36C24819Q0124-003.pdf

Statement Of Work Migration to Resource Scheduler on Demand

The Department of Veterans Affairs, VISN 8, James A. Haley VA Medical Center (JAHVH), 13000 Bruce B. Downs, Tampa, FL, 33612 currently uses Meeting Room Manager and want to migrate to Resource Scheduler On Demand. The general approach would be to establish a hosted RS environment and migrate the resource and reservation data for testing and training purposes. Once User Acceptance Testing is complete, this system will become the production scheduling system for James A. Haley Veterans’ Hospital. This requirement will be for a base year and four option years. Asure Software Inc, is the owner and provider for Resource Scheduler software currently being requested for migration by the James A. Haley VA Medical Center, Tampa Florida.

GENERAL TIMELINE

High level timeline for reference and context:

Tasking Activity Estimated Target Date Ranges

PHASE 1 – Environment setup

• Project Charter Defined &

Documented upon contractor’s receipt of Government’s executed Purchase Order document

Week 1

• Project Plan created Week 2

• RS Instance created in RSOD

Environment

2 weeks after PO received

• Data migrated ready for testing Week 3 – 4

• Training, Configuration and Review

Week 4 – 5

• Testing period Week 5 – 6

• Assist with Communications & Training Plans

• Conduct Review and Assess Readiness for Phase 2

Week 5 – 6

Week 7

PHASE 2 – GO-LIVE IN PRODUCTION

System clear down and final data migration Testing to confirm migration and go-live readiness

Week 8

Week 8

Go-live with Resource Scheduler Week 8 Close project Week 10

Program Service Requirements:

• The JAHVAH will managed the overall project for the program .

• All services will be delivered remotely by Asure consultants rather than on-site and the exact schedule will be agreed at the start of the project. Where within James A. Haley Veterans’ Hospital’s security policy, remote access should be granted through VPN connection to the Resource Scheduler web links. However, access can also be provided via online meeting such that James A. Haley Veterans’ Hospital personnel can share desktops with Asure consultants.

• All configuration of the resources will be carried out by James A. Haley Veterans’ Hospital with support from Asure. Professional Services consultants who will work with the James A.

Haley Veterans’ Hospital project team through training and mentoring to bring this task fully in-house.

• Where integration is required James A. Haley Veterans’ Hospital’s back-end systems, James A. Haley Veterans’ Hospital’s IT will provide all required information and data files and, where appropriate, will follow configuration guidelines given by Asure.

• Integration between Resource Scheduler and Outlook Exchange will be through an Outlook plug-in for Outlook 2013 and 2016.

• Deployment of the Outlook plug-in is the responsibility of the of the Tampa VA.

• Training in resource administration will be provided. Use of the online training resources in the Asure Software James A. Haley Veterans’ Hospital Support Portal is encouraged.

Additional training days can be purchased if required.

• All end user training will be carried out by James A. Haley Veterans’ Hospital administrators who will also be the first point of contact for user enquiries during the initial stage of the implementation. It is recommended that a “Hot Line” is specifically set up for this purpose.

• For meeting room images, James A. Haley Veterans’ Hospital will provide a suitable graphic image (.JPG or .GIF format) of each meeting room should it be required for the image to be shown in the room details.

2. Data Migration Details:

LOCATION/GROUP STRUCTURE

The Resource Scheduler tree structure must be built out manually prior to the migration of MRM data as the underlying architecture is different.

USER GROUPS (SECURITY)

The Resource Scheduler Security Group structure must be built out manually prior to the migration of MRM data as the underlying architecture is different.

ROOMS

Only Core Room Data will be migrated i.e. Meeting Room (name)

(Mapped) Location

Room Capacity Resource Type

USERS

Only Core User Data will be migrated i.e. Username Full Name Email Default Location

RESERVATIONS

Only core data from future reservations up to 24 months ahead are migrated i.e. Meeting Start Date Time Meeting End Date Time Setup & Teardown time Meeting Title (truncated to 60 chars) Room Creator Meeting Host Number of Attendees

ADDITIONAL REQUIRMENTS:

• No recurrence patterns, all Meetings migrate over as individual Reservations.

• No Services are able to be migrated.

• No Assets are able to be migrated

• All Migrated Users will be mapped to 'Everyone' Security Group.

• MRM Outlook appointments will not be accessible via RSO add-ins

• Local Passwords cannot be migrated with User Data as those are stored one-way-hashed.

Temporary Passwords will be generated to prevent unauthorized access to MRM.

3. Project Objectives

Objectives Description

3. Project Objectives

Objectives Description Priority

Project Charter and Schedule 1 Prepare the RS environment, including RSO and migrate data

Complete full user acceptance testing 1 Complete final reservation migration 1

4. Scope and Approach

Scope:

James A. Haley Veterans’ Hospital would like to migrate to Resource Scheduler. In addition to assisting with the technical migration, Asure Software Professional Services will assist in reviewing configuration to ensure that current functionality and work flows can be maintained and to take advantage of all features of Resource Scheduler.

4. Consulting Services

Asure Software will deliver consulting assistance during the project as required, per the description below:

Deliverable

Planning Description of Deliverable

Initialize & Plan Plan, conduct and document the Pre-Deployment Planning Meeting. Meeting with the teams and RS subject matter experts, via web conference. James A. Haley Veterans’ Hospital will coordinate to guarantee that James A. Haley Veterans’ Hospital will have the required personnel at the planning meeting. Upon completion of the meeting the contractor will deliver written documentation of the meeting, detailing findings and recommendations. Topics include, but are not limited to:

• Identify high level tasks

• Identify resources required and available

• Identify project risks, constraints and issues

• Establish project schedule

• Review system rules requirements

• Discuss data conversion

• Review project milestones and deliverables

Deliverable Description of Deliverable

Installation RS instance created in the hosted-On Demand environment

• RS web

• Managed Services

System Rules Workshop Asure implementation consultants will assist and guide James A. Haley Veterans’ Hospital with the setup of all configurable system rules within RS as required, to assure that they are set up as required by James A. Haley Veterans’ Hospital. James A. Haley Veterans’ Hospital will be provided with a spreadsheet for data capture and this must be completed prior to the workshop taking place. Based on the content of the capture sheet, the Asure Client Service Engineer(s) (“CSE”) will advise as required on industry best practices for setting up the RS system in conjunction with James A. Haley Veterans’ Hospital’s business requirements.

The workshop will be conducted remotely via an online meeting.

During the workshop, administration expertise will be transferred to James A. Haley Veterans’ Hospital who will be responsible for the actual configuration of the system.

System setup will be considered completed once all the resources, services and assets have been entered, along with their relevant settings and attributes.

Admin Training RS admin training will cover the core functionality of the RS software and includes the following:

• General system configuration

• User and security group configuration

• Location and Resource setup

• Usage of User Defined Fields and Service Tabs

• Email settings

• Reports

• Services setup

Training is to be conducted via an online meeting.

The training will be conducted in two to four-hour sessions. Configuration

Deliverable Description of Deliverable

Coaching and review sessions will also be provided while James A. Haley Veterans’ Hospital in configuring the system. The training will be considered complete when the Admin training agenda has been covered.

User Training End user training will cover the core user functionality of the RS software and includes the following:

• Guide to the Web user front-end

• Guide to the Outlook/Lotus Notes front end where relevant

• Reservation basics and advanced features

• Service ordering

Training is to be conducted via the web using an online meeting. The training will be conducted in two one-hour sessions and will be given to James A. Haley Veterans’ Hospital trainers or super-users who will be responsible for all end-user training. The training will be considered complete when the training agenda has been covered.

Test Before James A. Haley Veterans’ Hospital move away from its current program and begins exclusive processing on RS, the system will be tested for rules setup and approval work flow process. This will assure the James A. Haley Veterans’ Hospital that the set-up of the RS system is complete and correct and will constitute the User Acceptance period.

The testing will be carried out by the James A.

Haley Veterans’ Hospital team so that they can validate that the system was set up per the planning phase of the project.

The Contractor will kick off this exercise with the James A. Haley Veterans’ Hospital reviewing the success criteria. The Contractor will assist James A. Haley Veterans’ Hospital with modifying the standard system rules during the testing to meet the success criteria. Asure will conduct a success review with the James A. Haley, if required.

Deliverable Description of Deliverable To the JAHVAH at the end of the testing phase.

Final migration and go-live RS reservations cleared down and final migration of production reservation data. During the first week using RS, The Contractor will make available the CSE(s) that is most familiar with the setup. James A. Haley Veterans’ Hospital may contact the CSE if they feel RS is not working as expected. The purpose of this milestone is to assure quick resolution to any issues that might arise.

Acceptance is considered complete 30 days after go-live of project.

Project Wrap Up

Adoption Audit The Adoption Audit consists of a CSE(s) soliciting feedback and suggestions regarding the RS system setup, work processes related to the utilization of the RS system, and to provide an evaluation on your organization’s ability to fully utilize the RS system.

The audit is performed between the first 30-90 days of usage. Items may be identified during the audit that fall outside the current scope or work and may be reviewed for additional action.

The Contractor will conduct a review of the Adoption Audit and provide written documentation of our findings and recommendations if applicable.

5. Deliverables and Critical Success Factors

• The Contractor will adhere to scope of this Statement of Work.

• The Contractor will provide the appropriate resource to lead requirements gathering and design sessions.

• The Contractor will provide an escalation process for issues that may arise that cannot be resolved by the immediate project team.

• The Contractor will obtain formal sign-off on all key milestones and deliverables within the implementation.

• The Contractor will provide James A. Haley Veterans’ Hospital tasks for deployment of the solution as well as a timeline for these tasks.

6. Known Project Critical Success Factors

• These will be agreed with James A. Haley Veterans’ Hospital at the start of the project.

8. Organization and Roles & Responsibility

Contractor Role Primary Responsibility Contact Information Client Services Engineer Acts as primary point of contact for

James A. Haley Veterans’ Hospital;

responsible for Asure’s performance under this SOW.

TBD

Client Services Project Manager Conduct planning meetings and regular scheduled project management updates with James A.

Haley Veterans’ Hospital.

TBD

Contractor Executive Sponsor Provides leadership on culture and values, keeps project aligned with organization’s strategy, governs project risk, works with James A.

Haley Veterans’ Hospital sponsors, ensures continuity of sponsorship, provides assurance, provides feedback and lessons learned.

TBD

James A. Haley Veterans’ Hospital FM Project Manager

Definition of the services required by James A. Haley Veterans’ Hospital and acceptance of their execution against this SOW.

TBD

James A. Haley Veterans’ Hospital IT Project Manager

Provide on-site technical activities for James A. Haley Veterans’ Hospital relating to all James A. Haley Veterans’ Hospital systems and software

TBD

10. James A. Haley Veterans’ Hospital Responsibilities

• A Project Manager must be assigned as a single point of contact for all areas of the project. The PM may also hold some of the key roles listed below.

• Key role personnel will be required at the relevant points during the project as dependencies exist on them. For example:

o Facilities coordinator to handle all workflow and other facilities-related issues o IT Technical analyst / administrator for all areas relating to the integration with Asure and software.

o Trainer(s) responsible for end-user training for all pilot employees o User Coach / Contact for all user inquiries from the users during the project o Service providers such as catering and audio/visual o Reception Coordinator o Project evaluation coordinator

• Attendance of planned reviews and meetings. Where these are missed, the implementation dates may be pushed back

• Provide all data relating to the meeting rooms

• Provision of meeting room diagrams and floor plans

• Training of end users

• Ongoing administration (with Asure assistance)

11. General Terms

• The Contractor and James A. Haley Veterans’ Hospital will commit the necessary resources and management involvement to support the Project and perform the agreed upon scope, deliverables, acceptance, and other obligations identified in this Statement of Work in a timely and complete manner.

• James A. Haley Veterans’ Hospital has the right to determine whether to use or refrain from using any recommendations made by Asure Software.

• Any changes to this SOW shall be authorized and approved only through written correspondence from the CO. A copy of each change will be kept in a project folder along with all other products of the project. Costs incurred by the contractor through the actions of parties other than the CO shall be borne by the contractor.

VA INFORMATION AND INFORMATION SYSTEM SECURITY/PRIVACY LANGUAGE

VA INFORMATION CUSTODIAL LANGUAGE:

a. Contractors, contractor personnel, subcontractors, and subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security.

b. If VA determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the contractor or third party or terminate the contract for default or terminate for cause under Federal

Acquisition Regulation (FAR) part 12.

c. A contractor/subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order.

d. All contractors, subcontractors, and third-party servicers and associates working with VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures.

SECURITY INCIDENT INVESTIGATION:

a. The term “security incident” means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. The contractor/subcontractor shall immediately notify the COR and simultaneously, the designated ISO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/subcontractor has access.

b. To the extent known by the contractor/subcontractor, the contractor/subcontractor’s notice to VA shall identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the VA information or assets were placed at risk or compromised), and any other information that the contractor/subcontractor considers relevant.

c. With respect to unsecured protected health information, the business associate is deemed to have discovered a data breach when the business associate knew or should have known of a breach of such information. Upon discovery, the business associate must notify the covered entity of the breach.

Notifications need to be made in accordance with the executed business associate agreement

d. In instances of theft or break-in or other criminal activity, the contractor/subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG and Security and Law Enforcement. The contractor, its employees, and its subcontractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The contractor/subcontractor shall cooperate with VA in any civil litigation to recover VA information, obtain monetary or other compensation from a third party for damages arising from any incident, or obtain injunctive relief against any third party arising from, or related to, the incident.

LIQUIDATED DAMAGES FOR DATA BREACH:

a. Consistent with the requirements of 38 U.S.C. §5725, a contract may require access to sensitive personal information. If so, the contractor is liable to VA for liquidated damages in the event of a data breach or privacy incident involving any SPI the contractor/subcontractor processes or maintains under this contract.

b. The contractor/subcontractor shall provide notice to VA of a “security incident” as set forth in the

Security Incident Investigation section above. Upon such notification, VA must secure from a non-

Department entity or the VA Office of Inspector General an independent risk analysis of the data breach to determine the level of risk associated with the data breach for the potential misuse of any sensitive personal information involved in the data breach. The term 'data breach' means the loss, theft, or other unauthorized access, or any access other than that incidental to the scope of employment, to data containing sensitive personal information, in electronic or printed form, that results in the potential compromise of the confidentiality or integrity of the data. Contractor shall fully cooperate with the entity performing the risk analysis. Failure to cooperate may be deemed a material breach and grounds for contract termination.

SECURITY CONTROLS COMPLIANCE TESTING :

On a periodic basis, VA, including the Office of Inspector General, reserves the right to evaluate any or all of the security controls and privacy practices implemented by the contractor under the clauses contained within the contract. With 10 working-day’s notice, at the request of the government, the contractor must fully cooperate and assist in a government-sponsored security controls assessment at each location wherein VA information is processed or stored, or information systems are developed, operated, maintained, or used on behalf of VA, including those initiated by the Office of Inspector

General. The government may conduct a security control assessment on shorter notice (to include unannounced assessments) as determined by VA in the event of a security incident or at any other time.

TRAINING:

a. All contractor employees and subcontractor employees requiring access to VA information and

VA information systems shall complete VA Privacy and Information Security Awareness and Rules of Behavior Training.

(1) Sign and acknowledge (either manually or electronically) understanding of and responsibilities for compliance with the Rules of Behavior.

b. The contractor shall provide to the contracting officer and/or the COR a copy of the training certificates and certification of signing the Rules of Behavior for each applicable employee within 1 week of the initiation of the contract and annually thereafter, as required.

c. Failure to complete the mandatory annual training and sign the Rules of Behavior annually, within the timeframe required, is grounds for suspension or termination of all physical or electronic access privileges and removal from work on the contract until such time as the training and documents are complete.

The Certification and Accreditation (C&A) requirements do not apply and a Security Accreditation

Package is not required for this SOW.