ESOM - PWS - Draft.pdf

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Office of Information & Technology End User Services (EUS)

Endpoint Support and Operations Monitoring (ESOM)

Date: May 28, 2024

VA-24-00067607

PWS Version Number: 1.1

End User Support and Operations Monitoring

Contents

1.0 BACKGROUND

2.0 APPLICABLE DOCUMENTS

3.0 SCOPE OF WORK

4.0 PERFORMANCE DETAILS

4.1 PERFORMANCE PERIOD

4.2 PLACE OF PERFORMANCE

4.3 TRAVEL

5.0 SPECIFIC TASKS AND DELIVERABLES

5.1 PROJECT MANAGEMENT (T&M)

5.1.1 CONTRACTOR PROJECT MANAGEMENT PLAN

5.1.2 REPORTING REQUIREMENTS

5.2 MONTHLY WORKLOAD MEETINGS

5.3 Technical Services (T&M)

5.3.1 ENDPOINT MONITORING AND PERFORMANCE OPTIMIZATION

5.3.2 SYSTEM ACCESS AND USER ADMINISTRATION

5.3.3 OPERATING SYSTEM AND APPLICATION ADMINISTRATION

5.3.4 ENDPOINT SECURITY MANAGEMENT

5.3.5 INCIDENT MANAGEMENT AND RESOLUTION

5.3.6 DATA INTEGRATION AND SYSTEMS UPGRADE

5.3.7 COMPLIANCE AND QUALITY ASSURANCE

5.3.8 VIDEO TELECONFERENCING SUPPORT

5.3.9 END USER SERVICES TRAINING AND SUPPORT

5.3.10 ENDPOINT SECURITY CONFIGURATION SUPPORT

5.3.11 FISCAL AND FINANCIAL PLANNING SUPPORT

5.4 INFRASTRUCTURE SUPPORT (T&M, OPTIONAL)

5.4.1 SURGE SUPPORT

5.4.2 PROJECT MANAGEMENT SUPPORT

5.5 ENDPOINT ENGINEERING (T&M, OPTIONAL)

5.5.1 DESKTOP ENGINEERING

5.5.2 MOBILE DEVICE SUPPORT

5.5.3 DESKTOP IMAGING

5.6 NETWORKING SUPPORT (T&M, OPTIONAL)

5.6.1 LAN/WAN SUPPORT

5.7 IT ASSET MANAGEMENT (ITAM) SUPPORT (T&M, OPTIONAL)

5.8 CONTINUITY OF OPERATIONS (COOP) AND DISASTER RECOVERY

PLANNING (T&M, OPTIONAL)

5.8.1 CONTINUITY OF OPERATIONS (COOP) SUPPORT

5.9 ENTERPRISE COMMAND CENTER (ECC) SUPPORT (T&m)

5.9.1 ECC PROGRAM SUPPORT

5.9.2 APPLICATION MONITORING SUPPORT

5.9.3 NETWORK AND INFRASTRUCTURE SUPPORT

5.9.4 MAJOR INCIDENT MANAGEMENT SUPPORT

5.9.4.1 INCIDENT MANAGEMENT

5.9.4.2 INCIDENT COORDINATION

5.9.4.3 INCIDENT COORDINATION

6.0 GENERAL REQUIREMENTS

6.1 ENTERPRISE AND IT FRAMEWORK

6.1.1 VA TECHNICAL REFERENCE MODEL

6.1.2 FEDERAL IDENTITY, CREDENTIAL, AND ACCESS MANAGEMENT

(FICAM)

6.1.3 INTERNET PROTOCOL VERSION 6 (IPV6)

6.1.4 TRUSTED INTERNET CONNECTION (TIC)

6.1.5 STANDARD COMPUTER CONFIGURATION

6.1.6 VETERAN FOCUSED INTEGRATION PROCESS (VIP) AND PRODUCT

LINE MANAGEMENT (PLM)

6.1.7 PROCESS ASSET LIBRARY (PAL)

6.1.8 AUTHORITATIVE DATA SOURCES

6.1.9 SOCIAL SECURITY NUMBER (SSN) REDUCTION

6.2 SECURITY AND PRIVACY REQUIREMENTS

6.2.1 POSITION/TASK RISK DESIGNATION LEVEL(S)

6.2.2 CONTRACTOR PERSONNEL SECURITY REQUIREMENTS

6.3 METHOD AND DISTRIBUTION OF DELIVERABLES

6.4 PERFORMANCE METRICS

6.5 FACILITY/RESOURCE PROVISIONS

6.6 GOVERNMENT FURNISHED PROPERTY

1.0 BACKGROUND

The Office of Information & Technology (OIT) serves the Department of Veterans Affairs (VA) as a Veteran-centric provider of secure and cost-effective technology services. OIT collaborates with its business partners to create the best experience for all Veterans by endeavoring to provide a seamless and unified Veteran experience via state-of-the-art information technology (IT) solutions and service delivery. Within OIT, End User Services (EUS) provides enterprise-level infrastructure engineering, system implementation, production operations, and IT service management. EUS is responsible for the design, testing, deployment, and sustainment of platforms and supporting infrastructure. EUS is OIT’s main service line with more than 3,500 IT professionals across the United States and its territories.

The largest component of EUS is End User Operations (EUO), which has full accountability and responsibility for all IT field system operations and production throughout the agency. EUO provides onsite and remote support to IT customers across all VA Administrations and special program offices, including direct support of over 340,000 VA employees and thousands of contractors who use government-furnished IT equipment and infrastructure. EUO provisions and manages nearly 600,000 endpoint computing devices; conducts new facility activations and performs moves, adds and changes; executes local systems implementations; performs break/fix functions; and engages with VA’s customers across the nation to meet IT support needs. EUO is comprised of over 3,000 VA staff providing support at over 1,400 VA facilities, as well as countless remote locations.

Currently, VA is experiencing massive growth, in large part as a response to the Sergeant First Class Heath Robinson Promise to Address Comprehensive Toxics (PACT) Act of 2022 and anticipates significant expansion of its customer base over the next several years. To support this increased need for its services, OIT needs to scale its mission to modernize and standardize information technology services and support across the VA enterprise. While EUS is facing unprecedented business challenges, including limitations on hiring and personnel actions, it remains imperative that we increase our team's portfolio management capabilities. Continued expansion in VA’s Veteran-facing business units is critically necessary to mission execution, compels increased end user operational support to enhance the efficiency, security, and adaptability of the entire VA. Neglecting this need could lead to significant risks including security vulnerabilities, reduced productivity, and a negative perception of OIT.

2.0 APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. 44 U.S.C. § 3541-3549, “Federal Information Security Management Act (FISMA) of 2002”

2. “Federal Information Security Modernization Act of 2014”

3. Federal Information Processing Standards (FIPS) Publication 140-2, “Security Requirements for Cryptographic Modules”

4. FIPS Pub 199. “Standards for Security Categorization of Federal Information and Information Systems,” February 2004

5. FIPS Pub 200, “Minimum Security Requirements for Federal Information and Information Systems,” March 2006

6. FIPS Pub 201-2, “Personal Identity Verification of Federal Employees and Contractors,” August 2013

7. 10 U.S.C. § 2224, "Defense Information Assurance Program"

8. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

9. Public Law 109-461, Veterans Benefits, Health Care, and Information

Technology Act of 2006, Title IX, Information Security Matters

10. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”

11. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, https://www.va.gov/vapubs/index.cfm

12. VA Handbook 0710, “Personnel Security and Suitability Program,” May 2, 2016, https://www.va.gov/vapubs/index.cfm

13. VA Directive and Handbook 6102, “Internet/Intranet Services,” August 5,

14. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and Guidelines,” January 18, 2017

15. Office of Management and Budget (OMB) Circular A-130, “Managing Federal

Information as a Strategic Resource,” July 28, 2016

16. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed

Services (CHAMPUS)”

17. NIST SP 800-66 Rev. 1, “An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule,” October 2008

18. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended, January 18, 2017

19. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

20. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021

21. VA Handbook 6500, “Risk Management Framework for VA Information

Systems VA Information Security Program,” February 24, 2021

22. VA Handbook 6500.2, “Management of Breaches Involving Sensitive

Personal Information (SPI),” March 12, 2019

23. VA Handbook 6500.5, “Incorporating Security and Privacy into the System

Development Lifecycle,” March 22, 2010

24. VA Handbook 6500.6, “Contract Security,” March 12, 2010

25. VA Handbook 6500.8, “Information System Contingency Planning,” April 6,

26. VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018

27. VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017

28. OIT Process Asset Library (PAL), https://www.va.gov/process/ . Reference

Process Maps at https://www.va.gov/process/maps.asp and Artifact templates at https://www.va.gov/process/artifacts.asp https://www.va.gov/vapubs/index.cfm https://www.va.gov/vapubs/index.cfm http://www.va.gov/vapubs http://www.va.gov/vapubs https://www.va.gov/process/ https://www.va.gov/process/maps.asp https://www.va.gov/process/artifacts.asp

29. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

30. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014

31. VA Handbook 6508.1, “Procedures for Privacy Threshold Analysis and Privacy Impact Assessment,” July 30, 2015

32. VA Handbook 6510, “VA Identity and Access Management,” January 15,

33. VA Directive and Handbook 6513, “Secure External Connections,” October 12, 2017

34. VA Directive 6300, “Records and Information Management,” September 21,

35. VA Handbook, 6300.1, “Records Management Procedures,“ March 24, 2010

36. NIST SP 800-37 Rev 2, “Risk Management Framework for Information

Systems and Organizations: A System Life Cycle Approach for Security and Privacy,” December 2018

37. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020)

38. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015

39. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-

12) Program,” March 24, 2014

40. OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005

41. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019

42. OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008

43. Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance, December 2, 2011, (NOTE: Part A of the FICAM Roadmap and Implementation Guidance, v2.0, was replaced in 2015 with an updated Architecture (https://arch.idmanagement.gov/#what-is-the-ficam-architecture)

44. NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access,“ June 2018

45. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, “Digital Identity Guidelines,” updated March 02, 2020

46. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014

47. NIST SP 800-164, “Guidelines on Hardware-Rooted Security in Mobile

Devices (Draft),” October 2012

48. Draft National Institute of Standards and Technology Interagency Report

(NISTIR) 7981, “Mobile, PIV, and Authentication,” March 2014 https://www.va.gov/trm/TRMHomePage.aspx https://arch.idmanagement.gov/#what-is-the-ficam-architecture https://arch.idmanagement.gov/#what-is-the-ficam-architecture

49. VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

50. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

51. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

52. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

53. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019

54. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008

55. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (Public Law 110–140), December 19, 2007

56. Section 104 of the Energy Policy Act of 2005, (Public Law 109–58), August 8, 2005

57. Executive Order 13834, “Efficient Federal Operations,” dated May 17, 2018

58. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August

2, 2001

59. VA Directive 0058, “VA Green Purchasing Program,” July 19, 2013

60. VA Handbook 0058, “VA Green Purchasing Program,” July 19, 2013

61. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote

Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

62. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

63. “Veteran Focused Integration Process (VIP) Guide 4.0,” January 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

64. VA Memorandum “Proper Use of Email and Other Messaging Services,”

January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

65. “DevSecOps Product Line Management Playbook” version 2.0, May 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

66. NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020

67. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol

Version 6 (IPv6),” November 19, 2020

68. Social Security Number (SSN) Fraud Prevention Act of 2017

69. Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23,

70. Executive Order on the Safe, Secure, and Trustworthy Development and

Use of Artificial Intelligence, October 30, 2023

71. VA’s Organizational Changes Management Playbook (Directive 0213) https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514 https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896 https://www.cisa.gov/publication/tic-30-core-guidance-documents https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371 https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946 https://dvagov.sharepoint.com/sites/oitcmhub/Shared%20Documents/Forms/AllItems.aspx?id=%2Fsites%2Foitcmhub%2FShared%20Documents%2FOCMPlaybook%2D180212%2Epdf&parent=%2Fsites%2Foitcmhub%2FShared%20Documents

3.0 SCOPE OF WORK

The Contractor shall provide IT support services to assist EUS/EUO in achieving its mission of serving Veterans and the public by delivering effective Endpoint Support and Operations Monitoring (ESOM) of EUS/EUO programs and processes within the VA.

Major work areas for this effort shall include program management, investment and portfolio management, human capital management, financial management, logistics management and timely data reporting. To aid in the modernization and standardization efforts that EUO has defined in its response strategies, the Contractor shall perform and execute Support Services consisting of program/project management; IT operations and services to include systems, application, and database administration; software/system technical support; as well as remediation support services performing OIT remediation processes and EUS disaster recovery planning for sustainment of operations.

Performance and support may be also adjusted to support initiatives in consolidating, transforming, and modernizing IT services across the enterprise.

4.0 PERFORMANCE DETAILS

4.1 PERFORMANCE PERIOD

The Period of Performance (PoP) shall be 8 (eight) months from date of award, with 4 (four) 12-month option period(s) and 6 (six) Optional Tasks. The overall Period of Performance shall not exceed 56 months.

Any work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO). (If required, the CO may designate the Contractor to work during holidays and weekends)

There are eleven (11) Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, four are set by date:

New Year's Day January 1 Juneteenth June 19 Independence Day July 4 Veterans Day November 11 Christmas Day December 25

If any of the above falls on a Saturday, then Friday shall be observed as a holiday.

Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

Martin Luther King's Birthday Third Monday in January Washington's Birthday Third Monday in February

Memorial Day Last Monday in May Labor Day First Monday in September Columbus Day Second Monday in October Thanksgiving Fourth Thursday in November

4.2 PLACE OF PERFORMANCE

Tasks under this PWS shall be performed both in VA facilities (Onsite) and in Contractor Facilities (Offsite) throughout the United States. For the tasks that must be performed onsite, the specific locations for work will be identified based on actual, shifting business needs and conditions when contract resources and staff are ready to be applied. The Contractor shall identify the Contractor’s place of performance in their proposal submission. If the task and business conditions allow, work may be performed at remote locations with prior concurrence from the Contracting Officer’s Representative (COR).

4.3 TRAVEL

The Government anticipates travel under this effort to perform the tasks associated with the effort, as well as to attend program-related meetings or conferences throughout the period of performance. Travel costs will be included in the task order award as a separate, cost-reimbursable, “not to exceed” line item. Travel shall be in accordance with the Federal Travel Regulations (FTR) and requires advanced concurrence by the Contracting Officer’s Representative (COR). Contractor travel within the local commuting area will not be reimbursed.

The contractor must obtain written approval from the Veterans Affairs (VA) Program Manager via the Contracting Officer Representative BEFORE any travel begins, utilizing the Travel Authorization Request form. Travel and per diem expenses will be reimbursed on an actual expenditures basis in accordance with Federal Travel Regulations and FAR 31.205-46. Travel that occurs without written pre-approval will NOT be reimbursed.

In order to be reimbursed for travel, the contractor shall submit supporting documentation as required by Federal Travel Regulations with invoices. Federal Travel Regulations require for any temporary travel destination you must provide a receipt to substantiate your claimed travel expenses for lodging and a receipt for any authorized expenses costing over $75 (FTR 301-11.25). Expenses for subsistence and lodging will be reimbursed to the contractor only to the extent where an overnight stay is necessary and authorized by Federal Travel Regulations in effect at the time of the stay for the specific location.

The total estimated number of trips; anticipated locations; and estimated duration of trips in support of the program related meetings for this effort is provided below.

Base Period

Estimated Destination (i.e., Round Trip Location)

Approximate Number of trips per period of performance

Approximate Number of Contractor

Personnel required per trip

Approximate Number of days per trip

Washington, DC 4 2 5 Austin, TX 4 4 5 Salt Lake City, UT 4 4 5 Seattle, WA 2 2 5 Chicago, IL 4 5 5 Bay Pines, FL 4 4 5 Atlanta, GA 1 1 5 Anchorage, AK 2 4 5 San Juan, PR 2 4 5

5.0 SPECIFIC TASKS AND DELIVERABLES

5.1 PROJECT MANAGEMENT (T&M)

5.1.1 CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, timeline, and tools to be used in execution of the contract. The CPMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks, and resource support. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPMP shall be concurred upon and updated in accordance with Section B of the contract. The Contractor shall update and maintain the VA PM approved CPMP throughout the PoP.

Deliverable:

A. Contractor Project Management Plan

5.1.2 REPORTING REQUIREMENTS

The Contractor shall provide the COR with weekly Progress Reports in electronic form in Microsoft Word and Project formats. The report shall include detailed instructions/explanations for each required data element, to ensure that data is accurate and consistent. These reports shall reflect data as of the last day of the preceding week.

The weekly Progress Reports shall cover all work completed during the reporting period and work planned for the subsequent reporting period. The report shall also identify any problems that arose and a description of how the problems were resolved. If problems have not been completely resolved, the Contractor shall provide an explanation including their plan and timeframe for resolving the issue. The report shall also include an itemized list of all Information and Communication Technology (ICT) deliverables and their current Section 508 conformance status. The Contractor shall monitor performance against the CPMP and report any deviations. It is expected that the Contractor will keep in communication with VA accordingly so that issues that arise are transparent to both parties to prevent escalation of outstanding issues.

Deliverable:

A. Monthly Workload Summary

5.2 MONTHLY WORKLOAD MEETINGS

The contractor shall conduct a monthly workload review meeting with the COR and EUS Technical Team. The Contractor shall prepare a summary of assignments every month to present. The summary shall include tasks assigned and by whom, risks and issues to be reviewed, and statistical evidence of overall success. This report shall detail activities undertaken and results. This report shall be 7-10 slides, preferably using Microsoft PowerPoint format, and may include supplemental files in Microsoft Project, Microsoft Excel, Microsoft Word, or Adobe PDF formats.

A. Monthly Workload Meetings B. Monthly Summary Workload Reports

5.3 TECHNICAL SERVICES (T&M)

EUS provides onsite and remote support to IT customers across all VA Administrations and special program offices, including direct support of over 340,000 VA employees and thousands of contractors who use government-furnished IT equipment and infrastructure. The contractor shall provide support staff across 50+ CONUS and OCONUS locations including difficult-to-accommodate locales, such as high cost of living or under supported economic areas, where VA offices or facilities may be located and require onsite services.

5.3.1 ENDPOINT MONITORING AND PERFORMANCE OPTIMIZATION

The Contractor shall support the VA’s system monitoring framework that utilizes both passive and active monitoring tools (including Tachyon, Configuration Manager) to continuously assess the health and performance of all endpoint devices within the VA network. The monitoring includes maintaining thresholds for system performance indicators such as CPU usage, memory consumption, network latency, and disk space utilization. The Contractor shall deploy VA’s provided predictive analytics tools to forecast future system load and capacity requirements based on historical trends and projected operational needs. The Contractor shall collect and report required systems performance metrics, and augment and report any situation where an increase in processing, scaling, or storage are required. Automated alerts shall be established to notify VA OIT endpoint monitoring and engineering teams of potential issues. The Contractor shall deliver a Performance Report that includes data-driven insights into system utilization, identification of potential bottlenecks, record of system outages or performance dips, and a log of automated alerts triggered throughout the month. The report should propose specific actions to enhance system performance, such as hardware upgrades, software updates, or changes in system configuration.

A. Performance Reports

5.3.2 SYSTEM ACCESS AND USER ADMINISTRATION

The Contractor shall provide a consolidated view of access control remediation efforts, ensure the accuracy of personnel data, and support seamless identity and access management operations throughout the VA. The Contractor shall manage, track, and enhance access control remediation efforts. This involves collaborating with stakeholders to coordinate and monitor access control activities, tracking remediation actions, and facilitating dashboard reporting to achieve effective application across the VA. The Contractor shall manage initiation of mandatory control objectives at the local level, automatic disabling of inactive end user accounts, and regular updating of service account passwords.

The Contractor shall assist in improving personnel security by ensuring accurate data management in VA systems used for background checks, updating risk designation data, and maintaining fingerprint and background investigation records. They shall also support the Enterprise Service Desk (ESD) by developing and enhancing identity and access management processes, managing network access accounts, and providing specialized training and documentation for system users and technicians. These efforts are aimed at tightening security controls and enhancing the overall management and efficiency of access within the VA.

The Contractor shall assist in establishing and monitoring of system access controls and user accounts to ensure data access is limited to authorized personnel, and to provide access to accounts, files, and work areas for those users requiring access. The Contractor shall support managing and overseeing the access control systems for the VA's IT infrastructure, which involves establishing strict protocols to ensure that access to sensitive data and systems is limited to authorized personnel only. The Contractor shall assist with the entire lifecycle of user access, from the initial setup of accounts to the regular auditing and eventual decommissioning of accounts. The Contractor shall support key activities which shall include:

1. Creation and Maintenance of Access Protocols: Develop and implement robust access control protocols that comply with all VA standards and security regulations as outlined in Section 2. above, including setting up role-based access controls (RBAC) that define what resources a user can access based on their role within the organization.

• User Account Management: Manage user accounts throughout their lifecycle, ensuring secure and efficient provisioning, modification, and revocation of access as needed, including implementing joiner-mover-leaver (JML) processes to update access rights as employees change roles within the VA or leave the organization.

• Authentication Enhancements: Deploy multi-factor authentication (MFA) across all critical systems to add an additional layer of security, reducing the risk of unauthorized access.

• Coordinate with OIT and OIS for monthly scheduled Security Audits: Conduct scheduled monthly and quarterly security audits and reviews to ensure compliance with established access controls, identifying and remedying any deviations or breaches in protocol.

The Contractor shall capture comprehensive logs of all user account activities, including account creations, modifications, and deletions, audit results highlighting compliance levels, discrepancies found, and corrective actions taken. The Contractor shall analyze the effectiveness of current access controls with recommendations for improvements.

The Contractor shall document any security incidents related to user access and the subsequent response actions in a semi-annual System Access and User Administration Report and Quarterly Access Audit Report.

Deliverables:

A. System Access and User Administration Report B. Quarterly Access Audit Report

5.3.3 OPERATING SYSTEM AND APPLICATION ADMINISTRATION

The Contractor shall assist maintaining operating systems and applications to include ensuring that all systems are up-to-date, secure, and optimized for performance. The Contractor shall provide support for Macintosh and Windows endpoint devices. The Contractor shall ensure installed operating systems and software packages are patched and maintained to current version in accordance with Government guidelines and regulations.

The Contractor shall provide comprehensive application administration support services for IT operations software, at an enterprise level, to include installation, maintenance, and administration of the application, as well as offering subject matter expertise for configuring and customizing the application. The Contractor shall also assist in setting up and maintaining user accounts, interfacing with other software applications, compiling reports, and responding to customer requests. Monitoring of open tickets in VA’s ServiceNow customer incident ticketing system shall ensure adherence to business processes, and any discrepancies identified shall be reported with proposed corrective actions for approval before implementation.

The Contractor shall maintain and update knowledge-based documents, evaluate application configurations, and provide recommendations for improvements within the ITIL framework. The Contractor shall set up essential administration components like notifications, service level agreements, and service contracts. All system changes shall be documented in accordance with VA policy and current change management framework. The Contractor shall also support the installation and configuration of VA Technical Reference Model third-party software applications and assist users, software vendors, and other administrators with application-related problems and projects. New releases, functionalities, and patches shall be implemented as part of ongoing support efforts, ensuring the applications operate efficiently and effectively.

The Contractor shall deliver an Operating System and Application Administration Report that includes a detailed log of all system updates, patches applied, and any configuration changes made during the quarter. The report shall include performance metrics and any optimization actions taken as well as a summary of security assessments conducted, vulnerabilities found, and mitigations applied. The Contractor shall deliver a Semi-annual Administration Summary, including semi-annual summaries of operating system updates, application administration activities, and system health status, as well as recommendations for future system enhancements or upgrades based on observed trends and technological advancements.

A. Operating System and Application Administration Report B. Semi-annual Administration Summary

5.3.4 ENDPOINT SECURITY MANAGEMENT

The Contractor shall support and maintain the backup solution, run, and monitor scheduled backups of the systems and data files, perform restoration as necessary, and execute periodic tests to include quarterly Disaster Recovery scenarios and ensure backups can reconstruct working systems within VA guidelines. The Contractor shall provide backup, archiving, and patching capabilities to monitor and control endpoints and their underlying infrastructure.

The Contractor shall assist enhancement of endpoint security being implemented in a layered security strategy that includes endpoint detection and response (EDR) systems, regular vulnerability scanning, and real-time threat detection capabilities. This strategy comprised of a robust patch management system to ensure all devices are up to date with the latest security patches and updates. The Contractor shall follow the endpoint security policy that includes encryption standards, access controls, and user authentication protocols. The Contractor shall provide security training sessions to educate end users on potential security threats and best practices for maintaining endpoint security. The Contractor shall deliver a comprehensive quarterly Security Report that includes an overview of the security landscape, detailed findings from the security audits, an update on the status of patch management, records of any security incidents or breaches and respective responses. The report shall evaluate the effectiveness of the implemented security measures and recommend any necessary adjustments to the security strategy. The Contractor shall conduct annual assessments of endpoint security and provide detailed analysis of security posture and improvement plans in a comprehensive Annual Security Assessment.

A. Security Report B. Annual Security Assessment

5.3.5 INCIDENT MANAGEMENT AND RESOLUTION

The Contractor shall be on standby to respond to critical incidents with predefined escalation paths and ensure timely resolutions according to VA’s implementation of Information Technology Infrastructure Library (ITIL) standards for timeliness for Critical Priority Incidents (CPIs) and High Priority Incident (HPIs).

ITIL examples of SLA requirements based on priority include the following:

Priority 1 - Respond within 10 minutes, resolve within 4 hours.

Priority 2 - Respond within 15 minutes, resolve within 8 hours.

Priority 3 - Respond within 1 hour, resolve within 48 hours.

The Contractor shall conduct reviews of incident trends to identify recurring issues and underlying causes, enabling continuous improvement in incident management protocols. The Contractor shall deliver a detailed Monthly Incident Report, which shall include analytics on the number of incidents recorded, categorized by type and severity, resolution times, success rates, and any escalations. The report shall also highlight any major incidents, the responses enacted, and post-mortem analysis to prevent future occurrences. Additionally, trend analysis shall be used to recommend improvements in the incident management process.

A. Monthly Incident Report

5.3.6 DATA INTEGRATION AND SYSTEMS UPGRADE

The Contractor shall provide system change proposals and alternative solutions to current or newly requested processing requirements. The Contractor shall work in ServiceNow and submit change requests for approval and implementation. The Contractor shall assist the integration of disparate data systems across the VA to ensure seamless data flow and accessibility, to include designing and implementing custom Application Programming Interface (APIs), upgrading legacy systems to support modern data exchange standards, and ensuring data integrity during the transfer processes. The Contractor shall assist in the coordination of major system upgrades to introduce new functionalities and improve system efficiencies, involving careful planning and execution to minimize downtime and ensure compatibility with existing systems.

The Contractor shall deliver a System Upgrade and Integration Report that details the integration efforts undertaken, the systems upgraded, the challenges encountered, and the benefits realized from these activities made during the year. This report shall also assess the impact of these upgrades on overall system performance and user satisfaction, with a roadmap for future integration and upgrade projects.

A. System Upgrade and Integration Report

5.3.7 COMPLIANCE AND QUALITY ASSURANCE

The Contractor shall augment, schedule, test, and implement all changes to the environments, including hardware, software, and network modifications, in accordance with VA’s change control process. The Contractor shall install and monitor VA’s existing system configuration tools to perform configuration assessment and change auditing and address regulatory and security-compliance issues. The Contractor shall provide technical evaluation of systems and provide alternative solutions to current or newly requested processing requirements. Evaluation shall include options and advice for migration among SaaS, PaaS, and IaaS to determine optimal solutions for VA applications. The Contractor shall perform gap analyses and technical assessments to identify system vulnerabilities and inefficiencies. The Contractor shall propose solutions to improve system reliability and performance. The Contractor shall assist with conducting regular compliance audits and quality assurance tests across all systems to ensure adherence to national and international standards, VA policies, and industry best practices, which includes the development of comprehensive test plans that cover functional, performance, security, and compliance testing. The Contractor shall assist in the implementation of a continuous improvement protocol to address any findings from these audits and tests promptly, ensuring that all systems remain compliant and function optimally. The Contractor shall deliver Semi-annual Compliance Review Minutes that outlines the testing methodologies used, the results of the tests conducted, any non-compliance issues identified, and the corrective actions taken during the year.

The report shall also include recommendations for enhancing the testing protocols and compliance measures based on the latest industry trends and regulatory changes.

A. Semi-annual Compliance Review Minutes

5.3.8 VIDEO TELECONFERENCING SUPPORT

The Contractor shall provide Video Teleconferencing (VTC) support that includes hardware and software installation and maintenance. The Contractor shall provide VTC room facilitators who assist with onsite services and support to include, but not limited to the following tasks:

• VTC/Secure VTC (SVTC) scheduling and connectivity

• Setup, testing, and operations of audio and video equipment including AV racks, touch panels, microphones, video screens, projectors, video monitors, recording equipment, connecting wires and cables, sound and mixing boards, and related electronic equipment

• Attendance at VTC/SVTC (by request only)

• Customer support and troubleshooting of VTC/SVTC and equipment

• Audio and Video call setup procedures with the VA VTC Bridge

• Assist with end user training on conference room VTC/SVTC equipment

• Asset Management to include VTC endpoint upgrades (HW/SW) as required

• Assist with incident management, problem management, configuration management and ITSM related tasks as required using VA Enterprise ISTM suite of tools

• Coordinate with and provide Video conference support for VTCs

• Install, configure, and implement applicable Information Assurance security policies, guidelines, and requirements such as, the Defense Information Services Agency (DISA) Security Technical Implementation Guides (STIGs) and Information Assurance Vulnerability Alert (IAVA) patches as required to maintain the local IT infrastructures as they relate to VTC systems

• Load and configure VA VNC approved IPV conferencing software applications onto IPV network appliances or customer End User Devices (EUDs)

• Onsite assistance with the VA VNC to support and maintain enterprise VTC/SVTC infrastructure located at DHHQ locations; this shall include but is not limited to bridges, IP and ISDN gateways, gatekeepers, and other hardware appliances and applications supporting audio and video conferencing services

• Provide a Quarterly Service Performance Report including details on video teleconferencing support services, user satisfaction, and technology reliability

A. Quarterly Service Performance Report

5.3.9 END USER SERVICES TRAINING AND SUPPORT

The Contractor shall develop a comprehensive Training Package tailored to the needs of VA staff, as identified by the Government, focusing on the effective use and maintenance of the IT infrastructure. The Training Package includes user manuals and online training modules and shall be accompanied by interactive workshops that cover a range of topics from basic system operations to advanced troubleshooting techniques.

The Contractor shall deliver a Training Report that provides details on the training sessions conducted, including topics covered, attendee numbers, feedback received, and effectiveness assessments made during the past quarter. The report shall outline plans for future training sessions based on staff feedback and emerging IT trends, ensuring that VA staff remain proficient in using the VA’s IT systems.

The contractor shall assist with the preparation of presentation materials for various EUS partner meetings and create custom graphics as required. The Contractor shall assist in drafting, editing, and storing all standard operating procedures (SOPs), surveys, and job aids as directed by the government, ensuring each step meets approval standards. The Contractor shall plan and facilitate knowledge-sharing sessions, such as "lunch and learn" events, to disseminate information on monitoring and event management practices.

The Contractor shall provide an Annual Training Summary, including summaries of end-user training sessions conducted, participation metrics, and effectiveness assessments.

A. Training Package B. Training Report C. Annual Training Summary

5.3.10 ENDPOINT SECURITY CONFIGURATION SUPPORT

The Contractor shall support configuration management controls and security protection across all IT operations components, aligning with the requirements of the Federal Information Security Management Act (FISMA) and the Federal Information System Controls Audit Manual (FISCAM). This support extends to the implementation of recommendations from current and future audits. The Contractor shall also assist OIT and field facilities in addressing critical material weaknesses (MW), as well as findings and recommendations related to configuration management identified by the VA Office of Inspector General (OIG).

The Contractor shall provide configuration management vulnerabilities support by conducting information security analyses and generating documentation to aid the standardization of processes, technology configurations, and security controls across the VA. This involves the continuous tracking, monitoring, and reporting of any completed remediations or identified vulnerabilities in the Vulnerabilities and Remediation Status Report, which shall be submitted to the Contracting Officer’s Representative (COR) for review and approval. The Contractor shall develop recommendations, white papers, and other documents to enhance the security processes and documentation of ITOPS, with all drafted materials provided to the COR.

The Contractor shall provide a Semi-annual Security Configuration Report documenting endpoint security configuration, compliance status, and any identified security risks.

A. Vulnerabilities and Remediation Status Report B. Semi-annual Security Configuration Report

5.3.11 FISCAL AND FINANCIAL PLANNING SUPPORT

The Contractor shall provide financial analysis support for non-inherently Governmental fiscal and financial planning tasks. This includes surge support for fiscal activities such as data collection, tracking, reporting, process development, and the implementation of quality assurance checks. Key areas of focus include Unfunded Requests (UFRs), the use of Budget Tracking Tool (BTT), Integrated Financial and Acquisition Management System (iFAMS), and Multi-Year Planning (MYP), excluding budget formulation and planning.

The Contractor shall prepare purchase orders using VA financial systems including but not limited to those noted above, monitor budget execution, and provide direct support to Government employees overseeing various funding sources including annual appropriations, construction funding, and franchise funds. The Contractor shall create and update entries in BTT and prepare detailed financial reports to keep management informed of financial statuses and projections. This structured financial oversight and reporting is designed to enhance the operational efficiency and financial transparency of the organization. Contractor shall provide a Quarterly Financial Performance Report detailing budget execution, funding allocation, and financial planning effectiveness.

Deliverable:

A. Quarterly Financial Performance Report

5.3.12 ADMINISTRATIVE AND MANAGEMENT SUPPORT

The Contractor shall provide comprehensive support to OIT Service business and Chief of Staff offices, handling a variety of administrative tasks crucial for day-to-day operations. This support includes assisting in timekeeping activities, monitoring the Service email box, distributing both physical and electronic mail, and assisting in the development of travel and training documents. The Contractor shall be responsible for setting up, attending, and documenting meetings. Additional responsibilities include routing and managing action items and taskings, handling routine inquiries, and directing calls appropriately.

The Contractor shall adhere to OIT administrative processes for timekeeping, resolve discrepancies in timecards, and contact relevant personnel for corrections as needed.

The Contractor shall facilitate and schedule appointments, coordinate meetings, and handle the reservation and setup of conference spaces, ensuring that all meeting-related activities are promptly scheduled upon request. The Contractor shall prepare interoffice and executive correspondence, maintain an administrative filing system with internal controls, and keep updated operating and desk procedures. The Contractor shall manage the Service's email inboxes to ensure timely action and prepare various reports and documents to ensure they are routed or mailed to designated sources after obtaining necessary approvals.

The Contractor shall assist in preparing travel documents, completing travel vouchers, and handling office supply management, including tracking and coordinating requests.

The Contractor shall prepare supply reports and fact sheets to support decision-making processes within the Service. The Contractor shall provide a monthly Administrative Support Summary summarizing administrative activities, achievements, and operational challenges.

A. Monthly Administrative Support Summary

5.3.13 COMMUNICATIONS, DOCUMENTATION, BUSINESS PROCESS, AND

CORRESPONDENCE SUPPORT

The Contractor shall provide technical writing support to include creating, editing, standardizing and error-free, publishable content. The Contractor shall develop templates, reports, charts, tables, and presentations using Microsoft Office and Adobe Acrobat. The Contractor shall use Microsoft Visio to create complex workflow diagrams and process models, lead process owners in developing documentation for OIT work products and maintain SharePoint workflow processes integrated with Microsoft Outlook. This support extends to meeting facilitation, note-taking, ensuring Section 508 compliance, and developing reports using PowerBI.

The Contractor shall analyze IT business and information processes to identify risks and opportunities for increased efficiencies and provide recommendations to improve OIT business processes. The Contractor shall be responsible for preparing various business agreements such as Service Level Agreements (SLAs), rough order of magnitude (ROM) estimates, and records maintenance. This work includes monitoring agreements, researching variances, and documenting revised projections with customers, vendors, and peer organizations. The Contractor shall respond to customer inquiries regarding business-related matters, gather data for annual business planning, and provide timely updates on the status of assigned tasks. The Contractor shall work on special projects related to business process efforts, gap analyses, feasibility studies, and trade-off analyses. The Contractor shall prepare business cases for IT solutions, present findings and recommendations to various audiences, and use the standard OIT change management system for managing assignments and work products. The Contractor shall prepare an Annual Documentation and Process Improvement Report on communications effectiveness, business process optimizations, and documentation updates.

A. Annual Documentation and Process Improvement Report

5.3.14 KNOWLEDGE MANAGEMENT AND INTRANET SUPPORT

The Contractor shall provide support and development services for current versions of Microsoft SharePoint Server (MOSS), addressing both application and infrastructure components. This involves the strategic assessment and facilitation between different SharePoint versions and related products, with responsibilities including architectural design, web parts development, and the management of server installations to plan, deploy, and support SharePoint implementations effectively.

The Contractor shall offer technical guidance to SharePoint developers and administrators, collaborate with site collection stakeholders to develop and migrate SharePoint solutions that are scalable and compliant with VA's privacy and security policies. The Contractor shall provide training sessions to enhance user capabilities, implement advanced functionalities, process content requests, create and maintain websites. The Contractor shall establish and manage a centralized knowledge repository in SharePoint and implement and maintain knowledge management tools and platforms. Regular assessments shall be conducted to identify gaps and recommend improvements. Performance metrics shall be established and monitored to assess the effectiveness of knowledge management initiatives and provide a Semi-annual Knowledge Management Review of knowledge management practices and intranet usage statistics, including user feedback and suggested improvements.

A. Semi-annual Knowledge Management Review

5.4 INFRASTRUCTURE SUPPORT (T&M, OPTIONAL)

5.4.1 SURGE SUPPORT

The Contractor shall provide deployable surge teams with to assist locations with operational challenges. Tasks shall include, but are not limited to:

• Activations: IT asset deployment, customer transitions, and decommissioning of aged devices. The objective is to have activation areas ready from day one.

• Lifecycle Refresh: Deploy lifecycle refresh equipment, manage workstation provisioning, and handle the decommissioning of outdated devices.

• Equipment Accountability: Conduct physical scans, manage turn-ins and decommissions of assets, and organize warehouse spaces.

• Obsolescence: Turn-in processing of aged equipment, inventory of deployed equipment, removal of aged…