Draft PWS.docx

OIS Enterprise Visibility Support Services (EVSS)

VA-24-00082965

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Office of Information & Technology (OIT) Office of Information Security (OIS) OIS Enterprise Visibility Support Services (EVSS)

Date: July 17, 2024

VA-24-00082965

PWS Version Number: 1.0

Contents

BACKGROUND

The Department of Veterans Affairs (VA), Office of Information & Technology (OIT), Office of Information Security (OIS) strives to provide high quality, effective, and efficient Information Technology (IT) services to those responsible for providing care to the Veterans at the point-of-care as well as throughout all the points of the Veteran healthcare in an effective, timely and compassionate manner. VA depends on Information Management/Information Technology (IM/IT) systems to meet mission goals.

The mission of the VA OIT OIS is to ensure that the IM/IT systems are secure, and that the most sensitive Veteran information housed on those systems are safeguarded. VA employs over 400,000 people worldwide, including those located in Guam, Puerto Rico, and the Philippines.

The mission of OIS is to advance the overall cybersecurity posture through enhanced visibility, with leading edge guidance, support, and tools, while simultaneously ensuring VA and its mission partner information systems, practices, policies, processes, and procedures comply with Federal mandates.

OIS Enterprise Visibility and Vulnerability Management (EVVM) Team through its Enterprise Visibility Support Services (EVSS) promotes the OIS mission by providing the foundation for many aspects of cybersecurity. These include, but are not limited to, enterprise-wide endpoint security and compliance monitoring and reporting, authorization, and accreditation support for defined Federal Information Security Modernization Act (FISMA) system boundaries, and software assurance and source code review for VA applications.

BigFix is a critical VA OIS resource for Independent Verification and Validation (IV&V) of VA Endpoints and their Security Configurations.

· Provides real-time agent-based visibility to over 640,000 VA Managed Endpoints (Windows, Linux, Unix, and MacOS). Including Remote Systems not on Virtual Private Network (VPN), FedRamp Cloud, Microsoft Azure, Amazon Web Services (AWS), VA Enterprise Cloud (VAEC), External Service Providers (Veteran Service Applications).

· Provides unbiased continuous monitoring of endpoint security configuration compliance (e.g., Defense Information Systems Agency (DISA) Security Technical Implementation Guides (STIG), Enterprise Mission Assurance Support Service (eMASS) Artifacts, etc.), security tool configuration compliance and vulnerabilities (e.g., Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV), Common Vulnerability Enumerator (CVE)).

BigFix also provides endpoint data and functionality to many key VA and External Systems (e.g., Department of Homeland Security (DHS) Continuous Diagnostics and Mitigation (CDM), ServiceNow (SNOW), Information Central Analytics and Metrics Platform (ICAMP), VA Remote VPN Services (RESCUE) Network Admission Control (NAC, Cisco ISE/Forescout), Consolidated Enterprise Database (CEAD), etc.

VA maintains multiple Trusted Internet Connection (TIC) Gateways. The VA has established a datacenter cage connected to at least two TIC gateways specifically designed for hosting equipment that is used to support the services and capabilities outlined above.

APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. All VA Directives (Information Resources Management 6000-6999)

2. All VA Handbooks (Information Resources Management 6000-6999)

3. All Current (Non-Draft) NIST Federal Information Processing Standards (FIPS)

4. All Current (Non-Draft) revisions of NIST Special Publication 800 Series publications

5. One-VA Technical Reference Model (TRM)

6. OIT Process Asset Library (PAL)

7. OIT Process Reference Process Maps

8. OIT Process Artifact templates

9. Veteran Focused Integration Process (VIP) Guide

10. VA Memorandum “Proper Use of Email and Other Messaging Services,” January 2, 2018

11. DevSecOps Product Line Management Playbook

12. 44 U.S.C. § 3541-3549, “Federal Information Security Management Act (FISMA) of 2002”

13. “Federal Information Security Modernization Act of 2014”

14. 10 U.S.C. § 2224, "Defense Information Assurance Program"

15. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

16. Public Law 109-461, Veterans Benefits, Health Care, and Information Technology Act of 2006, Title IX, Information Security Matters

17. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”

18. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and Guidelines,” January 18, 2017

19. Office of Management and Budget (OMB) Circular A-130, “Managing Federal Information as a Strategic Resource,” July 28, 2016

20. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed Services (CHAMPUS)”

21. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended, January 18, 2017

22. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

23. OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005

24. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019

25. OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008

26. Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance, December 2, 2011, (NOTE: Part A of the FICAM Roadmap and Implementation Guidance, v2.0, was replaced in 2015 with an updated Architecture (https://arch.idmanagement.gov/#what-is-the-ficam-architecture)

27. VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

28. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

29. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

30. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

31. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019

32. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008

33. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (Public Law 110–140), December 19, 2007

34. Section 104 of the Energy Policy Act of 2005, (Public Law 109–58), August 8, 2005

35. Executive Order 13834, “Efficient Federal Operations,” dated May 17, 2018

36. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 2, 2001

37. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

38. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

39. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol Version 6 (IPv6),” November 19, 2020

40. Social Security Number (SSN) Fraud Prevention Act of 2017

41. Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23, 2018

42. Defense Information Systems Agency (DISA) Application Security and Development Security Technical Implementation Guides (STIGs)

43. Cybersecurity & Infrastructure Security Agency (CISA) Directives - https://www.cisa.gov/news-events/directives

44. VA Enterprise Architecture

45. VA ServiceNow/Change Control Processes

46. HCL BigFix Performance and Security Guide

47. ATTACHMENT A – OIS HOSTED SERVICES PLATFORM Hardware Reference System

48. ATTACHMENT B – HSPS Software Reference System

49. ATTACHMENT C – TIC Hosted Services MOU between SDE and EVVM

Please be advised that any hyperlinks contained within this document are for convenience purposes, only. Due to the dynamic nature of hyperlinks and the information accessed through or imbedded therein, it is incumbent upon the Contractor to ensure that all information required to successfully complete the requirements established herein is independently located, verified for accuracy, and confirmed to be the most up-to-date version available, prior to use.

SCOPE OF WORK

The Contractor shall provide technical support services to include development, maintenance and reporting of applicable information security compliance and associated vulnerability data as well as associated software and hardware asset management data. The Contractor shall ensure the confidentiality, availability, and integrity of this data in support of the VA Cybersecurity Operation Center (CSOC) Cyber Threat Intelligence (CTI) Program, VA OIS Assessment and Authorization (A&A) Program, the Department of Homeland Security’s (DHS) Continuous Diagnostics and Mitigation (CDM) Program, and many functions within VA Information Technology Operations and Services (ITOPS). The Contractor shall ensure device, system and accreditation boundary visibility into all assets is available to individual information system owners as well as appropriate security personnel and auditors to ensure appropriate technical security is deployed and maintains current, required security compliance. The Contractor shall provide the capability to report exceptions to information security requirements and strategies to identify non-compliant assets and systems that could expose VA to unnecessary or unauthorized risk.

SOFTWARE ASSURANCE (SWA) SUPPORT OPTION

If the SwA Support Optional Task is exercised, the Contractor shall provide VA enterprise-class software assurance services so that VA may deliver a high level of confidence that the software VA develops functions as intended and is free of vulnerabilities, either intentionally or unintentionally designed or inserted as part of the software throughout the software lifecycle. The Contractor will oversee VA development activities and ensure a planned and systematic set of processes are in place that ensure that software development processes and the resulting products conform to requirements, standards, and procedures.

HOSTED SERVICES PLATFORM SUPPORT (HSPS) OPTION

If the HSPS Optional Task is exercised, the Contractor shall provide VA enterprise-class hardware and software with technical dedicated, highly focused, expert platform performance management services for VA TIC Hosted Services areas. The Contractor shall perform all technical activities necessary to maintain and operate the OIS security platforms as outlined in the HSPS Optional Task sections. The Contractor shall identify and provide all necessary OIS system performance management functions not already outlined in the TIC Hosted Service Memorandum of Understanding (MOU) (Attachment C) as being provided by the hosting facility or VA-CSOC personnel that are typically required for platforms comprised of components listed herein.

PERFORMANCE DETAILS

PERFORMANCE PERIOD

The period of performance (PoP) shall be a 12-month base period with four 12-month option periods. If exercised, Optional Tasks One and Two under PWS Sections 5.3 and 5.4 shall have a PoP that coincides with the period in which they are exercised and may be exercised in each period.

Work on Federal Holidays will be required in emergency support situations by members of the EVVM Application Management team, and SWA team if that optional task is executed. Additionally, Work on Federal Holidays will be required by the HSPS Team if that optional task is executed.

There are eleven (11) Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, four are set by date:

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

PLACE OF PERFORMANCE

All work shall be performed remotely and is expected to be provided consistent with a standard workday, defined as 7:00 am to 5:00 pm Eastern Time (ET). The standard work week is Monday through Friday.

Work may be required off-hours or on weekends for activities that could cause disruptions to the production applications being supported such as scheduled upgrades, unexpected application outages or issues, or disaster recovery test events.

The workday for the HSPS team would be 24 hours and the work week would be 7 days a week.

In addition, TDY to a Government facility within the effort doesn’t change the Place of Performance to the Government Site.

TRAVEL

The Government anticipates travel under this effort to perform the tasks associated with the effort, as well as to attend program-related meetings or conferences throughout the PoP. Include all estimated travel costs in your firm-fixed price line items. These costs will not be directly reimbursed by the Government. While human resource location within the DC Metro area is preferred to keep costs limited it is understood that obtaining the best quality resources throughout the Continental United States can be an option to balance costs taking required travel into consideration.

Should the HSPS Optional Task be executed at least one resource should be located in the commuting area of Chicago, IL and the remaining resources required to support platform sustainment should be within the Sterling, VA commuting area given the need for hardware replacement, physical equipment configuration, end-of-life (EOL) hardware excess, etc.

The total estimated number of trips in support of the program related meetings for this effort is up to 2 trips per year for program related meetings. Anticipated locations include the following, estimated at 5 days (including up to 2 travel days) in duration:

1. Martinsburg, WV

1. Shepherdstown, WV

1. Washington, DC Metro Area

1. Bay Pines, FL

SPECIFIC TASKS AND DELIVERABLES

The Contractor shall obtain any required credentials, knowledge, training, and experience of specific technologies referenced as well as VA specific processes that the Contractor will need to understand/follow. For example, a deep understanding of BigFix is required. Should the Contractor bring on staff that do not have BigFix experience, the Government shall not incur the cost of sending Contractor staff to BigFix training. The Government shall not bear the expense of any training.

The Contractor shall perform the following:

PROJECT MANAGEMENT

The Contractor shall follow the established project management programs within VA, to include Veteran Focused Integration Process (VIP), Process Asset Library (PAL), and any other Project Management system(s) as they evolve in VA.

CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, timeline, and tools to be used in execution of the contract. The CPMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks, and resource support. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPMP shall be concurred upon and updated in accordance with Section B of the contract. The Contractor shall update and maintain the VA Program Manager (VA PM) approved CPMP throughout the PoP.

Deliverable:

1. Contractor Project Management Plan

REPORTING REQUIREMENTS

The Contractor shall provide the VA PM with Weekly Activity Reports (WAR) in electronic form in Microsoft Word format. The report shall include detailed instructions/explanations for each required data element, to ensure that data is accurate and consistent. These reports shall reflect data as of the last day of the preceding week.

The WAR shall cover all work completed during the reporting period and work planned for the subsequent reporting period broken down by each task described in Section 5.0 in the PWS. The report shall also identify any problems that arose and a description of how the problems were resolved. If problems have not been completely resolved, the Contractor shall provide an explanation including their plan and timeframe for resolving the issue.

The Contractor shall monitor performance against the CPMP and report any deviations. It is expected that the Contractor will keep in communication with VA accordingly so that issues that arise are transparent to both parties to prevent escalation of outstanding issues.

In addition, the Contractor shall be expected to attend teleconference meetings with the VA Task Leads to discuss and document any issues, pending deliverables, or other pertinent topics concerning the task areas on a cadence matching the individual Task Lead requirements, no less than weekly, but no more than twice daily. For example, the EVVM Team (along with the HSPS Team if that option is executed) will have brief daily EVVM 9AM ET (HSPS 10AM EST) status calls, bi-weekly Platform Planning calls, and weekly Task Tracker calls. Other teams may have daily or weekly calls depending on task cadence.

Deliverable:

A. Weekly Activity Report (WAR)

TECHNICAL KICKOFF MEETING

A technical kickoff meeting shall be held within 10 days after TO award. The Contractor shall coordinate the date, time, virtual meeting with the Contracting Officer (CO), as the Post-Award Conference Chairperson, the VA PM, as the Co-Chairperson, the Contract Specialist (CS), and the COR. The Contractor shall provide a draft agenda to the CO and VA PM at least five (5) calendar days prior to the meeting. Upon Government approval of a final agenda, the Contractor shall distribute to all meeting invitees.

During the kickoff-meeting, the Contractor shall present, for review and approval by the Government, the details of the intended approach, work plan, and project schedule for each effort via a Microsoft Office PowerPoint presentation. At the conclusion of the meeting, the Contractor shall update the presentation with a final slide entitled “Summary Report” which shall include notes on any major issues, agreements, or disagreements discussed during the kickoff meeting and the following statement “As the Post- Award Conference Chairperson, I have reviewed the entirety of this presentation and assert that it is an accurate representation and summary of the discussions held during the Technical Kickoff Meeting for the OIS Enterprise Visibility Support Services (EVSS).” The Contractor shall submit the final updated presentation to the CO for review and signature within three (3) calendar days after the meeting. The Contractor shall also work with the CS, the Government’s designated note taker, to prepare and distribute the meeting minutes of the kickoff meeting to the CO, COR, and all attendees within three (3) calendar days after the meeting. The Contractor shall obtain concurrence from the CS on the content of the meeting minutes prior to distribution of the document.

TRANSITION-IN SUPPORT

The incoming Contractor staff shall participate in phase-in, onboarding transition knowledge sharing and scheduling activities with the outgoing contractor. The Contractor shall participate in any Phase-In Transition Plan meetings scheduled by the outgoing contractor or with the VA PM, COR or VA groups identified by the VA PM or COR.

The incoming Contractor shall perform the following activities:

a) Participate in reviews of program documentation.

b) Participate, as an observer, in desk side knowledge sharing in the day-to-day tasks performed by the outgoing contractor, understanding all standard operating procedures, VA stakeholders, and business workflows and processes.

c) Acquire knowledge of all details on accessing and assessment of applicable tools and repositories.

d) Provide VA PM with ongoing status of Government-required (on-boarding) training, clearances, access, and certification processes.

BIGFIX ENGINEERING

The Contractor shall provide technical and programmatic support for the BigFix components of the Enterprise Visibility and Vulnerability Management (EVVM) architecture to sustain a four nines (99.99%) application availability. These application components include the BigFix Platform, BigFix Compliance, BigFix Inventory, and BigFix Remote Control. The size of the VA Enterprise necessitates a multi-core BigFix implementation to ensure performance and compliance with application vendor recommendations. The VA BigFix implementation remains one of the largest implementations within the Government and industry, presenting unique challenges that the Contractor must be prepared to address. For BigFix, other than the relays and back-end components running virtualized (VMware), the sizing should follow HCL Technologies (HCL), (d/b/a HCL Tech formerly Hindustan Computers Pvt. Limited) best practices for the number of endpoints mentioned.

Current tool versions are as follows and any upgrades shall be supported throughout the life of the TO: Assume current versions BigFix Platform 11.x, BigFix Compliance 2.x, BigFix Inventory 11.x, BigFix Remote Control 11.x, IBM Cognos 12.x, Microsoft Server Enterprise 2019, Microsoft SQL Server Enterprise 2019, Microsoft Internet Information Server (IIS) 10, Microsoft SharePoint 2016, Microsoft DevOps 2022, RedHat RHEL8, Linux TinyCore 12.x.

NOTE: If a software version is not listed above, or next to the product name anywhere throughout the PWS, the Contractor should assume the most current supported/patched version of the software in question is in use.

BigFix Technical Subject Matter Experts supporting BigFix Engineering tasks 5.2.1-5.2.5 should have extensive large-scale enterprise (>50,000 endpoints). Experience should include combining the data from multiple BigFix core installations. Key personnel should be certified by HCL Technologies holding one of the following certifications: HCL BigFix Platform 10/11 Professional, Platform 11 Administrator, HCL BigFix Compliance 10 Administrator. Resumes of proposed key resources for this task should be included in the technical proposal.

BIGFIX SUITE SUPPORT

The Contractor shall provide overarching support for all components of the BigFix Suite that are included in the EVVM architecture. Support tasks are as follows:

1. Initial installation, configuration, upgrades, and patching for all BigFix application components.

2. Maintain the BigFix Change Control Process SOP (renamed from EVVM Change Control SOP for consistency) utilizing the VA Change Request solution (currently ServiceNow (SNOW)) for these tasks and adjust for changes to VA Change Control policies.

3. Operating system and database server installation, configuration, upgrade, and patching activities are covered under a separate contract (or the HSPS Optional Task if exercised).

4. Develop and maintain an automated solution to monitor the daily health status to ensure functional operation of all components of the BigFix application suite. Monitor the BigFix application infrastructure to ensure the usability and availability of the tool for end users and that all automated jobs scheduled activities run successfully. The results of the daily health checks shall be included in a daily morning report.

5. Attend daily (Monday through Thursday) EVVM Status calls and provide Daily EVVM Meeting Minutes to EVVM Government personnel and other attendees.

6. Manage and monitor daily administrative database jobs supporting the BigFix application for performance and successful completion.

7. Maintain the processes and procedures necessary to ensure minimal data loss for the BigFix Application Suite in the event of hardware or primary site failure. The information will be included in the comprehensive BigFix Disaster Recovery Plan which is a formal deliverable and encompasses all systems in the eMASS BigFix FISMA System Boundary. The Contractor shall be responsible for the BigFix application specific Disaster Recovery activities; however, virtual machine Disaster Recovery responsibilities are covered under a separate contract.

8. Provide support for full Disaster Recovery tests of the BigFix application components. These tests will include failover from the designated primary site to the failover site. Disaster Recovery tests are to be performed at least annually, although current frequency is two times per year. This work is generally planned and performed during an approved maintenance window scheduled during weekend hours.

9. Provide support for any emergency Disaster Recovery event that may occur. Due to the redundancy built into the architecture, such an event has not yet occurred, but, if necessary, this may require after hours, holiday or weekend work until such time as production capabilities are fully restored.

10. Provide weekly status updates to the EVVM Government personnel regarding all planned and completed tasks supporting the BigFix application suite to be included in the weekly tracker report.

11. Manage BigFix application suite access requests via the VA standard ticketing system, currently Service Now (SNOW), and the BigFix Access Request Form.

12. Install, maintain, and troubleshoot BigFix single sign on capabilities across the BigFix application suite to include certificate based smart card and token authentications.

13. Collaborate directly with onsite HCL Technologies (HCL), Accelerated Value Program (AVP) personnel and remote BigFix Development personnel to provide recommendations to enhance the functionality and performance of the BigFix application suite.

14. Collaborate directly with Hosted Services Platform Sustainment support team to apply security remediation to all environments based on Nessus scans, Remediation Effort Entry Form (REEF), and Information Central Analytics Metrics Platform (ICAMP) results; perform Disaster Recovery testing; troubleshoot performance issues with BigFix related applications (generally application deficiencies); and restore the BigFix lab environment between production versions and beta versions of BigFix.

15. Maintain the formal system for intake, assessment of mission alignment, impact assessment, level of effort evaluation, and prioritization of requests which shall be included in the BigFix Request Intake Process Standard Operating Procedures (SOP).

16. Provide a BigFix Summary of Changes Report inclusive of version upgrades, database schema changes, and patches affecting the EVVM platform.

17. Maintain the BigFix Infrastructure Diagrams detailing the physical and logical architectural components of the BigFix Suite.

Deliverables:

A. BigFix Change Control Process SOP B. BigFix Disaster Recovery Plan C. BigFix Request Intake Process SOP D. BigFix Summary of Changes Report E. BigFix Infrastructure Diagrams

BIGFIX COMPONENT SUPPORT

The Contractor shall provide support for the BigFix Platform application components as follows:

1. Create and maintain console and web reports user accounts (approximately 50 per month) with appropriate authorization roles for system access supporting the VA Zero Trust Model.

2. Consolidate the BigFix Console Account Creation SOP and the BigFix Web Reports Account Creation SOP into a consolidated BigFix Account Creation SOP that comprehensively includes account creation documentation for all BigFix Information System Components separated by sections.

3. Configure and manipulate the BigFix environment per user requests generated by tickets from the National Service Desk (NSD) estimated at 50 per month. The Contractor shall create, configure and/or leverage existing software installation instructions using BigFix action scripts, Visual Basic (VB), and batch commands for silent and unattended installations.

4. Review and analyze threat indicators presented by OIS personnel, particularly teams within CSOC using BigFix Relevance language. The Contractor shall verify the performance characteristics of the written analyses or planned remediation actions such that they shall not significantly/negatively impact overall system performance or end-user experience whenever possible when searching for potential instances of the threats. There are typically 50 to 75 analyses running at all times.

5. Monitor the FillDB process and relay infrastructure data daily. Identify and escalate problems to the appropriate BigFix work stream for resolution.

6. Provide training on the use and operation of the BigFix Console and Web Reports modules through group and one-on-one training as requested using web teleconference capabilities. Training shall be conducted as needed but would not be expected to occur more than 12 times per year.

7. Provide BigFix Platform Subject Matter Expert (SME) support to VA Client Technologies and other external customers for approximately 15 separate email threads a week and approximately 10 conference calls a week. Provide guidance and recommendations at an expert level in Relevance, ActionScript, and Session Relevance in order to provide premium custom analysis properties, fixlets, and reports for Windows, Linux, MacOS, and other operating systems.

8. Perform monthly review of enabled external sites and provide recommendations monthly for additions/removals based on changing VA Enterprise environments.

9. Analyze, monitor, support, and manage the BigFix Policy content modules to ensure that BigFix Policies function properly. The Contractor shall minimize network traffic and optimize accuracy of the assessment, remediation, and reporting from the BigFix endpoints for security compliance evaluation, reporting, and remediation activities. The Contractor shall apply the correct relevance language-based questions across the VA enterprise environment and the applicable BigFix Policies.

Deliverables:

A. BigFix Account Creation SOP

BIGFIX COMPLIANCE SUPPORT

The Contractor shall provide support for the BigFix Compliance application components as follows:

1. Create and maintain Compliance user accounts with appropriate authorization roles for system access supporting the VA Zero Trust model. Consolidate the existing BigFix Compliance Account Creation SOP into the BigFix Account Creation SOP outlined in 5.2.2.

2. Monitor Compliance import performance daily. Identify and escalate problems to the appropriate BigFix work stream for resolution.

3. Provide BigFix Compliance SME support to Field Operations and other external customers for approximately 10 separate email threads a week and approximately five conference calls a week.

4. Implement appropriate BigFix Compliance Security checklists (i.e., DISA STIGs, Center for Internet Security (CIS), etc.) as needed to align with VA Baseline documentation. Create and maintain customized copies of the BigFix Compliance Security checklists to support VA approved deviations from the standardized checklists.

5. Provide SME support to verify validity of check/checklist data with system owners and Client Technologies.

BIGFIX INVENTORY SUPPORT

The Contractor shall provide support for the BigFix Inventory application components as follows:

1. Create and maintain Inventory user accounts (approximately 30 per month) with appropriate authorization roles for system access supporting VA’s Zero Trust model.

2. Consolidate and maintain the existing BigFix Inventory Account Creation SOP into the BigFix Account Creation SOP outlined in 5.2.2.

3. Monitor Inventory import performance daily. Identify and escalate problems to the appropriate BigFix work stream for resolution.

4. Manage BigFix Inventory tasks to ensure endpoint data gathering processes are functioning effectively and efficiently.

5. Provide BigFix Inventory SME support to Client Technologies and other external customers for approximately five separate email threads a week and approximately two conference calls a week.

6. Provide SME support to verify validity of Inventory data with system owners and Client Technologies.

BIGFIX REMOTE CONTROL (BFRC) SUPPORT

The Contractor shall provide support for the BFRC application components as follows:

1. Create and maintain BFRC user accounts (approximately five new accounts per month) with appropriate authorization roles for system access supporting the VA Zero Trust model.

2. Provide training as needed (approximately 12 times per year) to VA Staff.

3. Administer the BFRC Server and BFRC Brokers to ensure that the tool is available as a service throughout the VA Enterprise to Client Technologies.

4. Create and maintain a single BFRC SOP document tailored to the VA environment that, at a minimum, covers:

a. Account Creation

b. Controller Configuration and Management

c. Controller Target Configuration and Management

5. Provide SME support (for example researching issues and opening vendor tickets as necessary) for the Remote-Control application.

6. Install, maintain, and patch the BFRC Server and BFRC Brokers to ensure application security and configuration are in accordance with approved VA policies and procedures as well as the HCL Technologies provided BigFix Performance and Security Guide deliverable.

Deliverables:

A. BFRC SOP

BIGFIX LIFECYCLE CONTENT MANAGEMENT SUPPORT

The Contractor shall maintain the existing process that provides an end-to-end workflow for configuration management, publishing, and propagating BigFix Lifecycle custom content. The solution shall include an interface to integrate into the BigFix Console application to automate workflow and configuration management ensuring that custom content is available for consistent distribution among the BigFix cores. This process will be applied to a multi-tier architecture comprised of Development, Staging, and Production tiers. The Contractor shall provide support as follows:

1. Maintain the existing developed automated process (ContentVC) and interface (Content Wizard) to interact with BigFix content through the HCL BigFix RESTAPI. BigFix Content shall be queried, created, modified, and deleted as appropriate via this automated process. The automated process currently supports the following capabilities:

a. Automated process to interact with Microsoft DevOps tasks and source control through the Microsoft DevOps API. DevOps content is queried, created, modified, and deleted via the process.

b. Automated process to synchronize Microsoft DevOps source-controlled repository of BigFix content extracted through the HCL BigFix RESTAPI. The process shall support Analyses, Fixlets, Tasks and Baselines BigFix content types.

c. Content life cycle workflow to include peer review of BigFix content types prior to marking content as eligible to publish though the process.

d. Place content in a BigFix custom site and initiate the BigFix Propagation Server utility to synchronization and update site contents.

e. Provides process-level logging files for processing events, function invocations and business logic events and automatically maintain log sizes as determined by VA personnel.

f. Proactive monitoring of the automated process to include configurable notification settings based on process internal events.

g. Process to identify target BigFix content that is no longer linked with source content.

h. Restore propagated BigFix site content in the event of a disaster recovery event. Recovery content shall be sourced from Microsoft DevOps source control.

i. Recertification after an expiration period, as determined by VA personnel, of BigFix content to ensure only relevant content remains available on the sites.

j. Process for prioritizing BigFix content that is eligible to propagate. Content deemed critical by the Government/Customer shall be published immediately while other content shall follow a configurable schedule as determined by VA personnel.

k. User accessible BigFix integrated process to create, develop, review, recertify or remove BigFix content within a custom site.

l. Developed a user accessible BigFix integrated process to remove BigFix content from a VA published external site.

m. Enables the Console Operator accessible BigFix integrated process the ability to define custom fields as required by client to support record management. The Contractor maintained Console Operator accessible BigFix integrated process shall continue to contain the ability to create copies of BigFix content from internal and/or external sites as well as the ability to create and maintain content templates.

2. The Contractor provided Console Operator accessible BigFix integrated process shall continue to enforce security as defined within the BigFix Console security settings.

3. Maintain existing test cases for functional regression testing to ensure that modifications or updates to the process or updates to the BigFix do not introduce errors. Current implemented process has approximately 500 test cases comprising approximately 17,000 steps. Create any additional or deprecate any existing test cases as necessary to ensure functionality of maintained and added integrations.

4. Maintain existing BigFix Content Management Process SOP that documents the administration, operation, processes, and procedures for the integrations listed in items 1-3 above.

5. Maintain existing BigFix Content Management Wizard Users Guide that documents the user perspective for using the Content Management integrations interface in daily BigFix operations.

Deliverables:

A. BigFix Content Management Process SOP B. BigFix Content Management Wizard Users Guide

BIGFIX LIFECYCLE CONTENT MANAGEMENT REPORTING

The Contractor shall provide the ability to analyze and report on BigFix Lifecycle Content Management data to monitor the entire lifecycle of BigFix Lifecycle content and audit the current and historically trended findings at a summarized and detailed level while referencing each modified BigFix content unit. This process will be applied to a multi-tier architecture comprised of Development, Staging, and Production tiers. The Contractor shall provide support as follows:

1. Maintain the existing Cognos Data Modules to provide actionable analytics for platform users to search and monitor content as well as setup notifications and alerts.

2. Maintain the existing BigFix Lifecycle Content reports. Reports shall be based on data contained BigFix Lifecycle custom sites, BigFix Lifecycle external sites and the BigFix Lifecycle database. The Contractor shall ensure the data integrity and performance of the reports are optimized.

3. Maintain the existing expanded set of Cognos dashboards and reports that supply distributable analyses, based on user provided timeframes, for newly created content, active development, content awaiting review, standard/critical propagations, and removed/archived content.

4. Maintain the existing reporting on the custom content lifecycle to provide configuration management analysis and work productivity metrics. The Contractor shall provide custom reports that track all activity for BigFix Custom Content, including but not limited to:

· Content that is being developed.

· Content that is eligible for Review.

· Content that is eligible to be published to an external site.

· Content that has been published to an external site.

· Content that has been published with critical priority to an external site.

· Content that needs to be synchronized between the development and external site.

· Content that has been removed from an external site.

· Content that needs to be recertified and republished to an external site.

· Full lifecycle history of individual custom content.

· Operator productivity metrics that measure development, review, and publish content timelines and quantities.

5. Design, develop, test, and maintain any new or modify any existing Cognos Data Modules, BigFix Lifecycle Content reports, Cognos dashboards and reports, and reporting on the custom content lifecycle, as outlined above, as directed by VA PM FTE Team (estimate and average four (4) changes or additions for any of the above per year).

6. Implement a methodology or process to ensure all BigFix Content reports are kept updated and current with data.

7. Create and maintain test cases to test functionality for BigFix Content reports (currently process involves approximately 10 Test Cases and approximately 250 Steps).

Deliverables:

A. BigFix Content Management Dashboard B. BigFix Content Management Detail Report C. BigFix Content Management User Activity Dashboard D. BigFix Content Management Lifecycle Report

BIGFIX CUSTOMIZATIONS AND SCRIPTING SUPPORT

The Contractor shall provide overarching support for all components of the BigFix Suite that are included in the EVVM architecture. Due to the size and complexity of the BigFix environment at the VA, automated tasks and customizations are required to ensure proper functionality of the BigFix environment across the multiple BigFix Core, BigFix Compliance, and BigFix Inventory applications.

The Contractor Shall:

1. Maintain the existing automated process to provide daily Computer Deletion to ensure that only endpoints that are actively reporting to BigFix are displayed in the BigFix Console, Web Reports, Compliance, and Inventory applications. This process should be configurable to align with evolving VA business rules as provided to the Contractor by the VA PM.

2. Maintain the existing automated processes to support daily BigFix database maintenance tasks across all BigFix servers. Maintenance tasks include, but are not limited to, database backup, index rebuild, and distribution of data to the data warehouse (defined in sections 5.2.6 and 5.2.7) for data ingestion.

3. Maintain the existing automated process to extract CVE definition file information from NIST and upload to the BigFix Inventory servers. This process is necessary due to security configurations currently in place on the BigFix Inventory servers.

4. Maintain the existing daily processes to provide automated BigFix Inventory and BigFix health check summary information. This data may be provided in daily automated emails which summarizes the overall health of the BigFix environment across the multi-core BigFix deployment at the VA.

5. Maintain the existing automated daily processes to monitor BigFix endpoint data, identifying endpoints that indicate data inconsistencies and provide daily alerts of affected endpoints that may require remediation actions by the BigFix SMEs.

6. Maintain the existing automated FISMA Tagging process that leverages a web service to respond to the BigFix agent queries against daily supplied Information System (IS) Hardware Asset Boundary data from the VA GRC tool (currently eMASS). The BigFix agent query supplies the hostname of the endpoint to the web service to determine if a match exists. If the hostname is found within an IS the agent is “tagged” within a text file in the operating system on the endpoint.

7. Create any new processes, similar to the complexity of the items 1-6 listed above) as required (approximately six (6) annually).

8. Provide database and data analysis level assistance as necessary with troubleshooting application bugs as they are discovered in the VA environment. Due to the size of the VA BigFix implementation, these application bugs may not be identified by the vendor as they do not appear in smaller scale environments

The Contractor shall document all existing automated processes within a BigFix Automated Process Listing that includes, at a minimum, the following for each process:

1. Process Name

2. Process Description

3. Process Location

Deliverables:

A. BigFix Automated Process Listing

DATA WAREHOUSE, REPORTING, AND DASHBOARD SUPPORT

The Contractor shall support OIS in cybersecurity analysis and reporting activities on the status of desktops, laptops, and servers, as well as assist in the deployment of tools to gain visibility into other areas such as visibility to applications. The primary data sources driving these efforts are the BigFix components described in Section 5.2. The EVVM data warehouse is comprised of Microsoft SQL Server, IBM Cognos, and Microsoft SharePoint components. These components are deployed in a three-tiered architecture comprised of Development, Staging, and Production tiers. The Contractor shall support the overall platform as follows:

1. Initial installation, configuration, application, and maintenance of approved VA Baselines (based on DISA STIG setting), upgrades, and patching for all data warehouse, reporting, and dashboard application components. Document the changes and utilize the BigFix Change Control process (identified in Section 5.2.1) for these tasks. Operating system installation, configuration, upgrade, and patching activities are covered under a separate contract unless the HSPS Optional Task is exercised. Activities that may impact the production environment must be performed during approved maintenance windows, which are generally confined to after hours or weekend timeframes.

2. Attend daily (Monday through Thursday, 9AM ET) EVVM Status calls and provide daily updates to EVVM Government personnel and other attendees.

3. Perform daily health check tasks to ensure functional operation of the EVVM data warehouse application suite. Monitor the data warehouse application infrastructure to ensure the usability and availability of the tool for end users and that all automated jobs and backend processes are functioning correctly.

4. Maintain the existing documentation for the processes and procedures necessary to ensure minimal data loss for the data warehouse and dashboard application in the event of hardware or primary site…