CEIAESA PWS.docx

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

DEPARTMENT OF VETERANS AFFAIRS

Office of Information and Technology (OIT)

Cisco Enterprise Infrastructure & Advanced Engineering Support Agreement (CEIAESA)

1.0 BACKGROUND

The mission of the Department of Veterans Affairs (VA), Office of Information and Technology (OIT), is to provide benefits and services to Veterans of the United States. In accomplishing the mission, OIT strives to provide high quality, effective, and efficient Information Technology (IT) services to those responsible for providing care to the Veterans at the point-of-care as well as throughout all the points of the Veterans’ health care in an effective, timely, and compassionate manner. VA depends on Information Management/Information Technology (IM/IT) systems to meet its mission.

VA currently manages Cisco Systems, Inc. (hereinafter referred to as Cisco) networking, video devices, security products, server, converged virtualization, and Unified Communications (UC) devices that comprise the core of VA’s IT infrastructure. These devices and applications require effective, proactive, on-going maintenance and support. This contract seeks to continue vital services that provide Cisco Gold Partner premium hardware support and engineering services for over 420,000 Cisco branded devices to include routers, switches, servers, telephones, video devices, and wireless. This contract seeks to continue vital continuous (24 hours a day, 7 days a week, and 365 days a year) services that provide Cisco Smart Net Total Care (SNTC) Service, Cisco Focused Technical Support Services, and embedded advance engineering services for VA managed Cisco equipment and applications worldwide. The contractor must also provide an asset management and tracking tool for VA. The asset management tool shall be used to record, track, and monitor inventory of products covered under this contract. This tool shall optimize the administration, performance, and security of VA by improving asset visibility for Cisco brand name hardware requirements of this contract. In addition, VA also requires Cisco educational credits to improve the knowledge base of VA personnel.

The following paragraphs provide a general overview of these services. For the purposes of the performance work statement (PWS), these support capabilities collectively shall be referred to as the Cisco Enterprise Infrastructure & Advanced Engineering Support Agreement (CEIAESA).

CISCO SMART NET TOTAL CARE SERVICE (SNTC)

SNTC is a proactive and reactive technical support service that provides VA staff with anytime access to Cisco engineers and Cisco.com resources to resolve critical issues related to Cisco Networking, Telephony, Security Products, Unified Communications (UC), TelePresence, and Data Center/Unified Computing (server and converged virtualization) devices and applications. Cisco SNTC provides support for all covered devices, applications, and products including access to Cisco.com for online technical assistance; base Operating Systems(OS) firmware / software updates and support on devices and licensed operating system software, (including all maintenance, minor, and major releases); access to the Cisco Technical Assistance Center (TAC) 24 hours a day/seven days a week; equipment firmware updates, and advanced replacement of failed hardware either by next business day (8x5xNBD) or 24 hours a day/seven days a week/four hour delivery (24X7X4), depending on the type of equipment and its criticality to on-going operations.

CISCO FOCUSED TECHNICAL SUPPORT SERVICES

Cisco focused technical support services include Cisco portal management services, Cisco High Touch Operations Manager (HTOM), and Cisco Technical Account Management (TAM) Services.

ADVANCED ENGINEERING SERVICES

Advanced Engineering Services provide embedded engineers to work within designated VA technical teams for advanced collaboration between the contractor, Cisco and VA. Engineers will be highly technical within the assigned area, and assist with engineering, troubleshooting, design, and communication on the product base. The specialized engineering professionals shall provide VA with the following:

1. Services for Operations which provides capabilities and deliverables in support of availability, security compliance, and management of network infrastructure and application environment.

2. Services for Engineering which provides capabilities and deliverables in support of design and validation, application insights, threat analytics, automation, security programs, and hardening of network infrastructure and application environment.

3. Services for Architecture which provides capabilities and deliverables in support of strategy, architecture alignment, design, deployment strategy, and adoption strategy for scaling of network infrastructure and application environment.

2.0 APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. 44 U.S.C. § 3541-3549, “Federal Information Security Management Act (FISMA) of 2002”

2. “Federal Information Security Modernization Act of 2014”

3. Federal Information Processing Standards (FIPS) Publication 140-2, “Security Requirements for Cryptographic Modules”

4. FIPS Pub 199. “Standards for Security Categorization of Federal Information and Information Systems,” February 2004

5. FIPS Pub 200, “Minimum Security Requirements for Federal Information and Information Systems,” March 2006

6. FIPS Pub 201-2, “Personal Identity Verification of Federal Employees and Contractors,” August 2013

7. 10 U.S.C. § 2224, "Defense Information Assurance Program"

8. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

9. Public Law 109-461, Veterans Benefits, Health Care, and Information Technology Act of 2006, Title IX, Information Security Matters

10. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”

11. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, https://www.va.gov/vapubs/index.cfm

12. VA Handbook 0710, “Personnel Security and Suitability Program,” May 2, 2016, https://www.va.gov/vapubs/index.cfm

13. VA Directive and Handbook 6102, “Internet/Intranet Services,” August 5, 2019

14. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and Guidelines,” January 18, 2017

15. Office of Management and Budget (OMB) Circular A-130, “Managing Federal Information as a Strategic Resource,” July 28, 2016

16. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed Services (CHAMPUS)”

17. NIST SP 800-66 Rev. 1, “An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule,” October 2008

18. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended, January 18, 2017

19. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

20. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021

21. VA Handbook 6500, “Risk Management Framework for VA Information Systems VA Information Security Program,” February 24, 2021

22. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI),” June 30, 2023

23. VA Handbook 6500.5, “Incorporating Security and Privacy into the System Development Lifecycle,” March 22, 2010

24. VA Handbook 6500.6, “Contract Security,” March 12, 2010 (as amended by VA Notice 24-12, April 22, 2024

25. VA Handbook 6500.8, “Information System Contingency Planning,” April 6, 2011

26. VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018

27. VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017

28. OIT Process Asset Library (PAL), https://www.va.gov/process/ . Reference Process Maps at https://www.va.gov/process/maps.asp and Artifact templates at https://www.va.gov/process/artifacts.asp

29. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

30. VA Handbook 6510, “VA Identity and Access Management,” January 15, 2016

31. VA Directive and Handbook 6513, “Secure External Connections,” October 12, 2017

32. VA Directive 6300, “Records and Information Management,” September 21, 2018

33. VA Handbook, 6300.1, “Records Management Procedures,“ March 24, 2010

34. NIST SP 800-37 Rev 2, “Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy,” December 2018

35. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020)

36. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015

37. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” March 24, 2014

38. OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005

39. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019

40. OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008

41. Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance, December 2, 2011, (NOTE: Part A of the FICAM Roadmap and Implementation Guidance, v2.0, was replaced in 2015 with an updated Architecture (https://arch.idmanagement.gov/#what-is-the-ficam-architecture)

42. NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access,“ June 2018

43. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, “Digital Identity Guidelines,” updated March 02, 2020

44. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014

45. NIST SP 800-164, “Guidelines on Hardware-Rooted Security in Mobile Devices (Draft),” October 2012

46. Draft National Institute of Standards and Technology Interagency Report (NISTIR) 7981, “Mobile, PIV, and Authentication,” March 2014

47. VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

48. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

49. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

50. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

51. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019

52. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008

53. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (Public Law 110–140), December 19, 2007

54. Section 104 of the Energy Policy Act of 2005, (Public Law 109–58), August 8, 2005

55. Executive Order 13834, “Efficient Federal Operations,” dated May 17, 2018

56. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 2, 2001

57. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

58. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

59. “Veteran Focused Integration Process (VIP) Guide 4.0,” January 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

60. VA Memorandum “Proper Use of Email and Other Messaging Services,” January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

61. “DevSecOps Product Line Management Playbook” version 2.0, May 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

62. NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020

63. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol Version 6 (IPv6),” November 19, 2020

64. Social Security Number (SSN) Fraud Prevention Act of 2017

65. Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23, 2018

3.0 SCOPE OF WORK

The Contractor shall provide vital services that provide Gold Partner premium hardware support and engineering services for over 420,000 Cisco branded devices across the VA enterprise to include Cisco branded Routing and Switching devices, Security systems, UC systems, Wireless Local Area Network (LAN) Systems, TelePresence, telephony, and Data Center/Unified Computing systems (servers and converged virtualization).

The Contractor shall provide SNTC for hardware maintenance support for Cisco branded inventory. The Contractor shall deliver Cisco focused technical support services for portal management, TAC escalation and troubleshooting, HTOM, and TAM. The Contractor shall provide advanced engineering services to support VA in multiple engineering areas of expertise concerning its Cisco related infrastructure inclusive of but not limited to (1) planning, (2) design, (3) configuration, and (4) implementation and testing. The Contractor shall deliver an asset management and tracking tool with government facing access for VA. The asset management tool shall be used to record, track, and monitor products covered under this contract. The Contractor shall also provide Cisco educational credits.

The Contractor shall provide all services and support as defined in this PWS for all VA Administrations, Offices, and operational entities at the place of performance as defined in this PWS.

4.0 PERFORMANCE DETAILS

4.1 PERFORMANCE PERIOD

The Period of Performance (PoP) shall be one (1) year base period with four (4) 1-year option periods, and five optional tasks. The overall PoP shall not exceed 60 months.

Any work at the Government site shall not take place on Federal holidays or weekends, unless directed by the Contracting Officer (CO).

There are eleven (11) Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, five (5) are set by date:

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six (6) are set by a day of the week and month:

4.2 PLACE OF PERFORMANCE

Tasks under this PWS shall be performed primarily at Contractor facilities, with some work performed at remote locations upon advanced concurrence from the Contracting Officer’s Representative (COR) and VA Program Manager. The Contractor shall identify the Contractor’s place of performance within their Contractor Project Management Plan (CPMP) submission. It is expected that this work will be conducted during core business hours, which are defined as 8:00 A.M. to 5:00 P.M. local time, as well as non-core hours (nights and weekends) to include Federal Holidays. The Government will schedule meeting locations as necessary for any specific meetings best accomplished at Government facilities, including but not limited to, user requirements sessions and other key meetings.

For a listing of all current VA facilities, use the VA facility listing drop-down menu found on the following VA web page: https://www.va.gov/directory/guide/home.asp

4.3 TRAVEL

The Government anticipates very limited travel under this effort to perform the tasks associated with the effort. Travel may, however, be required to attend program-related meetings or conferences throughout the period of performance. Travel costs will not be directly reimbursed by the Government and shall be included in the firm fixed price. The estimated amount of travel required under this contract is approximately 5-8 visits per year with no more than 10 total visits per PoP. Travel shall be coordinated with the VA COR and Program Manager.

VA facilities listed at: https://www.va.gov/directory/guide/home.asp

Travel requires advanced concurrence by the COR. Contractor travel within the local commuting area will not be reimbursed.

5.0 SPECIFIC TASKS AND DELIVERABLES

5.1 PROJECT MANAGEMENT

5.1.1 CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Program Management Plan (CPMP) that lays out the Contractor’s approach, timeline and tools to be used in execution of this contract. The CPMP shall take the form of both a narrative and graphic format that displays the schedule, milestones, risks and resource support. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPMP shall be delivered within 10 business days of the award and concurred upon by the Government and updated in accordance with Section B of the Contract. The Contractor shall designate Contractor Program Manager and any additional support personnel they deem necessary and provide the contact information of each individual as part of the CPMP (this will be inclusive of any Cisco designated support personnel as defined in this PWS). The Contractor shall update and maintain and deliver the CPMP throughout the period of performance. The CPMP is at a minimum to be updated annually and at the start of each PoP and upon VA request during contract performance.

As part of the CPMP the following elements shall be included:

1. Meeting Reviews – The Contractor shall provide a summary of all ongoing meetings, activities, and deliverables as defined in this PWS and their status.

2. Project Management Support – Including Resource Allocation, Training, Personnel, and all other efforts necessary to facilitate contract activities.

Deliverable:

A. Contractor Project Management Plan (CPMP)

5.1.2 JOINT PROGRAM MANAGEMENT OFFICE

Support and management oversight of this contract shall be organized under a Joint Program Management Office (JPMO) that will coordinate general support activities, educational activities, and related support requirements. The JPMO shall consist of the VA COR, VA Program Manager, VA Technical Leads, and key Contractor Management Team personnel. Contractor Management team may consist of any prime and sub-contracted support personnel. The Contractor shall provide and update as needed a single unified Contractor Staff Support Roster. This roster shall also include all required elements as required in paragraph 6.2.2 minus any Personally Identifiable Information (PII) which shall be provided to the COR separately using secure VA approved methods.

The Contractor will provide the COR and Program Manager a single unified report which will include the Contractor support staff name, work e-mail, business contact number, and assigned technology area. The format of this report shall be agreed upon by the Contractor, COR, and PPM. This report shall be updated on a monthly basis unless updates are required due to personnel changes.

The initial Contractor Team Roster shall be delivered to the COR and Program Manager within 10 business days of award. Changes to any assigned Contactor representatives on the JPMO shall be provided to the COR/Program Manager within five business days of change or one business day prior to any scheduled monthly JPMO Meeting whichever is first.

The VA Program Manager in coordination with the CO, COR may issue VA Standard Operating Procedures to support effective oversight and implementation of elements of this contract to which the Contractor shall be required to adhere.

Deliverable:

A. Monthly Contractor Roster

5.1.3 PRIVACY TRAINING

The Contractor shall submit Talent Management System (TMS) Training Certificates of completion for VA Privacy and Information Security Awareness and Rules of Behavior and provide signed copies of the Contractor Rules of Behavior in accordance with Section 9, Training, from Appendix C of the VA Handbook 6500.6, “Contract Security”.

The Contractor shall track the status of VA Privacy and Information Security Awareness and Rules of Behavior training for all individuals engaged on the task. The status reporting shall identify a single Contractor Security Point of Contact (POC), the names of all personnel engaged on the task, their initial training date for VA Privacy and Information Security and Rules of Behavior training, and their next required training date. TMS Training Certificates shall be delivered to the COR and Program Manager upon completion. The training shall be delivered 3 days after the assignment of a new contractor is assigned to the contract and is required to be renewed annually.

Deliverable:

A. TMS Training Certificates (VA Privacy and Information Security Awareness and Rules of Behavior)

5.1.4 ELEVATED PERMISSIONS TRAINING

The Contractor shall ensure that all personnel have completed any and all required training prior to giving any elevated permissions to production or pre-prod environments as deemed by the VA’s Security regulations. The Contractor shall provide Elevated Permissions Training Documentation. The Contractor will follow VA policies and procedures to identify the need for any elevated permissions and will follow the least privilege model. Elevated Permissions Training shall be delivered to the COR and Program Manager upon completion in TMS. Elevated Permissions Training Documentation shall be provided to VA COR and Program Manager two days prior to any contractor gaining elevated permissions and shall be updated annually when required.

Deliverable:

A. Elevated Permissions Training Documentation

5.1.5 ONBOARDING

The Contractor shall manage the onboarding of its staff. Onboarding shall include steps to obtain a VA network and email account, complete training, initiate background investigations, and gain physical and logical access, which may include elevated privileges to the necessary development and test environments for the various systems to be enhanced.

A single Contractor Onboarding POC shall be designated by the Contractor who tracks the onboarding status of all Contractor personnel. The Contractor Onboarding POC shall be responsible for accurate and timely submission of all required VA onboarding paperwork to the COR or his/her onboarding designee. The Contractor shall be responsible for tracking the status of all its staff’s onboarding activities. The Contractor shall provide an Onboarding Status Report which includes updates for all in-process staff, including any staff with outstanding onboarding requests for review by the COR and his/her onboarding designee. The Onboarding Status Report shall be provided to VA Program Manager and COR for review within (30) thirty business days after award and updated during the period of performance when required.

Deliverable:

A. Onboarding Status Report

5.1.6 GENERAL REPORTING REQUIREMENTS

5.1.6.1 MONTHLY STATUS REPORTING

The Contractor shall provide the COR and Program Manager with a written Monthly Status Report in electronic form as defined in this PWS. Use of electronic deliverables and shared data portals is optional but encouraged. The report shall include detailed instructions and explanations for each required data element, to ensure that data is accurate and consistent. These reports shall reflect data as of the last day of the preceding month. All references in this PWS to “monthly” reporting requirements are inclusive of this report.

The Monthly Status Report shall provide a detailed summary of all work completed during the reporting period and any work planned for the subsequent reporting period. The report shall identify any problems that arose during the period and a description of how the problem(s) were resolved to include any issues with meeting performance metrics and service level agreements as defined in this PWS. If problems have not been completely resolved, the Contractor shall provide an explanation including their plan and timeframe for resolving the issue. The Contractor shall monitor performance against the CPMP and report any deviations. The Contractor shall keep in communication with VA regularly so that issues that arise are transparent to both parties to prevent escalation of outstanding issues.

Within 5 business days following the technical kickoff meeting a draft report format and proposed content structure shall be provided and concurred on by the COR and Program Manager.

Deliverable:

1. Monthly Status Report

5.1.6.2 SERVICE LEVEL AGREEMENT MONITORING PLAN AND REPORT

The Contractor shall provide the initial service level agreement (SLA) Monitoring Plan and Report to the COR and Program Manager for review and approval within 15 business days of award. Upon approval, the Contractor shall implement SLA monitoring in accordance with the approved plan shall implement SLA monitoring in accordance with their proposed plan and SLA metrics data is to be included as part of its monthly monitoring plan. The Contractor shall provide the SLA Report monthly which shall capture data as specified in the Deliverable Metrics/SLAs in this PWS (paragraph 6.4.1) with the initial report being due 30 business days after award. The SLA Report shall be delivered in conjunction with the Monthly Status Report. All SLAs in this PWS shall be reported monthly.

VA will not hold the contractor responsible for outages caused solely by VA actions. The Contractor will not be penalized for outages originating from GFE, including the VA Enterprise Cloud, insofar as they impact relevant operations (e.g. cloud disaster recovery capabilities).

Deliverable:

A. SLA Monitoring Plan B. SLA Monitoring Report

5.1.6.3 SERVICE LEVEL ROOT CAUSE ANALYSIS

The Contractor shall provide Root Cause Analysis (RCA) report for all outages, performance impacts, service degradations that reaches Severity Level 1. At the request of VA, the Contractor shall provide an RCA report for Severity Level 2-4 outages, performance impacts, or service degradations which are specifically requested by the Program Manager or COR. The Contractor shall provide VA Program Manager and COR with a proposed RCA template for review within 10 business days of award. VA Program Manager shall provide concurrence or revisions to the document within 14 business days from receipt of proposed RCA template. The Contractor shall provide the Preliminary RCA Report to the Program Manager and COR within three (3) business days of resolution of the outage, and a second Detailed RCA Report within fifteen (15) business days of resolution of the outage. Any Contractor provided recommendations contained in any RCA Report shall be reviewed by VA Program Manager and COR for approval prior to implementation. VA considers the RCA reports to be a mission critical element for its operations and will place a significant emphasis on this requirement when evaluating the contractor’s overall contract performance.

The Preliminary RCA Report shall at a minimum include the following:

1. The time the outage started.

2. The time the outage was resolved, and the affected system(s) fully returned to service.

3. A preliminary analysis of the root cause of the outage and any attributing factors.

4. Analysis of how future incidents of the same nature can be prevented or mitigated.

The Detailed RCA Report shall at a minimum include the following:

1. The time the outage started.

2. The time the outage was resolved, and the affected system(s) fully returned to service.

3. An analysis of the root cause of the outage and any attributing factors.

4. Analysis of how future incidents of the same nature can be prevented or mitigated to include code recommendations, hardware modification, best practices.

5. If newer firmware or code is required to be developed, contractor shall provide a timeline for delivery. Provide concrete and implementable recommendations concerning process improvements in support of eliminating any recurring failures.

Deliverable:

A. Preliminary RCA Report B. Detailed RCA Report

5.1.6.4 TECHNICAL ACCOUNT MANAGEMENT (TAM)

The Contractor shall provide the VA with Cisco TAM Services, beginning no later than 15 days after award and each option period. TAM shall be delivered across the Cisco technology verticals of Security, Core Networking, Data Center Switching, Data Center Compute, and Collaboration. TAM shall include the following requirements:

1. 24x7 on-call requirement for high-severity escalations.

2. Lead multiple functions internal/external on critical outages and complex issues.

3. Provide reactive support and builds a relationship with the customer’s operational team(s), typically service operations or network support.

4. Proactively monitor/review progress of all VA cases and engage, as necessary.

5. Provide root cause analysis (RCA) on escalated or recurring issues (problems).

6. Lead and attend weekly/bi-weekly case review calls to drive resolution on reactive break/fix issues and provide technical input to other VA engagements.

7. Provide network level problem resolution (i.e., not just device level) including troubleshooting and diagnosis.

8. Provide transfer(s) of information (TOI), to improve the VA engineering teams technical skills and processes.

9. Deliver reactive trend analysis to proactively detect and manage chronic or recurring network problems.

5.1.6.5 VA COST PER ASSET REPORT

The Contractor shall provide a VA cost per asset report, no later than 15 days after award and each option period, if executed. The report shall be in an agreed upon format and structure which shall show the quantity of the part numbers, total price, and price per item for VA assets currently covered under this agreement. This report will be utilized to determine the Total Cost of Ownership (TCO) for each item and provide price transparency for the value of equipment covered by this contract.

Deliverable:

A. VA Cost Per Asset Report

5.1.7 USER ACCESS AND REPORTING

The Contractor shall forward electronically all requests from all sources for the addition of authorized users to the CEIAESA to the COR and Program Manager for review and approval prior to authorization. Access may not be granted without VA approval. The Contractor shall provide on no less than on a semi-annual basis or upon any significant change, a User Access report of all users authorized to use this agreement for review and updates. The COR and Program Manager shall review and provide any required updates and changes, and actions to the Contractor. The Contractor then shall complete all required changes within five business days.

Deliverable:

A. User Access Report

5.1.8 PROGRAM MEETINGS

5.1.8.1 TECHNICAL KICKOFF MEETING

The Contractor shall hold a technical kickoff meeting within 10 business days after contract award. The Contractor shall present, for review and approval by the Government, the details of the intended approach, work plan, and project schedule for each effort. The Contractor shall propose dates, agenda (shall be provided to all attendees at least five calendar days prior to the meeting), and meeting minutes (shall be provided to all attendees within three calendar days after the meeting). The Contractor shall invite the CO, Contract Specialist (CS), COR and VA Program Manager. The Technical kickoff meeting may be held virtually or at a VA approved location. In addition, the Contractor shall provide all final Technical Kickoff meeting minutes within five business days after the Kickoff Meeting. The Contractor shall track and oversee all Technical Kickoff meeting follow-on items to closure. Tracking of these items will be included in the monthly JPMO Meeting minutes until closed.

Deliverable:

A. Technical Kickoff Meeting Minutes

5.1.8.2 MONTHLY JOINT PROGRAM MANAGEMENT OFFICE MEETING

The Contractor shall conduct and manage virtual monthly JPMO meetings between the VA COR, Program Manager, and Contractor staff. The Contractor (or its designated lead) shall discuss issues, track action items, discuss progress, review deliverables, and address any topics related to the services being provided under this contract. The Contractor shall provide the meeting agenda to all attendees at least one calendar day prior to the meeting. JPMO meeting minutes shall be provided to all attendees within five business days after the meeting. The meeting minutes shall also include any Contractor documentation that was provided for and/or presented at the monthly meetings. The Contractor will provide detailed reporting on any pending action that has had a duration of more than 45 days in any severity level. Reporting format for these meeting minutes shall be coordinated and approved by the COR and Program Manager.

Deliverable:

1. Monthly JPMO meeting minutes.

5.1.8.3 MIDPOINT GOVERNANCE COMMITTEE MEETING

The Contractor shall participate in a Midpoint Governance Committee (MGC) review, conducted virtually, with OIT leadership to brief on general progress and organizational priorities being supported under this contract. The MGC meeting time/date will be announced at least 20 business days prior to the event. The MGC shall be conducted once a year at an agreed upon time approximately six months into the period of performance. The MGC may be a mix of onsite and virtual attendees from both VA and the Contractor, with the participants primarily consisting of mid-level OIT leadership. Tasks accomplished by the Contractor’s team shall be reported and presented during this meeting. A draft report format and proposed content structure shall be provided and concurred on by the COR and Program Manager. All presentation materials shall be delivered at least 24 hours prior to any scheduled MGC. Within five business days after the meeting the Contractor shall provide meeting minutes that include topics covered, key issues/discussion points, actions and copies of any Contractor documentation and/or presentations that were provided and/or presented.

Deliverable:

1. Governance Committee Slides/Minutes

5.1.8.4 ANNUAL EXECUTIVE PROGRAM MANAGEMENT REVIEWS (PMR)

The Contractor shall participate in an annual executive program management review (PMR) that will be presented to VA senior IT leadership on the status of the overall contract. The purpose of this review is to provide VA senior IT leadership with a “snapshot” of the overall program, ongoing work efforts, meeting performance metrics and service level agreements and any VA designated topics. Contractor travel expenses shall be included in the firm-fixed price of this effort and will not be directly reimbursed to the Contractor. Within five business days after the meeting the Contractor shall provide meeting minutes that include topics covered, key issues/discussion points, actions and copies of all presentations. Coordination of this PMR shall be managed by the VA COR in conjunction with the Program Manager with Contractor support. Format and general content of this PMR briefing shall be provided by VA with guidance from VA senior IT leadership.

Deliverable:

1. Annual PMR Minutes

5.1.8.5 AD HOC / TIGER TEAM MEETINGS

As determined by VA the Contractor shall support ad-hoc meetings, briefings and task specific tiger teams to meet unique or special requirements under this contract. Requests for this support presented to the Contractor by any VA IT staff member must be vetted and approved by the COR, Program Manager. The Contractor shall designate personnel to support and virtually attend meetings with VA representatives at a time and frequency as requested by the lead for the meeting or tiger team. Meetings will be documented, and meeting minutes published and copies to be provided to the VA COR, Program Manager. The Contractor shall deliver the meeting minutes for any ad-hoc or tiger team meeting one day prior to the next meeting or within five business days, whichever comes first. Ad-hoc and Tiger Team efforts and progress will be reported during meetings of the JPMO, CPMP, and MSC as directed by the COR or Program Manager.

Deliverable:

1. Ad-Hoc/Tiger Team Meeting Minutes

5.2 CISCO INFRASTRUCTURE SUPPORT SERVICES

The Contractor shall deliver Cisco Infrastructure Support Services and base operating system firmware / software support for agreed upon VA inventory of Cisco hardware equipment and virtual systems. All products contained in the Cisco Install Base (IB), as defined in this PWS, will be covered by complete service coverage under this agreement (Service Full Coverage). The Contractor shall provide this Cisco support for all VA locations as defined in the Place of Performance and inclusive of all support as defined in paragraphs 5.2.1 to 5.2.7. The contractor shall utilize the asset management tool, described in paragraph 5.3.1, to determine coverage and service level of equipment. Cisco and the Contractor will, once per month, identify and validate all new VA assets owned in the prior thirty (30) days. Upon verification of the devices, the equipment will be entitled at the support service level indicated below and will be added to the correct VA support contract at the direction of VA Program Manager and COR. For purposes of clarification, the addition of equipment to coverage is for the purposes of entitlement, and no install base additions during the PoP shall result in a cost or price change for the current PoP.

The Contractor shall deliver Cisco SNTC Support Services for hardware and base operating system firmware / software support for agreed upon Cisco product families as detailed in Table 1 below.

Table 1 - Category Service Coverage

5.2.1 TECHNICAL ASSISTANCE CENTER

The Contractor shall provide unlimited, direct access to the Cisco technical assistance center (TAC) for technical US Based Support. The Contractor shall provide Cisco coverage 24 Hours x 7 Day x 365 Days per Year (24x7x365) via telephone, a web-based portal, e-mail, chat and applications for all hardware and software technical issues. First call \ online support will be directly to United States based Cisco TAC, not to partner or 3rd party. The Contractor shall provide Cisco tracking and progress of the technical support being provided and shall report it as part of the Monthly Status Report. The Cisco TAC shall provide first call access to Cisco support directly to all authorized VA staff and partner contractor support members needing assistance on VA managed Cisco products. VA is the final authority as to whom to grant access to use these services. PWS paragraph 5.1.7 defines how access to use the services set forth in this agreement is granted and reviewed. The Cisco TAC shall include assignment of a dedicated HTOM as detailed in PWS paragraph Section 5.2.6.2.

All TAC cases will be opened using the standard severity levels as defined in the table below. Cases may be elevated from lower severity levels as needed to resolve or restore services at the request of VA or VA support personnel that initiated the original support case.

Table 2 - Severity Levels

performance.

DELIVERABLE METRICS/SLAs:

TAC Case Response: Cases opened at the Severity 1 and Severity 2 levels shall have a response time of 30 minutes or less. Cases opened at the Severity 3 and Severity 4 levels shall have a response time of 60 minutes or less. 97% of all TAC cases shall have a response time less than minimum acceptable performance level over a monthly cycle. The calculated metrics shall be provided in the SLA Monitoring Report, detailed logs of all ticket transactions shall be retained for the evaluation timeframe for audit if necessary.

TAC Case Restoration of Service: The restoration times for Severity 1 cases is four hours from notification and eight hours from notification for Severity 2 cases. The restoration times for Severity 3 cases is next business day (NBD) or better. Severity 4 cases shall have a restoration time of 60 days. 97% of TAC cases shall have a restoration time less than minimum acceptable performance level over a monthly cycle. The calculated metrics shall be provided in the SLA Monitoring Report, detailed logs of all ticket transactions shall be retained for the evaluation timeframe for audit if necessary. The restoration time for a Service Event means the time period commencing upon creation of a TAC Service request and ending when Cisco provides the technical information which, when implemented, will restore the Cisco Product to a satisfactory, usable level of functionality.

5.2.2 EXPERT CARE NATIONAL SERVICES (EXNC)

As a higher security alternate to the TAC, the Contractor will provide access to the Expert Care National Services directly to all authorized VA staff and partner contractor support members needing assistance. The Contractor shall provide US Based support for Cisco Service Request’s and utilize authorized US Based resources. All Data stored by contractor shall have strict access controls enforced. Cases can be directly opened via a secure portal or via TAC with auto-rotation to the Expert Care National Services based on device or system technology. Expert Care National Services cases shall use the same severity levels, response times, and restoration requirements as general TAC cases (PWS paragraph 5.2.1) and will be reported as part of the CEIAESA SLA Monitoring Report.

5.2.3 ADVANCED HARDWARE REPLACEMENT

The Contractor shall provide Cisco 8x5xNext Business Day (NBD) Advanced Hardware Replacement or 24x7x4 onsite service or 24x7x4 Advanced Replacement Parts based on equipment identified by the asset management tool described in section 5.3.1. All equipment in Cisco’s installed base (IB) inventory will either utilize Manufacturer warranty, which will follow Cisco protocols based on current procedures or the service levels (8x5xNBD or 24x7x4 onsite or 24x7x4 Advanced Replacement Parts) identified in section 5.2. If the equipment is identified as 8x5xNBD, the hardware replacement part will be delivered before the end of the following business day, (5PM Local time). If equipment is identified as 24x7x4 the hardware parts for restoration of service will arrive to the location. The Contractor shall only provide new, or Cisco certified as equivalent to new, Cisco hardware of the exact same make and model as the replaced hardware. Factory seconds or remanufactured products are not acceptable. All replacement parts shall be manufactured by Cisco.

Absolutely no “Gray Market Goods” or “Counterfeit Items” or “Counterfeit Electronic Parts” shall be provided under this process. Used, refurbished, or remanufactured parts may be provided. No gray market supplies or equipment shall be provided. Gray market items are Original Equipment Manufacturer (OEM) goods intentionally or unintentionally sold outside an authorized sales territory or sold by non-authorized dealers in an authorized sales territory. No counterfeit supplies or equipment shall be provided. Counterfeit items include unlawful or unauthorized reproductions, substitutions, or alterations that have been mismarked, misidentified, or otherwise misrepresented to be an authentic, unmodified item from the original manufacturer, or a source with the express written authority of the original manufacturer or current design activity, including an authorized aftermarket manufacturer. Unlawful or unauthorized substitutions include used items represented as new, or the false identification of grade, serial number, lot number, date code, or performance characteristics. Electronic part means an integrated circuit, a discrete electronic component (including, but not limited to, a transistor, capacitor, resistor, or diode), or a circuit assembly. Counterfeit electronic part means an unlawful or unauthorized reproduction, substitution, or alteration that has been knowingly mismarked, misidentified, or otherwise misrepresented to be an authentic, unmodified electronic part from the original manufacturer, or a source with the express written authority of the original manufacturer or current design activity, including an authorized aftermarket manufacturer. Unlawful or unauthorized substitution includes used electronic parts represented as new, or the false identification of grade, serial number, lot number, date code, or performance characteristics. Contractor shall be a Cisco, authorized dealer, authorized distributor, or authorized reseller. All replacement parts or devices must be delivered under Cisco authorized distribution channels. All equipment shall be accompanied by the OEM warranty. All associated software for the equipment shall be in accordance with the OEM terms and conditions. If the Contractor becomes aware of or suspects gray market items, counterfeit items, or counterfeit electronic parts through inspection, testing, and authentication efforts of the contractor or its subcontractors; through a Government Industry Data Exchange Program alert; or by other means; shall provide written notice to both the CO and PM within 60 days after the contractor becomes aware of the issue and provide a proposed course of action to Government to remedy the matter.

Once delivered to VA, any storage media or any component capable of retaining VA data to include, at a minimum, rotating hard disk drives, solid state disk drives, PCIe flash media, Universal Serial Bus (USB) memory devices, and 3D XPoint/Optane media shall be retained by VA indefinitely. The contractor shall not remove storage media from VA facilities without the prior written approval of the CO.

All other hardware, appliances, or systems less any media or data/disk storage units may be returned via the standard Cisco return merchandise authorization (RMA) process. VA will submit a Cisco Asset Destruction Approval Request Form as an administrative request prior to disposal of the media/data/disk unit. This will serve as final authorization to for the VA to dispose of the unit per VA sanitization procedures and is not revocable.

The procurement of hardware replacement parts or equipment is considered an IT acquisition for commercial products and as such excepted from the restrictions of the Buy American statute. (41 U.S.C. 8301-8305). The Trade Agreements Act (TAA) (19 USC 2501), however, is applicable under this PWS. If a TAA compliant replacement device is available and meets the timelines for hardware replacement as specified in this PWS section, then that is considered acceptable. If not available in the specified time frame the government will accept a hardware replacement that meets all technical requirements for replacement of the original hardware.

The following table defines Cisco SNTC Replacement of Hardware and Onsite Field Engineer Delivery.

Table 3 – Level of Support

Enterprise level service disruptions are defined as:

Service Disruption: a natural or man-made event that significantly disrupts the operational environment, such as damage to the organization’s building(s) and grounds due to severe weather, or an event that disrupts availability or access to a system, such as loss of utilities (power, telecommunications), accidents, or emergencies within the organization or in the surrounding community.

Major Service Disruption: for the purposes of this document a major service disruption is defined as a service disruption to a critical system that…