36C24120R0006 RFP post.pdf

PAGE 1 OF 1. REQUISITION NO.

2. CONTRACT NO. 3. AWARD/EFFECTIVE DATE 4. ORDER NO. 5. SOLICITATION NUMBER 6. SOLICITATION ISSUE DATE

a. NAME b. TELEPHONE NO. (No Collect Calls) 8. OFFER DUE DATE/LOCAL

TIME

9. ISSUED BY CODE 10. THIS ACQUISITION IS UNRESTRICTED OR SET ASIDE: % FOR:

SMALL BUSINESS

HUBZONE SMALL

BUSINESS

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

WOMEN-OWNED SMALL BUSINESS

(WOSB) ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

EDWOSB

8(A)

NAICS:

SIZE STANDARD:

11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

SEE SCHEDULE

12. DISCOUNT TERMS

13a. THIS CONTRACT IS A

RATED ORDER UNDER

DPAS (15 CFR 700)

13b. RATING

14. METHOD OF SOLICITATION

RFQ IFB RFP

15. DELIVER TO CODE 16. ADMINISTERED BY CODE

17a. CONTRACTOR/OFFEROR CODE FACILITY CODE 18a. PAYMENT WILL BE MADE BY CODE

TELEPHONE NO. DUNS: DUNS+4:

PHONE: FAX:

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN OFFER

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK BELOW IS CHECKED

SEE ADDENDUM

19. 20. 21. 22. 23. 24.

ITEM NO. SCHEDULE OF SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

(Use Reverse and/or Attach Additional Sheets as Necessary)

25. ACCOUNTING AND APPROPRIATION DATA 26. TOTAL AWARD AMOUNT (For Govt. Use Only)

27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1, 52.212-4. FAR 52.212-3 AND 52.212-5 ARE ATTACHED. ADDENDA ARE ARE NOT ATTACHED.

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA ARE ARE NOT ATTACHED

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN _______________ 29. AWARD OF CONTRACT: REF. ___________________________________ OFFER

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND DATED ________________________________. YOUR OFFER ON SOLICITATION

DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY (BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE

ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED SET FORTH HEREIN IS ACCEPTED AS TO ITEMS:

30a. SIGNATURE OF OFFEROR/CONTRACTOR 31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER)

30b. NAME AND TITLE OF SIGNER (TYPE OR PRINT) 30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER (TYPE OR PRINT) 31c. DATE SIGNED

AUTHORIZED FOR LOCAL REPRODUCTION (REV. 2/2012)

PREVIOUS EDITION IS NOT USABLE Prescribed by GSA - FAR (48 CFR) 53.212

7. FOR SOLICITATION

INFORMATION CALL:

STANDARD FORM 1449

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 30

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS 94

36C24120R0006 07-29-2020

John D. Harris 802.295.9363 x5175 08-10-2020

90C

Department of Veterans Affairs

Network Contracting Office 1 (NE)

White River Junction VAMC

215 North Main Street

White River Junction VT 05009-0001 x

541513

$30 Million

N/A

X

Department of Veterans Affairs

9 locations (see Table 1 in PWS)

90C

Network Contracting Office 1 (NE)

White River Junction VAMC

215 North Main Street

White River Junction VT 05009-0001

All Invoices from the Contractor shall be submitted electronically as per

VAAR Clause 852.232-72

Electronic Submission of Payment Request http://www.fsc.va.gov/einvoice.asp

877-353-9791

See CONTINUATION Page

This solicitation is a request for quotes (RFQ) for RTLS maintenance and operation services and supplies.

The government intends to award a firm fixed price Purchase

Order using FAR Part 13.

Contractor shall provide all necessary personnel, supervision, labor, equipment, materials and disposal needed to provide the items at locations indicated on Table 1 in the PWS.

Quotes should carefully follow instructions included in

52.212-1 and evaluation criteria in 52.212-2.

Pricing should be identified in the Price/Cost Schedule.

Wage Determinations apply per serviced locations:

2015-4114 R#16 5-14-20; 2015-4010 R#13 12-23-19; 2015-4025

R#14 4-08-20; 2015-4081 R#13 4-10-20; 2015-4084 R#14 4-13-20

; 2015-4186 R#15 4-20-20.

All quotes shall be emailed to john.harris405@va.gov.

Any quote not compliant with the RFQ will not be considered.

$0.00 x X

X 1

19. 20. 21. 22. 23. 24.

ITEM NO. SCHEDULE OF SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

32a. QUANTITY IN COLUMN 21 HAS BEEN

RECEIVED INSPECTED ACCEPTED, AND CONFORMS TO THE CONTRACT, EXCEPT AS NOTED: _______________________________________________________

32b. SIGNATURE OF AUTHORIZED GOVERNMENT REPRESENTATIVE 32c. DATE 32d. PRINTED NAME AND TITLE OF AUTHORIZED GOVERNMENT REPRESENTATIVE

32e. MAILING ADDRESS OF AUTHORIZED GOVERNMENT REPRESENTATIVE 32f. TELEPHONE NUMBER OF AUTHORIZED GOVERNMENT REPRESENTATIVE

32g. E-MAIL OF AUTHORIZED GOVERNMENT REPRESENTATIVE

33. SHIP NUMBER 34. VOUCHER NUMBER 35. AMOUNT VERIFIED CORRECT 36. PAYMENT 37. CHECK NUMBER

FOR

PARTIAL FINAL

COMPLETE PARTIAL FINAL

38. S/R ACCOUNT NUMBER 39. S/R VOUCHER NUMBER 40. PAID BY

41a. I CERTIFY THIS ACCOUNT IS CORRECT AND PROPER FOR PAYMENT 42a. RECEIVED BY (Print)

41b. SIGNATURE AND TITLE OF CERTIFYING OFFICER 41c. DATE

42b. RECEIVED AT (Location)

42c. DATE REC'D (YY/MM/DD) 42d. TOTAL CONTAINERS

STANDARD FORM 1449 (REV. 2/2012) BACK

This solicitation is a request for proposal (RFP) for RTLS maintenance and operations services and supplies.

The government intends to award a single-award, 5-year IDIQ that uses firm-fixed Task Orders to order needed items.

Contractor shall provide all necessary personnel, supervision, labor, equipment, materials and disposal necessary to provide the services for all VISN1 locations per the Performance Work Statement (PWS) described herein.

Offerors should carefully follow instructions included in the 52.212-1, and for evaluation criteria specified in

52.212-2.

Pricing should be identified in the attached Price List.

Wage Determinations will apply to the Task Orders issued off the IDIQ and will be identified thereon.

All proposals shall be emailed to stephen.clements3@va.gov.

Any proposal not compliant with the RFP will not be considered.

Late proposals will not be considered.

36C24120R0006

Table of Contents

SECTION A

A.1 SF 1449 SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

A.2 SF 1449 SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS –

BACK 2

SECTION B - CONTINUATION OF SF 1449 BLOCKS

B.1 CONTRACT ADMINISTRATION DATA

B.3 PRICE/COST SCHEDULE

ITEM INFORMATION ................................................ Error! Bookmark not defined.

SECTION C - CONTRACT CLAUSES

C.1 52.252-2 CLAUSES INCORPORATED BY REFERENCE (FEB 1998)

C.2 52.216-18 ORDERING (OCT 1995)

C.3 52.216-19 ORDER LIMITATIONS (OCT 1995)

C.4 52.216-22 INDEFINITE QUANTITY (OCT 1995)

C.5 SUPPLEMENTAL INSURANCE REQUIREMENTS

C.6 52.237-2 PROTECTION OF GOVERNMENT BUILDINGS, EQUIPMENT, AND

VEGETATION (APR 1984)

C.7 VAAR 852.212-70 PROVISIONS AND CLAUSES APPLICABLE TO VA

ACQUISITION OF COMMERCIAL ITEMS (APR 2020)

C.8 VAAR 852.219-74 LIMITATIONS ON SUBCONTRACTING—MONITORING AND

COMPLIANCE (JUL 2018)

C.9 VAAR 852.237-70 INDEMNIFICATION AND MEDICAL LIABILITY INSURANCE

(OCT 2019)

C.10 52.212-5 CONTRACT TERMS AND CONDITIONS REQUIRED TO IMPLEMENT

STATUTES OR EXECUTIVE ORDERS—COMMERCIAL ITEMS (JUN 2020)

C.11 MANDATORY WRITTEN DISCLOSURES

SECTION D - CONTRACT DOCUMENTS, EXHIBITS, OR ATTACHMENTS

SECTION E - SOLICITATION PROVISIONS

E.1 52.212-1 INSTRUCTIONS TO OFFERORS—COMMERCIAL ITEMS (OCT 2018) 67

E.2 52.252-1 SOLICITATION PROVISIONS INCORPORATED BY REFERENCE (FEB

1998)

E.3 52.204-24 REPRESENTATION REGARDING CERTAIN TELECOMMUNICATIONS

AND VIDEO SURVEILLANCE SERVICES OR EQUIPMENT (DEC 2019)

E.4 52.209-7 INFORMATION REGARDING RESPONSIBILITY MATTERS (OCT 2018)

E.5 52.216-1 TYPE OF CONTRACT (APR 1984)

E.6 52.233-2 SERVICE OF PROTEST (SEP 2006)

E.7 52.212-2 EVALUATION—COMMERCIAL ITEMS (OCT 2014)

E.8 52.212-3 OFFEROR REPRESENTATIONS AND CERTIFICATIONS—

COMMERCIAL ITEMS (JUN 2020)

SECTION B - CONTINUATION OF SF 1449 BLOCKS

B.1 CONTRACT ADMINISTRATION DATA

1. Contract Administration: All contract administration matters will be handled by the following individuals:

a. CONTRACTOR: Please designate your point of contact here.

b. GOVERNMENT: Contracting Officer 36C241 John D. Harris

Network Contracting Office 1 (NE)

White River Junction VAMC

215 North Main Street

White River Junction VT 05009-0001

2. CONTRACTOR REMITTANCE ADDRESS: All payments by the Government to the contractor will be made in accordance with:

[X] 52.232-33, Payment by Electronic Funds Transfer—System For Award Management, or

[] 52.232-36, Payment by Third Party

3. INVOICES: Invoices shall be submitted in arrears:

a. Quarterly []

b. Semi-Annually []

c. Other [X] Monthly

4. GOVERNMENT INVOICE ADDRESS: All Invoices from the contractor shall be submitted electronically in accordance with VAAR Clause 852.232-72 Electronic Submission of Payment

Requests.

All Invoices from the Contractor shall be submitted electronically as per

VAAR Clause 852.232-72

Electronic Submission of Payment Request http://www.fsc.va.gov/einvoice.asp

ACKNOWLEDGMENT OF AMENDMENTS: The offeror acknowledges receipt of amendments to the Solicitation numbered and dated as follows:

AMENDMENT NO DATE

B.2 PERFORMANCE WORK STATEMENT (PWS)

VISN1 Real Time Location System (RTLS) Maintenance and Operation

1. BACKGROUND

Veterans Integrated Service Network 1 (VISN1) has installed a standardized RTLS systems at all major sites (see Table 1) to better enable the VA to manage and track assets. RTLS solutions address many of the

VA’s needs by providing additional capabilities beyond barcoding and can result in design process improvements for higher quality patient care, reductions in staff hours spent searching for equipment, and the ability to maintain effective inventory levels.

To enable this RTLS system, hardware and multiple software applications are integrated at the VISN-level to form a VISN1-wide standard of technology and capability. This standardization process included the use of Intelligent Insites (Asset Tracking Application) and Centrak (Location Services Technology) as two core components. The RTLS system in place is an enterprise solution for VISN1 in both standard of technology and meets VA policies.

2. SCOPE OF SERVICES AND SUPPLIES SOUGHT

VISN1 seeks to obtain RTLS maintenance and operation services and supplies at locations shown on Table

1 through a single-award, 1 Purchase Order (PO). The Contractor shall be able to provide the routine services and supplies, as well as be capable of updating RTLS application configurations that come about due to changes caused by minor construction projects (such as a floor or wing renovation) or major construction (such as a new building on campus).

The successful offeror shall be able to meet the required specifications of the RTLS infrastructure that provides the current VISN1 standard. Offerors that seek to replace the existing standard with another will be found non-responsive. Additional, related work may be ordered off the resulting PO without further competition at the discretion of the Contracting Officer (CO).

The Contractor shall provide RTLS Operation and Maintenance (O&M) services and supplies, inclusive of

RTLS application client and server software, operating system maintenance, operational support services, supplies, and hardware in accordance with the terms detailed in the PWS below.

To help formulate pricing, please see the Estimated Item Quantities spreadsheet in Section D.

2.1 PLACE OF PERFORMANCE

This requirement covers RTLS components located in the VAMCs and RDC as indicated in Table 1.

Services may be performed on-site as well as remotely, as appropriate.

Table 1. VAMC and Regional Data Center Locations

VA Maine Healthcare System

1 VA Center

Augusta, ME 04330

Bedford VA Medical Center

200 Springs Road

Bedford, MA 01730

VA Connecticut Healthcare System

West Haven Campus

950 Campbell Ave

West Haven, CT 06516

VA Boston Healthcare System

Jamaica Plain Campus

150 South Huntington Ave

Jamaica Plain, MA 01230

Providence VA Medical Center

830 Chalkstone Ave

Providence, RI 02908

Secaucus Regional Data Center

105 Enterprise Ave South

Suite 1144

Secaucus, NJ 07094

Manchester VA Medical Center

718 Smyth Road

Manchester, NH 03104

VA Central Western

Massachusetts

421 North Main Street

Leeds, MA 01053

VA Connecticut Healthcare System

Newington Campus

555 Willard Ave

Newington, CT 06111

2.2 SYSTEM ARCHITECTURE OVERVIEW

The RTLS architecture is divided into two component groups: VAMC and RDC components groups. The general scope of RTLS is outlined in the RTLS architecture depicted in Figure 1 below.

Figure 1. Scope of RTLS Sustainment

The RTLS sustainment services are inclusive of the components depicted in the VAMC and RDC component group. This includes CenTrak and Intelligent InSites (AT) components. Common infrastructure to be supported includes items required to operate Single Sign-On (SSO) and F5 load balancer

(configuration only). The complete list of software to be supported is specified in Tables 2.

The RDC component group includes all RTLS backend server components located in the RDC, including select communication interfaces to external systems.

The two RTLS component groupings at the VAMC and RDC are interdependent. As such, operations and maintenance efforts are coordinated with the Contracting Officer’s Representative (COR) at the VISN level, the COR(s) at the individual VAMCs, and other VA entities as specified by the CO and COR. This coordination is critical to assist with isolating issues for full resolution.

RTLS HARDWARE

RTLS computing hardware is provided in the form of two rack mounted suites at the RDC (see Figure 2).

RTLS data center software runs in a VMware environment, with VMs being hosted in a blade server environment with multiple 2.5GHz, Intel Xeon CPU processors, or other equally capable hardware. RTLS

SDD 8.0 specifies the use of HP C7000 enclosure and ProLiant Gen8 blades, although these may be substituted for equally capable hardware.

VISN DataCenter RTLS 42U rack

C7000 Enclosure

1 U

10 U

1 U F5 LTM 1600 LoadBalancers (2)

1 U 1 U SAN Switch (2)

V VM Farm (2) Oracle Weblogic Shared Prod/Test

V VM Farm (6) Shared Prod/Test

L Oracle DB (2) Shared Prod/Test

HP

StorageWorks

MSA2000

Model 2012fc

G2

2 U

HP

StorageWorks

MSA2000

Model 2012fc

G2

P2000/3 FC/iSCSI

MSA

Existing Datacenter services

AD

DNS servers SNMP server to forward email NTP server

2 U

VISN DataCenter RTLS new 42U rack

P2000/3 FC/iSCSI

MSA

HP

StorageWorks

MSA2000

Model 2012fc

G2

HP

StorageWorks

MSA2000

Model 2012fc

G2

HP

StorageWorks

MSA2000

Model 2012fc

G2

HP

StorageWorks

MSA2000

Model 2012fc

G2

HP

StorageWorks

MSA2000

Model 2012fc

G2

HP

StorageWorks

MSA2000

Model 2012fc

G2

HP

StorageWorks

MSA2000

Model 2012fc

G2

HP

StorageWorks

MSA2000

Model 2012fc

G2

2 U

2 U

2 U

2 U

2 U

2 U

2 U

Figure 2. RDC Hardware

RTLS VAMC software runs in a VMware environment (See Figure 3), with VMs being hosted in a blade server environment. RTLS SDD 8.0 specifies the use of ProLiant Gen8 rack mounted servers, although these may be substituted for equally capable hardware.

Per-Site At-Site existing rack space Per-Site At-Site existing rack space

Per-Site At-Site existing rack space

1 U VMWare Linux Kernel

Farm (2) 1 U

HP

StorageWorks

MSA2000

Model 2012fc

G2

P2000/3 SAS MSA

1.5 TB

Figure 3. VAMC Hardware

2.3 SERVICES AND SUPPLIES REQUIRED

The items needed include the following functions:

• Preventive Maintenance: The post-operation, proactive modification of RTLS products to detect and correct latent operating defects or conditions before they become effective faults.

• Corrective Maintenance: The reactive maintenance performed to identify, isolate, and rectify RTLS operating faults.

• Adaptive Maintenance: The performance of modifications required to keep RTLS operations viable and products usable in a changing environment.

These tasks are further detailed below.

RTLS SUSTAINMENT EFFORT

The Contractor shall provide O&M sustainment services for the RTLS production and pre-production environments. O&M sustainment services shall be provided for the software components identified below, including operating system patches/upgrades, RTLS software component patches/upgrades, network administration, software license installation, system configuration changes, and virtual machine reboots.

Table 2. Software Components Covered Under this Task Order

Products RTLS Current Version

CenTrak Buffer Server 3.6.17

CenTrak Connect 5.14.20

CenTrak Pulse (formerly GMS) 9.2.0.11

Intelligent InSites (Connector, Platform, BI, NSSM) Connector, Platform, BI 4.7.4

NSSM 2.24.x

Java JDK 7u111

Java SE SE1.6

Keepalive 1.2.13x

PostgreSQL 9.6.3

Microsoft Internet Information Services (IIS) 7.5

Microsoft .NET Framework 3.5 and 4.6

Microsoft SQL Server 2012

(SQL Always-on configuration)

2012 SP4

MonetDB 11.19.9

MySQL 5.6.30

Oracle WebLogic Server

(Clustered) 10.3.6

RabbitMQ 3.5.4

Red Hat Enterprise Linux 6.9 or 7.0

WildFly – JBoss: App Server (IAM) 8.2.1

Windows Server

2008 R2 SP1

2012 R2

The RTLS sustainment effort includes all the updates, patching and maintenance, particularly for preventive and corrective maintenance on each of the RTLS constitute system capabilities, which include AT. As illustrated in the architecture above, RTLS has a number of shared backend services and interfaces to external systems.

RTLS programs that interface with external systems are software solutions orchestrated by a series of

Enterprise Service Bus (ESB) flows. To support RTLS these interfaces, the VA uses MuleSoft, a lightweight, open source ESB and integration framework that implements a communication messaging system between mutually interacting software applications. It is a Java-based ESB and integration platform to facilitate message routing and data transformation. Within the ESB flows, RESTful web services are employed on both ends to facilitate communication. Communication with VistA is managed with a series of RESTful web service methods designed for the RTLS Enterprise solution called Vista Service.

Provision of RTLS interfaces are outside the scope of this PWS. However, troubleshooting the interface middleware and servers that run the interface software (such as MuleSoft ESB, and VistAService’s

Weblogic) is a key task for the Contractor.

RTLS software is highly virtualized, with software components spread across multiple virtual machines running on VA-provided hardware. A load balancer directs traffic to different RTLS servers, the number of which varies depending on the size of the VISN and individual VAMCs’ usage. To prevent outages, a high availability model is used to failover Virtual Machines (VM) and Storage Area Network (SAN) components. The list of virtual servers broken out by function is included as Government Furnished

Information as RTLS Virtual Server List by Function.

RTLS DEPLOYMENT

The RTLS sustainment effort will support O&M of the production and pre-production environments at the

RDC. This includes applying patches and upgrades just as with the production environment. The sustainment effort will also verify the function and stability of upgrades in all environments prior to advancing to operational deployment into the production environment. This will include regression testing sufficient to verify basic functionality (e.g., login, search, asset tracking, reporting, accurate monitoring and synchronization of inventory).

This RTLS Sustainment PWS does not include software development (which is defined as Contractor modification to the baseline codebase of a product).

TECHNICAL EXPERTISE

In performance of the tasks in this PWS, the Contractor shall use and have expertise or certification as necessary in the following software and technologies:

Table 3. RTLS Technology

Technology Technology

Microsoft SharePoint 2010, 2013 or later

SharePoint versions, and related technologies

XML, XSL, XSLT

SQL Server 2012

Reporting tools including SQL Server Reporting

Services (SSRS)

SQL Server Analysis Services (SSAS)

SQL Server Integration Services (SSIS)

Splunk

Nagios

Red Hat Linux system administration

Intelligent InSites

Wavemark

CenTrak

Oracle databases

MonetDB

MySQL

Java JDK/SE

RabbitMQ

VA Technical Reference Model (TRM)

VMWare

Windows System Administration

PROJECT MANAGEMENT

The Contractor shall identify a single Point of Contact (POC) to oversee the management of the IDIQ and resulting TOs in VISN1. The POC shall be responsible for:

Effectively communicating and providing timely project progress status to VA and Contractor team members using the progress reports.

Ensuring the submission of contract deliverables

Coordinating, escalating, and resolving Contractor-related project issues.

Representing the Contractor in status meetings.

Complying with VA’s change management process.

REPORTING REQUIREMENTS

The Contractor shall manage the RTLS Sustainment work effort and provide a Monthly Activity Report.

These reports shall convey the status of Task Order performance. A standard format will be provided by

VA and shall be utilized for submission of required information. Required information includes:

1. All planned or scheduled maintenance that will occur in the next reporting period, including patches, OS upgrades, and hardware replacements.

2. Maintenance activity log showing all patches / upgrades / licenses installed, failures and faults detected, system performance deviations, including security vulnerabilities identified by VA from the monthly Nessus and on demand Oracle and SQL Server database scans, and the operational time to restore.

3. Customer support log which shall include a description of all support issues identified, severity level, and how the issues were resolved.

4. Corrective actions taken and status, whether closed or open.

5. Anticipated closure date and roadblocks (if any) for open items.

6. All known significant issues or risks.

7. A summary of all closed and completed items.

WEEKLY STATUS MEETING

The Contractor shall hold a weekly status meeting with the VISN COR and VAMC COR(s) to discuss all the items identified in Monthly Activity Report and other issues as identified by the COR(s). The

Contractor shall provide weekly status meeting minutes to all attendees within three (3) business days after the meeting.

TECHNICAL KICKOFF MEETING

The Contractor shall attend a technical kickoff meeting within 10 days after PO award with designated VA personnel. The kickoff meetings are intended to facilitate phase-in transition planning and execution of the

PO, open communication channels with key personnel at the VAMCs, and identify any issues that may arise as early as possible for timely resolution.

The Contractor shall present for review and approval by the VA the details of the intended approach, work plan, and project schedule for each effort. Key information to be covered includes:

1. Reviewing legacy program documentation, product backlogs, user stories, and performance metrics and statistics.

2. Roles and Responsibilities of key personnel.

3. Transition coordination to confirm demarcation of responsibilities and interface points for performance of work elements.

4. Risks and associated risk mitigation plans.

5. Summary and schedule for Government-required training, clearance, and certification process.

PREVENTIVE MAINTENANCE

The Contractor shall deploy software updates and upgrades in the execution of RTLS preventive maintenance tasks. Additionally, the Contractor shall maintain and modify infrastructure system configurations to address functionality, security, connectivity or load issues. Most RTLS application minor updates are released once or twice a year, while major updates are done annually. Updates to any individual application may vary in a given period of performance but will collectively average out over time.

For RTLS preventive maintenance, the Contractor shall:

1. Perform modifications to RTLS software installations and operational configurations to maintain and improve system performance, and to detect and correct latent faults in software and hardware products before they become operative faults. A latent defect or condition is one that is present but hidden from regular means of detection or yet to have an operational impact. An operative or effective fault is a fault activity impacting nominal system operations or business functionality.

2. Monitor the performance of the RTLS system, including system resources such as processor, memory and disk utilization. The Contractor shall verify that performance thresholds are within nominal operating range and take corrective action necessary to mitigate or relieve RTLS performance deviations and respond proactively to actionable alert and threshold notifications. The

Contractor shall log and notify VA of any performance deviation, and any known or suspected rationale for the deviation in the Maintenance Activity Log as part of the Monthly Activity Report.

3. Engage in an ongoing inspection of RTLS to identify operative and latent defects in RTLS functions, software scripts, and software and hardware configuration. The Contractor shall make actionable recommendations that address any defects detected. Recommendations shall be relayed to the COR by email or vocally and also documented in the Maintenance Activity Log as part of the Monthly

Activity Report.

4. Coordinate with appropriate COR(s) to schedule patch / upgrade installations. This may take place outside of regular business hours.

5. Identify, download, and manage the installation of RTLS application software patches and upgrades.

6. Coordinate with COR(s) to shut down, reboot, or restart RTLS systems (e.g., Intelligent InSites, CenTrak, Wavemark) and RTLS supporting Systems (e.g., SSOi), following VA or RTLS IT maintenance, recovery, or software patching.

7. Proactively download Linux patches and upgrades from a server identified by VA, install those patches, and reboot the patched VMs.

8. Verify correct operation of RTLS after every patch installation.

9. If operating system patches are shown to interfere with RTLS operation, coordinate with VA POCs identified by the COR before backing out any operating system patch(es).

10. Provide RTLS network administration support to include maintenance of the application connection ports, firewall, load-balancer, Secure Socket Layer Off-loading, and Single Sign-On Integration

(SSOi) requirements and configurations.

11. Proactively replace non hot-swappable hardware (e.g., hard drives, motherboards) when it is in imminent danger of failure, based on alert notification from Nagios or other system and component monitoring tools.

12. Administer RTLS subsystem databases. This includes addressing database security remediation, capacity planning, performance monitoring, troubleshooting, modification of database tables, allocating additional space and archiving/purging data as required by the COR(s). Coordinate with

COR(s) if new storage hardware is added to configure new storage space for database use. VA IT will coordinate the granting of administrator privileges to Contractor staff to carry out database administration.

SOFTWARE UPDATES, UPGRADES AND ADMINISTRATION

The application components of RTLS are hosted on platforms that contain VA standard operating systems, virtual machines, and ancillary software. The Contractor shall be responsible for identifying and downloading updates. Some of the software listed in Tables 2 are sub-components of the RTLS application software. The maintenance updates and upgrades to VA standard environments are the responsibility of VA

Office of Information & Technology (OIT). For RTLS software updates or upgrades, the Contractor shall:

1. Perform the installation, configuration, update (patching operational software) and/or upgrade

(replacing or supplementing the software baseline) of RTLS software to mitigate the development of future faults, correct latent faults (present but hidden from routine (i.e., non-extraordinary) means of detection), rectify operative faults, restore nominal operations, or enhance component and system performance/capacity. For RTLS application software, the Contractor may expect approximately one major update and 2-3 minor updates a year. Linux patches are issued by VA monthly. The Contractor shall coordinate with COR(s) to schedule installation before the next set of patches becomes available

(less than 30 days). For RTLS application patches, the Contractor shall coordinate with COR(s) to schedule installation within 30 days from when the software update is available. If issues are encountered, this timeframe may be extended with agreement from the COR.

2. Notify COR three (3) weeks in advance of installing new RTLS application releases or upgrades or any other disruptive maintenance activity in any environment. The Contractor shall delay or terminate any planned update or upgrade, at the direction of the appropriate COR(s).

3. Perform the installation of software patches, new releases and software updates in the pre-production environment. New releases and upgrades may provide new functionality as well as any needed system corrections.

4. Ensure that the installation, operation, maintenance, updating, and patching of software shall not alter prior configuration settings or those from the VA-approved configuration.

5. Verify the function and stability of upgrades in all environments (subject to the connectivity limits of those environments) prior to advancing to operational deployment into the production environment. This will include regression testing sufficient to verify basic functionality (e.g., login, search, asset tracking, reporting, accurate monitoring and synchronization of inventory).

6. Perform routine RTLS system administration functions and serve as system administrator for all

RTLS applications. In addition to system patches and updates, the Contractor shall monitor system logs and resource utilization, and archive system data and audit logs as needed.

7. Provide written notice to COR(s) that each patch has been validated as not affecting the Systems within 10 working days when security fixes involve installing third party patches in pre-production

(such as Linux Red Hat). Notification shall come in the form of an email to the COR.

8. Provide VA any necessary information to update the One-VA TRM entry for any software components updated.

9. Contractor shall provide supporting data as requested by the COR to complete VA IT requests such as Authority to Operate (ATO) and TRM waivers.

HARDWARE UPDATES AND UPGRADES

The VA wireless infrastructure upon which RTLS depends, is updated, upgraded and maintained by VA

OI&T, including wireless access points, as well as the Cisco Mobility Services Engine (MSE). For RTLS

Hardware (HW) updates or upgrades, the Contractor shall:

1. Perform the provisioning, installation, configuration, update, or upgrade of RTLS hardware to mitigate the development of future faults and maintain nominal system performance or capacity. The term provisioning refers to the planned allocation and distribution of available or acquired hard assets.

2. Develop recommendations for the replacement or substitution of RTLS hardware components in the

RTLS System, as necessary to prevent faults or sustain performance thresholds.

3. Develop requisition requests and documentation for the procurement of additional RTLS software and hardware necessary to sustain RTLS functional capabilities at nominal levels. The CO and VISN

COR shall provide guidance on how the recommendations may be implemented.

4. Execute the provisioning and installation of substitute RTLS components into the operational RTLS system, upon the authorization of the VISN COR.

SOFTWARE LICENSE INSTALLATION

All RTLS software licenses will be purchased by VA and given to the Contractor for installation and use when required. For RTLS software license installation, the Contractor shall:

1. Receive from the VISN COR available license renewal data.

2. Install RTLS licenses, upon the authorization of the VISN COR. Licenses to operate RTLS software applications at the RDC are listed in Table 2 (Software Components Covered Under This Task

Order).

CORRECTIVE MAINTENANCE

Corrective Maintenance is the reactive maintenance performed to identify, isolate, and rectify RTLS operating faults. Corrective Maintenance is applicable to both RTLS software and hardware. For RTLS corrective maintenance, the Contractor shall:

1. Perform troubleshooting to identify and isolate faults causing any failure or degradation of service in RTLS software and hardware components and systems.

2. Execute RTLS backup procedures in the event of RTLS primary software and hardware component service failures.

3. Execute the appropriate RTLS recovery procedures following the restoration of RTLS primary services from a partial or full system failure. Restoration shall include resumption with all data and capabilities available prior to the backup inducing event, and restoration to nominal operational state of RTLS hardware devices, including hard drives, component boards and processing units.

4. VA will perform Federal Information Security Management Act (FISMA) compliance audits and

Nessus scans monthly, and the Contractor shall address and resolve all security remediation and vulnerabilities identified within the timeframe specified below, starting from notification of findings.

VA maintains a tracking database for all security scan findings and compliance audits. The

Contractor shall update that database to indicate the status of issue resolution and/or the plan to resolve issues that will take longer to resolve, in case of delays beyond the Contractor’s control (e.g., a VA delay or vendor dependency for software patches). Based on historical data, the Contractor may expect approximately 10 new findings per month (1/8 critical priority, 1/2 high priority, 3/8 medium priority).

a. Critical – patches shall be tested and applied within 30 days

b. High – patches shall be tested and applied within 60 days

c. Moderate – patches shall be tested and applied within 90 days

d. Low – the System owner will determine the patching timeframe

e. Emergent – patches shall be tested and applied as soon as possible

5. Respond to and resolve notifications that RTLS servers, software, and hardware are down or inoperable.

6. Non hot-swappable components shall be included as part of the contract for equipment located at the

RDC. For hot-swappable components at the RDC, a separate contractor performs the swaps. The

Contractor shall provide and replace failed hardware components that are not hot-swappable and restore/configure the new hardware to the previous working condition at the RDC. Failed hardware components for equipment at the VAMCs are not be included in this requirement. Failed components will be replaced by and labor required will be provided by individual VAMCs, unless otherwise specified by this PWS. Monitoring of equipment and notification of failed parts to the COR(s) at the

RDC and individual VAMCs are included in the requirement.

7. Troubleshoot, isolate, and repair connectivity and communication issues for data presented to or received from the Mule ESB. Resolution of these issues may require coordination with other POCs as identified by the COR(s).

8. Coordinate with VA OIT to obtain the status of the VA wide area network (WAN) and wireless infrastructure upon which RTLS depends to determine the operational impact on RTLS. The

Contractor shall obtain information on WAN and wireless updated, upgraded, and maintenance performed by VA OI&T. OIT maintenance includes wireless access points and Cisco Mobility

Services Engine (MSE).

9. Perform the provisioning, installation, configuration, update or upgrade of RTLS hardware to correct latent faults, rectify operative faults, and restore nominal operations. The term provisioning refers to the planned allocation and distribution of available or acquired hard assets.

10. Develop recommendations for the replacement or substitution of RTLS hardware components in the RTLS System, as necessary to resolve faults, restore performance or enhance performance.

11. Execute the provisioning and installation of substitute RTLS components into the operational

RTLS system, upon the authorization of the VISN COR at the RDC. VA IT will perform this function at the VAMCs.

ADAPTIVE MAINTENANCE

VISN1 has already procured and installed RTLS solutions at the RDC and VAMCs. As part of the system sustainment efforts, the Contractor shall have the capability to update the items and areas tracked, as detailed below:

1. Execute modifications or supplementation of RTLS software maps and software/ hardware configurations that adjust RTLS functions and operations to a new or modified deployment environment. The deployment environment may be modified because of new construction, changes to facility floorplans, or changes to the business use of facilities, rooms and other assets using RTLS.

The VA will provide new drawings. The Contractor shall verify that modifications or supplementations are following VA RTLS Deployment Standards (Attachment E). Contractor shall provide Intelligent Insites software configuration, such as regioning of map, map rendering, and preparation work for locations. Contractor shall provide Centrak software configuration, hardware installation, and verification. The contractor shall implement Centrak approved fingerprinting technology. The Contractor shall coordinate all activities in each system and the integration of data between systems.

2. The Contractor shall obtain VISN COR authorization prior to implementing any RTLS modification or supplementation steps. The Contractor shall update the Facility Hardware Deployment Design

Document Attachment A and Certified Space File (CSF) (Attachment A).

CUSTOMER SUPPORT

The Contractor shall work to resolve issues identified by the appropriate COR(s). The COR(s) and local staff from Clinical Engineering will perform initial review of all issues, and if they are unable to resolve the issues, will submit a help desk support ticket for escalation. The source of these issues may be Tier 2 or

3 trouble tickets. During regular business hours (7am to 7pm Eastern), the Contractor shall:

1. Respond to service requests from COR or designee (via telephone or email) to resolve or support the troubleshooting, identification and resolution of RTLS technical requests which involve RTLS components at the RDC. The Contractor shall log all requests that are received in the Maintenance

Activity Log as part of the Monthly Activity Report.

2. Classify all service request received by assigning a severity level, in accordance with Table 4 below. It is expected (but not guaranteed) that the Contractor may anticipate 2-3 service requests per month, typically of the Non-Critical and Important severity.

3. Coordinate with the COR(s) if access to resources at a VAMC are required to fully diagnose or resolve an issue and work collaboratively with the POC(s) identified by the COR to resolve issues within RDC boundaries as depicted in Figure 1 (shown previously in PWS). RTLS malfunctions may originate within RDC boundaries, outside RDC boundaries, or both, if the RDC components have a dependency on external RTLS components (i.e., RTLS components at a VAMC).

4. Collaborate with any identified POCs to cooperatively troubleshoot and resolve issues.

5. Provide issue resolution response to resolve faults and requests, in accordance with the response timeline provided in Table 4 below. Issues, status, and resolution notification shall be communicated to the appropriate COR(s).

6. Document all customer support issues in the Customer service log, a component of the Monthly

Activity Report.

7. Develop and submit service requests to COR-identified POCs to request OIT support services to resolve RTLS faults and other operating problems caused by components outside the maintenance responsibility of this TO.

Table 4: Event Response Time Intervals

Severity Code Impact Initial

Response to

Customer

Resolution

Time

1 - Critical Complete work stoppage. Critical Service

Request

30 minutes 4 hours

2 - Important Inability to perform a job function. Important

Service Request

1 hour 10 hours

3 - Non-critical Low/No Impact (Able to perform work functions) Non-critical Service Request

16 hours 80 hours

DOCUMENTATION OF STANDARD OPERATING PROCEDURES

For the RTLS Standard Operating Procedures (SOP), the Contractor shall:

1. Develop, periodically update, and submit for review a RTLS Sustainment SOP that describes the

Contractor’s RTLS SOP to the COR. The content of the SOP shall be inclusive of operations and maintenance procedures, configuration and change management, systems recovery point objectives, record maintenance, and performance metrics to be monitored and reported.

2. Adhere to the procedures documented in the SOP, once approved by the VISN COR.

Deliverable: RTLS Sustainment Standard Operating Procedures

2.4 GENERAL SECURITY REQUIREMENTS

The Contractor shall comply with VA security, privacy and records management policies, directives, handbooks, and guidelines.

INFORMATION SECURITY, PRIVACY AND RECORDS MANAGEMENT

Contractors and subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA personnel regarding information and information system security.

ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS

1. The Contractor shall request logical or physical access to VA information and VA information systems for their employees, subcontractors, and affiliates only to the extent necessary to perform the services specified in this contract or supplemental agreement.

2. All Contractors and Affiliates supporting this contract must be in the continental U.S.

3. Background security investigations for contractors must be in accordance with VA Directive and

Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures. Verification of a Security

Clearance must be processed through the Special Security Officer located in the Planning and

National Security Service within the Office of Operations, Security, and Preparedness.

4. The Contractor must notify the Contracting Officer immediately when an employee or subcontractor employee working on a VA system or with access to VA information is reassigned, leaves the contractor or subcontractor's employ, and/or prior to an unfriendly termination.

VA INFORMATION CUSTODIAL LANGUAGE

If VA determines that the Contractor has violated any of the information confidentiality, privacy, and security provisions of this contract, it shall be sufficient grounds for VA to withhold payment to the

Contractor and to terminate the contract for default or terminate for cause.

If a VHA contract is terminated for cause, all Business Associate Agreement (BAA) must also be terminated and appropriate actions taken in accordance with VHA Handbook 1600.05, BAAs. Absent an agreement to use or disclose protected health information, there is no business associate relationship.

For Contractor custodial responsibilities, the Contractor shall:

1. Store, transport, or transmit VA sensitive information in an encrypted form, using a FIPS 140-2 compliant solutions.

2. Have access to privileged and confidential materials of VA. These printed and electronic documents are for internal use only, are not to be copied or released without permission, and remain the sole property of VA.

3. Release no VA information. Any request for information presented to the Contractor shall be submitted to the VA Contracting Officer for response. The CO will be the sole authorized official to release any data, draft deliverables, final deliverables, or any other documentation or materials pertaining to this contract.

SECURITY INCIDENT INVESTIGATION

The Contractor shall cooperate with authorized Government offices concerning facility access, audits, security incident notification, and hosting location. Specifically, the Contractor shall:

1. Immediately and simultaneously notify the COR, designated ISO, and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/ subcontractor has access, and the discovery or disclosure of successful exploits of the vulnerability which can compromise the security of the Systems. For the purposes of this PWS, an incident is defined as an occurrence that (a) jeopardizes the confidentiality, integrity, or availability of an information system,

(b) jeopardizes the information being processed, computed, stored, or transmitted, or (c) anything that constitutes an imminent or occurring threat of violation of security policies, security procedures, acceptable use policies, or Agency data sharing agreements.

2. Report to the appropriate law enforcement entity, instances of theft or break-in or other criminal activity, including the VA OIG and Security and Law Enforcement.

3. Cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of possible criminal law violation(s) associated with any incident. The Contractor shall also cooperate with VA in civil litigation to recover VA information, obtain monetary or other compensation from a third party for damages arising from any incident, or obtain injunctive relief against third party arising from, or related to, the incident.

4. Cooperate with all audits, inspections, investigations, or other reviews conducted by or on behalf of the CO or other authorized Government offices as described in prior subparagraphs. Cooperation includes, but is not limited to, prompt disclosure of requests of data, information, and records about any audit, inspection, investigation, or review and making employees of the Contractor available for interview by auditors, inspectors, and investigators within ten (10) business days from such request, unless otherwise directed by the OIG.

5. Preserve such data, records, logs and other evidence reasonably necessary to conduct a thorough investigation of any computer security incident.

INFORMATION SYSTEM MAINTENANCE

For Information System Maintenance, the Contractor shall:

1. Include this Privacy Act clause, including this subparagraph (3), in all subcontracts awarded under this contract which requires the operation of such a SOR.

a. In the event of violations of the Act, a civil action may be brought against the agency involved when the violation concerns the operation of a SOR on Individuals. Criminal penalties may be imposed upon the officers or employees of the agency when the violation concerns the operation of a SOR on individuals to accomplish an agency function. For purposes of the Act, when the contract is for the operation of a SOR on individuals to accomplish an agency function, the Contractor is considered to be an employee of the agency.

i. "Operation of a System of Records" means performance of any of the activities associated with maintaining the SOR, including the collection, use, maintenance, and dissemination of records.

ii. "Record" means any item, collection, or grouping of information about an individual that is maintained by an agency, including, but not limited to, education, financial transactions, medical history, and criminal or employment history and contains the person's name, or identifying number, symbol, or any other identifying aspect assigned to the individual, such as a fingerprint.

iii. "System of Records" means a group of any records under the control of any agency from which information is retrieved by the name of the individual or by some identifying number, symbol, or other identifying aspect assigned to the individual.

2. Safeguard the security of all technologies being maintained, including their subcomponents

(hereinafter referred to as "Systems"), throughout the life of this contract and any extension, warranty, or maintenance periods. This includes, but is not limited to workarounds, patches, hotfixes, upgrades, and any physical components (hereafter referred to as Security Fixes) which may be necessary to fix all security vulnerabilities published or known to the vendor anywhere in the

Systems, including Operating Systems and firmware. The vendor shall ensure that Security Fixes shall not negatively impact the Systems beyond known OEM Operating thresholds.

SECURITY CONTROLS COMPLIANCE TESTING

On a periodic basis, VA, including the OIG, reserves the right to evaluate any or all the security controls and privacy practices implemented by the contractor under the clauses contained within the contract. With ten (10) working-days’ notice, at the request of the government, the contractor must fully cooperate and assist in a government-sponsored security controls assessment at each location wherein VA information is processed or stored, or information systems are developed, operated, maintained, or used on behalf of

VA, including those initiated by the OIG. The government may conduct a security control assessment on shorter notice (to include unannounced assessments) as determined by VA in the event of a security incident or at any other time.

SECURITY AND PRIVACY AWARENESS TRAINING

All Contractor employees and subcontractors requiring access to VA information and VA information systems shall complete VA security and privacy training before being granted access to VA information and its systems. The Contractor shall:

1. Sign and acknowledge (either manually or electronically) understanding of and responsibilities for compliance with the Contractor Rules of Behavior, Appendix E relating to access to VA information and information systems.

2. Successfully complete the Privacy and Information Security Awareness and Rules of Behavior

(TMS# VA10176), Privacy and HIPAA Training (TMS# VA10203), any additional cyber security or privacy training required for VA personnel with equivalent information system access, and any role-based information security training required in accordance with NIST Special Publication 800-

16, Information Technology Security Training Requirements.

3. Provide to the CO and/or the COR a copy of the training certificates and certification for each applicable employee within ten (10) business days of onboarding in the VA Talent Management

System (TMS), and annually thereafter for the life of the Contract.

4. Failure to complete the mandatory annual training and sign the Rules of Behavior annually, within the timeframe required, is grounds for suspension or termination of all physical or electronic access privileges and removal from work on the contract until the training…