Attachment C - National Retirement Solution PWS.pdf

HUMAN CAPITAL MANAGEMENT-WORKFORCE MANAGEMENT AND CONSULTING

PERFORMANCE WORK STATEMENT

NATIONAL VETERANS’ HEALTH ADMINISTRATION FEDERAL RETIREMENT ADMINISTRATION

SOFTWARE SOLUTION

1. BACKGROUND

Veterans Health Administration (VHA) human capital management is undergoing to the most significant redesign and transformation in the history of the administration. HR structures, functions, and resources are being reorganized into shared service models to improve the customer service and achieve the strategic outcomes necessary to enable VHA’s more than 370,000 employees to deliver care and services to nine million Veterans.

As part of VA’s Modernization efforts, which includes consolidation of benefits and retirement processes, the VA implemented a shared service organization for Human Resources (HR). This will ensure VA has a structure that provides efficient, consistent, accurate, timely and measurable Retirement and Benefits services that meet the needs of management, supervisors, employees, and HR staff in a cost-effective manner while leveraging current resources.

Workforce Management and Consulting (WMC) provides centralized retirement services for all VHA current and previous employees, and well as thousands of VA employees at the VA Central Office level, including staff offices and Office of Information and Technology. A single system with capability to integrate with VA and VHA’s multiple HR, financial, and other systems, including middleware, is essential.

2. PURPOSE

Human Capital Management-Workforce Management and Consulting (HCM-WMC) requires a Commercial off-the-shelf, web-based Retirement Administration software solution which provides a comprehensive single source repository for VHA employees Health Insurance, Life Insurance, Dental & Vision Insurance, Long Term Care Insurance, Flexible Spending Account, Workers Compensation Benefits, Pay and Leave Retirement services, Thrift Savings Plan, and Social Security user information.

3. SCOPE OF WORK

Retirements require benefits calculator(s)/report generation along with capabilities to accurately compute various complex estimates needed in assisting employees with their retirement decisions and review all available benefits to VA members. The solution’s calculator software and/or the solution’s functionality shall allow for the computing of retirement benefits to employees under the Civil Service Retirement System (CSRS), Federal Employees Retirement System (FERS), the Federal Thrift Savings Plan and the Social Security program. The calculator software and/or the solution’s functionality shall also be available as “self-service” to employees, for computing Retirement benefits under the Civil Service Retirement System (CSRS), and Federal Employees Retirement System (FERS).

Retirement services further require entitlements calculator(s)/report generation along with capabilities to accurately compute various complex estimates needed in assisting employees with their retirement decisions and review all available benefits to VA members. The Service Computation Date (SCD) calculator software and/or the solution’s functionality shall allow for the computing of retirement benefits to employees under the Civil Service Retirement System (CSRS), Federal Employees Retirement

System (FERS), the Federal Thrift Savings Plan and the Social Security program and assisting with onboarding VA employees with prior federal service. The calculator software and/or the solution’s functionality shall also be available as “self-service” to employees, for computing Retirement benefits under the Civil Service Retirement System (CSRS), and Federal Employees Retirement System (FERS).

Additionally, the application generates approved versions of forms required for processing that meet standards and guidance set forth by the Office of Personnel Management (OPM).

To achieve the goal of a fully integrated retirement system, VA intends to procure a Software-as-a- Service (SaaS) Federal Retirement Administration solution that meets the goals and objectives of the VA HR Line of Business (HRLoB). The proposed solution shall be a secure, self-service web application which allows employees to make elections to health and life insurance, Thrift Savings Plan contributions, review general and personal benefits information, and generate retirement estimates.

The Contractor shall provide a Retirement and Benefits production SaaS solution and training/test environment with an integrated suite of web-based software modules specifically for the Federal employee, which combines tools and capabilities for human resource specialists, managers, and employees into a common system.

The SaaS solution shall be offered on a subscription basis which allows users to have unrestricted access to all the features and functionality which will automate the entire retirement process, to include (but not limited to) providing estimates, computations, analysis, reporting, tools, forms, and permitting for the submission of completed retirement documents to Defense Finance and Accounting Services (DFAS) and OPM. The SaaS solution shall comply with all VA, VHA, DFAS, and OPM requirements for retirements and system security requirements.

4. FUNCTIONAL AND TECHNICAL REQUIREMENTS

The SaaS solution shall provide the following Application Features / Functionality:

Calculate creditable years of service in conjunction with the Federal Retirement Entitlements (FRB) retirement calculator.

The retirement software must feature a retirement calculator for federal retirement, Service Computation Date, Average Salary, and entitlements calculations.

This software must be designed for HR Specialist to use a centralized database of personnel and retirement data to perform calculations for Federal retirement, Thrift Savings Plan annuity options, Average Salary, Deposits/Redeposits, Part-time Proration, FERCCA Entitlement Comparisons, Severance Pay, Reemployed Annuitant Supplemental Annuity, CSRS Voluntary Contributions, and Social Security entitlements.

Software must be able to utilize two factor authentication connections compatible with the VA Personal Identity Verification (PIV) Access card.

Software designed for an unlimited number of users and an on-line tutorial for training needs.

The software must have eRetirement capability for employees to self-service and obtain their own estimates and projection and eSeminars available for self-service retirement counseling.

Retirement Entitlements Calculation Engine that can accurately calculate retirement entitlements associated with nearly every type of Federal employment.

Handles voluntary, early, and disability retirement entitlements; part-time and intermittent service; deposits and redeposits owed; Social Security/ FERS supplement entitlements.

Thrift Savings Plan entitlements; survivor entitlements; and severance pay.

The solution must contain CSRS, FERS, and other OPM forms for electronic form filling, data storage, and case management.

Data in the central database may be updated as determined (frequency) with data from the agency payroll/personnel system. (API, flat file imports) Unlimited HR user accounts should be available with full access to the Retirement

Calculator to address their duties to prepare retirement estimates, counsel employees and prepare the retirement application and related forms for transmittal to the Office of Personnel Management (OPM).

The software must include an OPM vetted Federal Employees Erroneous Retirement Coverage Correction Act (“FERCCA Calculator”), a tool that facilitates the management and filing of electronic forms for retirement application packages and service history calculations.

Software must be in compliance with section 508 of the Rehabilitation Act of 1973, as amended (29U.S.C 794d).

A Forms Manager within the Retirement section that facilitates the management and filling of electronic forms for retirement application packages and service history calculations.

Secure portal access for Employees to calculate their own retirement estimates and obtain their Entitlements Statement “on-demand”.

A Retirement Planner that also combines federal and non-federal retirement funds (including spouses) and estimates probability of meeting the retirement goals established by the employee. (Total USER Compensation Statement)

The contractor shall perform a quarterly review of ATC creditable service determinations that were completed by the servicing HR offices to ensure the HR offices are correctly applying the laws, rules, regulations, and guidance related to the special provisions of ATC retirement.

The software must enable users to initiate requests which allows HR staff to capture and flag a case with a status, date, and comments.

The software must allow employees the opportunity for continued updates on pending HR actions and email dialogue with the HR office.

Provides standard and ad hoc reports for the HR community to meet management reporting and program administration requirements.

Software that downloads data from payroll provider. This data import shall automatically create a record in the retirement calculator and/or other applications for every employee and populate it with information regarding their current entitlements enrollment and salary history going back as far as payroll office has data.

The opportunity to move completed (e-files) packet forms established transmission directly to DFAS, OPM, and eOPF.

The software must allow users the ability to complete and digitally sign a retirement application and all forms needed to create an entire retirements package.

The software must allow users to upload scanned wet signatures of all necessary application documents.

Any data is the property of Department of Veterans Affairs, Veterans Health Administration.

The SaaS solution shall provide the following Customer Features / Resource Management capabilities:

Provide a centralized dashboard (benefits/TSP/Insurance/retirements, etc.)

Multiple Case Requests availability with rules/restrictions Home user screen page customizable for optional entitlement selections Case management to Open, Close, Re-Open tracked activity Case Request ICONs for Training/Document informational section Provide a user self-service calculator (Retirements, High Three Salary, Severance/VSIP) User "Extended Attributes" (Look up, drop down selector, text, yes/no check box) Customer Case and system e-file attachments (excel, .pdf, .tiff, .gif, .png, .jpg, .bmp, word) User notes section for detailed interactions not case specific (HR Views Only) Customer email notifications Custom email functionality (HR/user responses "bi-directional") Detailed History notes section for tracking Ability to accept and upload VA’s data file from current vendor in XLM file format

The SaaS solution shall provide the following Disaster Recovery capabilities:

Vendor provides “Hot” disaster recovery In the event of more than 24 Hours outage, for a full recovery, vendor to provide a substitute shell (sandbox) for continued VA productivity/retirement and SCD calculations

Vendor to provide cloud document access - only in the event of a disaster

The SaaS solution shall provide the following HR Features / Functionality capabilities:

Case creations for multiple types of HR/Entitlements actions to include:

Case Management View(s) – complete view of assigned HR cases with filtering Case Type(s) – multiple Case Assignment(s) designated group assignments/automated/internal transferring (HR to HR) Case Reporting Case Workflow functionality Case "Extended Attributes" (Look up, drop down selector, text, yes/no check box) Case History Notes section (manual and automated) Case user resolution response section Case e-file attachments (excel, .pdf, .tiff, .gif, .png, .jpg, .bmp, word)

The SaaS solution shall provide the following ROLE Permissions/Administration access levels:

HR Only HR Read Only HR Manager SCD Report Only Administrator

Assignable Permissions to Roles:

System Reporting Case Type (Create/Edit/View) permissions

Domain Assignments One to multiple assignments availability Case creation specific to domain(s) (manual/automated)

5. SPECIFIC TASKS AND DELIVERABLES

The contractor shall perform the tasks and complete the associated deliverables under this task order by the scheduled due dates within the overall period of performance. If the contractor cannot present those deliverables specified by this task order by the required due date, then the contractor shall provide a written explanation to the Contracting Officer (CO) within three business days of the required due date. This written transmittal shall include the reasons for the delay; when the Contractor knew or should have known a delay would incur; due diligence taken to mitigate the problems; the impact on the overall project; and a firm commitment of when the work is to be completed. The CO will then review the facts and issue a response in accordance with applicable regulations. For other problems or concerns, the contractor shall notify VA Project manager (PM), Contracting Officer’s Representative (COR), and CO, in writing, immediately if problems arise adversely impacting the performance of the contract. In most instances, the COR will serve as the contractor’s primary point of contact.

The contractor shall provide services, materials, and equipment to complete the tasks both as described below and further defined within the sub-sections of this Section.

The Software solution must contain a flexible, bi-directional interface to communities with VA’s payroll/human resource information system (HRIS), third-party providers, and any outside parties with secure electronic file transfer protocols (sFTP) for electronic file (eFiles) to export and log transactions as necessary.

The Software solution must be certified and/or accredited under FIPS 199 and NIST 800-60.

The Software solution shall provide HR Specialists with a suite of tools for assisting employees with their retirement decisions which increases productivity and lowers cost by providing a single framework for organizing and managing high-volume caseloads.

The Software solution must be capable of using, processing, and storing Personally Identifiable Information (PII), which will be provided through the DFAS payroll system and VA HR Smart (PeopleSoft) system employee information. DFAS serves as the data collection for the employment and compensation data. The Software solution must also be capable of electronically submitting retirement packages to the DFAS office.

HR Smart serves as the official data base of record for VA member employee information. Only pertinent PII that is necessary to accurately compute retirement estimates will be extracted from DFAS and HR Smart. The Software solution must also be capable of integrating with HR Smart (PeopleSoft) and allow for automated electronic data feeds from HR Smart.

The Software solution must be capable to electronic submit retirement packages to Office of Personnel Management (OPM).

5.1 POST-AWARD KICK-OFF MEETING

Within 10 business days after task order effective date (or as agreed upon between the VA PM and contractor), the contractor shall participate in a task order kick-off meeting with the program office comprised of key stakeholders and subject matter experts (SMEs) to be identified by the VA PM, including the COR and the CO. The kick-off meeting will be conducted via video or teleconference.

Prior to the Kickoff, the Contractor shall collaborate with the VA COR, then prepare and distribute the Kickoff meeting agenda to planned attendees. During the Kickoff meeting, the contractor shall present the details of its intended approach, work plan and project schedule, along with a staff roster. The contractor shall prepare and deliver to attendees meeting minutes captured during the Kickoff.

Deliverables:

1A Kickoff Meeting Participation/ Presentation 1B Kickoff Agenda (before) and Meeting Minutes (after) 1C Staff Roster

5.2 LICENSING

The contractor shall provide a retirement software with licenses to accommodate up to 458,139 users annually.

Licensing for this retirement calculator shall grants users access to the following features all of which are OPM- or VHA-required:

Computational Functionality

Full and part-time retirement annuity estimates Optional

MRA+10

Involuntary/Early Deferred Disability Survivor Benefits Special Groups (LEO, Firefighters, ATCs) Phased Retirement VA Title-38

Other Retirement Computations FERS Annuity Supplement

FERCCA Election Comparison Alternative Form of Annuity Supplemental Annuity for Reemployed Annuitants CSRS Voluntary Contributions Part-Time Service Proration Factors Severance Pay Lump-Sum Annual Leave Payment Divorce/Court Orders – Former Spouse

Service Credit Computations Civilian Deposits Civilian Redeposits Post-1956 Military Service Deposits Peace Corp/VISTA Service Deposits

Service Analysis Retirement Coverage Determination Creditability of Service Determination FERCCA Determination

Average Salary Computations High-3 Salary Breaks in Service Less Than 3-Year Period Part-Time Employment

Service Computation Dates Retirement SCD Leave/RIF SCD

TSP SCD

Agency SCD

Social Security Estimates Retirement Benefits Survivor Benefits Disability Benefits Amount of CSRS Offset Windfall Elimination Penalty (WEP)

TSP Tools Single/Joint Life Annuities Withdrawal Estimates Account Balance Projection Loan Calculator

Retirement Calculator Reports

Create various reports to include retirement analyses, including retirement estimates, annuity estimates, service computation dates, average salary, part-time proration factor, Thrift Savings Plan, Social Security, military service, and civilian deposit/redeposits. The report displayed on screen shall look identical when being printed on paper and can be saved in PDF format.

Annuity estimates shall be computed with the utmost accuracy which includes considering the applicable reductions and deductions from their gross monthly annuity computation. The reductions and deductions from the gross monthly annuity shall include calculations for health benefits, life insurance, dental and vision premiums, federal tax, survivor benefits, unpaid deposits/redeposits, alternative annuity, and early retirement age.

Forms The license shall provide access to produce any OPM authorized or custom requested forms and come with an integrated forms package containing a variety of retirement and benefits related forms. Forms will automatically pre-populate with employee information saving significant time and minimizing manual data entry.

Deliverables:

2A Retirement software with licenses to accommodate up to 458,139 users 2B Computational Functionality, Retirement Calculator Report, Forms

5.3 RETIREMENT CALCULATOR SUPPORT

The Contractor shall provide any/all software subscriptions necessary to support a retirement calculator, to allow up to 458,139 VA employees access, in addition to providing including installation support through help desk support.

The Contractor shall provide hosting for the retirement calculator in a secure environment made available to VA via web access. Contractor shall also provide support services via telephone or email for system assistance during standard support hours; the times are 9:00 AM to 5:00 PM EST Monday

– Friday, excluding Federal Holidays.

Deliverables:

3A Software subscriptions and support for up to 458,139 VA employees 3B Contractor support services; 9 am – 5 PM EST

5.4 SERVICE COMPUTATION DATE ONLY PLATFORM

Contractor shall provide a separate Service Computation Date (SCD) only platform. This platform shall provide users with the following features:

Computational Functionality

Service Computation Dates Retirement SCD Leave/RIF SCD

TSP SCD

Agency SCD

Social Security Estimates Retirement Benefits Survivor Benefits Disability Benefits

Amount of CSRS Offset Windfall Elimination Penalty (WEP)

TSP Tools Single/Joint Life Annuities Withdrawal Estimates Account Balance Projection Loan Calculator

Forms The license shall provide access to produce any OPM authorized or custom requested forms and come with an integrated forms package containing a variety of retirement and entitlements related forms. Forms will automatically pre-populate with employee information saving significant time and minimizing manual data entry.

4A SCD Only Software and support 4B Computational Functionality, Forms

5.5 CASE MANAGEMENT

The Contractor’s proposed solution shall provide a Case management functionality/feature which will permit users to manage case activity and tracking with extended attribute functionality to include look-up/drop down values, free form text, and Boolean values. The case management function will include user case management system- generated emails with customized (editable) agency responses. The case management functionality shall also include HR administrative permissions, including but not limited to case view, case edit, case deletion, case re-open/close management. Case management functionality shall include user history logs with date time stamps and action details and document repository. Document retention shall be provided for up to 458,139 users, to include the ability to retain documents in .pdf, .tiff, .gif, .png, .jpg, .bmp, .xls, and .doc formats

Deliverables:

5A Case Management 5B User Case management System Generated Notification Emails 5C 5C User History Logs 5D Document Repository

5.6 EXTENSIBLE MARKUP LANGUAGE FILE

The technical solution shall provide external reporting capabilities.

The program office is required by their SLAs to report the data. As such, there is a need for the program office to have the ability to extrapolate information for their reporting purposes.

The Contractor shall provide a case export extensible markup language (XML) file to the program office on a daily basis. This is an output file for reporting purposes. The current method used for such purposes is XML, however, there may be a change in submission format during the course of contract performance.

Deliverable:

6A Extensible Markup Language File

5.7 VIRTUAL TRAINING PLAN (OPTIONAL TASK)

The Contractor shall provide a training plan for Off-the-Shelf user virtual training for the Platform and new releases for the Retirement Shared Service Office (RSSO) under this optional task. The Contractor shall provide all training materials, soft and hard copies, per the Government’s request.

Minimum two-week lead time training for personnel prior to new releases. The Contractor shall ensure that users have access to training materials online, including web seminars for users’ quick reference. Plan shall be updated if there are changes to the Platform.

Virtual Training Plan Trainer’s guide Participant handbook All supplemental materials job aids, videos, etc.

The contractor must ensure that all training materials are free of errors and contain relevant and up-to-date references, PowerPoint presentations and/or handouts.

Deliverable:

7A Virtual Training Plan 7B Virtual training using Zoom, WebEx, or Teams, etc.

7C Trainer’s guide 7D Participant Guides 7E Supplemental training materials, job aids, videos, PPTs, etc.

5.8 TRANSITION SUPPORT (OPTIONAL TASK)

The Contractor shall provide transition support of the product. The Contractor shall provide a plan for 60 days of outgoing transition support for transitioning work from the current task order to a follow-on task order or other entity. This transition may be to a Government entity or to another Contractor, or to the incumbent Contractor under a new task order. In accordance with the Government-approved plan, the Contractor shall assist the Government in implementing a complete transition from this contract to a new support provider, to include, but not limited to, the transfer of data of any form residing within the current system in use. This shall include formal coordination with Government staff and successor staff and management. It shall also include delivery of copies of all artifacts delivered under this contract including all VA data, as well as existing policies and procedures, training materials, and delivery of baseline metrics and statistics.

This Transition Plan shall address and include details to accomplish the following areas at minimum:

1. Coordination with Government representatives.

2. Review, evaluation, and transition of current support services.

3. Transition of historic data to a new contractor system.

4. Transfer of all necessary business and/or technical documentation.

Deliverables

8A Transition Plan

6. DELIVERY SCHEDULE

Days used in the table below refer to calendar days unless otherwise stated. Deliverables with due dates falling on a weekend or holiday shall be submitted the following Government workday after the weekend or holiday. The Contractor shall deliver documentation in electronic format, unless otherwise directed in Section B of the solicitation/contract. Acceptable electronic media include Microsoft Word, Microsoft Excel, Microsoft PowerPoint, Microsoft Project, Microsoft Visio, and Adobe Postscript Data Format (PDF).

Deliverables

Task/ Deliv. Deliverable Description Qty Base (B) or

Option (O) Due

5.1 POST-AWARD KICK-OFF MEETING

1A Kickoff Meeting Participation/ Presentation 1 B only Within Ten (10) business days of the start of period of performance

1B Kickoff Agenda and Meeting Minutes 1 B only

Agenda- 2 business days prior to Kickoff

Minutes- 3 business days following Kickoff

1C Staff Roster 1 B only At Kickoff Meeting

5.2 LICENSING

2A Retirement software with licenses

B/O Available NLT 14 calendar days from contract award

2B Computational Functionality, Retirement Calculator Report, Forms

B/O

Available NLT 14 calendar days from contract award

5.3 RETIREMENT CALCULATOR SUPPORT

3A Software subscriptions necessary to support a retirement calculator for up to 458,139 employee users

1 B/O Available NLT 14 calendar days from contract award

3B Contract support service 1 B/O Available NLT 14 calendar days from contract award

5.4 SCD ONLY SOFTWARE

4A SCD Only Software and support for up to 300 HR personnel

1 B/O Available NLT 14 calendar days from contract award

4B Computational Functionality, Forms

1 B/O Available NLT 14 calendar days from contract award

5.5 CASE MANAGEMENT

5A Case Management 1 B/O Available NLT 14 calendar days from contract award 5B User Case management

System Generated Emails 1 B/O Available NLT 14 calendar days from contract award

5C User History Logs 1 B/O Available NLT 14 calendar days from contract award 5D Document Repository 1 B/O Available NLT 14 calendar days from contract award

5.6 EXTENSIBLE MARKUP LANGUAGE FILE

6A Extensible Markup Language

File

B/O Available NLT 14 calendar days from contract award

5.7 VIRTUAL TRAINING (OPTIONAL TASK)

7A Virtual Training Plan 1 B/O Available NLT 14 calendar days from contract award 7B Trainer’s guide 1 B/O Available NLT 14 calendar days from contract award 7C Participant Guides 1 B/O Available NLT 14 calendar days from contract award 7D Supplemental training materials, job aids, videos, PPTs, etc.

1 B/O Available NLT 14 calendar days from contract award

5.8 TRANSITION SUPPORT (OPTIONAL TASK)

8A Transition Plan 1 B/O Sixty (60) business days prior to contract termination

6.1 FORMAL ACCEPTANCE OR REJECTION OF DELIVERABLES:

The Government will have 14 (14) business days to review each deliverable and provide feedback/ comments. The contractor shall have seven (7) business days to incorporate feedback/comments and make appropriate revisions. The contractor shall provide the revised version of each deliverable to the Contracting Officer Representative (COR) and VA Program Manager (VA PM). The COR will review and determine final acceptance by the Government. The COR will make all best efforts to notify the contractor of final acceptance within five business days. However, failure to receive the COR notification within this time shall not serve as and/or be construed as final acceptance.

6.2 METHOD AND DISTRIBUTION OF DELIVERABLES

All training deliverables shall be submitted as Oral Presentation (when applicable), Editable Microsoft Office 365 compatible file (i.e., Word, Excel, Project, and/or PowerPoint) or Adobe.pdf as requested by the VHA Program Manager and COR.

6.2 PERFORMANCE METRICS

The table below defines the Performance Standards and Acceptable Performance Levels for Objectives associated with all tasks outlined in this PWS.

Performance Objective Performance Standard Minimum Acceptable Performance Levels

Method(s) of Surveillance

Technical Needs Delivers computational functionality.

Delivers retirement estimate reports.

Delivers HR Case Assignments

Delivers User Account Management

Delivers User Case Requests

Delivers User Case reporting

Delivers HR Case Tracking

Delivers HR Case Reporting

Delivers employee self-service portal.

Delivers forms.

Delivers pdf compatibility.

95% Inspection/ review, direct observation

Project Milestones and Schedule

To be determined at contract award.

6.3 OPERATIONS AND MAINTENANCE HELPDESK SUPPORT

The Contractor shall provide operations and maintenance support for the SaaS (Software as a Service) solution, including but not limited to system configuration, change requests, and bug defects, found as necessary to meet the performance requirements of this effort. The Contractor shall provide technical helpdesk support of the solution. The Contractor shall provide business-day telephone and/or on-line support. A business day is defined as Monday through Friday during standard business hours, the times are 9:00 AM to 5:00 PM EST Monday – Friday, excluding Federal Holidays.

Support includes, but is not limited to, providing technical assistance in troubleshooting issues, problems or symptoms with the software and answering questions regarding documented properties, methods, events, function calls, parameters, and specific functionality of software components. The

Contractor shall acknowledge receipt of all support inquires and provide resolution of support requests according to the timelines shown in the table below. The Contractor shall communicate to the VA PM (Project Manager) on system outages to include:

a. No later than 72 hours prior to scheduled outages.

b. Within 1 hour of identified emergency issues

The Contractor shall provide a System Performance Specification to the Government, showing system performance and up-time, specific indication of system issues, restarts and system maintenance activities including scheduled and unscheduled, and best practices used.

Table 1. Response Times for Support Severity Code Tier 2 initial response to customer

Tier 2 escalates to Tier 3 for initial contact

Tier 3 response back to Tier 2

Tier 2 requests updates from Tier 3 based on SLA resolution

Resolution time based on SLA from time incident initially reported

1 – Critical 15 minutes 0-15 minutes 15 minutes On call until issue resolved or hourly status check

0-2 business hours

2 – Serious 1 hour 30 minutes 1 hour On call until issue resolved or hourly status check

2-4 business hours

3 – Moderate 4 hours 1 hour 4 hours Daily 4-8 business hours

7. PERIOD OF PERFORMANCE

The period of performance shall be 12-months from date of award, with four 12-month option periods (if exercised).

8. PLACE OF PERFORMANCE

N/A – Contract is for a SaaS application at contractor’s facility.

9. CONTRACT TYPE

Firm Fixed Price (FFP).

10. APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

a. 44 U.S.C. § 3541, “Federal Information Security Management Act (FISMA) of 2002”

b. Federal Information Processing Standards (FIPS) Publication 140-2, “Security Requirements for

Cryptographic Modules”

c. FIPS Pub 201, “Personal Identity Verification of Federal Employees and Contractors,” March

d. 10 U.S.C. § 2224, "Defense Information Assurance Program"

e. Software Engineering Institute, Software Acquisition Capability Maturity Modeling (SA CMM) Level 2 procedures and processes

f. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

g. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”

h. Department of Veterans Affairs (VA) Directive 0710, “Personnel Suitability and Security

Program,” October 11, 2018

i. VA Directive 6102, “Internet/Intranet Services,” August 5, 2019

j. 36 C.F.R. Part 1194 “Electronic and Information Technology Accessibility Standards,” December

21, 2000

k. OMB Circular A-130, “Managing Information as a Strategic Resource”, November 28, 2000

l. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed Services (CHAMPUS)”

m. An Introductory Resource Guide for Implementing the Health Insurance Portability and

Accountability Act (HIPAA) Security Rule, October 2008

n. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended by the Workforce

Investment Act of 1998 (P.L. 105-220), August 7, 1998

o. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

p. VA Directive 6500, “VA Cybersecurity Program”, February 24, 2021

q. VA Handbook 6500, “Risk Management Framework for VA Information Systems VA Information

Security Program,” February 24, 2021

r. VA Handbook 6500.1, “Mobile Device Security Policy”, February 15, 2018

s. VA Handbook 6500.2, “Management of Data Breaches Involving Sensitive Personal

Information”, March 12, 2019

t. VA Handbook, 6500.5, “Incorporating Security and Privacy in System Development Lifecycle”

March 22, 2010

u. VA Handbook 6500.6, “Contract Security,” March 12, 2010

v. National Institute Standards and Technology (NIST) Special Publications, NIST SP 800-145, NIST

SP 800-207, NIST 800-210

11. ASSESSMENT, AUTHORIZATION, AND CONTINUOUS MONITORING

1. The information system solution selected by the Contractor shall comply with the Federal

Information Security Management Act (FISMA).

2. The Contractor shall comply with FedRAMP requirements as mandated by Federal laws and policies, including making available any documentation, physical access, and logical access needed to support this requirement.

3. Following guidance from the Federal CIO, VA will utilize existing JAB ATO or agency ATO issued by another agency as a starting point for FedRAMP requirements. If neither of those exist, VA will sponsor FedRAMP ATO. VA will be using the FedRAMP baselines as a starting point, since they are specifically tailored for cloud services.

4. The Contractor shall, where applicable, assist with the VA ATO Process to help achieve agency authorization of the cloud service or migrated application.

5. The Contractor shall complete a FedRAMP System Security Plan (SSP) and supporting documentation within 45 calendar days after contract award. (If Data Security Categorization is High Impact, this will be due 85 calendar days after contract award.)

6. The Contractor shall complete a Third-Party Assessment Organization (3PAO) Security Assessment Plan (SAP) within 90 calendar days after contract award. (If Data Security Categorization is High Impact, this will be due after 130 calendar days after contract award.)

7. The Contractor shall complete a Third Party Assessment Organization (3PAO) Security Assessment Report (SAR) within 140 calendar days after contract award. (If Data Security Categorization is High Impact, this will be due 180 calendar days after contract award.)

8. The Contractor shall afford VA access to the Contractor’s and Cloud Service Provider’s (CSP) facilities, installations, technical capabilities, operations, documentation, records, and databases.

9. If new or unanticipated threats or hazards are discovered by either VA or the Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party in accordance with the security addendum B.

10. The Contractor shall not release any VA data without the consent of VA in writing. All requests for release must be submitted in writing to the Contracting Officer’s Representative (COR)/Contracting Officer (CO), and approval of said requests must first be received, prior to the release of any data.

11. In order for live VA data to be used in this system, a FedRAMP Authorization and Agency ATO will be required.

A. FedRAMP System Security Plan (SSP) and supporting documentation B. VA Implementation Diagram: This is a VA specific architecture diagram demonstrating the proposed implementation of this system at VA (VAID) C. 3PAO Security Assessment Plan (SAP) D. 3PAO Security Assessment Report (SAR)

FedRAMP

There are relatively few SaaS products that are already FedRAMP authorized. Because of this, VA has created a process to onboard new SaaS applications to VA, including sponsoring the desired SaaS product for FedRAMP. Some important points to know:

VA has dedicated specific resources to help bring a newly-awarded vendor into a FedRAMP Authorization (the DTC SaaS Team).

By FedRAMP policy, Agencies cannot sponsor a product for FedRAMP unless they already have an awarded contract in place with the vendor. So no product could ever be added to FedRAMP by Agency sponsorship if it had to be Authorized prior to award.

A FedRAMP Authorization is not necessary at the time of award. This is now common practice:

VA has awarded 25+ SaaS contracts in the last year that were not FedRAMP Authorized at the time of the award.

13. ADDENDUM A

Cyber and Information Security Requirements for VA IT Services

The Contractor shall ensure adequate LAN/Internet, data, information, and system security in accordance with VA standard operating procedures and standard PWS language, conditions, laws, and regulations. The Contractor’s firewall and web server shall meet or exceed VA minimum requirements for security. All VA data shall be protected behind an approved firewall. Any security violations or attempted violations shall be reported to the VA Program Manager and VA Information Security Officer as soon as possible. The Contractor shall follow all applicable VA policies and procedures governing information security, especially those that pertain to certification and accreditation.

Contractor supplied equipment, PCs of all types, equipment with hard drives, etc. for contract services must meet all security requirements that apply to Government Furnished Equipment (GFE) and Government Owned Equipment (GOE). Security Requirements include a) VA Approved Encryption Software must be installed on all laptops or mobile devices before placed into operation, b) Bluetooth equipped devices are prohibited within VA; Bluetooth must be permanently disabled or removed from the device, c) VA approved anti-virus and firewall software, d) Equipment must meet all VA sanitization requirements and procedures before disposal. The COR, CO, the Project Manager, and the Information Security Officer (ISO) must be notified and verify all security requirements have been adhered to.

Each documented initiative under this contract incorporates VA Handbook 6500.6, “Contract Security,” March 12, 2010 by reference as though fully set forth therein. The VA Handbook 6500.6, “Contract Security” shall also be included in every related agreement, contract, or order. The VA Handbook 6500.6, Appendix C, is included in this document as Addendum B.

Training requirements: The Contractor shall complete all mandatory training courses on the current VA training site, the VA Talent Management System (TMS), and will be tracked therein. The TMS may be accessed at https://www.tms.va.gov. If you do not have a TMS profile, go to https://www.tms.va.gov and click on the “Create New User” link on the TMS to gain access.

Contractor employees shall complete a VA Systems Access Agreement if they are provided access privileges as an authorized user of the computer system of VA.

VA Internet and Intranet Standards The Contractor shall adhere to and comply with VA Directive 6102 and VA Handbook 6102, Internet/Intranet Services, including applicable amendments and changes, if the Contractor’s work includes managing, maintaining, establishing, and presenting information on VA’s Internet/Intranet Service Sites. This pertains but is not limited to creating announcements; collecting information;

databases to be accessed, graphics and links to external sites.

Internet/Intranet Services Directive 6102 is posted at (copy and paste the following URL to browser):

http://www1.va.gov/vapubs/viewPublication.asp?Pub_ID=409&FType=2 Internet/Intranet Services Handbook 6102 is posted at (copy and paste following URL to browser):

http://www1.va.gov/vapubs/viewPublication.asp?Pub_ID=410&FType=2

Notice of the Federal Accessibility Law Affecting All Electronic and Information Technology Procurements (Section 508) On August 7, 1998, Section 508 of the Rehabilitation Act of 1973 was amended to require that when Federal departments or agencies develop, procure, maintain, or use Electronic and Information Technology, that they shall ensure it allows Federal employees with disabilities to have access to and use of information and data that is comparable to the access to and use of information and data by other Federal employees. Section 508 required the Architectural and Transportation Barriers Compliance Board (Access Board) to publish standards setting forth a definition of electronic and information technology and the technical and functional criteria for such technology to comply with

Section 508. These standards have been developed are published with an effective date of December 21, 2000. Federal departments and agencies shall develop all Electronic and Information Technology requirements to comply with the standards found in 36 CFR 1194.

Section 508 – Electronic and Information Technology (EIT) Standards:

The Section 508 standards established by the Architectural and Transportation Barriers Compliance Board (Access Board) are incorporated into, and made part of all VA orders, solicitations and purchase orders developed to procure Electronic and Information Technology (EIT). These standards are found in their entirety at: http://www.section508.gov and http://www.access-board.gov/sec508/standards.htm.

A printed copy of the standards will be supplied upon request. The Contractor shall comply with the technical standards as marked:

_x_§ 1194.21 Software applications and operating systems _x_§ 1194.22 Web-based intranet and internet information and applications _x_§ 1194.23 Telecommunications products _x_§ 1194.24 Video and multimedia products _x_§ 1194.25 Self-contained, closed products _x_§ 1194.26 Desktop and portable computers _x_§ 1194.31 Functional Performance Criteria _x_§ 1194.41 Information, Documentation, and Support

The standards do not require the installation of specific accessibility-related software or the attachment of an assistive technology device, but merely require that the EIT be compatible with such software and devices so that it can be made accessible if required by the agency in the future.

Physical Security & Safety Requirements:

The Contractor and their personnel shall follow all VA policies, standard operating procedures, applicable laws, and regulations while on VA property. Violations of VA regulations and policies may result in citation and disciplinary measures for persons violating the law.

1. The Contractor and their personnel shall wear visible identification at all times while they are on the premises.

2. VA does not provide parking spaces at the work site; the Contractor must obtain parking at the work site if needed. It is the responsibility of the Contractor to park in the appropriate designated parking areas. VA will not invalidate or make reimbursement for parking violations of the Contractor under any conditions.

3. Smoking is prohibited inside/outside any building other than the designated smoking areas.

4. Possession of weapons is prohibited.

5. The Contractor shall obtain all necessary licenses and/or permits required to perform the work, with the exception of software licenses that need to be procured from a Contractor or vendor in accordance with the requirements document. The Contractor shall take all reasonable precautions necessary to protect persons and property from injury or damage during the performance of this contract.

Confidentiality and Non-Disclosure The Contractor shall follow all VA rules and regulations regarding information security to prevent disclosure of sensitive information to unauthorized individuals or organizations.

The Contractor may have access to Protected Health Information (PHI) and Electronic Protected Health Information (EPHI) that is subject to protection under the regulations issued by the Department of Health and Human Services, as mandated by the Health Insurance Portability and Accountability Act of

1996 (HIPAA); 45 CFR Parts 160 and 164, Subcontracts A and E, the Standards for Privacy of Individually Identifiable Health Information (“Privacy Rule”); and 45 CFR Parts 160 and 164, Subcontracts A and C, the Security Standard (“Security Rule”). Pursuant to the Privacy and Security Rules, the Contractor must agree in writing to certain mandatory provisions regarding the use and disclosure of PHI and EPHI.

1. The Contractor will have access to some privileged and confidential materials of VA. These printed and electronic documents are for internal use only, are not to be copied or released without permission, and remain the sole property of VA. Some of these materials are protected by the Privacy Act of 1974 (revised by PL 93-5791) and Title 38. Unauthorized disclosure of Privacy Act or Title 38 covered materials is a criminal offense.

2. The VA Contracting Officer will be the sole authorized official to release in writing, any data, draft deliverables, final deliverables, or any other written or printed materials pertaining to this contract. The Contractor shall release no information. Any request for information relating to this contract presented to the Contractor shall be submitted to the VA Contracting Officer for response.

3. Contractor personnel recognize that in the performance of this effort, Contractor personnel may receive or have access to sensitive information, including information provided on a proprietary basis by carriers, equipment manufacturers and other private or public entities. Contractor personnel agree to safeguard such information and use the information exclusively in the performance of this contract. Contractor shall follow all VA rules and regulations regarding information security to prevent disclosure of sensitive information to unauthorized individuals or organizations as enumerated in this section and elsewhere in this Contract and its subcontracts and appendices.

4. Contractor shall limit access to the minimum number of personnel necessary for contract performance for all information considered sensitive or proprietary in nature. If the Contractor is uncertain of the sensitivity of any information obtained during the performance this contract, the Contractor has a responsibility to ask the VA Contracting Officer.

5. Contractor shall train all of their employees involved in the performance of this contract on their roles and responsibilities for proper handling and nondisclosure of sensitive VA or proprietary information. Contractor personnel shall not engage in any other action, venture or employment wherein sensitive information shall be used for the profit of any party other than those furnishing the information. The sensitive information transferred, generated, transmitted, or stored herein is for VA benefit and ownership alone.

6. Contractor shall maintain physical security at all facilities housing the activities performed under this contract, including any Contractor facilities according to VA-approved guidelines and directives. The Contractor shall ensure that security procedures are defined and enforced to ensure all personnel who are provided access to patient data must comply with published procedures to protect the privacy and confidentiality of such information as required by VA.

7. Contractor must adhere to the following:

a. The use of “thumb drives” or any other medium for transport of information is expressly prohibited.

b. Controlled access to system and security software and documentation.

c. Recording, monitoring, and control of passwords and privileges.

d. All terminated personnel are denied physical and electronic access to all data, program listings, data processing equipment and systems.

e. VA, as well as any Contractor (or Subcontractor) systems used to support development, provide the capability to cancel immediately all access privileges and authorizations upon employee termination.

f. Contractor PM and VA PM are informed within twenty-four (24) hours of any employee termination.

g. Acquisition sensitive information shall be marked "Acquisition Sensitive" and shall be handled as "For Official Use Only (FOUO)".

h. Contractor does not require access to classified data.

8. Regulatory standard of conduct governs all personnel directly and indirectly involved in procurements. All personnel engaged in procurement and related activities shall conduct business in a manner above reproach and, except as authorized by statute or regulation, with complete impartiality and with preferential treatment for none. The general rule is to strictly avoid any conflict of interest or even the appearance of a conflict of interest in VA/Contractor relationships.

9. VA Form 0752 shall be completed by all Contractor employees working on this contract and shall be provided to the CO before any work is performed. In the case that Contractor personnel are replaced in the future, their replacements shall complete VA Form 0752 prior to beginning work.

14. ADDENDUM B – VA INFORMATION SYSTEM SECURITY AND PRIVACY

APPLICABLE PARAGRAPHS TAILORED FROM: THE VA INFORMATION AND INFORMATION SYSTEM

SECURITY/PRIVACY LANGUAGE, VA HANDBOOK 6500.6, APPENDIX C, MARCH 12, 2010

GENERAL

Contractors, Contractor personnel, Subcontractors, and Subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security.

ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS

a. A Contractor/Subcontractor shall…