36C10B24Q0759.docx

Data Management and Data Analytics SaaS Question(s) and Answers

GENERAL INFORMATION

SET-ASIDE

PLACE OF PERFORMANCE

POSTAL CODE

COUNTRY

CONTACT INFORMATION

Technology Acquisition Center

23 Christopher Way Eatontown NJ 07724

POINT OF CONTACT*

Contract Specialist Kevin Andujar Kevin.Andujar@va.gov

ADDITIONAL INFORMATION

AGENCY’S URL

URL DESCRIPTION

AGENCY CONTACT’S EMAIL ADDRESS

EMAIL DESCRIPTION

Presolicitation Notice Presolicitation Notice

DESCRIPTION

Presolicitation Notice

REQUEST FOR INFORMATION

Data Management and Data Analytics Software-as-a-Service (SaaS)

Introduction:

This is a Request for Information (RFI) only issued for conducting market research. Accordingly, this RFI constitutes neither a Request for Quote (RFQ), Request for Proposal (RFP), nor a guarantee that one will be issued by the Government in the future; furthermore, it does not commit the Government to contract for any services described herein. The Department of Veterans Affairs (VA) is not, at this time, seeking proposals or quotes, and therefore, will not accept, review, or evaluate unsolicited proposals or quotes received in response hereto. This notice is not to be construed as a commitment on the part of the Government to award a contract, nor does the Government intend to pay for any information submitted because of this request. The Government does not reimburse respondents for any costs associated with submission of the information being requested or reimburse expenses incurred for responses to this RFI. The information provided may be used by VA in developing its acquisition strategy and Performance Work Statement (PWS) or Product Description (PD). Any information submitted by respondents to this RFI is strictly voluntary; however, any information received shall become the property of the Government and will not be returned to the respondent. Interested parties are responsible for adequately marking proprietary, restricted, or competition sensitive information contained in their response. This is a request for information and does not obligate the Government in any way, nor does it commit the Government to any specific course of action. Product information, brochures, part numbers, and/or other description information may be included with the submission.

Requirement:

The Office of Enterprise Integration and Office of Information Technology are co-sponsoring the sustainment of the Common Operating Platform, referred to from this point forward as the ‘National Center for Veterans Analysis and Statistics Platform’ or ‘NCVAS Platform’.

VA currently has the Palantir Foundry Software-as-a-service (SaaS) solution, which underpins its current capability. VA seeks a SaaS solution that provides the same functionality as the current operational decision support capability. The VA requires the SaaS solution to be authorized at the Federal Risk and Authorization Management Program (FedRAMP) High level and meet Federal Information System Management Act 2014 (FISMA) High requirements as specified in section 2.0, at time of proposal submission. VA also requires the SaaS solution to be fully configurable, deployed and ready for VA use within 14 days of award so that the SaaS solution can ingest data, metadata, transformations, and allow user configurations. VA will provide technical subject matter experts who will support connecting the SaaS Platform to the VA’s environment as well as obtaining an Authority to Operate (ATO). The vendor shall enter into a Service Level Agreement and provide the Architectural Diagram and Artifacts representing the SaaS product security controls.

The attached draft Product Description – Data Management and Data Analytics SaaS describes the technical specifications for this effort.

Responses:

All interested parties shall respond no later than 12:00 PM EST on October 3, 2024 via e-mail to Kevin Andujar at Kevin.Andujar@va.gov. If you have any questions on the RFI, please submit via the SAM.gov. Please note Data Management and Data Analytics Software-as-a-Service (SaaS) in the subject line of your response.

1) Provide a brief summary of your technical approach for meeting the attached draft PD requirements for Data Management and Data Analytics SaaS.

2) Has the draft PWS/PD and any associated attachments provided sufficient detail to describe the technical and functional requirements that encompass the desired solution?

______ YES ______ NO

a. If “NO”, please provide your technical and functional comments/recommendations on elements of the requirements that may contribute to a more accurate quote submission and efficient, cost-effective solution.

3) Are there any specifications that you believe are unachievable by industry? If so, please state why.

4) What additional information would be needed to provide a firm fixed price quote for each item/task?

5) Include the following identification information:

a. Name of Company

b. Address

c. Point of Contact

d. Phone Number

e. Fax Number

f. Email address

g. CAGE code/Unique Entity Identifier

h. Company Business Size and Status for NAICS 513210

i. Any Schedules held on General Services Administration (GSA), Government-Wide Acquisition Contracts (GWAC) held on the National Aeronautics and Space Administration (NASA) Solutions for Enterprise Wide Procurement (SEWP) V, or any other schedule not mentioned above to assist in determining acquisition strategy if you are included in one or more. Please also include Contract Number, expiration date, etc.

j. Socioeconomic data: If a small business, what type of small business are you? Are you able to comply with FAR 52.219-6 and 52.219-14 in execution of this effort? Are you able to comply with VAAR 852.219-10, VA Notice of Total Service-Disabled Veteran-Owned Small Business Set-Aside and with subcontracting limitations in 13 CFR 125.6 in execution of this effort?

6) Is your company currently providing similar services to any government agency or other non-government customers? If so, please identify the agency or non-government customer. If you are unwilling to share your customers' identity, please address whether your company offers the same or similar services, commercially (outside the federal government).

VA is requesting assistance in obtaining rough estimated pricing based on the requirements, as identified in the draft PD. The results of the estimated pricing and technical capabilities shall be used to finalize the VAs requirements prior to issuing a solicitation. Please provide a Rough Order of Magnitude (ROM) for the product/solution being proposed, if possible.

Post RFI Phase VA envisions that once RFI responses are reviewed, select responders may be invited to provide a face-to-face or telephonic briefing to VA personnel to answer additional questions with respect to the response given. VA retains sole discretion of whether any post RFI briefings are warranted, and which industry partners may be invited to provide additional market research information.

Based on market research results, the RFP/RFQ may be made available on Contracting Opportunities. It is the responsibility of interested parties to regularly monitor the Contracting Opportunities website for updates. The government will not provide hard copies of the solicitation once issued. Interested parties are responsible for monitoring the website and downloading the solicitation, its attachments, and any amendments from the internet site identified above when/if issued. All information regarding the procurement is provided herein, and no additional information shall be provided at this time.

OFFERORS ARE ADVISED THAT THIS REQUIREMENT MAY BE DELAYED, CANCELED, OR REVISED AT ANY TIME.

**PLEASE NOTE THIS IS AN AMENDMENT TO PREVIOUSLY POSTED RFI 36C10B24Q0732

Page 1 of

PRODUCT DESCRIPTION

DEPARTMENT OF VETERANS AFFAIRS

VA Central Office

Data Management and Data Analytics Software-as-a-Service (SaaS)

Date: September 19, 2024

Product Description Version Number: 3.0

PRODUCT DESCRIPTION

1.0 REQUIREMENTS:

The Office of Enterprise Integration (OEI) and Office of Information Technology are co-sponsoring the sustainment of the Common Operating Platform (COP), referred to from this point forward as the ‘National Center for Veterans Analysis and Statistics Platform’ or ‘NCVAS Platform’.

VA currently has the Palantir Foundry Software-as-a-service (SaaS) solution, which underpins its current capability. VA seeks a SaaS[footnoteRef:0] solution that provides the same functionality as the current operational decision support capability. The VA requires the SaaS solution to be authorized at the Federal Risk and Authorization Management Program (FedRAMP) High level and meet Federal Information System Management Act 2014 (FISMA) High requirements as specified in section 2.0, at time of proposal submission. VA also requires the SaaS solution to be fully configurable, deployed and ready for VA use within 14 days of award so that the SaaS solution can ingest data, metadata, transformations, and allow user configurations. VA will provide technical subject matter experts who will support connecting the SaaS Platform to the VA’s environment as well as obtaining an Authority to Operate (ATO). The vendor shall enter into a Service Level Agreement and provide the Architectural Diagram and Artifacts representing the SaaS product security controls. [0: Software as a Service (SaaS) as used here means Commercial-off-the-Shelf (COTS) software that is hosted on vendor-owned or procured cloud infrastructure and made available to VA users and other authorized users via web interface. The operation and maintenance of the software is the responsibility of the vendor and is bundled into the total price. The government shall be able to use the software without engaging separate third-party engineering or other technical help.]

The Contractor shall provide an integrated Commercial-off-the-Shelf (COTS) SaaS solution for the NCVAS Platform’s operational decision support capability. The SaaS solution shall meet the Salient Characteristics of Section 1.1.

The base support will be bound to ingestion, curation, and maintenance of Person, Veteran, and Employee Objects that include identity, demographics, military history, geospatial data, contact information, socioeconomic characteristics, and data indicating usage of VA benefits and healthcare. The Salient Characteristics detailed in Section 1.1 will enable the use cases stemming from these core data objects which may span benefits and services capacity and capability planning, preparedness, emergency response, and enterprise decision-support and will be supported through the execution of optional tasks. The VA Business Reference Model (BRM) is the means by which functional analysis, capacity, and capability modeling and analytics are accomplished in the NCVAS Platform. The BRM Objects will be extensible to performance, budget, financial, acquisition, and human capital data objects. The Platform will also support BRM configuration management and control.

The SaaS solution shall support a full operational decision-making capability that satisfies VA business and operational use case requirements, with the intent of enabling analysis of Mission and Mission Support requirements and capabilities and traceability to improve Veteran Outcomes. Cost estimates provided by potential bidders must separately address the base contract requirements and extensible use cases as optional tasks.

The COTS SaaS solution shall include software licenses, cloud hosting, implementation support (including installation, integration, configuration, testing, and deployment) necessary to replicate the data environment by establishing approximately 160 data connections, completing 1800 data ingestions, creating 15,000 datasets, and creating nearly 200,000 dataset builds within 30 days of award. Any data issues identified should be documented in the platform and resolved within the transition period. The vendor shall provide commercially available virtual training/workshops on a bi-weekly schedule for up to 30 personnel, addressing four categories of user needs: Basic End-user Familiarization, Advanced End-user training, Data Engineering and Data Pipeline training, and Leadership familiarization, for the life of the contract.

The platform implementation shall fulfill ease of use, data protection, interoperability, and privacy and security requirements as outlined in Section 1.1. VA’s desired solution will enable analysis of data as it relates to effective and efficient delivery of VA products and services and assessments of risks and issues. The base support will be bound to ingestion, curation, and maintenance of Person, Veteran, and Employee Objects that include identity, demographics, military history, geospatial data, contact information, socioeconomic characteristics, and data indicating usage of VA benefits and healthcare. Use cases stemming from these core data objects will span benefits and services capacity and capability planning, preparedness, emergency response, and enterprise decision-support and will be supported through the execution of optional tasks. The VA Business Reference Model (BRM) is the means by which functional analysis, capacity, and capability modeling and analytics are accomplished in the NCVAS Platform. The BRM Objects will be extensible to performance, budget, financial, acquisition, and human capital data objects. The Platform will also support BRM configuration management and control. The capabilities of the NCVAS Platform must be scalable based on customer demands and enable the integration of additional enterprise data for use by Administration and Staff Office decision-makers for projects executed under optional tasks/CLINS. Data products developed on NCVAS must be exportable without proprietary metadata and in formats compliant with interoperability requirements as outlined in Section 1.1.

The Contractor shall deploy and configure the software, onboard and train users and provide technical support to fully replicate the current data environment described above supporting an operational decision-making capability within 3 months following award. The VA will provide current COP related elements (e.g. data, transformations, meta-data) exported from the current solution. The Contractor shall import data, meta-data, and transformations from the current platform and/or the VA environment.

Deliverables:

A. SaaS Solution Software Licenses (due at award) B. SaaS Solution User Manual (due at award) C. Service Level Agreement (14-days after award) D. Architectural diagram (due at award)

1.1 SaaS Solution Salient Characteristics

The SaaS solution shall provide the following capabilities:

A. Ingestion and analysis of unstructured and disaggregated Person/Veteran/Employee data from a wide variety of sources and formats. The software solution shall have the ability to:

1. Securely ingest, curate, integrate, store, search, share, transfer, perform de-confliction, analyze, and visualize large amounts of disparate structured and unstructured near real-time data from a wide variety of internal and external sources, on-demand, or at a scheduled interval. The SaaS product must support the assessment of input source data quality, provide automated feedback mechanism to data stewards and business owners, and track and monitor quality issues through resolution. Product functionality must include:

a) Modeling capability for population projections

b) Ability to leverage open-source applications for programming and interoperability with other tools, platforms, and applications

c) Point and click capability to accommodate a range of technical expertise

d) Ability to process and manage multiple, large data sets comprised of tens of millions of records

e) Dynamic visualization capabilities

f) Integration and validation of:

i. Identity data

ii. Demographic data

iii. Military history data

iv. Enrollment and utilization data

v. Geospatial data

vi. Contact information

vii. Socioeconomic characteristics

2. Seamlessly integrate data ingestion, curation, visualization, analytic, and report generation capabilities

3. Be accessible, configurable, administered, and useable by various types of OEI personnel, including management analysts, data analysts, data managers, data engineers, and data scientists, to support organizational data management and data analytic needs

4. Base contract will provide up to 500 users with at least a 99.9998% availability rate and no greater than 1% performance degradation.

5. Optional Tasks/CLIN support will provide users with at least a 99.9998% availability rate and no greater than 1% performance degradation.

6. Ability to ingest, manipulate, validate, analyze, and apply machine learning algorithms to up to 20 petabytes of raw and processed data; process daily updates up to 100 terabytes, and manage large language models and complex data pipelines requiring processing components developed in a variety of languages and environments with no material degradation in performance.

7. Enable the implementation and adherence to the Data Management Book of Knowledge, current industry standards, operationalization of VA’s data stewardship policy and handbook, and the OEI data quality methodology.

8. Enable federation of metadata with the VA Enterprise Data Catalog (EDC), to include all metadata fields specified in VA’s EDC policy. This may include fields that must be manually entered.

B. Ingestion and analysis of unstructured and disaggregated mission and mission support data from a wide variety of sources and formats. The software solution shall have the ability to:

1.Securely ingest, curate, integrate, store, search, share, transfer, and perform data de-confliction and enable the extension of large amounts of disparate structured and unstructured near real-time mission and mission support data to the Person/Veteran Object. The solution will support data ingestion from a wide variety of internal and external sources, on-demand, or at a scheduled interval for use in reporting and analytics. Types of data may include:

a. Hospital capacity data

b. VA health care enrollee data

c. VA Strategic Framework and Performance data

d. VA and Program Policy and Planning data

e. Diagnostic testing data

f. Finance Data

g. Budget and Budget execution data

h. Contracts and Acquisition data

i. Facility data

j. Information Technology investment and program data

k. Human Resource data

l. Supply chain data to include medical supplies and medical equipment

m. Asset and Real-property data

n. Logistics data

o. Health data from federal partners such as Health and Human Services, and its’ subordinate departments and activities.

p. Veteran data from federal partners such as Department of Labor, Social Security Administration, Internal Revenue Service, and the Department of Defense.

2. Seamlessly integrate data ingestion, curation, visualization, analytic, and report generation capabilities

3. Be accessible, configurable, administered, and useable by various types of VA personnel staff including management analysts, data analysts, data managers, data engineers, and data scientists to support their organizational data management and data analytic needs

4. Provide unlimited users with at least a 99.9998% availability rate and no greater than 1% performance degradation (including thousands of potential outside collaborators globally)

5. Ability to ingest, manipulate, validate, analyze, and apply machine learning algorithms up to 20 petabytes of raw and processed data; process daily updates up to 100 terabytes, and manage large language models (LLMs) and complex data pipelines requiring processing components developed in a variety of languages and environments with no material degradation in performance.

6. Support the development of the VA Enterprise Information Model and transfer of metadata definitions and tagging by subject area and class, to the VA Enterprise Data Catalog.

7. integration of business strategies and processes with available data management technologies, of roles and responsibilities with data management processes and applications (e.g. allow Data Steward to curate data within the Data Catalog), and with applications and databases to automate coordination of workflows

8. Enable the implementation and adherence to the Data Management Book of Knowledge, current industry standards, operationalization of VA’s data stewardship policy and handbook, and the OEI data quality methodology.

9. Enable evaluation and reporting of orphaned data objects in support of

10. Support identification and reporting of orphaned data and data objects to enable optimization of resource utilization.

C. Provide operational decisional support to VA and its stakeholders. The software solution shall have the ability to:

1. Extend the Person/Veteran/Employee objects to VA mission and mission support data and create analytic products and visualizations the inform improvements in benefits and services delivery and Veteran outcomes.

2. Enable understanding of VA's capacity to deliver benefits and services

3. Facilitate data-driven decision support (e.g. clinical, financial, administrative) for strategic, tactical, and operational and program leaders.

4. Provide intuitive and highly configurable (e.g. adapted to a user’s preference and changing business requirements) user interfaces that can be utilized by a wide variety of users with varying technical skills including data scientists, analysts, executives, customer service representatives, logistics specialists, and contract specialists.

5. Provide user aids (e.g. online training materials, hover bar descriptions, user guides, and alerts) to guide and ease system use and manipulate findings into manageable formats (e.g. reports, dashboards).

6. Support addition of context to profiled, raw data based on business needs.

7. Enable evaluation of data and data objects, definitions, and conformance to standards.

D. Create a comprehensive analytics framework that associates data to Key Analytic Questions and decisions it informs in order to rapidly expand the data’s utility. The software solution shall have the ability to:

1. Develop, modify, and enhance the Extract, Transform, and Load (ETL) processes due to changes in dataset structures, including, but not limited to, unstructured, structured, semi-structured, RDMS, XML, JSON, flat files, non-SQL database, FHIR, API, AWS S3, and Azure data lake storage

2. Support predictive and descriptive analytics, to run machine learning algorithms, to perform data writeback

3. Enable entity resolution

4. Perform de-confliction of disparate datasets through cleansing, deterministic matching, probabilistic matching, and problem resolution capabilities and apply those results to search criteria

5. Provide data profiling capabilities, including descriptive statistics, metadata discovery, tagging, and problem identification

6. Provide master data services, including golden record creation and management

7. Allow a non-technical user to create custom queries via graphical user interfaces in real time based on sequential analytic queries

8. Develop leading indicators and performance metrics via predictive analytics for decision-making and track results of those decisions over time

9. Enable analysts to apply advanced analytics to conduct relational, temporal, geospatial, statistical and behavioral analysis to turn raw data into actionable intelligence

10. Enable analysts to perform advanced analytics in a user's preferred coding language (e.g., Java, Python, R, SQL), as well as in non-code-based point-n-click tools, with the added capability for low-code programming all within the same platform

11. Provide the ability to display and filter statistical information in interactive tabular and chart formats

12. Provide the ability to generate reports reflecting search results and analysis

13. Maintain transparency in all data transformations and analytical activities E. Designed with an open data architecture, promoting architectural interoperability. The software solution shall:

1. Be built on a distributed microservices architecture with open, well-documented Representational State Transfer Application Programming Interfaces (API) to seamlessly interface with other systems and adapt to VA's evolving needs

2. Ensure that all data and any associated metadata, including but not limited to the following: business rules, data quality issues, transformations to the data performed within the platform remains under VA control and can be exported in open, non-proprietary data formats via APIs

3. Enable data agnosticism that allows logic and analyses to be interoperable with all data types from any source at any scale

4. Enable quick and easy integration (using open standards and protocols) of new or legacy dataset structures from internal and external sources based on VA business stakeholder-defined requirements

5. Accommodate SQL Server Integration Service objects

6. Provide ability to independently develop new plugins, services, and extensions to meet new and unforeseen needs (e.g. COVID-19 response) and interfaces to external systems (e.g. Public Health Registries) without contractor or vendor support

7. Enable access to data stored within various types of databases such as ODBC, JDBC and the Internet of Things (IoT)

8. Provide the ability to export the following from the platform: the object data model, data quality metrics, data curation routines, descriptive statistics for inclusion in data monitoring and reporting functions, and analytical routines, for evaluation by Data Scientists and Data Analysts using open, standards-based APIs

9. Enable the export of raw and unstructured data, curated and refined data, and master or “golden record” data for use in external applications and reporting solutions

10. Allow users to extract metadata documentation, workflows, business processes, and reports through open, standards-based APIs in order to promote interoperability

11. Enable the export of thousands of statistical indicators into various types of reporting and analytic systems

12. Enable batch ingestion of HL7, FHIR, and EHR data

13. Ability for end-users to interact with geospatial data (zoom, filter, mark maps, select, retrieve lists based on interacting with geospatial data) F. Maintain data origin and reproducibility of all integrated data sources. Every resource (e.g., dataset, analysis, report) must retain its origin and metadata that can be traced back to the exact version of all upstream code and data dependencies. Both code and data must be supported across different, coexisting branches according to industry-standard version-control workflows. The software solution shall:

1. Provide the ability to create a dynamic data model, object-based search/discovery and analysis workflows, allow easy definition of objects, properties, and links that propagate from a source table, and provide intuitively designed ways to move between tabular and object-oriented interfaces and data analysis.

2. Provide link analysis capabilities and allow users to create objects and add (or edit) attributes for any object to use in link analysis

3. Provide the users with interactive network diagrams that display associations between records of interest and other data defined objects

4. Provide the ability to discover metadata from imported data sets, data catalogs, and ETL code

5. Provide a unified mechanism of metadata management and data discovery through an intuitive user interface so analysts will have a single point of reference while searching for data elements

6. Provide Data Managers and Data Engineers the ability to create, track, and manage data transfer processes

7. Ensure that all data written to the platform maintains its metadata, lineage, and provenance within an integrated data foundation (e.g., self-documenting code), and can be used alongside data native to the foundation

8. Provide the ability to clone and import/export data validation logic from the platform

9. Provide logic and model versioning, and metadata tracing for logic so users can understand the context for every piece of work created, including analyses and operational workflows

10. Support sequential sets of tables, or environments, on which processes (e.g. metadata management, data quality, and data curation) can operate and improve data

11. Support version control functionality to support quality rule implementation among concurrent users

12. Provide the ability to customize data lineage visualizations

13. Provide ability to import raw data, such as from spreadsheets or other sources for integration into data pipeline and reporting architecture

14. Provide configurable issue creation for datasets customizable to assign to specific groups with alerting feature

15. Provide tools to examine data health and allow users to receive notifications on data pipelines updates.

16. Provide tools to interpret datasets time last built and lineage based up datedness within broader data pipeline

17. Enable automatic row counts for all datasets

18. Provide automated alerts when data row counts are not within an automatically calculated expected range

19. Provide automatic field-level statistics for all fields in datasets

20. Enable the ability to view build duration of each dataset and data performance metrics

G. The software solution shall allow VA individuals or VA data teams to create and use workflows. The software solution shall:

1. Provide collaboration capabilities (e.g. shared workspace, reports) enabling teams comprised of technical and non-technical roles to work concurrently on the same data and merge analytical paths in one place

2. Allow users to use collaboration and knowledge management capabilities and allow analyst teams to collaborate on a project with all the information kept and shared in one location or repository (using GitHub or similar service), updated and worked on simultaneously

3. Allow analyst teams to work on the same analysis or assignment through file sharing capabilities

4. Provide work product and workspace sharing between users and allow users to control who has access to the collaboration

5. Provide the ability for users to create, track, adjudicate, and resolve data quality issues within the platform

6. Enable stewardship of data, including the ability to validate and remediate business rules and ensure data integrity

7. Allow for the creation of workflows in support of VA business and functionality

8. Allow for the creation, deletion and modification of in-system notifications or emails based on alerts or triggers

9. Allow access by teams external to VA to view and interact with reports generated using the software

10. Ability to track user view metrics of all reports and applications

11. Provide graphical user interfaces for pipeline visualization and management

12. Allow customizable build schedules with customizable alert features

13. Ability to create forms for user submitted input where input data is saved into datasets and available for rapid analysis

14. Provide version control of analytics including ability to roll-back to previous version

H. The software solution shall have the ability to provide proven granular security controls with the ability for data owners to easily control all downstream uses of the originating data and conform to VA security policies. The software solution shall:

1. Meet Federal Information System Management Act 2014 (FISMA) High security controls

2. Meet security compliance framework policies including: Federal Risk and Authorization Management (FedRAMP) High and Health Insurance Portability and Accountability Act (HIPAA)

3. Provide security and privacy protection that allows multiple levels of access for different users based on Role Based Access Controls (RBAC), Classification Based Access Controls (CBAC), and Access Control Lists (ACL)

4. Provide the ability to mask any data element (including part of a data element (e.g. first five digits of social security number) based on user privileges defined by RBAC, CBAC, and ACL

5. Propagate access control and data security through all data, data engineering transformation, data objects, data in IDE, all logic used in transformations, and all output data from IDE

6. Provide visibility of user access to and within the platform and retain an audit history of user access and actions for the duration of the contract

7. Maintain a history of user activity per session

8. Provide alerts based on abnormal usage patterns (e.g., attempts by data consumers to access sensitive data without proper privileges)

9. Provide tools to examine user-specific permissions for specific datasets and data objects

10. Provide visualizations of permissions / data restrictions and markings for all datasets Period of Performance:

12-month base period and three 12-month option periods with optional tasks for expansion of the Integrated Mission Analytics Platform. The optional tasks allow for additional SaaS support to prototype and production data and analytic projects.

2.0 ASSESSMENT, AUTHORIZATION, and CONTINUOUS MONITORING

1. The information system solution selected by the Contractor shall comply with the Federal Information Security Management Act (FISMA).

2. The Contractor shall comply with FedRAMP requirements as mandated by Federal laws and policies, including making available any documentation, physical access, and logical access needed to support this requirement.

3. The Contractor shall, where applicable, assist with the VA ATO Process to help achieve agency authorization of the cloud service or migrated application.

4. The Contractor shall provide IRP scenario within 14 days of award and complete Table-Top exercise within 21 days of award unless current VA IRP can be provided.

5. The Contractor shall provide a System Boundary Diagram that demonstrates implementation and any proposed VA interconnections including required ports and protocols at the time award.

6. The Contractor shall complete a FedRAMP System Security Plan (SSP) and supporting documentation at the time of award.

7. The Contractor shall complete a Third-Party Assessment Organization (3PAO) Security Assessment Plan (SAP) at the time of award.

8. The Contractor shall complete a 3PAO Security Assessment Report (SAR) at the time of award.

9. To the extent required to carry out the FedRAMP assessment and authorization process and FedRAMP continuous monitoring, to safeguard against threats and hazards to the security, integrity, and confidentiality of any non-public VA data collected and stored by the Contractor, the Contractor shall provide the VA access to the Contractor’s and Cloud Service Provider’s facilities, installations, technical capabilities, operations, documentation, records, and databases.

10. If new or unanticipated threats or hazards are discovered by either VA or the Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party in accordance with the security addendum B.

11. The Contractor shall not release any data without the consent of VA in writing. All requests for release must be submitted in writing to the Contracting Officer’s Representative (COR)/Contracting Officer (CO).

12. In order for live VA data to be used in this system, a FedRAMP Authorization and VA ATO will be required.

13. Identified gaps between required FedRAMP Security Control Baselines and Continuous Monitoring controls and the contractor’s implementation as documented in the Security Assessment Report shall be tracked by the contractor for mitigation in a Plan of Action and Milestones (POA&M) document. Depending on the severity of the gaps, the Department may require them to be remediated before a provisional or agency authorization is issued.

14. The Contractor shall maintain a security management continuous monitoring environment based upon the latest edition of the VA Cloud Computing Continuous Monitoring Process, FedRAMP Security Controls Baseline and FedRAMP Continuous Monitoring Strategy Plan.

15. The Contractor shall comply with all VA and FedRAMP privacy requirements.

16. VA may choose to cancel the Contract and terminate any outstanding orders if the contractor has its ATO revoked and the deficiencies are greater than VA risk tolerance thresholds.

Deliverables: Due 30-days after award A. System Boundary Diagram B. FedRAMP System Security Plan (SSP) and supporting documentation C. 3PAO Security Assessment Plan (SAP) D. 3PAO Security Assessment Report (SAR)

3.0 NOTICE OF THE FEDERAL ACCESSIBILITY LAW AFFECTING ALL INFORMATION AND COMMUNICATION TECHNOLOGY (ICT) PROCUREMENTS (SECTION 508) On January 18, 2017, the Architectural and Transportation Barriers Compliance Board (Access Board) revised and updated, in a single rulemaking, standards for electronic and information technology developed, procured, maintained, or used by Federal agencies covered by Section 508 of the Rehabilitation Act of 1973, as well as our guidelines for telecommunications equipment and customer premises equipment covered by Section 255 of the Communications Act of 1934. The revisions and updates to the Section 508-based standards and Section 255-based guidelines are intended to ensure that information and communication technology (ICT) covered by the respective statutes is accessible to and usable by individuals with disabilities.

3.1 SECTION 508 – INFORMATION AND COMMUNICATION TECHNOLOGY (ICT) STANDARDS

The Section 508 standards established by the Access Board are incorporated into, and made part of all VA orders, solicitations and purchase orders developed to procure ICT. These standards are found in their entirety at: https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines. A printed copy of the standards will be supplied upon request.

Federal agencies must comply with the updated Section 508 Standards beginning on January 18, 2018. The Final Rule as published in the Federal Register is available from the Access Board: https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule.

The Contractor shall comply with “508 Chapter 2: Scoping Requirements” for all electronic ICT and content delivered under this contract. Specifically, as appropriate for the technology and its functionality, the Contractor shall comply with the technical standards marked here:

E205 Electronic Content – (Accessibility Standard -WCAG 2.0 Level A and AA Guidelines) E204 Functional Performance Criteria E206 Hardware Requirements E207 Software Requirements E208 Support Documentation and Services Requirements

3.2 COMPATABILITY WITH ASSISTIVE TECHNOLOGY

The standards do not require installation of specific accessibility-related software or attachment of an assistive technology device. Section 508 requires that ICT be compatible with such software and devices so that ICT can be accessible to and usable by individuals using assistive technology, including but not limited to screen readers, screen magnifiers, and speech recognition software.

3.3 ACCEPTANCE AND ACCEPTANCE TESTING

Deliverables resulting from this solicitation will be accepted based in part on satisfaction of the Section 508 Chapter 2: Scoping Requirements standards identified above.

The Government reserves the right to test for Section 508 Compliance before delivery. The Contractor shall be able to demonstrate Section 508 Compliance upon delivery.

4.0 INFORMATION SECURITY CONSIDERATIONS:

All VA sensitive information should be protected in accordance with VA’s security and privacy policies while performing the tasks detailed in this Product Description.

Contractor personnel will be accountable for Non-Disclosure Agreements at time of onboarding. --- placeholder for OGC input.

While the Contractor shall strive to make reasonable accommodations to work within the VA’s security and compliance standards, the Contractor shall be allowed to use the audited and approved Contractor federal cloud service system security plan (SSP) and associated procedures as the core requirements for the operations of the system. Where there is conflict between the SSP and Addendum B below, the SSP shall control.

5.0 GOVERNMENT FURNISHED EQUIPMENT (GFE), PROPERTY (GFP), MATERIALS (GFM), AND DATA (GFD)

As deemed necessary to be required by the PM, VA will provide the following in support of solution implementation. All onsite activities will be completed virtually as directed by the PM and COR through Cisco Webex, Skype or Microsoft Teams if offices are closed due to the COVID-19 pandemic.

· Sponsored access to Government data sources immediately upon order award

· Sponsored onsite access to VA facilities for Contractor personnel, including any required badging or clearances for implementation of the SaaS Solution, trainings and support.

· Government equipment is not applicable to this acquisition

· Office space shall be provided on an ad-hoc basis as needed when VA requires contractor personnel to come on site for assistance.

5.1 ONBOARDING SUPPORT

The Contractor shall manage the onboarding process for VA access and to individual system/environment access for all Contractors. The Contractor shall collect signed rules of behavior documents, signed non-disclosure agreements, training certificates, Contractor Background Investigation Request (CBIR), Special Agreement Check (SAC), Fingerprint Request Form (FPV), Declaration for Federal Employment (SF306), Release of Information (VA Form 0710), Self-Certification of Continuous Service (SC), applications for access to VA information systems, TMS, Personal Identity Verification (PIV) card requests and other related information, for assigned projects, and provide secure storage for the documents and files, in accordance with VA guidance. The Contractor shall provide the documents, files and information to VA PgM, PM, COR or IT staff, when requested, to support VA’s onboarding process for granting access to VA systems. The Contractor shall submit access requests, including TMS applications, PIV card applications, Service Now tickets, and electronic Contractor Access Request Forms (eCARFs). The Contractor shall monitor the submission of the artifacts and follow up with Contractors to assure that all artifacts submitted are complete and correct. The Contractor shall also track VA system access requests, for assigned projects, to completion. All findings shall be documented in the Work Plan.

Page 1 of Page 1 of

2.

3.

5.

8.

9.

11.

13.

15.

17.

Would the VA perform any code conversions?

The COTS SaaS solution shall include software licenses, cloud hosting, implementation support (including installation, integration, configuration, testing, and deployment) necessary to replicate the data environment by establishing approximately 160 data connections, completing 1800 data ingestions, creating 15,000 datasets, and creating nearly 200,000 dataset builds within 30 days of award.

VA will help with questions during the migration but will not do any code conversions. The current technology is API-driven service mesh, managed cloud infrastructure, Integrated security & governance, LLMS, and AI & Modeling.

19.

20.

21.

Is there a migration required?"

The COTS SaaS solution shall include software licenses, cloud hosting, implementation support (including installation, integration, configuration, testing, and deployment) necessary to replicate the data environment by establishing approximately 160 data connections, completing 1800 data ingestions, creating 15,000 datasets, and creating nearly 200,000 dataset builds within 30 days of award.

VA will help with questions during the migration but will not do any code conversions. The current technology is API-driven service mesh, managed cloud infrastructure, Integrated security & governance, LLMS, and AI & Modeling.

25.

26.