information and Information System Security/Privacy Language.

13. The Contractor shall comply with data management requirements.

14. Successful issuance of a VA ATO will be required before live VA data can be used in the system.

Deliverables:

A. FedRAMP SSP and supporting documentation B. VAID: This is a VA specific architecture diagram demonstrating the proposed implementation of this system at VA

C. 3PAO SAP

D. 3PAO SAR

E. IRP Scenario

If the solution is FedRAMP Authorized but not VA Authorized:

1. The information system solution shall comply with FISMA.

2. The Contractor shall comply with FedRAMP requirements as mandated by Federal laws and policies, including making available any documentation, physical access, and logical access needed to support this requirement.

3. The system must be FedRAMP Authorized at no less than the FedRAMP Low

4. The Contractor shall, where applicable, assist with the VA ATO Process to help achieve agency authorization of the cloud service or migrated application.

5. The Contractor shall develop a VA specific system boundary diagram including any integration and connectivity components that will be known as a VAID demonstrating the proposed implementation of this system at VA. The Contractor shall provide the VAID within 10 calendar days of contract award.

6. The Contractor shall provide confirmation of their FedRAMP SSP and supporting documentation completion via their repository Identification number and a link for VA to download the SSP and all required artifacts within 5 calendar days of contract award.

7. The Contractor shall provide the results of their most recent 3PAO SAP within 10 calendar days of contract award.

8. The Contractor shall complete a 3PAO SAR within 10 calendar days after the SSP is accepted by VA.

9. The Contractor shall provide VA with the most recent monthly scans for the production environment within the authorization boundary and their scan upload schedule for FedRAMP within 30 calendar days of contract award.

10. The Contractor shall provide their availability to participate in monthly continuous monitoring meetings to be scheduled following successful VA ATO within 30 calendar days of contract award.

11. Contractor shall work with assigned VA SME to develop a VA specific IRP and perform an IRP Table Top Exercise with VA Stakeholders. This should be completed within 30 calendar days of the SAR being delivered.

12. If new or unanticipated vulnerabilities are discovered by either VA or the Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party in accordance with Addendum B, VA Information and Information System Security/Privacy Language.

13. The Contractor shall comply with data management requirements.

14. Successful issuance of a VA ATO will be required before live VA data can be used in the system.

Deliverables:

A. VA Implementation Diagram B. FedRAMP SSP and supporting documentation

C. 3PAO SAP

D. 3PAO SAR

E. IRP Scenario

If the solution is FedRAMP Authorized and VA Authorized:

1. The information system solution selected by the Contractor shall comply with FISMA and have a current VA authorization.

2. The Contractor shall comply with FedRAMP requirements as mandated by Federal laws and policies, including making available any documentation, physical access, and logical access needed to support this requirement.

3. The FedRAMP Authorization level and existing VA ATO should be no less than the level required for this use case which has been defined as FedRAMP Low

4. The Contractor shall, where applicable, assist with the VA ATO Sustainment Process to help maintain health and quality of agency authorization of the cloud service or migrated application.

5. The Contractor shall exclusively provide licenses and/or accounts to FedRAMP authorized and VA authorized environments.

6. The Contractor shall afford VA access to the Contractor’s and CSP‘s facilities, installations, technical capabilities, operations, documentation, records, and databases.

7. If new or unanticipated vulnerabilities are discovered by either VA or the Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party in accordance with Addendum B, VA Information and Information System Security/Privacy Language.

8. The Contractor shall comply with data management requirements.

9. Successful issuance of a VA ATO will be required before live VA data can be used in the system.

10. The Contractor shall participate in monthly Agency and FedRAMP Sustainment meetings following the granting of a VA ATO.

11. The Contractor shall provide continuous monitoring activities including scans, security artifacts, and monthly Plan of Action and Milestones (POAM) reports as outlined by FedRAMP requirements.

Deliverables:

A. Continuous monitoring security artifacts B. Continuous monitoring scans C. POAM reports.

MIGRATION, SOFTWARE MAINTENANCE AND CUSTOMER SUPPORT

Importing and creation of user accounts shall be complete 30 days following agency approved FedRAMP ATO followed by 12 months of software maintenance and customer support.

The following table contains the FMS:Workplace Facility Management Software brand name product configurations that meets VA’s requirements (see Section 1.1). Should the offeror propose “or equivalent” products, the offeror shall demonstrate that they meet Salient Characteristics in Section 1.1 and SaaS FEDRAMP Requirements in Section 1.2.

FedRAMP Migration Services – FM:Interact Hosting Setup Fee PS-CSTM-FEDRAMP-OD – Custom authorization; used in conjunction with standard recurring FedRAMP authorization PS-GSA-SOW – FM:Interact Implementation & Data Migration Services Implementation & Migration Fees – Workplace FM:Systems Group LLC - FMS-HOST-SETUP

FMS Employee - SW-RS-DESKS-OD-500 - Interactive pan-and- zoom floorplans for workspace reservations.

FM:Systems Group LLC - SW-RS-DESKS-OD-500 Annual Subscription

FMS Employee - SW-RS-ENT-RL-OD-150. RS Enterprise Resource License Scheduling platform for shared resources Includes Outlook Exchange Integration for streamlined scheduling, robust capabilities for associated services and a mobile app. (Subscription as a Service) FM:Systems Group LLC - SW-RS-ENT-RL-OD-150 Annual Subscription

FMS Standard FedRAMP Authorization & Premium Hosting Infrastructure (AWS) - PSA-Premium Enhanced SLA for Extended support (required) for FMS Employee FM:Systems Group LLC -

PSA-GSA-FEDRAMP-OD

Representative Brand Name or Equivalent Migration, Software Maintenance and Customer Support – Option Period One (The period of performance shall be 12 months)

The following table contains the FMS:Workplace Facility Management Software brand name product configurations that meets VA’s requirements (see Section 1.1). Should the offeror propose “or equivalent” products, the offeror shall demonstrate that they meet Salient Characteristics in Section 1.1 and SaaS FEDRAMP Requirements in Section 1.2.

Representative Brand Name or Equivalent Migration, Software Maintenance and Customer Support – Optional Tasks for Option Period One (The period of performance shall be 12 months)

The following table contains the FMS:Workplace Facility Management Software brand name product configurations that meets VA’s requirements (see Section 1.1). Should the offeror propose “or equivalent” products, the offeror shall demonstrate that they meet Salient Characteristics in Section 1.1 and SaaS FEDRAMP Requirements in Section 1.2.

Optional Task 2: FMS Employee - SW-RS-ENT-RL-OD-150. RS Enterprise Resource License Scheduling platform for shared resources Includes Outlook Exchange Integration for streamlined scheduling, robust capabilities for associated services and a mobile app.

(Subscription as a Service) FM:Systems Group LLC - SW-RS-ENT-RL-OD-150 Annual Subscription

Representative Brand Name or Equivalent Migration, Software Maintenance and Customer Support – Option Period Two (The period of performance shall be 12 months)

The following table contains the FMS:Workplace Facility Management Software brand name product configurations that meets VA’s requirements (see Section 1.1). Should the offeror propose “or equivalent” products, the offeror shall demonstrate that they meet Salient Characteristics in Section 1.1 and SaaS FEDRAMP Requirements in Section 1.2.

Representative Brand Name or Equivalent Migration, Software Maintenance and Customer Support – Optional Tasks for Option Period Two (The period of performance shall be 12 months)

The following table contains the FMS:Workplace Facility Management Software brand name product configurations that meets VA’s requirements (see Section 1.1). Should the offeror propose “or equivalent” products, the offeror shall demonstrate that they meet Salient Characteristics in Section 1.1 and SaaS FEDRAMP Requirements in Section 1.2.

Optional Task 2: FMS Employee - SW-RS-ENT-RL-OD-150. RS Enterprise Resource License Scheduling platform for shared resources Includes Outlook Exchange Integration for streamlined scheduling, robust capabilities for associated services and a mobile app.

(Subscription as a Service) FM:Systems Group LLC - SW-RS-ENT-RL-OD-150 Annual Subscription

Representative Brand Name or Equivalent Migration, Software Maintenance and Customer Support – Option Period Three (The period of performance shall be 12 months)

The following table contains the FMS:Workplace Facility Management Software brand name product configurations that meets VA’s requirements (see Section 1.1). Should the offeror propose “or equivalent” products, the offeror shall demonstrate that they meet Salient Characteristics in Section 1.1 and SaaS FEDRAMP Requirements in Section 1.2.

Representative Brand Name or Equivalent Migration, Software Maintenance and Customer Support – Optional Tasks for Option Period Three (The period of performance shall be 12 months)

The following table contains the FMS:Workplace Facility Management Software brand name product configurations that meets VA’s requirements (see Section 1.1). Should the offeror propose “or equivalent” products, the offeror shall demonstrate that they meet Salient Characteristics in Section 1.1 and SaaS FEDRAMP Requirements in Section 1.2.

Optional Task 2: FMS Employee - SW-RS-ENT-RL-OD-150. RS Enterprise Resource License Scheduling platform for shared resources Includes Outlook Exchange Integration for streamlined scheduling, robust capabilities for associated services and a mobile app.

(Subscription as a Service) FM:Systems Group LLC - SW-RS-ENT-RL-OD-150 Annual Subscription

CONTRACTOR RESPONSIBILITIES

Prior to termination or completion of this contract, contractor/subcontractor must not destroy information received from VA, or gathered/created by the contractor in the course of performing this contract without prior written approval by the VA. Any data destruction done on behalf of VA by a contractor/subcontractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self-certification by the contractor that the data destruction requirements above have been met must be sent to the VA Contracting Officer within 30 days of termination of the contract.

NOTICE OF THE FEDERAL ACCESSIBILITY LAW AFFECTING ALL INFORMATION AND COMMUNICATION TECHNOLOGY (ICT) PROCUREMENTS (SECTION 508)

On January 18, 2017, the Architectural and Transportation Barriers Compliance Board (Access Board) revised and updated, in a single rulemaking, standards for electronic and information technology developed, procured, maintained, or used by Federal agencies covered by Section 508 of the Rehabilitation Act of 1973, as well as our guidelines for telecommunications equipment and customer premises equipment covered by Section 255 of the Communications Act of 1934. The revisions and updates to the Section 508-based standards and Section 255-based guidelines are intended to ensure that information and communication technology (ICT) covered by the respective statutes is accessible to and usable by individuals with disabilities.

SECTION 508 – INFORMATION AND COMMUNICATION TECHNOLOGY (ICT) STANDARDS

The Section 508 standards established by the Access Board are incorporated into, and made part of all VA orders, solicitations and purchase orders developed to procure ICT. These standards are found in their entirety at: https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines. A printed copy of the standards will be supplied upon request.

Federal agencies must comply with the updated Section 508 Standards beginning on January 18, 2018. The Final Rule as published in the Federal Register is available from the Access Board: https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule.

The Contractor shall comply with “508 Chapter 2: Scoping Requirements” for all electronic ICT and content delivered under this contract. Specifically, as appropriate for the technology and its functionality, the Contractor shall comply with the technical standards marked here:

COMPATABILITY WITH ASSISTIVE TECHNOLOGY

The standards do not require installation of specific accessibility-related software or attachment of an assistive technology device. Section 508 requires that ICT be compatible with such software and devices so that ICT can be accessible to and usable by individuals using assistive technology, including but not limited to screen readers, screen magnifiers, and speech recognition software.

ACCEPTANCE AND ACCEPTANCE TESTING

Deliverables resulting from this solicitation will be accepted based in part on satisfaction of the Section 508 Chapter 2: Scoping Requirements standards identified above.

The Government reserves the right to test for Section 508 Compliance before delivery. The Contractor shall be able to demonstrate Section 508 Compliance upon delivery.

INFORMATION TECHNOLOGY USING ENERGY-EFFICIENT PRODUCTS

The Contractor shall comply with Sections 524 and Sections 525 of the Energy Independence and Security Act of 2007; Section 104 of the Energy Policy Act of 2005; Executive Order 13834, “Efficient Federal Operations”, dated May 17, 2018; Executive Order 13221, “Energy-Efficient Standby Power Devices,” dated August 2, 2001; and the Federal Acquisition Regulation (FAR) to provide ENERGY STAR®, Federal Energy Management Program (FEMP) designated, low standby power, and Electronic Product Environmental Assessment Tool (EPEAT) registered products in providing information technology products and/or services.

EPEAT

EPEAT product compliance is not required in this acquisition.

ENERGY STAR

Energy Star compliance is not required in this acquisition.

FEMP

FEMP or FEMP low standby power product compliance is not required in this acquisition.

SYSTEM ACCEPTANCE (PRE-PRODUCTION) TESTING

It is the Government’s desire that all End User Devices be delivered to the Government without an Operating System (OS) installed thereon. Contractors will be required to provide each End User Device (including docking stations and monitors) for Pre-Production testing. The Pre-Production test units shall be provided at no additional cost to the Government. Following successful Pre-Production Testing, the Contractor will not be required to install the Government Baseline; instead, the Government Baseline will be installed by the Government at the field sites.

The Government Pre-Production Test Facilities will test the end user device to ensure that it functions correctly within the current Government infrastructure; regression testing must take place involving Government application software to ensure that the Government-specific Baseline is functioning correctly. The Government will complete product testing as soon as practicable, however, this regression testing requires a minimum of thirty (30) calendar days for completion. Upon successful regression testing, Government will notify the Contractor that the end user device has passed testing. If the proposed equipment fails to pass the Pre-Production testing, Government will return the failed devices to the Contractor or designated original equipment manufacturer (OEM) point of contact (at the Contractor’s cost), and the Contractor shall provide new devices to the government-designated Pre-Production Test Facility. If the test unit passes, the accepted test unit will not be returned to the Contractor.

Deliverable:

A. Pre-Production Test Unit

SHIPMENT OF HARDWARE OR EQUIPMENT

Inspection: Destination Acceptance: Destination Free on Board (FOB): Destination

Ship To and Mark For:

Primary

Alternate

Bldg. 53 Lakewood, CO 80225 Address:

Voice:

Voice:

Email:

Email:

SPECIAL SHIPPING INSTRUCTIONS

Prior to shipping, Contractor shall notify Site POCs, by phone followed by email, of all incoming deliveries including line-by-line details for review of requirements. The Contractor shall not make any changes to the delivery schedule at the request of Site POC.

Contractors shall coordinate deliveries with Site POCs before shipment of hardware to ensure sites have adequate storage space.

All shipments, either single or multiple container deliveries, shall bear the VA IFCAP Purchase Order number on external shipping labels and associated manifests or packing lists. In the case of multiple container deliveries, a statement readable near the VA IFCAP PO number shall indicate total number of containers for the complete shipment (e.g. “Package 1 of 2”), clearly readable on manifests and external shipping labels.

Packing Slips/Labels and Lists shall also include the following:

IFCAP PO #: ____________ (e.g., 166-E11234 (the IFCAP PO number is located in block #20 of the SF 1449)) Project Description: (e.g. Tier I Lifecycle Refresh)

Total number of Containers: Package ___ of ___. (e.g., Package 1 of 3)

GENERAL REQUIREMENTS

VA TECHNICAL REFERENCE MODEL

The Contractor shall support the VA enterprise management framework. In association with the framework, the Contractor shall comply with OIT Technical Reference Model (VA TRM). The VA TRM is one component within the overall Enterprise Architecture (EA) that establishes a common vocabulary and structure for describing the information technology used to develop, operate, and maintain enterprise applications. Moreover, the VA TRM, which includes the Standards Profile and Product List, serves as a technology roadmap and tool for supporting OIT. Architecture & Engineering Services (AES) has overall responsibility for the VA TRM.

SOCIAL SECURITY NUMBER (SSN) REDUCTION

The Contractor solution shall support the Social Security Number (SSN) Fraud Prevention Act (FPA) of 2017 which prohibits the inclusion of SSNs on any document sent by mail. The Contractor support shall also be performed in accordance with Section 240 of the Consolidated Appropriations Act (CAA) 2018, enacted March 23, 2018, which mandates VA to discontinue using SSNs to identify individuals in all VA information systems as the Primary Identifier. The Contractor shall ensure that any new IT solution discontinues the use of SSN as the Primary Identifier to replace the SSN with the Integrated Control Number (ICN) in all VA information systems for all individuals. The Contractor shall ensure that all Contractor delivered applications and systems integrate with the VA Master Person Index (MPI) for identity traits to include the use of the ICN as the Primary Identifier. The Contractor solution may only use a Social Security Number to identify an individual in an information system if and only if the use of such number is required to obtain information VA requires from an information system that is not under the jurisdiction of VA.

INTERNET PROTOCOL VERSION 6 (IPV6)

The Contractor solution shall support Internet Protocol Version 6 (IPv6) based upon the memo issued by the Office of Management and Budget (OMB) on November 19, 2020 (https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-07.pdf). IPv6 technology, in accordance with the USGv6 Program (https://www.nist.gov/programs-projects/usgv6-program/usgv6-revision-1), NIST Special Publication (SP) 500-267B Revision 1 “USGv6 Profile” (https://doi.org/10.6028/NIST.SP.500-267Br1), and NIST SP 800-119 “Guidelines for the Secure Deployment of IPv6” (https://doi.org/10.6028/NIST.SP.800-119), compliance shall be included in all IT infrastructures, application designs, application development, operational systems and sub-systems, and their integration. In addition to the above requirements, all devices shall support native IPv6 and dual stack (IPv6 / IPv4) connectivity without additional memory or other resources being provided by the Government, so that they can function in a mixed environment. All public/external facing servers and services (e.g. web, email, DNS, ISP services, etc.) shall support native IPv6 and dual stack (IPv6 / IPv4) users and all internal infrastructure and applications shall communicate using native IPv6 and dual stack (IPv6 / IPv4) operations.

SOFTWARE AND LICENSING REQUIREMENTS

The Contractor shall be responsible for the provision of all software licenses and any associated licensing maintenance required for any development, delivery, integration, operation, and/or maintenance associated with its proposed application(s), software products, software solution, and/or system including, but not limited to, any and all application(s), software and/or software products that comprise, are a part of, or integrate with the Contractor’s proposed application(s), software products, software solution, and/or system for the life of any resulting contract.

POSITION/TASK RISK DESIGNATION LEVEL(S)

Position Sensitivity and Background Investigation Requirements by Service Task/Item Number Service Task/ Item Number

The Tasks identified above and the resulting Position Sensitivity and Background Investigation requirements identify, in effect, the Background Investigation requirements for Contractor individuals, based upon the tasks the particular Contractor individual will be working. The submitted Contractor Staff Roster must indicate the required Background Investigation Level for each Contractor individual based upon the tasks the Contractor individual will be working, in accordance with their submitted proposal.

SOLICITATION INSTRUCTIONS FOR INFORMATION TECHNOLOGY USING ENERGY-EFFICIENT PRODUCTS Response Instructions: Offerors shall provide with its quote/proposal evidence of product registration/qualification/designation for EPEAT, Energy Star, and FEMP respectively for any and all proposed products certifying that the proposed product(s) as of the date of the submission of the quote/proposal are registered/qualified/designated as required in the form of screenshots from the associated website. The Offeror shall include in the screenshots submitted, the EPEAT-registered product(s) by manufacturer, model name, and model number to be supplied under this contract, and shall specify the EPEAT level rating (bronze, silver, or gold) for each product. The Offeror shall include in the screenshots submitted, the Energy Star qualified product(s) by manufacturer, model name, and model number to be supplied under this contract, and shall provide evidence of Energy Star qualification for each product. Offerors shall include in the screenshots submitted the FEMP-designated product(s) by brand, model name, and model number to be supplied under this contract. Additionally, the Offeror’s quote/proposal shall explicitly self-certify that that the products proposed meet the required EPEAT level rating, Energy Star, or FEMP registration/qualification/designation respectively. Failure to include the requisite evidence and Offeror self-certification may render the Offeror’s quote Unacceptable and thus, ineligible for award.

POINTS OF CONTACT

VA Program Manager:

Name:

Address:

Voice:

Email:

Contracting Officer’s Representative:

Name:

Address:

Voice:

Email:

Contracting Officer:

Name:

Address:

Voice:

Email:

Contract Specialist:

Name:

Address:

Voice:

Email:

ADDITIONAL ITEMS

SPECIAL INSTRUCTIONS/REMARKS

Response Instructions: Offerors shall provide an authorization letter or other means of verification from the Original Equipment Manufacturer (OEM) confirming it is an authorized dealer, authorized distributor, or authorized reseller for the proposed equipment/system in accordance with VA Acquisition Regulation (VAAR) 852.212-72 and 852.212-73. Additionally, the Offeror’s quote/proposal shall explicitly self-certify that it will not provide Gray Market Goods and/or Counterfeit Items, as defined by VA Acquisition Regulation (VAAR) 852.212-72 and 852.212-73, and that it has the level of certification/specialization, as required by the OEM(s). Failure to include the requisite OEM letter(s)/documentation and Offeror self-certification may render the Offeror’s quote Unacceptable and thus, ineligible for award.

INFORMATION SECURITY CONSIDERATIONS:

The Assessment and Authorization (A&A) requirements do not apply and a Security Accreditation Package is not required

All VA sensitive information shall be protected at all times in accordance with local security field office System Security Plans (SSP’s) and Authority to Operate (ATO)’s for all systems/LAN’s accessed while performing the tasks detailed in this Product Description.

a. A prohibition on unauthorized disclosure: “Information made available to the Contractor or Subcontractor by VA for the performance or administration of this contract or information developed by the Contractor/Subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA.” This clause expressly limits the Contractor/Subcontractor’s rights to use data as described in Rights in Data – General, FAR 52.227-14(d).(1).

b. A requirement for data breach notification: Upon discovery of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the Contractor/Subcontractor has access, the Contractor/Subcontractor shall immediately notify the COR and simultaneously, the designated ISO, and Privacy Officer for the contract. The term “security incident” means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. See VA Handbook 6500.6, Appendix C, paragraph 6.a.

c. A requirement to pay liquidated damages in the event of a data breach: “In the event of a data breach or privacy incident involving SPI the contractor processes or maintains under this contract, the contractor shall be liable to VA for liquidated damages for a specified amount per affected individual to cover the cost of providing credit protection services to those individuals.” However, it is the policy of VA to forgo collection of liquidated damages in the event the Contractor provides payment of actual damages in an amount determined to be adequate by the agency.

Based on the determinations of the independent risk analysis, the Contractor shall be responsible for paying to VA liquidated damages in the amount of $37.50 per affected individual to cover the cost of providing credit protection services to affected individuals consisting of the following:

1) Notification;

2) One year of credit monitoring services consisting of automatic daily monitoring of at least 3 relevant credit bureau reports;

3) Data breach analysis;

4) Fraud resolution services, including writing dispute letters, initiating fraud alerts and credit freezes, to assist affected individuals to bring matters to resolution;

5) One year of identity theft insurance with $20,000.00 coverage at $0 deductible; and

6) Necessary legal expenses the subjects may incur to repair falsified or damaged credit records, histories, or financial affairs

d. A requirement for annual security/privacy awareness training: “Before being granted access to VA information or information systems, all Contractor employees and Subcontractor employees requiring such access shall complete on an annual basis either: (i) the VA security/privacy awareness training (contains VA security/privacy requirements) within 1 week of the initiation of the contract, or (ii) security awareness training provided or arranged by the contractor that conforms to VA’s security/privacy requirements as delineated in the hard copy of the VA security awareness training provided to the Contractor. If the Contractor provides their own training that conforms to VA’s requirements, they will provide the COR or CO, a yearly report (due annually on the date of the contract initiation) stating that all applicable employees involved in VA’s contract have received their annual security/privacy training that meets VA’s requirements and the total number of employees trained. See VA Handbook 6500.6, Appendix C, paragraph 9.

e. A requirement to sign VA’s Rules of Behavior: “Before being granted access to VA information or information systems, all Contractor employees and Subcontractor employees requiring such access shall sign on annual basis an acknowledgement that…