DRAFT PWS_PVP Services.docx

PVP Support Services

VA-25-00003437

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Operations, Security and Preparedness (OSP) Office of Personnel Vetting and Credential Management (PVCM)

Personnel Vetting Program (PVP) Support

Date: July 29, 2024

VA-25-00003437

PWS Version Number: 0.1

Contents

BACKGROUND

The Personnel Vetting and Credential Management (PVCM) contributes to a safe and secure environment for VA by ensuring trust in our VA workforce – appointees, employees, contractors, and affiliates through implementation, oversight, and compliance of Personnel Vetting and Trusted Workforce efforts, central coordination, and oversight of VA’s personnel investigations, enforcing VA compliance with Federal statutes, regulations, and policies. PVCM’s activities directly support VA’s top priorities. PVCM processes require modern transformational reform in line with today’s complex missions, societal norms, threat landscape, changing workforce, and evolving technology.

The PVCM Program within the office of Operations, Security and Preparedness (OSP) consists of the Personnel Vetting Program (PVP), and the Homeland Security Presidential Directive (12) (HSPD-12) Personal Identity Verification (PIV) Credential Management Program. PVCM supports and establishes the Department-wide personnel security and suitability program policy, implementation, compliance, oversight, and training to ensure sound vetting practices are in place to support the safety and security of our Nation’s Veterans, visitors, employees, and facilities. The PVCM Program establishes and enforces VA compliance with personnel security and suitability policies and ensures consistency and alignment with the implementation of Trusted Workforce 2.0. This contract will provide support for PVP.

The PVP supports VA’s human resource and security specialists with numerous PVP elements including policy, training, and program oversight, which instill confidence in the vetting steps in the hiring process. The PVP is implementing the National Training Standards for National Security and Suitability Adjudicators to track and deliver training for the PVP workforce nationwide. In addition, the PVP is in alignment and maintains consistency throughout the Department according to the Federal Investigative Standards for tiered background investigations. The PVP has proactively pursued communications with the field through monthly PVP calls and various other communications methods. The PVP continues to transform itself in order to provide the best possible service for our Nation’s Veterans, their families and VA employees.

PVP Functions and Activities

1. Develops and implements policies and processes that define VA Personnel Security and Vetting requirements for compliance with applicable statutes, Executive Orders, and Federal regulations for all VA employees, contractors, and affiliates.

2. Coordinates with other agencies and exchanges personnel security and vetting information with the Office of Personnel Management (OPM), Office of the Director of National Intelligence (ODNI), and other agencies.

3. Conducts training, oversight, and compliance of VA Administrations and staff offices that perform personnel security and vetting functions.

4. Serves as the mission/business owner for the VA Centralized Adjudication and Background Investigation System (VA–CABS), a secure, end-to-end IT system application enabling continuous subject evaluation and timely dissemination of, and access to, personnel security information from trusted information providers.

5. Processes and adjudicates background investigations for all high and moderate risk adjudications as well as national security positions for VA employees and contractors.

6. Develops plans, policies, processes, and VA implementation guidance for Federal personnel security modernization efforts, to include the implementation of Trusted Workforce 2.0.

7. Provides centralized compliance and oversight to all administrations’ personnel vetting programs.

8. Coordinates information import and export from the Department to other agencies regarding trust decisions.

This is a particularly innovative time as Federal efforts have ramped up significantly to bring efficiencies and automation to Federal background investigation processes and policies. The efforts to modernize Federal vetting practices are known as Trusted Workforce 2.0, and VA must keep pace with the Federal efforts in implementing the new polices and processes across the large VA workforce. The PVP policy, program management, oversight, governance, and technical support services being sought through this contract ensure that PVCM can maintain the level of support services required to address VA’s strategic priorities and implement, track, and oversee the agency’s Trusted Workforce initiatives.

APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. 44 U.S.C. § 3541-3549, “Federal Information Security Management Act (FISMA) of 2002”

2. “Federal Information Security Modernization Act of 2014”

3. Federal Information Processing Standards (FIPS) Publication 140-2, “Security Requirements for Cryptographic Modules”

4. FIPS Pub 199. “Standards for Security Categorization of Federal Information and Information Systems,” February 2004

5. FIPS Pub 200, “Minimum Security Requirements for Federal Information and Information Systems,” March 2006

6. FIPS Pub 201-2, “Personal Identity Verification of Federal Employees and Contractors,” August 2013

7. 10 U.S.C. § 2224, "Defense Information Assurance Program"

8. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

9. Public Law 109-461, Veterans Benefits, Health Care, and Information Technology Act of 2006, Title IX, Information Security Matters

10. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”

11. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, https://www.va.gov/vapubs/index.cfm

12. VA Handbook 0710, “Personnel Security and Suitability Program,” May 2, 2016, https://www.va.gov/vapubs/index.cfm

13. VA Directive and Handbook 6102, “Internet/Intranet Services,” August 5, 2019

14. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and Guidelines,” January 18, 2017

15. Office of Management and Budget (OMB) Circular A-130, “Managing Federal Information as a Strategic Resource,” July 28, 2016

16. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed Services (CHAMPUS)”

17. NIST SP 800-66 Rev. 1, “An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule,” October 2008

18. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended, January 18, 2017

19. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

20. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021

21. VA Handbook 6500, “Risk Management Framework for VA Information Systems VA Information Security Program,” February 24, 2021

22. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI),” March 12, 2019

23. VA Handbook 6500.5, “Incorporating Security and Privacy into the System Development Lifecycle,” March 22, 2010

24. VA Handbook 6500.6, “Contract Security,” March 12, 2010

25. VA Handbook 6500.8, “Information System Contingency Planning,” April 6, 2011

26. VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018

27. VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017

28. OIT Process Asset Library (PAL), https://www.va.gov/process/ . Reference Process Maps at https://www.va.gov/process/maps.asp and Artifact templates at https://www.va.gov/process/artifacts.asp

29. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

30. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014

31. VA Handbook 6508.1, “Procedures for Privacy Threshold Analysis and Privacy Impact Assessment,” July 30, 2015

32. VA Handbook 6510, “VA Identity and Access Management,” January 15, 2016

33. VA Directive and Handbook 6513, “Secure External Connections,” October 12, 2017

34. VA Directive 6300, “Records and Information Management,” September 21, 2018

35. VA Handbook, 6300.1, “Records Management Procedures,“ March 24, 2010

36. NIST SP 800-37 Rev 2, “Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy,” December 2018

37. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020)

38. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015

39. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” March 24, 2014

40. OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005

41. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019

42. OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008

43. Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance, December 2, 2011, (NOTE: Part A of the FICAM Roadmap and Implementation Guidance, v2.0, was replaced in 2015 with an updated Architecture (https://arch.idmanagement.gov/#what-is-the-ficam-architecture)

44. NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access,“ June 2018

45. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, “Digital Identity Guidelines,” updated March 02, 2020

46. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014

47. NIST SP 800-164, “Guidelines on Hardware-Rooted Security in Mobile Devices (Draft),” October 2012

48. Draft National Institute of Standards and Technology Interagency Report (NISTIR) 7981, “Mobile, PIV, and Authentication,” March 2014

49. VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

50. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

51. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

52. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

53. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019

54. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008

55. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (Public Law 110–140), December 19, 2007

56. Section 104 of the Energy Policy Act of 2005, (Public Law 109–58), August 8, 2005

57. Executive Order 13834, “Efficient Federal Operations,” dated May 17, 2018

58. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 2, 2001

59. VA Directive 0058, “VA Green Purchasing Program,” July 19, 2013

60. VA Handbook 0058, “VA Green Purchasing Program,” July 19, 2013

61. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

62. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

63. “Veteran Focused Integration Process (VIP) Guide 4.0,” January 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

64. VA Memorandum “Proper Use of Email and Other Messaging Services,” January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

65. “DevSecOps Product Line Management Playbook” version 2.0, May 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

66. NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020

67. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol Version 6 (IPv6),” November 19, 2020

68. Social Security Number (SSN) Fraud Prevention Act of 2017

69. Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23, 2018

70. Office of Management and Budget (OMB) Memorandum M-19-17, May 21, 2019, (MEMORANDUM FOR HEADS OF EXECUTIVE DEPARTMENTS AND AGENCIES (whitehouse.gov))

71. Office of Personnel Management's (OPM) Federal Investigations Notices (https://www.dcsa.mil/mc/pv/gov_hr_security/notices_PSP/)

72. Executive Order 13467, as amended in 29 September 2016 and in 1/23/2017 by EO13764. Reforming Processes Related to Suitability for Government Employment, Fitness for Contractor Employees, and Eligibility for Access to Classified National Security Information

73. Executive Order 13488, as amended in 1/23/2017 by EO13764., Granting Reciprocity on Excepted Service and Federal Contractor Employee Fitness and Reinvestigating Individuals in Positions of Public Trust

SCOPE OF WORK

The Contractor shall provide support services for a broad range of tasks in support of the PVP mission to include support for personnel vetting program/project management, governance, policy development and issuance, compliance oversight, strategic analysis, training support, and expert level technical support to the PVP Directors. The Contractor shall support PVP’s programs, projects and initiatives.

PERFORMANCE DETAILS

PERFORMANCE PERIOD

The period of performance (PoP) shall be one (1) 12-month base period with four (4) 12-month option periods. This contract also contains three (3) optional tasks that may be exercised at any time in the base and/or option periods for a period of no greater than 12-months each and that shall be coterminous with the current base or option period of performance it is exercised within. This contract also contains one 60-day optional task for Task-Transition Planning for PVP that may be exercised one time, at any time, during the period of performance. The period of performance of this Task Order shall not exceed 60 months.

Any work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO).

There are eleven (11) Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, four are set by date:

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

PLACE OF PERFORMANCE

Tasks under this PWS shall be performed at Contractor facilities and/or at remote locations. However, on-site performance at VA Central Office (VACO), 810 Vermont Ave, Washington, DC is typically requested one day a week.

TRAVEL

There is no anticipated travel for this effort.

SPECIFIC TASKS AND DELIVERABLES

The Contractor shall perform the following:

PROJECT MANAGEMENT

CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, timeline, and tools to be used in execution of the contract effort for PVP support. The CPMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks, and resource support. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPMP shall be concurred upon and updated in accordance with Section B of the contract. The Contractor shall update and maintain the VA Program Manager (PM) approved CPMP throughout the PoP. The VA Program Managers for the contract are the Director and Deputy Director of the PVP Office.

Deliverables:

A. Contractor Project Management Plan

WEEKLY STATUS REPORT

The Contractor shall submit a Weekly Status Report (WSR) outlining the action items, progress, status, and any problems/issues encountered in the performance of this task. The WSR shall cover all work completed during the reporting period and work planned for the subsequent reporting period.

The report shall also identify any problems that arose and a description of how the problems were resolved. If problems have not been completely resolved, the Contractor shall provide an explanation including the plan and timeframe for resolving the issue. It is expected that the Contractor will keep in communication with the PVP Director and Deputy so that as issues arise, they are articulated to all the respective parties to prevent escalation of outstanding issues.

The Contractor shall provide PVP Associated Briefings expanding upon topics discussed in the WSR, including reports and slide presentations, as required to support VA OSP initiatives.

Deliverable:

A. Weekly Status Report and Associated Briefing

PRIVACY TRAINING

The Contractor shall submit status of VA Privacy and Information Security Awareness training for all Contractor personnel engaged on the task. The CPMP shall identify a single Contractor Security point of contact, the names of all personnel engaged on the task, their initial training date for VA Privacy and Information Security training, and their next required training date.

The Contractor shall submit VA Privacy and Information Security Training Certificates in accordance with Section 9, Training, from Appendix C of the VA Handbook 6500.6, “Contract Security”.

Deliverable:

A. VA Privacy and Information Security Training Certificates

KICKOFF MEETING

A kickoff meeting shall be held within 10 days after contract award. The Contractor shall coordinate the date, time, and location (can be virtual) with the CO, as the Post-Award Conference Chairperson, the VA PM, as the Co-Chairperson, the Contract Specialist (CS), and the COR. The Contractor shall provide a draft agenda to the CO and VA PM at least five (5) calendar days prior to the meeting. Upon Government approval of a final agenda, the Contractor shall distribute to all meeting attendees. During the kickoff-meeting, the Contractor shall present, for review and approval by the Government, the details of the intended approach, work plan, and project schedule for each effort via a Microsoft Office PowerPoint presentation.

At the conclusion of the meeting, the Contractor shall update the presentation with a final slide entitled “Summary Report” which shall include notes on any major issues, agreements, or disagreements discussed during the kickoff meeting and the following statement “As the Post-Award Conference Chairperson, I have reviewed the entirety of this presentation and assert that it is an accurate representation and summary of the discussions held during the Kickoff Meeting for the PVP Support effort.”

The Contractor shall submit the final updated presentation to the CO for review and signature within three (3) calendar days after the meeting. The Contractor shall also work with the CS, the Government’s designated note taker, to prepare and distribute the meeting minutes of the kickoff meeting to the CO, COR, the VA Program Manager and all attendees within three (3) calendar days after the meeting. The Contractor shall obtain concurrence from the CS on the content of the meeting minutes prior to distribution of the document.

VA PVP STRATEGIC PLANNING, PROGRAM MANAGEMENT, POLICY, AND PVP MODERNIZATION SUPPORT The Contractor shall:

1. Maintain the VA Trusted Workforce Strategic Plan for the Federal Government’s initiative to modernize and enhance automation of personnel security and suitability vetting processes known as TW 2.0, which includes technology solutions, metric reports, program health determinations and strategic roadmaps. The Plan shall be updated to include all VA enterprise-wide Trusted Workforce requirements, all VA Trusted Workforce projects and initiatives, performance measures, issues, and challenges as they occur. While the Plan shall be maintained daily, the Contractor shall also submit a formal update on a quarterly basis.

2. Develop methodologies for tracking and assessing the development, evaluation, and monitoring of program goals, objectives, and plans. This includes support for the established governance processes and meetings that serve to assist PVP in managing decisions and tracking changes.

3. Provide subject matter expertise regarding PVP policies and processes to ensure there is technical soundness and quality of the VA PVP plans, policies, and processes, including providing technical support and recommendations to the PVP Director.

4. Develop and deliver a Data Management Plan for the management, tracking, and reporting of TW 2.0 performance management standards. The DMP shall document and define TW 2.0 performance management standards received by the PVP office, the systems in which the necessary data resides and frequency/schedule that data will be pulled, any changes to performance metrics/standards, and performance risks to the overall PVP. Upon Government approval, the Contractor shall implement the Plan to provide data tracking and reporting to support PVP with measuring/grading VA’s performance against the required standards. The Contractor shall update the Plan, as necessary but at least once a year, when federal and/or department policies and regulations change. The Contractor shall provide data input and administrative support to assist PVP in developing annual executive briefings regarding PVP performance heath.

5. Update the VA Personnel Security and Suitability Program Compliance Plan quarterly, which contains the actions that VA will pursue to ensure all VA employees, contractors, and staff have been properly vetted in compliance with Federal vetting requirements and standards. The Compliance Plan also includes plans and actions for the VA PVP office to conduct in person (or virtual) inspections or compliance reviews of VA local site compliance with Federal and VA PVP policies, guidelines, and standards.

6. Provide support to PVP for the development of plans of actions and milestones to help remediate VA’s Office of Inspector General (OIG) findings around identity, credentialing, and access management, and also for the OIG findings and weaknesses identified in FISMA audits of the VA PVP. The Contractor shall provide technical expertise and recommendations to assist PVP remediate the weaknesses in identity and access management security controls identified by the OIG in their annual FISMA reports by focusing on appropriate implementation of security and privacy controls in VA’s IT systems as required by the NIST Risk Management Framework and VA’s Cybersecurity and Privacy Policy guidance (VA 6500 Directive and Handbook). In addition, the Contractor shall develop briefing slides that report monthly and quarterly status of the plans of actions and milestones to remediate the OIG identified security weaknesses.

7. Review the annual OIG FISMA audits which typically results in up to three findings and recommendations for personnel security and suitability. The Contractor shall assist VA in monitoring and reporting remediation progress as well as support the development of new/revised policies, plans, and procedures to mitigate potential findings in future audits and reviews.

8. Provide technical and administrative support for annual updates and be responsible for administrative editing to the Directive and Handbook for PVP (VA Directive and Handbook 0710) along with policy advisories distributed between VA directive and handbook publications.

9. Coordinate with business stakeholders, inter-agency, intra-agency, and other outside partners to identify, articulate, assess, plan, document and support modifications and changes to VA’s Trusted Workforce initiatives.

10. Schedule meetings, prepare briefings, agendas and meeting minutes for PVP working groups, leadership status meetings, ad-hoc meetings, and integrated project teams. There will be an average of 10-15 meetings per week.

11. Provide day to day support to assist the PVP staff in routine program activities such as follow-up phone calls, sending emails, and supporting internal discussions focused on PVP requirements and issues.

12. Support PVP-related budgeting and cost estimation and monitor metrics, goals, risks, and associated plans for Trusted Workforce to assist with future planning. The Contractor shall summarize the activities and progress within the Trusted Workforce Cost Estimate Report due quarterly.

13. Provide technical support to include the development of Action Plans, Technical White Papers and/or Presentation/Briefing Materials to support different VA enterprise meetings such as the Enterprise Cyber Security Program (ECSP) meetings, Data Governance Council (DGC), quarterly metrics HR Professionals Meeting, Trusted Workforce briefing to the Senior Implementation Official, Material Weakness Working Group Meeting, Notices of Findings and Recommendations (NFR) 2 FISMA Working Group meeting, and Trusted Workforce 2.0 meetings conducted by the Defense Counterintelligence Security Agency (DCSA) and by OPM. The Contractor shall also participate and provide subject matter expertise during these meetings.

14. Utilize historical and current industry knowledge, OIG reports, and other compliance audits and findings to determine gaps in the as-is business processes and recommend solutions to close the gaps. The Contractor shall conduct current state/business need assessments, perform gap analysis, and develop Business Requirement Documents (BRD), when necessary. The BRD shall include, but is not limited to, writing functional requirements, use cases, scenarios, and other supporting material to communicate effective descriptions of the necessary changes for existing programs such as VA-CABS, ICAMP, and other PVP tracking systems to meet stakeholders’ needs. Typically, one (1) BRD is needed per year.

Deliverables:

A. VA Trusted Workforce Strategic Plan Updates B. Data Management Plan C. VA Personnel Security and Suitability Program Compliance Plan Updates D. Action Plans, Technical White Papers, and/or Presentation/Briefing Materials E. Business Requirements Document F. Trusted Workforce Cost Estimate Report

PVP GOVERNANCE AND COMPLIANCE SUPPORT

The Contractor shall provide governance and compliance support for PVP and shall perform the following tasks:

1. Develop materials to support PVP in performing governance, oversight, and compliance of PVP activities. The support shall include development and maintenance of field office program performance metrics, compliance checklists, guides, job aides, and station compliance reports. Documentation generally utilizes Microsoft products, and it is anticipated that approximately four (4) documents will be required per month.

2. Provide PVP help desk support consisting of policy and process clarification, reconciliation on delinquent reports, and investigative reports; and for Government staff conducting PVP compliance reviews. IT specific tickets are typically handled by OIT helpdesk support and not within scope of this contract. Specifically, the Contractor shall:

a. Provide help desk support during normal business hours of 8 a.m. to 4 p.m. EST.

b. Acknowledging receipt of PVP-specific tickets and/or emails and other inquiries via Microsoft Teams, in-person meetings, phone calls; forward to appropriate staff office; review and coordinate resolution and response to tickets within 48 hours of receipt. If the ticket is associated with a PVP-managed IT system, the Contractor shall facilitate resolution by ensuring the appropriate staff offices are involved in the resolution.

c. Create and maintain a repository of Frequently Asked Questions (FAQs) from responses sent from the help desk for use and posting to VA Share Point site or similar site.

d. Maintain monthly customer service metrics on number of emails received by topic including trend analyses for inclusion in the Weekly Status Report (WSR) (refer to PWS section 5.1.2).

e. Respond to a minimum of 250 inquires per month.

3. Provide support to manage compliance and oversight meetings, to include distribution lists, tasks, assignments and evidence. Coordinate the scheduling and management of meetings with the field offices. Compile supporting documentation for the meetings, including compliance checklists, evidence, and briefing slides for input from compliance and oversight team to add findings.

Collect and report on employee and contractor background investigation status through the Agency’s system of record of VA-CABS. The Contractor shall provide a Background Investigation Status and Population Data Analysis Report on a quarterly basis which includes the locations that need current reviews and locations that may have best practices. The Contractor shall also provide a Quarterly Adjudication Delinquent Briefing which summarizes the number of delinquent adjudications for the prior four quarters, a trend analysis, and recommendations for improvements, if necessary.

4. Export data weekly from VA-CABS to Information Central Analytics and Metrics Platform (ICAMP) and coordinate with the ICAMP team to create technical reports to support PVP auditing and reporting needs.

5. Compile and analyze data regarding PVP program health, reform and special interest from multiple systems including VA-CABS, USAStaffing, USAccess, HR Smart, and APDS to create reports and dashboards (within PowerBI and Salesforce) to enable analysis by auditing personnel, executive leadership and responsible program directors. The Contractor shall be responsible for the costs associated with any additional software used for data analysis purposes.

6. Develop and deliver communications documentation for PVP-related guidance using emerging and existing tools (e.g. SharePoint FAQs, mailboxes, and newsletters). Create, publish, and distribute all PVP business areas’ related communications publications such as brochures (approximately one (1) quarterly), videos (approximately one (1) quarterly), and newsletters (approximately one (1) monthly) delivered in electronic media to validate consistent messaging to VA stakeholders. Communication documentation shall also include assisting with the development and distribution of VA All-Employee e-mail blasts relating to PVP topics, system issues, and/or outages, as necessary. Ensure all documentation is 508 compliant prior to finalization, distribution, and storage.

7. Manage, update and store artifacts produced on behalf of PVP in the appropriate SharePoint repositories. The Contractor shall manage the maintenance and user privileges for the PVP SharePoint sites. The Contractor shall ensure that SharePoint repositories are the main location where all documentation related to PVP activities is stored and kept up to date.

Deliverables:

A. Employee and Contractor Background Investigation Status and Population Data Analysis Report B. Quarterly Adjudication Delinquent Briefing C. Compliance and Oversight Reports D. PVP Newsletters, Training documents and Videos E. SharePoint Releases

TRAINING SERVICES FOR PVP (OPTIONAL TASK 1)

If this Optional Task is exercised by VA, the Contractor shall provide training support for PVP. Training support includes but is not limited to in-person (limited to VACO) and/or virtual trainings, coordinating training sessions, development and modification of training materials, and scheduling activities. The Contractor shall have the capability to perform, for PVP, multiple virtual training demonstrations simultaneously, provided to multiple separate geographic locations. The number of attendees varies but averages approximately 100 to 600 participants. The Contractor shall coordinate closely with technical teams, as well as VA stakeholders, to understand gaps in current training offerings, requirements to create user specific or administrative training materials, and support development of scenarios to demonstrate the latest system capabilities for training purposes.

The Contractor shall provide the subject matter expertise during training to answer questions about regulations, onboarding systems (VA-CABS, APDS, USA Staffing, USAccess) and VA policies and implement of Federal policies. For PVP, the Contractor shall:

1. Develop and update training materials:

a. Develop Training Packages for the various role holders such as system administrators and end users (to also include staff) that includes user guides and Talent Management System (TMS) training modules. These training materials will be used by VA stakeholders and the end users for the effective use of PVP business area solutions, including current and near future efforts such as on/off boarding services, VA-CABS, NBIS, eAPP, ICAMP, and new annual training requirements for Trusted Workforce. The Training Packages shall include all reference materials, including job aids, user guides, and standard operating procedures (SOPs) for the performance of PVP business areas as needed

b. Provide support for training requirements to include development of slides to train users of VA’s onboarding suite of services. VA anticipates up to three (3) training packages annually.

c. Track metrics for completion and delinquencies in TMS to monitor department-wide implementation of new training requirements (e.g. Trusted Workforce).

2. Perform training via on-line audio/video conferencing. There are approximately 12 training events per year, one per month. Each session is approximately one (1) hour in duration.

3. Provide Training Session Reports to include dates/time of training sessions, lists of attendees and times attended.

Deliverables:

A. PVP Training Packages B. PVP Training Session Reports

TASK-TRANSITION PLANNING FOR PVP (OPTIONAL TASK 2)

If this Optional Task is exercised by VA, the Contractor shall develop and deliver a Phase-Out Transition Plan. All transition actions shall be completed prior to the task order expiration date. This optional task may be exercised by the Government at any time, during the base or option period and shall have a period of performance of 60 days. The Contractor shall address the following areas in its Transition Plan:

1. Inventory, review, evaluation and transition of VA-furnished information and other GFE items, (if any).

2. Inventory and transition of historical data (e.g., memos, letters, correspondence, regulations, briefings, reports, documents, transition agreement documents, memorandums of agreement/ understanding, and inter- service agreements).

3. Editable versions of all informational materials and products, including training materials developed.

4. Data and workflow processes.

5. Scheduling processes.

6. Any templates used in day-to-day operations.

7. An orientation phase to introduce the Contractor personnel, programs, and users to the incoming team, explaining tools, methodologies, and business processes.

8. Procedures to introduce VA personnel, programs, and users to the Contractor's team, tools, methodologies, and business processes.

9. The Contractor strategy regarding personnel staffing and training during the transition period.

10. Process for transfer of existing on-hand inventory.

11. Transition checklist.

12. Signed turnover agreements.

13. Monthly Deliverable Matrix.

Deliverable:

A. Transition Plan

GENERAL REQUIREMENTS

ENTERPRISE AND IT FRAMEWORK

VA TECHNICAL REFERENCE MODEL

The Contractor shall support the VA enterprise management framework. In association with the framework, the Contractor shall comply with OIT Technical Reference Model (VA TRM). The VA TRM is one component within the overall Enterprise Architecture (EA) that establishes a common vocabulary and structure for describing the information technology used to develop, operate, and maintain enterprise applications. Moreover, the VA TRM, which includes the Standards Profile and Product List, serves as a technology roadmap and tool for supporting OIT. Architecture & Engineering Services (AES) has overall responsibility for the VA TRM.

FEDERAL IDENTITY, CREDENTIAL, AND ACCESS MANAGEMENT (FICAM)

The Contractor shall ensure Commercial Off-The-Shelf (COTS) product(s), software configuration and customization, and/or new software are Personal Identity Verification (PIV) card-enabled by accepting HSPD-12 PIV credentials using VA Enterprise Technical Architecture (ETA), https://www.ea.oit.va.gov/EAOIT/VA_EA/Enterprise_Technical_Architecture.asp, and VA Identity and Access Management (IAM) approved enterprise design and integration patterns, https://www.oit.va.gov/library/recurring/edp/index.cfm. The Contractor shall ensure all Contractor delivered applications and systems comply with the VA Identity, Credential, and Access Management policies and guidelines set forth in VA Handbook 6510 VA Identity and Access Management, VA Handbook 0735 Homeland Security Presidential Directive 12 (HSPD-12) Program, and align with the Federal Identity, Credential, and Access Management Roadmap and Implementation Guidance v2.0.

The Contractor shall ensure all Contractor delivered applications and systems provide user authentication services compliant with the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-63-3, VA Handbook 6500 Appendix F, “VA System Security Controls”, and VA IAM enterprise requirements for direct, assertion based authentication, and/or trust based authentication, as determined by the design and integration patterns. Direct authentication at a minimum must include Public Key Infrastructure (PKI) based authentication supportive of PIV card and/or Common Access Card (CAC), as determined by the business need.

The Contractor shall ensure all Contractor delivered applications and systems conform to the specific Identity and Access Management PIV requirements set forth in the Office of Management and Budget (OMB) Memoranda M-05-24, M-19-17, and NIST Federal Information Processing Standard (FIPS) 201-2. OMB Memoranda M-05-24 and M-19-17 can be found at: https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2005/m05-24.pdf, and https://www.whitehouse.gov/wp-content/uploads/2019/05/M-19-17.pdf respectively. Contractor delivered applications and systems shall be on the FIPS 201-2 Approved Product List (APL). If the Contractor delivered application and system is not on the APL, the Contractor shall be responsible for taking the application and system through the FIPS 201 Evaluation Program.

The Contractor shall ensure all Contractor delivered applications and systems support:

1. Automated provisioning and are able to use enterprise provisioning service.

2. Interfacing with VA’s Master Person Index (MPI) to provision identity attributes, if the solution relies on VA user identities. MPI is the authoritative source for VA user identity data.

3. The VA defined unique identity (Secure Identifier [SEC ID] / Integrated Control Number [ICN]).

4. Multiple authenticators for a given identity and authenticators at every Authenticator Assurance Level (AAL) appropriate for the solution.

5. Identity proofing for each Identity Assurance Level (IAL) appropriate for the solution.

6. Federation for each Federation Assurance Level (FAL) appropriate for the solution, if applicable.

7. Two-factor authentication (2FA) through an applicable design pattern as outlined in VA Enterprise Design Patterns.

8. A Security Assertion Markup Language (SAML) implementation if the solution relies on assertion-based authentication. Additional assertion implementations, besides the required SAML assertion, may be provided as long as they are compliant with NIST SP 800-63-3 guidelines.

9. Authentication/account binding based on trusted Hypertext Transfer Protocol (HTTP) headers if the solution relies on Trust based authentication.

10. Role Based Access Control.

11. Auditing and reporting capabilities.

12. Compliance with VIEWS 00155984, PIV Logical Access Policy Clarification https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896.

The required Assurance Levels for this specific effort are Identity Assurance Level 3, Authenticator Assurance Level 3, and Federation Assurance Level 3.

INTERNET PROTOCOL VERSION 6 (IPV6)

The Contractor solution shall support Internet Protocol Version 6 (IPv6) based upon the memo issued by the Office of Management and Budget (OMB) on November 19, 2020 (https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-07.pdf). IPv6 technology, in accordance with the USGv6 Program (https://www.nist.gov/programs-projects/usgv6-program/usgv6-revision-1), NIST Special Publication (SP) 500-267B Revision 1 “USGv6 Profile” (https://doi.org/10.6028/NIST.SP.500-267Br1), and NIST SP 800-119 “Guidelines for the Secure Deployment of IPv6” (https://doi.org/10.6028/NIST.SP.800-119), compliance shall be included in all IT infrastructures, application designs, application development, operational systems and sub-systems, and their integration. In addition to the above requirements, all devices shall support native IPv6 and dual stack (IPv6 / IPv4) connectivity without additional memory or other resources being provided by the Government, so that they can function in a mixed environment. All public/external facing servers and services (e.g. web, email, DNS, ISP services, etc.) shall support native IPv6 and dual stack (IPv6 / IPv4) users and all internal infrastructure and applications shall communicate using native IPv6 and dual stack (IPv6 / IPv4) operations.

TRUSTED INTERNET CONNECTION (TIC)

The Contractor solution shall meet the requirements outlined in Office of Management and Budget Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative“ (https://www.whitehouse.gov/wp-content/uploads/2019/09/M-19-26.pdf), VA Directive 6513 “Secure External Connections”, and shall comply with the TIC 3.0 Core Guidance Documents, including all Volumes and TIC Use Cases, found at the Cybersecurity & Infrastructure Security Agency (CISA) (https://www.cisa.gov/publication/tic-30-core-guidance-documents). Any deviations must be approved by the VA TIC 3.0 Working Group at vaoisesatic30team@va.gov.

STANDARD COMPUTER CONFIGURATION

The Contractor IT end user solution that is developed for use on standard VA computers shall be compatible with and be supported on the standard VA operating system, currently Windows 10 (64bit), Edge (Chromium based), and 365 Apps for enterprise. Applications delivered to VA and intended to be deployed to Windows 10 workstations shall be delivered as a signed .msi package with switches for silent and unattended installation and updates shall be delivered in signed .msp file formats for easy deployment using Microsoft Endpoint Configuration Manager (CM) VA’s current desktop application deployment tool. Signing of the software code shall be through a vendor provided certificate that is trusted by VA using a code signing authority such as Verizon/Cybertrust or Symantec/VeriSign. The Contractor shall also ensure and certify that their solution functions as expected when used from a standard VA computer, with non-admin, standard user rights that have been configured using the United States Government Configuration Baseline (USGCB) and Defense Information Systems Agency (DISA) Secure Technical Implementation Guide (STIG) specific to the particular client operating system being used.

VETERAN FOCUSED INTEGRATION PROCESS (VIP) AND PRODUCT LINE MANAGEMENT (PLM)

The Contractor shall support VA efforts IAW the updated Veteran Focused Integration Process (VIP) and Product Line Management (PLM). The major focus of the new VIP is on Governance and Reporting and is less prescriptive, with a focus on outcomes and continuous delivery of value. Product Line Management (PLM) is a framework that focuses on delivering functional products that provide the highest priority work to customers while delivering simplified, reliable, and practical solutions to the business, medical staff, and our Veterans. The VIP Guide is a companion guide to the PLM Playbook and can be found at: https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371 and the PLM Playbook can be found at https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946. The PLM Playbook pivots from project-centric to product-centric delivery and contains descriptive practices that focuses on outcomes. The PLM Playbook contains a set of “plays” that implement Development, Security, and Operations (DevSecOps) principles and processes such as automated development, continuous integration/continuous delivery, and release on demand. The PLM Playbook details how product lines implement Lean-Agile principles, methods, practices, and techniques through levels of maturity. VIP and PLM are the authoritative processes that IT projects must follow to ensure development and delivery of IT products.

PROCESS ASSET LIBRARY (PAL)

The Contractor shall perform their duties consistent with the processes defined in the OIT Process Asset Library (PAL). The PAL scope includes the full spectrum of OIT functions and activities, such as VIP project management, operations, service delivery, communications, acquisition, and resource management. PAL serves as an authoritative and informative repository of searchable processes, activities or tasks, roles, artifacts, tools and applicable standards and guides to assist the OIT workforce, Government and Contractor personnel. The Contractor shall follow the PAL processes to ensure compliance with policies and regulations and to meet VA quality standards. The PAL includes the contractor onboarding process consistent with Section 6.2.2 and can be found at https://www.va.gov/PROCESS/artifacts/maps/process_CONB_ext.pdf. The main PAL can be accessed at www.va.gov/process.

AUTHORITATIVE DATA SOURCES

The VA Enterprise Architecture Repository (VEAR) is one component within the overall EA that establishes the common framework for data taxonomy for describing the data architecture used to develop, operate, and maintain enterprise applications. The Contractor shall comply with the department’s Authoritative Data Source (ADS) requirement that VA systems, services, and processes throughout the enterprise shall access VA data solely through official VA ADSs where applicable, see below. The Information Classes which compose each ADS are located in the VEAR, in the Data & Information domain. The Contractor shall ensure that all delivered applications and system solutions support:

1. Interfacing with VA’s Master Person Index (MPI) (formerly the Master Veteran Index (MVI)) to provision identity attributes, if the solution relies on VA user identities. MPI is the authoritative source for VA user identity data.

2. Interfacing with Capital Asset Inventory (CAI) to conduct real property record management actions, if the solution relies on real property records data. CAI is the authoritative source for VA real property record management data.

3. Interfacing with electronic Contract Management System (eCMS) for access to contract, contract line item, purchase requisition, offering vendor and vendor, and solicitation information above the micro-purchase threshold, if the solution relies on procurement data. ECMS is the authoritative source for VA procurement actions data.

4. Interfacing with HRSmart Human Resources Information System to conduct personnel action processing, on-boarding, benefits management, and compensation management, if the solution relies on personnel data. HRSmart is the authoritative source for VA personnel information data.

5. Interfacing with Vet360 to access personal contact information, if the solution relies on VA Veteran personal contact information data. Vet360 is the authoritative source for VA Veteran Personal Contact Data.

6. Interfacing with VA/Department of Defense (DoD) Identity…