36C10E19R0003-002.pdf

Performance Work Statement (PWS) for the

Veterans Intake, Conversion and Communications Services (VICCS)

Date: June 14, 2019

Department of Veterans Affairs

Office of Administration and Facilities

Acquisition Division

VICCS PWS

Version History Version # Version Description Release

Date

1.0 Initial Release April 2019

2.0 Revised for Solicitation June 2019

Contents

1.0 Scope

2.0 Applicable Documents

3.0 General Requirements

3.1 Contract Type

3.2 Ordering Period

3.3 Hours of Work

3.4 Place of Performance

3.5 Travel

3.6 Materials, Equipment, and Locations

Government-Furnished Contractor-Acquired Connectivity Facilities

3.6.4.1 Government Facilities

3.6.4.2 Non-Government Facilities

3.7 Government Inspection and Oversight

3.8 Enterprise and IT Framework

Federal Identity, Credential, and Access Management (FICAM) Authority to Operate (ATO) / Interim Authority to Operate IATO) Browser / Mobile Standards

3.9 Quality Assurance

Quality Assurance Surveillance Plan Performance Based Service Assessment (PBSA) Contractor Performance

3.10 Independent Quality Assurance and Monitoring (QA&M)

3.11 Disaster Recovery (DR) and Continuity of Operations (COOP)

3.12 Training

4.0 Service Areas

4.1 Program Management, Strategy, and Planning Support Services

4.2 Intake Services

4.3 Source Material Tracking Services

4.4 Source Material Management Services

4.5 Conversion Services

4.6 Upload and Routing Services

4.7 Inbound Mail Management Support Services

4.8 Rules-Based Processing Service (RBPS)

4.9 Business Processing Services (BPS)

4.10 Centralized Outbound Services

4.11 Data Transfer Services

4.12 Graphical Self-Service Report Generation Capability (VA-Accessible) Services

4.13 Inbound Call Services

4.14 Outbound Call Services

4.15 Integration, Setup, Test, And Validation Services

4.16 Service Updates

4.17 Data Transition In / Out Services

4.18 Professional Services

4.19 Help Desk Services

5.0 Deliverables

5.1 Products

5.2 Rights in Data

6.0 Security and Privacy

6.1 Information Security and Privacy Security Requirements

6.2 Personnel Security Requirements

6.3 Facility/Resource Access Provisions

6.4 Badges

6.5 Incident Reporting and Management

6.6 Security and Privacy Awareness Training

6.7 Security Role-Based Training

7.0 Contract Management

7.1 Government Support

IDIQ COR

Task Order COR Onsite Government Representative

7.2 Contractor Program Management

Key Personnel Work Control

Addendum A – Additional VA Requirements, Consolidated Addendum B – Performance Based Service Assessment

1.0 Scope

Through its three (3) administrations, National Cemetery Administration (NCA), Veterans Benefits Administration (VBA), and Veterans Health Administration (VHA), VA administers vital services to America's veterans. VA provides health care services, benefits programs and access to national cemeteries to former military personnel and their dependents.

The fundamental mission of the Veterans Benefits Administration (VBA) is to provide Veterans, service members, and their families benefits earned through military service to the United States. VBA accomplishes its mission by providing services supporting Veteran readjustment to civilian life and enhancements to their well-being.

VBA developed the Veterans Benefits Management System (VBMS), a paperless claims processing system that enables efficiencies, thereby reducing the time required to process claims for benefits. The system replaces a manual and paper-based process comprised of inherent bottlenecks and inefficiencies.

Populating the VBMS document repository requires ongoing conversion efforts consisting primarily of converting claims-related source materials. Such materials are received in either paper or electronically via fax or other electronic means, or through converting other non-paper source materials. These materials can include: microfilm, microfiche, files stored on Compact Discs (CD), Digital Video Disc / Digital Versatile Disc (DVDs), and flash memory devices. All materials are converted into searchable Portable Document Format (PDF) files, associated metadata is captured, and the images and metadata are uploaded into the VBMS repository.

To continuously improve benefits processing efficiency and cycle-time, VBA has partnered with industry leaders to provide a host of contracted services. Services in the existing contract portfolio include:

• File bank extraction services reduced VBA’s physical footprint at 56 regional offices across the nation, saving taxpayers millions of dollars.

• Conversion services that provide images and metadata to VBMS eFolders.

• Digitized Mail Handling Service (DMHS) that provides a digital preview of converted mail.

• Records Management Services (RMS) that provide storage for converted source materials.

• Centralized Benefits Communications Management (CBCM) services supporting the centralization of printing and mailing for all VA regional offices.

• Services supporting Private Medical Records (PMR) retrieval.

Through these partnerships VBA continues to progress from paper-based processes to an electronic environment supporting greater automation and improved efficiencies.

This progression continues through the acquisition of managed services that include the capabilities to:

• Perform intake services

• Perform tracking, handling (including physical storage), and management of all source materials

• Perform conversion services

• Perform inbound and outbound mail management

• Facilitate transaction processing / case management

• Perform centralized outbound services

• Perform data reconciliation and data transfer to VA and other Contractor systems and services

• Develop training and communications materials and facilitate change management where new policies, business rules / procedures, or systems changes are implemented

• Assist VA with development and documentation of business processes, rules, and tools to create and / or improve:

o Data analytics and business process intelligence o Data visualization o Inbound / outbound mail processing o Document taxonomy management o Document processing / editing tools o New business rules creation for new business processes o Business rules management o Training o Forms development and modification

• Perform analysis using the developed business processes, rules, and tools

This PWS provides general requirements. Specific requirements shall be defined in individual Task Orders. Service area requirements are described in Section 4.0 and are not mutually exclusive for Task Order requirements. Requirements may fall within one specific service area but in many cases, the requirements will encompass and apply across and within multiple service areas. Service performance requirements shall be established in individual Task Orders.

2.0 Applicable Documents

The Contractor shall comply with the documents listed below. Additional documents may be listed in individual Task Orders.

1. 44 U.S.C. § 3551-3558, “Federal Information Security Modernization Act (FISMA) of 2014”

2. Federal Information Processing Standards (FIPS) Publication 140-2, “Security Requirements for Cryptographic Modules”

3. Federal Information Processing Standards (FIPS) Publication 140-3, “Security Requirements for Cryptographic Modules”

4. FIPS Publication 199, “Standards for Security Categorization of Federal Information and Information Systems,” February 2004

5. FIPS Publication 200, “Minimum Security Requirements for Federal Information and Information Systems,” March 2006

6. FIPS Publication 201-2, “Personal Identity Verification of Federal Employees and Contractors,” August 2013

7. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

8. Public Law 109-461, “Veterans Benefits, Health Care, and Information Technology Act of 2006, Title IX, Information Security Matters”

9. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, http://www.va.gov/vapubs/

10. VA Handbook 0710, “Personnel Security and Suitability Security Program,” May 2, 2016, http://www.va.gov/vapubs

11. VA Directive and Handbook 6102, “Internet/Intranet Services,” July 15, 2008

12. 36 C.F.R. Part 1194 “Electronic and Information Technology Accessibility Standards”

13. Office of Management and Budget (OMB) Circular A-130, “Managing Federal Information as a Strategic Resource,” July 28, 2016

14. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended by the Workforce Investment Act of 1998 (P.L. 105-220), August 7, 1998

15. NIST Special Publication (SP) 800-66 Rev 1: “An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule,” October 2008

16. “Homeland Security Presidential Directive (12) (HSPD-12),” August 27, 2004

17. VA Directive 6500, “VA Cybersecurity Program,” January 23, 2019

18. VA Handbook 6500, “Risk Management Framework for VA Information Systems

– Tier 3: VA Information Security Program,” March 10, 2015

19. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI)”, March 12, 2019

20. VA Handbook 6500.3, “Assessment, Authorization, and Continuous Monitoring of VA Information Systems,” February 3, 2014

21. VA Handbook 6500.5, “Incorporating Security and Privacy in System Development Lifecycle,” March 22, 2010

22. VA Handbook 6500.6, “Contract Security,” March 12, 2010

23. VA Handbook 6500.8, “Information System Contingency Planning,” April 6, 2011

24. “One-VA Technical Reference Model (TRM)” - (reference at https://www.va.gov/trm/TRMHomePage.aspx)

25. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014

26. VA Handbook 6508.1, “Procedures for Privacy Threshold Analysis and Privacy Impact Assessment,” July 30, 2015

27. VA Directive 6510, “VA Identity and Access Management,” January 15, 2016

28. VA Handbook 6510, “VA Identity and Access Management,” January 15, 2016

29. VA Directive 6300, “Records and Information Management,” September 21,

30. VA Handbook, 6300.1, “Records Management Procedures,” March 24, 2010

31. NIST SP 800-37, “Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach, Rev. 2,” December 20, 2018

32. NIST SP 800-53 Rev. 5 (DRAFT), “Security and Privacy Controls for Federal Information Systems and Organizations,” August 15, 2017

33. OMB Memorandum, “Transition to Internet Protocol version 6 (IPv6),” September 28, 2010

34. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015

35. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” March 24, 2014

36. OMB Memorandum M-04-04, “E-Authentication Guidance for Federal Agencies,” December 16, 2003

37. OMB Memorandum M-05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005

38. OMB memorandum M-11-11, “Continued Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” February 3, 2011

39. OMB Memorandum for Chief Information Officers, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008

40. “Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance,” December 2, 2011

41. NIST SP 800-116 Rev. 1, “Guidelines for the Use of PIV Credentials in Facility Access,” June 29, 2018

42. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, “Digital Identity Guidelines,” December 1, 2017

43. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 19, 2014

44. “Draft National Institute of Standards and Technology Interagency Report (NISTIR) 7981 Mobile, PIV, and Authentication,” March 2014

45. “IAM Identity Management Business Requirements Guidance Document,” May 2013, (https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

46. VA Memorandum, VAIQ #7712300, “Mandate to meet PIV Requirements for New and Existing Systems,” June 30, 2015, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4846

47. “Trusted Internet Connections (TIC) Reference Architecture Document, Version 2.2, Federal Interagency Technical Reference Architectures, Department of Homeland Security,” June 19, 2017

48. OMB Memorandum M-08-05, “Implementation of Trusted Internet Connections (TIC),” November 20, 2007

49. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008

50. VA Memorandum, VAIQ #7497987, “Compliance – Electronic Product Environmental Assessment Tool (EPEAT) – IT Electronic Equipment,” August 11, 2014 (reference Document Libraries, EPEAT/Green Purchasing Section, https://www.voa.va.gov/documentlistpublic.aspx?NodeID=552)

51. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (Public Law 110–140), December 19, 2007

52. Section 104 of the Energy Policy Act of 2005, (Public Law 109–58), August 8,

53. Executive Order 13693, “Planning for Federal Sustainability in the Next Decade”, dated March 19, 2015

54. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 2,

55. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote Access”, January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

56. VA Memorandum, VAIQ #7614373, “Implementation of Federal Personal Identity Verification (PIV) Credentials for Federal and Contractor Access to VA

IT Systems,” July 9, 2015, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

57. VA Memorandum, VAIQ #7613595, “Mandatory Use of PIV Multifactor Authentication to VA Information System,” June 30, 2015, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

58. VA Memorandum, VAIQ #7613597, “Mandatory Use of PIV Multifactor Authentication for Users with Elevated Privileges,” June 30, 2015;

https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

59. VA Memorandum, VAIQ #7581492, “Use of Personal Email,” April 24, 2015, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

60. VA Memorandum VAIQ #7823189, “Updated VA Information Security Rules of Behavior,” September 15, 2017, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

61. “Records Control Schedule VB-1,” dated January 31, 2014

62. VA Handbook 0730, “Security and Law Enforcement” dated August 11, 2000 (https://www.va.gov/vapubs/viewPublication.asp?Pub_ID=93&FType=2)

63. VA Handbook 0730/1, “Security and Law Enforcement” dated August 20, 2004 (https://www.va.gov/vapubs/viewPublication.asp?Pub_ID=96&FType=2)

64. VA Handbook 0730/4, “Security and Law Enforcement” dated March 29, 2013 (https://www.va.gov/vapubs/viewPublication.asp?Pub_ID=700&FType=2)

65. “Authorization Requirements Standard Operating Procedures, v3.31,” dated February 4, 2019

66. VA Memorandum, VAIQ #7660995, “Continuous Diagnostics and Monitoring of all VA Information Systems,” dated January 29, 2016

3.0 General Requirements

The Contractor shall provide and/or acquire the services required by individual Task Orders pursuant to the general requirements specified below.

3.1 Contract Type

This is a Multiple Award Indefinite Delivery/Indefinite Quantity (IDIQ) contract.

3.2 Ordering Period

The ordering period for the basic contract shall be five (5) years.

3.3 Hours of Work

Work at a Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO). Hours of work will be established at the TO level. The Contractor may also be required to support 24/7 operations 365 days per year as identified in individual Task Orders.

There are 10 Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, four are set by date:

New Year's Day January 1 Independence Day July 4 Veterans Day November 11 Christmas Day December 25

If any of the above falls on a Saturday, then Friday shall be observed as a holiday.

Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six (6) are set by a day of the week and month:

Martin Luther King's Birthday Third Monday in January Washington's Birthday Third Monday in February Memorial Day Last Monday in May Labor Day First Monday in September Columbus Day Second Monday in October Thanksgiving Fourth Thursday in November

3.4 Place of Performance

The place of performance shall be identified in individual Task Orders. Locations will be Government and Contractor sites within the Continental United States (CONUS). No work shall be performed outside of the Continental United States (OCONUS).

3.5 Travel

Travel shall be in accordance with (IAW) individual Task Order requirements. Travel details must be provided to and approved by the Contracting Officer’s Representative (COR) or the Government designee prior to the commencement of travel. All travel shall be IAW FAR 31.205-46.

3.6 Materials, Equipment, and Locations

Government-Furnished

Government Furnished Property (GFP) which includes Government Furnished Material (GFM), Government Furnished Information (GFI), and Government Furnished Equipment (GFE) may be provided and shall be identified in the individual Task Order.

The Contractor shall be responsible for conducting all necessary examinations, inspections, maintenance, and tests upon receipt.

VA will provide VA specific system access as appropriate and required in individual Task Orders. Contractors shall comply with VA security policies and procedures with respect to protecting sensitive data. See Section 6.0 for detailed security requirements.

Contractor-Acquired The Contractor shall acquire and / or provide any hardware and / or software required to accomplish each Task Order that is not provided as GFP. Software integrity shall be maintained by the Contractor within the licensing agreement of the producer.

Connectivity VA will provide connectivity to VA specific systems / network as required for execution of a task via VA approved remote access technology. Currently this may include but is not limited to Citrix Access Gateway (CAG), site-to-site VPN, or Cisco AnyConnect Secure Mobility Client. The Contractor must meet the requirements of VA Handbook 6500 and will bear the cost to provide connectivity to VA systems / networks. Other connectivity to VA systems may be authorized as appropriate in individual Task Orders.

Facilities Work may be performed at either a Government or non-Government facility. Each Task Order shall delineate the location requirements.

3.6.4.1 Government Facilities

Certain Government office space may be made available for performance of individual Task Orders. Contractors may be required to establish operations and support at Government locations and shall comply with VA and / or Federal assessment and authorization (A&A) requirements. Such facilities shall be specified in the individual Task Order.

3.6.4.2 Non-Government Facilities

Personnel shall perform at Contractor facilities as specified in the individual task order and shall comply with VA and/or Federal A&A requirements. The Contractor shall disclose specific facility information during the Request for Task Order Proposal (RTOP) process. All facilities shall be approved by VA and in compliance with PWS paragraph 6.0, Security and Privacy. All facilities containing VA source materials shall be compliant with 36 CFR Part 1234, Subpart B, with no exceptions made for the waivers discussed within 36 CFR Part 1234, Subpart B. While National Archives and Records Administration (NARA) certification is not required, the Contractor shall maintain compliance with the referenced NARA requirements.

3.7 Government Inspection and Oversight

The Contractor shall cooperate with authorized Government offices in the areas of facilities access, audits, security incident notification, and hosting location. Specifically, the Contractor (and any Subcontractor) shall:

a. Provide the CO, COR, and representatives of authorized Government offices, full and free physical and remote / logical access to their facilities, installations, operations documentation, databases, and personnel used for contract hosting services. This access shall be provided to the extent required to carry out audits, inspections, device scanning utilizing Government prescribed tools, investigations, or other reviews to ensure compliance with contractual requirements for IT and information security, and to safeguard against threats and hazards to the integrity, availability, and confidentiality of agency information in the possession or under the control of the Contractor (or Subcontractor).

b. Fully cooperate with all audits, inspections, investigations, or other reviews conducted by or on behalf of the CO or other authorized Government offices as described in subparagraph (a). Full cooperation includes, but is not limited to, prompt disclosure (per agency policy) to authorized requests of data, information, and records requested in connection with any audit, inspection, investigation, or review, making employees of the Contractor available for interview by auditors, inspectors, and investigators upon request, and providing prompt access (per agency policy) to Contractor facilities, systems, data and personnel to the extent the auditors, inspectors, and investigators reasonably believe necessary to complete the audit, inspection, investigation, or other review. The Contractor's (and any Subcontractors') cooperation with audits, inspections, investigations, and reviews shall be provided at no additional cost to the Government.

c. Preserve such data, records, logs and other evidence which are reasonably necessary to conduct a thorough investigation of any computer security incident.

A computer security incident (as defined in NIST SP 800-61, Computer Security Incident Handling Guide), includes but is not limited to, those constituting an actual or potential threat or hazard to the integrity, availability, or confidentiality of agency information in the possession or under the control of the Contractor (or Subcontractor), or to the function of information systems operated by the Contractor (or Subcontractor) in the performance of this contract.

d. Promptly notify the designated agency representative in the event of any computer security and privacy incident as described in paragraph (c) above. This notification requirement is in addition to any other notification requirements which may be required by law or this contract. Established Federal agency timeframes for reporting security and privacy incidents to the United States Computer Emergency Readiness Team (US-CERT), although not exhaustive, serve as a useful guideline for determining whether reports under this paragraph are made promptly. (See NIST SP 800-61, Computer Security Incident Handling Guide, Appendix J).

e. Provide to the requestor (CO, a representative of the CO, or authorized

Government offices) Government data, information, or records under the control of or in the possession of the Contractor pursuant to this contract, which the Agency or authorized Government offices, including the Office of Inspector General (OIG), may request in furtherance of other audits, inspections, investigations, reviews or litigation in which the Agency or other authorized Government offices are involved in the form specified at the task order level.

Requests for production under this paragraph shall specify a deadline not less than 10 days for compliance, which will determine whether response to the request has been made in a timely manner. Unless expressly provided otherwise elsewhere in this contract, the production of data, information, or records under this paragraph will be at no additional cost to the Government.

f. Include the substance of this Section, including this paragraph (f) in any subcontract which would require or otherwise result in Subcontractor employees having access to agency information in the possession or under the control of the Contractor (or Subcontractor), or access to information systems operated by the Contractor (or Subcontractor) in the performance of this contract.

g. Ensure that all hosting services pertaining to this contract are performed within the Continental United States of America, including the storage of agency data, information, and records under the control of or in the possession of the Contractor pursuant to this contract.

3.8 Enterprise and IT Framework

Federal Identity, Credential, and Access Management (FICAM)

The Contractor shall ensure Commercial Off-The-Shelf (COTS) product(s), software configuration and customization, and/or new software are Personal Identity Verification (PIV) card-enabled by accepting HSPD-12 PIV credentials using VA Enterprise Technical Architecture (ETA), http://www.ea.oit.va.gov/VA_EA/VAEA_TechnicalArchitecture.asp, and VA Identity and Access Management (IAM) approved enterprise design and integration patterns, http://www.techstrategies.oit.va.gov/enterprise_dp.asp. The Contractor shall ensure all Contractor delivered applications and systems comply with the VA Identity, Credential, and Access Management policies and guidelines set forth in the VA Handbook 6510 and align with the Federal Identity, Credential, and Access Management Roadmap and Implementation Guidance v2.0.

The Contractor shall ensure all Contractor delivered applications and systems provide user authentication services compliant with the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-63-3, VA Handbook 6500 Appendix F, “VA System Security Controls”, and VA IAM enterprise requirements for direct, assertion-based authentication, and/or trust-based authentication, as determined by the design and integration patterns. Direct authentication at a minimum must include Public Key Infrastructure (PKI) based authentication supportive of PIV card and/or Common Access Card (CAC), as determined by the business need.

The Contractor shall ensure all Contractor delivered applications and systems conform to the specific Identity and Access Management PIV requirements set forth in the Office of Management and Budget (OMB) Memoranda M-04-04, M-05-24, M-11-11, and NIST Federal Information Processing Standard (FIPS) 201-2. OMB Memoranda M-04-04, M- 05-24, and M-11-11 can be found at:

https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/omb/memoranda/fy 04/m04-04.pdf, https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/omb/memoranda/fy 2005/m05-24.pdf, and http://www.ea.oit.va.gov/VA_EA/VAEA_TechnicalArchitecture.asp http://www.techstrategies.oit.va.gov/enterprise_dp.asp https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/omb/memoranda/fy04/m04-04.pdf https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/omb/memoranda/fy04/m04-04.pdf https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/omb/memoranda/fy2005/m05-24.pdf https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/omb/memoranda/fy2005/m05-24.pdf https://obamawhitehouse.archives.gov/sites/default/files/omb/memoranda/2011/m11- 11.pdf respectively. Contractor delivered applications and systems shall be on the FIPS 201-2 Approved Product List (APL). If the Contractor delivered application and system is not on the APL, the Contractor shall be responsible for taking the application and system through the FIPS 201 Evaluation Program.

The Contractor shall ensure all Contractor delivered applications and systems support:

1. Automated provisioning and can use enterprise provisioning service.

2. Interfacing with VA’s Master Veteran Index (MVI) to provision identity attributes, if the solution relies on VA user identities. MVI is the authoritative source for VA user identity data.

3. The VA defined unique identity (Secure Identifier [SEC ID]/Integrated Control Number [ICN]).

4. Multiple authenticators for a given identity and authenticators at every Authenticator Assurance Level (AAL) appropriate for the solution.

5. Identity proofing for each Identity Assurance Level (IAL) appropriate for the solution.

6. Federation for each Federation Assurance Level (FAL) appropriate for the solution, if applicable.

7. Two-factor authentication (2FA) through an applicable design pattern as outlined in VA Enterprise Design Patterns.

8. A Security Assertion Markup Language (SAML) implementation if the solution relies on assertion-based authentication. Additional assertion implementations, besides the required SAML assertion, may be provided if they are compliant with NIST SP 800-63-3 guidelines.

9. Authentication/account binding based on trusted Hypertext Transfer Protocol (HTTP) headers if the solution relies on Trust based authentication.

10. Role Based Access Control.

11. Auditing and reporting capabilities.

12. Compliance with VAIQ# 7712300 Mandate to meet PIV requirements for new and existing systems.

https://www.voa.va.gov/DocumentView.aspx?DocumentID=4846

The required Assurance Levels for this specific effort are Identity Assurance Level 3, Authenticator Assurance Level 3, and Federation Assurance Level 3.

Authority to Operate (ATO) / Interim Authority to Operate IATO) The Contractor shall obtain and maintain any ATO or, if acceptable to the Government, any IATO within 180 calendar days following Task Order award. The Contractor shall develop, implement, and execute processes to obtain VA authorizations for all services (including updated services as required) as specified by individual Task Orders. Specific activities include, but are not limited to security certifications, or comprehensive assessments of the management, operational, and technical security controls in Contractor-provided services to determine the extent to which the controls are implemented correctly. For detailed Security and Privacy Requirements refer to Authorization Requirements Standard Operating Procedures Version 3.31.

https://obamawhitehouse.archives.gov/sites/default/files/omb/memoranda/2011/m11-11.pdf https://obamawhitehouse.archives.gov/sites/default/files/omb/memoranda/2011/m11-11.pdf https://www.voa.va.gov/DocumentView.aspx?DocumentID=4846

Browser / Mobile Standards The Contractor shall ensure services are developed in accordance with VA standard browser baselines and shall update services as required by VA when new browser standards are implemented. In the event mobile services are required, VA mobile development, security and privacy standards should be followed to ensure adequate protection of VA information. VA currently uses Windows IE 11 and anticipates staying with the Windows standard as VA progresses into Windows 10 OS. Although VA has Chrome, it is currently limited in functionality and is not considered the standard browser for daily usage across VA applications.

3.9 Quality Assurance

Quality Assurance Surveillance Plan

In accordance with FAR 37.102, Task Orders issued under this IDIQ will be performance-based to the maximum extent practicable. Each TO will define the quality assurance surveillance plan, to include specific performance standards and measures at the TO level.

Performance Based Service Assessment (PBSA) The COR shall perform quarterly performance assessments. The Performance Based Service Assessment (PBSA), or other method, may be used to document this assessment. A sample PBSA is provided in this document as Addendum B.

Performance Objective

Performance Standard Acceptable Levels of Performance

A. Technical / Quality of Product or Service

1. Demonstrates understanding of requirements

2. Efficient and effective in meeting requirements

3. Meets technical needs and mission requirements

4. Provides quality services / products

Satisfactory or higher

B. Project Milestones and Schedule

1. Established milestones and project dates are met

2. Products completed, reviewed, delivered in accordance with the established schedule

3. Notifies customer in advance of potential problems

Satisfactory or higher

C. Cost & Staffing 1. Currency of expertise and staffing levels appropriate

2. Personnel possess necessary knowledge, skills and abilities to perform tasks

Satisfactory or higher

D. Management 1. Integration and coordination of all activities to execute effort

Satisfactory or higher

Contractor Performance

A Contractor Discrepancy Report (CDR), may be issued by a CO or COR to document less than acceptable performance by the Contractor at any point during the period of performance. It should be noted that issuance of a CDR should not be the first form of communication or plan of resolution unless the seriousness of the situation warrants such formal documentation from onset. The CO, COR and Contractor shall maintain open and effective communications to avoid the issuance of CDRs to the maximum extent practicable. All parties acknowledge that a finalized CDR will become part of the official file and will be used to report on annual performance under the IDIQ. If use of a CDR is warranted, the CO/COR shall complete the CDR, citing the IDIQ and / or TO number and the specific IDIQ and/or TO section or clause related to the performance issue. The CO/COR shall provide a detailed and descriptive narrative of the background and issue. Upon receipt of the CDR, the Contractor shall provide a timely and detailed response. The Contractor’s response shall include any important or relevant information or justification for the performance issue and a proposed resolution. The CO/COR will review the response from the Contractor and the CO will issue a final recommendation or plan of action. The CO, COR, and Contractor will maintain communication to ensure that the recommendation or plan of action is carried out.

The Contractor’s performance on the IDIQ and any TOs will be reported to the Contractor Performance Assessment Reporting System (CPARS) on an annual basis.

The CO and COR will make use of information from CDRs and the Task Order Performance Evaluations, as well as any additional knowledge and information available to them with respect to the Contractor’s performance, to complete the CPARS.

Contractors shall familiarize themselves with the CPARS process and be prepared to respond to reports entered by the CO and COR.

3.10 Independent Quality Assurance and Monitoring (QA&M)

The Contractor is responsible for the quality of all work performed. All work performed either by Contractor employees or by Subcontractors shall be subject to quality review.

The government will implement an independent, third party QA&M contract.

As described in individual Task Orders, the Contractor may be required to support full-time onsite government QA&M staff and to support activities including but not limited to:

• Making available program, project, and operational documents

• Providing data requested as part of onsite and remote audits

• Providing access to source materials, images and associated metadata

• Complying with sampling methodologies or practices required by the government

Unless otherwise specified, within 30 calendar days of any Task Order award, the VICCS Contractor shall provide any resources necessary to support QA&M as specified in the individual Task Order. These requirements may include making available full-time space at the Contractor’s facility.

3.11 Disaster Recovery (DR) and Continuity of Operations (COOP) The Contractor shall develop, implement, and execute processes for disaster recovery and business continuity. The range of recovery services covers the spectrum from partial loss of function or data for a brief amount of time to a “worst-case” scenario in which a man-made, natural disaster, or service failure results in the loss of an entire service. Services may be required during any timeframe from initial declaration of a disaster to final recovery of all business processes. Service availability requirements will be specified by individual Task Orders.

3.12 Training

The Contractor shall develop, implement, and execute processes for initial training for use of all services specified by individual Task Orders. The Contractor shall develop and submit to the Government for review training plans, manuals and other training documentation or training aids. Electronic training tools such as video teleconferencing and computer-based training shall be employed to enhance the effectiveness of training materials and courses. Training delivery may be recorded during live delivery to VA;

pre-recorded initial training is not acceptable. The Contractor shall submit a detailed training plan with timelines and schedules, sufficiently detailed to identify user training plans as specified by individual Task Orders.

The Contractor shall develop accompanying electronic user manuals that VA will subsequently make available to new users. The electronic user manuals shall be delivered along with the training manuals. The Contractor shall revise all user manuals as substantial changes are made to the service.

4.0 Service Areas

Individual Task Orders may encompass more than one functional area listed below.

Further service area details are described to provide greater insight into the complexity and uniqueness of some potential Task Order requirements covered by this PWS.

Service area requirements are not mutually exclusive and may apply across multiple service areas. Efforts to be performed by the Contractor under this contract are of such a nature that they may create a potential organizational Conflict of Interest (COI) as contemplated by Subpart 9.5 of the FAR. Contractor personnel may be required to sign a non-disclosure agreement.

4.1 Program Management, Strategy, and Planning Support Services The Contractor shall develop plans for and provide Program and Project Management, monitoring and analysis, strategy, enterprise architecture and planning support on an enterprise or individual project level. Program Management support is critical to the organization achieving strategic goals and fulfilling mission requirements within programmatic constraints. Contractor shall address all program / project management aspects identified at the individual TO level.

4.2 Intake Services

The Contractor shall develop, implement, and execute processes for a series of intake services to support the receipt of physical and digital source materials from a variety of sources and methods, including but not limited to:

• Bulk source materials

• U.S. Mail

• Private carrier delivery (e.g., FedEx, UPS, DHL)

• Facsimiles

• Application Programming Interface (API)

• Self-service submissions

Source materials will be received from VA offices and directly from Veterans and other individuals/locations on behalf of Veterans. The Contractor may also retrieve materials from designated VA and other Government facilities.

The Contractor shall take receipt of all deliveries of physical or electronic source materials on the same day as delivered. This receipt shall constitute the acceptance of the source materials and liability for material management by the Contractor, including complete end-to-end traceability.

Source materials may contain Veterans’ claims or other claimants’ applications that include VA Sensitive Information. All source materials and VA information received during the performance of this contract, whether in physical or electronic format, shall be treated as sensitive information. While in their custody, the Contractor shall securely handle source materials without loss or damage. The Contractor shall minimize the risk of source material damage while source materials are in the Contractor’s custody.

4.3 Source Material Tracking Services

While in their custody, the Contractor shall have documented processes for tracking all physical or digital source materials. The Contractor shall develop, implement, and execute processes for an automated tracking service to be utilized by VA authorized users to facilitate tracking and maintaining a chain of custody for all source materials received by the VICCS Contractors as well as all materials previously received and processed that are now in long term storage awaiting disposition.

4.4 Source Material Management Services

Source material management is the process which integrates the flow of source materials, through and out of an organization to achieve a level of service which ensures that the right materials are available at the right place at the time in the right quantity. The Contractor shall develop, implement, and execute processes for managing all activities associated with the materials in their constructive custody. Such activities include, but are not limited to:

• Loading all necessary information related to the materials into tracking services created for that purpose

• Determining and executing necessary steps for compliance with processing plans and physical security of all materials

• Performing any corrective steps necessary in Contractor and VA provided systems and services to allow continued planned processing activities

• Providing information and feedback to the VA and other Contractors related to completed and planned activities

4.5 Conversion Services

Conversion is defined as the process of changing source materials from one form, state, etc., to another. Conversion includes both the scanning of paper source materials and the conversion of digital/electronic or non-paper source materials into pre-defined images. Materials may be hazardous, delicate, or damaged. The Contractor shall develop, implement, and execute conversion services at a Contractor or Government site as specified in individual Task Orders. While in their custody, the Contractor shall securely handle source materials, manage conversion in accordance with published Document Conversion Rules (DCR) or Business Rules without loss or damage, and work collaboratively with the Government to support efficient processing of variable document conversion production rates. The Contractor shall minimize the risk of source materials damage during conversion. If source material is fragile or likely to be damaged when scanned, the Contractor shall maintain procedures for preventing such damage.

The Contractor shall propose efficient and effective methodologies for protecting source material.

The Contractor shall maintain the physical arrangement of source materials until conversion is complete unless otherwise directed within the Business Rules or Document Conversion Rules. Following conversion, the Contractor shall de-prep source materials in accordance with the Business Rules and Document Conversion Rules.

Specifically, in support of this contract, conversion includes:

• Preparing source materials for conversion

• Converting source materials, sufficient for upload to Government image repositories and/or other Contractor services

• Document indexing

• Data extraction o Supporting material tracking o Supporting automated business process flows

• De-Preparation of materials for transferring to storage awaiting disposition

4.6 Upload and Routing Services

The Contractor shall develop, implement, and execute processes for uploading and routing images and/or associated metadata to multiple image repositories and services provided by other Contractors as specified by individual Task Orders. Performance of this task may include all or part of the tasks listed below:

• Upload to VA’s Veterans Benefits Management System (VBMS) or other non- VBMS repository

• Routing to VICCS inbound mail management support service

• Routing to legacy mail handling service

• Routing to external Private Medical Records (PMR) Contractor

• Routing to other Contractor services

• Routing to VICCS Source Material Tracking Service

• Routing to RMS Contractors

4.7 Inbound Mail Management Support Services

The Contractor shall develop, implement, and execute processes for a single access point inbound mail management support service to remotely display, to VA authorized users, images and associated metadata that were created as a part of the conversion services. This service shall interface with services provided by other Contractors as specified by individual Task Orders.

4.8 Rules-Based Processing Service (RBPS)

The Contractor shall develop, implement, and execute processes for an automated RBPS that supports VA’s efforts to modernize claims processing capabilities for VA authorized users. This service shall interface with existing / future VA and Contractor services specified in individual Task Orders.

4.9 Business Processing Services (BPS)

Business Processing Services consist of a series of service transactions to be completed based upon mail received. VA intends to implement BPS for a series of simplified claims and other business-related services, each with varying levels of complexity. The Contractor shall develop, implement, and execute processes for processing transactions utilizing existing VA and other Contractor-created services.

These transactions can be initiated from either manual or automated data entry from a variety of forms, or from pre-populated data sets/service call inputs. Services may include, but are not limited to:

• Mail management services (e.g., mail handling, unidentifiable mail resolution, return mail resolution, etc.)

• Claims services (e.g., claims auto-establishment, manual claims establishment, Burial claims processing, Pension claims processing, Dependency claims processing, etc.)

• Business-related services (e.g., failure to upload resolution, redaction services, image splitting, etc.)

4.10 Centralized Outbound Services

Centralized Outbound Services (COS) is required to centralize the printing, mailing or electronic notification of outbound communications generated by VA staff. The Contractor shall develop, implement, and execute processes for centralized outbound services. These services may include, but are not limited to:

• Downloading specific documents from VA repositories

• Letter generation

• Preparing downloaded documents for delivery

• Outbound delivery

• Notifying and presenting to the recipient an electronic image of the specific documents

• Acknowledging receipt of claims-related materials sent to VA by Veterans / claimants / representatives

• Printing and Mailing Services

4.11 Data Transfer Services

The Contractor shall develop, implement, and execute processes for integrating with various VA systems and other Contractor services to support data transfers as required by individual Task Orders. VA will ensure appropriate interface documentation for all VA systems and other Contractor services is made available with each Task Order.

4.12 Graphical Self-Service Report Generation Capability (VA-Accessible) Services

The Contractor shall develop, implement, and execute processes for a business intelligence engine supporting report generation accessible by VA staff. The Contractor shall expose their raw, real-time data to VA to support the generation of real-time reports as needed. Data access shall be extended to agents of the Government.

4.13 Inbound Call Services

The Contractor shall develop, implement, and execute processes for a call intake capability, providing direct access to VA field users, Veteran Service Organizations (VSOs), and other entities as required by individual Task Orders.

4.14 Outbound Call Services

The Contractor shall develop, implement, and execute processes for an outbound call capability, enough to support a pre-defined period of time/call volume specified by individual Task Orders. VA will deliver the Contractor enough contact information for identified recipients as well as the scripted details of the information VA desires to have communicated.

4.15 Integration, Setup, Test, And Validation Services

The Contractor shall develop, implement, and execute processes for the setup, testing, and validation of all services as required by individual Task Orders. The Contractor shall provide systems integration support to include planning, interoperability specifications and analysis, system interface specifications, and service definitions.

The Contractor shall ensure that any specific setup, testing, and validation procedures are fully documented and complete. The Contractor shall establish a test strategy including end-to-end plans, procedures, and testing scenarios. The Contractor shall establish and test Task Order work flows, business rules, policy definitions, and permissions.

As specified by individual Task Orders, the Contractor shall create and utilize development and test environments that will interconnect appropriately with Government and other Contractor created environments for testing of all services being acquired prior to implementation into the Production environment.

Rollout of all services into the Production environment shall be implemented as a phased approach and shall be detailed in all planning documents including regression testing and service rollback contingency plans. Such phased rollouts shall be implemented for any service updates and not be limited to initial capabilities.

4.16 Service Updates

The Government anticipates updates will be required for any Task Order services provided by the Contractor (routine) and when changes occur to systems / services with which the Contractor will interface (non-routine). The Contractor shall develop, implement, and execute processes for the performance of routine and non-routine service updates as required by individual Task Orders.

Routine service updates shall be implemented on a bi-monthly basis. Bi-monthly means once every two (2) months. Routine service updates include, but are not limited to, approved changes to:

• Intake Services

• SMTS and User Administration

• VICCS Mail Portal and User Administration

• Rules-Based Processing Service

• Centralized Outbound Services

Non-routine service updates are those updates occurring on either an emergent basis or other than bi-monthly basis. When Government systems, or other VICCS Contractor services are updated, either on a regular interval or on an emergent basis, and where the updates impact the Contractor service, the Contractor shall perform corresponding service updates, including database updates, to ensure ongoing operations. These updates include, but are not limited to, approved changes to:

• Interfaces with VA government system(s) o Data access service o VBMS o VA Application Program Interfaces (API)

• Interfaces…