36C10B25Q0389.docx

Heuristic Behavior Analytics (HBA)

VA-25-00017469

GENERAL INFORMATION

SET-ASIDE

Technology Acquisition Center

23 Christopher Way Eatontown NJ 07724

POINT OF CONTACT*

Contract Specialist Julia Renna julia.renna@va.gov

PLACE OF PERFORMANCE

ADDRESS

POSTAL CODE

COUNTRY

ADDITIONAL INFORMATION

AGENCY’S URL

URL DESCRIPTION

AGENCY CONTACT’S EMAIL ADDRESS

EMAIL DESCRIPTION

DESCRIPTION

Request for Information Heuristic Behavior Analytics (HBA) (Recompete) / 36C10B25Q0389

VA-25-00017469

1. Introduction

This Request for Information (RFI) is for planning purposes only and shall not be considered an Invitation for Bid, Request for Task Execution Plan, Request for Quotation or a Request for Proposal. Additionally, there is no obligation on the part of the Government to acquire any products or services described in this RFI. Your response to this RFI will be treated only as information for the Government to consider. You will not be entitled to payment for direct or indirect costs that you incur in responding to this RFI. This request does not constitute a solicitation for proposals or the authority to enter into negotiations to award a contract. No funds have been authorized, appropriated or received for this effort. Interested parties are responsible for adequately marking proprietary, restricted or competition sensitive information contained in their response. The Government does not intend to pay for the information submitted in response to this RFI.

This action may be competed under the Transformation Twenty One Total Technology Next Generation multiple award, indefinite delivery, indefinite quantity contract using fair opportunity procedures in accordance with Federal Acquisition Regulation 16.505. One of the purposes of issuing this RFI is to determine the availability of Small Business Administration (SBA) Veteran Small Business Certification Program (VetCert) Service-Disabled Veteran-Owned Small Businesses (SDVOSBs) and Veteran Owned Small Businesses (VOSBs) that are capable of providing the services identified in the attached Performance Work Statement (PWS) that are not T4NG Contract holders. An SDVOSB/VOSB company that is not in the SBA certification database (https://veterans.certify.sba.gov/) should not respond to this notice.

The North American Industry Classification System (NAICS) for this requirement is 541512 with a size standard of $34 million.

2. Submittal Information:

All responsible sources may submit a response in accordance with the below information.

There is a page limitation for this RFI of 10 pages. The Government will not review any other information or attachments included, that are in excess of the 10-page limit. NO MARKETING MATERIALS ARE ALLOWED AS PART OF THIS RFI. Generic capability statements will not be accepted or reviewed. Your response must address capabilities specific to the services required in the attached PWS and must include the following:

a. Interested Vendors shall at a minimum, provide the following information in the initial paragraph of the submission:

Name of Company Address Point of Contact Phone Number Fax Number Email address Company Business Size and Status For VOSB and SDVOSBs, proof of verification in SBA VetCert.

NAICS code(s) Socioeconomic data Data Universal Numbering System (DUNS) Number Existing Contractual Vehicles (GWAC, FSS, or MAC)

b. Provide a summary of your capability to meet the requirements contained within the draft PWS for the following areas:

a. Provide a summary of your technical capability to meet the PWS requirements.

c. Corporate experience or expertise in performing these services and specific examples or references. Specific examples or references provided must include the agency, point of contact, dollar value, and contract number.

a. Your company’s intent and ability to meet the set aside requirement in accordance with VAAR 852.219-73 (JAN 2023) (DEVIATION) VA Notice of Total Set-Aside For Certified SDVOSBs and 13 CFR §125.6, which states the contractor will not pay more than 50% of the amount paid by the government to the prime for contract performance to firms that are not certified SDVOSBs listed in the SBA certification database (excluding direct costs to the extent they are not the principal purpose of the acquisition and the SDVOSB/VOSB does not provide the service, such as airline travel, cloud computing services, or mass media purchases). When a contract includes both services and supplies, the 50 percent limitation shall apply only to the service portion of the contract.

Your response shall include information as to available personnel and financial resources; full names of proposed team members and the PWS requirements planned to be subcontracted to them, which must include the prime planned percentage or the names of the potential team members that may be used to fulfill the set aside requirement.

b. Has the draft PWS provided sufficient detail to describe the technical requirements that encompass the software development and production operations support services to be performed under this effort.

______ YES _______ NO (if No, answer question c)

c. If “NO”, please provide your technical comments/recommendations on elements of the draft PWS that may contribute to a more accurate proposal submission and efficient, cost-effective effort.

Responses are due by COB, Tuesday, June 24, 2025 via email to Julia Renna, Contract Specialist at julia.renna@va.gov, Andrea Caltabilota, Contract Specialist at andrea.caltabilota@va.gov and Evan Schlisserman, Contracting Officer at evan.schlisserman@va.gov. Please note “36C10B25Q0389” in the subject line of your response. Mark your response as “Proprietary Information” if the information is considered business sensitive. The email file size shall not exceed 5 MB.

Sources Sought Notice Sources Sought Notice

Sources Sought Notice

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Office of Information & Technology Office of Information Security (OIS) Cyber Security Operations Center (CSOC) Heuristic Behavior Analytics (HBA) Recompete

Date: June 10, 2025 PWS Version Number: 1.1

Contents

BACKGROUND

The mission of the VA is to provide benefits and services to Veterans of the United States. In meeting these goals, VA Office of Information & Technology (OIT) and the Office of Information Security (OIS) strive to provide high quality, effective, efficient, and secure Information Technology (IT) services to those responsible for providing care to the Veterans at the point-of-care, as well as throughout all the points of the Veterans’ health care environment in an effective, timely and compassionate manner.

In order to support this mission, OIT and OIS are chartered to provide robust cybersecurity protections for Veterans, VA information, and VA information systems, and infrastructure. OIS ensures the resiliency of VA’s cybersecurity infrastructure through proactive monitoring, adaptive response, adherence to federal requirements and best practices. OIS must continue to evolve its information security program to address existing deficiencies, match the growing and evolving cybersecurity threat landscape, minimize risks from the use of new technologies, address existing deficiencies, and align with federal cybersecurity strategies and direction.

Heuristic Behavior Analytics (HBA) is a significant part of VA’s overall defensive security strategy which provides comprehensive visibility into user account activity, data, and cyber traffic as it enters, exits, and moves throughout the network. The VA seeks continual analysis of heuristic behaviors by defining normal baselining behavior and traffic patterns which will provide a baseline for identifying anomalies. Alerts generated by anomalies to solution defined patterns and algorithms are forwarded to the appropriate security devices such as Security Orchestration Automation and Response (SOAR) and Security Information and Event Management (SIEM) or Cyber Security Operations Center (CSOC) analyst for investigation

APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. 44 U.S.C. § 3541-3549, “Federal Information Security Management Act (FISMA) of 2002”

2. “Federal Information Security Modernization Act of 2014”

3. Federal Information Processing Standards (FIPS) Publication 140-2, “Security Requirements for Cryptographic Modules”

4. FIPS Pub 199. “Standards for Security Categorization of Federal Information and Information Systems,” February 2004

5. FIPS Pub 200, “Minimum Security Requirements for Federal Information and Information Systems,” March 2006

6. FIPS Pub 201-2, “Personal Identity Verification of Federal Employees and Contractors,” August 2013

7. 10 U.S.C. § 2224, "Defense Information Assurance Program"

8. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

9. Public Law 109-461, Veterans Benefits, Health Care, and Information Technology Act of 2006, Title IX, Information Security Matters

10. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”

11. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, https://www.va.gov/vapubs/index.cfm

12. VA Handbook 0710, “Personnel Security and Suitability Program,” May 2, 2016, https://www.va.gov/vapubs/index.cfm

13. VA Directive and Handbook 6102, “Internet/Intranet Services,” August 5, 2019

14. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and Guidelines,” January 18, 2017

15. Office of Management and Budget (OMB) Circular A-130, “Managing Federal Information as a Strategic Resource,” July 28, 2016

16. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed Services (CHAMPUS)”

17. NIST SP 800-66 Rev. 1, “An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule,” October 2008

18. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended, January 18, 2017

19. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

20. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021

21. VA Handbook 6500, “Risk Management Framework for VA Information Systems VA Information Security Program,” February 24, 2021

22. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI),” March 12, 2019

23. VA Handbook 6500.5, “Incorporating Security and Privacy into the System Development Lifecycle,” March 22, 2010

24. VA Handbook 6500.6, “Contract Security,” March 12, 2010

25. VA Handbook 6500.8, “Information System Contingency Planning,” April 6, 2011

26. VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018

27. VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017

28. OIT Process Asset Library (PAL), https://www.va.gov/process/ . Reference Process Maps at https://www.va.gov/process/maps.asp and Artifact templates at https://www.va.gov/process/artifacts.asp

29. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

30. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014

31. VA Handbook 6508.1, “Procedures for Privacy Threshold Analysis and Privacy Impact Assessment,” July 30, 2015

32. VA Handbook 6510, “VA Identity and Access Management,” January 15, 2016

33. VA Directive and Handbook 6513, “Secure External Connections,” October 12, 2017

34. VA Directive 6300, “Records and Information Management,” September 21, 2018

35. VA Handbook, 6300.1, “Records Management Procedures,“ March 24, 2010

36. NIST SP 800-37 Rev 2, “Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy,” December 2018

37. National Institute of Standards and Technology. (n.d.). NIST Special Publication 800- 53 (Rev. 4) AU-2 AUDIT EVENTS – Retrieved August 06, 2019, from https://nvd.nist.gov/800-53/Rev4/control/AU-2

38. MITRE ATT&CK Framework – https://attack.mitre.org/

39. The White House - Office of the Press Secretary. (2016, July 26). Presidential Policy Directive - United States Cyber Incident Coordination – Retrieved August 15, 2019, from https://obamawhitehouse.archives.gov/the-press-office/2016/07/26/presidential-policy-directive-united-states-cyber-incident.

40. VA Handbook 6500.3, “Assessment, Authorization, and Continuous Monitoring of VA Information Systems,” February 3, 2014 and NIST Special Publication 800- 37, Revision 1

41. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020)

42. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015

43. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” March 24, 2014

44. OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005

45. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019

46. OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008

47. Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance, December 2, 2011, (NOTE: Part A of the FICAM Roadmap and Implementation Guidance, v2.0, was replaced in 2015 with an updated Architecture (https://arch.idmanagement.gov/#what-is-the-ficam-architecture)

48. NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access,“ June 2018

49. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, “Digital Identity Guidelines,” updated March 02, 2020

50. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014

51. NIST SP 800-164, “Guidelines on Hardware-Rooted Security in Mobile Devices (Draft),” October 2012

52. Draft National Institute of Standards and Technology Interagency Report (NISTIR) 7981, “Mobile, PIV, and Authentication,” March 2014

53. VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

54. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

55. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

56. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

57. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019

58. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008

59. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (Public Law 110–140), December 19, 2007

60. Section 104 of the Energy Policy Act of 2005, (Public Law 109–58), August 8, 2005

61. Executive Order 13834, “Efficient Federal Operations,” dated May 17, 2018

62. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 2, 2001

63. VA Directive 0058, “VA Green Purchasing Program,” July 19, 2013

64. VA Handbook 0058, “VA Green Purchasing Program,” July 19, 2013

65. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

66. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

67. “Veteran Focused Integration Process (VIP) Guide 4.0,” January 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

68. VA Memorandum “Proper Use of Email and Other Messaging Services,” January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

69. “DevSecOps Product Line Management Playbook” version 2.0, May 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

70. NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020

71. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol Version 6 (IPv6),” November 19, 2020

72. Social Security Number (SSN) Fraud Prevention Act of 2017

73. Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23, 2018

SCOPE OF WORK

The Contractor shall provide project management, technical services and support for the VA HBA project. The HBA solution is comprised of the Everfox User and Entity Behavior Analytics (UEBA) appliance and User Activity Monitor (UAM) software, Corelight Zeek Network Traffic Analytics, and Response (NTAR) appliances. This solution is built on the current technologies and adheres to VA Enterprise Security Directives and Standards. It ensures VA compliance with various regulations, including the Health Insurance Portability and Accountability Act (HIPAA) Privacy and Security Rule, the Health Information Technology for Economic and Clinical Health (HITECH) Act, the Privacy Act, National Institute of Standards and Technology (NIST) guidelines, the Federal Information Security Management Act (FISMA), the Federal Acquisition Regulation (FAR), and other laws and regulations that protect sensitive VA data. The Contractor shall provide all technical services required to support the HBA solution, including implementation, engineering, customer service support, training, testing, configuration management and disaster recovery.

0. ORDER TYPE

The effort shall be proposed on a Firm Fixed Price (FFP) basis.

PERFORMANCE DETAILS

0. PERFORMANCE PERIOD

The Period of Performance (PoP) shall be one 12-month Base Period and two 12-month option periods, if exercised. The PoP shall also include six optional tasks. The total PoP shall not exceed 36 months.

Any work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO). If required, the CO may designate the Contractor to work during holidays and weekends.

There are eleven (11) Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, five are set by date:

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

0. PLACE OF PERFORMANCE

Efforts under this TO shall be performed at Contractor facilities located in the Contiguous United States (CONUS). The Government reserves the right to require any and/or all personnel to work at a government facility with 30 days notice. The Contractor shall identify the Contractor’s place of performance in their proposal submission.

0. Travel The Government does not anticipate travel will be required to complete the effort associated with this TO.

SPECIFIC TASKS AND DELIVERABLES

The Contractor shall perform the following:

0. PROJECT MANAGEMENT

4. CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, timeline, and tools to be used in execution of this TO effort. The CPMP should take the form of both a narrative and graphic format that displays schedule, milestones, risks, and resource support.The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPMP shall be concurred upon and updated in accordance with Section B of the contract. The Contractor shall update and maintain the VA Program Manager (PM) approved CPMP throughout the PoP.

The CPMP shall include a methodology for implementation of the additional software (SW) and hardware (HW) & Maintenance for optional implementations.

The CPMP shall take the approach that this will be a phased implementation during the course of the entire period of performance. Implementation targets to be considered specifically are:

1. VA Financial Services; Austin TX

2. VA CRRC, Martinsburg WV,

3. VA CSOC, Hines IL

4. High Value Assets, VACO Washington DC

5. High Potential Risk Assets

6. High Network Visibility locations

The CPMP shall include subsidiary plans which further detail the approach to be used for each aspect of the task order. The Contractor may, as it deems appropriate, expand on the minimum subsidiary plans.

The CPMP Subsidiary plans shall include the following (at a minimum):

1. Implementation Schedule Plan as new candidates (hosts or accounts) for UEBA monitoring and new locations for NTAR sensors are identified.

2. Staffing Management Plan: shall illustrate and detail the arrangement of Management, Key, and Support personnel assigned to the TO, as well as corporate reach-back for staff augmentation.

3. Communications Plan: shall list the roles and contact information of all Management and Key personnel both for the Contractor and Government, tasks and functional area assignments and associations.

4. Risk Management Plan: shall detail all risks that actually or potentially impact contract success, to include a common name or title, probability, impact, risk score, origin, explanation, planned or recommended mitigation.

VA can provide templates for each plan and the VA PM will provide guidance to the Contractor on the necessary input/information that is required to develop the outputs for each one of the subsidiary plans.

Deliverable:

A. Contractor Project Management Plan (CPMP)

4. REPORTING REQUIREMENTS

The Contractor shall provide a Weekly Activity Report (WAR), a Weekly Work Breakout Schedule (WBS), and Weekly Integrated Master Schedule (IMS) updates to the COR and VA PM addressing all work completed during the preceding reporting period and shall present the work to be accomplished during the subsequent period(s) for each task as described in Section 5.0.

The Contractor shall attend weekly teleconference meetings with the VA PM or as requested. The Contractor shall discuss and document any issues, pending deliverables, or other pertinent topics concerning the task areas. Each report shall include the work schedule by name for everyone assigned to this TO. Each report shall identify any issues that arose and identify any issues that have arisen but have not been completely resolved with an explanation.

The Contractor shall establish and attend quarterly meetings with the VA stakeholders, contractor project Subject Matter Experts (SME), and other points of contact (POC) to include solution provider POCs. The Contractor shall discuss and document any issues, pending deliverables, or other pertinent topics concerning the task areas. The Contractor shall provide a Quarterly Status Report. Each report shall include assigned action items with designated POCs, schedule, and plan for resolution(s). Each report shall include a quarterly rollup of the issues and resolutions discussed during the weekly teleconference meetings.

The Contractor shall define and report on key issues and metrics, to include performance, cyber resiliency, time to detect, time to investigate, time to mitigate, false positive, and false negative metrics as the basis to evaluate goal achievement.

Deliverables:

A. Weekly Activity Report (WAR) B. Weekly Work Breakout Schedule (WBS) C. Weekly Integrated Master Schedule (IMS) D. Quarterly Status Reports

4. TRAINING

The Contractor shall ensure all VA-CSOC Contract Personnel engaged on this effort complete VA required and provided training. The current core requirements include VA Privacy and Information Security Awareness Training and Rules of Behavior Status. Role based specific training of equivalent complexity may also be required. VA has the right to modify the training requirements. Completion of these training requirements are required during the on-boarding of personnel and required to begin individual performance.

The Contractor shall provide the VA COR with progress and completion status in the form of a Training Status Report. The Training Status Report shall convey the following: first and last name of all Contractor personnel engaged on the effort, their initial training completion date(s), next required training date. The training status report and completion certificates shall be maintained by the Contractor in a VA provided central location. The training referenced above is required to be renewed annually.

Deliverables:

A. Training Status Report B. VA Training Certificates C. Signed Contractor Rules of Behavior

4. TECHNICAL KICKOFF MEETING

A technical kickoff meeting shall be held within 10 days after TO award. The Contractor shall coordinate the date, time, and location (can be virtual) with the Contracting Officer (CO), as the Post-Award Conference Chairperson, the VA PM, as the Co-Chairperson, the Contract Specialist (CS), and the COR. The Contractor shall provide a draft agenda to the CO and VA PM at least five (5) calendar days prior to the meeting. Upon Government approval of a final agenda, the Contractor shall distribute to all meeting attendees. During the kickoff-meeting, the Contractor shall present, for review and approval by the Government, the details of the intended approach, work plan, and project schedule for each effort via a Microsoft Office PowerPoint presentation. At the conclusion of the meeting, the Contractor shall update the presentation with a final slide entitled “Summary Report” which shall include notes on any major issues, agreements, or disagreements discussed during the kickoff meeting and the following statement “As the Post-Award Conference Chairperson, I have reviewed the entirety of this presentation and assert that it is an accurate representation and summary of the discussions held during the Technical Kickoff Meeting for the Heuristic Behavior Analytics effort.” The Contractor shall submit the final updated presentation to the CO for review and signature within three (3) calendar days after the meeting. The Contractor shall also work with government PM/Technical Lead to prepare and submit meeting minutes to VA for approval. Once the meeting minutes are approved the contractor shall distribute the meeting minutes of the kickoff meeting to the CO, COR, and all attendees within three (3) calendar days after the meeting.

Deliverables:

A. Draft Agenda B. Kickoff Meeting Presentation C. Meeting Minutes

0. HBA HARDWARE/SOFTWARE REQUIREMENTS

The Department of Veterans Affairs (VA) requires renewal maintenance for existing Corelight Zeek NTARs Hardware Sensors, Suricata, and ET Pro Capacity with Enterprise Support; and Everfox UAM Subscriptions. In addition, the VA seeks to acquire added Corelight Zeek hardware, associated maintenance, subscriptions, and support; and Everfox UAM subscriptions. These sensors are scoped and configured to support actual VA network traffic bandwidth without packet loss or other negative performance in a non-clustered configuration and are capable of enhancement as future requirements for traffic bandwidth mandate.

5. Corelight Zeek Sensors Maintenance, Suricata, and Subscription

5. FORCEPOINT UAM Subscription

0. HBA IMPLEMENTATION, CONFIGURATION, AND CHANGE MANAGEMENT

The Contractor shall provide implementation, configuration and change management services that are consistent with VA’s standard implementation and deployment methodology and configure the HBA solution to meet all VA’s requirements as stipulated in this PWS. The Contractor shall also provide guidance on alternative approaches to minimize future customizations of the solution and provide all configuration and testing of the systems prior to deployment. All accepted guidance will require an update to the HBA Implementation Plan.

The full enterprise implementation shall be completed within the first 90 days of the contract award and considered complete once all UAM agents are deployed, all systems are up and running and providing data.

The Contractor shall provide a HBA Implementation Plan which shall include all requirements necessary to provide and maintain a fully operational HBA solution environment to support project management and include HBA installation support through policy development, planning, testing, implementation, installation, training, at an Enterprise level. This includes, but is not limited to, deployment of UAM agents across the enterprise, and network interconnectivity to supporting systems.

The Implementation Plan shall also include a timeline for each phase that will enable effective monitoring of the progress. The Implementation Plan is due 30 days after award of Task Order. An updated plan must be submitted within 30 days of a change. All changes must be approved by the COR/PM prior to the change taking effect.

The Contractor shall prepare a Change and Configuration Management Plan in accordance with all applicable regulatory policy and guidance. The Change and Configuration Management Plan shall contain all information relevant to defining and modifying the solution from the initial baseline configuration and subsequent re-baselining activities, all risks, potential or real, must be identified. The Change and Configuration Management Plan shall be delivered within 30 days of Task Order award and updated monthly thereafter.

Deliverables:

A. Enterprise Implementation of UAM Agents Report B. HBA Implementation Plan C. Change and Configuration Management Plan

0. ENGINEERING SUPPORT

The Contractor shall provide engineering support to the CSOC and assist the CSOC in establishing processes to provide continual analysis of heuristic behaviors by defining and providing normal baselining behavior of UEBA solutions and traffic patterns of NTAR solutions. The Contractor shall assist the CSOC in understanding the Alerts generated by anomalies to solution defined patterns and algorithms and ensure they are forwarded to the appropriate security devices such as SOAR and SIEM or analyst. The contractor shall provide direct engineering support for capacity expansion as required. The contractor must support and ensure that the solution operation and future implemented deployments continue to meet at a minimum all the requirements established in Appendix B.

0. CUSTOMER SERVICE SUPPORT

The Contractor shall provide 24/7/365 customer service phone support, Internet accessible Operating System (OS)/application patch update support, and 24-hour appliance Return Merchandise Authorization (RMA) support. Any telephone support provided by the Contractor shall be at no additional cost. Unresolved support issues will be elevated to the VA Enterprise Service Desk for submission of a service ticket. The Contractor shall also provide input and technical support to VA help/service desks on all layers until resolution.

0. TESTING

The Contractor shall provide pre-deployment testing. The Contractor shall be responsible for performing all testing activities related to the deployment and use of the HBA solution. The testing must ensure that all changes associated with a patch or upgrade are validated as safe against the entirety of the HBA system, VA, and Governance Requirements. The Contractor shall deliver testing results to the Government for approval that demonstrate that the any hardware and software changes compliant with all PWS requirements as outlined in section 5.2 and Appendix B. The Contractor shall perform the following testing to include functional, accessibility, system, reliability, usability, interoperability, regression, security, and performance of the system. The Contractor shall provide the Test Report prior to deployment in the production environment. Deployment to production environment will commence after government review of test results.

Deliverable:

A. Test Report

0. DISASTER RECOVERY

The Contractor shall provide a Comprehensive Disaster Recovery Plan (DRP) to include Recovery of Data, Recovery of Application, Recovery of Connections, and Recovery to full operational status post failure or validate the existing DRP. The plan must define and ensure capabilities exist to recover local, multi-site, muti-cloud. Identify techniques to ensure full data recovery post failure and establish how continuous data protection will be achieved. The DRP shall set a recovery time objective (RTO) goal of 8 hours. The Contractor shall perform and complete a Tabletop DRP exercise on an annual basis as requested by the Information Systems Security Officer (ISSO) and provide the results of the exercise within 5 business days. The exercise shall successfully emulate an accurate account of disaster recovery processes and procedures. All findings shall be remediated within 30 days of completion of exercise or other extended timing as decided by the government, based upon finding. All remediation efforts shall be approved by the ISSO and/or CSOC Team Lead before any remediation action is started. Additionally, all findings and resulting shall be provided to both ISSO and CSOC.

Deliverable:

A. Comprehensive Disaster Recovery Plan B. Tabletop DRP Exercise Results

0. option period

If the Option Period(s) are exercised by VA, the Contractor shall continue to perform the tasks embodied in this PWS inclusive of all subparagraphs, and provide all requested deliverables for one year.

0. Transition Out Support OPTIONAL TASK 1 The Contractor shall provide Transition-Out activities for a period of 90-days to transition support from the current contract to a follow-on contract or Government entity. This transition may be to a government entity or to another Contractor or to the incumbent Contractor under a new contractual vehicle. The Contractor shall produce a Transition-Out Plan for COR/ PM review and approval no later than 30 days prior to planned execution date. Once approved the plan shall be executed. The Contractor shall perform formal coordination with Government staff and successor staff and management. The Transition-Out Plan shall also include delivery of copies of all artifacts delivered under this effort, as well as existing policies and procedures, and delivery of baseline metrics and statistics. This Transition-Out Plan, at a minimum, shall include:

Coordination with Government representatives

1. Review, evaluation, and transition of current support services.

2. Transition of historic data to new Contractor.

3. Produce status on all necessary business and/ or technical documentation.

4. Orientation phase and program to introduce Government and Contractor personnel and programs.

5. Disposition of Contractor purchased Government owned assets.

6. Transfer of GFE and Government Furnished Information, and GFE inventory management assistance.

7. Turn-in of all Government keys, ID/ access cards, and security codes.

As part of the transition activities, the Contractor shall also hold a TO Close-Out meeting and provide an oral presentation, PowerPoint briefing, which summarizes its Transition Plan steps and outcomes. This meeting shall include the Contractor identifying any issues encountered and any future upgrade projects. The Contractor shall address key issues, to include defining performance, cyber resiliency, time to detect, time to investigate, time to mitigate, false positive, and false negative metrics as the basis to evaluate goal achievement, whether any projects have adequately demonstrated through testing that the system meets its functional and performance requirements and whether the system is adequately supported by documentation, training, etc. All final reports, status updates, and transfer of all appropriate records to the COR shall be accomplished before this close-out meeting.

The contractor shall provide a Post-Project Review which include lessons learned. Lessons learned include problem(s), solutions(s), mitigation, and the cognizant VA point of contact. A Post-Project Review document in MS PowerPoint shall be delivered along with the Transition-out Plan.

The contractor shall provide Recorded Project Debrief in VA TEAMS format. The content of the debrief shall consist of all items listed in Task 5.8 Transition Out.

If VA TEAMS is no longer the VA collaboration solution, the contractor shall complete the recording utilizing the current solution.

Deliverable:

A. Transition-Out Plan B. Post-Project Review Document C. Recorded Project Debrief

0. Hardware for Three Trusted internet connections (TIC) Gateways OPTIONAL TASK 2 If exercised, Hardware Maintenance, as referenced in Line Item 2 in the table below, may be exercised one time per period of performance, for a maximum of three times throughout the Task Order. Line Items 1 and 3 referenced in the table below may be exercised a maximum of one time throughout the Task Order.

0. Forcepoint UAM Subscription Additional Licenses– Optional Task 3 If exercised, this Optional Task may be exercised one time per period of performance, for a maximum of three times throughout the Task Order.

0. Forcepoint UAM Subscription Additional Licenses– Optional Task 4 If exercised, this Optional Task may be exercised one time per period of performance, for a maximum of three times throughout the Task Order.

0. Hardware for Six Data Centers – Optional Task 5 If exercised, this Optional Task may be exercised one time per period of performance, for a maximum of three times throughout the Task Order.

0. Hardware for four Medical Centers – Optional Task 6 If exercised, this optional task may be exercised one time per period of performance, for a maximum of three times throughout the task order.

0. Professional Services – Optional Task 7

If exercised, this optional task may be exercised for 200 hours one time per period of performance, for a maximum of three times throughout the task order.

GENERAL REQUIREMENTS

0. ENTERPRISE AND IT FRAMEWORK

19. VA TECHNICAL REFERENCE MODEL

The Contractor shall comply with the VA OIT Technical Reference Model (VA TRM). Compliance with the VA TRM is achieved by using only technologies and standards that are listed as approved for use in the VA TRM. The Contractor shall provide all necessary information requested by VA to ensure TRM approval is obtained prior to use on VA’s network.

19. FEDERAL IDENTITY, CREDENTIAL, AND ACCESS MANAGEMENT (FICAM)

The Contractor shall ensure Commercial Off-The-Shelf (COTS) product(s), software configuration and customization, and/or new software are Personal Identity Verification (PIV) card-enabled by accepting HSPD-12 PIV credentials using VA Enterprise Technical Architecture (ETA), https://www.ea.oit.va.gov/EAOIT/VA_EA/Enterprise_Technical_Architecture.asp, and VA Identity and Access Management (IAM) approved enterprise design and integration patterns, https://www.oit.va.gov/library/recurring/edp/index.cfm. The Contractor shall ensure all Contractor delivered applications and systems comply with the VA Identity, Credential, and Access Management policies and guidelines set forth in VA Handbook 6510 VA Identity and Access Management, VA Handbook 0735 Homeland Security Presidential Directive 12 (HSPD-12) Program, and align with the Federal Identity, Credential, and Access Management Roadmap and Implementation Guidance v2.0.

The Contractor shall ensure all Contractor delivered applications and systems provide user authentication services compliant with the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-63-3, VA Handbook 6500 Appendix F, “VA System Security Controls”, and VA IAM enterprise requirements for direct, assertion based authentication, and/or trust based authentication, as determined by the design and integration patterns. Direct authentication at a minimum must include Public Key Infrastructure (PKI) based authentication supportive of PIV card and/or Common Access Card (CAC), as determined by the business need.

The Contractor shall ensure all Contractor delivered applications and systems conform to the specific Identity and Access Management PIV requirements set forth in the Office of Management and Budget (OMB) Memoranda M-05-24, M-19-17, and NIST Federal Information Processing Standard (FIPS) 201-2. OMB Memoranda M-05-24 and M-19-17 can be found at: https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2005/m05-24.pdf, and https://www.whitehouse.gov/wp-content/uploads/2019/05/M-19-17.pdf respectively. Contractor delivered applications and systems shall be on the FIPS 201-2 Approved Product List (APL). If the Contractor delivered application and system is not on the APL, the Contractor shall be responsible for taking the application and system through the FIPS 201 Evaluation Program.

The Contractor shall ensure all Contractor delivered applications and systems support:

1. Automated provisioning and are able to use enterprise provisioning service.

2. Interfacing with VA’s Master Person Index (MPI) to provision identity attributes, if the solution relies on VA user identities. MPI is the authoritative source for VA user identity data.

3. The VA defined unique identity (Secure Identifier [SEC ID] / Integrated Control Number [ICN]).

4. Multiple authenticators for a given identity and authenticators at every Authenticator Assurance Level (AAL) appropriate for the solution.

5. Identity proofing for each Identity Assurance Level (IAL) appropriate for the solution.

6. Federation for each Federation Assurance Level (FAL) appropriate for the solution, if applicable.

7. Two-factor authentication (2FA) through an applicable design pattern as outlined in VA Enterprise Design Patterns.

8. A Security Assertion Markup Language (SAML) implementation if the solution relies on assertion-based authentication. Additional assertion implementations, besides the required SAML assertion, may be provided as long as they are compliant with NIST SP 800-63-3 guidelines.

9. Authentication/account binding based on trusted Hypertext Transfer Protocol (HTTP) headers if the solution relies on Trust based authentication.

10. Role Based Access Control.

11. Auditing and reporting capabilities.

12. Compliance with VIEWS 00155984, PIV Logical Access Policy Clarification https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896.

The required Assurance Levels for this specific effort are Identity Assurance Level 3, Authenticator Assurance Level 3, and Federation Assurance Level 3.

19. INTERNET PROTOCOL VERSION 6 (IPv6)

The Contractor solution shall support IPv6-Only based upon the memo issued by the Office of Management and Budget (OMB) on November 19, 2020 (https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-07.pdf). Which defines IPv6-only as the state of an operational system or service when IPv4 protocol functions (addressing, packet forwarding) are not in use. The NIST USGv6 profile defines technical requirements for a product to be capable of operating in IPv6-Only environments. IPv6-Only technology, in accordance with the USGv6 Program (https://www.nist.gov/programs-projects/usgv6-program/usgv6-revision-1), NIST Special Publication (SP) 500-267B Revision 1 “USGv6 Profile” (https://doi.org/10.6028/NIST.SP.500-267Br1), and NIST SP 800-119 “Guidelines for the Secure Deployment of IPv6” (https://doi.org/10.6028/NIST.SP.800-119), compliance shall be included in all IT infrastructures, application designs, application development, operational systems and sub-systems, and their integration. In addition to the above requirements, all devices, applications, and systems shall support all applicable functionality on native IPv6-Only as well as dual stack (IPv6 / IPv4) connectivity without additional memory or other resources being provided by the Government, so that they can function in a mixed environment.