D.1 ATTACHMENT A 36C10X22R0060 A00001_Rev 1_8.16.2022.pdf

Performance Work Statement Rev 1 8.16.2022

1.0 BACKGROUND

The VA Police is a federal law enforcement organization within the U.S. Department of Veterans Affairs with unique responsibilities dedicated to reducing crime and protecting those assets under the charge and control of the Veterans Health Administration. In accordance with H.R. 2429, dated June 16, 2021, Subsection (a) of Section 902, the Secretary shall require Department police officers to use cameras worn on the individual police officer’s person that record and store audio and video (commonly known as ‘body worn cameras’).” Body Worn Cameras will be provided to VA Police Officers in the performance of their duties at all VA Medical Facilities within the United States. The use of Body Worn Cameras ensures the continued compliance and oversight of security objectives at VA Medical Centers and leased facilities to include: (i) Arrests made by and tickets issued by Department police officers; (ii) Prosecutions, ticketing, and other actions relating to such arrests; (iii) The use of force and weapons discharge, and (iv) Complaints, investigations, and disciplinary actions.

The body worn cameras and dashcams in vehicle will be used throughout the duty day.

Upon completion of the duty day, VA Police Officers will return their camera devices to a Digital Evidence Management System for data storage and retrieval.

The Digital Evidence Management System also functions as a network providing the capability to share data across jurisdictional lines and discover links between crimes in different localities and states.

2.0 APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. 44 U.S.C. § 3541-3549, “Federal Information Security Management Act (FISMA) of 2002”

2. “Federal Information Security Modernization Act of 2014”

3. Federal Information Processing Standards (FIPS) Publication 140-2, “Security Requirements for Cryptographic Modules”

4. FIPS Pub 199. “Standards for Security Categorization of Federal Information and Information Systems,” February 2004

5. FIPS Pub 200, “Minimum Security Requirements for Federal Information and

Information Systems,” March 2006

6. 10 U.S.C. § 2224, "Defense Information Assurance Program"

7. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

8. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”

9. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, https://www.va.gov/vapubs/index.cfm

10. VA Handbook 0710, “Personnel Security and Suitability Program,” May 2, 2016, https://www.va.gov/vapubs/index.cfm https://www.va.gov/vapubs/index.cfm https://www.va.gov/vapubs/index.cfm http://www.va.gov/vapubs

11. VA Directive and Handbook 6102, “Internet/Intranet Services,” August 5,

12. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and Guidelines,” January 18, 2017

13. Office of Management and Budget (OMB) Circular A-130, “Managing Federal Information as a Strategic Resource,” July 28, 2016

14. ”

15. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended, January 18, 2017

16. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

17. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021

18. VA Handbook 6500, “Risk Management Framework for VA Information

Systems VA Information Security Program,” February 24, 2021

19. VA Handbook 6500.2, “Management of Breaches Involving Sensitive

Personal Information (SPI),” March 12, 2019

20. VA Handbook 6500.5, “Incorporating Security and Privacy into the System

Development Lifecycle,” March 22, 2010

21. VA Handbook 6500.6, “Contract Security,” March 12, 2010

22. VA Handbook 6500.8, “Information System Contingency Planning,” April 6,

23. VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018

24. VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017

25. VA Directive 6508, “Implementation of Privacy Threshold Analysis and

Privacy Impact Assessment,” October 15, 2014

26. VA Handbook 6508.1, “Procedures for Privacy Threshold Analysis and

Privacy Impact Assessment,” July 30, 2015

27. VA Directive and Handbook 6510, “VA Identity and Access Management,”

January 15, 2016

28. VA Directive and Handbook 6513, “Secure External Connections,” October

12, 2017

29. VA Directive 6300, “Records and Information Management,” September 21,

30. VA Handbook, 6300.1, “Records Management Procedures,“ March 24, 2010

31. NIST SP 800-37 Rev 2, “Risk Management Framework for Information

Systems and Organizations: A System Life Cycle Approach for Security and Privacy,” December 2018

32. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020)

33. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015

34. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-

12) Program,” March 24, 2014

35. OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005

36. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019

37. OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008

38. NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access,“ June 2018

39. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, “Digital Identity Guidelines,” updated March 02, 2020

40. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014

41. NIST SP 800-164, “Guidelines on Hardware-Rooted Security in Mobile

Devices (Draft),” October 2012

42. VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland

Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

43. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

44. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

45. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

46. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019

47. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008

48. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (Public Law 110–140), December 19, 2007

49. Section 104 of the Energy Policy Act of 2005, (Public Law 109–58), August 8, 2005

50. Executive Order 13834, “Efficient Federal Operations,” dated May 17, 2018

51. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August

2, 2001

52. VA Directive 0058, “VA Green Purchasing Program,” July 19, 2013

53. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote

Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

54. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

55. “Veteran Focused Integration Process (VIP) Guide 4.0,” January 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

56. VA Memorandum “Proper Use of Email and Other Messaging Services,”

January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

57. “DevSecOps Product Line Management Playbook” version 2.0, May 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

58. NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020 https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514 https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896 https://www.cisa.gov/publication/tic-30-core-guidance-documents https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371 https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

59. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol Version 6 (IPv6),” November 19, 2020

60. Social Security Number (SSN) Fraud Prevention Act of 2017

61. Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23,

62. H.R. 2429, VA Police Improvement and Accountability Act. June 16, 2021.

63. Office of Management and Budget (OMB) Memorandum 10-28, “Clarifying

Cybersecurity Responsibilities and Activities of the Executive Office of the President and the Department of Homeland Security”

64. NIST 800-88, “Guidelines for Media Sanitization,” December 2014

65. VA Directive 6008, “Acquisition and Management of VA Information

Technology Resources,” November 2, 2017

66. VA Directive 6512, “Secure Wireless Technology,” October 12, 2017

67. VA Directive/Handbook 6517, “Risk Management for Cloud Computing

Services,” November 15, 2016

68. VA Directive 6609, “Mailing of Sensitive Personal Information,” May 20, 2011

3.0 SCOPE OF WORK

The scope of this contract is for the Contractor to provide all supervision, management, and labor required for the services outlined in this PWS. This activity supports the use of approximately 4500 Body Worn Cameras, 600 in dash vehicle cameras, and shall be integrated with the Digital Evidence Management System (DEMS). Ancillary products include batteries, power cords, charging and data platform stations, kits, maintenance, software upgrades, and warranty of products.

The scope of this contract is to obtain a Digital Evidence Management System that is a one-turnkey solution with the ability functions and features capable of supporting the ongoing operations and activities of the Digital Evidence Management System These Software as a Service (SaaS) licenses shall be utilized nationally by VA Police personnel to support the capture, ingest, management, and secure sharing of digital evidence, to include but not limited to body worn camera video and dashcam captured from VA Police Officers authorized for use on federal property.

The objective of this procurement to provide the Veterans Affairs Police with an integrated car and body-worn camera video and audio platform that includes a Digital Evidence Management System which maintains the evidentiary value of the audio/video while providing a process to manage, redact and release the data efficiently.

4.0 PERFORMANCE DETAILS

4.1 PERFORMANCE PERIOD

The Government intends to award a single Indefinite Delivery Indefinite Quantity (IDIQ) type contract. The PoP shall be 12 months from date of award, with four 12-month option periods to include no optional tasks.

Any work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO).

PLACE OF PERFORMANCE

Tasks under this PWS shall be performed at VA facilities located nation-wide. The Government anticipates shipment of product to be ordered and sent to VA Facilities within the United States, followed by teleconference calls for customer engagement to support operations of equipment. Work may be performed at remote locations with prior concurrence from the Contracting Officer’s Representative (COR). The Contractor staff shall be available to coordinate with VA Office Chief of Police and the Director of Operations and Administration on normal Federal Government workdays and be responsive between the core hours of 9:00 a.m. and 5:00 p.m. Eastern Standard Time.

4.2 TRAVEL

The Government does not anticipate travel under this effort to perform the tasks associated with the effort.

5.0 SPECIFIC TASKS AND DELIVERABLES

Tasks performed shall be of a non-personal nature. VA organization will not provide supervision of Contractor personnel. Contractor personnel shall at no time allow an employer-employee relationship to develop with VA organization or their staff. VA organizations will refrain from any activity that creates the appearance of such a relationship.

Contractors shall not perform inherently government functions including decision making, supervision of Government employees, supervision of other contractors on other contracts, and activities that create the appearance of performing such functions.

Contractor personnel shall have the level of experience necessary to accomplish the requirement of this PWS with reference to personal and professional conduct, and in technical knowledge. Furthermore, Contractor personnel are expected to be proficient in using office automation equipment and software and sufficient written and verbal communication skills to support VA program offices, their customers and any other VA organization. Should any Contractor personnel be determined to be unacceptable in terms of technical competency or unacceptable conduct or behavior while on-site working on contract activities, the Contractor shall immediately remove and replace the unacceptable on-site personnel at no additional cost to the Government. Contractor personnel are to serve in a support role; therefore, final decisions regarding inherently governmental functions will always be made by Government personnel. The Contractor shall perform the following:

5.1 TECHNICAL KICK OFF MEETING

A technical kickoff meeting shall be held within 10 days after contract award. The Contractor shall coordinate the date, time, and location (can be virtual) with the Contracting Officer’s Representative (COR), as the Post-Award Conference Chairperson, the VA PM, as the Co-Chairperson, the Contract Specialist (CS), and the

COR. The Contractor shall provide a draft agenda to the CO and COR at least five (5) calendar days prior to the meeting. Upon Government approval of a final agenda, the Contractor shall distribute to all meeting attendees. At the conclusion of the meeting, the Contractor shall update the presentation with a final slide entitled “Summary Report” which shall include notes on Action Items and, any major issues, agreements, or disagreements discussed during the kickoff meeting, attendance roster, Strategic Vision & Approach Plan, and the following statement “As the Post-Award Conference Chairperson, I have reviewed the entirety of this presentation and assert that it is an accurate representation and summary of the discussions held during the Technical Kickoff Meeting for the VA Body Worn Cameras and Digital Evidence Management System and in dash vehicle cameras. The Contractor shall submit the final updated presentation to the COR for review and signature within three (3) calendar days after the meeting. The Contractor shall work with the government Task Leads, to ensure the contractor has accurately captured the salient points from the kickoff meeting. Once collaboration with Government Task Leads are complete, the contractor shall prepare the meeting minutes for acceptance by the COR/PM. prior to distribution of the meeting minutes to the COR, PM, and the all attendees within three (3) calendar days after the meeting.

Deliverable:

A. Final Kickoff Presentation

5.2 REQUIREMENTS

1. The solution shall provide sufficient safeguards to ensure evidentiary integrity of the captured video and confirm valid receipt by the repository of the entire video before deleting original from the in-vehicle and body-worn system.

2. The system must have a role-based security model to control user access to features and data throughout the system.

3. The systems security model must provide a method to easily limit access to sensitive case information and people related to confidential cases.

4. The Contractor’s cameras must support a minimum quality of 720p for body-worn cameras, 720p for front and rear in-vehicle camera s and 480p for the backseat camera.

The Contractor’s solution must include body-worn cameras that are integrated with the in-vehicle camera solution.

5. The Contractor’s solution must capture audio within the vehicle and the body-worn camera must have a remote microphone to record audio interaction outside of vehicle.

6. The Contractor must host and maintain the Digital Evidence Management System in a secure cloud hosting environment providing all necessary hardware, software, system and database administration to manage the application including all test, training and production environments of the system.

7. Contractor shall provide documentation of FedRAMP compliance approval by solicitation due date.

5.2.1.1 REQUIREMENT FOR VIDEO CAMERAS:

1. High-definition Dual-View Camera with panoramic field of view, 12x zoom, and AI processing for automatic license plate reader (ALPR)

2. High-definition Interior Camera with infrared illumination for back seat view in complete darkness

3. Wireless Mic and Charging Base for capturing audio when outside of vehicle

4. Police vehicle connectivity, global navigation satellite system (GNSS), secure solid- state storage, and Signal inputs

5. Automatic transition from Buffering to Event mode with configurable Signals

6. Video Recall records last 24 hours of each camera in case camera not activated for an event

7. Mobile data terminal app, for controlling system, reviewing video, quick tagging, and more

8. Efficiently categorize, play back and share all video and audio alongside other digital files on management system database

9. Multi-cam playback, for reviewing up to four videos, including body-worn and in-car footage, at the same time

10. Fully integrated with management system and other recording devices

11. Automatic time synchronization with all Fleet (police vehicles)and other on-officer cameras allows for multi-camera playback on management database system.

12. Prioritized upload to management system of critical event videos via a minimum of 4G/LTE

13. Support install times, wireless updates, and quick remote troubleshooting

14. live stream, alerts, and location updates for situational awareness

15. ALPR hotlist alerts, plate read retention, and investigative search

5.2.1.2 REQUIRMENT FOR POLICE OFFICER BODY WORN CAMERA:

1. Video quality with reduced motion blur and better low-light performance

2. Multi-mic audio—four built-in microphones

3. Wireless upload option

4. Gunshot detection and alerts

5. Streaming audio and video capability

6. “Find my camera” feature

7. Verbal transcription

8. End-to-end encryption

9. Minimum Twelve-hour battery

10. Up to 120-second buffering period to record footage before pressing record button

5.2.1.3 REQUIRMENT FOR CLOUD SERVICE OF DIGITAL EVIDENCE

MANAGEMENT SYSTEM

1. Is a current Criminal Justice Information Services (CJIS)/FedRAMP JAB Provisional

2. Authority to Operate (P-ATO) Authorized SaaS solution with an Authority to Operate

3. (ATO) rated for impact level moderate/high certified and authorized product

4. Is a turnkey solution that allows for secure management, access, and sharing of digital evidence

5. Provides VA wide enterprise licensing permitting unlimited usage

6. Can accept and provide media in all forms (.jpeg, .pdf, etc.)

7. Provides a secure method for requesting and receiving digital content from U.S.

Citizens

8. Shall provide redaction capabilities powered by Artificial Intelligence (AI).

9. Stores and supports various forms of third-party data ingests evidence collected from mobile phone application,

10. Allows secure case sharing with current partner agencies as well as the

Executive Office of United States Attorneys (EOUSA) or States Attorney

11. Provides a minimum of 2.5 petabytes of storage (10GB per 250,000)

12. Is a SaaS model that reduces security and administration by local IT staff: no local installation required

13. Contractor shall provide automatic, timely security upgrades and enhancements deployed to application without the need for any local IT staff involvement

14. Controls access to evidence based on pre-defined roles and permissions and predefined individuals

15. Will have a password authentication system:

16. Password complexity, IP-based access restrictions, single sign-on, and multi-factor authentication support

17. Contractor shall have an automated category-based evidence retention policies assists with efficient database management in accordance with Federal Records rules of retention

18. Able to recover deleted evidence within seven days of deletion to ensure retention of evidence

19. Requires NO proprietary file formats avoiding additional cost

20. Able to upload files directly from the computer to DEMS via an Internet

21. Browser desktop-based application

22. Fault- and disaster-tolerant infrastructure

23. Has chain-of custody capabilities: Audit logs automatically track all system and user activity. These logs cannot be edited or deleted, even by account administrators and IT staff to assist in chain of custody for case prosecution

24. Contractor shall have a dedicated information security department that protects the DEMS and data with security monitoring, centralized event log analysis and correlation, advanced threat and intrusion protection, and incident response capabilities

25. Provide enterprise licensing capable of supporting up to 5000 users

26. Training: provide initial training in-person and as required technical support in system upgrades.

5.2.1.4 REQUIRMENTS of AES ENCRYPTION FOR DATA STORAGE

1. Security Testing: Independent security firms perform in-depth security and penetration testing

2. Reliability: Fault- and disaster-tolerant infrastructure in at least 4 redundant data centers in both the East and West regions of the United States

3. Chain-of-Custody: Audit logs automatically track all system and user activity.

These logs cannot be edited or deleted, even by account administrators and IT staff

4. Protection: With no on-site application, critical evidence stored in Evidence is protected from local malware that may penetrate agency infrastructure security program

5. Application and data protected by a CJIS and ISO 27001 compliant information security program

6. Dedicated information security department that protects evidence management system and data with security monitoring, centralized event log analysis and correlation, advanced threat, and intrusion protection, and incident response capabilities

7. Redact videos easily within the system, create tags, markers, and clips, search 7 fields in addition to 5 category-based fields, create cases for multiple evidence files.

5.3 FEDERAL RISK AND AUTHOTIZATION MANAGEMENT PROGRAM

The Federal Risk and Authorization Management Program (FedRAMP) is an innovate policy approach to develop trusted relationships between Executive departments and agencies and cloud service providers (CSPs). FedRAMP reduces duplicative efforts, inconsistencies and cost efficiencies associated with current security authorization process. FedRAMP establishes a public-private partnership to promote innovative and the advancement of more secure information technologies. FedRAMP will enable the Federal Government to accelerate the adoption of cloud computing by creating transparent standards and processes for security authorizations and allowing agencies to leverage security authorizations on a government-wide scale.

The Contractor shall be compliant. The Contract shall be FedRamp compliant category Moderate /High.

5.4 VA DATA

ASSESSMENT, AUTHORIZATION, AND CONTINOUS MONITORING

1. The information system solution selected by the Contractor shall comply with the

Federal Information Security Management Act (FISMA)

2. The Contractor shall comply with FedRAMP requirements as mandated by Federal laws and policies, including making available any documentation, physical access, and logical access needed to support this requirement

3. The Contractor shall, where applicable, assist the VA to achieve Authority To Operate (ATO) of the cloud service or migrated application.

4. The Contractor shall provide an Incident Response Plan (IRP) scenario within 14 days and complete Table-Top exercise within 21 days of award unless current VA IRP can be provided

5. The Contractor shall provide a System Boundary Diagram that demonstrates implementation and any proposed VA interconnections including required ports and protocols at the time award

6. The Contractor shall complete a FedRAMP System Security Plan (SSP) and supporting documentation at the time of award

7. The Contractor shall complete a Third-Party Assessment Organization (3PAO) Security Assessment Plan (SAP) at the time of award

8. The Contractor shall complete a 3PAO Security Assessment Report (SAR) at the time of award

9. The Contractor shall afford VA access to the Contractor’s and CSP facilities, installations, technical capabilities, operations, documentation, records, and databases

10. If new or unanticipated threats or hazards are discovered by either VA or the Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party in accordance with the security addendum B

11.The Contractor shall not release any data without the consent of VA in writing. All requests for release must be submitted in writing to the Contracting Officer’s Representative (COR)/Contracting Officer (CO)

12. In order for live VA data to be used in this system, a FedRAMP Authorization and Agency ATO will be required

Deliverables:

A. System Boundary Diagram B. FedRAMP System Security Plan (SSP) and supporting documentation C. 3PAO Security Assessment Plan (SAP) D. 3PAO Security Assessment Report (SAR)

6.0 GENERAL REQUIREMENTS

6.1 ENTERPRISE AND IT FRAMEWORK

6.1.1 VA TECHNICAL REFERENCE MODEL

The Contractor shall support the VA enterprise management framework. In association with the framework, the Contractor shall comply with OIT Technical Reference Model (VA TRM). The VA TRM is one component within the overall Enterprise Architecture (EA) that establishes a common vocabulary and structure for describing the information technology used to develop, operate, and maintain enterprise applications. Moreover, the VA TRM, which includes the Standards Profile and Product List, serves as a technology roadmap and tool for supporting OIT. Architecture & Engineering Services (AES) has overall responsibility for the VA TRM.

7.0 INTERNET PROTOCOL VERSION 6 (IPV6)

The Contractor shall support Internet Protocol Version 6 (IPv6) based upon the memo issued by the Office of Management and Budget (OMB) on November 19, 2020 (https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-07.pdf). IPv6 technology, in accordance with the USGv6 Program (https://www.nist.gov/programs-projects/usgv6-program/usgv6-revision-1), NIST Special Publication (SP) 500-267B Revision 1 “USGv6 Profile” (https://doi.org/10.6028/NIST.SP.500-267Br1), and NIST SP 800-119 “Guidelines for the Secure Deployment of IPv6” (https://doi.org/10.6028/NIST.SP.800-119), compliance shall be included in all IT infrastructures, application designs, application development, operational systems and sub-systems, and their integration. In addition to the above requirements, all devices shall support native IPv6 and dual stack (IPv6 / IPv4) connectivity without additional memory or other resources being provided by the Government, so that they can function in a mixed environment. All public/external facing servers and services (e.g.

web, email, DNS, ISP services, etc.) shall support native IPv6 and dual stack (IPv6 / IPv4) users and all internal infrastructure and applications shall communicate using native IPv6 and dual stack (IPv6 / IPv4) operations.

7.1.1 TRUSTED INTERNET CONNECTION (TIC)

The Contractor solution shall meet the requirements outlined in Office of Management and Budget Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative“ (https://www.whitehouse.gov/wp-content/uploads/2019/09/M-19-26.pdf), VA Directive 6513 “Secure External Connections”, and shall comply with the TIC 3.0 Core Guidance Documents, including all Volumes and TIC Use Cases, found at the Cybersecurity & Infrastructure Security Agency (CISA) (https://www.cisa.gov/publication/tic-30-core-guidance-documents). Any deviations must be approved by the VA TIC 3.0 Working Group at vaoisesatic30team@va.gov.

7.1.2 STANDARD COMPUTER CONFIGURATION

The Contractor IT end user solution that is developed for use on standard VA computers shall be compatible with and be supported on the standard VA operating system, currently Windows 10 (64bit), Edge (Chromium based), and 365 Apps for enterprise. Applications delivered to VA and intended to be deployed to Windows 10 workstations shall be delivered as a signed .msi package with switches for silent and unattended installation and updates shall be delivered in signed .msp file formats for easy deployment using Microsoft Endpoint Configuration Manager (CM) VA’s current desktop application deployment tool. Signing of the software code shall be through a contractor provided certificate that is trusted by VA using a code signing authority such as Verizon/Cybertrust or Symantec/VeriSign. The Contractor shall also ensure and certify that their solution functions as expected when used from a standard VA computer, with non-admin, standard user rights that have been configured using the United States Government Configuration Baseline (USGCB) and Defense Information https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-07.pdf file://///R04.med.va.gov/V03/EAS/Users/vhaeasWymbsk/TEMPLATES--NEW%20TAC%20PROCESS/PWS%20TEMPLATE%20(DO%20NOT%20TOUCH)%20-%20In%20Process%20Revisions/DO%20NOT%20TOUCH%20(next%20version/IPv6/(https:/www.nist.gov/programs-projects/usgv6-program/usgv6-revision-1 file://///R04.med.va.gov/V03/EAS/Users/vhaeasWymbsk/TEMPLATES--NEW%20TAC%20PROCESS/PWS%20TEMPLATE%20(DO%20NOT%20TOUCH)%20-%20In%20Process%20Revisions/DO%20NOT%20TOUCH%20(next%20version/IPv6/(https:/www.nist.gov/programs-projects/usgv6-program/usgv6-revision-1 https://doi.org/10.6028/NIST.SP.500-267Br1 https://doi.org/10.6028/NIST.SP.800-119 https://www.whitehouse.gov/wp-content/uploads/2019/09/M-19-26.pdf https://www.cisa.gov/publication/tic-30-core-guidance-documents mailto:vaoisesatic30team@va.gov

Systems Agency (DISA) Secure Technical Implementation Guide (STIG) specific to the particular client operating system being used.

7.1.3 VETERAN FOCUSED INTEGRATION PROCESS (VIP) AND PRODUCT LINE

MANAGEMENT (PLM)

The Contractor shall support VA efforts IAW the updated Veteran Focused Integration Process (VIP) and Product Line Management (PLM). The major focus of the new VIP is on Governance and Reporting and is less prescriptive, with a focus on outcomes and continuous delivery of value. Product Line Management (PLM) is a framework that focuses on delivering functional products that provide the highest priority work to customers while delivering simplified, reliable, and practical solutions to the business, medical staff, and our Veterans. The VIP Guide is a companion guide to the PLM Playbook and can be found at:

https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371 and the PLM Playbook can be found at https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946. The PLM Playbook pivots from project-centric to product-centric delivery and contains descriptive practices that focuses on outcomes. The PLM Playbook contains a set of “plays” that implement Development, Security, and Operations (DevSecOps) principles and processes such as automated development, continuous integration/continuous delivery, and release on demand. The PLM Playbook details how product lines implement Lean-Agile principles, methods, practices, and techniques through levels of maturity. VIP and PLM are the authoritative processes that IT projects must follow to ensure development and delivery of IT products.

7.1.4 PROCESS ASSET LIBRARY (PAL)

The Contractor shall perform their duties consistent with the processes defined in the OIT Process Asset Library (PAL). The PAL scope includes the full spectrum of OIT functions and activities, such as VIP project management, operations, service delivery, communications, acquisition, and resource management. PAL serves as an authoritative and informative repository of searchable processes, activities or tasks, roles, artifacts, tools and applicable standards and guides to assist the OIT workforce, Government and Contractor personnel. The Contractor shall follow the PAL processes to ensure compliance with policies and regulations and to meet VA quality standards.

The PAL includes the contractor onboarding process consistent with Section 6.2.2 and can be found at https://www.va.gov/PROCESS/artifacts/maps/process_CONB_ext.pdf.

The main PAL can be accessed at www.va.gov/process.

7.1.5 AUTHORITATIVE DATA SOURCES

The VA Enterprise Architecture Repository (VEAR) is one component within the overall EA that establishes the common framework for data taxonomy for describing the data architecture used to develop, operate, and maintain enterprise applications. The Contractor shall comply with the department’s Authoritative Data Source (ADS) requirement that VA systems, services, and processes throughout the enterprise shall https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946 https://www.va.gov/PROCESS/artifacts/maps/process_CONB_ext.pdf http://www.va.gov/process access VA data solely through official VA ADSs where applicable, see below. The Information Classes which compose each ADS are located in the VEAR, in the Data & Information domain. The Contractor shall ensure that all delivered applications and system solutions support:

1. Interfacing with VA’s Master Person Index (MPI) (formerly the Master Veteran Index (MVI)) to provision identity attributes, if the solution relies on VA user identities. MPI is the authoritative source for VA user identity data.

2. Interfacing with Capital Asset Inventory (CAI) to conduct real property record management actions, if the solution relies on real property records data. CAI is the authoritative source for VA real property record management data.

3. Interfacing with electronic Contract Management System (eCMS) for access to contract, contract line item, purchase requisition, offering contractor and contractor, and solicitation information above the micro-purchase threshold, if the solution relies on procurement data. ECMS is the authoritative source for VA procurement actions data.

4. Interfacing with HRSmart Human Resources Information System to conduct personnel action processing, on-boarding, benefits management, and compensation management, if the solution relies on personnel data. HRSmart is the authoritative source for VA personnel information data.

5. Interfacing with Vet360 to access personal contact information, if the solution relies on VA Veteran personal contact information data. Vet360 is the authoritative source for VA Veteran Personal Contact Data.

6. Interfacing with VA/Department of Defense (DoD) Identity Repository (VADIR) for determining eligibility for VA benefits under Title 38, if the solution relies on qualifying Active-Duty military service data. VADIR is the authoritative source for Qualifying Active-Duty military service in VA.

7.1.6 SOCIAL SECURITY NUMBER (SSN) REDUCTION

The Contractor solution shall support the Social Security Number (SSN) Fraud Prevention Act (FPA) of 2017 which prohibits the inclusion of SSNs on any document sent by mail. The Contractor support shall also be performed in accordance with Section 240 of the Consolidated Appropriations Act (CAA) 2018, enacted March 23, 2018, which mandates VA to discontinue using SSNs to identify individuals in all VA information systems as the Primary Identifier. The Contractor shall ensure that any new IT solution discontinues the use of SSN as the Primary Identifier to replace the SSN with the ICN in all VA information systems for all individuals. The Contractor shall ensure that all Contractor delivered applications and systems integrate with the VA Master Person Index (MPI) for identity traits to include the use of the ICN as the Primary Identifier. The Contractor solution may only use a Social Security Number to identify an individual in an information system if and only if the use of such number is required to obtain information VA requires from an information system that is not under the jurisdiction of VA.

7.2 METHOD AND DISTRIBUTION OF DELIVERABLES

The Contractor shall deliver documentation in electronic format, unless otherwise directed in Section B of the solicitation/contract. Acceptable electronic media include:

Microsoft 365, MS Word 2000/2003/2007/2010/2019, MS Excel 2000/2003/2007/2010/2019, MS PowerPoint 2000/2003/2007/2010/2019, MS Project 2000/2003/2007/2010/2019, MS Access 2000/2003/2007/2010, MS Visio 2000/2002/2003/2007/2010/2019, AutoCAD 2002/2004/2007/2010, and Adobe Postscript Data Format (PDF).

7.3 PERFORMANCE METRICS

The table below defines the Performance Standards and Acceptable Levels of Performance associated with this effort.

Performance Objective

Performance Standard Acceptable Levels of Performance

A. Technical / Quality of Product

1. Meets technical needs and mission requirements

2. Provides quality services/products

Product is operable 99% of the workday

B. Project Milestones and Schedule

1. Established milestones and project dates are met

2. Products completed, reviewed, delivered in accordance with the established schedule

3. Notifies customer in advance of potential problems

Product deliveries are provided with an on-time delivery rate of 95%

The COR will utilize a Quality Assurance Surveillance Plan (QASP) throughout the life of the contract to ensure that the Contractor is performing the services required by this PWS in an acceptable level of performance. The Government reserves the right to alter or change the surveillance methods in the QASP at its own discretion. A Performance Based Service Assessment will be used by the COR in accordance with the QASP to assess Contractor performance.

7.4 FACILITY/RESOURCE PROVISIONS

The Government will provide office space, telephone service, and system access when authorized contract staff work at a government location as required in order to accomplish the Tasks associated with this PWS. All procedural guides, reference materials, and program documentation for the project and other Government applications will also be provided on an as-needed basis.

The Contractor shall request other Government documentation deemed pertinent to the work accomplishment directly from the Government officials with whom the Contractor has contact. The Contractor shall consider the COR as the final source for needed Government documentation when the Contractor fails to secure the documents by other means. The Contractor is expected to use common knowledge and resourcefulness in securing all other reference materials, standard industry publications, and related materials that are pertinent to the work.

VA may provide remote access to VA specific systems/network in accordance with VA Handbook 6500, which requires the use of a VA approved method to connect external equipment/systems to VA’s network. Citrix Access Gateway (CAG) is the current and only VA approved method for remote access users when using or manipulating VA information for official VA Business. VA permits CAG remote access through approved Personally Owned Equipment (POE) and Other Equipment (OE) provided the equipment meets all applicable 6500 Handbook requirements for POE/OE. All of the security controls required for Government furnished equipment (GFE) must be utilized in approved POE or OE. The Contractor shall provide proof to the COR for review and approval that their POE or OE meets the VA Handbook 6500 requirements and VA Handbook 6500.6 Appendix C, herein incorporated as Addendum B, before use. CAG authorized users shall not be permitted to copy, print, or save any VA information accessed via CAG at any time. VA prohibits remote access to VA’s network from non- North Atlantic Treaty Organization (NATO) countries. The exception to this are countries where VA has approved operations established (e.g. Philippines and South Korea).

Exceptions are determined by the COR in coordination with the Information Security Officer (ISO) and Privacy Officer (PO).

The Contractor shall not transmit, store, or otherwise maintain sensitive data or products in Contractor systems (or media) within the VA firewall IAW VA Handbook

6500.6 dated March 12, 2010. All VA sensitive information shall be protected at all times in accordance with VA Handbook 6500, local security field office System Security Plans (SSP’s) and Authority to Operate (ATO)’s for all systems/LAN’s accessed while performing the tasks detailed in this PWS. The Contractor shall ensure all work is performed in countries deemed not to pose a significant security risk. For detailed Security and Privacy Requirements (additional requirements of the contract consolidated into an addendum for easy reference) refer to ADDENDUM A – ADDITIONAL VA REQUIREMENTS, CONSOLIDATED and ADDENDUM B - VA

INFORMATION AND INFORMATION SYSTEM SECURITY/PRIVACY LANGUAGE.

7.5 GOVERNMENT FURNISHED PROPERTY

7.5.1 Non-Applicable

7.6 SHIPMENT OF HARDWARE OR EQUIPMENT

National Acquisitions

In accordance with the IT Asset Management (ITAM) PAL Process ITAM-02.01.01 Notify Logistics of Pending Shipment, for National Acquisitions, the “Master Delivery Schedule” must be completed by the VA PM (the Government portion as indicated within the Master Delivery Schedule Instructions) as it will become an attachment within the PWS. The PM must also add the contract deliverables specified in the below text to the Schedule for Deliverables table in the PWS. This Master Delivery Schedule will be updated by the Contractor and provided at delivery. See the Master Delivery Schedule Template within the PAL ITAM Process at http://vaww.oed.wss.va.gov/process/Library/master_delivery_schedule_template.xlsx.

All questions related to these instructions and the Master Delivery Schedule template/process shall be directed to the VA ITAAG and VA ITAAG RILOS distribution list in the Global Address List (GAL). For all equipment buys, ensure that this group is consulted to ensure proper cataloging of equipment early on in the planning stages of the procurement.

The Contractor shall complete the Master Delivery Schedule in accordance with the Instructions and shall coordinate with the COR for specifics. The Master Delivery Schedule shall be provided after award and updated prior to and after each delivery timeframe.

Shipment/Delivery Kick-off Meeting

The Contractor shall conduct a Shipment/Delivery Kick-off Meeting with the VA PM, COR, Delivery Date Coordinator, Implementation Manager, and Facility CIOs (or designee) to discuss delivery schedule requirements and facilitate delivery of equipment. This meeting may be held in conjunction with the post award conference or identified technical kickoff meeting. The Contractor shall also present the Shipment/Delivery Progress Report format for review and approval by the Government.

This meeting, if held independently, shall be conducted telephonically within ten days after award and shall incorporate any delivery schedule changes to the draft Delivery Schedule identified by the Government.

The Contractor shall provide a Shipment/Delivery Progress Report which shall identify the items shipped, the serial number associated with each piece of equipment; the date of each shipment; the status of each shipment, tracking information, and information relative to Government-receipt of the equipment items at each delivery site. In addition, the Shipment/Delivery Progress Report shall identify any problems and provide a description of how the problems were resolved/addressed. If problems have not been completely resolved, the Contractor shall provide an explanation and status of resolution. Shipment/Delivery y Progress Reports shall be submitted in Microsoft Excel Format and shall clearly identify each serial number of the equipment being delivered with one (1) serial number per cell.

Packing Slips/Labels and Lists shall also include the following:

http://vaww.oed.wss.va.gov/process/Library/master_delivery_schedule_template.xlsx

IFCAP PO #: ____________ (e.g., 166-E11234 (the IFCAP PO number is located in block #20 of the SF 1449)) Project Description: (e.g. Tier 1 Lifecycle Refresh) Total number of Containers: Package ___ of ___. (e.g., Package 1 of 3)

Deliverables:

A. Master Delivery Schedule

ADDENDUM A – ADDITIONAL VA REQUIREMENTS, CONSOLIDATED

A1.0 Cyber and Information Security Requirements for VA IT Services The Contractor shall ensure adequate LAN/Internet, data, information, and system security in accordance with VA standard operating procedures and standard PWS language, conditions, laws, and regulations. The Contractor’s firewall and web server shall meet or exceed VA minimum requirements for security. All VA data shall be protected behind an approved firewall. Any security violations or attempted violations shall be reported to the VA Program Manager and VA Information Security Officer as soon as possible. The Contractor shall follow all applicable VA policies and procedures governing information security, especially those that pertain to assessment and authorization and continuous monitoring

Contractor supplied equipment, PCs of all types, equipment with hard drives, etc. for contract services must meet all security requirements that apply to Government Furnished Equipment (GFE) and Government Owned Equipment (GOE). Security Requirements include: a) VA Approved Encryption Software must be installed on all laptops or mobile devices before placed into operation, b) Bluetooth equipped devices are prohibited within VA; Bluetooth must be permanently disabled or removed from the device, unless the connection uses FIPS 140-2 (or its successor) validated encryption,

c) VA approved anti-virus and firewall software, d) Equipment must meet all VA sanitization requirements and procedures before disposal. The COR, CO, the PM, and the Information Security Officer (ISO) must be notified and verify all security requirements have been adhered to.

Each documented initiative under this contract incorporates VA Handbook 6500.6, “Contract Security,” March 12, 2010, by reference as though fully set forth therein. The VA Handbook 6500.6, “Contract Security” shall also be included in every related agreement, contract, or order. The VA Handbook 6500.6, Appendix C, is included in this document as Addendum B.

A2.0 VA Enterprise Architecture Compliance The applications, supplies, and services furnished under this contract must comply with VA Enterprise Architecture (EA), available at http://www.ea.oit.va.gov/index.asp in force at the time of issuance of this contract, including the Program Management Plan and VA's rules, standards, and guidelines in the Technical Reference Model/Standards Profile (TRMSP). VA reserves the right to assess contract deliverables for EA compliance prior to acceptance.

A2.1. VA Internet and Intranet Standards

The Contractor shall adhere to and comply with VA Directive 6102 and VA Handbook 6102, Internet/Intranet Services, including applicable amendments and changes, if the Contractor’s work includes managing, maintaining, establishing, and presenting information on VA’s Internet/Intranet Service Sites. This pertains, but is not limited to:

http://www.ea.oit.va.gov/index.asp creating announcements; collecting information; databases to be accessed, graphics and links to external sites.

Internet/Intranet Services Directive 6102 is posted at (copy and paste the following URL to browser): https://www.va.gov/vapubs/viewPublication.asp?Pub_ID=1056&FType=2

Internet/Intranet Services Handbook 6102 is posted at (copy and paste following URL to browser): https://www.va.gov/vapubs/viewPublication.asp?Pub_ID=1055&FType=2

A3.0 Notice of the Federal Accessibility Law Affecting All Information and Communication Technology (ICT) Procurements (Section 508)

(Three standards listed in Section A3.1 below [E205 Electronic Content – (Accessibility Standard -WCAG 2.0 Level A and AA Guidelines), E204 Functional Performance Criteria, and E208 Support Documentation and Services] always apply to the evaluation of ICT and should remain marked as “x”. The requiring activity should un-mark any of the other remaining standards below [E206 and/or E207] that do not apply to this effort.

The Accessibility Requirements Tool (ART) is a web-based application that will help the requiring activity determine the Section 508 standards that apply to their specific acquisition. The ART tool is located at https://app.buyaccessible.gov/home.)

On January 18, 2017, the Architectural and Transportation Barriers Compliance Board (Access Board) revised and updated, in a single rulemaking, standards for electronic and information technology developed, procured, maintained, or used by Federal agencies covered by Section 508 of the Rehabilitation Act of 1973, as well as our guidelines for telecommunications equipment and customer premises equipment covered by Section 255 of the Communications Act of 1934. The revisions and updates to the Section 508-based standards and Section 255-based guidelines are intended to ensure that information and communication technology (ICT) covered by the respective statutes is accessible to and usable by individuals with disabilities.

A3.1. Section 508 – Information and Communication Technology (ICT) Standards

The Section 508 standards established by the Access Board are incorporated into, and made part of all VA orders, solicitations and purchase orders developed to procure ICT.

These standards are found in their entirety at: https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines. A printed copy of the standards will be supplied upon request.

Federal agencies must comply with the updated Section 508…