36C10B26Q0078.docx

Network Engineering, Design, Implementation and Infrastructure Support (NEDIIS)

VA-26-00019737

GENERAL INFORMATION

Technology Acquisition Center

23 Christopher Way Eatontown NJ 07724

POINT OF CONTACT*

Contract Specialist Diana Sesta diana.sesta@va.gov

PLACE OF PERFORMANCE

ADDRESS

POSTAL CODE

COUNTRY

ADDITIONAL INFORMATION

AGENCY’S URL

URL DESCRIPTION

AGENCY CONTACT’S EMAIL ADDRESS

EMAIL DESCRIPTION

DESCRIPTION

This is an RFI/Source Sought for Network Engineering, Design, Implementation and Infrastructure Support (NEDIIS) ReCompete. Please see the attached for more information.

Request for Information Network Engineering, Design, Implementation and Infrastructure Support (NEDIIS)

1. Introduction

This Request for Information (RFI) is for planning purposes only and shall not be considered an Invitation for Bid, Request for Task Execution Plan, Request for Quotation or a Request for Proposal. Additionally, there is no obligation on the part of the Government to acquire any products or services described in this RFI. Your response to this RFI will be treated only as information for the Government to consider. You will not be entitled to payment for direct or indirect costs that you incur in responding to this RFI. This request does not constitute a solicitation for proposals or the authority to enter into negotiations to award a contract. No funds have been authorized, appropriated or received for this effort. Interested parties are responsible for adequately marking proprietary, restricted or competition sensitive information contained in their response. The Government does not intend to pay for the information submitted in response to this RFI.

This action may be competed under the Transformation Twenty One Total Technology Next Generation multiple award, indefinite delivery, indefinite quantity contract using fair opportunity procedures in accordance with Federal Acquisition Regulation 16.505.

The North American Industry Classification System (NAICS) for this requirement is 541512 with a size standard of $34 million.

2. Submittal Information:

All responsible sources may submit a response in accordance with the below information.

There is a page limitation for this RFI of 25 pages. The Government will not review any other information or attachments included, that are in excess of the 25 page limit. NO MARKETING MATERIALS ARE ALLOWED AS PART OF THIS RFI. Generic capability statements will not be accepted or reviewed. Your response must address capabilities specific to the services required in the attached PWS and must include the following:

a. Interested Vendors shall at a minimum, provide the following information in the initial paragraph of the submission:

Name of Company Address Point of Contact Phone Number Fax Number Email address Company Business Size and Status For VOSB and SDVOSBs, proof of verification in SBA VetCert.

NAICS code(s) Socioeconomic data Data Universal Numbering System (DUNS) Number Existing Contractual Vehicles (GWAC, FSS, or MAC)

b. Provide a summary of your capability to meet the requirements contained within the draft PWS, as well as the following areas:

a. Provide at least one prime example of staffing a Federal contract with at least 150 FTEs that span network engineering, cybersecurity, software engineering, systems administration, and business process support disciplines that are distributed between at least 3 geographic locations. Specific examples or references provided must include the agency, point of contact, dollar value, and contract number.

b. Provide at least one prime example of experience auditing and providing telecom expense-oriented support for a similar customer (with customer point of contact information). Specific examples or references provided must include the agency, point of contact, dollar value, and contract number.

c. Provide at least one prime example demonstrating ability to serve as proxy between the Government and Telecom providers including CenturyLink, AT&T, Verizon, and T-Mobile. Proxy activities include managing circuit billing and providing training on telecom billing systems, to name a few. Specific examples or references provided must include the agency, point of contact, dollar value, and contract number.

d. Provide expertise with non-traditional telecom cost-savings models. Specific examples or references provided must include the agency, point of contact, dollar value, and contract number.

c. Corporate experience or expertise in performing these services and specific examples or references. Specific examples or references provided must include the agency, point of contact, dollar value, and contract number.

a. Your company’s intent and ability to meet the set aside requirement in accordance with VAAR 852.219-73 (JAN 2023) (DEVIATION) VA Notice of Total Set-Aside For Certified SDVOSBs and 13 CFR §125.6, which states the contractor will not pay more than 50% of the amount paid by the government to the prime for contract performance to firms that are not certified SDVOSBs listed in the SBA certification database (excluding direct costs to the extent they are not the principal purpose of the acquisition and the SDVOSB/VOSB does not provide the service, such as airline travel, cloud computing services, or mass media purchases). When a contract includes both services and supplies, the 50 percent limitation shall apply only to the service portion of the contract.

Your response shall include information as to available personnel and financial resources; full names of proposed team members and the PWS requirements planned to be subcontracted to them, which must include the prime planned percentage or the names of the potential team members that may be used to fulfill the set aside requirement.

b. Has the draft PWS provided sufficient detail to describe the technical requirements that encompass the software development and production operations support services to be performed under this effort.

______ YES _______ NO (if No, answer question f)

c. If “NO”, please provide your technical comments/recommendations on elements of the draft PWS that may contribute to a more accurate proposal submission and efficient, cost effective effort.

Responses are due no later than 1:00pm EST, December 01, 2025 via email to Diana Sesta, Contract Specialist at Diana.Sesta@va.gov and Susan Banasiak, Contracting Officer at Susan.Banasiak@va.gov. Please note “Network Engineering, Design, Implementation and Infrastructure Support (NEDIIS)” in the subject line of your response. Mark your response as “Proprietary Information” if the information is considered business sensitive. The email file size shall not exceed 5 MB.

Sources Sought Notice Sources Sought Notice

Sources Sought Notice

TRANSFORMATION TWENTY-ONE TOTAL TECHNOLOGY NEXT GENERATION (T4NG)

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Office of Information & Technology (OIT) Enterprise Technology Services (ETS) Connectivity and Collaboration Services (CCS) Core Network Services (CNS)

Network Engineering, Design, Implementation and Infrastructure Support (NEDIIS)

Date: November 17, 2025

Task Order PWS Version Number: 1.0

Contents

BACKGROUND

The Department of Veterans Affairs (VA) is the second-largest federal department, serving approximately 19 million Veterans in over 1,700 facilities and sites worldwide, making it the largest integrated health care system in the United States. This impressive service delivery is made possible through the coordinated efforts of three major line organizations: the Veterans Health Administration (VHA), the Veterans Benefits Administration (VBA), and the National Cemetery Administration (NCA). These efforts are orchestrated at the VA Central Office (VACO) located in Washington, D.C.

OIT delivers available, adaptable, secure, and cost-effective technology services to the VA and acts as a steward for all VA's Information Technology (IT) assets and resources. Currently, 60% of the 16,000 plus OIT employees and contractors are Veterans.

The Connectivity and Collaboration Services (CCS) team delivers world class Telephony, Network, and Collaboration Services in an environment that encourages transparency, innovation, flexibility, fiscal responsibility, and accountability with 100% focus on Veteran outcomes.

CCS serves at the forefront of VA’s digital transformation, enabling enterprise collaboration and connecting Veterans to VA through secure and resilient voice, video, data, and messaging services.

CCS is divided into three pillars.

· Core Network Services (CNS) - This pillar fuses the development, engineering, and operation of VA network services into a single organization, driving efficiency and enabling a unified strategy for our network infrastructure.

· Collaboration Services (CS) - CS provides enterprise level support focused on providing dynamic, flexible and efficient collaboration amongst VA staff and Veteran outreach. CS nationally supports the Microsoft 365 suite of products that VA currently employs for enterprise messaging and collaboration. These products include Exchange, Teams, OneDrive and others.

· Unified Communications (UC) - UC continues to modernize, enhance, and operate world class enterprise Unified Communications services and solutions to connect Veterans, their families and VA professionals to the resources and services they need.

Direct Contractor support for this Task Order (TO) will reside within CCS Division under the Office of Information and Technology. Mainly under CNS with optional tasks under the CS, UC, and ETS Business Office pillars.

Under CCS, The CNS team is a vital team supporting the Department of Veterans Affairs (VA) mission by providing robust and reliable network infrastructure that connects VA facilities, Clouds, Internet, contractors, guests, and Veterans to critical VA resources and services. CNS enables seamless access to essential applications, data, and services across all VA divisions, ensuring that VHA,(VBA, and NCA can deliver top-tier healthcare, benefits, and cemetery services to Veterans across the nation. In doing so, CNS directly impacts the quality and timeliness of the VA's service delivery by maintaining the infrastructure that powers every networked interaction within VA facilities.

CNS is responsible for overseeing the telecommunications and networking technologies that serve as the backbone for VA operations. This includes provisioning the high-speed, secure, and resilient connections that allow VA personnel to collaborate effectively, enable contractors to access necessary resources, support guests’ informational needs, and allow Veterans direct access to their own health and benefits information. By providing stable network connectivity, CNS plays a crucial role in critical system availability to the VA workforce, whether they are in medical centers, regional offices, veteran centers, or remote clinics.

CNS Priorities

· Communications - internally within network operations, engineering, and provisioning teams

· Site Availability - Uptime for sites, redundancy, resiliency, minimizing downtime, and data supporting this.

· Compliance - baseline configuration compliance, code standards, time to deploy, tracking Known Exploited Vulnerabilities/Zero Days.

CNS operates a very large enterprise network for our customers. As of (FY26, CNS is responsible for the following:

· Daily Remote Access Users: ~246,000 Unique Users

· Sites: ~2,200

· Circuits: ~2,600

· Routers: ~5,000

· Firewalls: ~4,000

· LAN Switches: ~45,000

· Wi-Fi Access Points: ~200,000

The VA Enterprise Network will consist of products and services which are increasingly automated, digitally assisted and integrated with security across all service domains.

· Network Operations, Implementations, and Engineering teams will be digitally assisted and automated.

· Network configuration changes will be robustly tested and leverage Continuous Integration Continuous Delivery (CI/CD) pipeline techniques.

· All network acquisitions will require Trade Agreement Act compliance for all hardware.

· All network capabilities will have multiple original equipment manufacturers and suppliers to deliver requested services.

· The focus of network telemetry data will be on the End User Experience.

· The Network Source of Truth serves as the primary data repository for the operational network, network data for the Configuration Management Database (CMDB), Location Source of Truth, network events, and the network performance metrics of servers and endpoints.

· Users, Endpoints, and Servers will communicate via Native IPv6 end to end without translation.

· VA on-prem campus networking will provide Wi-Fi first connectivity for all end user devices.

· VA on-prem Local Area Networks (LAN) will provide and enforce Zero Trust aligned network segmentation.

· VA Remote Access methods will offer Zero Trust Network Access.

· VA Wide Area Network (WAN) connectivity will be Software Defined WAN (SD-WAN) with redundant connectivity designs by default.

· VA WAN connectivity options will be flexible and include multiple choices in both the terrestrial category as well as non-terrestrial.

· Terrestrial services will include Fiber based MPLS, Direct Internet Access (DIA), broadband, etc.

· Non-terrestrial services will include cellular based (LTE, 5G, etc.) as well as VSAT and LEO connectivity.

· VA WAN will be fully Trusted Internet Connect (TIC) 3.0 integrated and leverage Secure Access Service Edge services to augment SD-WAN and achieve true multi-cloud networking.

· CNS will be capable of deploying VA remote sites in less than 48 hours.

1.1 ENTERPRISE INFRASTURE ARCHITECHTURE

1.1.1 GATEWAYS/COLLOCATED HOSTING SERVICES

Gateways provide security protection to VA’s IT infrastructure and assets so that VA business processes can reliably deliver uninterrupted services to Veterans and their beneficiaries. Toward that end, VA has adopted a multi-layered security approach referred to as “defense-in-depth,” comprised of seven strategic security processes set out below. The five processes, denoted by an asterisk (*), are part of the gateway architecture. The VA’s network Internet Gateways are comprised of the following displayed in Figure 1: GW Core Services, Remote Access Service, and Business Partner Extranet (BPE), Business Partner Site to Site (S2S) and Hosting Services.

a) Protect Network Infrastructure Services*

b) Secure Operating Systems

c) Secure Protocols

d) Provide Boundary Protection*

e) Provide Intrusion Detection Systems and Services*

f) Provide Online Virus Protection*

g) Provide Active Network and Network Security Monitoring*

Figure 1: VA Internet Gateway Components

Strategic Security Processes

The VA Gateway is an extremely complex architecture that complies with the Department of Homeland Security (DHS); current version is TIC 2.2 grandfathered as a TIC 3.0 Use Case. TIC 3.0 concept is defined by Cybersecurity and Infrastructure Security Agency (CISA) at https://www.cisa.gov/publication/tic-30-core-guidance-documents and expanded roles are part of the VA mission initiatives within the next five years. The TIC is comprised of state-of-the-art technologies and capabilities and employs a defense in-depth strategy that helps to ensure the confidentiality, integrity, and availability of the VA’s information systems.

The TIC consists of the following technologies:

· Application Firewall Services

· Inbound Web Application Firewall / Inbound Proxy Services

· Layer 3/4 Firewall Services

· Inbound/Outbound Encrypted Domain Name Service (DNS) Services

· Inbound/Outbound Email Services

· BPE Services

· S2S Virtual Private Network (VPN) Services

· Remote Access Services

· CISA Partner Services

· Application Analysis and Troubleshooting Services

· Network Automation & Visibility Tool Services

Gateway objectives include enabling and protecting VA’s computing connections to the outside world, confidentiality and privacy, data integrity, accountability, access control, and email data loss prevention.

1.1.2 VIRTUAL PRIVATE NETWORK SERVICES

The VA VPN service is one of many secure services provided within VA Gateway architecture. The current VA VPN client solution consists of 16 Cisco Adaptive Security Appliances split between the four gateways. VA Personal Identification Verification (PIV) authentication is utilized. Additional security provided validating Windows authentication via Identity Service Engine nodes and authorization provided by Lightweight Directory Access Protocol (LDAP) servers at each VA gateways before successfully entering the VA network. Remote Enterprise Security Compliance Update Environment (RESCUE) utilizes Transport Layer Security (TLS) with 256-bit Advanced Encryption Standard (AES) encryption and is compatible with Windows and MAC Operating Systems (OS).

Citrix Access Gateway (CAG) is the most secure method for the VA to access personally owned equipment (POE) devices. CAG provides a TLS connection between the client and the NetScaler Gateway. It is a method of providing access to applications within the VA trusted network without installing the application on the POE. CAG offers support for numerous stationery and mobile devices, including Windows, Mac OS/iOS, and Android. To access the VA network via CAG a user launches a web browser and submits Two-Factor Authentication credentials via VA-issued PIV card or One Time Password token. Once the user is authenticated, a TLS connection is established between the client and the NetScaler. CAG presents users with applications with a desktop look and provide a virtual desktop. Virtual desktops are a simulation of a personal computer setting inside of the VA trusted network. The NetScaler Gateway proxies all requests for applications/desktops via the client’s Citrix Receiver to the backend server(s) hosting the resources. Support for copy and paste or printing is available with sufficient business justification provided to the user’s Supervisor and/or Authorizing Officials. These features are disabled by default until explicitly requested and kept VA data from being easily captured outside of VA.

In addition to RESCUE and VA CAG, VA gateway engineering support is working to deploy and support a new VA Government Furnished Equipment (GFE) remote access solution called Palo Alto Prisma Suite. The Prisma Suite offers VA the capability to expand, and decrease based upon the remote access service usage and provides similar capabilities as RESCUE. The Prisma Suite offers TIC 3.0 capabilities as the traffic traverses the cloud service for outbound internet traffic and routing through the VA gateways for additional security capabilities in accessing VA network resources. The Prisma Suite cloud instances are managed by VA gateway engineering support, Technology and Service Transition team, and planned to be offered with 24x7x365 operational support by TIC and BPE Support teams.

In supporting VPN services, the VA Remote Access Information and Media Portal provides VA remote access users the ability to review and access frequently asked questions, media, memo, bulletins, user guides, and other relevant documentation that are updated by the Technology and Service Transition team with collaboration and support from various teams to include gateway engineering support for approval and validation of content.

Site-to-Site VPNs are an integral part of the gateway architecture. The site-to-site VPN solution consists of Fortinet devices (two per gateway). These devices use IP Security (IPSec) with Triple Digital Encryption Standard or AES for encryption and Internet Security Association and Key Management Protocol for authentication and integrity. The devices are Federal Information Processing Standard (FIPS)-140-2 certified.

VA Virtual Office (VAVO) VPN is another service offered for remote access to the VA network via the VA gateways. VAVO remote access is a highly scalable solution which provides teleworkers, small offices, and mobile users with office like experiences combining voice, video, and real-time applications in a secure environment. VAVO has the same integration with the Remote Access Portal (RAP) for approval as with both RESCUE and VA CAG and ensures the identical security posture validation as RESCUE VPN client remote access.

1.1.3 BUSINESS PARTNER EXTRANET

VA has consolidated external connections in cloud style architecture with all connections terminating at VA Gateway facilities. This architecture includes site to site connections with VPN routers and firewall, and BPE connections through firewall and intrusion protection. BPE provides connectivity to larger government partners and enterprise vendors including connectivity to Equinix for access to VA cloud services providers.

Figure 2 VA Business Partner Extranet

1.1.4 WAN

The WAN is built around a highly scalable Multiprotocol Label Switching (MPLS) over multipoint GRE (MPLS over mGRE). It's scalable by providing a way to extend MPLS VPNs across large or complex infrastructure where full MPLS support is not available. The WAN architecture provides a cost-effective design that significantly reduces WAN traffic bottlenecks.

A dual service provider (SP) WAN is employed. Every service provider MPLS L3 VPN connected WAN link is configured by the service providers into a common virtual routing and forwarding (VRF) domain per SP. Each VA gateway has a single WAN link per service provider. WAN’s MPLS over mGRE technology and configuration is applied to all participating routers. This MPLS over mGRE configuration, referred to as “The VA Overlay Route Table” is scalable and provide deterministic, load balanced, fault tolerant routing of VA and non-VA traffic across all four (4) Gateways and all sites.

There are 2 topology types accounted for in this WAN standard:

· Type 1 - Dual WAN router/dual service provider (ATT and Lumen)

· Type 2 - Single WAN router/single service provider (either ATT or Lumen)

1.1.5 SD WAN

VA aims to reduce reliance on expensive MPLS WAN circuits and routers by implementing an SD-WAN solution. This approach enables the use of more cost-effective broadband and Direct Internet Access (DIA) circuits, while maintaining high security and improving user experience. SD-WAN also allows for faster deployment of reliable network connectivity across VA sites.

In locations that do not support terrestrial based circuits (or require a costly buildout) SD-WAN can also utilize cellular and satellite services. SD-WAN allows for traffic prioritization based on application criticality and lowest latency/best network path selection. CNS will support transport provisioning and provide connectivity quickly and securely following a standard design across the enterprise. This approach will achieve the required agility, responsiveness, and security by employing technologies that provide industry standard security capabilities and tools for automation and “zero touch” provisioning of network devices.

1.1.6 DATA CENTERS

VA has six corporate core data centers that are connected directly to the high-speed core nodes. Each one of these data centers is treated as an AS and is connected to at least two different core nodes for redundancy. The OMB Exhibit 300 requires agencies to develop strategic and tactical plans for the federal, state, and local government technology markets to stay abreast of new applications, pursue the robust, high performance, cost effective, and assured communications infrastructure in order to meet or exceed the growth trends.

APPLICABLE DOCUMENTS

The Contractor shall comply with the following documents, in addition to the documents in Paragraph 2.0 in the T4NG Basic Performance Work Statement (PWS), in the performance of this effort:

1. 44 U.S.C. § 3541-3549, “Federal Information Security Management Act (FISMA) of 2002”

2. “Federal Information Security Modernization Act of 2014”

3. Federal Information Processing Standards (FIPS) Publication 140-2, “Security Requirements for Cryptographic Modules”

4. FIPS Pub 199. “Standards for Security Categorization of Federal Information and Information Systems,” February 2004

5. FIPS Pub 200, “Minimum Security Requirements for Federal Information and Information Systems,” March 2006

6. FIPS Pub 201-2, “Personal Identity Verification of Federal Employees and Contractors,” August 2013

7. 10 U.S.C. § 2224, "Defense Information Assurance Program"

8. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

9. Public Law 109-461, Veterans Benefits, Health Care, and Information Technology Act of 2006, Title IX, Information Security Matters

10. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964

11. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, https://www.va.gov/vapubs/index.cfm

12. VA Handbook 0710, “Personnel Security and Suitability Program,” May 2, 2016, https://www.va.gov/vapubs/index.cfm

13. VA Directive and Handbook 6102, “Internet/Intranet Services,” August 5, 2019

14. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and Guidelines,” January 18, 2017

15. Office of Management and Budget (OMB) Circular A-130, “Managing Federal Information as a Strategic Resource,” July 28, 2016

16. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed Services (CHAMPUS)”

17. NIST SP 800-66 Rev. 1, “An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule,” October 2008

18. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended, January 18, 2017

19. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

20. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021

21. VA Handbook 6500, “Risk Management Framework for VA Information Systems VA Information Security Program,” February 24, 2021

22. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI),” March 12, 2019

23. VA Handbook 6500.5, “Incorporating Security and Privacy into the System Development Lifecycle,” March 22, 2010

24. VA Handbook 6500.6, “Contract Security,” March 12, 2010

25. VA Handbook 6500.8, “Information System Contingency Planning,” April 6, 2011

26. VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018

27. VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017

28. OIT Process Asset Library (PAL), https://www.va.gov/process/ . Reference Process Maps at https://www.va.gov/process/maps.asp and Artifact templates at https://www.va.gov/process/artifacts.asp

29. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

30. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014

31. VA Handbook 6508.1, “Procedures for Privacy Threshold Analysis and Privacy Impact Assessment,” July 30, 2015

32. VA Handbook 6510, “VA Identity and Access Management,” January 15, 2016

33. VA Directive and Handbook 6513, “Secure External Connections,” October 12, 2017

34. VA Directive 6300, “Records and Information Management,” September 21, 2018

35. VA Handbook, 6300.1, “Records Management Procedures,“ March 24, 2010

36. NIST SP 800-37 Rev 2, “Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy,” December 2018

37. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020)

38. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015

39. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” March 24, 2014

40. OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005

41. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019

42. OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008

43. Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance, December 2, 2011, (NOTE: Part A of the FICAM Roadmap and Implementation Guidance, v2.0, was replaced in 2015 with an updated Architecture (https://arch.idmanagement.gov/#what-is-the-ficam-architecture)

44. NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access,“ June 2018

45. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, “Digital Identity Guidelines,” updated March 02, 2020

46. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014

47. NIST SP 800-164, “Guidelines on Hardware-Rooted Security in Mobile Devices (Draft),” October 2012

48. Draft National Institute of Standards and Technology Interagency Report (NISTIR) 7981, “Mobile, PIV, and Authentication,” March 2014

49. VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

50. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

51. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

52. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

53. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019

54. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008

55. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (Public Law 110–140), December 19, 2007

56. Section 104 of the Energy Policy Act of 2005, (Public Law 109–58), August 8, 2005

57. Executive Order 13834, “Efficient Federal Operations,” dated May 17, 2018

58. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 2, 2001

59. VA Directive 0058, “VA Green Purchasing Program,” July 19, 2013

60. VA Handbook 0058, “VA Green Purchasing Program,” July 19, 2013

61. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

62. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

63. “Veteran Focused Integration Process (VIP) Guide 4.0,” January 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

64. VA Memorandum “Proper Use of Email and Other Messaging Services,” January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

65. “DevSecOps Product Line Management Playbook” version 2.0, May 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

66. NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020

67. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol Version 6 (IPv6),” November 19, 2020

68. Social Security Number (SSN) Fraud Prevention Act of 2017

69. Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23, 2018

70. Attachment A: NEDIIS Systems List

71. Attachment B: Remote Access and Solution Integration (RASI) Applications and Integrations

72. Attachment C: EHRM Schedule

73. Attachment D: 6210.001 VA Network Operations Center (NOC), CRRC, Hines Information Technology Center (HITC), and VACO NEDIIS Contractor Onboarding Standard Operating Procedures (SOP)

74. Attachment E: 6310.021 Government Motor Vehicle Trip Ticket SOP

75. Attachment F: 6310.005 Logistics Management of IT Assets SOP

76. Attachment G: 6310.006 Inventory Control Annual Audit of IT Assets SOP

77. Attachment H: 6310.007 IT Asset Return Merchandise Authorization SOP

78. Attachment I: 6310.010 IT Asset Management SOP

79. Attachment J: 6310.013 Media Sanitization, Turn-In and Disposal of IT Hardware SOP

80. Attachment K: 6310.014 VA Media Sanitization Users Guide for VA Hard Drive Destruction Portal

81. Attachment L: 6310.018 Missing, Lost, or Stolen IT Assets and Report of Survey SOP

82. Attachment M: 6310.020 Business Community Advisory Group Portal SOP

83. Attachment N: 6310.022 VA Form 887 Property Pass SOP

84. Attachment O: 6310.025 UPS CampusShip User Guide Policy and SOP

85. Attachment P: 6310.027 VA NOC Validate Receiving Shipment SOP

86. Attachment Q: 6310.031 Asset Management Offboarding SOP

87. Attachment R: Software Acquisition Capability Maturity Model Version 1.03

88. Attachment S: NSOC Management Equipment

89. Attachment T: IT Asset Management Configuration Management Plan

SCOPE OF WORK

The Contractor shall provide technical support services for CNS and all CNS managed locations, consisting of all technical activities necessary to design, implement, maintain, operate and improve the VA enterprise network security and network transportation services, including core, distribution and access layers.

The Contractor shall provide project management, documentation management, asset management, change/configuration management, network operations and maintenance, telecommunication, software development and support, database administration and support, network and security, business process, VA’s next generation network planning, and transition support.

The Contractor shall provide service design, configuration and implementation of network devices, network security devices, applications, storage and physical/virtual systems supporting the CNS Infrastructure and Information Security Systems throughout the VA Enterprise. The Contractor shall collect metrics, perform the evaluation and technical refresh of hardware and software for all CNS owned and managed devices, enabling the ability to locate equipment across the VA’s Enterprise infrastructure.

To meet the OMB mandates for data center consolidation, various new enterprise application introductions, remote support for telemedicine technologies, radiology, telemedicine convergence of voice and video, and the continuation of systems centralization to the RDPCs, the Contractor shall support OIT in continuing to pursue an evolving robust, high performance, cost effective, and assured telecommunications infrastructure and IT infrastructure in order to meet or exceed the growth trends. The Contractor shall support OIT in continuing five major IT initiatives: transform the WAN design, move to enterprise telecommunication services and infrastructure, realign VA IT, VistA evolution, and move VA IT and telecommunication into the Cloud. These initiatives will be evolving throughout the TO performance and support may be adjusted to reflect any transformation of the major IT initiatives resulting from pending VA reorganization. The Contractor shall support the initiatives as they evolve during the period of performance (PoP).

Work tasks include; monitoring, design and development, operations and maintenance, security management, request/ incident/ problem/ change/ program/ project/ requirements management, documentation production, process automation, next generation planning, asset management, as described in VA Handbook 6221:

1. Implement and maintain a VA Enterprise WAN

2. Provide potential for reduced infrastructure support costs

3. Improve manageability of the network

4. Secure the VA Enterprise against cyber attack

5. Establish effective metrics to measure performance

6. Organize information faster and more cost-effectively

7. Implement an effective Command and Control, Continuity of Operations Plan and Continuity of Government infrastructure

8. Provide network security, availability, and performance that meet VA service level goals and metrics

1.2 APPLICABILITY

This Task Order (TO) effort PWS is within the scope of paragraph(s) <Enter paragraph numbers> of the T4NG Basic PWS.

1.3 ORDER TYPE

The effort shall be proposed on a Firm Fixed Price (FFP) basis. Travel will be on a Cost Reimbursement basis.

PERFORMANCE DETAILS

1.4 PERFORMANCE PERIOD

The Period of Performance (PoP) shall be 12 from date of TO award, with four 12-month option periods and three optional tasks. Optional Task One and Optional Task Two may be exercised multiple times during the base and each Option Period, if exercised, up to the not to exceed amount. Optional Task Three may be exercised one time during the performance of this TO for a period of 60 days. The overall TO PoP shall not exceed 60 months.

1.5 PLACE OF PERFORMANCE

Efforts under this TO shall be performed at Contractor facilities (offsite) and VA facilities (onsite). VA facilities locations are as follows:

· VA Offices

· 239 Lowe Drive, Suite 101, Shepherdstown, West Virginia 25443

· 810/811 Vermont Avenue NW, Washington, District of Columbia 20420

· 7100 Old Landover Road, Building C, Landover, Maryland 20785

· Data Centers

· Austin ITC, 1615 Woodward Street, Austin, Texas 78772-0001

· Hines ITC, Building 215, Hines, Illinois 60141

· CRRC, 221 Butler Ave, Building 511, Martinsburg, West Virginia 25405

· Gateways

· 11830 Webb Chapel Rd, Dallas, Texas 75234

· 350 E. Cermak Road, Chicago, Illinois 60616

· 3020 Coronado Drive, Santa Clara, CA 95054

· 22810 International Drive, Sterling, Virginia 20166

Telework may be approved by the Contracting Officer Representative (COR) in coordination with the VA Program Manager. Due to the nature of the VA’s daily IT operations, designated personnel shall remain within the designated recall time (2 hours) to the Agency’s data centers and gateway locations. When emergencies, natural disasters, or special circumstances occur, the COR will evaluate and approve/disapprove exceptions on a case-by-case basis.

Future site locations include:

1.6 TRAVEL OR SPECIAL REQUIREMENTS

The Government encourages maximum utilization of teleconferencing and video conferencing for meetings.

The Government anticipates travel to perform the tasks associated with the effort, as well as to attend program-related meetings or conferences throughout the PoP. Include all estimated travel costs in your firm-fixed price line items. These costs will not be directly reimbursed by the Government.

Travel shall be in accordance with the Federal Travel Regulations (FTR) and requires advanced concurrence by the COR. Travel and per diem shall be reimbursed in accordance with FTR. The Contractor shall provide cost estimates with each travel request. Each Contractor invoice shall include copies of all receipts that support the travel costs claimed in the invoice. The Government will not reimburse local travel within a 50-mile radius from the Contractor's facility. This includes travel, subsistence, and associated labor charges for travel time. Travel performed for personal convenience and daily travel to and from work at the Contractor's facility will not be reimbursed.

The Government shall provide vehicles for the purposes of transporting and picking up VA Owned equipment from and to VA locations. The Contractor shall use the vehicles for purposes or traveling to the north and east Gateway locations to provide contract specific maintenance activity and the VA Receiving Warehouse located in Landover, MD. The Contractor shall use the vehicles for these purposes only upon request/approval from the COR or VA Program Manager (PgM)/Project Manager (PM). The Contractor shall follow all rules, policy, and legal statutes in accordance with 6310.021 Government Motor Vehicle Trip Ticket SOP and VA Directive 0637 https://www.va.gov/vapubs/viewPublication.asp?Pub_ID=1215&FType=2.

1.7 CONTRACT MANAGEMENT

All requirements of Sections 7.0 and 8.0 of the T4NG Basic PWS apply to this effort. This TO shall be addressed in the Contractor’s Progress, Status and Management Report as set forth in the T4NG Basic contract.

1.8 GOVERNMENT FURNISHED PROPERTY

The Government has multiple remote access solutions available to include CAG, Site-to-Site VPN, and RESCUE VPN.

The Government’s issuance of GFE is limited to Contractor personnel requiring direct access to the network to: development environments; install, configure and run TRM approved software and tools (e.g., Oracle, Fortify, Eclipse, SoapUI, WebLogic, LoadRunner); upload/download/ manipulate code, run scripts, and apply patches; configure and change system settings; check logs, troubleshoot/debug, and test/QA.

When necessary, the Government will furnish desktops or laptops, for use by the Contractor to access VA networks, systems, or applications to meet the requirements of this PWS. The overarching goal is to determine the most cost-effective approach to providing needed access to the VA environment coupled with the need to ensure proper Change Management principles are followed. Contractor personnel shall adhere to all VA system access requirements for on-site and remote users in accordance with VA standards, local security regulations, policies and rules of behavior. GFE shall be approved by the COR and Program Manager on a case-by-case basis prior to issuance.

Each person located at VA offices will be provided space, a desk, and a telephone. The Government shall provide laptops, and associated peripherals (this includes all IT equipment and all consumables). The Contractor is responsible for providing any other peripherals such as headsets to optimize personnel environments.

Based upon the Government assessment of remote access solutions and requirements of this TO, the Government estimates that the following GFE will be required by this TO:

1. Not to exceed 150 standard laptops and 100 developer grade laptops for a total of 250 laptops.

The Government will not provide IT accessories including but not limited to Mobile Wi-Fi hotspots/wireless access points, additional or specialized keyboards or mice, laptop bags, extra charging cables, extra Personal Identity Verification card readers, peripheral devices, or additional Random Access Memory. The Contractor is responsible for providing these types of IT accessories in support of the TO as necessary and any VA installation required for these IT accessories shall be coordinated with the COR.

The Status of Government Furnished Equipment Report under the T4NG Basic Contract requirements is applicable to this TO and shall be delivered to the COR/VA PM as required.

1.8.1 BADGES

The Contractor employees working at a Government facility shall be required to display, on their person, a Government provided identification badge that shall include the full name of the employee and the legal name under which the Contractor is operating. It is the responsibility of the Contractor to request and obtain badges from the COR prior to the first workday of any Contractor employee. The Contractor shall return all badges to the VA COR/PgM/PM, or designee, on the same day an individual’s employment is terminated and upon termination of the TO. The Contractor shall notify the VACOR/PgM/PM, or designee, immediately of any lost badges.

1.9 SECURITY AND PRIVACY

All requirements in Section 6.0 of the T4NG Basic PWS apply. Specific TO requirements relating to Addendum B, Section B4.0 paragraphs j and k supersede the corresponding T4NG Basic PWS paragraphs, and are as follows:

j. The vendor shall notify VA within 24 hours of the discovery or disclosure of successful exploits of the vulnerability which can compromise the security of the Systems (including the confidentiality or integrity of its data and operations, or the availability of the system). Such issues shall be remediated as quickly as is practical, but in no event longer than two days.

k. When the Security Fixes involve installing third party patches (such as Microsoft OS patches or Adobe Acrobat), the vendor shall provide written notice to VA that the patch has been validated as not affecting the Systems within 10 working days. When the vendor is responsible for operations or maintenance of the Systems, they shall apply the Security Fixes within 30 business days.

1.9.1 POSITION/TASK RISK DESIGNATION LEVEL(S)

In accordance with VA Handbook 0710, Personnel Security and Suitability Program, the position sensitivity and the level of background investigation commensurate with the required level of access for the following tasks within the PWS are:

The Contractor shall provide support at the Position Sensitivity and Background Investigation Requirements of Tier 2 / Moderate at time of award by the TO.

However, no later than four months after award, the Contractor shall have support at the Position Sensitivity and Background Investigation Requirements listed in the below table by Task due to the understanding that achieving High is a longer process based on VA coordination. To alleviate further delays, the Contractor should initiate High background investigation within 45 days of award for those resources required to possess this level.

Position Sensitivity and Background Investigation Requirements by Task

The Tasks identified above and the resulting Position Sensitivity and Background Investigation requirements identify, in effect, the Background Investigation requirements for Contractor individuals, based upon the tasks the particular Contractor individual will be working.