36C24120R0006 RFP Amendment 1 8-4-20.pdf

PAGE 1 OF 1. REQUISITION NO.

2. CONTRACT NO. 3. AWARD/EFFECTIVE DATE 4. ORDER NO. 5. SOLICITATION NUMBER 6. SOLICITATION ISSUE DATE

a. NAME b. TELEPHONE NO. (No Collect Calls) 8. OFFER DUE DATE/LOCAL

TIME

9. ISSUED BY CODE 10. THIS ACQUISITION IS UNRESTRICTED OR SET ASIDE: % FOR:

SMALL BUSINESS

HUBZONE SMALL

BUSINESS

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

WOMEN-OWNED SMALL BUSINESS

(WOSB) ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

EDWOSB

8(A)

NAICS:

SIZE STANDARD:

11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

SEE SCHEDULE

12. DISCOUNT TERMS

13a. THIS CONTRACT IS A

RATED ORDER UNDER

DPAS (15 CFR 700)

13b. RATING

14. METHOD OF SOLICITATION

RFQ IFB RFP

15. DELIVER TO CODE 16. ADMINISTERED BY CODE

17a. CONTRACTOR/OFFEROR CODE FACILITY CODE 18a. PAYMENT WILL BE MADE BY CODE

TELEPHONE NO. DUNS: DUNS+4:

PHONE: FAX:

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN OFFER

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK BELOW IS CHECKED

SEE ADDENDUM

19. 20. 21. 22. 23. 24.

ITEM NO. SCHEDULE OF SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

(Use Reverse and/or Attach Additional Sheets as Necessary)

25. ACCOUNTING AND APPROPRIATION DATA 26. TOTAL AWARD AMOUNT (For Govt. Use Only)

27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1, 52.212-4. FAR 52.212-3 AND 52.212-5 ARE ATTACHED. ADDENDA ARE ARE NOT ATTACHED.

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA ARE ARE NOT ATTACHED

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN _______________ 29. AWARD OF CONTRACT: REF. ___________________________________ OFFER COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND DATED ________________________________. YOUR OFFER ON SOLICITATION DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY (BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED SET FORTH HEREIN IS ACCEPTED AS TO ITEMS:

30a. SIGNATURE OF OFFEROR/CONTRACTOR 31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER)

30b. NAME AND TITLE OF SIGNER (TYPE OR PRINT) 30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER (TYPE OR PRINT) 31c. DATE SIGNED

AUTHORIZED FOR LOCAL REPRODUCTION (REV. 2/2012)

PREVIOUS EDITION IS NOT USABLE Prescribed by GSA - FAR (48 CFR) 53.212

7. FOR SOLICITATION

INFORMATION CALL:

STANDARD FORM 1449

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 30

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS 95

36C24120R0006 Amendment1 07-29-2020

John D. Harris 802.295.9363 x5175 08-14-2020

90C Department of Veterans Affairs Network Contracting Office 1 (NE) White River Junction VAMC 215 North Main Street White River Junction VT 05009-0001 x

541513

$30 Million

N/A

X

Department of Veterans Affairs 9 locations (see Table 1 in PWS)

90C

Network Contracting Office 1 (NE) White River Junction VAMC 215 North Main Street White River Junction VT 05009-0001

All Invoices from the Contractor shall be submitted electronically as per VAAR Clause 852.232-72 Electronic Submission of Payment Request http://www.fsc.va.gov/einvoice.asp

877-353-9791

See CONTINUATION Page

This solicitation is a request for proposal (RFP) for RTLS maintenance and operation services and supplies.

The government intends to award a single-award, 4-year IDIQ Applying firm-fixed price Task Orders to order needed items.

Contractor shall provide all necessary personnel, supervision, labor, equipment, materials and disposal needed to provide the items at locations indicated on Table 1 in the PWS.

Quotes should carefully follow instructions included in 52.212-1 and evaluation criteria in 52.212-2.

Pricing should be identified in the Price/Cost Schedule.

Wage Determinations apply per serviced locations:

2015-4114 R#16 5-14-20; 2015-4010 R#13 12-23-19; 2015-4025 R#14 4-08-20; 2015-4081 R#13 4-10-20; 2015-4084 R#14 4-13-20 ; 2015-4186 R#15 4-20-20.

All proposals shall be emailed to john.harris405@va.gov.

Any proposal not compliant with the RFP will not be considered.

$0.00 x X

X 1

36C24120R0006

Table of Contents

SECTION A

A.1 SF 1449 SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

SECTION B - CONTINUATION OF SF 1449 BLOCKS

B.1 CONTRACT ADMINISTRATION DATA

B.2 PERFORMANCE WORK STATEMENT (PWS)

1.0 BACKGROUND

2.0 APPLICABLE DOCUMENTS

3.0 SCOPE OF WORK

4.0 PERFORMANCE DETAILS

4.1 PERFORMANCE PERIOD

4.2 PLACE OF PERFORMANCE

4.3 TRAVEL OR SPECIAL REQUIREMENTS

5.0 SYSTEM ARCHITECTURE OVERVIEW

5.1 RTLS SUSTAINMENT EFFORT

5.2 TECHNICAL EXPERTISE

6.0 SPECIFIC TASKS AND DELIVERABLES

6.1 PROJECT MANAGEMENT

6.1.1 REPORTING REQUIREMENTS

6.1.2 TECHNICAL KICKOFF MEETING

6.1.3 WEEKLY STATUS MEETING

6.2 PREVENTIVE MAINTENANCE

6.2.1 SOFTWARE UPDATES, UPGRADES AND ADMINISTRATION

6.2.2 HARDWARE UPDATES AND UPGRADES

6.3 CORRECTIVE MAINTENANCE

6.4 ADAPTIVE MAINTENANCE

6.5 CUSTOMER SUPPORT

7.0 GOVERNMENT FURNISHED EQUIPMENT

8.0 POSITION/TASK RISK DESIGNATION LEVEL(S)

9.0 GENERAL SECURITY REQUIREMENTS

9.1 INFORMATION SECURITY, PRIVACY AND RECORDS MANAGEMENT

9.1.1 Access to VA Information and VA Information Systems

9.1.2 VA Information Custodial Language

9.1.3 Security Incident Investigation

9.1.4 Information System Maintenance

9.1.5 Liquidated Damages for Data Breach

9.1.6 Security Controls Compliance Testing

9.1.7 Security and Privacy Awareness Training

9.2 PERFORMANCE METRICS

B.3 PRICE/COST SCHEDULE

SECTION C - CONTRACT CLAUSES

C.1 52.252-2 CLAUSES INCORPORATED BY REFERENCE (FEB 1998)

C.2 52.216-18 ORDERING (OCT 1995)

C.3 52.216-19 ORDER LIMITATIONS (OCT 1995)

C.4 52.216-22 INDEFINITE QUANTITY (OCT 1995)

C.5 SUPPLEMENTAL INSURANCE REQUIREMENTS

C.6 52.237-2 PROTECTION OF GOVERNMENT BUILDINGS, EQUIPMENT, AND

VEGETATION (APR 1984)

C.7 VAAR 852.212-70 PROVISIONS AND CLAUSES APPLICABLE TO VA

ACQUISITION OF COMMERCIAL ITEMS (APR 2020)

C.8 VAAR 852.219-74 LIMITATIONS ON SUBCONTRACTING—MONITORING AND

COMPLIANCE (JUL 2018)

C.9 VAAR 852.237-70 INDEMNIFICATION AND MEDICAL LIABILITY INSURANCE

(OCT 2019)

C.10 52.212-5 CONTRACT TERMS AND CONDITIONS REQUIRED TO IMPLEMENT

STATUTES OR EXECUTIVE ORDERS—COMMERCIAL ITEMS (JUN 2020)

C.11 MANDATORY WRITTEN DISCLOSURES

SECTION D - CONTRACT DOCUMENTS, EXHIBITS, OR ATTACHMENTS

SECTION E - SOLICITATION PROVISIONS

E.1 52.212-1 INSTRUCTIONS TO OFFERORS—COMMERCIAL ITEMS (OCT 2018)

E.2 52.252-1 SOLICITATION PROVISIONS INCORPORATED BY REFERENCE (FEB

1998)

E.3 52.204-24 REPRESENTATION REGARDING CERTAIN TELECOMMUNICATIONS

AND VIDEO SURVEILLANCE SERVICES OR EQUIPMENT (DEC 2019)

E.4 52.209-7 INFORMATION REGARDING RESPONSIBILITY MATTERS (OCT 2018)

E.5 52.216-1 TYPE OF CONTRACT (APR 1984)

E.6 52.233-2 SERVICE OF PROTEST (SEP 2006)

E.7 52.212-2 EVALUATION—COMMERCIAL ITEMS (OCT 2014)

E.8 52.212-3 OFFEROR REPRESENTATIONS AND CERTIFICATIONS—

COMMERCIAL ITEMS (JUN 2020)

SECTION B - CONTINUATION OF SF 1449 BLOCKS

B.1 CONTRACT ADMINISTRATION DATA

1. Contract Administration: All contract administration matters will be handled by the following individuals:

a. CONTRACTOR: Please designate your point of contact here.

b. GOVERNMENT: Contracting Officer 36C241 John D. Harris

Network Contracting Office 1 (NE) White River Junction VAMC 215 North Main Street White River Junction VT 05009-0001

2. CONTRACTOR REMITTANCE ADDRESS: All payments by the Government to the contractor will be made in accordance with:

[X] 52.232-33, Payment by Electronic Funds Transfer—System For Award Management, or

[] 52.232-36, Payment by Third Party

3. INVOICES: Invoices shall be submitted in arrears:

a. Quarterly []

b. Semi-Annually []

c. Other [X] Monthly

4. GOVERNMENT INVOICE ADDRESS: All Invoices from the contractor shall be submitted electronically in accordance with VAAR Clause 852.232-72 Electronic Submission of Payment Requests.

All Invoices from the Contractor shall be submitted electronically as per VAAR Clause 852.232-72 Electronic Submission of Payment Request http://www.fsc.va.gov/einvoice.asp

ACKNOWLEDGMENT OF AMENDMENTS: The offeror acknowledges receipt of amendments to the Solicitation numbered and dated as follows:

AMENDMENT NO DATE

1 8-3-2020

B.2 PERFORMANCE WORK STATEMENT (PWS)

VISN1 Real Time Location System (RTLS) Maintenance and Operation

1.0 BACKGROUND

VISN 1 implemented a Real Time Location System (RTLS) under the National RTLS Contract.

Hardware and multiple software applications are integrated to the core RTLS infrastructure to achieve benefits in locating assets and improving workflow. The use of Intelligent Insites (Asset Tracking Application) and Centrak (Location Services Technology) is essential to the Government’s requirements and now seeks to obtain RTLS Sustainment services. The Services are necessary to make RTLS Application configuration changes due to minor construction projects, such as a floor or wing renovation or major construction, such as a new building on campus. In addition, RTLS sustainment, such as server system administration is required to ensure the RTLS enterprise solution and servers deployed at the VA Medical Centers (VAMCs) in VISN 1 conforms to VA policies.

2.0 APPLICABLE DOCUMENTS

The Contractor may reference the following documents to understand the performance tasks of this effort:

1. Public Law 109-461, Veterans Benefits, Health Care, and Information Technology Act of 2006, title IX Information Security Matters

2. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

3. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

4. Office of Management and Budget (OMB) Circular A-130, “Managing Federal

Information as a Strategic Resource”, July 28, 2016

5. Office of Management and Budget (OMB) Memorandum M-08-05, “Implementation of Trusted Internet Connections (TIC), November 20, 2007

6. VA Directive 6300, Records and Information Management, February 26, 2009

7. VA Directive 0735, Homeland Security Presidential Directive 12 (HSPD-12)

Program, October 26, 2015)

8. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010

9. VA Handbook 6102 (Internet/Intranet Services), July 15, 2008 Health Insurance

Portability and Accountability Act (HIPAA); 45 CFR Part 160, 162, and 164; Health Insurance Reform: Security Standards; Final Rule dated February 20, 2003

10. VA Handbook 6500.3, “Assessment, Authorization, And Continuous Monitoring of VA Information Systems,” February 3, 2014

11. VA Handbook 6500.8, “Information System Contingency Planning”, April 6, 2011 (http://www1.va.gov/vapubs/)

12. VHA Handbook 1605.05, Business Associate Agreements, July 22, 2014(http://www.va.gov/vhapublications/)

13. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote Access”, January 15, 2014,

14. VA Memorandum, VAIQ # 7011145, VA Identity Management Policy, June 28, 2010 http://www1.va.gov/vapubs/ http://www.va.gov/vhapublications/

15. VA Memorandum, “Implementation of Federal Personal Identity Verification (PIV) Credentials for Federal and Contractor Access to VA IT Systems”, (VAIQ# 7614373) July 9, 2015,

16. VA Memorandum “Mandatory Use of PIV Multifactor Authentication to VA Information System” (VAIQ#7613595), June30, 2015,

17. VA Memorandum “Mandatory Use of PIV Multifactor Authentication for Users with Elevated Privileges” (VAIQ#7613597), June30, 2015; (VAIQ#7613597), June30, 2015;

18. Attachment A - Facility RTLS Hardware Deployment Design Document and Certified Space File

19. Attachment B - VISN and VAMC Site Server Build Document

3.0 SCOPE OF WORK

The Contractor shall provide RTLS Operation and Maintenance (O&M) services, inclusive of RTLS application client and server software, operating system maintenance, operational support services and RTLS hardware. The Contractor shall provide these services for the RTLS production and pre-production environments deployed the VA Medical Centers (VAMCs) listed in Table 1, Section 4.2. The Contractor shall operate, repair, and maintain systems, applications, and Information Technology (IT) environments in support of RTLS applications and system components. The RTLS sustainment services shall include the following functions:

• Preventive Maintenance: The proactive modification of RTLS products to detect and correct latent operating defects or conditions before they become effective faults.

• Corrective Maintenance: The reactive maintenance performed to identify, isolate, and rectify RTLS operating faults.

• Adaptive Maintenance: Adaptive Maintenance: The proactive or reactive modifications performed to keep RTLS operations viable and products usable in a changing environment.

The tasks within this PWS are within scope and inclusive of Section 6.1 through Section 6.6

4.0 PERFORMANCE DETAILS

4.1 PERFORMANCE PERIOD

The Period of Performance (PoP) shall be 12 months from the date of award with three 12-month option periods.

4.2 PLACE OF PERFORMANCE

The scope of this requirement includes RTLS components located in the VAMC and VISN level servers located at the Austin Information Technology Center. Efforts under this ID/IQ may be performed on-site as well as remotely.

Table 1. VAMCs

VA Maine Healthcare System 1 VA Center Augusta, ME 04330

Bedford VA Medical Center 200 Springs Road Bedford, MA 01730

*White River Junction VA Medical Center (215 North Main Street White River Junction, VT 05009)

VA Boston Healthcare System Jamaica Plain Campus 150 South Huntington Ave

*VA Boston Healthcare System West Roxbury Campus 1400 VFW Parkway

*VA Boston Healthcare System Brockton Campus 940 Belmont Street

Jamaica Plain, MA 01230 West Roxbury, MA 02132 Brockton, MA 02301 Manchester VA Medical Center 718 Smyth Road Manchester, NH 03104

Providence VA Medical Center 830 Chalkstone Ave Providence, RI 02908

VA Connecticut Healthcare System West Haven Campus 950 Campbell Ave West Haven, CT 06516

VA Connecticut Healthcare System Newington Campus 555 Willard Ave Newington, CT 06111

VA Central Western Massachusetts 421 North Main Street Leeds, MA 01053

*These sites are optional as RTLS has not been completed at this time.

4.3 TRAVEL OR SPECIAL REQUIREMENTS

The Government anticipates travel under this effort to perform adaptive maintenance tasks.

Include all estimated travel costs. These costs will not be directly reimbursed by the Government.

5.0 SYSTEM ARCHITECTURE OVERVIEW

The VISN 1 RTLS architecture (see Figure 1) is divided into two groupings: components in VA Medical Centers (VAMC) and components in the Austin Information Technology Center (VISN level servers at AITC). Additionally, there are external interfaces that touch other VA systems.

Figure 1. VISN 1 RTLS Architecture

RTLS interfaces to external systems are software solutions orchestrated by a series of Enterprise Service Bus (ESB) flows. To support RTLS interfaces, VA uses the MuleSoft, a lightweight, open source ESB and integration framework that implements a communication messaging system between mutually interacting software applications. It is a Java-based ESB and integration platform to facilitate message routing and data transformation.

The RTLS component groupings at the VAMC and at the AITC are interdependent.

Sustainment of RTLS interfaces and System Administration duties for virtual servers, Databases, and components located at the Austin Information Technology Center (AITC) are outside the scope of this requirement. Because of the interdependencies, operations and maintenance efforts are coordinated with the Contracting Officer’s Representative (COR) and other sustainment/support entities as specified by the COR to assist with isolating issues whose full resolution may span the component groupings. Table 2 provides a high level overview of responsibilities between the different sustainment entities.

Table 2. High Level Overview of Support for VISN 1 RTLS

Asset Tracking Responsibility Matrix for VISN 1 RTLS System

SUPPORT

Task

AITC

Sustainment ESE Interfaces Sustainment

VISN 1

RTLS

Sustainment Notes MuleESB Server R VistA Services/VistALink (Oracle/Linux) R Interface Code and Upgrades R Patches for Linux (Interfaces/PIV SSOi) R Patches for Windows Centrak Servers R R

VISN 1 Sustainment responsible for servers at VAMCs. AITC Sustainment responsible for servers at AITC

Patches for Windows Insites Servers R R

VISN 1 Sustainment responsible for servers at VAMCs. AITC Sustainment responsible for servers at AITC

Patches for RTLS Applications R

VISN 1 Sustainment responsible for Software Maintenance Agreements

Application (SQL) Level Database Administration - Centrak/Insites R Load Balancing R PIV/SSOi R Vulnerability Remediation Management OS Level - Centrak R R

VISN 1 Sustainment responsible for servers at VAMCs. AITC Sustainment responsible for servers at AITC

Vulnerability Remediation Management OS Level - Insites R

VISN 1 Sustainment responsible for servers at VAMCs. AITC Sustainment responsible for servers at AITC

Vulnerability Remediation Management - Databases R

All databases are consolidated at the

AITC.

Help Desk R

Project Management R R

VISN 1 Sustainment responsible for PM at VAMCs. AITC Sustainment responsible PM at AITC

System Monitoring R R

VISN 1 Sustainment responsible for monitoring servers at VAMCs. AITC Sustainment responsible for monitoring servers at AITC

5.1 RTLS SUSTAINMENT EFFORT

RTLS servers are highly virtualized and hosted on VA OIT virtual infrastructure, with software components spread across multiple virtual machines.

The Contractor shall provide O&M sustainment services for the RTLS production and pre-production environments.

O&M sustainment services shall be provided for the software components identified in Table 3.

These services are detailed in Section 6.0 to include operating system patches/upgrades, RTLS software component patches/upgrades, software license installation, system configuration changes, and virtual machine reboots on each of the RTLS VA Medical Center Asset Tracking Virtual Servers. Since some of these products are deployed at the AITC, it will require a coordinated effort through the COR with other sustainment vendors.

Table 3. Software Components Covered Under this Task Order

Products

CenTrak Application Server

CenTrak Connect and Fingerprinting

CenTrak Pulse (formerly GMS) and Prism

Intelligent InSites (Connector, Platform, BI, NSSM)

Java JDK

Java SE

Keepalive

PostgreSQL

Microsoft Internet Information Services (IIS)

Microsoft .NET Framework

RabbitMQ

WildFly – JBoss: App Server (IAM)

Windows Server 2012 R2 and 2016

Products

WinRAR

Internet Information Services (IIS)

5.2 TECHNICAL EXPERTISE

In performance of the tasks in this PWS, the Contractor shall use and have expertise or certification as necessary in the following software and technologies:

Table 4. RTLS Technology

Technology Technology

Microsoft SharePoint 2010, 2013 or later SharePoint versions, and related technologies

XML, XSL, XSLT

SQL Server 2012 and 2016 Reporting tools including SQL Server Reporting Services (SSRS) SQL Server Analysis Services (SSAS) SQL Server Integration Services (SSIS) Splunk Nagios Monitoring

Intelligent InSites CenTrak Oracle databases MySQL Java JDK/SE RabbitMQ VA Technical Reference Model (TRM) VMWare Windows System Administration 2012 and Red Hat Linux system administration

6.0 SPECIFIC TASKS AND DELIVERABLES

6.1 PROJECT MANAGEMENT

The Contractor shall identify a Single Point of Contact (POC) to oversee the O&M tasking for the RTLS sustainment in VISN 1. The Contractor POC shall be responsible for:

1. Effectively communicating and providing timely project progress to VA and Contractor team members using the activity progress report.

2. Ensuring the submission of contract deliverables

3. Coordinating, escalating, and resolving Contractor-related project issues.

4. Representing the Contractor in status meetings.

5. Complying with VA’s change management process.

6.1.1 REPORTING REQUIREMENTS

The Contractor shall manage the RTLS Sustainment work effort and provide a Monthly Activity Report. These reports shall convey the status of Contract performance. A standard format will be provided by VA and shall be utilized for submission of required information. Required information includes:

1. All planned or scheduled maintenance that will occur in the next reporting period, including patches, OS upgrades and hardware replacements

2. Maintenance activity log showing all patches / upgrades / licenses installed, failures and faults detected, system performance deviations, including security vulnerabilities identified by VA from the monthly Nessus and on demand Oracle and SQL Server database scans, and the operational time to restore.

3. Customer support log which shall include a description of all support issues identified, severity level, and how the issues were resolved.

4. Corrective actions taken and status, whether closed/resolved or still open.

5. Anticipated closure date and roadblocks (if any) for open items.

6. All known significant issues or risks.

7. A summary of all closed and completed items.

Deliverable:

A. Monthly Activity Report

6.1.2 TECHNICAL KICKOFF MEETING

The Contractor shall hold a technical kickoff meeting within 10 days after TO award. The Contractor shall present, for review and approval by the Government, the details of the intended approach, work plan, and project schedule for each effort. The Contractor shall specify dates, locations (can be virtual), agenda (shall be provided to all attendees at least five (5) calendar days prior to the meeting), and meeting minutes (shall be provided to all attendees within three

(3) calendar days after the meeting). The Contractor shall invite the Contracting Officer (CO), Contract Specialist (CS), COR, and the VA PM.

6.1.3 WEEKLY STATUS MEETING

The Contractor shall hold a weekly status meeting with the COR and technical Point of Contacts (POC) as specified by the COR to discuss all the items identified in Monthly Activity Report (section 6.1.1), and other issues as identified by the COR. The Contractor shall provide weekly status meeting minutes to all attendees within three (3) calendar days after the meeting.

6.2 PREVENTIVE MAINTENANCE

The Contractor shall deploy software updates and upgrades in the execution of RTLS preventive maintenance tasks. Additionally, the Contractor shall maintain and modify infrastructure system configurations to address functionality, security, or connectivity issues.

Most RTLS application minor updates are released once or twice a year, while major updates are done annually. Updates to any individual application may vary in a given period of performance but will collectively average out over time.

For RTLS preventive maintenance, the Contractor shall:

1. Perform modifications to RTLS software installations and operational configurations to maintain and improve system performance, and to detect and correct latent faults in software and hardware products before they become operative faults. A latent defect or condition is one that is present but hidden from regular means of detection or yet to have an operational impact. An operative or effective fault is a fault activity impacting nominal system operations or business functionality.

2. Monitor the performance of the RTLS system, including system resources such as processor, memory and disk utilization and verify that performance thresholds are within nominal operating range, and take corrective action necessary to mitigate or relieve RTLS performance deviations and respond proactively to actionable alert and threshold notifications. The Contractor shall log and notify VA of any performance deviation, and any known or suspected rationale for the deviation in the Maintenance Activity Log as part of the Monthly Activity Report (Section 6.1.1).

3. Engage in an ongoing inspection of RTLS to identify operative and latent defects in RTLS functions, software scripts, and software and hardware configuration. The Contractor shall make actionable recommendations that address any defects detected.

Recommendations shall be verbally relayed to the COR and documented in the Maintenance Activity Log as part of the Monthly Activity Report (Section 6.1.1).

4. Coordinate with COR to determine timing windows for patch / upgrade installations. This may take place outside of regular business hours.

5. Identify, download and install or manage the installation of RTLS application software patches and upgrades.

6. Coordinate with VA POCs identified by the COR to shut down, reboot or restart RTLS systems (e.g., Intelligent InSites, CenTrak) and RTLS supporting Systems (e.g., SSOi), following VA or RTLS IT maintenance, recovery or software patching.

7. Verify correct operation of RTLS after every patch installation.

8. If operating system patches are shown to interfere with RTLS operation, coordinate with

VA POCs identified by the COR before backing out any operating system patch(es).

6.2.1 SOFTWARE UPDATES, UPGRADES AND ADMINISTRATION

The application components of RTLS are hosted on platforms that contain VA standard operating systems, virtual machines, and ancillary software. The Contractor shall be responsible for identifying and downloading updates. Some of the software listed in Table 3 are sub-components of the RTLS application software. The maintenance updates and upgrades to VA standard environments are the responsibility of VA Office of Information & Technology (OIT).

For RTLS software updates or upgrades, the Contractor shall:

1. Proactively monitor One-VA Technical Reference Model to ensure RTLS Software components are approved to run on VA environment. If not, develop a plan to upgrade and perform installation and configuration of RTLS Software so that RTLS environment remains compliant with approved VA Baseline. This may include Operating System upgrades and software component upgrades.

2. Perform the installation, configuration, update (patching operational software) and/or upgrade (replacing or supplementing the software baseline) of RTLS software to mitigate the development of future faults, correct latent faults (present but hidden from routine (i.e., non-extraordinary) means of detection), rectify operative faults, restore nominal operations, or enhance component and system performance/capacity. For RTLS application software, the Contractor may expect approximately one major update and 2-3 minor updates a year. Linux patches are issued by VA monthly. The Contractor shall coordinate with VA COR to schedule installation before the next set of patches becomes available (less than 30 days). For RTLS application patches, the Contractor shall coordinate with VA COR to schedule installation within 30 days from when the software update is available. If issues are encountered, this timeframe may be extended with agreement from the COR.

3. Notify COR three (3) weeks in advance of installing new RTLS application releases or upgrades or any other disruptive maintenance activity in any environment. The Contractor shall delay or terminate any planned update or upgrade, at the direction of the

COR.

4. Perform the installation of software patches, new releases and software updates in the pre-production environment. New releases and upgrades may provide new functionality as well as any needed system corrections.

5. Ensure that the installation, operation, maintenance, updating, and patching of software shall not alter prior configuration settings or those from the VA approved configuration.

6. Verify the function and stability of upgrades in all environments (subject to the connectivity limits of those environments) prior to advancing to operational deployment into the production environment. This will include regression testing sufficient to verify basic functionality (e.g., login, search, asset tracking, reporting, accurate monitoring and synchronization of inventory).

7. Perform routine RTLS system administration functions and serve as system administrator for all RTLS applications. In addition to system patches and updates, the Contractor shall monitor system logs and resource utilization, and archive system data and audit logs as needed.

8. Provide written notice to VA that each patch has been validated as not affecting the Systems within 10 working days when security fixes involve installing third party patches in pre-production (such as Linux Red Hat). Notification can come in the form of an email to the COR.

9. Provide VA any necessary information to update the One-VA TRM entry for any software components updated.

10. Contractor shall provide supporting data as requested by the COR to complete VA IT requests such as Authority to Operate (ATO) and TRM waivers.

6.2.2 HARDWARE UPDATES AND UPGRADES

The VA wireless infrastructure upon which RTLS depends, is updated, upgraded and maintained by VA OI&T, including wireless access points, as well as the Cisco Mobility Services Engine (MSE). For RTLS Hardware (HW) updates or upgrades, the Contractor shall:

1. Perform the provisioning, installation, configuration, update or upgrade of RTLS hardware to (a) mitigate the development of future faults and maintain nominal system performance or capacity. The term provisioning refers to the planned allocation and distribution of available or acquired hard assets.

2. Develop recommendations for the replacement or substitution of RTLS hardware components in the RTLS System, as necessary to prevent faults or sustain performance thresholds.

3. Develop requisition requests and documentation for the procurement of additional RTLS software and hardware necessary to sustain RTLS functional capabilities at nominal levels. The VISN PM shall provide for the procurement of all RTLS hardware.

4. Execute the provisioning and installation of substitute RTLS components into the operational RTLS system, upon the authorization of the VISN RTLS PM.

6.3 CORRECTIVE MAINTENANCE

Corrective Maintenance is the reactive maintenance performed to identify, isolate, and rectify RTLS operating faults. Corrective Maintenance is applicable to both RTLS software and hardware. For RTLS corrective maintenance, the Contractor shall:

1. Perform troubleshooting to identify and isolate faults causing any failure or degradation of service in RTLS software and hardware components and systems.

2. Execute RTLS backup procedures in the event of RTLS primary software and hardware component service failures.

3. Execute the appropriate RTLS recovery procedures following the restoration of RTLS primary services from a partial or full system failure. Restoration shall include resumption with all data and capabilities available prior to the backup inducing event, and restoration to nominal operational state of RTLS hardware devices, including hard drives, component boards and processing units.

4. VA will perform Federal Information Security Management Act (FISMA) compliance audits and Nessus scans monthly, and the Contractor shall address and resolve all security remediation and vulnerabilities identified within the timeframe specified below, starting from notification of findings. VA maintains a tracking database for all security scan findings and compliance audits. The Contractor shall update that database to indicate the status of issue resolution and/or the plan to resolve issues that will take longer to resolve, in case of delays beyond the Contractor’s control (e.g., a VA delay or vendor dependency for software patches). Based on historical data, the Contractor may expect approximately 10 new findings per month (1/8 critical priority, 1/2 high priority, 3/8 medium priority).

a. Critical – patches shall be tested and applied within 30 days

b. High – patches shall be tested and applied within 60 days

c. Moderate – patches shall be tested and applied within 90 days

d. Low – the System owner will determine the patching timeframe

e. Emergent – patches shall be tested and applied as soon as possible

5. Respond to and resolve notifications that RTLS servers, software and hardware are down or inoperable.

6. Troubleshoot, isolate and repair connectivity and communication issues for data presented to, or received from, the Mule ESB. Resolution of these issues may require coordination with other POCs as identified by the COR.

7. Coordinate with VA OIT to obtain the status of the VA wide area network (WAN) and wireless infrastructure upon which RTLS depends, to determine the operational impact on RTLS. The Contractor shall obtain information on WAN and wireless updated, upgraded and maintenance performed by VA OI&T. OIT maintenance includes wireless access points and Cisco Mobility Services Engine (MSE).

8. Perform the provisioning, installation, configuration, update or upgrade of RTLS hardware to correct latent faults, rectify operative faults, and restore nominal operations.

The term provisioning refers to the planned allocation and distribution of available or acquired hard assets.

9. Execute the provisioning and installation of substitute RTLS components into the operational RTLS system, upon the authorization of the VISN RTLS PM.

6.4 ADAPTIVE MAINTENANCE

VISN 1 procured and installed an RTLS Solution including Intelligent Insites Asset Tracking Application and Centrak Location Technology. For RTLS adaptive maintenance, the Contractor shall:

1. Execute modifications or supplementation of RTLS software maps and software/ hardware configurations that adjust RTLS functions and operations to a new or modified deployment environment. The deployment environment may be modified because of new construction, changes to facility floorplans, or changes to the business use of facilities, rooms and other assets using RTLS. The VA will provide new drawings. The contractor shall verify that modifications or supplementations are following VA RTLS Deployment Standards (Attachment E). Contractor shall provide Intelligent Insites software configuration, such as regioning of map, map rendering, and preparation work for locations. Contractor shall provide Centrak software configuration, hardware installation and verification. The contractor shall implement Centrak approved fingerprinting technology. The Contractor shall coordinate all activities such as software configuration in each system and the integration of data between systems.

The Contractor shall obtain VISN PM authorization prior to implementing any RTLS modification or supplementation steps. The contractor shall update the Facility Hardware Deployment Design Document Attachment A and Certified Space File (CSF) (Attachment A).

Deliverable:

Facility Hardware Design Document and Configuration Space File

6.5 CUSTOMER SUPPORT

The Contractor shall work to resolve issues identified by the COR or a VA Clinical Engineering POC from one of the medical centers. Local staff from Clinical engineering will perform initial review of all issues and if unable to resolve, will submit a help desk support ticket for escalation.

The source of these issues may be Tier 2 or 3 trouble tickets. During regular business hours (7am to 7pm Eastern), the Contractor shall:

1. Respond to service requests from COR or designee (via telephone or email) to resolve or support the troubleshooting, identification and resolution of RTLS technical requests which involve RTLS components at the RDC. The Contractor shall log all requests that are received in the Maintenance Activity Log as part of the Monthly Activity Report (Section 6.1.1).

2. Classify all service request received by assigning a severity level, in accordance with Table 3 below. The Contractor may anticipate 2-3 service requests per month, typically of the Non-Critical and Important severity.

3. Coordinate with the COR if access to resources at a VAMC are required to fully diagnose or resolve an issue and work collaboratively with the POC(s) identified by the COR to resolve issues within RDC boundaries as depicted in Figure 1. RTLS malfunctions may originate within RDC boundaries, outside RDC boundaries, or both, if the RDC components have a dependency on external RTLS components (i.e., RTLS components at a VAMC).

4. Collaborate with any identified POCs to cooperatively troubleshoot and resolve issues.

5. Provide issue resolution response to resolve faults and requests, in accordance with the response timeline provided in Table 3 below. Issues, status and resolution notification shall be communicated to the COR.

6. Document all customer support issues in the Customer service log, a component of the Monthly Activity Report (section 6.1.1)

7. Develop and submit service requests to COR-identified VA POCs to request OIT support services to resolve RTLS faults and other operating problems caused by components outside the maintenance responsibility of this TO.

Table 5: Event Response Time Intervals

Severity Code Impact Initial Response to

Customer

Resolution Time

1 - Critical Complete work stoppage. Critical Service Request

30 minutes 8 hours

2 - Important Inability to perform a job function.

Important Service Request

1 hour 12 hours

3 - Non-critical Low/No Impact (Able to perform work functions) Non-critical Service Request

16 hours 80 hours

7.0 GOVERNMENT FURNISHED EQUIPMENT

The Government has multiple remote access solutions available to include Citrix Access Gateway (CAG), Site-to-Site Virtual Private Network (VPN), and RESCUE VPN.

The Government’s issuance of Government Furnished Equipment (GFE) is limited to Contractor personnel requiring direct access to the network to: development environments; install, configure and run Technical Reference Model (TRM) approved software and tools (e.g., Oracle, Fortify, Eclipse, SoapUI, WebLogic, LoadRunner); upload/download/ manipulate code, run scripts, and apply patches; configure and change system settings; check logs, troubleshoot/debug, and test/QA.

When necessary, the Government will furnish desktops or laptops, for use by the Contractor to access VA networks, systems, or applications to meet the requirements of this PWS. The overarching goal is to determine the most cost-effective approach to providing needed access to the VA environment coupled with the need to ensure proper Change Management principles are followed. Contractor personnel shall adhere to all VA system access requirements for on-site and remote users in accordance with VA standards, local security regulations, policies and rules of behavior. GFE shall be approved by the COR and Program Manager on a case-by-case basis prior to issuance.

Based on the Government assessment of remote access solutions and the requirements of this TO, the Government estimates that the following GFE will be required by this TO:

1. Two (2) standard laptops

The Government will not provide IT accessories including but not limited to Mobile Wi-Fi hotspots/wireless access points, additional or specialized keyboards or mice, laptop bags, extra charging cables, extra PIV readers, peripheral devices, additional RAM, etc. The Contractor is responsible for providing these types of IT accessories in support of the TO as necessary and any VA installation required for these IT accessories shall be coordinated with the COR.

8.0 POSITION/TASK RISK DESIGNATION LEVEL(S)

In accordance with VA Handbook 0710, Personnel Security and Suitability Program, the position sensitivity and the level of background investigation commensurate with the required level of access for the following tasks within the PWS are:

Table 6. Position Sensitivity and Background Investigation Requirements by Task

Task Number

Tier1 / Low Risk

Tier 2 / Moderate Risk

Tier 4 / High Risk

6.1

6.2

6.3

6.4

6.5

6.6

The tasks identified above, and the resulting Position Sensitivity and Background Investigation requirements identify the Background Investigation required for Contractor individuals, based upon the tasks individual contractors will be working. The submitted Contractor Staff Roster must indicate the required Background Investigation Level for each Contractor individual based upon the tasks the Contractor individual will be working, in accordance with their submitted proposal.

9.0 GENERAL SECURITY REQUIREMENTS

The Contractor shall comply with VA security, privacy and records management policies, directives, handbooks, and guidelines.

9.1 INFORMATION SECURITY, PRIVACY AND RECORDS MANAGEMENT

Contractors and subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA personnel regarding information and information system security.

9.1.1 Access to VA Information and VA Information Systems

1. The Contractor shall request logical or physical access to VA information and VA information systems for their employees, subcontractors, and affiliates only to the extent necessary to perform the services specified in this contract or supplemental agreement.

2. All Contractors and Affiliates supporting this contract must be in the continental U.S.

3. Background security investigations for contractors must be in accordance with VA

Directive and Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures. Verification of a Security Clearance must be processed through the Special Security Officer located in the Planning and National Security Service within the Office of Operations, Security, and Preparedness.

4. The Contractor or Subcontractor must notify the Contracting Officer immediately when an employee working on a VA system or with access to VA information is reassigned, leaves the contractor or subcontractor's employ, and prior to an unfriendly termination.

The Contracting Officer must also be notified immediately by the contractor or subcontractor prior to an unfriendly termination.

9.1.2 VA Information Custodial Language

If VA determines that the Contractor has violated any of the information confidentiality, privacy, and security provisions of this contract, it shall be sufficient grounds for VA to withhold payment to the Contractor, Subcontractor or Third Party, and to terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) Part 12.

If a VHA contract is terminated for cause, all Business Associate Agreement (BAA) must also be terminated and appropriate actions taken in accordance with VHA Handbook 1600.05, BAAs.

Absent an agreement to use or disclose protected health information, there is no business associate relationship.

For Vendor custodial responsibilities, the Contractor shall:

1. Store, transport, or transmit VA sensitive information in an encrypted form, using a FIPS 140-2 compliant solutions.

2. Have access to privileged and confidential materials of VA. These printed and electronic documents are for internal use only, are not to be copied or released without permission, and remain the sole property of VA.

3. Release no VA information. Any request for information presented to the Contractor shall be submitted to the VA Contracting Officer for response. The VA Contracting Officer will be the sole authorized official to release any data, draft deliverables, final deliverables, or any other documentation or materials pertaining to this contract.

9.1.3 Security Incident Investigation

The Contractor shall cooperate with authorized Government offices concerning facility access, audits, security incident notification, and hosting location. Specifically, the Contractor and Subcontractors shall:

1. Immediately and simultaneously notify the COR, designated ISO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/ subcontractor has access, and the discovery or disclosure of successful exploits of the vulnerability which can compromise the security of the Systems. For the purposes of this PWS, an incident is defined as an occurrence that (a) jeopardizes the confidentiality, integrity, or availability of an information system, (b) jeopardizes the information being processed, computed, stored, or transmitted, or (c) anything that constitutes an imminent or occurring threat of violation of security policies, security procedures, acceptable use policies, or Agency data sharing agreements.

2. Report to the appropriate law enforcement entity, instances of theft or break-in or other criminal activity, including the VA OIG and Security and Law Enforcement.

3. Cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of possible criminal law violation(s) associated with any incident. The Contractor shall also cooperate with VA in civil litigation to recover VA information, obtain monetary or other compensation from a third party for damages arising from any incident, or obtain injunctive relief against third party arising from, or related to, the incident.

4. Cooperate with all audits, inspections, investigations, or other reviews conducted by or on behalf of the CO or other authorized Government offices as described in prior subparagraphs. Cooperation includes, but is not limited to, prompt disclosure of requests of data, information, and records about any audit, inspection, investigation, or review and making employees of the Contractor available for interview by auditors, inspectors, and investigators within ten business days from such request, unless otherwise directed by the OIG.

5. Preserve such data, records, logs and other evidence reasonably necessary to conduct a thorough investigation of any computer security incident.

9.1.4 Information System Maintenance

For Information System Maintenance, the Contractor shall:

1. Include this Privacy Act clause, including this subparagraph (3), in all subcontracts awarded under this contract which requires the operation of such a SOR.

a. In the event of violations of the Act, a civil action may be brought against the agency involved when the violation concerns the operation of a SOR on Individuals. Criminal penalties may be imposed upon the officers or employees of the agency when the violation concerns the operation of a SOR on individuals to accomplish an agency function. For purposes of the Act, when the contract is for the operation of a SOR on individuals to accomplish an agency function, the Contractor is considered to be an employee of the agency.

i. "Operation of a System of Records" means performance of any of the activities associated with maintaining the SOR, including the collection, use, maintenance, and dissemination of records.

ii. "Record" means any item, collection, or grouping of information about an individual that is maintained by an agency, including, but not limited to, education, financial transactions, medical history, and criminal or employment history and contains the person's name, or identifying number, symbol, or any other identifying aspect assigned to the individual, such as a fingerprint.

iii. "System of Records" means a group of any records under the control of any agency from which information is retrieved by the name of the individual or by some identifying number, symbol, or other identifying aspect assigned to the individual.

2. Safeguard the security of all technologies being maintained, including their subcomponents (hereinafter referred to as "Systems"), throughout the life of this contract and any extension, warranty, or maintenance periods. This includes, but is not limited to workarounds, patches, hotfixes, upgrades, and any physical components (hereafter referred to as Security Fixes) which may be necessary to fix all security vulnerabilities published or known to the vendor anywhere in the Systems, including Operating Systems and firmware. The vendor shall ensure that Security Fixes shall not negatively impact the Systems beyond known OEM Operating thresholds.

9.1.5 Liquidated Damages for Data Breach

1. Consistent with the requirements of 38 U.S.C. §5725, a contract may require access to sensitive personal information (SPI). If so, the Contractor may be liable to VA for liquidated damages in the event of a data breach involving any SPI the Contractor/Subcontractor processes or maintains under this contract to the extent that such breach is the result of the Contractor’s error or omission. However, it is the policy of VA to forgo collection of liquidated damages in the event the Contractor provides payment of actual damages in an amount determined to be adequate by the agency.

2. The Contractor shall provide notice to VA of a data breach as set forth in the Security Incident Investigation section above. Upon such notification, VA must secure from a non- Department entity or the VA Office of Inspector General an independent risk analysis of the data breach to determine the level of risk associated with the data breach for the potential misuse of any sensitive personal information involved in the data breach. The term 'data breach' means the loss, theft, or other unauthorized access, or any access other than that incidental to the scope of employment, to data containing SPI, in electronic or printed form, that results in the potential compromise of the confidentiality or integrity of the data. Contractor shall fully cooperate with the entity performing the risk analysis. Failure to cooperate may be deemed a material breach and grounds for contract termination.

3. Each risk analysis shall address all relevant information concerning the data

a. Nature of the event (loss, theft, unauthorized access);

b. Description of the event, including: (i) date of occurrence, and (ii) data elements involved, including any PII, such as full name, social security number, date of birth, home address, account number, disability code;

c. Number of individuals affected or potentially affected;

d. Names of individuals or groups affected or potentially affected;

e. Ease of logical data access to the lost, stolen or improperly accessed data considering the degree of protection for the data, e.g., unencrypted, plain text;

f. Amount of time the data has been out of Contractor’s control;

g. The likelihood that the sensitive personal information will or has been compromised (made accessible to and usable by unauthorized persons);

h. Known misuses of data containing sensitive personal information, if any;

i. Assessment of the potential harm to the affected individuals;

j. Data breach analysis as outlined in 6500.2 Handbook, Management of Breaches

Involving Sensitive Personal Information, as appropriate; and

k. Whether credit protection services may assist record subjects in avoiding or mitigating the results of identity…