DRAFT_PWS_RTLS VISN 16.pdf

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

South Central VA Health Care Network (VISN 16) Real Time Location System (RTLS) Asset Tracking (AT) Sustainment

Date: November 20, 2024

VA-25-00016405

PWS Version Number: 1.1

VISN 16 RTLS Asset Tracking Sustainment Services

Contents

1.0 BACKGROUND

2.0 APPLICABLE DOCUMENTS

3.0 SCOPE OF WORK

4.0 PERFORMANCE DETAILS

4.1 PERFORMANCE PERIOD

4.2 PLACE OF PERFORMANCE

4.3 TRAVEL

5.0 SPECIFIC TASKS AND DELIVERABLES

5.1 PROJECT MANAGEMENT

5.1.1 CONTRACTOR PROJECT MANAGEMENT PLAN

5.1.2 REPORTING REQUIREMENTS

5.1.3 TECHNICAL KICKOFF MEETING

5.2 BATTERY MANAGEMENT

5.3 CENTRAK MAINTENANCE SUPPORT

5.4 INFOR LBI MAINTENANCE SUPPORT

5.5 SERVER MAINTENANCE AND ADMINISTRATION

5.5.1 PREVENTIVE MAINTENANCE

5.5.2 RTLS SOFTWARE UPDATES, UPGRADES AND ADMINISTRATION

5.5.3 SOFTWARE LICENSE INSTALLATION

5.5.4 CORRECTIVE MAINTENANCE

5.5.5 RTLS HELP DESK

5.6 TRANSITION PERIOD – OPTIONAL TASK

6.0 GENERAL REQUIREMENTS

6.1 ENTERPRISE AND IT FRAMEWORK

6.1.1 VA TECHNICAL REFERENCE MODEL

6.1.2 FEDERAL IDENTITY, CREDENTIAL, AND ACCESS MANAGEMENT

(FICAM)

6.1.3 INTERNET PROTOCOL VERSION 6 (IPV6)

6.1.4 TRUSTED INTERNET CONNECTION (TIC)

6.1.5 STANDARD COMPUTER CONFIGURATION

6.1.6 VETERAN FOCUSED INTEGRATION PROCESS (VIP) AND PRODUCT

LINE MANAGEMENT (PLM)

6.1.7 PROCESS ASSET LIBRARY (PAL)

6.1.8 AUTHORITATIVE DATA SOURCES

6.1.9 SOCIAL SECURITY NUMBER (SSN) REDUCTION

6.2 SECURITY AND PRIVACY REQUIREMENTS

6.2.1 POSITION/TASK RISK DESIGNATION LEVEL(S)

6.2.2 CONTRACTOR PERSONNEL SECURITY REQUIREMENTS

6.3 METHOD AND DISTRIBUTION OF DELIVERABLES

6.4 PERFORMANCE METRICS

6.5 FACILITY/RESOURCE PROVISIONS

6.6 GOVERNMENT FURNISHED PROPERTY

6.7 SHIPMENT OF HARDWARE OR EQUIPMENT

ADDENDUM A – ADDITIONAL VA REQUIREMENTS, CONSOLIDATED

ADDENDUM B – VA INFORMATION AND INFORMATION SYSTEM

SECURITY/PRIVACY LANGUAGE

Email:

1.0 BACKGROUND

Real Time Location System (RTLS) Asset Tracking (AT) capability is currently provided by CenTrak RTLS Technology and Infor Location Based Intelligence (LBI) middleware in the VA Medical Centers. Both are supplemented via the Infor LBI Asset Management Business Intelligent (BI) Solution. RTLS technology combines a variety of signaling and wireless communication methods to determine the location of tagged assets. Knowing the location of tagged assets can be used to speed up annual inventory, locate equipment, reduce theft/loss, track patients and track staff to improve workflow.

Active RTLS technology uses tags that transmit a Radio Frequency ID (RFID) through Wi-Fi at a regular interval. The same tags may also listen for, and report the receipt of, other signaling technologies like infrared or low frequency (LF) emitters. These technologies are designed for room level accuracy. VISN 16’s AT solution uses Active Tags only. AT is one of three RTLS business use cases deployed by VA, and one of eight that VA has identified. VISN 16 facilities are currently operating AT, AT data is collected and transferred from the CenTrak system to the Infor LBI. Infor LBI, is a RTLS specific Business Intelligent platform that leverages location-based data to provide users with the following information:

• A real-time GUI display of location status for individual assets

• A set of statistically based reports and dashboards that present the state of the RTLS inventory, as well as the employment of individual assets.

RTLS users may access and use individual application functionality directly from CenTrak or from Infor LBI. The Infor LBI implementation is interfaced to IBM’s Maximo Asset Management solution. IBM Maximo Asset Management is an asset management life cycle and workflow management application. Currently, MuleSoft Enterprise Service Bus (ESB) is deployed as part of the interface solution to Maximo.

See Section 4.2 for the list of specific VISN 19 sites that are in scope for this PWS requirement. New Orleans is still under warranty during the base year, therefore not included in the base year, however wthis site location will be included in the option years.

2.0 APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. 44 U.S.C. § 3541-3549, “Federal Information Security Management Act (FISMA) of 2002”

2. “Federal Information Security Modernization Act of 2014”

3. Federal Information Processing Standards (FIPS) Publication 140-2, “Security Requirements for Cryptographic Modules”

4. FIPS Pub 199. “Standards for Security Categorization of Federal Information and Information Systems,” February 2004

5. FIPS Pub 200, “Minimum Security Requirements for Federal Information and Information Systems,” March 2006

6. FIPS Pub 201-2, “Personal Identity Verification of Federal Employees and Contractors,” August 2013

7. 10 U.S.C. § 2224, "Defense Information Assurance Program"

8. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

9. Public Law 109-461, Veterans Benefits, Health Care, and Information

Technology Act of 2006, Title IX, Information Security Matters

10. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”

11. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, https://www.va.gov/vapubs/index.cfm

12. VA Handbook 0710, “Personnel Security and Suitability Program,” May 2, 2016, https://www.va.gov/vapubs/index.cfm

13. VA Directive and Handbook 6102, “Internet/Intranet Services,” August 5,

14. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and Guidelines,” January 18, 2017

15. Office of Management and Budget (OMB) Circular A-130, “Managing Federal

Information as a Strategic Resource,” July 28, 2016

16. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed

Services (CHAMPUS)”

17. NIST SP 800-66 Rev. 1, “An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule,” October 2008

18. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended, January 18, 2017

19. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

20. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021

21. VA Handbook 6500, “Risk Management Framework for VA Information

Systems VA Information Security Program,” February 24, 2021

22. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI),” March 12, 2019

23. VA Handbook 6500.5, “Incorporating Security and Privacy into the System Development Lifecycle,” March 22, 2010

24. VA Handbook 6500.6, “Contract Security,” March 12, 2010

25. VA Handbook 6500.8, “Information System Contingency Planning,” April 6,

26. VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018

27. VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017

28. OIT Process Asset Library (PAL), https://www.va.gov/process/ . Reference

Process Maps at https://www.va.gov/process/maps.asp and Artifact templates at https://www.va.gov/process/artifacts.asp

29. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx) https://www.va.gov/vapubs/index.cfm https://www.va.gov/vapubs/index.cfm http://www.va.gov/vapubs http://www.va.gov/vapubs https://www.va.gov/process/ https://www.va.gov/process/maps.asp https://www.va.gov/process/artifacts.asp https://www.va.gov/trm/TRMHomePage.aspx

30. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014

31. VA Handbook 6508.1, “Procedures for Privacy Threshold Analysis and Privacy Impact Assessment,” July 30, 2015

32. VA Handbook 6510, “VA Identity and Access Management,” January 15,

33. VA Directive and Handbook 6513, “Secure External Connections,” October 12, 2017

34. VA Directive 6300, “Records and Information Management,” September 21,

35. VA Handbook, 6300.1, “Records Management Procedures,“ March 24, 2010

36. NIST SP 800-37 Rev 2, “Risk Management Framework for Information

Systems and Organizations: A System Life Cycle Approach for Security and Privacy,” December 2018

37. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020)

38. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015

39. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-

12) Program,” March 24, 2014

40. OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005

41. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019

42. OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008

43. Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance, December 2, 2011, (NOTE: Part A of the FICAM Roadmap and Implementation Guidance, v2.0, was replaced in 2015 with an updated Architecture (https://arch.idmanagement.gov/#what-is-the-ficam-architecture)

44. NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access,“ June 2018

45. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, “Digital Identity Guidelines,” updated March 02, 2020

46. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014

47. NIST SP 800-164, “Guidelines on Hardware-Rooted Security in Mobile

Devices (Draft),” October 2012

48. Draft National Institute of Standards and Technology Interagency Report

(NISTIR) 7981, “Mobile, PIV, and Authentication,” March 2014

49. VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland

Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514) https://arch.idmanagement.gov/#what-is-the-ficam-architecture https://arch.idmanagement.gov/#what-is-the-ficam-architecture https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514

50. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

51. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

52. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

53. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019

54. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008

55. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (Public Law 110–140), December 19, 2007

56. Section 104 of the Energy Policy Act of 2005, (Public Law 109–58), August 8, 2005

57. Executive Order 13834, “Efficient Federal Operations,” dated May 17, 2018

58. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August

2, 2001

59. VA Directive 0058, “VA Green Purchasing Program,” July 19, 2013

60. VA Handbook 0058, “VA Green Purchasing Program,” July 19, 2013

61. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote

Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

62. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

63. “Veteran Focused Integration Process (VIP) Guide 4.0,” January 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

64. VA Memorandum “Proper Use of Email and Other Messaging Services,”

January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

65. “DevSecOps Product Line Management Playbook” version 2.0, May 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

66. NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020

67. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol

Version 6 (IPv6),” November 19, 2020

68. Social Security Number (SSN) Fraud Prevention Act of 2017

69. Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23,

70. “National RTLS Requirements Specification Document (RSD) v4.1 Final”, June 2015

71. “RTLS System Design Document (SDD) v7.2”, February 2018

72. “RTLS National Enterprise Data Architecture FINAL”, August 2017

73. RTLS Enterprise Data Architecture (EDA) Standards Workbook v2.0 Final

Spreadsheet. (this replaces Data Standards 1.94.1?)

74. RTLS National Requirement Traceability Matrix 20180215_v1.2

Spreadsheet, February 2018 https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896 https://www.cisa.gov/publication/tic-30-core-guidance-documents https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371 https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

75. RTLS Asset Tracking - Application Usage Document v4.0, September 2017

76. Maximo – Intelligent Infor LBI RTLS ICD, Version 3.0 November 16th 2017

77. VA Directive 6300, Records and Information Management, February 26,

78. VA Memorandum, VAIQ # 7011145, VA Identity Management Policy, June

28, 2010

3.0 SCOPE OF WORK

The Contractor shall provide project management, CenTak battery management, CenTrak maintenance support, Infor LBI maintenance support, and RTLS server support. The Contractor shall provide RTLS software updates, upgrades, and administration along with software license installation, corrective maintenance and helpdesk support. The Contractor shall also provide offline tag mitigation and a CenTrak system health assessment to include an onsite assessment of CenTrak infrastructure coverage.

The Office of Information & Technology replaced the Wi-Fi system through a national NextGen Wi-Fi project using Juniper/Mist technology. The new Wi-Fi system affected the connectivity to the RTLS system. The connectivity needs to be re-established to restore functionality to all stations except Houston. Houston was the Beta site for the integrationtherefore it will not need re-establishment connectivity for the base period , however the Houston location will need sustainment services for the option years. .

4.0 PERFORMANCE DETAILS

4.1 PERFORMANCE PERIOD

The period of performance (PoP) shall be 12 months from the date of award with four 12-month option periods.

Any work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO). If required, the CO may designate the Contractor to work during holidays and weekends.

There are eleven (11) Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, four are set by date:

New Year's Day January 1 Juneteenth June 19 Independence Day July 4 Veterans Day November 11 Christmas Day December 25

If any of the above falls on a Saturday, then Friday shall be observed as a holiday.

Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

Martin Luther King's Birthday Third Monday in January Washington's Birthday Third Monday in February Memorial Day Last Monday in May Labor Day First Monday in September Columbus Day Second Monday in October Thanksgiving Fourth Thursday in November

4.2 PLACE OF PERFORMANCE

Tasks under this PWS shall be performed in VA facilities as noted in the Table 1 below as well as at Contractor facilities. Work may be performed at remote locations with prior concurrence from the Contracting Officer’s Representative (COR). Tasks under this PWS shall be performed at Contractor facilities. The Contractor shall identify the Contractor’s place of performance in their proposal submission.

Table 1. VISN Facilities Deploying the RTLS Asset Tracking Solution

Facility ID Facility Name

502 Alexandria VA Health Care System

2495 Shreveport Hwy 71 Pineville, LA 71360

520 Gulf Coast Veterans Health Care System VA Gulf Coast Veterans Health Care System 400 Veterans Ave.

Biloxi, MS 39531

520BZ Gulf Coast Veterans Health Care System-Joint Ambulatory Care Center

790 Veterans Way Pensacola, FL 32507

564 Veterans Health Care System of the Ozarks

1100 North College Ave.

Fayetteville, AR 72703

580 Michael E. DeBakey VA Medical Center

2002 Holcombe Blvd.

Houston, TX 77030

586 G. V. (Sonny) Montgomery VA Medical Center

1500 E. Woodrow Wilson Dr.

Jackson, MS 39216

598 Central Arkansas Veterans Healthcare System John L. McClellan Memorial Veterans Hospital 4300 West 7th St.

Little Rock, AR 72205

598AO Central Arkansas Veterans Healthcare System

Eugene J. Towbin Healthcare Center

2200 Fort Roots Drive North Little Rock, AR 72114

629 Southeast Louisiana Veterans Health Care System 2400 Canal Street New Orleans, LA 70119-6535

667 Overton Brooks VA Medical Center 510 East Stoner Ave.

Shreveport, LA 71101

4.3 TRAVEL

The Government anticipates travel under this effort to perform the tasks associated with the effort, as well as to attend program-related meetings or conferences throughout the PoP. Include all estimated travel costs in your firm-fixed price line items. These costs will not be directly reimbursed by the Government.

The total estimated number of trips in support of the battery management program for this effort is outlined in the Table 2 below. Anticipated locations include the following, with estimated days and number of travelers per each trip:

Table 2

Site Days Trips Base Period Travelers

Option Periods One through Four Travelers per Option Period

Alexandria, LA 5 6 2 2

Biloxi, MS 5 6 2 2

Fayetteville, AR 5 6 2 2

Houston, TX 5 7 2 2

Jackson, MS 5 6 2 2

Little Rock, AR 5 6 2 2

North Little Rock, AR 5 7 2 2

New Orleans 5 7 0 2

Shreveport, LA 5 7 2 2

Pensacola, FL 5 7 2 2

5.0 SPECIFIC TASKS AND DELIVERABLES

The Contractor shall perform the following:

5.1 PROJECT MANAGEMENT

5.1.1 CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, timeline, and tools to be used in execution of the contract. The CPMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks, and resource support. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPMP shall be concurred upon and updated in accordance with Section B of the contract. The Contractor shall update and maintain the VA PM approved CPMP throughout the PoP.

Deliverable:

A. Contractor Project Management Plan

5.1.2 REPORTING REQUIREMENTS

The Contractor shall provide the COR with Monthly Progress Reports in electronic form in Microsoft Word and Project formats. The report shall include detailed instructions/explanations for each required data element, to ensure that data is accurate and consistent. These reports shall reflect data as of the last day of the preceding Month.

The Monthly Progress Reports shall cover all work completed during the reporting period and work planned for the subsequent reporting period. The report shall also identify any problems that arose and a description of how the problems were resolved. If problems have not been completely resolved, the Contractor shall provide an explanation including their plan and timeframe for resolving the issue. The report shall also include an itemized list of all Information and Communication Technology (ICT) deliverables and their current Section 508 conformance status. The Contractor shall monitor performance against the CPMP and report any deviations. It is expected that the Contractor will keep in communication with VA accordingly so that issues that arise are transparent to both parties to prevent escalation of outstanding issues.

These reports shall convey the status of contract performance. Required information shall include:

1. All planned or scheduled maintenance that will occur in the next reporting period.

2. Maintenance activity log showing all patches / upgrades / licenses installed, failures and faults detected, system performance deviations, including security vulnerabilities identified by VA from the monthly Nessus and on demand Oracle and SQL Server database scans, and the operational time to restore.

3. Customer support log which shall include a description of all support issues identified, severity level, and how the issues were resolved.

4. Corrective actions taken and status, whether closed/resolved or still open.

5. Anticipated closure date and roadblocks (if any) for open items.

6. All known significant issues or risks.

7. A summary of all closed and completed items.

A. Monthly Progress Report

5.1.3 TECHNICAL KICKOFF MEETING

A technical kickoff meeting shall be held within 10 days after TO award. The Contractor shall coordinate the date, time, and location (can be virtual) with the Contracting Officer (CO), as the Post-Award Conference Chairperson, the VA PM, as the Co-Chairperson, the Contract Specialist (CS), and the COR. The Contractor shall provide a draft agenda to the CO and VA PM at least five calendar days prior to the meeting. Upon Government approval of a final agenda, the Contractor shall distribute to all meeting attendees. During the kickoff-meeting, the Contractor shall present, for review and approval by the Government, the details of the intended approach, work plan, and project schedule for each effort via a Microsoft Office PowerPoint presentation. At the conclusion of the meeting, the Contractor shall update the presentation with a final slide entitled “Summary Report” which shall include notes on any major issues, agreements, or disagreements discussed during the kickoff meeting and the following statement “As the Post-Award Conference Chairperson, I have reviewed the entirety of this presentation and assert that it is an accurate representation and summary of the discussions held during the Technical Kickoff Meeting for the Real Time Location System Asses Tracking Sustainment – VISN 16.” The Contractor shall submit the final updated presentation to the CO for review and signature within three calendar days after the meeting. The Contractor shall also work with the CS, the Government’s designated note taker, to prepare and distribute the meeting minutes of the kickoff meeting to the CO, COR and all attendees within three calendar days after the meeting.

The Contractor shall obtain concurrence from the CS on the content of the meeting minutes prior to distribution of the document.

A. Kickoff Meeting Final Presentation

5.2 BATTERY MANAGEMENT

The Contractor shall monitor battery levels, provide batteries and change batteries for all CenTrak hardware which includes: tags, monitors, LF exciters, Radiofrequency network access points (stars), and Infrared virtual walls (VW) to sites listed in Table 1.

The Contractor shall be CenTrak certified. The Contractor shall use the government provided RTLS hardware design documents to locate devices. The Contractor shall use the Centrak Global Management System (GMS) Application and Intelligent Infor LBI application tools to obtain necessary information to complete the job. The Contractor shall monitor battery levels of all sites’ infrastructure and asset tags and shall determine when those batteries need to be changed.

Contractor shall monitor battery status for asset tags and infrastructure in the CenTrak GMS 30-day, 90-day, and offline low battery notification list. Contractor shall provide and replace batteries through onsite work performance. At any given day, the 30-day, 90-day, and Offline Low Battery List (LBL) shall not exceed 2% of total infrastructure devices in each site inventory. At any given day, the 30-day and 90-day LBL shall not exceed 2% of total asset tags in each site inventory. The VA would bring the off line devices within 2% before the award. The Contractor shall be in compliance with this requirement within 60 days of contract award.

Table 3 provides the total number of infrastructure devices and asset tags per site

Table 3. Number of Infrastructure and Asset Tags per Site

Site Server SAN Tags Monitor Virtual Wall

LF

Exciter

Star Hand

Hygiene Security

Controller

502- Alexandria

2 1 2672 226 690 51 68 0 0

520-Biloxi 2 1 5830 277 899 52 123 0 0

520BZ-

Pensacola

2 1 1366 111 588 12 93 0 0

564- Fayetteville

2 1 8940 174 716 17 62 0 0

580- Houston

2 1 8196 525 2263 27 305 0 0

586- Jackson

2 1 11219 291 1536 28 126 0 0

590-Little Rock

2 1 3145 374 1606 18 182 0 0

590AO-

North Little Rock

2 1 3978 212 376 15 70 0 0

629-New Orleans

2 1 4651 438 2920 108 410 717 0

667- Shreveport

2 1 6561 47 877 14 80 0 25

Table 4. Number of Infrastructure and Asset Tags per Site by LBI

Site Tags

Day

Tags

Day

Tags Offline

Infrastructure 90 Day

Infrastructure 30 Day

Infrastructure Offline

502-Alexandria 2 18 943 9 20 107

520-Biloxi 29 72 3196 5 6 71

520BZ-

Pensacola

9 20 988 0 8 15

564-Fayetteville 56 110 5212 10 5 169

580-Houston 176 1158 3907 28 78 366

586-Jackson 40 155 8374 19 62 542

590-Little Rock 11 79 3912 32 88 580

590AO-North Little Rock

2 25 2827 8 27 0

629-New Orleans

4 9 230 0 8 29

667-Shreveport 8 51 4457 1 5 86

The Contractor shall be onsite when performing battery replacement at each site. The Contractor shall follow all VA policies while in patient care areas. The Contractor shall not interrupt patient care while performing duties. It is encouraged to complete duties during normal business hours, but daily schedules will be determined by the local site POCs and shall be scheduled around patient care. The Contractor shall also bring their own equipment, (e.g. ladders/tools/laptop) to perform work, as the government will not be providing equipment. Some infrastructure is mounted on walls and ceilings of greater than 10 feet high. Contractor shall provide advance notification to site POC prior to onsite work performance.

Contractor shall provide a report of activities in the Battery Management Report for each onsite visit detailing the onsite technician contact information, the asset tags and infrastructure devices in which batteries were replaced.

Deliverables:

A. Battery Management Report

5.3 CENTRAK MAINTENANCE SUPPORT

The Contractor shall provide access to the CenTrak Knowledge Center and technical tips and FAQs.

The Contractor shall also provide all Centrak maintenance support to include:

1. Update, upgrades, patches, and bug fixes for firmware

2. Use the Connect Pulse server to conduct remote monitoring of RTLS performance

3. Update GMS for modifications or additions of infrastructure

4. Configuration of GMS including. addition of use cases, adding tags, and devices (approximately up to a maximum of 4 rooms and/or 8 additional devices)

5. Provide Level 3 support for onsite resources including troubleshooting, location accuracy, performance enhancement, and infrastructure adjustment recommendations)

6. Create Warnings, bulletins, and alerts for VA staff

7. Replace defective asset tags and infrastructure devices

The Contractor shall log and notify VA of any performance deviation, and any known or suspected rationale for the deviation in the Maintenance Activity Log as part of the Monthly Status Report.

The Contractor shall provide proof of partnership with Centrak that includes all extended support with Centrak. The Contractor shall provide certifications for all on-boarded personnel in the CPMP. The Contractor shall be available to respond to any of the locations in as listed in Table 1, Section 4.2. Only manufacturer certified Contractor personnel shall perform work on RTLS.

5.4 INFOR LBI MAINTENANCE SUPPORT

Contractor shall provide all Intelligent Insite software maintenance support to include:

1. Update, upgrades, patches, and bug fixes for firmware.

2. Provide Level 3 support for onsite resources including troubleshooting, location accuracy, performance enhancement, and infrastructure adjustment recommendations)

3. Provide continuous system health monitoring (Nagios Monitoring or equivalent)

4. Provide configuration changes, database clean up, business intelligence and reporting. The Contractor may expect service requests from VA POCs 1-2 times per month. The Contractor shall respond to the request within 24 hours and have a solution available within five business days. Pro-active services to optimize the RTLS shall be discussed with and approved by the COR prior to implementation.

The Contractor shall log and notify VA of any performance deviation, and any known or suspected rationale for the deviation in the Maintenance Activity Log as part of the Monthly Status Report.

The Contractor shall provide clinical/operational webinar trainings once per month to cover operational use of the Intelligent Infor LBI software.

The Contractor shall provide proof of partnership with Intelligent Infor LBI that includes all extended support with Intelligent Infor LBI. The Contractor shall provide certifications for all on-boarded personnel in the CPMP. The Contractor shall be available to respond to any of the locations in as listed in Table 1, Section 4.2. Only manufacturer certified Contractor personnel shall perform work on RTLS.

5.5 SERVER MAINTENANCE AND ADMINISTRATION

The Contractor shall provide O&M sustainment services for the RTLS production, pre-production, development, and SQA environments. O&M sustainment services shall be provided for the software components identified in Table 5. These services shall include operating system patches/upgrades, RTLS software component patches/upgrades, network administration, software license installation, system configuration changes, and virtual machine reboots.

Table 5. Software Components Covered Under This Task Order

Products RTLS Current Version

CenTrak Connect Core 5.14.26

CenTrak Pulse (formerly GMS) 9.2.0.16

Centrak Hand Hygiene Compliance 3.x

Infor LBI (Connector, Platform, BI, NSSM)

Connector - 3.0.x.x, Infor LBI RDS – 2.x, Platform - 5.5.2, Necto – 22.0 NSSM 2.24.x

Amazon Corretto 11.0.21

Microsoft Internet Information Services (IIS)

7.5

Microsoft .NET Framework 4.7.2

Microsoft SQL Server 2016 (SQL Always-on configuration)

RabbitMQ 4.x

Wildyfly – Jboss: App Server Wildyfly – Jboss: App Server (IAM)

26.1.1 26.1.1

Windows Server 2019

Red Hat Linux 8.x

5.5.1 PREVENTIVE MAINTENANCE

The Contractor shall deploy software updates and upgrades in the execution of RTLS preventive maintenance tasks. Additionally, the Contractor shall maintain and modify infrastructure system configurations to address functionality, security, connectivity or load issues. Most RTLS application minor updates are released approximately once or twice a year, while major updates are done annually. Contractor is required to replace/install defective hardware. See Attachment A for server list. All RTLS preventive maintenance activities shall be documented in the Monthly Status Report IAW Basic PWS 8.1.1.

For RTLS preventive maintenance, the Contractor shall:

1. Perform modifications to RTLS software installations and operational configurations to maintain and improve system performance, and to detect and correct latent faults in software and hardware products before they become operative faults. A latent defect or condition is one that is present but hidden from regular means of detection or yet to have an operational impact. An operative or effective fault is a fault activity impacting nominal system operations or business functionality.

2. Monitor the performance of the RTLS system, including system resources such as processor, memory and disk utilization and verify that performance thresholds are within nominal operating range, and take corrective action necessary to mitigate or relieve RTLS performance deviations. The Contractor shall log and notify VA of any performance deviation, and any known or suspected rationale for the deviation in the Maintenance Activity Log as part of the Monthly Status Report.

3. Engage in an ongoing inspection of RTLS to identify operative and latent defects in RTLS functions, software scripts, and software and hardware configuration.

The Contractor shall make actionable recommendations that address any defects detected. Recommendations shall be verbally relayed to the COR and documented in the Maintenance Activity Log as part of the Monthly Status Report.

4. Identify, download and install or manage the installation of RTLS application software patches and upgrades.

5. Coordinate with VA POCs identified by the COR to shut down, reboot or restart

RTLS systems (e.g., Intelligent Infor LBI, CenTrak) and RTLS supporting Systems (e.g., SSOi), following VA or RTLS IT maintenance, recovery or software patching.

6. Download Linux patches and upgrades from a server identified by VA, install those patches and reboot the patched VMs.

7. Verify correct operation of RTLS after every patch installation.

8. If operating system patches are shown to interfere with RTLS operation, coordinate with VA POCs identified by the COR before backing out any operating system patch(es).

9. Provide RTLS network administration support; to include maintenance of the application connection ports, firewall, load-balancer, Secure Socket Layer Off-loading and Single Sign-On Integration (SSOi) requirements and configurations.

5.5.2 RTLS SOFTWARE UPDATES, UPGRADES AND ADMINISTRATION

The application components of RTLS are hosted on platforms that contain VA standard operating systems, virtual machines, and ancillary software. The Contractor shall be responsible for identifying and downloading updates. Some of the software listed in Table 5 are sub-components of the RTLS application software. For RTLS software updates or upgrades, the Contractor shall:

1. Perform the installation, configuration, update (patching operational software) and/or upgrade (replacing or supplementing the software baseline) of RTLS software to mitigate the development of future faults, correct latent faults (present but hidden from routine (i.e., non-extraordinary) means of detection), rectify operative faults, restore nominal operations, or enhance component and system performance/capacity. For RTLS application software, the Contractor may expect approximately one major update and 2-3 minor updates a year. Linux patches are issued by VA monthly. The Contractor shall coordinate with COR to schedule installation before the next set of patches becomes available (less than 30 days).

For RTLS application patches, the Contractor shall coordinate with COR to schedule installation within 30 days from when the software update is available. If issues are encountered, this timeframe may be extended with agreement from the COR.

2. Notify COR three weeks in advance of installing new RTLS application releases or upgrades or any other disruptive maintenance activity in any environment.

The Contractor shall delay or terminate any planned update or upgrade, at the direction of the COR.

3. Perform the installation of software patches, new releases and software updates in the Dev and SQA environments to determine their impact prior to performing the same installations in the pre-production environment.

4. Ensure that the installation, operation, maintenance, updating, and patching of software shall not alter prior configuration settings or those from the VA approved configuration.

5. Verify the function and stability of upgrades in all environments (subject to the connectivity limits of those environments) prior to advancing to operational deployment into the production environment. This shall include regression testing sufficient to verify basic functionality (e.g., login, search, asset tracking, reporting, accurate monitoring and synchronization of inventory).

6. Perform routine RTLS system administration functions and serve as system administrator for all RTLS applications. In addition to system patches and updates, the Contractor shall monitor system logs and resource utilization, and archive system data and audit logs as needed. Server operating system administration (apart from patches) is the responsibility of VA staff.

7. Provide written notice to VA that each patch has been validated as not affecting the Systems within 10 working days when security fixes involve installing third party patches in pre-production (such as Linux Red Hat). Notification can come in the form of an email to the COR. The Contractor shall provide software testing documentation as part of the Monthly Status Report.

8. Provide VA any necessary information to update the One-VA TRM entry for any software components updated.

9. Contractor shall provide supporting data to complete necessary VA IT requests such as Authority to Operate (ATO) and TRM waivers.

5.5.3 SOFTWARE LICENSE INSTALLATION

All RTLS software licenses will be purchased by VA and given to the Contractor for installation and use when required. For RTLS software license installation, the Contractor shall:

1. Receive from the PM/COR, available license renewal data.

2. Install RTLS licenses, upon the authorization of the PM/COR. Licenses to operate RTLS software applications are listed in Table 4 (Software Components Covered Under This Task Order). Documentation of licenses applied shall be included as part of the Monthly Status Report.

5.5.4 CORRECTIVE MAINTENANCE

Corrective Maintenance is the reactive maintenance performed to identify, isolate, and rectify RTLS operating faults.

For RTLS corrective maintenance, the Contractor shall:

1. Perform troubleshooting to identify and isolate faults causing any failure or degradation of service in RTLS components and systems.

2. VA will perform Federal Information Security Management Act (FISMA) compliance audits and Nessus scans on a monthly basis, and the Contractor shall address and resolve all security remediation and vulnerabilities identified within the timeframe specified below, starting from notification of findings. VA maintains a tracking database for all security scan findings and compliance audits. The Contractor shall update that database to indicate the status of issue resolution and/or the plan to resolve issues that will take longer to resolve, in case of delays beyond the Contractor’s control (e.g., a VA delay or vendor dependency for software patches). Based on historical data, the Contractor may expect approximately 10 new findings per month.

a. Emergent – patches shall be tested and applied within 1 business day.

b. Critical – patches shall be tested and applied within 30 days

c. High – patches shall be tested and applied within 60 days

d. Moderate – patches shall be tested and applied within 90 days

e. Low – the COR will determine the patching timeframe

3. Respond to and resolve notifications that RTLS servers are down.

4. Administer RTLS subsystem databases. This includes maintaining database synchronization with the backup site at Philadelphia Information Technology Center (PITC), addressing database security remediation, capacity planning, performance monitoring, troubleshooting, modification of database tables, allocating additional space and archiving data as required by the COR.

Coordinate with VA POCs if new storage hardware is added, to configure new storage space for database use. VA will grant administrator privileges to Contractor staff to carry out database administration.

5. Troubleshoot, isolate and repair connectivity and communication issues for data presented to, or received from, the Mule ESB. Resolution of these issues may require coordination with other POCs as identified by the COR.

5.5.5 RTLS HELP DESK

The Contractor shall provide helpdesk support via a single email address for POCs.

The suggested name is ‘RTLS helpdesk’. The helpdesk support is manned with a live person from 8 a.m. to 5 p.m. CDT, Monday through Friday, During the other hours (nights, weekends and holidays) an automatic responder will acknowledge the receipt of an emailed request and the help desk personnel will take up the request when they return during regular business hours (8 a.m. to 5 p.m. CDT, Monday through Friday.

The Contractor shall work to resolve issues identified by POCs. The source of these defects may be Tier 2 or 3 trouble tickets from another RTLS support contract, or an issue identified by the POCs. During regular business hours (9am to 6pm Central), the Contractor shall:

1. Respond to service requests from COR or POC (via telephone or email) to resolve or support the troubleshooting, identification, and resolution of RTLS technical requests which involve RTLS components. The Contractor shall log all requests that are received in the Maintenance Activity Log as part of the Monthly Status Report.

2. Classify all service request received by assigning a severity level, in accordance with Table 6 below. The Contractor may anticipate 2-3 service requests per site per month, typically of the Non-Critical and Important severity.

3. Coordinate with the COR if access to resources at VA Medical Centers (VAMC) are required to fully diagnose or resolve an issue and work collaboratively with the POC(s) identified by the COR to resolve issues.

4. Collaborate with any identified POCs to cooperatively troubleshoot and resolve issues.

5. Provide issue resolution response to resolve faults and requests, in accordance with the response timeline provided in Table 3 below. Issues, status and resolution notification shall be communicated to the POCs.

6. Document all customer support issues in the Customer service log, a component of the Monthly Status Report.

7. Develop and submit service requests to COR-identified VA POCs to request OIT support services to resolve RTLS faults and other operating problems caused by components outside the maintenance responsibility of this TO.

Table 6: Event Response Time Intervals

Severity Code Impact Initial Response to Customer

Resolution Time

1 - Critical Complete work stoppage. Critical Service Request

30 minutes 4 hours

2 - Important Inability to perform a job function.

Important Service Request

1 hour 10 hours

3 - Non-critical Low/No Impact (Able to perform work functions) Non-critical Service Request

16 hours 80 hours

5.6 TRANSITION PERIOD – OPTIONAL TASK

If this Optional Task is exercised by VA, the Contractor shall perform the following. This optional task shall be completed no later than 30 days from date of task exercise.

The Contractor shall provide a Transition Plan for 30 days of outgoing transition support for transitioning work from the current task order to a follow-on task order or Government entity.

This transition may be to a Government entity or to another Contractor or to the incumbent Contractor under a new task order. In accordance with the Government-approved plan, the Contractor shall assist the Government in implementing a complete transition from this contract to a new support provider. This shall include formal coordination with Government staff and successor staff and management. It shall also include delivery of copies of all artifacts delivered under this contract, as well as existing policies and procedures, and delivery of baseline metrics and statistics.

A. Transition Plan

6.0 GENERAL REQUIREMENTS

6.1 ENTERPRISE AND IT FRAMEWORK

6.1.1 VA TECHNICAL REFERENCE MODEL

The Contractor shall support the VA enterprise management framework. In association with the framework, the Contractor shall comply with OIT Technical Reference Model (VA TRM). The VA TRM is one component within the overall Enterprise Architecture (EA) that establishes a common vocabulary and structure for describing the information technology used to develop, operate, and maintain enterprise applications. Moreover, the VA TRM, which includes the Standards Profile and Product List, serves as a technology roadmap and tool for supporting OIT. Architecture & Engineering Services (AES) has overall responsibility for the VA TRM.

6.1.2 FEDERAL IDENTITY, CREDENTIAL, AND ACCESS MANAGEMENT (FICAM)

The Contractor shall ensure Commercial Off-The-Shelf (COTS) product(s), software configuration and customization, and/or new software are Personal Identity Verification (PIV) card-enabled by accepting HSPD-12 PIV credentials using VA Enterprise Technical Architecture (ETA), https://www.ea.oit.va.gov/EAOIT/VA_EA/Enterprise_Technical_Architecture.asp, and VA Identity and Access Management (IAM) approved enterprise design and integration patterns, https://www.oit.va.gov/library/recurring/edp/index.cfm. The Contractor shall ensure all Contractor delivered applications and systems comply with the VA Identity, Credential, and Access Management policies and guidelines set forth in VA Handbook 6510 VA Identity and Access Management, VA Handbook 0735 Homeland Security https://www.ea.oit.va.gov/EAOIT/VA_EA/Enterprise_Technical_Architecture.asp https://www.oit.va.gov/library/recurring/edp/index.cfm

Presidential Directive 12 (HSPD-12) Program, and align with the Federal Identity, Credential, and Access Management Roadmap and Implementation Guidance v2.0.

The Contractor shall ensure all Contractor delivered applications and systems provide user authentication services compliant with the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-63-3, VA Handbook 6500 Appendix F, “VA System Security Controls”, and VA IAM enterprise requirements for direct, assertion based authentication, and/or trust based authentication, as determined by the design and integration patterns. Direct authentication at a minimum must include Public Key Infrastructure (PKI) based authentication supportive of PIV card and/or Common Access Card (CAC), as determined by the business need.

The Contractor shall ensure all Contractor delivered applications and systems conform to the specific Identity and Access Management PIV requirements set forth in the Office of Management and Budget (OMB) Memoranda M-05-24, M-19-17, and NIST Federal Information Processing Standard (FIPS) 201-2. OMB Memoranda M-05-24 and M-19- 17 can be found at:

https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2005/m05- 24.pdf, and https://www.whitehouse.gov/wp-content/uploads/2019/05/M-19-17.pdf respectively. Contractor delivered applications and systems shall be on the FIPS 201-2 Approved Product List (APL). If the Contractor delivered application and system is not on the APL, the Contractor shall be responsible for taking the application and system through the FIPS 201 Evaluation Program.

The Contractor shall ensure all Contractor delivered applications and systems support:

1. Automated provisioning and are able to use enterprise provisioning service.

2. Interfacing with VA’s Master Person Index (MPI) to provision identity attributes, if the solution relies on VA user identities. MPI is the authoritative source for VA user identity data.

3. The VA defined unique identity (Secure Identifier [SEC ID] / Integrated Control Number [ICN]).

4. Multiple authenticators for a given identity and authenticators at every Authenticator Assurance Level (AAL) appropriate for the solution.

5. Identity proofing for each Identity Assurance Level (IAL) appropriate for the solution.

6. Federation for each Federation Assurance Level (FAL) appropriate for the solution, if applicable.

7. Two-factor authentication (2FA) through an applicable design pattern as outlined in VA Enterprise Design Patterns.

8. A Security Assertion Markup Language (SAML) implementation if the solution relies on assertion-based authentication. Additional assertion implementations, besides the required SAML assertion, may be provided as long as they are compliant with NIST SP 800-63-3 guidelines.

9. Authentication/account binding based on trusted Hypertext Transfer Protocol (HTTP) headers if the solution relies on Trust based authentication.

10. Role Based Access Control.

https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2005/m05-24.pdf https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2005/m05-24.pdf https://www.whitehouse.gov/wp-content/uploads/2019/05/M-19-17.pdf

11. Auditing and reporting capabilities.

12. Compliance with VIEWS 00155984, PIV Logical Access Policy Clarification https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896.

The required Assurance Levels for this specific effort are Identity Assurance Level 3, Authenticator Assurance Level 3, and Federation Assurance Level 3.

6.1.3 INTERNET PROTOCOL VERSION 6 (IPV6)

The Contractor solution shall support Internet Protocol Version 6 (IPv6) based upon the memo issued by the Office of Management and Budget (OMB) on November 19, 2020 (https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-07.pdf). IPv6 technology, in accordance with the USGv6 Program (https://www.nist.gov/programs-projects/usgv6-program/usgv6-revision-1), NIST Special Publication (SP) 500-267B Revision 1 “USGv6 Profile” (https://doi.org/10.6028/NIST.SP.500-267Br1), and NIST SP 800-119 “Guidelines for the Secure Deployment of IPv6” (https://doi.org/10.6028/NIST.SP.800-119), compliance shall be included in all IT infrastructures, application designs, application development, operational systems and sub-systems, and their integration. In addition to the above requirements, all devices shall support native IPv6 and dual stack (IPv6 / IPv4) connectivity without additional memory or other resources being provided by the Government, so that they can function in a mixed environment. All public/external facing servers and services (e.g.

web, email, DNS, ISP services, etc.) shall support native IPv6 and dual stack (IPv6 / IPv4) users and all internal infrastructure and applications shall communicate using native IPv6 and dual stack (IPv6 / IPv4) operations.

6.1.4 TRUSTED INTERNET CONNECTION (TIC)

The Contractor solution shall meet the requirements outlined in Office of Management and Budget Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative“ (https://www.whitehouse.gov/wp-content/uploads/2019/09/M-19-26.pdf), VA Directive 6513 “Secure External Connections”, and shall comply with the TIC 3.0 Core Guidance Documents, including all Volumes and TIC Use Cases, found at the Cybersecurity & Infrastructure Security Agency (CISA) (https://www.