CIP PWS Jan 25 2024.pdf

Performance Work Statement

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Office of Information & Technology Office of Information Security

Information Security Policy and Strategy

Cybersecurity Innovation Program

Date: January 25, 2024

VA-24-00011325

PWS Version Number: 1

Contents

1.0 BACKGROUND

2.0 APPLICABLE DOCUMENTS

3.0 SCOPE OF WORK

4.0 PERFORMANCE DETAILS

4.1 PERFORMANCE PERIOD

4.2 PLACE OF PERFORMANCE

4.3 TRAVEL

4.4 KEY PERSONNEL

5.0 Specific Tasks and Deliverables

5.1 PROJECT MANAGEMENT

5.1.1 Contractor Project Management Plan

5.1.2 REPORTING REQUIREMENTS

5.1.3 TECHNICAL KICKOFF MEETING

5.1.4 TRANSITION IN

5.1.5 QUARTERLY PROGRAM REVIEW MEETINGS

5.1.6 VA TRAINING

5.1.7 CONTRACTOR PERSONNEL MANAGEMENT

5.1.7.1 STAFFING PLAN

5.2 Cybersecurity transformation Initiatives

5.2.1 CYBERSECURITY STRATEGIC OPERATIONS

5.2.2 CYBERSECURITY PROGRAM AND SERVICE MANAGEMENT

5.2.3 CYBERSECURITY GOVERNANCE

5.2.4 CYBERSECURITY RESEARCH

5.2.5 CYBERSECURITY RISK AND ANALYTICS

5.2.6 CYBERSECURITY SOLUTIONS DEVELOPMENT

5.2.7 DOMAIN SUBJECT MATTER EXPERT SUPPORT

5.3 SECURITY CONTROL RISK MANAGEMENT SUPPORT

5.4 COMPLIANCE ANALYTICS PROJECT MANAGEMENT SUPPORT

5.5 MODULAR DELIVERY (Optional Tasks)

5.5.1 CYBERSECURITY RESEARCH SMALL

5.5.2 CYBERSECURITY RESEARCH MEDIUM

5.5.3 CYBERSECURITY RESEARCH HIGH

5.5.4 CYBERSECURITY RISK AND ANALYTICS SMALL

5.5.5 CYBERSECURITY RISK AND ANALYTICS MEDIUM

5.5.6 CYBERSECURITY RISK AND ANALYTICS HIGH

5.5.7 CYBERSECURITY SOLUTION DEVELOPMENT SMALL

5.5.8 CYBERSECURITY SOLUTION DEVELOPMENT MEDIUM

5.5.9 CYBERSECURITY SOLUTION DEVELOPMENT HIGH

5.6 TRANSITION SUPPORT (OPTIONAL TASK)

6.0 GENERAL REQUIREMENTS

6.1 ENTERPRISE AND IT FRAMEWORK

6.1.1 VA TECHNICAL REFERENCE MODEL

6.1.2 FEDERAL IDENTITY, CREDENTIAL, AND ACCESS MANAGEMENT

(FICAM)

6.1.3 INTERNET PROTOCOL VERSION 6 (IPV6)

6.1.4 TRUSTED INTERNET CONNECTION (TIC)

6.1.5 STANDARD COMPUTER CONFIGURATION

6.1.6 VETERAN FOCUSED INTEGRATION PROCESS (VIP) AND PRODUCT

LINE MANAGEMENT (PLM)

6.1.7 PROCESS ASSET LIBRARY (PAL)

6.1.8 AUTHORITATIVE DATA SOURCES

6.1.9 SOCIAL SECURITY NUMBER (SSN) REDUCTION

6.2 SECURITY AND PRIVACY REQUIREMENTS

6.2.1 POSITION/TASK RISK DESIGNATION LEVEL(S)

6.2.2 CONTRACTOR PERSONNEL SECURITY REQUIREMENTS

6.3 METHOD AND DISTRIBUTION OF DELIVERABLES

6.4 PERFORMANCE METRICS

6.5 FACILITY/RESOURCE PROVISIONS

6.6 GOVERNMENT FURNISHED PROPERTY

6.7 ORGANIZATIONAL CONFLICT OF INTEREST

ADDENDUM A – ADDITIONAL VA REQUIREMENTS, CONSOLIDATED

1.0 BACKGROUND

The Department of Veterans Affairs (VA), Office of Information & Technology (OIT), Office of Information Security (OIS) delivers available, adaptable, secure, and cost-effective technology services to VA, transforming the Department into an innovative, 21st century organization, and acts as a steward for all VA’s IT assets and resources.

OIT delivers the necessary technology and expertise that supports Veterans and their families through effective communication and management of people, technology, business requirements, and financial processes. To meet these goals, OIT strives to provide high quality, effective, and efficient Information Technology (IT) services to those responsible for providing care to the Veterans at the point-of-care as well as throughout all the points of the Veterans’ health care in an effective, timely and compassionate manner. VA depends on Information Management/ Information Technology (IM/IT) systems to meet mission goals.

It is important that Veterans’ most sensitive information about their personal identity and medical records be protected. VA systems contain sensitive but unclassified data, personally identifiable information (PII), and protected health information (PHI) that, if compromised, may have a negative impact on Veterans, VA, and the Federal Government. The challenge is to ensure that VA safeguards this information in a way that minimizes any interference with the business processes and technologies that are used to deliver services to our nation’s Veterans. To meet this challenge and comply with Federal legislation, VA established an enterprise-wide information security program with a mission promising to “serve our Veterans, their beneficiaries, employees, and all VA stakeholders by ensuring the confidentiality, integrity, and availability of VA sensitive information and information systems.”

The business of VA, the second largest cabinet Department, is a massive, far-reaching, and complex effort that truly exemplifies direct public service to very special United States (U.S.) citizens. There are 20 million living Veterans, and about a quarter of the nation's population is potentially eligible for VA benefits and services because they are Veterans or beneficiaries of Veterans.

To serve that constituency, VA operates a network of more than 1,500 facilities, and has over 350,000 employees. Among the many professions represented in the vast VA workforce are physicians, nurses, counselors, statisticians, architects, engineers, computer specialists, and attorneys.

VA computer networks encounter over 45 million weekly security related events and have over 500,000 workstations, 350,000 users, 500 network security appliances, and 25,000 servers.

VA’s direction of the information protection efforts expresses what and where information security controls need to be implemented in order to help further VA IT goals and objectives and achieve the VA mission. This builds on the VA information protection mission by providing direction and describing the future state of enterprise-wide security. VA’s Cybersecurity Strategy Goals outline our approach to countering the cybersecurity threat, while continuing to innovate and adapt to a rapidly changing IT landscape:

Goal 1. Secure and protect VA and Veteran information Goal 2. Protect information systems and assets Goal 3. Leverage innovation to strengthen cybersecurity Goal 4. Enhance cybersecurity through partnerships and information sharing Goal 5. Empower VA mission through cybersecurity risk management

In meeting these goals, the Department of Veterans Affairs (VA), Office of Information & Technology (OIT), and the Office of Information Security (OIS) strive to provide high quality, effective, efficient, and secure Information Technology (IT) services to those responsible for providing care to the Veterans at the point-of-care, as well as throughout all the points of the Veterans’ health care environment in an effective, timely and compassionate manner. The Information Security Policy and Strategy (ISPS) Division supports this mission by developing, monitoring, and implementing projects and programs that support Information Management/Information Technology (IM/IT) cybersecurity needs.

The Office of Information Security (OIS) established the Enterprise Audit Readiness Program (EARP) under the authority of a December 2017 VA Chief Information Security Officer (CISO) memorandum to continually enhance enterprise security capabilities to meet these multiple innovation needs. EARP drives this enhancement via OIT-wide cybersecurity projects and initiatives that are prioritized based on a broad range of factors, such as the overall VA mission, healthcare-industry leading practices, and the OIG annual audit findings. Thus, the prioritization factors have been comprehensive.

EARP, however, has been somewhat limited in the emerging tools and technologies available to address cybersecurity projects and enhance their capabilities. Traditionally, only more mature technologies typically align with the lengthy procurement cycles at VA due to its size and complexity. This almost eliminates VA’s ability to interact with, and leverage, the ecosystem of emerging startup cybersecurity companies that have the agility to rapidly respond to the evolving threat landscape - increasingly inclusive of nation state actors – and provide innovative and disruptive solutions to mitigate the existing and potential material weaknesses and support advanced technology transformation.

Unforeseen and rapidly evolving occurrences such as the recent COVID-19 pandemic accentuate the need to develop the ability to rapidly respond to fast moving, unanticipated events and requirements from VA stakeholders. Recent examples include secure telemedicine using off-the- shelf Bring Your Own Device (BYOD) and non-PIV identity management technologies. To achieve these goals, OIS must establish access to an ongoing compendium of innovative and effective technologies that are available to rapidly respond to or mitigate risks in response to critical special situations. A compendium of innovative technologies is inaccessible through the traditional procurement process, thus requiring OIS to establish an agile, proactive, and measurable Cybersecurity Innovation Program (CIP).

VA requires a Contractor deeply embedded and connected to existing and emerging cybersecurity innovation ecosystems to assist OIS to gain visibility and proactively respond to cybersecurity threats. Integrating CIP into OIS will directly enhance support of the VA Digital Transformation Strategy; one of the four core values of the Strategy is innovation that supports “OIT’s mission to collaborate with our business partners to create the best experience for all Veterans”. The OIS CIP will recommend effective disruptive technology solutions to near-term VA cybersecurity challenges, proactively provide long-term strategic cybersecurity recommendations based on continual technology scouting and innovation horizon scanning and support ongoing ISPS efforts to develop enterprise cybersecurity policy and mitigations to OIG findings. These pillars

– near-term innovation solutions, long-term innovation strategies, policy, and mitigations to OIG findings – provide the framework for an actionable and measurable OIS CIP.

To accomplish this, OIS needs the support of a Contractor with large scale commercial and Federal cybersecurity and digital transformation experience with in-house real-world experience in change management in support of technology and identifying, assessing, and recommending high-pedigree innovative technologies and organizational modernization efforts. With the foundation of the current Cybersecurity Innovation Program contract, the Contractor must also quickly activate an ecosystem of domestic and global vendors and partnerships based on well-established existing relationships.

2.0 APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. 44 U.S.C. § 3541-3549, “Federal Information Security Management Act (FISMA) of 2002”

2. “Federal Information Security Modernization Act of 2014”

3. Federal Information Processing Standards (FIPS)

Publication 140-2, “Security Requirements For Cryptographic Modules”

4. FIPS Pub 199. Standards for Security Categorization of Federal Information and Information Systems, February 2004

5. FIPS Pub 200, Minimum Security Requirements for Federal Information and Information Systems, March 2016

6. FIPS Pub 201-2, “Personal Identity Verification of Federal Employees and Contractors,” August 2013

7. 10 U.S.C. § 2224, "Defense Information Assurance Program"

8. Carnegie Mellon Software Engineering Institute, Capability Maturity

Model® Integration for Development (CMMI-DEV), Version 1.3

November 2010; and Carnegie Mellon Software Engineering Institute, Capability Maturity Model® Integration for Acquisition (CMMI-ACQ), Version 1.3 November 2010

9. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

10. Public Law 109-461, Veterans Benefits, Health Care, and Information

Technology Act of 2006, Title IX, Information Security Matters

11. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”

12. VA Directive 0710, “Personnel Security and Suitability

Program,” June 4, 2010, https://www.va.gov/vapubs/index.cfm

13. VA Handbook 0710, Personnel Security and Suitability

Program, May 2, 2016, https://www.va.gov/vapubs/index.cfm

14. VA Directive and Handbook 6102, “Internet/Intranet Services,” August 5, 2019

15. 36 C.F.R. Part 1194 “Information and Communication

Technology Standards and Guidelines,” January 18, 2017

16. Office of Management and Budget (OMB) Circular A-130, “Managing Federal Information as a Strategic Resource,” July 28, 2016

17. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed Services (CHAMPUS)”

18. NIST SP 800-66 Rev. 1, An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule, October 2008

19. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended, January 18, 2017

20. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

21. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021

22. VA Handbook 6500, “Risk Management Framework for VA

Information Systems VA Information Security Program,” February 24,

23. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI)”, June 30, 2023

24. VA Handbook 6500.5, “Incorporating Security and Privacy into the System Development Lifecycle”, March 22, 2010

25. VA Handbook 6500.6, “Contract Security,” March 12, 2010

26. VA Handbook 6500.8, “Information System Contingency Planning”, April 6, 2011

27. VA Handbook 6500.11, “VA Firewall Configuration”, August 22, 2017

28. OI&T Process Asset Library (PAL), https://www.va.gov/process/ .

Reference Process Maps at https://www.va.gov/process/maps.asp and Artifact templates at https://www.va.gov/process/artifacts.asp

29. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.a spx)

30. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014

31. VA Handbook 6508.1, “Procedures for Privacy Threshold Analysis https://www.va.gov/vapubs/index.cfm https://www.va.gov/vapubs/index.cfm https://www.va.gov/process/ https://www.va.gov/process/maps.asp https://www.va.gov/process/artifacts.asp https://www.va.gov/trm/TRMHomePage.aspx https://www.va.gov/trm/TRMHomePage.aspx and Privacy Impact Assessment,” July 30, 2015

32. VA Handbook 6510, “VA Identity and Access Management”, January 15, 2016

33. VA Directive and Handbook 6513, “Secure External Connections”, October 12,

34. VA Directive 6300, Records and Information Management, September 21, 2018

35. VA Handbook, 6300.1, Records Management Procedures, March 24, 2010

36. NIST SP 800-37 Rev 1, Risk Management Framework for

Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy, December 2018

37. NIST SP 800-53 Rev. 5, Security and Privacy Controls for Federal Information Systems and Organizations, September 23, 2020 (includes updates as of 12/10/2020)

38. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol Version 6 (IPv6), November 19, 2020

39. VA Directive 0735, Homeland Security Presidential Directive 12 (HSPD-12) Program, October 26, 2015

40. VA Handbook 0735, Homeland Security Presidential Directive 12 (HSPD-12) Program, March 24, 2014

41. OMB Memorandum 05-24, Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors, August 5, 2005

42. OMB memorandum M-11-11, “Continued Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors, February 3, 2011

43. OMB Memorandum, Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation, May 23, 2008

44. Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance, December 2, 2011

45. NIST SP 800-116 Rev 1, Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access, June 2018

46. OMB Memorandum M-07-16, Safeguarding Against and Responding to the Breach of Personally Identifiable Information, May 22, 2007

47. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, Digital Identity Guidelines, December 2017

48. NIST SP 800-157, Guidelines for Derived PIV Credentials, December 2014

49. NIST SP 800-164, Guidelines on Hardware-Rooted Security in

Mobile Devices (Draft), October 2012

50. VA Memorandum, VAIQ #7100147, Continued Implementation of

Homeland Security Presidential Directive 12 (HSPD-12), April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

51. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514

Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

52. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=48

53. Trusted Internet Connections (TIC) Reference Architecture Document, Version 2.2, Federal Interagency Technical Reference Architectures, Department of Homeland Security, June 19, 2017, https://www.dhs.gov/sites/default/files/publications/TIC_Ref_Arch _v2.2_2017.pdf

54. OMB Memorandum M-08-05, “Implementation of Trusted Internet Connections (TIC), November 20, 2007

55. OMB Memorandum M-08-23, Securing the Federal Government’s Domain Name System Infrastructure, August 22,

56. VA Memorandum, VAIQ #7497987, Compliance – Electronic Product Environmental Assessment Tool (EPEAT) – IT Electronic Equipment, August 11, 2014 (reference Document Libraries, EPEAT/Green Purchasing Section, https://www.voa.va.gov/documentlistpublic.aspx?NodeID=552)

57. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (Public Law 110–140), December 19, 2007

58. Section 104 of the Energy Policy Act of 2005, (Public Law 109–58), August 8,

59. Executive Order 13834, “Efficient Federal Operations”, dated May 17, 2018

60. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 2,

61. VA Directive 0058, “VA Green Purchasing Program”, July 19, 2013

62. VA Handbook 0058, “VA Green Purchasing Program”, July 19, 2013

63. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote Access”, January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

64. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

65. “Veteran Focused Integration Process (VIP) Guide 4.0”, March 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentI D=4371

66. VA Memorandum “Proper Use of Email and Other Messaging Services”, January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

67. OMB Circular No. A-11

68. American Innovation and Competitiveness Act (AICA)

69. “Federal Cyber Security Research and Development Strategic

Plan”, December 2019, https://www.whitehouse.gov/wp-https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896 https://www.dhs.gov/sites/default/files/publications/TIC_Ref_Arch_v2.2_2017.pdf https://www.dhs.gov/sites/default/files/publications/TIC_Ref_Arch_v2.2_2017.pdf https://www.voa.va.gov/documentlistpublic.aspx?NodeID=552 https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371 https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 https://www.whitehouse.gov/wp-content/uploads/2019/12/Federal-Cybersecurity-RD-Strategic-Plan-2019.pdf content/uploads/2019/12/Federal-Cybersecurity-RD- Strategic-Plan- 2019.pdf

70. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.M08gov/publication/tic-30-core-guidance-documents

71. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019

72. "DevSecOps Product Line Management Playbook” version 2.0, May 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

73. NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020

74. OMB Memorandum M-21-07, “Completing the Transition to Internet

Protocol Version 6 (IPv6),” November 19, 2020

75. Social Security Number (SSN) Fraud Prevention Act of 2017

76. Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23, 2018

3.0 SCOPE OF WORK

The Contractor shall support the OIS Cybersecurity Innovation Program (CIP) as a managed service provider. This includes:

Project Management, Cybersecurity strategic operations, Program and service management, Governance, Research, Risk and analytics, Solution delivery, Domain subject expert support, Security control risk management, and Compliance analytics project management support.

4.0 PERFORMANCE DETAILS

4.1 PERFORMANCE PERIOD

The Period of Performance (PoP) shall be 12 months from the date of award, with four (4), 12- month option periods. The overall Period of Performance shall not exceed 60 months.

Any work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO).

There are eleven (11) Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, four are set by date:

https://www.whitehouse.gov/wp-content/uploads/2019/12/Federal-Cybersecurity-RD-Strategic-Plan-2019.pdf https://www.whitehouse.gov/wp-content/uploads/2019/12/Federal-Cybersecurity-RD-Strategic-Plan-2019.pdf https://www.whitehouse.gov/wp-content/uploads/2019/12/Federal-Cybersecurity-RD-Strategic-Plan-2019.pdf https://www.cisa.gov/publication/tic-30-core-guidance-documents https://www.cisa.gov/publication/tic-30-core-guidance-documents https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

New Year's Day January 1 Juneteenth June 19 Independence Day July 4 Veterans Day November 11 Christmas Day December 25

If any of the above falls on a Saturday, then Friday shall be observed as a holiday.

Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

Martin Luther King's Birthday Third Monday in January Washington's Birthday Third Monday in February Memorial Day Last Monday in May Labor Day First Monday in September Columbus Day Second Monday in October Thanksgiving Fourth Thursday in November

4.2 PLACE OF PERFORMANCE

Tasks under this Contract/Task Order (TO) shall be performed at Contractor facilities, as well as the VA Central Office (VACO) Government facility for meetings and coordination as needed. The Contractor shall identify the Contractor’s place of performance in their proposal submission.

The Contractor staff shall be available to coordinate with VA-OPS staff on normal Federal Government workdays and shall be responsive between the core hours of 8:00am and 5:00pm EST.

VA will provide working space for up to four (4) contractor staff at the ISPS offices located at 811 Vermont St. Washington, DC. Any work at the

4.3 TRAVEL

At the Government’s request, there may be anticipated travel under this effort to perform the tasks associated with the effort, as well as to attend program-related meetings or conferences throughout the PoP. Include all estimated travel costs in your firm-fixed price line items. These costs will not be directly reimbursed by the Government.

The total estimated number of trips in support of the program related meetings for this effort is four trips per year. Possible locations of the four trips include the following, each trip estimated at five business days in duration, estimated of persons per trip is two:

1. Washington, DC

2. Hines, IL

3. Martinsburg, WV

4. Austin, TX

4.4 KEY PERSONNEL

The Contractor shall provide resources that have the requisite skills and experience required to perform the tasks within the PWS. The Contractor agrees that the personnel identified below, as key to supporting this effort, shall not be removed from the TO effort, replaced or added to the contract without a compelling reason and without written notification to the Contracting Officer (CO).

It is the responsibility of the Contractor to provide Contractor support personnel and subcontractors who have the required educational background, experience, security clearance, and access authorization or combination thereof to meet the labor category descriptions under this task order for the required PWS tasks.

If any change to the Key Personnel assigned to the labor categories identified below becomes necessary (initial staffing, substitutions or additions), the Contractor shall immediately notify the CO/COR/PM in writing, accompanied by the resume, if applicable, of the proposed replacement personnel who shall be of at least substantially equal ability and qualifications as the individual(s) currently performing in that category and that the proposed replacement meets or exceeds the qualifications designated for that Key Personnel position. It is expected that substitution or replacement of the personnel will not occur within the first six (6) months after date of award.

The Contractor agrees that it has a contractual obligation to mitigate the consequences of the loss of Key Personnel and shall promptly secure any necessary replacements in accordance with (IAW) this PWS section. Failure to replace a Key Personnel pursuant to this clause and without a break in performance of the labor category at issue shall be considered a condition endangering contract performance and may provide grounds for default termination.

The labor categories below in Table 1 are identified as Key Personnel. Key Personnel must meet the corresponding requirements identified in the Labor Description column below:

Table 1: KEY PERSONNEL

Labor Category Labor Description Program Manager Expertise

• Minimum of 10 years expertise in managing cybersecurity and risk management projects and programs at large scale federal departments/agencies (e.g. VA, DOD, DHS, HHS, etc.).

• Minimum of 10 years expertise as a program manager accountable for delivery for at least 10 cybersecurity professionals with a duration of greater than one year.

• CISSP or PMP Certification Minimum Education Level

• Master’s Degree In:

• Business Administration, Business Management, Computer Science, Information Systems, Risk Management, Cybersecurity or related fields.

Project Manager Expertise

• Minimum of 10 years expertise demonstrating knowledge and management cybersecurity and risk management projects and programs at large scale federal departments/agencies (e.g. VA, DOD, DHS, HHS, etc.)

• PMP Certification

Minimum Education Level

• Bachelor’s degree in

• Business Administration, Business Management, Computer Science, Information Systems, Risk Management, Cybersecurity or related fields.

Technical Solution Lead

Expertise

• Minimum 5 years expertise demonstrating knowledge and application acumen to execute cyber transformation efforts including risk scoring leveraging threat intel data, driving data visualization with disparate sets of technical data.

Minimum Education Level

• High School or GED

Policy Analyst, Sr. Expertise

• Minimum 5 years expertise demonstrating knowledge analyzing and supporting public policy implementation at federal departments or agencies.

Demonstrated successful policy implementation at multiple large-scale deployments.

Minimum Education Level Bachelor’s (J.D. preferred) degree in,

• Public Policy, Law, Cybersecurity, Information Systems or related fields.

Change Management and Organizational Transformation SME

Expertise

• Minimum 5 years expertise leading transformation programs, change management efforts in a clinical setting

Minimum Education Level

• Bachelor’s (Master’s preferred) degree in

• Public Health degree or related fields.

Information Technology Assessment SME

Expertise

• Minimum 5 years expertise in public and private sector

Internal Control Assessment/Risk Assessment and Internal Control Testing.

• Information Systems Audit and Control Association (ISACA) preferred (e.g. ISA, CISM, CRISC, CDPSE or

CGEIT).

Minimum Education Level

• Bachelor’ s degree in

• Business Administration, Business Management, Computer Science, Information Systems, Cybersecurity, Risk Management, or related fields.

IT Delivery Manager, II Expertise

• 5 or more years managing the successful deliver of IT projects at large scale public agencies or private industry

• Demonstration management of schedule, budget and communication with stakeholders.

Minimum Education Level

• Bachelor’s degree in

• Business Administration, Business Management, Computer Science, Information Systems, Cybersecurity or related fields.

Cybersecurity Analyst, Sr

Expertise

• 5 years’ experience in analyzing cybersecurity and risk management projects at large scale federal departments/agencies(e.g. VA, DOD, DHS, HHS, et al.)

• CISSP or related certification.

Minimum Education Level

• Bachelor’s degree in

• Computer Science, Information Systems, Cybersecurity, Risk Management or related fields.

The Contractor shall perform the following:

5.0 SPECIFIC TASKS AND DELIVERABLES

5.1 PROJECT MANAGEMENT

5.1.1 Contractor Project Management Plan

The Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach timeline and tools to be used in execution of this effort.

The purpose of this plan is to ensure that the Government and the Contractor understand and manage risk, communications schedules, deliverable, quality and human resources. The Contractor shall provide a draft CPMP at the Kickoff Meeting.

The CPMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks and resource support. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPMP shall be concurred upon and updated in accordance with Section B of the contract/TO. The contractor shall update and maintain the VA Program Manager (PM) approved CPMP throughout the Pop.

The CPMP shall include subsidiary plans which further detail the approach to be used for each aspect of the PWS. The CPMP shall include the following:

1. Schedule Management Plan: Shall include a schedule of all deliverables planned.

2. Scope Management Plan: Shall describe how the contractor will control the activities and deliverables and the roles and responsibilities of everyone involved; shall also address:

a. Who has authority and responsibility for scope management.

b. How the scope is measured and verified (i.e., Quality Checklists, Scope Baseline, Work Performance Measurements, etc.).

c. Who is responsible for final acceptance of project scope and deliverables.

3. Staffing Management Plan: Shall illustrate and detail the arrangement of Management, Key and Support personnel assigned to the contract, as well as corporate reach-back for staff augmentation.

4. Quality Control Plan: Shall detail plan to establish a program to ensure all work products and deliverables submitted to the Government are accurate, free of errors or defects.

5. Communications Plan: Shall list the roles and contact information of all Management and key personnel both for the Contractor and Government, tasks and functional area assignments and associations.

6. Risk Management Plan: Shall detail all risks that actually or potentially impact contract success, to include a common name or title, probability, impact, risk score, origin, explanation, planned or recommended mitigation.

VA may provide templates/shells for each plan and the VA PM will provide guidance to the Contractor on the necessary inputs/ information that are required to develop the outputs for each one of the subsidiary plans. The above list may be updated by VA to include additional subsidiary plans.

Deliverable:

A. Contractor Project Management Plan

5.1.2 REPORTING REQUIREMENTS

The Contractor shall provide the COR with Monthly Progress Reports in electronic form in Microsoft Word and Project formats. The report shall include detailed instructions/explanations for each required data element, to ensure that data is accurate and consistent. These reports shall reflect data as of the last day of the preceding Month.

The Monthly Progress Reports shall cover all work completed during the reporting period and work planned for the subsequent reporting period. The report shall summarize the activities which took place during the previous period to include but not limited to: stakeholder inputs for cybersecurity initiatives, emerging threats discovered, suggested areas of potential innovation and the strategies for incorporating them, technology scouting and solution discovery activities, briefings and whitepapers that took place, and in later years, innovation-informed policy development support and OIS program support provided. The report shall also identify any problems that arose and their resolution as well as potential risks and suggested mitigations. If problems have not been completely resolved, the Contractor shall provide an explanation including their plan and timeframe for resolving the issue. The report shall also include an itemized list of all Electronic and Information Technology (EIT) deliverables and their current Section 508 conformance status. The Contractor shall monitor performance against the CPMP and report any deviations. It is expected that the Contractor will keep in communication with VA accordingly so that issues that arise are transparent to both parties to prevent escalation of outstanding issues.

The Contractor shall create and maintain a Microsoft SharePoint repository to be provided by OIS to support the data monitoring and management for this program. The repository shall be the main location where all documentation related to this program are kept including copies of deliverables as well as formal and informal work products.

The Contractor shall manage, and store artifacts produced on behalf of OIS. The Contractor shall manage the maintenance and user privileges for the SharePoint site at the direction of the VA PM.

The Contractor shall also schedule and coordinate a weekly status meeting virtually to review the current status of each task, provide recommendations on next steps, and alert VA of any risks, impediments or urgent issues that arise along with suggested mitigation actions. For each task, the weekly status meeting will include a quadrant (quad) chart in Microsoft PowerPoint format that describes (1) recent accomplishments,

(2) planned activities, (3) a timeline of upcoming milestones and deliverables for the next quarter and updates on a rolling basis, and (4) risks and suggested mitigation actions. The Government PM will provide a template of the quad chart to the Contractor after award.

Deliverable:

A. Monthly Progress Report B. Weekly Status Quad Chart

5.1.3 TECHNICAL KICKOFF MEETING

A technical kickoff meeting shall be held within 10 days after award. The technical kickoff meeting shall be onsite at a VA facility (location to be determined, some attendees may be virtual). The Contractor shall coordinate the date, time, and location with the Contracting Officer (CO), as the Post-Award Conference Chairperson, the VA PM (Co- Chairperson), the Contract Specialist (CS), and the COR. The Contractor shall provide a draft agenda to the CO and VA PM at least five calendar days prior to the meeting. Upon Government approval of a final agenda, the Contractor shall distribute to all meeting attendees. During the kickoff-meeting, the Contractor shall present, for review and approval by the Government, the details of the intended approach, work plan, and project schedule for each effort via a Microsoft Office PowerPoint presentation. At the conclusion of the meeting, the Contractor shall update the presentation with a final slide entitled “Summary Report” which shall include notes on any major issues, agreements, or disagreements discussed during the kickoff meeting and the following statement “As the

Post-Award Conference Chairperson, I have reviewed the entirety of this presentation and assert that it is an accurate representation and summary of the discussions held during the Technical Kickoff Meeting for the CIP Support effort.” The Contractor shall submit the final updated presentation to the CO for review and signature within three calendar days after the meeting. The Contractor shall also work with the CS and the Government’s designated note taker, to prepare and distribute the Meeting Minutes of the kickoff meeting to the CO, COR and all attendees within three calendar days after the meeting. The Contractor shall obtain concurrence from the CS on the content of the Meeting Minutes prior to distribution of the document.

Deliverable:

A. Summary Report Presentation B. Meeting Minutes

5.1.4 TRANSITION IN

The Contractor shall begin transitioning in task support immediately after completion of the kickoff meeting and remain in effect for 45 days. The Contractor shall participate in any Phase-In Transition Plan meetings scheduled by the outgoing Contractor or with the VA COR, or VA organizations identified by the COR.

The incoming Contractor shall perform the following activities:

a. Participate in reviews of program documentation

b. Participate, as an observer, such as desk side knowledge sharing in the day-to-day tasks performed by the outgoing contractor for the purpose of knowledge sharing, understanding all standard operating procedures, VA stakeholders, meeting attendance, report training, and business workflows and processes

c. Acquire knowledge of all details on accessing and analyzing of applicable tools and repositories

d. Provide VA COR with ongoing status of Government-required (on-boarding) training, clearances, access, and certification processes

e. Provide VA COR and OIS Management with daily status updates on hiring and staffing until such time that full staffing is reached.

f. Key Personnel, identified in Table 1, shall be onboarded within 14 business days of award.

5.1.5 QUARTERLY PROGRAM REVIEW MEETINGS

The Contractor shall hold Quarterly Program Review meetings and provide an oral presentation, PowerPoint briefing, along with written supporting documentation in the form of a Quarterly Program Status Report that summarizes the delivery of services for previous quarter as required by this PWS. The Contractor shall identify issues encountered and any future upgrade projects. The Contractor shall address key issues, to include the elements included in the CPMP, to include TO and security performance measure reporting. The information in the Quarterly Program Status Report will be used as the basis for evaluating VA CSOC security goal achievement, and whether any projects have adequately demonstrated through testing to meet its functional and performance requirements, and whether project output is adequately supported by documentation, training, etc. The Contractor shall give this briefing and submit the supporting Quarterly Program Status Report to VA Team Leads, COR, and PM. The meetings may be conducted in-person, in Washington, DC, Philadelphia Information Technology Center, Martinsburg WV, or Hines, IL., at the Government’s request.

The Contractor shall create and provide a Monthly Status Executive Briefing on the current status of the Program summarizing the achievements, functional and performance requirements status, project output quality, staffing, and items of concern to be provided to the Government at least once a month, with the expectation that the approved Executive Briefing, upon their request, will then be provided to OIS Executive Leadership.

Deliverable:

A. Quarterly Program Status Report B. Monthly Status Executive Briefing

5.1.6 VA TRAINING

The Contractor shall ensure all VA CIP Contract Personnel engaged on this effort complete VA required and provided training. The current core requirements include VA Privacy and Information Security Awareness Training and Rules of Behavior Status.

Role based specific training of equivalent complexity may also be required. VA has the right to modify the training requirements. Completion of these training requirements are required during the on-boarding of personnel and required to begin individual performance.

The Contractor shall submit VA Privacy and Information Security Training Certificates for each Contractor employee in accordance with Appendix C of the VA Handbook 6500.6, “Contract Security”. The training referenced above is required to be renewed annually.

The Contractor shall provide VA COR with progress and completion status of VA Privacy and Information Security Awareness Training and Rules of Behavior in the form of a Training Status Report. The Training Status Report shall convey the following: first and last name of all Contractor personnel engaged on the effort, their initial training completion date(s), next required training date. The training status report and completion certificates shall be maintained by the Contractor in a VA provided central location. The Contractor shall provide a Quarterly Staff Certification Report that track and report all industry certifications held and obtained by Contractor staff on a quarterly basis, the first business day of each quarter, and upon new hire onboarding.

Deliverable:

A. Training Status Report B. Quarterly Staff Certification Report

5.1.7 CONTRACTOR PERSONNEL MANAGEMENT

In support of more efficient onboarding, the Contractor shall provide dedicated support for VA Onboarding/Offboarding Service Portal for all personnel working under this TO.

As part of this support, the Contractor shall ensure that all personnel who require privilege level access to network devices, servers, security devices and/ or desktop systems shall possess industry standard knowledge and skill sets specific to the technology to be accessed with the prescribed experience defined in the below sections of the PWS. Where qualifications are not specifically called out, the Contractor shall provide resources adequately qualified to successfully perform the described functions.

5.1.7.1 STAFFING PLAN

The Contractor shall provide a Staffing Plan in the form of an Excel file within three business days after award, following the requirements provided for in Section 4 Table 1, above.. The Contractor shall develop and present the Government with a Staffing Plan that includes; the Labor Category (LCAT), resource function/role, resource name, PWS Task Section affiliation, requirements (experience and/or certifications) met, physical location, and onboarding/offboarding status as well as any positions that do not yet have a candidate selected. The ability to sort and filter on all categories will be reflected in the Staffing Plan. This shall also include Key Personnel Positions (See PWS Section 4).

Deliverable:

A. Staffing Plan

5.2 CYBERSECURITY TRANSFORMATION INITIATIVES

VA’s cybersecurity innovation challenges evolve rapidly and unexpectedly as VA programs adapt to a maturing technology portfolio and a dynamic threat landscape. It is an organizational and operational imperative that OIS be proactively engaged in emerging VA program objectives, understand fully the impact of emerging threats, and inform areas of potential innovation. The Contractor shall perform the CIP Program Management tasks identified below.

Effective cybersecurity transformation within an organization as large and complex as the VA requires a suite of capabilities and services, to include: cybersecurity strategic operations; cybersecurity program and service management; cybersecurity governance;

cybersecurity research; cybersecurity risk and analytics; cybersecurity solution development; and domain subject matter expert support. Executing the above activities help drive cybersecurity strategy transformation outcomes, including but not limited to:

1. Optimizing operational efficiency - Moving beyond organizational silos and embracing an integrated approach in how VA delivers information security services to our customers and protecting sensitive information

2. Advancing VA as a leader in cybersecurity - Drawing on public and private sectors to establish baseline and future benchmarks for organizational strategy and capabilities and maturing with evolving demands

3. Transforming risk management - Driving continuous improvement to amplify the understanding of the risk landscape across all system boundaries

4. Evolving automation capabilities - Integrating proven automation practices to enhance cybersecurity with an intentional purpose to introduce an agile approach to common and repetitive security activities

The tasks and activities that make up these capabilities and services are detailed in the following sections.

5.2.1 CYBERSECURITY STRATEGIC OPERATIONS

As an organization mature its capabilities, using its strategy as a guidepost for downstream activities is critical to stakeholder engagement and prioritization. This results in roadmap development and execution, promotes alignment, and informs the pace at which transformation occurs. This enables an organization to 1) implement cybersecurity measures and best practices ahead of regulatory requirements demonstrating a commitment to security and customers 2) develop its strategy and processes that are both effective and practical and 3) ready the workforce on latest threats, technologies, policies (e.g. National Cybersecurity Implementation Plan, FISMA, National Cyber Workforce and Education Strategy), and standards. To accomplish this the contractor shall perform the following Cybersecurity Strategic Operational planning activities as outlined in Table 2.

Table 2. Cybersecurity Strategic Operations Activities Description

Strategic Operational Development Support

1. Develop and maintain Operations Plan (develop within 15 days and update quarterly) on an ongoing basis in coordination with stakeholders, technology trends, and priorities.

2. Coordinate strategic operational updates to align with enterprise direction and identify efficiencies in achieving OIS strategic goals/objectives

3. Facilitate operational development sessions with leadership through non-traditional facilitation techniques designed to resolve business challenges

4. Develop Implementation Roadmaps (up to one roadmap per programmatic priority, up to 50 programmatic areas) (i.e., sequenced action plans over a timeline) to achieve strategy goals/objectives and deploy SMEs to inform capabilities and mechanisms

Emerging Cybersecurity Transformation Adoption Support

5. Create a methodology and/or mechanism for managing the adoption of cybersecurity policy, services, and capabilities that may impact the cybersecurity transformation program through the creation of programs, strategic outcomes, and OKRs as needed that align with the organization’s strategy.

6. Provide objective coaching, support, and knowledge exchange on highly technical and fast-moving areas of interest associated with the cybersecurity transformation program.

7. Develop a Stakeholder Analysis and Engagement Plan (develop within 30 days and update on a bi-weekly basis) that describes active relationships between across the organization and broader enterprise to facilitate engagements on changes.

Cybersecurity Transformation Workforce Readiness Plan Support

8. Provide Workforce Readiness Plan (up to 50 workforce readiness plans aligned to programmatic areas) that includes a strategy for employee engagement and skill development in response to evolving threats, policies, innovation, and furthermore cybersecurity transformation services to drive employee satisfaction and retention

9. Provide cybersecurity leadership training services to drive collaboration across stakeholders and foster a culture of innovation and learning across the organization

10. Deploy and facilitate interactive training exercises with supporting organizations across the enterprise (e.g., field offices) to increase adoption and understanding of new organizational policies and procedures

11. Track impact of interactive training sessions over time via metrics and cyber campaigns to confirm effectiveness and areas for further sessions

12. Document workforce readiness activities, outcomes, and metrics in recurring Workforce Readiness Executive Report (provided on a bi-weekly basis on up to 100 metrics)

Cybersecurity Outreach Support 13. Develop and implement a cybersecurity Outreach

Strategy (up to 50 strategies aligned to priority programmatic areas) and re-evaluated on a recurring basis based on cybersecurity transformation efforts inclusive of new organizational services.

14. Develop, plan, and participate in quarterly offsites and / or working sessions that enable leadership to brief its executives on efforts related to cybersecurity transformation, evolving priorities, and services

15. Develop timely materials through a host of outreach mechanisms to inform cybersecurity transformation efforts and services (e.g. brochures, videos, animation creation, newsletters, presentations, branding and logos, lunch and learns, physical and virtual media, podcasts)

16. Conduct media analysis to determine the stakeholder sentiment and effectiveness of messaging of new services pertaining to the cybersecurity transformation program as part of customer experience management

17. Deploy advanced capabilities to drive outreach and engagement as a result of planning and analysis efforts on applicability to deploy across the organization

18. Document outreach activities, outcomes, and metrics in recurring Outreach Executive Report (provided on a bi-weekly basis on up to 100 metrics)

DELIVERABLES:

A. Operations Plan B. Implementation Roadmaps C. Stakeholder Analysis and Engagement Plan D. Workforce Readiness Executive Report E. Outreach Strategy F. Outreach Executive Report

5.2.2 CYBERSECURITY PROGRAM AND SERVICE MANAGEMENT

Cybersecurity Program and Service Management is the end-to-end view of prioritized work targeted and committed for all cyber sprints across functions. To accomplish faster delivery of cybersecurity capabilities, the Cybersecurity Strategy Transformation program should define and coordinate standardized, repeatable decision-making processes and capabilities that align with existing organizational governance and management escalation…