Draft PWS HCSC IT Support Services.docx

HCSC Information Technology Support Services

VA-25-00009783

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Human Capital Services Center (HCSC)

Talent Development Solutions (TDS)

HCSC Information Technology (IT) Support Services

Date: 12 September 2024

VA-25-00009783

PWS Version Number: 1.0

Contents

(NOTICE to all Requiring Activities:

VA Enterprise Cloud (VAEC) – The Enterprise Cloud Solutions Office (ECSO) in the Enterprise Program Management Office (EPMO) has developed the VA Enterprise Cloud (VAEC), which will host all suitable VA cloud applications including new systems and existing applications migrating to the cloud. Use of the VAEC is required based on the VAEC Cloud Policy Memo and VAEC for New Development Memo issued by OIT leadership. Information about the VAEC can be found here. If the Requiring Activity has not requested cloud hosting, they need to do so via the VA IT Process Request (VIPR), using the VIPR Portal.

Requiring Activities should also note that there is standard VAEC performance work statement (PWS) language (see below) to be used by project teams that need to migrate applications or systems to the VAEC or are implementing applications or systems in the VAEC. This language includes cloud-specific requirements and deliverables that should be considered in your PWS.

Projects where an existing COTS or custom, legacy application or system has been deemed cloud suitable and is targeted to be migrated to and hosted in the VAEC (or is currently hosted in a VAEC) should refer to the “Standard VAEC PWS Language for Migrations” document for PWS sample language considerations regarding specific VAEC requirements to be added to the Requiring Activity’s PWS.

Projects where there is a new solution implementation should refer to the “Standard VAEC PWS Language for New Implementations” document for PWS sample language considerations regarding specific VAEC requirements to be added to the Requiring Activity’s PWS.

These documents can be found at the VAEC Acquisition Resources page: https://dvagov.sharepoint.com/sites/OITECSO/SitePages/VAEC-Acquisition.aspx?csf=1&e=dhnDL4. Any questions, please contact ecsoinfo@va.gov.)

BACKGROUND

The Department of Veterans Affairs (VA) (also interchangeably referred to herein as the “Government”), Office of Human Resources and Administration/Operations, Security, and Preparedness, Chief Human Capital Officer, Human Capital Service Center (HCSC) supports continuing and emerging VA customer requirements while delivering best-in-class human resource services and capabilities to VA’s Administrations and Staff Offices. HCSC provides products and services, including learning management, employee accountability, internships, and learning content to nearly 600,000 VA employees, Contractors, volunteers, and academic affiliates. HCSC’s mission will provide a delightful customer experience to engage VA employees with products and services that will enable them to become role models in serving Veterans and their families. VA depends on Information Management/Information Technology (IM/IT) systems to meet mission goals.

This PWS establishes the requirements for Contractor-provided solutions in support of IT. The Contractor-provided solutions shall support VA and may be required to support other Federal Agencies. The Contractor shall provide total IT services solutions to include the following functional areas: program management, strategy, enterprise architecture and planning; systems/software engineering; software technology demonstration and transition; test and evaluation; independent verification and validation; enterprise network; enterprise management framework; operations and maintenance; and cybersecurity.

APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. 44 U.S.C. § 3541-3549, “Federal Information Security Management Act (FISMA) of 2002”

2. “Federal Information Security Modernization Act of 2014”

3. Federal Information Processing Standards (FIPS) Publication 140-2, “Security Requirements for Cryptographic Modules”

4. FIPS Pub 199. “Standards for Security Categorization of Federal Information and Information Systems,” February 2004

5. FIPS Pub 200, “Minimum Security Requirements for Federal Information and Information Systems,” March 2006

6. FIPS Pub 201-2, “Personal Identity Verification of Federal Employees and Contractors,” August 2013

7. 10 U.S.C. § 2224, "Defense Information Assurance Program"

8. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

9. Public Law 109-461, Veterans Benefits, Health Care, and Information Technology Act of 2006, Title IX, Information Security Matters

10. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”

11. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, https://www.va.gov/vapubs/index.cfm

12. VA Handbook 0710, “Personnel Security and Suitability Program,” May 2, 2016, https://www.va.gov/vapubs/index.cfm

13. VA Directive and Handbook 6102, “Internet/Intranet Services,” August 5, 2019

14. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and Guidelines,” January 18, 2017

15. Office of Management and Budget (OMB) Circular A-130, “Managing Federal Information as a Strategic Resource,” July 28, 2016

16. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed Services (CHAMPUS)”

17. NIST SP 800-66 Rev. 1, “An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule,” October 2008

18. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended, January 18, 2017

19. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

20. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021

21. VA Handbook 6500, “Risk Management Framework for VA Information Systems VA Information Security Program,” February 24, 2021

22. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI),” March 12, 2019

23. VA Handbook 6500.5, “Incorporating Security and Privacy into the System Development Lifecycle,” March 22, 2010

24. VA Handbook 6500.6, “Contract Security,” March 12, 2010

25. VA Handbook 6500.8, “Information System Contingency Planning,” April 6, 2011

26. VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018

27. VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017

28. OIT Process Asset Library (PAL), https://www.va.gov/process/ . Reference Process Maps at https://www.va.gov/process/maps.asp and Artifact templates at https://www.va.gov/process/artifacts.asp

29. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

30. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014

31. VA Handbook 6508.1, “Procedures for Privacy Threshold Analysis and Privacy Impact Assessment,” July 30, 2015

32. VA Handbook 6510, “VA Identity and Access Management,” January 15, 2016

33. VA Directive and Handbook 6513, “Secure External Connections,” October 12, 2017

34. VA Directive 6300, “Records and Information Management,” September 21, 2018

35. VA Handbook, 6300.1, “Records Management Procedures,“ March 24, 2010

36. NIST SP 800-37 Rev 2, “Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy,” December 2018

37. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020)

38. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015

39. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” March 24, 2014

40. OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005

41. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019

42. OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008

43. Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance, December 2, 2011, (NOTE: Part A of the FICAM Roadmap and Implementation Guidance, v2.0, was replaced in 2015 with an updated Architecture (https://arch.idmanagement.gov/#what-is-the-ficam-architecture)

44. NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access,“ June 2018

45. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, “Digital Identity Guidelines,” updated March 02, 2020

46. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014

47. NIST SP 800-164, “Guidelines on Hardware-Rooted Security in Mobile Devices (Draft),” October 2012

48. Draft National Institute of Standards and Technology Interagency Report (NISTIR) 7981, “Mobile, PIV, and Authentication,” March 2014

49. VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

50. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

51. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

52. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

53. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019

54. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008

55. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (Public Law 110–140), December 19, 2007

56. Section 104 of the Energy Policy Act of 2005, (Public Law 109–58), August 8, 2005

57. Executive Order 13834, “Efficient Federal Operations,” dated May 17, 2018

58. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 2, 2001

59. VA Directive 0058, “VA Green Purchasing Program,” July 19, 2013

60. VA Handbook 0058, “VA Green Purchasing Program,” July 19, 2013

61. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

62. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

63. “Veteran Focused Integration Process (VIP) Guide 4.0,” January 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

64. VA Memorandum “Proper Use of Email and Other Messaging Services,” January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

65. “DevSecOps Product Line Management Playbook” version 2.0, May 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

66. NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020

67. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol Version 6 (IPv6),” November 19, 2020

68. Social Security Number (SSN) Fraud Prevention Act of 2017

69. Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23, 2018

70. NIST 800-162 “Guide to Attribute Based Access Control (ABAC) Definition and Considerations”, February 2019 https://csrc.nist.gov/publications/detail/sp/800-162/final

71. NIST 800-122 “Guide to Protecting the Confidentiality of Personally Identifiable Information (PII)”, April 2010 https://csrc.nist.gov/publications/detail/sp/800-122/final

72. NIST Special Publication (SP) 800-18, Rev. 1, “Guide for Developing Security Plans for Federal Information Systems.” February 2006 https://csrc.nist.gov/publications/detail/sp/800-18/rev-1/final

73. NIST SP 800-30, Rev. 1, “Guide for Conducting Risk Assessments”, September 2012 https://csrc.nist.gov/publications/detail/sp/800-30/rev-1/final

74. NIST SP 800-34 Rev. 1 “Contingency Planning Guide for Federal Information Systems.” November 2010 https://csrc.nist.gov/publications/detail/sp/800-34/rev-1/final

75. NIST SP 800-37 Rev. 2, “Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy” December 2018 https://csrc.nist.gov/publications/detail/sp/800-37/rev-2/final

76. NIST SP 800-47, “Security Guide for Interconnecting Information Technology Systems.” August 2002 https://csrc.nist.gov/publications/detail/sp/800-47/final

77. NIST SP 800-53A Rev. 4, “Assessing Security and Privacy Controls in Federal Information Systems and Organizations” January 2015 https://csrc.nist.gov/publications/detail/itl-bulletin/2015/01/release-of-nist-special-publication-800-53a-revision-4-assessi/final

78. M-00-15, Guidance on Implementing Electronic Signature, September 2000 https://www.whitehouse.gov/wp-content/uploads/2017/11/2000-M-00-15-OMB-Guidance-on-Implementing-the-Electronic-Signatures-in-Global-and-National-Commerce-Act.pdf

79. M-06-16, Protection of Sensitive Agency Information, June 2006 https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2006/m06-16.pdf

80. Homeland Security Presidential Directive 12 (HSPD-12) Program, August 2004 https://csrc.nist.gov/Topics/Laws-and-Regulations/executive-documents/HSPD-12

81. Executive Order 13681, Improving the Security of Consumer Financial Transactions, October 2014 https://obamawhitehouse.archives.gov/the-press-office/2014/10/17/executive-order-improving-security-consumer-financial-transactions

82. M-19-17 Enabling Mission Delivery through Improved Identity, Credential, and Access Management, May 2019 https://www.whitehouse.gov/wp-content/uploads/2019/05/M-19-17.pdf

83. Electronic Signatures in Global and National Commerce Act (Public Law 106-229), June 2000 https://www.congress.gov/bill/106th-congress/senate-bill/761

84. Government Paperwork Elimination Act 105-277 (Public Law 105-277), October 1998. The Implementation of the Government Paperwork Elimination Act can be found here: https://obamawhitehouse.archives.gov/omb/fedreg_gpea2/

85. VHA Directive 1906, Data Quality Requirements for Healthcare Identity Management and Master Person Index Functions, April 2020 https://www.va.gov/vhapublications/ViewPublication.asp?pub_ID=8787

86. VHA Directive 1907.09, Identity Authentication for Health Care Services, June 2019 http://www.va.gov/vhapublications/ViewPublication.asp?pub_ID=8374

87. VHA Handbook 1907.01, Health Information Management and Health Records, March 2015 http://www.va.gov/vhapublications/ViewPublication.asp?pub_ID=3088

88. VHA Handbook 1907.02, My HEALTHeVET Identity Verification, December 2014 http://www.va.gov/vhapublications/ViewPublication.asp?pub_ID=3071

89. VA Accreditation and Authorization (A&A) Standard Operating Procedure (SOP)

90. Attachment A

SCOPE OF WORK

The Contractor shall provide IT support for HCSC-delivered solutions. Refer to Attachment A for the current list of HCSC solutions. This support includes: Authority to Operate (ATO) technical support; database management; project management; risk management; strategic planning support for enterprise systems and modernization as well as implementation, Integrations and documentation between internal and external systems; technical analysis of documentation, publications and handbooks; technical analysis of new policies and emerging technologies; systems integration and implementation to include the analysis of program security deficiencies and application integration monitoring through the governance process.

PERFORMANCE DETAILS

PERFORMANCE PERIOD

The period of performance (PoP) shall 12 months from date of award, with four 12-month option period(s) and three Optional Tasks. The overall PoP shall not exceed 60 months.

PLACE OF PERFORMANCE

Tasks under this PWS shall be performed at Contractor facilities. The Contractor shall identify the Contractor’s place of performance in their proposal submission.

TRAVEL

The Government does not anticipate travel for this effort.

KEY PERSONNEL

The Contractor shall provide resources that have the requisite skills and experience required to perform the tasks within the PWS. The Contractor agrees that the personnel identified below, as key to supporting this effort, shall not be removed from the contract, replaced or added to the contract without a compelling reason and without written notification to the Contracting Officer (CO).

It is the responsibility of the Contractor to provide Contractor support personnel and subcontractors who have the required educational background, experience, security clearance, and access authorization or combination thereof to meet the labor category descriptions under this task order for the required PWS tasks.

If any change to the Key Personnel assigned to the labor categories identified below becomes necessary (initial staffing, substitutions, or additions), the Contractor shall immediately notify the CO/Contracting Officer Representative (COR)/Program Manager (PM) in writing, accompanied by the resume, if applicable, of the proposed replacement personnel who shall be of at least substantially equal ability and qualifications as the individual(s) currently performing in that category and that the proposed replacement meets or exceeds the qualifications designated for that Key Personnel position. It is expected that substitution or replacement of the personnel will not occur within the first six (6) months after date of contract award.

The Contractor agrees that it has a contractual obligation to mitigate the consequences of the loss of Key Personnel and shall promptly secure any necessary replacements in accordance with (IAW) this PWS section. Failure to replace a Key Personnel pursuant to this clause and without a break in performance of the labor category at issue shall be considered a condition endangering contract performance and may provide grounds for default termination.

The labor categories below are identified as Key Personnel. Key Personnel must meet the corresponding requirements identified in the Labor Description column below:

Project Manager

Expertise

· Expertise in project management and cybersecurity with ability to translate customer requirements and relay them to the team.

· Expertise in managing IT and Cloud design, security, development, systems engineering, and implementation efforts.

· Expertise in Cloud solutions in both federal and/or commercial industry.

· Expertise with Federal A&A and ATO activities.

· Expertise in cybersecurity engineering requirements and authorizations (FedRAMP/RMF)

· Expertise in Federal policies, processes, and standards.

Minimum Education Level

· Bachelors Degree

Degree In/Certifications

· Business Administration, Business Management, Cybersecurity, Computer Science, Information Systems, Information Assurance, Information Security, Information Resource Management, or related fields.

· One or more of the following: Project Management Professional (PMP), Information Assurance Technician (IAT) III, Information Assurance Management (IAM) III or Information Assurance System Architects and Engineers (IASAE) III certifications.

Minimum Experience

· 10 years (5 years of Cybersecurity and Cloud Security experience at a Government agency similar in size/scope to DoD or VA).

Substitution

· Not applicable.

· Strong knowledge of database management systems, such as Microsoft SQL Server, ETL and MySQL.

· Proficiency in writing complex SQL queries and optimizing database performance.

· Knowledge of Cloud Infrastructure.

Minimum Education Level

· Bachelors Degree

Degree In/Certifications

· computer science, Information Technology, or a related field.

Minimum Experience

· 3 to 5 years of proven work experience as a Data Base Administrator, specifically in the healthcare industry

Substitution

· Not applicable

· Experience in cybersecurity engineering requirements and authorizations (FedRAMP/RMF) into systems and applications.

· Experience in IT and Cloud design, security, development, systems engineering, and implementation efforts.

· Experience in large-scale Cloud solutions in both federal and/or commercial industry.

· Experience with Federal A&A and ATO activities.

· Experience in Federal policies, processes, and standards.

Minimum Education Level

· Bachelors Degree

Degree In/Certifications

· Business Administration, Business Management, Cybersecurity, Computer Science, Information Systems, Information Assurance, Information Security, Information Resource Management, or related fields.

· One or more of the following: IAT II, IAM II or IASAE II certifications.

Minimum Experience

· 5 years (3 years of Cybersecurity and Cloud Security experience at a Government agency similar in size/scope to DoD or VA).

Substitution Not applicable.

· Experience in cybersecurity engineering requirements and authorizations (FedRAMP/RMF) into systems and applications.

· Experience in IT and Cloud design, security, development, systems engineering, and implementation efforts.

· Experience in large-scale Cloud solutions in both federal and/or commercial industry.

· Experience with Federal A&A and ATO activities.

· Experience in Federal policies, processes, and standards.

Minimum Education Level

· Associates or Bachelors Degree

Degree In/Certifications

· Business Administration, Business Management, Cybersecurity, Computer Science, Information Systems, Information Assurance, Information Security, Information Resource Management, or related fields.

· One or more of the following: IAT I, IAM I or IASAE I certifications.

Minimum Experience

· 2 years (1 year of Cybersecurity and Cloud Security experience at a Government agency similar in size/scope to DoD or VA).

Substitution Not applicable.

SPECIFIC TASKS AND DELIVERABLES

A high level of technical expertise is necessary and broad for this effort. Key personnel and employees need to begin day one and be PIV compliant.

The Contractor shall perform the following:

PROJECT MANAGEMENT

CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, timeline, and tools to be used in execution of the contract. The CPMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks, and resource support. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The CPMP shall also include a work breakdown structure, activity lists and resources, plan and work schedule (dependencies and interdependencies), and project baseline to continuously improve the VA’s cybersecurity posture. The initial baseline CPMP shall be concurred upon and updated in accordance with Section B of the contract. The Contractor shall update and maintain the COR/VA PM approved CPMP throughout the PoP.

The Contractor shall develop a CPMP that includes an Integrated Master Schedule (IMS), providing an event-driven plan that documents the significant accomplishments for the work delineated within this PWS. The IMS shall be used to assist the Government in planning and scheduling of all work efforts. The IMS shall include a Work Breakdown Structure (WBS) of associated responsibilities pertaining to Government-provided requirements for the Contractor to complete. The CPMP shall detail all identified and assigned tasks, major milestones, project roadmap, dates and dependencies, indications of a critical path, statuses, statistics, risk management review, and other milestone progress checks.

The CPMP is an evolutionary document that shall be monthly and identify tasks and deliverables to be completed by the Contractor, as specified in operating procedures. Tasks from the final Government approved CPMP shall be selected as milestones against which the Contractors’ progress shall be monitored and reported on by the Contractor in the Monthly Status Report. The Contractor shall develop an Implementation Plan and deliver it to the Government in either Adobe and Microsoft Project formats or in another VA approved format.

In order to facilitate a clear understanding of the overall project and work to be accomplished, the Contractor shall deliver the CPMP, not later than 10 days after contract award. The Contractor shall update and maintain the VA PM approved CPMP monthly.

The Contractor shall include in the CPMP sections or separate plans for:

a. Scope Statement

b. Schedule Baseline

c. Schedule Management

d. Work Breakdown Structure

e. Risk Management

f. Risk Log

g. Quality Management

h. Logistical Support

i. Communications Management

j. Personnel Management

Deliverables:

A. Contractor Project Management Plan B. Implementation Plan

PROGRAM MANAGEMENT SUPPORT

The purpose of this section is to highlight the high level of administrative support that is not highly technical in nature, but shall be included, within the task descriptions below. The Contractor shall provide, at a minimum, the following administrative support, in the performance of all PWS sections:

a. Meeting support

b. Correspondence management

c. Monitor weekly Project Management Report (PMR) updates, to ensure timely submissions

d. Track audit responses

e. Maintain Cyber Security Technology and Metrics (CTM) section briefs

f. Maintain CTM Knowledge Site (KS) information

g. Coordinate projects

h. SharePoint content creation and management

i. Editing and proof reading of technical and non-technical documents

WEEKLY ACTIVITY REPORTING

The Contractor shall provide a detailed Weekly Activity Report (WAR) and Project Management Report (PMR). The WAR is a high-level report that shall include the work accomplished from the previous week and work planned for the week, by PWS task number. Each WAR report shall identify any issues and their resolution(s), and any existing or new issues that have not been completely resolved with an explanation of the findings or progress made with them. In addition, the Contractor shall attend a daily technical teleconference meeting(s) with the HCSC staff to discuss and document any issues, pending deliverables or other pertinent topics concerning the task areas. The PMR report shall provide details regarding levels of effort, activities and milestones, demonstrate recent activity and milestone updates, highlight changes since the last update, and explain all details regarding the changes.

Deliverables:

A. Weekly Activity Report B. Monthly Project Management Report (PMR) C. Weekly Briefs

PRIVACY & HIPAA TRAINING

The Contractor shall submit TMS training certificates of completion for all required VA Training to include, at a minimum, the VA Privacy and Information Security Awareness and Rules of Behavior and Health Insurance Portability and Accountability Act (HIPAA) training and provide signed copies of the Contractor Rules of Behavior in accordance with Section 9, Training, from Appendix C of the VA Handbook 6500.6, “Contract Security”.

Deliverable:

A. TMS 2.0 Training Certificates

TECHNICAL KICKOFF MEETING

A technical kickoff meeting shall be held within 10 days after contract award. The Contractor shall coordinate the date, time, and location (can be virtual) with the Contracting Officer (CO), as the Post-Award Conference Chairperson, the VA PM, as the Co-Chairperson, the Contract Specialist (CS), and the COR. The Contractor shall provide a draft agenda to the CO and VA PM at least five (5) calendar days prior to the meeting. Upon Government approval of a final agenda, the Contractor shall distribute to all meeting attendees. During the kickoff-meeting, the Contractor shall present, for review and approval by the Government, the details of the intended approach, work plan, and project schedule for each effort via a Microsoft Office PowerPoint presentation. At the conclusion of the meeting, the Contractor shall update the presentation with a final slide entitled “Summary Report” which shall include notes on any major issues, agreements, or disagreements discussed during the kickoff meeting and the following statement “As the Post-Award Conference Chairperson, I have reviewed the entirety of this presentation and assert that it is an accurate representation and summary of the discussions held during the Technical Kickoff Meeting. The Contractor shall submit the final updated presentation to the CO for review and signature within three (3) calendar days after the meeting. The Contractor shall also work with the PM, to prepare and distribute the meeting minutes of the kickoff meeting to the CO, COR and all attendees within three (3) calendar days after the meeting.

SYSTEM ENGINEERING LIFE CYCLE SUPPORT PROCESS AND SERVICES

The Contractor shall provide System Engineering tasks, support, and deliverables required to support instantiating and/or continuous monitoring of the VA Authority to Operate (ATO) for multiple systems managed by HCSC, as well as for emerging technology initiatives. These activities are large in scale and the Contractor shall provide System Engineers with various technical expertise in multiple domains like cloud computing, architecture, risk management, networking, virtualization, continuous monitoring, compliance, and policy. The Contractor shall have knowledge of the VA environment and culture and possess interpersonal and collaboration skills to effectively collaborate with organizations responsible for the successful performance of the contract. The Contractor shall work with VA technical professionals supporting their VA program and project management, cyber security, security architecture, and operations organization teams.

SYSTEM SECURITY ENGINEERING SUPPORT

The Contractor shall analyze and recommend integrated system security engineering activities and processes, which shall encompass security requirements, system controls, critical milestones, roles, and responsibilities. The Contractor shall provide Information System Engineering services to include attending and administratively supporting HCSC systems related meetings and creating meeting minutes, technical analysis such as reviewing and commenting on federal and departmental ISSE related Special Publications (SP), Presidential Directives (PD), memos, handbooks, etc. The Contractor shall also provide support to include assessing, managing, and tracking program risks as indicated in current revision of NIST SP 800-53 (rev 4.), assessing OMB and other Federal mandates, and analyzing the NIST and Cybersecurity Frameworks. Specifically, the Contractor shall:

a. Deliver a Security Consideration Plan one time for the base year and updated annually thereafter if optional years are exercised. The Security Consideration Plan outlines security considerations captured in organizational policies and procedures for the management and deployment of life cycle models and processes. The Security Consideration Plan shall be provided to the COR/VA PM for review and approval. The COR/VA PM must also approve the commencement of any implementation.

b. Assist with evaluating, redefining, and developing the system life cycle model management process. The Contractor shall assist in identifying and assessing, the security needs and considerations for life cycle policies, procedures, processes, and models that are capable of being applied. The Contractor shall utilize industry best practices, proven methods, and tools to recommend improvements in the system life cycle model management process.

c. Assist in reviewing and recommending policies and procedures outlining security roles and responsibility within a Responsible, Accountable, Consulted, and Informed (RACI) Matrix, and include accountability and authority within the system life cycle. The Contractor shall keep the RACI Matrix assessment updated as required.

d. Deliver a Security Requirements Needs Document one time for the base year and is updated annually thereafter if optional years are exercised. The Security Requirements Needs Document shall address, at a minimum, the following:

1. Security requirement needs and considerations:

2. Life cycle models

3. Baselines (per cloud service model e.g., Platform as a Service (PaaS); Software as a Service (SaaS)

4. Overlays

5. Processes to be used by the organization.

All plans, recommendations and documents shall be provided to the COR/VA PM for review and approval.

Deliverables:

A. Security Consideration Plan B. Security Requirements Needs Document

TECHINCAL SYSTEM ENGINEERING SUPPORT

The Contractor shall provide technical System engineering support services to HCSC throughout the software development lifecycle (SDLC) to include concept planning, development, and sustainment lifecycle for ATO. The Contractor shall provide weekly summations (e.g., meeting minutes) of internal and external meeting activities. The Contractor shall support system integration and implementation by identifying and analyzing system deficiencies, tracking VA application integration activities, monitoring application integration service request submissions and approvals through the governance process. The Contractor shall coordinate the uploading of all documentation into the VA selected site, e.g., SharePoint.

The Contractor shall provide technical system engineering support for each project to include:

a. Provide support to system owners and the Office of Information Security (OIS) Security and Access Control Assessor teams, within the assigned projects, during the ATO process for expiring or new ATOs. The assigned projects may be in varying stages within the ATO process.

b. Provide support to HCSC Project Manager (PjM), during the SDLC, within the assigned projects, by providing system architecture support, and maintenance of security access controls and other control consultation of applications and systems in, or transitioning to, the cloud.

c. Provide support to HCSC to collaborate and provide subject matter expertise (consultation and recommendations); hands-on technical security, access, and other control assessment support and perform analyses for talent development solution (TDS) teams within the assigned projects. Recommendations shall be provided quarterly within each PoP in the form of a System Impact Assessment (SIA) Report provided to the COR/PM and the assigned project Point of Contact related to new and existing architectures, infrastructures, and technologies (e.g., enterprise architecture, cloud computing, mobility, networks, virtualization, and services).

d. Provide continuous monitoring of the System Controls needed to maintain our current TDS authority to operate, as well as establishing the ATO for our future TDS.

In additional to the above requirements, the Contractor shall develop a detailed System Integration Process Improvement Workflow Report. The report shall address any specific recommendations describing efficiencies and improvements upon delivering applications and systems to on premise and cloud computing technology. The Government anticipates quarterly reports within each PoP. The System Integration Process Improvement Workflow Report shall be provided to the COR/VA PM for review and approval. Upon approval, the Contractor shall provide recommendations for process improvements for the SDLC. The COR/VA PM must also approve the commencement of any implementation.

Deliverables:

A. System Impact Assessment Report B. System Integration Process Improvement Workflow Report

TECHNICAL SYSTEM ENGINEERING AUTHORITY TO OPERATE (ATO)

The Contractor shall participate in systems security and controls assessments and provide recommendations that ensure compliance in accordance with NIST standards, VA 6500, A&A guidelines, VA security policies, and all systems controls. The Contractor shall provide full lifecycle information security, access, and other controls support for all ATO activities. This includes Updated ATO Implementation Narratives and updated ATO Test Results for Systems 1, 2, and 3. The Contractor shall maintain and update ATO SOPs for Systems 1, 2, and 3. The Contractor shall create ATO SOPs, ATO Implementation Narratives and ATO Test Results for System 4.

In support of this task, the Contractor shall perform the following:

a. Analyze and recommend ongoing guidance regarding potential security, access, and other control impacts to design and architecture changes, present to project lead or representative as a part of WAR, per assigned project.

b. Participate in recurring, strategic level meetings for assigned projects.

c. Perform Federal Information Processing Standard (FIPS) assessments for assigned projects and identify and define information types to support system categorization for systems requiring ATO support.

Provide support to projects requiring ATO approval. This includes participation in conducting reviews of ATO artifacts (e.g., System Security Plans, Incident Response Plans); and consulting with System Owners and Project Management Leads.

The COR/VA PM must also approve all recommendations and reports before the commencement of any implementation.

Deliverables:

Base Year A. Updated ATO SOPs for Systems 1, 2, and 3 B. Updated ATO Implementation Narratives for Systems 1, 2, and 3 C. Updated ATO Test Results for Systems 1, 2, and 3 D. ATO SOPs for System 4 E. ATO Implementation Narratives for System 4 F. ATO Test Results for System 4

Option Year 1 G. Updated ATO SOPs for Systems 1, 2, 3, and 4 H. Updated ATO Implementation Narratives for Systems 1, 2, 3, and 4 I. Updated ATO Test Results for Systems 1, 2, 3, and 4

Option Year 2 J. Updated ATO SOPs for Systems 1, 2, 3, and 4 K. Updated ATO Implementation Narratives for Systems 1, 2, 3, and 4 L. Updated ATO Test Results for Systems 1, 2, 3, and 4

Option Year 3 M. Updated ATO SOPs for Systems 1, 2, and 3 N. Updated ATO Implementation Narratives for Systems 1, 2, and 3 O. Updated ATO Test Results for Systems 1, 2, and 3

Option Year 4 P. Updated ATO SOPs for Systems 1, 2, and 3 Q. Updated ATO Implementation Narratives for Systems 1, 2, and 3 R. Updated ATO Test Results for Systems 1, 2, and 3

ENGINEERING AND TECHNICAL DOCUMENTATION

The Contractor shall provide Data Base Administrator (DBA) support and be responsible for the performance, integrity, and security of VA database systems. The Contractor shall provide expert technical advice, guidance, and recommendations to management and other technical specialists on critical IT issues. Interpret IT policies, standards, and guidelines. The Contractor shall monitor database performance, conduct regular performance tuning, and optimize queries for maximum efficiency. The Contractor shall:

a. Develop and implement database backup and recovery strategies to ensure data reliability and minimize downtime.

b. Perform routine maintenance tasks, such as database backups, index rebuilding, and statistics gathering.

c. Manage and optimize VA databases to ensure their availability.

d. Create and maintain comprehensive documentation of database systems, including schema, configurations, and standard operating procedures.

e. Generate regular reports on database performance, usage, and security compliance for management and stakeholders.

f. Develop and maintain data dictionaries for all assigned databases.

g. Apply strong knowledge of database management systems, such as Microsoft SQL Server, ETL and MySQL to design, development, query, and other routine tasks.

h. Apply proficiency in writing complex structured query language (SQL) queries and optimizing database performance.

i. Develop and enact stored procedures to address the business requirements for the talent development solutions.

j. Provide the precise vocabulary needed for discussing specific data elements from VA owned databases that supports a Talent Development Taxonomy.

k. Document all design, code, and implementation activities to include in a monthly Database Administration Report.

l. Communicate complex concepts/issues in a manner matched to the audience.

m. Maintain all documentation (e.g. standard operating procedures, code snippets,) on a VA-provided platform (e.g., SharePoint site).

The DBA shall create a shared dictionary to ensure that the meaning, relevance, and quality of data elements are the same for all users and to enhance the interoperability of data across systems. The baseline for this shared data dictionary shall incorporate elements from the VA’s Education Data Repository (EDR) and Talent Management System (TMS 2.0). Data dictionaries shall also provide information needed by those who build systems and applications that support the data. The Contractor shall develop and maintain a detailed data dictionary of all objects and elements in the specified VA databases. Each Data Dictionary shall include a listing of all data objects (names and definitions and description) and contain, at a minimum:

a. Detailed properties of data elements (data type, character length, nullability (accept null value), optionality, indexes, primary and foreign keys, required field) Entity-relationship diagrams (ERD), and other system-level diagrams.

b. Reference data (classification and descriptive domains)

c. Missing data indicated

d. Business rules, such as for validation of a schema or data quality.

The Contractor shall develop the Shared Data Dictionary, Talent Development Taxonomy and Solution Data Dictionary and provide monthly updates for each.

This information shared with the VA shall be up to date; when changes are made to database tables, objects and elements, VA shall be provided the most current and updated data dictionary and ERD’s, as soon as changes have been made to the database. If optional years are exercised the Contractor shall maintain and update monthly, the current Shared Data Dictionary, Talent Development Taxonomy and Solution Data Dictionary that are in place.

The Contractor shall provide a monthly Database Administrator Report that …

Deliverables:

A. Shared Data Dictionary B. Talent Development Taxonomy C. Solution Data Dictionary D. Database Administrator Report

RISK MANAGEMENT SUPPORT

The Contractor shall perform system analysis and deliver a System Risk Assessment Report for each system assigned to support the team’s presentation to the Authorizing Official (AO) for each system that will enable OIS and VA make informed, risk-based decisions regarding the accreditation of systems. The Contractor shall deliver a System Risk Analysis Report for each system assigned that shall include identifying, analyzing, evaluating, responding, and monitoring the risks of systems. The Contractor shall support the Enterprise Security Architecture (ESA) Enterprise Security Risk Assessment Model (ESRAM) with developing questions and metrics to support risk scoring development process. The Contractor shall use the ESRAM tool as a part of the System Risk Assessment process. These reports shall be required for each PoP exercised.

Deliverables:

A. System Risk Assessment Report B. Security Risk Analysis Report

ENTERPRISE BASELINE SUPPORT

The Contractor shall provide enterprise baseline support to ensure VA compliance with federal system and security requirements, VA system and security requirements, and Office of Inspector General (OIG) findings to improve security posture at the agency level. The Contractor shall provide technical subject matter expertise support for system and security impact analysis relating to the implementing/changing of enterprise baselines and providing recommendations to reduce and manage risk to the VA. This support includes system security analysis of new security policies and emerging technologies, artificial intelligence and machine learning, and internet of things that will be utilized by the VA. The Contractor shall document all findings in a quarterly System and Security Remediation Report Deliverable A. System and Security Remediation Reports

SYSTEMS INTEGRATIONS

The Contractor shall provide systems/software integration support to include planning, updating architecture models, interoperability specifications and analysis, system interface specifications, service definitions, and segmented architecture for the transition, integration, and implementation of IT systems. An integration requirement specification document (iRSD) shall be provided that describes the requirements for a successful data integration. For all system integrations a Memorandum of Understanding (MOU) and Interconnection Security Agreements (ISA) are required and will include in detail what data types are shared, who has access, and the appropriate level of security controls for all systems connected to VA networks. An interface control document (ICD) for each integration will be required for system integrations and should display specifically how the systems will exchange data that includes documentation and diagrams that depict the flow of data.

Deliverables Base Year A. Integration requirement specification document iRSD (x11) B. Memorandum of Understanding (MOU) / Interconnection Security Agreement (ISA) Integration Support (x11) C. Interface Control Document (ICD) (x11)

Option Year 1 D. Integration requirement specification document iRSD (x24) E. Memorandum of Understanding (MOU) / Interconnection Security Agreement (ISA) Integration Support (x17) F. Interface Control Document (ICD) (x24)

Option Year 2 H. Integration requirement specification document iRSD (x10) I. Memorandum of Understanding (MOU) / Interconnection Security Agreement (ISA) Integration Support (x10) J. Interface Control Document (ICD) (x10)

Option Year 3 K. Integration requirement specification document iRSD (x5) L. Memorandum of Understanding (MOU) / Interconnection Security Agreement (ISA) Integration Support (x5) M. Interface Control Document (ICD) (x5)

Option Year 4 O. Integration requirement specification document iRSD (x5) P. Memorandum of Understanding (MOU) / Interconnection Security Agreement (ISA) Integration Support (x5) Q. Interface Control Document (ICD) (x5)

SYSTEMS TRANSITION SUPPORT (OPTIONAL TASK)

The Contractor shall provide a Transition Plan for 60 days of outgoing transition support for transitioning work from the current contract to a follow-on contract or Government entity. This transition may be to a Government entity or to another contractor or to the incumbent Contractor under a new contract. In accordance with the Government-approved plan, the Contractor shall implement and a complete transition from this contract to a new support provider. This shall include formal coordination with Government staff and successor contractor staff and management. It shall also include delivery of copies of all artifacts and supporting documentation delivered under this contract, as well as existing policies and procedures, and delivery of baseline metrics and statistics. This Transition Plan shall include, at a minimum, the following:

a. Coordination with Government representatives.

b. Review, evaluation, and transition of current support services.

c. Transition of historic data to new System.

d. Transfer of all necessary business and/or technical documentation.

e. Orientation phase and program to introduce Government and contractor personnel, programs, and users to the Contractor's team, tools, methodologies, and business processes.

f. Disposition of Contractor purchased Government owned assets.

g. Turn-in of all VA PIV Cards and GFE.

The Contractor shall provide a detailed Transition Completion Report that outlines all completed work that is associated with the Transition Plan. This shall include any plans, specifications, or other relevant documentation.

Deliverables:

A. Transition Plan B. Transition Completion Report

OIT RESPONSE TO NATIONAL EMERGENCIES, PANDEMICS AND OTHER UNFORESEEN VA NEEDS SUPPORT…