VPAS RFI Answers to Questions.pdf

Veterans Affairs Processing and Automation Services (VPAS)

Answers to RFI 36C10D24Q0038

1. Can you provide more details on the specific VA network and VA‐authorized systems that contractors should use for communication? Pg. 19, Section 3.9

Answer: All contractors should use a VA‐approved instant messaging application and VA email to communicate with the government. The only exception is during the onboarding process when contractors are waiting for access to the VA Network, or if the VA Network is unavailable, in which case the contractor’s email can be temporarily used for communications.

2. What are the encryption requirements for email communication when deemed necessary?

PWS Pg. 19, Section 3.9

Answer: Sensitive information should be encrypted and only exchanged within the VA IT environment. Sensitive information may include Personal Identifiable Information (PII), Personal

Health Information (PHI), and financial information. VA email uses S/MIME encryption.

3. Are there any specific guidelines or protocols for using Microsoft Teams for video conferencing?

PWS Pg. 19, Section 3.9

Answer: VA recommends video conferencing for communications where appropriate.

4. Can you clarify what constitutes an "undue burden" in terms of providing access to individuals with disabilities? PWS Pg. 19, Section 3.10

Answer: The Contractor shall adhere to all Section 508 compliance requirements. The current

PWS language will be refined.

5. Are there any specific requirements or standards that the solution needs to meet regarding accessibility for individuals with disabilities? PWS Pg. 19, Section 3.10

Answer: This will vary by requirement and task order.

6. Can you specify the VA‐approved authentication methodologies that contractors should incorporate into their solutions? PWS Pg. 19‐20, Section 3.11

Answer: PIV card‐based authentication is the current standard for physical and logical access to

VA facilities and systems. Other authentication methodologies will be requirement and task order dependent.

7. What actions should contractors take if their accounts are disabled after 90 days or deleted after 180 days? PWS Pg. 19‐20, Section 3.11

Answer: At a minimum, Contractors shall be required to log in and access their VA accounts on a weekly basis to prevent the accounts from being disabled. The Contractor shall inform the COR immediately if an account becomes disabled after 90 days of inactivity.

8. Are there any additional requirements for authentication beyond the ones mentioned in the section? PWS Pg. 19‐20, Section 3.11

Answer: The referenced section describes all the current general requirements related to user authentication to VA systems and services with PIV credential.

9. Can you provide more information about the VA Identity, Credential, and Access Management

(ICAM) Program Management Office and its role in authentication? PWS Pg. 20‐21, Section

3.12.1

Answer: Reference www.idmanagement.gov/arch.

10. What are the specific requirements for ensuring that Contractor delivered applications and systems comply with VA Handbook 6510 and align with the Federal Identity, Credential, and

Access Management Roadmap? PWS Pg. 20‐21, Section 3.12.1

Answer: The COR and the VA PM will adhere to the Position Designation Automated Tool requirements.

11. Can you elaborate on the process for obtaining an Authority to Operate (ATO) or Interim

Authority to Operate (IATO) within 180 calendar days following task order award? PWS Pg. 20‐

21, Section 3.12.1

Answer: An overview of the ATO process will be provided as an attachment to the Request for

Proposal (RFP).

12. What are the specific guidelines outlined in the NIST SP 800‐207 for Zero Trust Architecture compliance? PWS Pg. 22‐23, Section 3.12.4

Answer: Reference NIST SP 800‐207.

13. Can you clarify the process for ensuring compliance with the Zero Trust Architecture guidelines during the development, deployment, and sustainment of managed service provider solutions?

PWS Pg. 22‐23, Section 3.12.4

Answer: Reviews and audits will be conducted by the VA.

14. Can you provide more details on the components of the Enterprise Management Framework

(EMF) and how they support enterprise‐wide system management? PWS Pg. 24, Section 3.12.8

Answer: This will be requirement and task order dependent.

15. Are there any specific industry standard IT Infrastructure Library (ITIL) service management best practices that the EMF aligns with? PWS Pg. 24, Section 3.12.8

16. Can you specify the process for maintaining a current VA authorization and complying with

FedRAMP requirements? PWS Pg. 25‐26, Section 3.12.10

Answer: The FedRAMP process needs to be compliant with FISMA and is based on NIST Special

Publication (SP) 800‐37. Information on NIST SP 800‐37 can be found in VA Handbook 6517. The level of FedRAMP compliance will depend on the requirement and task order.

17. What are the requirements for granting VA access to Contractor and Cloud Service Provider facilities, installations, and technical capabilities? PWS Pg. 25‐26, Section 3.12.10

Answer: VA access will be granted as required for the task and role during the onboarding process for each contractor. An ATO and relevant processes must be in place before a cloud service provider facility, installation will be allowed access to the VA.

18. How does the contractor demonstrate understanding of the requirements outlined in the PWS?

PWS Pg. 26‐27, Section 3.14.2

Answer: The RFP will include the evaluation criteria. During the source selection phase for the base VPAS IDIQ contract vehicle, the Government will evaluate Contractor proposals to determine understanding of requirements outlined in the PWS.

19. Can you provide examples of how efficiency and effectiveness in meeting requirements are measured? PWS Pg. 26‐27, Section 3.14.2

Answer: Post‐task order award, the cognizant COR shall perform quarterly performance‐based service assessments and conduct annual Contractor Performance Assessment Reporting System

(CPARS) evaluations.

20. What criteria are used to determine if the technical needs and mission requirements are being met? PWS Pg. 26‐27, Section 3.14.2

Answer: Reference the Performance Standard as described in the Table in Section 3.14.2.

21. How is the quality of services/products assessed and ensured? PWS Pg. 26‐27, Section 3.14.2

Answer: Quality Assurance Surveillance Plan (QASP) and Service Level Agreements (SLAs) will be requirement and task order specific.

22. How are milestones and project dates established? PWS Pg. 26‐27, Section 3.14.2

Answer: Milestones and project dates will be established depending on the requirement and task order. Review and approval from the COR will be required.

23. Can you explain the process for reviewing and delivering products in accordance with the established schedule? PWS Pg. 26‐27, Section 3.14.2

Answer: The process will be based on the SLAs and will be task order dependent. Review and approval from the COR will be required.

24. What measures are in place for notifying customers in advance of potential problems or delays?

PWS Pg. 26‐27, Section 3.14.2

Answer: This will be based on the SLAs and will be task order dependent.

25. How is the currency of expertise and appropriate staffing levels determined? PWS Pg. 26‐27, Section 3.14.2

Answer: This will be requirement and task order dependent. The COR will conduct assessments during performance periods.

26. What methods are used to assess if personnel possess the necessary knowledge, skills, and abilities to perform tasks? PWS Pg. 26‐27, Section 3.14.2

Answer: The COR will conduct assessments during performance periods.

27. Can you elaborate on how integration and coordination of all activities are ensured to execute the effort effectively? PWS Pg. 26‐27, Section 3.14.2

Answer: The Contractor will be responsible to ensure activities are executed effectively.

28. What specific activities are involved in managing all aspects of the effort satisfactorily? PWS Pg.

26‐27, Section 3.14.2

Answer: The Contractor will be responsible to ensure activities are executed satisfactorily. The

COR will conduct assessments during performance periods.

29. What triggers the issuance of a Contractor Discrepancy Report (CDR)? PWS Pg. 27‐28, Section

3.14.3

Answer: The Government will assess the Contractor’s performance based on the QASP, SLA and other artifacts such as approved schedules and milestones and initiate communications on any discrepancies. After multiple communications, if the Contractor’s performance is not up to VBA standards, a CDR may be issued.

30. How is communication maintained between the CO, COR, and Contractor to resolve performance issues? PWS Pg. 27‐28, Section 3.14.3

Answer: VA has an emphasis on open communications. The CO, COR and the cognizant VA

Program Manager will ensure effective communications utilizing email and meetings.

31. Can you explain the role of the independent third‐party QA&M contract? PWS Pg. 28, Section

3.15

Answer: Independent third‐party vendors may perform quality assurance, quality control, and/or audit functions to ensure a high level of performance.

32. Is VBA open to exploring the use of additional emerging technology components (i.e., Generative AI, etc.) to be applied across the different tasks/activities outlined in the PWS? If so, we recommend VBA consider funding PoC development as a separate CLIN in applicable Tos.

Answer: VBA is open to exploring emerging technologies.

Is the vendor expected to provide resources to actively man the help desk/call center? If so, additional requirements (i.e., on‐site vs. remote, etc.) would need to be elaborated upon for the

RFP.

Answer: Reference the VPAS Second Industry Engagement Day presentation.

33. Can the VA provide specific examples or scenarios where 24/7 operations might be required as per individual task orders? This will help us better plan resource allocation and staffing. PWS

Pg. 15, Section 3.3

Answer: Currently, there is no requirement where 24/7 operations are needed. However, the

VA will require the vendor to adjust operational resources to account for fluctuations of business needs.

34. Given the broad scope of services required under the PWS, does the VA anticipate dividing the

IDIQ into multiple lots or tracks to cater to different specializations or capabilities, potentially influencing set‐aside considerations? PWS Pg. 15, Section 3.0

Answer: The Government is still in the acquisition planning stage and a determination has not been made. That determination will be based on an analysis of the market research.

35. Will there be any geographical considerations or preferences that might affect the competition or selection process, particularly for small or local businesses? PWS Pg. 16, Section 3.4

Answer: Currently, VBA is not contemplating geographical preferences.

36. Could the VA clarify if there are preferred vendors or platforms for acquiring hardware and software necessary for task order completion, or if there are any restrictions on vendors that can be used? PWS Pg. 16, Section 3.7.2

Answer: VBA has no preferred vendors or platforms. VBA is looking for the most advantageous and competitive processes to meet its mission.

37. Can the VA provide more details on the expected data volumes and peak load times for system access to ensure the proposed connectivity solutions are adequately provisioned? PWS Pg. 16, Section 3.7.3

Answer: Reference the VPAS Second Industry Engagement Day presentation for select volume information. Other volume information will be provided with the RFP.

38. For non‐Government facilities used to perform work, are there specific security standards and certifications, beyond compliance with 36 CFR Part 1234 Subpart B, that the facilities must meet? PWS Pg. 17, Section 3.7.4

39. Given the specific reference to browser standards and the limited functionality of Chrome, can the VA clarify the preferred web technologies and frameworks that should be used for developing web services and applications to ensure compatibility across VA systems? PWS Pg.

21, Section 3.12.3

Answer: Reference the VA Technical Reference Model.

40. In implementing Zero Trust Architecture in accordance with Presidential Executive Order M‐22‐

09, could the VA provide examples of existing VA systems or services that embody these principles, which could serve as models for compliance? PWS Pg. 22, Section 3.12.4

Answer: Reference NIST SP 800‐207.

41. In the context of evaluation factors, how will compliance with Zero Trust Architecture principles and cybersecurity standards be assessed? Will there be specific criteria or scoring related to a proposer's capability to meet these requirements? PWS Pg. 22, Section 3.12.4

Answer: We are currently in the RFI phase and evaluation factors for Zero Trust Architecture have not been decided.

42. Can the VA provide an estimated timeline for when the VA Processing and Automation Services

(VPAS) IDIQ will be officially released for competition?

Answer: The RFP is estimated to be released in the first or second quarter of Fiscal Year 2025.

43. Will the VPAS IDIQ be designated as a set‐aside for small businesses, veteran‐owned small businesses, or any other specific set‐aside categories? If so, can the VA share the criteria and considerations for this designation?

Answer: Set asides are still being considered and will be decided upon review of all market research and as a result of this RFI.

44. Could the VA outline the primary evaluation factors that will be used to assess proposals for the

VPAS IDIQ? Furthermore, can the VA indicate the relative importance or weighting of these factors in the selection process?

Answer: Technical, Past Performance, and Price. Price is required to be evaluated in every source selection. These evaluation factors may be subject to change with the release of the RFP.

45. Can the government elaborate on the services required to develop, implement, and execute

Veteran Transition Support Services? PWS Pg. 35, Section 4.10

Answer: VBA expects Offerors to submit proposals that address the requirements outlined in the PWS.

46. Does the government currently have a dashboard in place (i.e., Power BI, or others) that is used to maintain data integration, data quality, and data governance? PWS Pg. 37, Section 4.13.3

Answer: Dashboard(s) are currently in place for select task orders under the VICCS IDIQ contract. VPAS‐related dashboard requirements will be requirement and task order dependent.

47. What VA facility would the awardee need to perform work at, and what expectations does the

VA have regarding contractor staffing and onsite work activities?

Answer: This will be requirement and task order dependent. Contractors may be required to travel to VA headquarters in Washington, DC or regional offices across the country.

48. What is the legacy mail routing service referenced in the PWS? PWS Pg. 32

Answer: Currently, there is a Mail Management Services task order issued under the VICCS IDIQ.

Reference the VPAS Second Industry Engagement Day presentation slide 15 for more information.

49. Please provide more details about the automation routing services listed, including their role, system access, and security?

Answer: VBA automation task orders automatically route incoming mail and claims to Veterans

Benefits Management System (VBMS).

50. What technology stack is the VA’s Veterans Benefits Management System (VBMS) built on?

Answer: VPAS IDIQ will not engage in the building or upgrading of VBMS architecture. APIs and

Robotic Process Automation may be required to interact with VBMS.

51. What is the quantity of previously received and processed items that are now in long‐term storage awaiting disposition? PWS Pg. 30

a. Are these digital, physical, or other types of data?

Answer: Some volume information have been provided in the VPAS Second Industry

Engagement Day presentation. The Government is working on collecting additional volume data that will be included in the RFP.

52. What current technology supports the Inbound & Outbound Call Services? PWS Pg. 33

a. What is the current volume of calls?

Answer: Reference the VPAS Second Industry Engagement Day presentation for call volume information.

53. What is the verification process for identifying an individual?

What information is captured from the calls, and how is the information captured/documented?

Answer: Veteran private medical records.

54. How are FOIA requests currently being routed and fulfilled?

a. Which Technology stack is being leveraged?

Answer: FOIA and Privacy Act requests are sent to VA via physical and digital formats (e.g., mail, email, fax, direct upload) to the VBA Intake Center. The requests are processed via Mail

Management Services (MMS) to digitize the communication to meet the VBMS PDF specification and are then placed into the VBA Centralized Mail Portal for further processing. In many cases, the request is processed via automation within MMS to establish the correct End Product (EP) in

VBMS as a non‐rating claim. Once the claim is established in VBMS, VBA personnel begin the detailed process of gathering the documentation and creating the response to the request. The requests are then provided to the requestor via hardcopy, Compact Disc, or both via USPS.

Other related systems in this process are Caseflow, which is used to retrieve information from

VBMS when specific types of requests are made, and FOIAXpress, which is the VA enterprise management application for tracking the status of FOIA claims, where information is inserted to support status tracking activities.

55. Will the different areas of the VA (e.g., NCA, VBA, VHA, and VA) be a single sign‐on with the ability to navigate unhindered throughout all portal sights?

Answer: No.

56. Will third parties (e.g., community care) need the ability to obtain these records?

Answer: In some cases, third parties will need the ability to obtain these records.

57. Would the government consider adding a SDVOSB set‐aside pool for multiple awardees on VPAS similar to T4NG, T4NG2, IHT, and other VA IDIQs with the Government’s priority to increase small business participation in GWACs and IDIQs?

Answer: VBA is contemplating an IDIQ award with all the requirements listed in the draft PWS.

Set asides are still being considered and will be decided upon review of all market research and as a result of this RFI.

58. The PWS states the contractor shall “support the receipt of physical…materials”. Can the solution provider dictate the location to receive materials? PWS Pg. 29, Section 4.2.1

Answer: Yes.

59. Will an architectural diagram(s) be provided as part of the final PWS? PWS Pg. 36, Section

4.13

Answer: Available architectural information will be provided at time of RFP release. Additional architectural information may be provided at time of task order solicitation.