BD questions answered by IT.docx

Answers to solicitation questions submitted by Vendors.

IT answers in RED.

Contracting answers in BLUE.

General Questions

1. Question: Upon award of contract, will the customer have identified IT staff to assist with MedES server implementation and installation? Yes, OIT will be available to assist with installation. Biomed will also need to be involved. Installation will need to be scheduled in advance (as much advance as possible given we have the EHRM project going along with all the other Sub projects we are tasked to make happen as well)

2. Question: Will the customer allow vendors to leverage an already existing vetted IT-Level II NACL DoD workforce? Yes, as long as HR is able to verify that the background check is still valid. This is up to the vendor to make happen or keep up with the requirements if they already have access.

B.2 IT CONTRACT SECURITY

Reference: c. Contract personnel who require access to national security programs must have a valid security clearance. National Industrial Security Program (NISP) was established by Executive Order 12829 to ensure that cleared U.S. defense industry contract personnel safeguard the classified information in their possession while performing work on contracts, programs, bids, or research and development efforts. The Department of Veterans Affairs does not have a Memorandum of Agreement with Defense Security Service (DSS). Verification of a Security Clearance must be processed through the Special Security Officer located in the Planning and National Security Service within the Office of Operations, Security, and Preparedness.

Question: Will the Government allow vendors to leverage an already existing vetted IT-Level II NACL DoD workforce? Yes, as long as HR is able to verify that the background check is still valid. This is up to the vendor to make happen or keep up with the requirements if they already have access.

8. SECURITY CONTROLS COMPLIANCE TESTING

Reference: On a periodic basis, VA, including the Office of Inspector General, reserves the right to evaluate any or all of the security controls and privacy practices implemented by the contractor under the clauses contained within the contract. With 10 working-days’ notice, at the request of the government, the contractor must fully cooperate and assist in a government-sponsored security controls assessment at each location wherein VA information is processed or stored, or information systems are developed, operated, maintained, or used on behalf of VA, including those initiated by the Office of Inspector General. The government may conduct a security control assessment on shorter notice (to include unannounced assessments) as determined by VA in the event of a security incident or at any other time.

Question: Can VA please provide details of what the scope would entail for both the evaluation and assessment addressed below? The evaluation depends on the proposal submitted by each vendor. Evaluation entails analyzing the technical specifications proposed for capability. Please see solicitation provision E.6 FAR 52.212-2. After vendor selection and installation, the VA will monitor IT to maintain proper security control compliance on all systems and connections.

9. TRAINING

Reference: (1) Sign and acknowledge (either manually or electronically) understanding of and responsibilities for compliance with the Contractor Rules of Behavior, Appendix E relating to access to VA information and information systems;

Question: Will the VA provide Appendix E for review? I believe it is Appendix D. It is attached. Starting on page 51.

9. TRAINING

Reference: (2) Successfully complete the VA Cyber Security Awareness and Rules of Behavior training and annually complete required security training;

Question: In addition to the course defined, which security training courses will need to be completed? Will the training be through TMS? Privacy course 10203 may be required per the Privacy Officers request.

9. TRAINING

Reference: (4) Successfully complete any additional cyber security or privacy training, as required for VA personnel with equivalent information system access [to be defined by the VA program official and provided to the contracting officer for inclusion in the solicitation document - e.g., any role-based information security training required in accordance with NIST Special Publication 800-16, Information Technology Security Training Requirements.] Question: What additional Cyber Security or Privacy training requirements will be expected of the contract holder? Privacy course 10203 may be required per the Privacy Officers request.

Statement of Work, Salient characteristics, Enterprise system Reference: Remote access from any VA PC connected to the Hospital’s network Question: Remote Access to any VA PC is a cloud deployed solution and is currently available for commercial accounts. We can partner with VA Illiana on an ATO for cloud deployment in the federal space and meet this requirement. Will the VA accept this? Since this is a Medical Device and behind an ACL we will not provide “ALL” VA connected PC access. It will be limited to only those who need access via ACL that Biomed will need to be involved in creating. (Note that the statement of work has been amended to reflect IT’s response. Any VA PC has been changed to any VA pharmacy PC.)

Statement of Work, Salient characteristics, Enterprise system Reference: Must be able to share a Server with the Rhoudebush VA Medical Center in VISN 10.

Question: Given that the server at the facility is the server from a particular vendor, this appears to be tailored to a particular vendor’s solution. Will the VA utilize the existing server at VISN 12 or add a CLIN for server to be located at Rhoudebush VA Medical Center? it prefers to have server created on our virtual environment here on our local Virtual environment. There is no material cost associated with this but would ultimately be up to the vendor as to whether their software can be used in a virtual environment. If there is an SQL database required a 2016 version would be required and purchased through the vendor. (Note that the statement of work has been amended to reflect IT’s response. The sharing of a server is no longer required.)

Statement of Work, Salient characteristics, Enterprise system Reference: VPN site to site Question: Is it acceptable that direct IP connection with firewall rule restriction can be used in place of Site to Site VPN connection? This has to do with Vendor accessing our system for troubleshooting and verification from the vendor site. This comes down to the vendor and whether they have access from the VA to access our systems. If they do not already have access (their own VA account), then the vendor would have to go through the process to request. (Note that the statement of work has been amended to reflect IT’s response.)

Project Scope:

Reference: VA Illiana Health Care System will replace all existing technology across our catchment area and adding technology in other areas. VA Illiana is a Level 3 facility and does not possess the level of expertise and support of a larger medical system. As part of this project, VA Illiana proposes to share a serve with another VA Hospital. Therefore, the new devices must have a proven ability to interface bi- directionally with VA’s Electronic Health Record system (VistA) via the PADE (Pharmacy Automated Dispensing Equipment) interface.

Question: Would it be more beneficial to the VA to utilize a current server within the same VISN as VA Illiana? Prefer to have our own virtual sever located here in Danville. If a vendor proposes an alternative to a virtual server, vendor MUST explain in detail why its solution is better. (Note that the statement of work has been amended to reflect IT’s response.)