DRAFT PRODUCT DESCRIPTION (PD)

DEPARTMENT OF VETERANS AFFAIRS

Office of Information & Technology (OIT)

Office of Information Security (OIS)

Zero Trust Data Monitoring and Sensing - Structured Data Protection

VA-26-00050089

PD Version Number: 1.1

Date: April 14, 2025

Draft Product Description

1.0 PRODUCT REQUIREMENTS

The Department of Veterans Affairs (VA), Office of Information & Technology (OIT), Office of Information Security (OIS) requires a comprehensive Zero Trust Data Monitoring and Sensing - Structured Data Protection solution that provides a data protection solution to address on-premises structured data, and structured data in the VA Enterprise Cloud (VAEC) Cloud environments to include- Amazon Web Services (AWS) and Azure. Data Monitoring and Sensing is essential for enhancing cybersecurity measures across VA’s enterprise environments, supporting VA's Zero Trust Architecture Strategy in line with Executive Order 14028, Improving the Nation's Cybersecurity. The Zero Trust Data Monitoring and Sensing - Structured Data Protection solution shall provide robust Data Loss Prevention (DLP) capabilities, including automated enforcement of policies to prevent unauthorized access, transfer, or exfiltration of sensitive structured data. In addition, the solution must support automated and persistent data labeling, ensuring labels are applied consistently to structured data assets and integrated with DLP policies for dynamic access control and compliance.

DLP and labeling integration should align with VA’s Zero Trust principles and classification standards, enabling continuous verification, least privilege access, and adaptive policy enforcement across on-premises and cloud environments

This solution shall be a commercial off-the-shelf (COTS) product or an equivalent turnkey implementation that delivers end-to-end security capabilities, including management, threat detection, runtime policy enforcement, support, and virtual patching.

2.0 APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. “Federal Information Security Modernization Act of 2014”

2. Federal Information Processing Standards (FIPS) Publication 140-3, “Security

Requirements for Cryptographic Modules”, March 22, 2019

3. FIPS Pub 199. “Standards for Security Categorization of Federal Information and

Information Systems,” February 2004

4. FIPS Pub 200, “Minimum Security Requirements for Federal Information and

Information Systems,” March 2006

5. FIPS Pub 201-3, “Personal Identity Verification of Federal Employees and

Contractors,” January 2022

6. 10 U.S.C. § 2224, "Defense Information Assurance Program", as amended

7. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

8. Public Law 109-461 (P.L. 109-461), Veterans Benefits, Health Care, and Information Technology Act of 2006, as amended, Title IX, Information Security Matters

9. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”, as amended

10. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, https://www.va.gov/vapubs/index.cfm

11. VA Handbook 0710, “Personnel Security and Suitability Program,” May 2, 2016, https://www.va.gov/vapubs/index.cfm

12. VA Directive 6102, “Internet/Intranet Services,” August 5, 2019

13. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and

Guidelines,” as amended

14. Office of Management and Budget (OMB) Circular A-130, “Managing Federal

Information as a Strategic Resource,” July 28, 2016

15. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed Services

(CHAMPUS)”, as amended

16. National Institute of Standards and Technology (NIST) SP 800-66 Rev. 2, “Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule: A Cybersecurity Resource Guide,” February 2024

17. 45 C.F.R Parts 160 and 164, Subparts A and E, the Standards for Privacy of Individually Identifiable Health Information (“Privacy Rule”); and 45 C.F.R. Parts 160 and 164, Subparts A and C, the Security Standard (“Security Rule”); as amended

18. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended

19. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

20. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021 (see VA

NOTICE 24-18, dated September 27, 2024, “Update to VA Directive 6500 Cybersecurity Program”, and VA Notice 25-07, dated 3/18/25, “Amending VA Directive 6500 to incorporate M-24-15”)

21. VA Handbook 6500, “Risk Management Framework for VA Information Systems VA Information Security Program,” February 24, 2021 (see VA Notice 25-01, dated October 15, 2024, “Update to VA Handbook 6500 Risk Management Framework for VA Information Systems VA Information Security Program”, and VA Notice 25-06, dated 3/18/25, “Amending VA Directive 6500 to incorporate M-24-15”)

22. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI),” June 30, 2023

23. VA Handbook 6500.6, “Contract Security,” March 12, 2010 (see VA Notice 24-12, dated April 22, 2024, “Update to VA Handbook 6500.6, Contract Security, Appendix C VA Information and Information System Security/Privacy Language For Inclusion Into Contracts, As Appropriate”)

24. VA Handbook 6500.8, “Information System Contingency Planning,” March 25, 2025

25. VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018

26. VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017 https://www.va.gov/vapubs/index.cfm https://www.va.gov/vapubs/index.cfm http://www.va.gov/vapubs http://www.va.gov/vapubs

27. OIT Process Asset Library (PAL), OIT Process Asset Library.

28. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

29. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy

Impact Assessment,” October 15, 2014

30. VA Directive 6510, “VA Identity, Credential and Access Management,” September 3,

31. VA Handbook 6510, “VA Identity, Credential and Access Management,” September

27, 2024

32. VA Directive and Handbook 6513, “Secure External Connections,” October 12, 2017

33. VA Directive 6300, “Records and Information Management,” September 21, 2018

34. VA Handbook, 6300.1, “Records Management Procedures,“ March 24, 2010

35. NIST SP 800-37 Rev 2, “Risk Management Framework for Information Systems and

Organizations: A System Life Cycle Approach for Security and Privacy,” December

36. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020)

37. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015

38. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” March 24, 2014

39. OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005

40. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019

41. OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008

42. Federal Identity, Credential, and Access Management (FICAM) Architecture, June 30, 2023 (FICAM Architecture (idmanagement.gov))

43. NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access,“ June 2018

44. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, “Digital Identity Guidelines,” updated March 02, 2020

45. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014

46. VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland

Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514) https://digital.va.gov/process-asset-library/ https://www.va.gov/trm/TRMHomePage.aspx https://www.idmanagement.gov/arch/#:%7E:text=FICAM%20is%20the%20federal%20government%E2%80%99s%20enterprise%20approach%20to,identity%20processes%2C%20practices%2C%20policies%2C%20and%20information%20security%20disciplines.

https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514

47. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

48. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

49. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

50. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019

51. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008

52. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (P.L.

110–140), December 19, 2007

53. Section 104 of the Energy Policy Act of 2005, (P.L. 109–58), August 8, 2005

54. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 2, 2001

55. VA Directive 0057, “VA Environmental Management Program,” October 25, 2022

56. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote

Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

57. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

58. “Veteran Focused Integration Process (VIP) Guide 4.0,” March 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

59. VA Memorandum “Proper Use of Email and Other Messaging Services,” January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

60. “Product Line Management Transformation Playbook” version 3.1, August 2023, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

61. NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020

62. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol Version

6 (IPv6),” November 19, 2020

63. Social Security Number (SSN) Fraud Prevention Act of 2017

64. Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23, 2018

65. C.F.R Title 15 Part 7, “Securing the Information and Communications Technology and Services (ICTS) Supply Chain”, as amended

66. Executive Order 14028, “Executive Order on Improving the Nation's Cybersecurity,”

May 12, 2021, https://bidenwhitehouse.archives.gov/briefing-room/presidential-actions/2025/01/16/executive-order-on-strengthening-and-promoting-innovation-in-the-nations-cybersecurity/ https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896 https://www.cisa.gov/publication/tic-30-core-guidance-documents https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371 https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946 https://bidenwhitehouse.archives.gov/briefing-room/presidential-actions/2025/01/16/executive-order-on-strengthening-and-promoting-innovation-in-the-nations-cybersecurity/ https://bidenwhitehouse.archives.gov/briefing-room/presidential-actions/2025/01/16/executive-order-on-strengthening-and-promoting-innovation-in-the-nations-cybersecurity/ https://bidenwhitehouse.archives.gov/briefing-room/presidential-actions/2025/01/16/executive-order-on-strengthening-and-promoting-innovation-in-the-nations-cybersecurity/

67. OMB Memorandum M-22-09, “Moving the U.S. Government Toward Zero Trust Cybersecurity Principles”, January 26, 2022, https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf.

68. NIST SP 800-52 Revision 2, “Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations

69. OMB M-22-18, “Enhancing the Security of the Software Supply Chain through Secure Software Development Practices,” September 14, 2022

70. OMB M-23-16, “Update to Memorandum M-22-18,” June 9, 2023

71. OMB M-21-31, “Improving the Federal Government’s Investigative and Remediation

Capabilities Related to Cybersecurity Incidents,” August 27, 2021

72. NIST SP 800-88 Revision 1 “Guidelines for Media Sanitization,” December 2014

73. CISA Binding Operational Directive (BOD) 19-02: “Vulnerability Remediation

Requirements of Internet-Accessible Systems,” April 29, 2019, BOD 19-02:

Vulnerability Remediation Requirements for Internet-Accessible Systems | CISA

74. CISA BOD 22-01: “Reducing the Significant Risk of Known Exploited Vulnerabilities,” November 3, 2021, BOD 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities | CISA

75. CISA BOD 23-01: Improving Asset Visibility and Vulnerability Detection on Federal Networks.” Cybersecurity & Infrastructure Security Agency (CISA), BOD 23-01:

Improving Asset Visibility and Vulnerability Detection on Federal Networks | CISA

76. VA Directive 6550, Pre-Procurement Assessment and Implementation of Medical Devices/Systems, June 03, 2019

77. VA Memorandum, “VA Security Controls,” January 17, 2025, https://www.voa.va.gov/DocumentView.aspx?DocumentID=5010

3.0 SOLUTION SALIENT CHARACTERISTICS

The proposed solution shall meet the following salient characteristics:

3.1 PLATFORM AND ARCHITECTURE

a. Is a COTS, Software-as-a-Service (SaaS) offering aligned with VA’s Zero Trust Data Monitoring and Sensing - Structured Data Protection initiative.

b. Provides Cloud-Native Application Protection Platform capabilities.

c. Implements Policy-as-Code for data categorization, discovery, and labeling of structured data and supports enforcement through Continuous Integration and Continuous Delivery pipelines across development, test, and production environments, as well as integration with data inventories, Security Information and Event Management (SIEM), and User and Entity Behavior Analytics (UEBA) platforms.

d. Supports hybrid deployment across VA on-premises data centers and VA Enterprise Cloud (AWS GovCloud (US), Azure Government) under a unified SaaS control plane.

https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf https://www.cisa.gov/news-events/directives/bod-19-02-vulnerability-remediation-requirements-internet-accessible-systems https://www.cisa.gov/news-events/directives/bod-19-02-vulnerability-remediation-requirements-internet-accessible-systems https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities https://www.cisa.gov/news-events/directives/bod-23-01-improving-asset-visibility-and-vulnerability-detection-federal-networks https://www.cisa.gov/news-events/directives/bod-23-01-improving-asset-visibility-and-vulnerability-detection-federal-networks https://www.voa.va.gov/DocumentView.aspx?DocumentID=5010

e. Includes a SaaS control plane that holds a current Federal Risk and Authorization Management Program (FedRAMP) High authorization (Agency Authority to Operate (ATO) or Joint Authorization Board Provisional Authority to Operate ATO) prior to production use and maintains continuous monitoring.

f. Does not require database connectivity.

g. At the Government’s option, integrates with VA Cybersecurity Operations

Center (CSOC) automation and Extended Detection and Response platforms.

3.2 CONTINUOUS MAINTENANCE AND NON-DISRUPTION REQUIREMENT

a. Operational Continuity. Contains sufficient people, processes, and technology, to remain fully functional and maintained in accordance with stated performance requirements for the entire period of performance. All operational, maintenance, and update activities—whether technical, procedural, or personnel-related—shall be performed entirely by the Contractor, without reliance on the Government for execution. The Government’s role shall be limited to oversight, status review, and approvals where explicitly required VA policy and the contract terms.

b. Non-Disruption and Risk Prevention. Ensures that operation, maintenance, updates, and related activities do not disrupt, interfere with, or degrade VA workloads, systems, or networks. All activities are performed in a manner that does not introduce new security vulnerabilities or increase risk to VA assets, operations or partners.

c. Change-Safe Deployment Controls. Implements administrative controls to stage, validate, and deploy all changes—including scope, prerequisites, test/validation steps, risk assessment, and rollback procedures—within Government-approved change-control windows. It proactively coordinates change activities to maintain uninterrupted service and ensures compliance with applicable VA and Federal security requirements.

d. Support, Escalation, and Third-Party Coordination (No additional cost to Government). Maintains established relationships, agreements, and entitlements with any third-party vendors necessary to support, troubleshoot, or enhance the solution. All coordination with such third parties is handled exclusively by the solution at no additional cost to the Government. All operations, maintenance actions, escalations, and third-party involvement are fully documented, transparent to the Government, and available for review upon request. Third party vendor involvement does not alter the stated performance requirements obligations or accountability to the Government;

service levels for vendor escalation align with Key Performance Indicators.

3.3 SECURITY AND COMPLIANCE

a. Cryptography. Uses cryptographic modules validated by NIST’s Cryptographic Module Validation Program under FIPS 140-3 (or FIPS 140-2 modules on NIST’s historical list only where permitted by VA policy) and allows disabling non-validated ciphers/protocols.

b. Identity & Audit. Supports role-based access control that maps to VA Identity, Credential, and Access Management groups (e.g., Single Sign-On via Security Assertion Markup Language (SAML) 2.0/ OpenID Connect) and captures all privileged administrative actions in append-only, tamper-evident audit logs with time synchronization and integrity verification.

c. Accessibility. Administrative and user-facing interfaces conform to Section 508 and demonstrate Web Content Accessibility Guidelines (WCAG) 2.1 Level AA conformance; and makes available a current Voluntary Product Accessibility Template (latest Information Technology Industry Council template/edition) covering applicable criteria.

d. Sustainable Acquisition (if hardware is furnished). Physical appliances meet applicable sustainable acquisition for ENERGY STAR® or Federal Energy Management Program-designated efficiency and Electronic Product Environmental Assessment Tool® registration—consistent with Federal Acquisition Regulation (FAR) 52.223-23 (Sustainable Products and Services) and U.S. Environmental Protection Agency’s Recommendations of Specifications, Standards, and Ecolabels. (If no hardware is proposed, mark “Not Applicable.”)

3.4 DISCOVER, CLASSIFY, AND LABEL STRUCTURED DATA.

a. Native support for industry standard structured data platforms, systems, and clouds.

a. Organizes data into classifications to enhance both its usability and protection: Improves data usability and protection by systematically organizing data into appropriate classifications. This structured approach ensures that data is managed efficiently and securely.

b. Tags and labels data sources by classification: Implements tagging and labeling mechanisms to categorize data sources according to their classifications. This process facilitates easy identification and management of data assets.

c. Connects a data object with detailed metadata: Links each data object with comprehensive metadata to provide detailed information about the data. This connection enables better management, retrieval, and usage of the data.

d. Allows VA to append essential information to data assets including sensitivity levels (e.g., secret, confidential), classification criteria (e.g., health, financial records), retention guidelines (e.g. how long the data should be kept), and access limitations (e.g., who can view or modify the data), and customizable labels. Equips the VA with the capability to append crucial information to data assets. Such information includes sensitivity levels, classification criteria, retention guidelines, access limitations, and customizable labels, ensuring data is appropriately managed and protected.

e. Creates and deploys policies based on classifications/labels.

f. Enables informed, dynamic access decisions based on the specific context of the access request. Fosters the creation and deployment of policies that are informed by data classifications and labels. These policies enable dynamic and context-specific access decisions, enhancing security and compliance.

3.5 AUTOMATION

a. Exports data security event and audit log data to Government-designated consuming security tools with end-to-end delivery latency of no more than 60 seconds, measured from event generation to availability for query in the consuming tool.

b. Provides built-in automation that executes at least the following workflows:

alert triage deduplication; incident case creation with enrichment; response playbook execution; and compliance report generation.

c. Scales telemetry ingestion (e.g., gigabytes of log, flow, and data event data daily).

d. Provides a unified compliance dashboard that consolidates posture information across compute, asset, application, product, and system boundaries. The dashboard generates exportable compliance reports aligned with applicable federal cybersecurity frameworks, including at minimum NIST 800-53, FedRAMP, and the Center for Internet Security benchmarks.

e. Alerts for detected data loss events, misconfigurations, and policy violations.

Alerts include plain-language descriptions, relevant identifiers, and remediation guidance.

f. Exports audit logs of administrative actions and security events to VA’s centralized log management, IT Service Management (ITSM), and SIEM platforms.

g. Schedules and On-Demand Report Generation Reports are configurable for daily, weekly, monthly intervals.

4.0 SPECIFIC TASKS AND DELIVERABLES

4.1 PROJECT MANAGEMENT

4.1.1 CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, timeline, and tools to be used in execution of this task order. The purpose of this plan is to ensure that the Government and the Contractor understand and manage risk, communications, schedules, deliverables, quality, and human resources. The contractor shall ensure the CPMP takes the form of both a narrative and graphic format to illustrate schedules, milestones, risks, and resource support. The CPMP shall also include procedures that detail how the Contractor shall coordinate and execute plans, routines, and ad-hoc data collection and reporting requests as identified within the PD. The Contractor shall provide the Contracting Officer’s Representative (COR) and VA Program Manager (PM) with the CPMP within

10 business days after task order award and the CPMP shall be updated/maintained monthly thereafter throughout the period of performance. The contractor shall enable the Government to access the CPMP and associated artifacts in the VA SharePoint site or any other platform of the Government’s choosing.

The CPMP shall be treated as a dynamic document, regularly reviewed and updated to reflect changing conditions, new information, and the Government’s emerging priorities.

The Contractor shall adopt a proactive approach to planning that ensures the CPMP remains relevant and a useful tool for guiding decision-making.

The baseline CPMP for the base year of the contract shall include the following milestones: Pilot Readiness Review (PRR), Mid-Pilot Review (MPR), and Pilot Exit Review/Go-No-Go (PER). These activities, along with their planned dates and criteria, must occur only during the base year and are aligned with the Deployment Plan (DP) Pilot Annex. They shall not take place in any option years of the contract.

The CPMP shall be comprised of the following subsidiary plans: Schedule Management Plan; Scope & Acceptance Management Plan; Staffing Management Plan (SMP) (with Organization Chart annex); Quality Control Plan; Performance Management Plan;

Communications Plan (CP); and Risk Management Plan. Where a standalone deliverable is referenced elsewhere in this PD, the CPMP shall reference that deliverable and need not duplicate its content.

1. Schedule Management Plan: Includes GANTT charts and schedules of all planned deliverables; and, for the Base Period only, the Pilot Milestones: (a) PRR; (b) MPR; and (c) PER with Go/No-Go decision. Pilot milestone dates, entry/exit criteria, change windows, and rollback validation shall align to the DP Pilot Annex.

2. Scope & Acceptance Management Plan: Describes how the Contractor controls scope and deliverables and defines roles and responsibilities.

The Scope and Acceptance Management Plan shall include:

a) Who has authority and responsibility for scope management.

b) How scope is measured and verified (e.g., Quality Checklists, Scope

Baseline, Work Performance Measurements).

c) Who is responsible for final acceptance of project scope and deliverables.

3. SMP: Illustrates and details the arrangement of Management, Key and Support personnel assigned to the order, as well as corporate reach-back for staff augmentation. The SMP includes an Organization Chart (annex) for positions vacant and filled showing names, locations, team assignment, role, tour of duty/shift (as applicable), associated subcontractors, and reporting structure. The contractor shall update the Organization Chart within 15 days of any change.

4. Quality Control Plan: Describes all work products and deliverables to meet the needs of the Government, are accurate, and free of errors or unacceptable number of defects.

5. Performance Management Plan: Outlines how performance will be monitored and measured for acceptance by the Government, including schedule adherence, effectiveness, and stakeholder satisfaction. The plan shall include performance tracking for integration support and alert triage during the Base- Period pilot, as defined in the Pilot Annex.

6. CP: Describes methods, timelines, and responsibilities for communication between the Contractor and the Government throughout the period of performance. The CP shall include:

a) List the Responsible–Accountable–Consulted–Informed and contact information of all management and key personnel for both the Contractor and the Government, with associated tasks, functional assignments, and relationships.

b) Identify a single, authorized point of contact (POC) who will serve as the sole liaison for all technical, operational, and administrative matters.

c) A designated POC who is empowered to coordinate directly with any subcontractors or third-party vendors, at no additional cost to the Government, to resolve issues and maintain continuous system operation.

d) Shall illustrate how to communicate with the designated POC during Monday–Friday, 0800–1700 Eastern Standard Time.

e) No duplication: The Communications Plan shall reference the Staffing Plan (Roster) in PD 4.1.2 - Contractor Personnel Management as the authoritative source for Contractor personnel; it shall not duplicate roster fields.

7. Risk Management Plan. Details risks that may impact contract success, including a common name/title, probability, impact, risk score, origin, explanation, planned/recommended mitigation, and time to close; otherwise, complete a Plan of Action & Milestones (POAM) for identified risks. In the base period only, the plan includes pilot-specific technical/integration risks with mitigations, owners, and closure criteria mapped to Pilot milestones.

The Contractor shall propose plan formats or templates that meet the Government’s requirements. VA may provide templates/shells for each plan and the VA PM will provide guidance to the Contractor on the necessary inputs/ information that are required to develop the outputs for each one of the subsidiary plans. The above list may be updated by VA to include additional subsidiary plans and/or greater details.

Deliverable:

A. Contractor Project Management Plan

4.1.2 CONTRACTOR PERSONNEL MANAGEMENT

The Contractor shall provide a Staffing Plan, (Roster) within three business days after award, following the requirements provided for each Section in the table below. The Contractor shall develop and present the Government with a Staffing Plan that includes the Labor Category (LCAT), resource function/role, resource name, status of background investigations, PD Task Section affiliation, requirements (experience and/or certifications) met, physical location, and onboarding / offboarding status as well as any positions that have not been filled. The ability to sort and filter on all categories shall be reflected in the Staffing Plan. The staffing plan shall also include Key Personnel Positions (See PD Section 4.1.7 - Personnel).

This Staffing Plan (Roster) implements and is governed by the CPMP’s Staffing Management Plan (PD section 4.1.1). It is an operational roster, not a separate management plan; the CPMP shall reference this roster and need not duplicate the roster fields.

The Contractor shall provide a Contractor Manpower Report to the COR. The report is due weekly during the Transition-In period (until staffing is complete), and monthly thereafter (Staffing is complete). The report shall contain the following information for each person supporting this PD:

1. Name

2. Team Assigned

3. Role

4. Site Location

5. Contact Information

6. Start date.

7. Separation date

8. In/ Out processing progress status details (to include all aspects)

9. Background investigation progress status and date released.

10. Mandatory VA training completion dates.

The Contractor, when notified of an unfavorably adjudicated background investigation on a Contractor employee as determined by the Government, shall withdraw the employee from consideration in working under the Task Order.

Deliverables:

A. Staffing Plan (Roster) B. Contractor Manpower Report

4.1.3 ONBOARDING / OFFBOARDING

The Contractor shall manage Onboarding/Offboarding and administration of Contractor personnel who work under this Task Order. Onboarding/Offboarding shall be conducted through the VA Account Provisioning/Deprovisioning.

The Contractor Onboarding SOP shall include:

https://mvitk.iam.va.gov/imdquiWeb/myDashboard.action

1. Scheduling appointments to submit electronic fingerprints.

2. Submitting request for Talent Management System (TMS) accounts.

3. Completing VA mandatory training for contractors

4. Coordinating completion of background request application using the Federal

Electronic Questionnaires for Investigations Processing (e-QIP).

5. Completing and submit background investigation information and documents.

6. Coordinating PIV card issuance activities.

7. Completing and submit system account request forms.

8. Ensuring computer issuance is properly coordinated with VA Asset Management

Team with coordination through the COR/ VA PM.

9. Ensuring all efforts for in-processing are coordinated and communicated to the

COR.

10. Retain a log of all onboarding activities for personnel assigned to this effort, which shall be made available to the COR upon written COR request within 1 business day.

11. Completing and submitting documented requests for specific individuals who require elevated privilege to successfully execute this PD

Onboarding/offboarding VA Identity Management Toolkit portal link below:

https://mvitkssoi.iam.va.gov/imdquiWeb/provManagedUserAcctSelf.action?action=reque stAccount

The Contractor shall identify individuals who require elevated privileges to the necessary development and test environments for the product lines.

After review between the Contractor and VA COR(s), a decision will be made as to the necessity of obtaining GFE for the onboarding staff. If approved, Contractor shall follow the appropriate steps to obtain the equipment.

A Contract Lead (single Contractor Onboarding POC) shall be designated by the Contractor that performs onboarding/offboarding and tracks the onboarding status of all Contractor personnel. The Contractor Onboarding POC shall be responsible for accurate and timely submission of all required VA onboarding documents to the VA COR(s). All VA onboarding (non-Personally Identifiable Information (PII)) documents shall be stored in the deliverables folder in the COR designated VA SharePoint site or equivalent tool. The Contractor Onboarding POC shall be responsible for tracking the status of all their staff’s onboarding activities to include the names of all personnel engaged on the task, their initial training date for VA Privacy and Information Security training, and their next required training date. The Contractor Onboarding POC shall also report the status of the staff level in the Biweekly Status Report.

The Contractor shall manage all the offboarding processes for access to VA individual system/environment access for all Contractor staff. The Contractor shall prepare all forms necessary for termination of access to VA information systems, in accordance with VA guidance and policies. The Contractor shall confirm via email to COR, VA Team https://mvitkssoi.iam.va.gov/imdquiWeb/provManagedUserAcctSelf.action?action=requestAccount https://mvitkssoi.iam.va.gov/imdquiWeb/provManagedUserAcctSelf.action?action=requestAccount and Lead whether the GFE equipment, associated documentation, and PIV card has been returned to the proper receiving authorities in accordance with VA policy.

The Contractor shall provide a Monthly On/Off-Boarding Status Report. The On/Off-boarding report shall be delivered in a Microsoft Office format, as determined by the government. The report is due no later than 15th of each month and shall be in accordance with the OIT/OIS writing style guide. The report shall include, at a minimum, the following items:

a. Name of contractor employee

b. Team

c. Title

d. Role (scope of work and responsibilities)

e. Start Date

f. Departure date

g. List of assigned VA assets including PIV & attestation that all were returned.

h. Attestation that all accesses (physical and logical) were revoked.

i. Confirmation that relevant knowledge was transferred, and status of pending tasks/deliverables were appropriately reassigned.

The Contractor shall perform the efforts required for offboarding Contractor personnel assigned to this effort as defined in the OIS Contractor Offboarding SOP, to include:

1. Sending out notifications of termination.

2. Removal access.

3. Withdrawing of physical access.

4. Collecting issued property (computer, two factor authentication tokens).

5. Returning PIV Card to PIV Sponsor.

6. Circulating checklist.

A. On/Off-boarding Monthly Status Report

4.1.4 REPORTING REQUIREMENTS

The Contractor shall ensure that all reports, work products and deliverables submitted to the VA shall be in accordance with the OIT Brand System, and suitable for submitting to a non-technical senior management audience, and/or a technical audience.

The Contractor shall facilitate a weekly teleconference status meeting with the OIT staff to discuss progress against milestones, document issues, pending deliverables, and other pertinent topics concerning the task areas. During the weekly status meetings, the Contractor shall record the call and create meeting minutes utilizing Microsoft Word and include them in the Weekly Progress Reports. The Contractor shall provide Weekly Progress Reports which address issues, risks, risk mitigation strategies, progress https://digital.va.gov/oit-brand-system/ against milestones, and progress against schedules. Current risks shall be highlighted during weekly meetings. Past or mitigated risks shall be archived and available for later reference or review.

The Contractor shall ensure the minutes contain notes on all discussions, by topics and with details. The Contractor shall ensure that OIT Management, VA PM and applicable parties are informed of issues to prevent escalation.

The Contractor shall provide a weekly update of the Risk Management Plan in the CPMP to the COR. The risk management plan shall include a Risk Log, with an acceptable template to be provided by the COR. The Contractor shall detail all risks that impact successful execution of the PD with acceptable template to be provided by the COR. This includes a common name or title of the status, issue category, issue number, issue description, area affected, date open, date closed, risk identified, recommended mitigation, notes/next actions.

The Contractor shall submit a consolidated monthly deliverable acceptance report to the COR no later than two days prior to submitting the monthly invoice. This report must be delivered after obtaining the necessary signatures from the PM or task leads, confirming the completion and acceptance of deliverables. The COR will provide a template or guidelines for the minimal content required in the deliverable acceptance report. The Contractor is responsible for routing the deliverable acceptance report to the PM and task leads to obtain their acceptance signatures before submitting it to the COR.

Deliverables:

A. Weekly Progress Reports B. Consolidated Deliverable Acceptance Report

4.1.5 TECHNICAL KICKOFF MEETING

The Contractor shall facilitate a technical kickoff meeting 10 days after task order award. The technical kickoff meeting shall be virtual. The Contractor shall coordinate the date, time, and location with the Contracting Officer (CO), as the Post-Award Conference Chairperson, the VA PM (Co-Chairperson), the Contract Specialist (CS), the COR, and OIT Leadership. The Contractor shall provide a draft agenda to the CO, the COR and the VA PM at least five calendar days prior to the meeting. Upon Government approval of a final agenda, the Contractor shall distribute the final version to all meeting attendees. During the kickoff meeting, the Contractor shall present, for review and approval by the Government, the details of the intended approach, work plan, and project schedule for each effort via a Microsoft Office PowerPoint presentation. At the conclusion of the meeting, the Contractor shall update the presentation with a final slide entitled “Summary Report” which shall include notes on any major issues, agreements, or disagreements discussed during the kickoff meeting and the following statement “As the Post-Award Conference Chairperson, I have reviewed the entirety of this presentation and assert that it is an accurate representation and summary of the discussions held during the Technical Kickoff Meeting for the Zero

Trust Data Monitoring and Sensing - Structured Data Protection contract.” The Contractor shall coordinate with the CS, prepare and distribute the Technical Kickoff Meeting minutes to the CO, COR, and all attendees within three calendar days after the meeting. The Contractor shall obtain concurrence from the CS on the content of the Meeting Minutes prior to distribution of the document.

Deliverables:

A. Technical Kick-off B. Presentation Slides and Summary Report C. Approved Meeting Minutes

4.1.6 VA COMPLIANCE TRAINING

The Contractor shall ensure all Contractor personnel engaged on the Zero Trust Data Monitoring and Sensing - Structured Data Protection contract complete mandatory VA training before their due dates. The current mandatory requirements include VA Privacy and Information Security Awareness Training and Rules of Behavior Status. Role-based specific training of equivalent complexity may also be required. VA has the right to modify the training requirements. Completion of these training requirements are required during the onboarding of personnel and required before individuals start working under this task order.

The Contractor shall submit VA Privacy and Information Security Training Certificates for each Contractor employee in accordance with Section 9, Training, from Appendix C of the VA Handbook 6500.6, “Contract Security”. The contractor shall ensure that training referenced above is renewed annually by each contractor staff member.

The Contractor shall provide VA COR with progress and completion status of VA Privacy and Information Security Awareness Training and Rules of Behavior in the form of a Training Status Report on a monthly basis. The Training Status Report shall convey the following: first and last name of all Contractor personnel engaged on the effort, their initial training completion date(s), next required training date. The training status report and completion certificates shall be maintained by the Contractor in a VA provided central location.

A. Training Status Report

4.1.7 PERSONNEL

All personnel performing work on this task order shall possess experience, and competency in the disciplines and functional areas for the task to which they have been assigned. All personnel shall have knowledge of NIST security controls and possess sufficient understanding of industry standards to successfully execute the requirements in the Zero Trust Data Monitoring and Sensing - Structured Data Protection contract.

The Contractor shall provide Contractor support personnel and subcontractors who have the required skills, VA security clearance (when authorized), and access authorization or combination thereof to meet the requirements in the PD.

If there are any changes to personnel, the Contractor shall immediately notify the COR/VA PM in writing. The Contractor must replace any vacating personnel with individuals who have at least equal ability and qualifications as those currently performing in that role. This replacement must be completed within 30 calendar days, and the transition in or out must not affect the performance of the Zero Trust Data Monitoring and Sensing - Structured Data Protection solution.

All positions shall be filled within 30 calendar days after award.

4.1.8 AUTHORITY TO OPERATE (ATO)

The Contractor shall deliver a COTS SaaS solution in accordance with applicable Federal and Agency security policies. Where a proposed SaaS solution maintains a FedRAMP authorization but does not currently hold a VA ATO, the Contractor shall ensure that all required documentation, testing, and coordination activities are completed in order to obtain VA authorization and achieve full operational readiness for this SaaS capability within the VA environment.

The Contractor shall complete and provide all deliverables identified in this section in accordance with the timelines and requirements specified. The Contractor shall coordinate with VA Digital Transformation Center (DTC), COR, and Subject Matter Experts to ensure that all deliverables are accurate, complete, and sufficient to support VA’s security authorization process. The contractor shall at minimum complete the following to obtain an ATO if the solution is FedRAMP Authorized and VA Authorized:

1. The information system solution selected by the Contractor shall comply with the Federal Information Security Management Act (FISMA) and have a current VA authorization.

2. The Contractor shall comply with FedRAMP requirements as mandated by Federal laws and policies, including making available any documentation, physical access, and logical access needed to support this requirement.

3. The FedRAMP Authorization level and existing VA ATO should be no less than the level required for this use case which has been defined as a 100% high system (per NIST 800-60 Vol 2).

4. The Contractor shall, where applicable, assist with the VA ATO Sustainment Process to help maintain health and quality of agency authorization of the cloud service or migrated application.

5. The Contractor shall exclusively provide licenses and/or accounts to FedRAMP authorized and VA authorized environments.

6. The Contractor shall afford VA access to the Contractor’s and Cloud Service Provider’s (CSP) facilities, installations, technical capabilities, operations, documentation, records, and databases.

7. If new or unanticipated vulnerabilities are discovered by either VA or the Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party in accordance with Addendum B, VA Information and Information System Security/Privacy Language

8. The Contractor shall comply with data management requirements.

9. Successful issuance of a VA ATO will be required before live VA data can be used in the system.

10. The Contractor shall participate in monthly Agency and FedRAMP Sustainment meetings following the granting of a VA ATO.

11. The Contractor shall provide continuous monitoring activities including scans, security artifacts, and monthly Plan of Action and Milestones (POAM) reports as outlined by FedRAMP requirements.

Deliverables:

A. Continuous monitoring security artifacts B. Continuous monitoring scans C. Plan of Action and Milestones reports.

4.1.9 DEPLOYMENT AND IMPLEMENTATION SERVICES

The Contractor shall provide a turnkey delivery model following a phased implementation approach focused on structured data discovery, classification, labeling, and DLP enforcement across VA on‑premises and VAEC (AWS GovCloud (US), Azure Government) environments. The Contractor shall develop a Deployment Plan (DP) that covers scope, schedule, prerequisites, dependencies/compatibility (including data repositories, Extract, Transform, Load (ETL) tools, and data services), and risk management strategies. Upon Government approval of the DP, the Contractor shall coordinate with Government technical teams to ensure seamless integration and shall provide regular progress updates to the VA Project Management Team, addressing issues, risks, and mitigations during implementation.

During the Base Period, the Contractor shall conduct a time-boxed pilot with 1 – 3 VA Systems, to validate deployment and integration, policy efficacy, and structured data protection on a representative subset of VA systems prior to enterprise rollout. The pilot shall include each of the following system types: relational databases, data warehouses, and cloud‑native data services. The pilot shall also validate connectors, classification and labeling accuracy, DLP policy efficacy, and non‑disruptive enforcement prior to enterprise rollout. The pilot shall begin in monitor/alert mode and progress to prevention/enforcement only after tuning and Government approval. The Contractor shall implement required integrations with VA-designated tools necessary for pilot operations and shall lead policy and alert tuning (rule hygiene, routing, baselining) against representative VA workloads. All changes shall occur within approved change windows with tested rollback paths. The pilot duration, scope, success criteria, and rollback procedures shall be defined in the DP’s Pilot Annex. Oversight & Stage Gates.

Government oversight will include stage-gated reviews (PRR, MPR, PER). These are governance events with notes and minutes retained as artifacts; they are not separate deliverables.

For the Base Period only, pilot outcomes shall be included in the monthly Integration Status Report (ISR) under “Pilot Progress”. Weekly status shall include a Pilot Progress line item (scope coverage, summary of tuning changes, performance for integration support and alert triage, risks/issues/mitigations, upcoming change windows, and rollback tests executed).

The Contractor shall maintain pilot artifacts (DP/Pilot Annex, tuning and change logs, integration health checks, rollback evidence) and provide them upon request and at stage-gated reviews. Pilot exit criteria (acceptable detection efficacy, acceptable false-positive rates, acceptable performance overhead in monitor and prevention modes, and stable integration health) shall be proposed by the Contractor and approved by the Government. If exit criteria are unmet, the Government may direct additional pilot cycles or scope adjustments.

The DP Pilot Annex shall specify:

1. Representative systems (databases/data warehouses/data services),

2. Timelines, resource assignments, prerequisites, and dependency and compatibility assessments,

3. Integration endpoints/data flows,

4. Classification & labeling approach (test datasets, ground truth sampling, Quality

Assurance criteria),

5. Policy tuning approach (rule hygiene, routing, baselining),

6. Approved change control windows and tested rollback plan,

7. Evidence to be produced (dashboards, event samples, label propagation traces, policy diffs, integration health checks),

8. Stage‑gate plan (Readiness, Mid‑Pilot, Exit) with entry and exit criteria, and

9. Scale‑out plan requiring VA PM approval

The Contractor shall set up and configure the solution to full operational status and shall ensure integration with the Department’s network and security infrastructure, contingent upon Pilot Exit approval and a Government “Go” decision for scale-out.

The Contractor shall provide the monthly ISR for the duration of the contract documenting traceability of implementation and sustainment activities and the continued alignment of the Zero Trust Data Monitoring and Sensing - Structured Data Protection solution with VA systems and environments. The report shall summarize integration progress with key enterprise platforms, including but not limited to DevSecOps pipelines, configuration management platforms, incident response systems, UEBA, and SIEM and Security Orchestration, Automation, and Response (SOAR) technologies;

identify completed integrations, active development items, decommissioned systems or tools, newly onboarded protected workloads, technical dependencies, and any gaps or issues requiring Government attention or mitigation; and note planned change windows and associated risk and impact.