DRAFT PWS - OPAL Tier 1 Systems Services Support 5-06-2024 CLEAN - RFI VERSION.docx

OPAL Tier 1 Acquisition and Business System Support Services

VA-24-00073756

DRAFT

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Office of Procurement, Acquisition and Logistics (OPAL)

OPAL Tier 1 Acquisition and Business Systems Support Services

Date: May 3, 2024

VA-24-00073756

PWS Version Number: 0.1

Contents

BACKGROUND

The Department of Veterans Affairs (VA) Office of Procurement, Acquisition and Logistics (OPAL) primary mission is to provide contracting support to VA Central Office and the entire VA enterprise. OPAL is currently required to utilize a combination of the Electronic Contract Management System (eCMS) and the Integrated and Financial Accounting System (IFAMS). Based on the use of eCMS, IFAMS and other acquisition and business support systems, OPAL requires tier 1 support services for a broad range of actions that shall include training and user support, application administration, and reporting. The contract writing systems currently integrate with all Integrated Acquisition Environment systems: Federal Procurement Data System – Next Generation (FPDS-NG), Office of Research Compliance and Assurance (ORCA), General Service Administration (GSA) eBuy, Federal Business Opportunities (FBO), and the contractor is expected to reconcile data between eCMS and Virtual Office of Acquisition (VOA), /Forecast of Opportunities and Requirements Center for Excellence (FORCE).

APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following (as applicable):

1. 44 U.S.C. § 3541-3549, “Federal Information Security Management Act (FISMA) of 2002”

2. “Federal Information Security Modernization Act of 2014”

3. Federal Information Processing Standards (FIPS) Publication 140-3, “Security Requirements for Cryptographic Modules”, March 22, 2019

4. FIPS Pub 199. “Standards for Security Categorization of Federal Information and Information Systems,” February 2004

5. FIPS Pub 200, “Minimum Security Requirements for Federal Information and Information Systems,” March 2006

6. FIPS Pub 201-3, “Personal Identity Verification of Federal Employees and Contractors,” January 2022

7. 10 U.S.C. § 2224, "Defense Information Assurance Program"

8. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

9. Public Law 109-461, Veterans Benefits, Health Care, and Information Technology Act of 2006, Title IX, Information Security Matters

10. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”

11. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, https://www.va.gov/vapubs/index.cfm

12. VA Handbook 0710, “Personnel Security and Suitability Program,” May 2, 2016, https://www.va.gov/vapubs/index.cfm

13. VA Directive and Handbook 6102, “Internet/Intranet Services,” August 5, 2019

14. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and Guidelines,” January 18, 2017

15. Office of Management and Budget (OMB) Circular A-130, “Managing Federal Information as a Strategic Resource,” July 28, 2016

16. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed Services (CHAMPUS)”

17. NIST SP 800-66 Rev. 1, “An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule,” October 2008

18. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended, January 18, 2017

19. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

20. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021

21. VA Handbook 6500, “Risk Management Framework for VA Information Systems VA Information Security Program,” February 24, 2021

22. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI),” June 30, 2023

23. VA Handbook 6500.5, “Incorporating Security and Privacy into the System Development Lifecycle,” March 22, 2010

24. VA Handbook 6500.6, “Contract Security,” March 12, 2010

25. VA Handbook 6500.8, “Information System Contingency Planning,” April 6, 2011

26. VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018

27. VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017

28. OIT Process Asset Library (PAL), https://www.va.gov/process/ . Reference Process Maps at https://www.va.gov/process/maps.asp and Artifact templates at https://www.va.gov/process/artifacts.asp

29. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

30. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014

31. VA Handbook 6510, “VA Identity and Access Management,” January 15, 2016

32. VA Directive and Handbook 6513, “Secure External Connections,” October 12, 2017

33. VA Directive 6300, “Records and Information Management,” September 21, 2018

34. VA Handbook, 6300.1, “Records Management Procedures,“ March 24, 2010

35. NIST SP 800-37 Rev 2, “Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy,” December 2018

36. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020)

37. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015

38. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” March 24, 2014

39. OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005

40. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019

41. OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008

42. Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance, December 2, 2011, (NOTE: Part A of the FICAM Roadmap and Implementation Guidance, v2.0, was replaced in 2015 with an updated Architecture (https://arch.idmanagement.gov/#what-is-the-ficam-architecture)

43. NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access,“ June 2018

44. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, “Digital Identity Guidelines,” updated March 02, 2020

45. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014

46. NIST SP 800-164, “Guidelines on Hardware-Rooted Security in Mobile Devices (Draft),” October 2012

47. VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

48. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

49. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

50. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

51. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019

52. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008

53. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (Public Law 110–140), December 19, 2007

54. Section 104 of the Energy Policy Act of 2005, (Public Law 109–58), August 8, 2005

55. Executive Order 13834, “Efficient Federal Operations,” dated May 17, 2018

56. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 2, 2001

57. VA Directive 0057, “VA Environmental Management Program”, October 25, 2022

58. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

59. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

60. “Veteran Focused Integration Process (VIP) Guide 4.0,” January 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

61. VA Memorandum “Proper Use of Email and Other Messaging Services,” January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

62. “Product Line Management Transformation Playbook” version 3.1, August 2023, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

63. NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020

64. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol Version 6 (IPv6),” November 19, 2020

65. Social Security Number (SSN) Fraud Prevention Act of 2017

66. Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23, 2018

67. . Executive Order 14028, “Executive Order on Improving the Nation's Cybersecurity,” May 12, 2021, https://www.whitehouse.gov/briefing-room/presidential-actions/2021/05/12/executive-order-on-improving-the-nations-cybersecurity/

68. OMB Memorandum M-22-09, “Moving the U.S. Government Toward Zero Trust Cybersecurity Principles”, January 26, 2022, https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf.

69. “Binding Operational Directive 23-01: Improving Asset Visibility and Vulnerability Detection on Federal Networks.” Cybersecurity & Infrastructure Security Agency (CISA), https://www.cisa.gov/binding-operational-directive-23-01.

SCOPE OF WORK

The Contractor shall provide Tier 1 contract writing system support services to assist the acquisition workforce in the use of these tools. This shall include training and user support, application administration, and reporting.

PERFORMANCE DETAILS

PERFORMANCE PERIOD

The Period of Performance (POP) shall be July 1, 2024 through June 30, 2025 and shall include four (4) 12-month option periods. The POP for Optional Task One (1), if exercised, shall be proposed by the Contractor for Government approval based on the Government’s training requirement prior to exercise of the optional task on a per-training-event basis.

Refer to PWS Section 5.2.1 for support service coverage hours.

There are eleven (11) Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, four are set by date:

If any of the above falls on a Saturday, then the preceding Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then subsequent/following Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

PLACE OF PERFORMANCE

All requirements of this PWS shall be supported remotely for all sites. Each OPAL facility shall have a member of the Contractor team dedicated to the specific site.

Phone 908-458-7813 Email: Richard.Wortman2@va.gov

Phone 708-786-5211 Email: Raymond.Schraeder@va.gov

National Acquisition Center (NAC) Commodities and Services Acquisition Service and Denver Logistics Center (DLC)

Attention: Star Yeo Phone 303-273-6211 Email: Star.Yeo@va.gov

Table 1: Primary Facility Locations and POCs

Phone: 202-461-6906 Email: Iris.Hall2@va.gov

Phone 202-704-7417 Email: Adam.Spacht@va.gov

Table 2: Optional Task Facility Locations and POCs

TRAVEL

Reimbursement of Travel:

Reimbursement of travel is not envisioned for performance of this contract. Should a travel event arise, it must be pre-approved by the CO and the COR on a case-by-case basis and will be authorized in accordance with General Services Administration (GSA) Terms and Conditions. Most meetings can be attended virtually on MS Teams. Contractor personnel shall travel to their nearest VA location to obtain GFE at no cost to the Government.

Local Travel:

Local travel to attend meetings or events may be required at no cost to the Government. Travel within a specific VA commuting vicinity (50 miles one way) is considered a cost of doing business and shall not be separately reimbursed.

Relocation:

Relocation: Relocation of contractor personnel for the purpose of staffing this contract are not subject to reimbursement.

4.4.4 Travel for On-Boarding:

Mileage Reimbursement is available for new, approved contractor personnel on non-pay status who must travel more than 50 miles one way for initial on-boarding related appointments due to the lack of available, timely appointments available at their local/closest VA facility. Appointments within seven business days of position acceptance is considered timely. Mileage reimbursement begins on mile 51. This is based on the VA Financial Policy, Volume XIV, Travel, where local travel is defined within a 50 mile radius. VA's standard application of hiring employees or permitting contractors to work remotely (i.e. perform duties at a non-VA owned or leased facility) is expected to have and maintain a safe remote workplace within a 50 mile range of a VA facility/office that supports both PIV credentialing/issuance/support as well as on-site IT end-user support. Only in extraordinary circumstances (i.e. no qualified/eligible employee/contractor can be found to be available to maintain such a remote worksite shall 2023 GSA FTR reimbursement rate for privately owned vehicles (POVs) is $0.655 per mile (Might need to check to see if this increased); this rate is usually updated annually and posted on the GSA.gov website under Travel Resources.

SPECIFIC TASKS AND DELIVERABLES

The Contractor shall perform the following:

The Contractor shall provide Tier 1 contract writing system and support system support, attend technical and program meetings, provide advanced reporting capabilities, support the documentation of Standard Operating Procedures (SOP), and provide training support for the four (4) primary OPAL sites listed in Section 4.2, Table 1. Support is required for any and all acquisition systems used by the VA acquisition workforce to include not only the current systems, but also any future systems VA may elect to adopt or otherwise use in execution of its acquisition mission. This shall include support services for other related business systems that interface with those acquisition systems used by VA, even if only in part, that enable or otherwise support the VA’s acquisition mission operational, compliance, and reporting objectives through the Federal and VA acquisition lifecycle. Examples of acquisition systems and their interfacing or otherwise supporting systems include, but are not limited to the following: eCMS (which consists of AAMS, FORCE, OOM, eCERT, eCOR, VP, VOA/ATOMS, EPIC), FPDS, CPARS, GPE (e.g. SAM.gov), eSRS, IPPS, iFAMS, IFCAP, FMS, CAATS, GSA eBuy, SCMC, ADDS UP, GATEWAY, IAM, MicroStrategy, Power BI, VA Acquisition Internet-based, Intranet-based, and SharePoint-based sites. The Contractor shall provide support to the four (4) OPAL sites referenced in Section 4.2.

Any additional enhancements to these systems, subsequent replacement systems, or otherwise replacement/next-generation versions of the systems, and/or newly developed or used acquisition systems that the Federal and/or VA acquisition workforce systems users employ.

PROJECT MANAGEMENT

CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, timeline, and tools to be used in execution of the contract. The CPMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks, and resource support. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPMP shall be concurred upon and updated in accordance with Section B of the contract. The Contractor shall update and maintain the VA PM approved CPMP throughout the PoP.

Deliverable:

A. Contractor Project Management Plan

TECHNICAL KICKOFF MEETING

The Contractor shall hold a virtual technical kickoff meeting within 10 days after TO award. The Contractor shall present, for review and approval by the Government, the details of the intended approach, work plan, and project schedule for each effort. The Contractor shall specify dates, locations (can be virtual), agenda (shall be provided to all attendees at least five (5) calendar days prior to the meeting), and meeting minutes (shall be provided to all attendees within three (3) calendar days after the meeting). The Contractor shall invite the Contracting Officer (CO), Contract Specialist (CS), COR, and the VA PM’s.

PROGRAM RELATED MEETINGS

The Contractor shall conduct a Program Management Review (PMR) once per quarter inclusive of the sites detailed in Section 4.2 above. The Contractor shall coordinate with the COR to ensure representation from each site. The Contractor shall present goals and objectives, contract cost, schedule, and performance, as well as any issues or open discussion items.

PMRs may be held in person at one of the sites detailed in Section 4.2 above. Location and option to convert the PMR to a hybrid and/or fully virtual meeting will be at the discretion of the Government with appropriate notice provided. Any resulting travel for PMRs will be in accordance with Section 4.3 above.

REPORTING REQUIREMENTS

The Contractor shall provide the COR with Monthly Progress Reports (MPR) in a VA approved format. The report shall include detailed instructions/explanations for each required data element, to ensure that data is accurate and consistent.

The MPR shall cover all work completed during the performance period and work planned for the subsequent performance period. The report shall also identify any problems that arose and a description of how the problems were resolved. If problems have not been completely resolved, the Contractor shall provide an explanation including their plan and timeframe for resolving the issue. The MPR shall include a Tier 1 Support Monthly Summary Log that details all support activities performed during the previous month to include all issues separated by location; all open, closed and escalated tickets, resolution times, requestor’s name and contact information, description, priority, and current ticket status. Resolution times shall include total amount of time to resolve a ticket and/or amount of time it took for the Contractor to escalate the ticket to the eCMS Help Desk, which is supported under a separate task order. The Tier 1 Support Monthly Summary Log shall also include a cumulative roll-up of all support activities performed during the performance period. The Contractor shall monitor performance against the CPMP and report any deviations. It is expected that the Contractor will keep in communication with VA accordingly so that issues that arise are transparent to both parties to prevent escalation of outstanding issues.

Deliverable:

A. Monthly Progress Report B. Tier 1 Monthly Summary Log

SUPPORT TO OPAL CONTRACTING TEAMS

OPAL eCMS TIER 1 SUPPORT The Contractor shall provide contracting writing and support system tier 1 support for all OPAL users employed at the primary facilities listed in Section 4.3 above, during the normal business hours of 7:30am to 7pm ET Monday through Friday. The Contractor shall provide a response to all OPAL user or VA Application Coordinator requests within 30 minutes and shall provide resolution to the problem within two (2) hours. OPAL users consist of those employed or contracted staff to OPAL, or a site therein, whose job functions or duties require system access and use to execute those duties, as well as supporting these end-users through indirect support to the end-user’s customer(s) and other stakeholder(s) as needed (e.g. providing information to end-user on how customer’s PM office staff provisioning/access in FORCE is needed to ensure proper routing/reporting, how end-user’s stakeholder contractors may need to be provisioned/vendorized appropriately, etc). The Contractor shall provide support for interfaces to all systems referenced in PWS Section 5.0. The Contractor shall report any irregularities in functionality to the applicable VA Application Coordinator and elevate to the Enterprise Acquisition System Support (EASS) Team as necessary.

There are approximately 405 VA OPAL employees/contractors that currently use eCMS. In FY18 OPAL awarded 13,758 actions. VA is assuming a 10% increase in actions and users per year, and increased use of telework.

Table 3: FY18 OPAL Actions, Tickets and Users

HELP DESK REFERRALS

The Contractor shall escalate any tickets that cannot be resolved, to the EASS Help Desk within two (2) hours of receipt of request. The Contractor shall ensure that the end user and applicable VA Application Coordinator is copied on all correspondence between the Tier 1 support team and the EASS Help Desk. The Contractor shall be responsible for tracking, coordinating and reporting of all escalated tickets until resolved. Upon escalation of trouble tickets to the EASS Help Desk, the Contractor is not responsible for the resolution of the identified issue, however, shall be responsible for reporting until resolution is achieved. Typically, 99% of issues are resolved prior to escalation to the EASS Help Desk. Additionally, the contractor shall assist with entering and elevating tickets to other help desks such as the iFAMS/FSC Help Desks and other acquisition systems help desks (FMBT, IPPS, IAM provisioning, FPDS, SAM.gov, etc) as appropriate for issue resolution.

CONTRACTING SYSTEM SUPPORT

The Contractor shall provide the following OPAL contracting support, but not limited to:

ACQUISITION SYSTEMS APPLICATION SUPPORT

The Contractor shall provide the following acquisition systems application support, including but not limited to eCMS/IFAMS.

1. Based upon direction by a VA Application Coordinator, the Contractor shall perform configuration of new and existing user accounts, assignment of roles and permissions, identity register information, standard address data, edit warrant information, and desktop access. Also, upon request from a VA Application Coordinator, the Contractor shall deactivate departed users, remove roles, remove membership to workgroups and otherwise any other updates to user’s account access.

2. Collect contracting trends, data artifacts and materials that may potentially be suitable for reuse by other OPAL eCMS/IFAMS users, these may be in the context of Best Practices/ SOP and providing those artifacts to the applicable Application Coordinator.

BEST PRACTICES AND STANDARD OPERATING PROCEDURES (SOPs) The Contractor shall recommend Best Practices and SOPs for the OPAL eCMS/IFAMS users at the facilities listed in Table 1 such as:

1. eCMS/IFAMS data value guidance

2. Procedures for milestones of various eCMS/IFAMS action types

3. Procedures for standard filing of eCMS/IFAMS actions

4. Procedures on organizing and uploading action briefcase files

5. Process to ensure proper adherence to the weekly pipeline and workload reports that are reviewed by OPAL leadership.

RIGHTS IN DATA

Any SOPs, training documents, or other work products/deliverables developed, produced or maintained by the Contractor under this contract shall be provided to the Government. The Contractor shall pass ownership of these products/documents to the Government for the Government’s unrestricted use and license.

REPORTING SUPPORT

The Contractor shall utilize MicroStrategy, IFAMS, FPDS AdHoc Reporting Tool, and any other official reporting tools for generation of Standard Reports, detailed below, and Customized Reports. It is expected that in addition to the Standard Reports listed below, two (2) additional Standard Reports will be added per year.

In the case the eCMS and IFAMS Reporting Tools fail to function or are not capable of creating the Standard Reports, the Contractor shall generate the reports utilizing Microsoft Access, Microsoft Excel, or Power BI, assuming the Contractor can obtain appropriate data.

The Contractor shall develop and provide the following Standard Reports:

1. Weekly and Monthly Award Report – The Contractor shall develop Weekly and Monthly Award Reports to track all awards made within OPAL. These reports shall contain all award action fields from eCMS/IFAMS with the filter being Action State of awarded in the current fiscal year. The Weekly Report shall include data from the previous week and the Monthly Report shall include data from the previous month.

2. Monthly FPDS-NG Year to-Date Report – This Report shall be pulled from www.fpds.gov to report on all awards reported to FPDS-NG in the current fiscal year.

3. Daily eCMS Pipeline Report – The Contractor shall utilize and maintain the eCMS Pipeline report located in MicroStrategy. The Contractor shall be responsible for all formatting including advanced and conditional formatting. The Contractor is also responsible for the creation and maintenance of all logic built into the report and the applicable subscriptions.

4. Daily FORCE Pipeline Report – The Contractor shall utilize and maintain the FORCE Pipeline report located in MicroStrategy. The Contractor shall be responsible for all formatting including advanced and conditional formatting. The Contractor is also responsible for the creation and maintenance of all logic and filters built into the report and the applicable subscriptions.

5. Biweekly Closeout Report – The Contractor shall utilize and maintain the Microsoft Access Closeout database tool to generate a biweekly Microsoft Excel Closeout Report. The Contractor shall be responsible for all formatting including advanced and conditional formatting. For the Access database, the Contractor is responsible for the creation and maintenance of all tables, queries and logic built into the Closeout database tool.

Customized Reports are any other reports that are not listed above and require the Contractor to generate them utilizing MicroStrategy, Power BI, Microsoft Access, Microsoft Excel, and/or any other acceptable business intelligence and data visualization tools. These reports are estimated at 20 per month, per site. The Contractor shall also provide dashboard support to include the development, maintenance, and updating of dashboards and data visualization.

The Contractor shall ensure proper email subscriptions are set up and maintained for each report within MicroStrategy, Power BI, or any other authoritative VA business intelligence tools utilized as sources for acquisition data based on the requirements specified by the VA eCMS Application Coordinator/Systems Team POCs.

Deliverables:

1. Weekly Award Report

1. Monthly Award Report

1. Monthly FPDS-NG Year-to-Date Report

1. Daily eCMS Pipeline Report

1. Daily FORCE Pipeline Report

1. Biweekly Closeout Report The Contractor shall also create, maintain, and make available upon request on a regular and/or ad-hoc basis reports such as but not limited to:

· Awarded Actions Reports.

5. Between X & Y Dates

5. To n Contractor/Vendor

5. With X NAICS and/or PSC

5. Type of Action

5. Missing Data Value(s) (list)

5. Incorrect Data Value(s) (list)

5. Funded by/with (Program Office and/or Funding Office Codes)

5. Containing X Clause/Provision (list)

5. Containing {defined} value(s) in Specified Data Values

· Non-Award Actions Reports (similar to 1. Above)

· User Reports

5. Active/Inactive Users in System

5. User List(s) Based on Role(s)

5. User List(s) Based on Permission(s)

5. User List(s) Based on Warrant Level

5. User List(s) Based on Date(s) of Access

5. User List(s) Based on Organization/Team/Division/Sub-unit

· User List(s) Based on User-Type (employee vs contractor) OPTIONAL TASK ONE – iFAMS ENTERPRISE ACQUISITION MODULE SUPPORT

OPAL contracting offices may transition into the iFAMS Enterprise Acquisition Module at some time during the performance of this contract. This will replace eCMS/AAMS as the official contract writing tool for those offices at that time. The Contractor shall provide all support referenced in Section 5.2 of the PWS for this iFAMS Enterprise Acquisition Module if this optional task is exercised. If iFAMS Enterprise Acquisition Module is not adopted by OPAL offices to replace eCMS/AAMS and another contract writing system is, this Optional Task shall cover that other replacement if this optional task is exercised.

OPTIONAL TASK TWO – TRANSITION SUPPORT

The Contractor shall provide a plan for 30 days of outgoing transition for transitioning work from the current contract to a follow-on contract/order or Government entity two (2) months prior to the end of the period of performance. This transition may be to a Government entity or to another Contractor or to the incumbent Contractor under a new contract/order. In accordance with the Government-approved plan, the Contractor shall assist the Government in planning and implementing a complete transition from this contract to a successful provider. This shall include formal coordination with Government staff and successor staff and management. It shall also include delivery of electronic copies of existing policies and procedures, and delivery of required metrics and statistics. This transition plan shall include:

1. Coordination of Government and incoming representatives for each OPAL facility

1. Roster of key points of contact with email address and telephone numbers

1. Transition timeline with key milestones

1. Inventory and transition of historical data (e.g., memos, letters, correspondence, regulations, documents, transition agreement documents, and memorandums of agreement/ understanding)

1. Procedural manuals/guidelines and Standard Operating Procedures (SOPs)

1. Report Subscriptions details

1. Standard Reports

1. Custom Reports logic and background

1. Operating instructions

1. Data and workflow process

1. Training materials

1. Orientation to introduce incumbent Contractor team, programs, and users to the incoming team, explaining tools, methodologies, and business processes

1. Procedures to introduce Government personnel, programs, and users to the Contractor team’s tools, methodologies, and business processes

1. Transition checklist

1. Signed turnover agreements

Deliverable:

0. Transition Plan

GENERAL REQUIREMENTS

ENTERPRISE AND IT FRAMEWORK

VA TECHNICAL REFERENCE MODEL

The Contractor shall comply with the VA OIT Technical Reference Model (VA TRM). Compliance with the VA TRM is achieved by using only technologies and standards that are listed as approved for use in the VA TRM. The Contractor shall provide all necessary information requested by VA to ensure TRM approval is obtained prior to use on VA’s network.

FEDERAL IDENTITY, CREDENTIAL, AND ACCESS MANAGEMENT (FICAM)

The Contractor shall ensure Commercial Off-The-Shelf (COTS) product(s), software configuration and customization, and/or new software are Personal Identity Verification (PIV) card-enabled by accepting HSPD-12 PIV credentials using VA Enterprise Technical Architecture (ETA), https://www.ea.oit.va.gov/EAOIT/VA_EA/Enterprise_Technical_Architecture.asp, and VA Identity and Access Management (IAM) approved enterprise design and integration patterns, https://www.oit.va.gov/library/recurring/edp/index.cfm. The Contractor shall ensure all Contractor delivered applications and systems comply with the VA Identity, Credential, and Access Management policies and guidelines set forth in Executive Order 14028, VA Handbook 6510 VA Identity and Access Management, VA Handbook 0735 Homeland Security Presidential Directive 12 (HSPD-12) Program, CISA Binding Operational Directive 23-01, and align with the Federal Identity, Credential, and Access Management Roadmap and Implementation Guidance v2.0.

The Contractor shall ensure all Contractor delivered applications and systems provide user authentication services compliant with the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-63-3, VA Handbook 6500 , and VA IAM enterprise requirements for direct, assertion based authentication, and/or trust based authentication, as determined by the design and integration patterns. Direct authentication at a minimum must include Public Key Infrastructure (PKI) based authentication supportive of PIV card and/or Common Access Card (CAC), as determined by the business need.

The Contractor shall ensure all Contractor delivered applications and systems conform to the specific Identity and Access Management PIV requirements set forth in the Office of Management and Budget (OMB) Memoranda M-05-24, M-19-17, M22-09, and NIST Federal Information Processing Standard (FIPS) 201-2. OMB Memoranda M-05-24, M-19-17, and M-22-09 can be found at: Memoranda | OMB | The White House ,. Contractor delivered applications and systems shall be on the FIPS 201-2 Approved Product List (APL). If the Contractor delivered application and system is not on the APL, the Contractor shall be responsible for taking the application and system through the FIPS 201 Evaluation Program.

The Contractor shall ensure all Contractor delivered applications and systems support:

1. Automated provisioning and are able to use enterprise provisioning service.

2. Interfacing with VA’s Master Person Index (MPI) to provision identity attributes, if the solution relies on VA user identities. MPI is the authoritative source for VA user identity data.

3. The VA defined unique identity (Secure Identifier [SEC ID] / Integrated Control Number [ICN]).

4. Multiple authenticators for a given identity and authenticators at every Authenticator Assurance Level (AAL) appropriate for the solution.

5. Identity proofing for each Identity Assurance Level (IAL) appropriate for the solution.

6. Federation for each Federation Assurance Level (FAL) appropriate for the solution, if applicable.

7. Two-factor authentication (2FA) through an applicable design pattern as outlined in VA Enterprise Design Patterns.

8. A Security Assertion Markup Language (SAML) implementation if the solution relies on assertion-based authentication. Additional assertion implementations, besides the required SAML assertion, may be provided as long as they are compliant with NIST SP 800-63-3 guidelines.

9. Authentication/account binding based on trusted Hypertext Transfer Protocol (HTTP) headers if the solution relies on Trust based authentication.

10. Role Based Access Control.

11. Auditing and reporting capabilities.

12. Compliance with VIEWS 00155984, PIV Logical Access Policy Clarification https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896.

The required Assurance Levels for this specific effort are Identity Assurance Level 3, Authenticator Assurance Level 3, and Federation Assurance Level 3.

INTERNET PROTOCOL VERSION 6 (IPV6)

The Contractor solution shall support Internet Protocol Version 6 (IPv6) based upon the memo issued by the Office of Management and Budget (OMB) on November 19, 2020 (https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-07.pdf). IPv6 technology, in accordance with the USGv6 Program (https://www.nist.gov/programs-projects/usgv6-program/usgv6-revision-1), NIST Special Publication (SP) 500-267B Revision 1 “USGv6 Profile” (https://doi.org/10.6028/NIST.SP.500-267Br1), and NIST SP 800-119 “Guidelines for the Secure Deployment of IPv6” (https://doi.org/10.6028/NIST.SP.800-119), compliance shall be included in all IT infrastructures, application designs, application development, operational systems and sub-systems, and their integration. In addition to the above requirements, all devices, applications, and systems shall support all applicable functionality on native IPv6 only as well as dual stack (IPv6 / IPv4) connectivity without additional memory or other resources being provided by the Government, so that they can function in a mixed environment. All public/external facing servers and services (e.g., web, email, DNS, ISP services, etc.) shall support native IPv6 and dual stack (IPv6 / IPv4) users and all internal infrastructure and applications shall support using native IPv6 only and dual stack (IPv6 / IPv4) for all functionality and operations.

TRUSTED INTERNET CONNECTION (TIC)

The Contractor solution shall meet the requirements outlined in Office of Management and Budget Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative“ (https://www.whitehouse.gov/wp-content/uploads/2019/09/M-19-26.pdf), VA Directive 6513 “Secure External Connections”, and shall comply with the TIC 3.0 Core Guidance Documents, including all Volumes and TIC Use Cases, found at the Cybersecurity & Infrastructure Security Agency (CISA) (https://www.cisa.gov/publication/tic-30-core-guidance-documents). Any deviations must be approved by the VA TIC 3.0 Working Group at vaoisesatic30team@va.gov.

STANDARD COMPUTER CONFIGURATION

The Contractor IT end user solution that is developed for use on standard VA computers shall be compatible with and be supported on the standard VA operating system, currently Windows 10(64bit), Edge (Chromium based), and 365 Apps for enterprise. In preparation for the future VA standard configuration update, end user solutions shall also be compatible with Windows 11. However, Windows 11 is not the VA standard yet and is currently not approved for use on the VA Network but is in-process for future approval by OIT. Upon the release approval of Windows 11 individually as the VA standard, Windows 11 will supersede Windows 10. Applications delivered to VA and intended to be deployed to Windows 10 workstations shall be delivered as a signed .msi package with switches for silent and unattended installation and updates shall be delivered in signed .msp file formats for easy deployment using Microsoft Endpoint Configuration Manager (CM) VA’s current desktop application deployment tool. Signing of the software code shall be through a vendor provided certificate that is trusted by VA using a code signing authority such as Verizon/Cybertrust or Symantec/VeriSign. The Contractor shall also ensure and certify that their solution functions as expected when used from a standard VA computer, with non-admin, standard user rights that have been configured using the Defense Information Systems Agency (DISA) Secure Technical Implementation Guide (STIG) specific to the particular client operating system being used.

VETERAN FOCUSED INTEGRATION PROCESS (VIP) AND PRODUCT LINE MANAGEMENT (PLM)

The Contractor shall support VA efforts IAW the Veteran-Focused Integration Process (VIP) Guide and Product Line Management (PLM) Playbook. The major focus of VIP is on Enterprise Oversight, Governance, reporting, and establishing practices that focus on outcomes and continuously delivering sustainable IT capabilities to benefit the Veteran. PLM is a framework that focuses on delivering functional products that provide the highest priority work to customers while delivering simplified, reliable, and practical solutions to the business, medical staff, and our Veterans. The VIP Guide is a companion guide to the PLM Transformation Playbook and can be found at: https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371 and the PLM Transformation Playbook can be found at https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946. VIP and PLM are the authoritative processes that IT projects must follow to ensure development and delivery of IT products.

The VIP Guide provides guidance for transitioning from project-centric to product-centric delivery. The VIP guide applies to all OIT Office of Management and Budget (OMB) reportable products that are required to collect and report costs, schedules, risks, and other valuable information in VA PARS (whether products are procured or developed by VA) and any VA Information Technology project effort in Software Product Management (SPM) and Infrastructure Operations (IO), or their successors, that touch the VA network regardless of IT organizational alignment (whether it spends government funding from VA's Congressional IT Appropriation or any other appropriation).

The PLM Transformation Playbook details how OIT leadership expects Product Lines (PLs) to implement PLM, DevOps, and Lean-Agile principles, methods, practices, and techniques through levels of maturity. The PLM Transformation Playbook applies to all Information Technology (IT) products aligned to PLs in the Software Product Management, Infrastructure Operations and Product Engineering organizations within the OIT organization.

Others outside the referenced groups or organizations may use the VIP Guide and PLM Transformation Playbook for situational awareness as needed.

PROCESS ASSET LIBRARY (PAL)

The Contractor shall perform their duties consistent with the processes defined in the OIT Process Asset Library (PAL).

The Process Asset Library (PAL) includes a spectrum of OIT functions and activities, such as project management, operations, service delivery, communications, acquisition, and resource management. PAL serves as an authoritative and informative repository of searchable processes, activities or tasks, roles, artifacts, tools and applicable standards and guides to assist the OIT workforce, Government and Contractor personnel. OIT utilizes PAL processes to ensure compliance with policies and regulations and to meet VA quality standards. The PAL includes the contractor onboarding process consistent with Section 6.2.2 and can be found at https://www.va.gov/PROCESS/artifacts/maps/process_CONB_ext.pdf. The main PAL can be accessed at www.va.gov/process

AUTHORITATIVE DATA SOURCES

The VA Enterprise Architecture Repository (VEAR) is one component within the overall EA that establishes the common framework for data taxonomy for describing the data architecture used to develop, operate, and maintain enterprise applications. The Contractor shall comply with the department’s Authoritative Data Source (ADS) requirement that VA systems, services, and processes throughout the enterprise shall access VA data solely through official VA ADSs where applicable, see below. The Information Classes which compose each ADS are located in the VEAR, in the Data & Information domain. The Contractor shall ensure that all delivered applications and system solutions support:

a. Interfacing with VA’s Master Person Index (MPI) (formerly the Master Veteran Index (MVI)) to provision identity attributes, if the solution relies on VA user identities. MPI is the authoritative source for VA user identity data.

b. Interfacing with Capital Asset Inventory (CAI) to conduct real property record management actions, if the solution relies on real property records data. CAI is the authoritative source for VA real property record management data.

c. Interfacing with electronic Contract Management System (eCMS) for access to contract, contract line item, purchase requisition, offering vendor , and solicitation information above the micro-purchase threshold, if the solution relies on procurement data. ECMS is the authoritative source for VA procurement actions data.

d. Interfacing with HRSmart Human Resources Information System to conduct personnel action processing, on-boarding, benefits management, and compensation management, if the solution relies on personnel data. HRSmart is the authoritative source for VA personnel information data.

e. Interfacing with VA Profile to access personal contact information, if the solution relies on VA Veteran personal contact information data. VA Profile is the authoritative source for VA Veteran Personal Contact Data.

f. Interfacing with VA/Department of Defense (DoD) Identity Repository (VADIR) for determining eligibility for VA benefits under Title 38, if the solution relies on qualifying active duty military service data. VADIR is the authoritative source for Qualifying Active Duty military service in VA.

g. Interfacing with VA Systems Inventory (VASI ) to access VA systemsystems information, if the solution relies on VA system information data. VASI is the authoritative source for VA system data.

SOCIAL SECURITY NUMBER (SSN) REDUCTION

The Contractor solution shall support…