FSC IT Operations Support RFI PWS.docx

FSC Financial Technology Services

VA-24-00018197

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

FINANCIAL SERVICES CENTER (FSC)

INFORMATION TECHNOLOGY OPERATIONS SUPPORT

Date: 29 November 2023

VA-24-00018197

PWS Version Number: 0.2

Contents

BACKGROUND

The U.S. Department of Veterans Affairs (VA) continues its pursuit to make America’s Veterans a priority; to serve and honor the men and women who are America’s Veterans. VA is committed to five core values that define “who” we are and how we care for Veterans. The core values are Integrity, Commitment, Advocacy, Respect, and Excellence.

The VA Financial Services Center (FSC) is a Franchise Fund site authorized pursuant to the Government Management Reform Act of 1994 (Public Law 103-356). The Act authorizes designated agencies to provide certain common administrative support services on a reimbursable basis both internally and to other Government agencies. Permanent status was conferred upon the VA Franchise Fund under the “Military Quality of Life and Veterans Affairs Appropriations Act, 2006,” Public Law 109-114. Consequently, the VA FSC receives no federally appropriated funding and is required to market VA FSC services to customers. As such, the VA FSC provides financial services to VA as well as other government agencies (OGAs).

The mission of the VA FSC Financial Technology Service (FTS) is to provide high-quality IT infrastructure, software engineering, including system and data, Architecture, Electronic Commerce (EC)/Electronic Data Interchange (EDI) (EC/EDI), and system and database support services to the FSC in support of the FSC's overall mission of providing high-quality financial services, exceeding the expectations of our Federal customers, inspiring their trust and empowering them to focus on their core missions.

VA FSC Data Analytics Service (DAS) is dedicated to creating, promoting, encouraging, and advancing a full range of analytical tools. These tools drive evidence-based program decisions, cost savings, process improvements, identification of fraud, waste, and abuse, budget forecasts, and management efforts to drive innovation. Analytical tools aid in efficient delivery of VA programs that ensure Congressional funding is utilized to a level that honors the commitment of VA, which in turn ensures VA continues meeting the mission to make the Veterans a priority for the Nation. DAS offers financial monitoring tools and analytics which drive technological solutions to help propel the responsible use of the Nation’s VA hospitals and facilities to ensure that our Veterans, and their families, are cared for and provide for a resilient future.

In November 2018, VA issued the Cloud First Policy mandating that all new and existing IT solutions be assessed to determine suitability to be offered as an enterprise cloud computing service. The VA Enterprise Cloud (VAEC) was established by the Enterprise Cloud Solutions Office (ECSO) in 2017, to host cloud computing solutions. VA anticipates that solutions shall be deployed in the VAEC as defined in VA’s Use of the VAEC to Host Solutions and Use of Cloud-Based Native Technologies and Approaches Policies.

APPLICABLE DOCUMENTS

1. VA Enterprise Cloud Technical Reference Guide, Version 1.3 July 2018

2. VA Cloud-First Policy, November 15, 2016

3. Use of the VA Enterprise Cloud (VAEC) to Host Solutions, January 16, 2018

4. Use of Cloud-Based Native Technologies and Approaches, April 10, 2018

5. The Health Information Technology for Economic and Clinical Health Act (HITECH) Act (https://www.govinfo.gov/content/pkg/PLAW-111publ5/html/PLAW-111publ5.htm)

6. Electronic Communications Privacy Act of 1986: (https://www.govinfo.gov/content/pkg/STATUTE-100/pdf/STATUTE-100-Pg1848.pdf)

7. 44 U.S.C. § 3541-3549, “Federal Information Security Management Act (FISMA) of 2002”

8. “Federal Information Security Modernization Act of 2014”

9. Federal Information Processing Standards (FIPS) Publication 140-2, “Security Requirements for Cryptographic Modules”

10. FIPS Pub 199. “Standards for Security Categorization of Federal Information and Information Systems,” February 2004

11. FIPS Pub 200, “Minimum Security Requirements for Federal Information and Information Systems,” March 2006

12. FIPS Pub 201-2, “Personal Identity Verification of Federal Employees and Contractors,” August 2013

13. 10 U.S.C. § 2224, "Defense Information Assurance Program"

14. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

15. Public Law 109-461, Veterans Benefits, Health Care, and Information Technology Act of 2006, Title IX, Information Security Matters

16. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”

17. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, https://www.va.gov/vapubs/index.cfm

18. VA Handbook 0710, “Personnel Security and Suitability Program,” May 2, 2016, https://www.va.gov/vapubs/index.cfm

19. VA Directive and Handbook 6102, “Internet/Intranet Services,” August 5, 2019

20. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and Guidelines,” January 18, 2017

21. Office of Management and Budget (OMB) Circular A-130, “Managing Federal Information as a Strategic Resource,” July 28, 2016

22. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed Services (CHAMPUS)”

23. NIST SP 800-66 Rev. 1, “An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule,” October 2008

24. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended, January 18, 2017

25. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

26. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021

27. VA Handbook 6500, “Risk Management Framework for VA Information Systems VA Information Security Program,” February 24, 2021

28. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI),” March 12, 2019

29. VA Handbook 6500.5, “Incorporating Security and Privacy into the System Development Lifecycle,” March 22, 2010

30. VA Handbook 6500.6, “Contract Security,” March 12, 2010

31. VA Handbook 6500.8, “Information System Contingency Planning,” April 6, 2011

32. VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018

33. VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017

34. OIT Process Asset Library (PAL), https://www.va.gov/process/ . Reference Process Maps at https://www.va.gov/process/maps.asp and Artifact templates at https://www.va.gov/process/artifacts.asp

35. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

36. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014

37. VA Handbook 6508.1, “Procedures for Privacy Threshold Analysis and Privacy Impact Assessment,” July 30, 2015

38. VA Handbook 6510, “VA Identity and Access Management,” January 15, 2016

39. VA Directive and Handbook 6513, “Secure External Connections,” October 12, 2017

40. VA Directive 6300, “Records and Information Management,” September 21, 2018

41. VA Handbook, 6300.1, “Records Management Procedures,“ March 24, 2010

42. NIST SP 800-37 Rev 2, “Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy,” December 2018

43. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020)

44. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015

45. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” March 24, 2014

46. OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005

47. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019

48. OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008

49. Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance, December 2, 2011, (NOTE: Part A of the FICAM Roadmap and Implementation Guidance, v2.0, was replaced in 2015 with an updated Architecture (https://arch.idmanagement.gov/#what-is-the-ficam-architecture)

50. NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access,“ June 2018

51. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, “Digital Identity Guidelines,” updated March 02, 2020

52. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014

53. NIST SP 800-164, “Guidelines on Hardware-Rooted Security in Mobile Devices (Draft),” October 2012

54. Draft National Institute of Standards and Technology Interagency Report (NISTIR) 7981, “Mobile, PIV, and Authentication,” March 2014

55. VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

56. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

57. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

58. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

59. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019

60. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008

61. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (Public Law 110–140), December 19, 2007

62. Section 104 of the Energy Policy Act of 2005, (Public Law 109–58), August 8, 2005

63. Executive Order 13834, “Efficient Federal Operations,” dated May 17, 2018

64. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 2, 2001

65. VA Directive 0058, “VA Green Purchasing Program,” July 19, 2013

66. VA Handbook 0058, “VA Green Purchasing Program,” July 19, 2013

67. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

68. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

69. “Veteran Focused Integration Process (VIP) Guide 4.0,” January 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

70. VA Memorandum “Proper Use of Email and Other Messaging Services,” January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

71. “DevSecOps Product Line Management Playbook” version 2.0, May 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

72. NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020

73. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol Version 6 (IPv6),” November 19, 2020

74. Social Security Number (SSN) Fraud Prevention Act of 2017

75. Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23, 2018

SCOPE OF WORK

The Contractor shall provide on-site professional services to support the FSC FTS, Data Analytics Service (DAS), and its current and future Divisions and Branches. Current FTS branches are Operations and Maintenance (OMD), IT Business Operations Division (ITBOD), Program Management Office (PMO), and Financial Management Business Transformation (FMBT). Additionally, the Contractor shall provide support of the FSC IT infrastructure, operations, projects, and various initiatives supported by FSC on behalf of VA and OGAs. The current technical environment to be supported is described in PWS section 3.3.

The Contractor shall provide support services and develop deliverables for all FSC projects including new software projects, maintenance releases, and emergency software releases. Services and workload will support FSC’s current and potential projects which are both internal to FSC and external projects for other VA customers and potentially other Government entities. The Contractor shall support projects which frequently include, but are not limited to, the following core business areas: financial management, fraud, waste, and abuse, supply chain, category management, purchase card, internal compliance management, acquisition obligations, healthcare, travel, and other initiatives.

All deliverables shall align with the Veterans-Focused Integration Process (VIP). The Contractor shall perform resource planning in support of new software projects, maintenance releases, emergency software releases, and operations and maintenance support. The Contractor shall manage resource levels and coordinate with FSC Project Managers and FTS management, as needed, to understand schedule timelines.

Technical Writing support may be allocated to divisions other than OMD and HPO upon Contracting Officer’s Representative (COR) approval to support surges in activity.

The scope of services required includes the following functional areas and tasks:

i. Software as a Service (SaaS)

ii. Platform as a Service (PaaS)

iii. Infrastructure as a Service (IaaS)

iv. Database as a Service (DaaS)

APPLICABILITY

This Task Order (TO) effort PWS is within the scope of paragraph(s) 4.1.2: Standards, Policy, Procedure and Process Development, and Implementation Support, 4.1.4: Technology Refresh and Configuration Reviews, 4.1.6: Program Management Support, 4.6.1: Systems/Network Administration, 4.6.2: Network and Telecommunications Infrastructures, 4.9: Operations and Maintenance, and 4.10: Training of the T4NG Basic PWS.

ORDER TYPE

The effort shall be proposed on a Time and Materials (T&M) basis with a Cost Reimbursable Travel line item.

DESCRIPTION OF CURRENT TECHNICAL ENVIRONMENT

Following is an overview of the current VA-FSC IT Infrastructure and Technical Environment:

3.3.1 VA FSC IT SOFTWARE INFRASTRUCTURE

Following is an overview of the current VA-FSC IT Infrastructure and Technical Environment:

The VA-FSC IT Software Infrastructure consists, but is not limited to, the following products:

3.3.2 VA FSC IT IN-HOUSE DEVELOPED APPLICATIONS

The VA-FSC currently provides production support and maintenance for over 100 in-house developed applications and reporting systems, which were created with Microsoft Visual Studio, Eclipse, and Pega BPM development tools. VA estimates that this will increase over the life of this Task Order. Most of these applications include custom code and Commercial Off the Shelf (COTS) software.

3.3.3 VA FSC IT HARDWARE INFRASTRUCTURE

The VA-FSC IT hardware infrastructure primary resides in two VA enduring data centers and consists of:

A. Physical Servers

B. Storage Area Network (SAN) – The FSC’s Storage Area Network (SAN) with total storage at approximately four (4) Petabytes (PB) combined between the two above locations.

C. Over 1500 PCs. A workstation PC can be either a desktop PC or a notebook PC.

D. Approximately 20 Multi-Function devices for printing, scanning, faxing, and copying; and various other network and stand-alone printers.

E. Two (2) IBML ImageTrac high-speed scanners.

3.3.4 VA FSC LOCAL AREA NETWORK

The VA-FSC local area network (LAN):

A. Consists of primarily Cisco routers and switches with some F5 load balancing appliances within each data center location.

B. Connects to the Internet and to the VA intranet via a redundant pair of VA supplied network connections.

3.3.5 VA EC/EDI ENVIRONMENTS

The following provides overview information about the VA Gentran EC/EDI environment:

a. Is comprised of the Sterling Gentran for Multiple Virtual Storage (MVS) version 6.5 software, which is installed on an IBM z/900.

b. The translated data interfaces with multiple mainframe based legacy applications, such as the VA Financial Management System (FMS), the VA Personnel and Accounting Integrated Data (PAID), the VA-FSC Document Management System (DMS), and the VA Data Management Interface (DMI) and server based software, such as the Instream HIPAA validation tool and TrustedLink Enterprise

c. The mainframe legacy applications are written in COBOL and the server-based applications are written in Microsoft .Net or Visual Studio environment. The following are applications maintained by the FSC:

1. e-Claims application processes flat file medical insurance claims received in Austin from the VA medical centers. These claims are translated into a compliant ASC X12 837 transaction and sent over a dedicated connection to a clearinghouse. The clearinghouse forwards the ASC X12 837s on to the payers following internal business rules. The VA currently sends out secondary claims for processing to the clearinghouse. The determination is made at the FSC, by referring to a table of payers accepting electronic secondary claims, whether the secondary claim is to be processed electronically by the clearinghouse, or printed and mailed to the payers. All transactions received from the medical centers, via MailMan, are processed into the DMI system or extraction by the application. FSC IT staff are currently working on the processes and procedures to establish a second clearinghouse to process X12 837 transactions.

2. e-MRA (Medicare Remittance Advice) application processes the electronic ASC X12 835 transactions received in Austin from the clearinghouse. As the VA is not paid by Medicare, to create a secondary claim with the Medicare allowable information, the VA has contracted with an independent vendor to process the VA primary Medicare claims and return the allowed/disallowed information. The Accredited Standards Committee (ASC) X12 835 is translated by the FSC and sent to the VA medical centers for processing. The information is used in creating the secondary claim for Veterans having additional medical coverage. All transactions sent to the medical centers, via MailMan, are processed into the DMI system by the application.

3. e-Reports applicable application provides a customer a series of reports related to the processing of electronic transactions in support of the Veterans Health Administration (VHA) Medical Care Collection Fund (MCCF) activities.

4. e-Payments application processes the electronic ASC X12 835 electronic remittance advice (ERA) transactions and ASC X12 835 electronic fund transfers (EFT) transactions received in Austin from the clearinghouse. These transactions are translated by the FSC to a flat-file format and sent to the VA medical centers for processing. All transactions sent to the medical centers, via MailMan, are processed into the DMI system by the application.

5. 277STAT is a variation on the ASC X12 277 transaction which is used to notify the VA medical stations as to the various actions and acceptability/status of the claims. These are delivered to the medical centers via MailMan, after being processed into the DMI system by the application.

6. Financial applications support the processing of vendor invoices, purchase orders, payments, purchase order changes, billing documents, payment vouchers, electronic fund transfers (EFT).

d. Data is transferred between these internal systems and external systems: Veteran’s Health Administration (VHA) file servers, Veteran’s Benefits Administrations (VBA) servers, PNC Bank, Veterans Health Information Systems and Technology Architecture (VistA), and Healthcare Clearinghouses, using multiple VA approved communications protocols such as Virtual Private Networks VPN (VPNS), Mailman, and Secure File Transfer Protocol (SFTP).

3.3.6 VA TRUSTEDLINK ENTERPRISE (TLE)

The following provides overview information about the VA TrustedLink Enterprise (TLE) EDI environment:

a. Is comprised of TLE version 16.3.0.0 software, which is installed on a Windows 2019 server with three accompanying client interfaces (Catalyst Map, Mapping Workbench & Operations Center).

c. TLE, in combination with a COTS Business-to-Business (B2B) communications portal (Cleo VL Trader), is used and will be used to replace some current EDI translations and communications methods.

Currently, TLE is used to process healthcare claims and financial transactions and perform data extracts, transformation or translation, and load (ETL) processes.

3.3.7 AITC BUSINESSWARE ENVIRONMENT

The following provides overview information about the Vitria BusinessWare environment:

a. The Vitria BusinessWare environment is being migrated to Vitria BusinessWare version 4.8 (64-bit), AITC deployments are on Red Hat Enterprise Linux (RHEL) version 7 and are being migrated to RHEL-8.

The following are applications maintained by the FTS:

1. e-Insurance Verification (e-IV) application automates the discovery of health care insurance for those Veterans VA has no record of having insurance and determines the eligibility for claimed insurance. The FSC receives HL7 transactions from the VA medical centers. The FSC determines if the Veteran’s insurance is already on file with the FSC database. If the Veteran is not in the file, the application creates an ASC X12 270 transaction which is sent to the clearinghouse for processing to the payer. The payer’s response, an ASC X12 271 transaction, is transmitted through the clearinghouse to the FSC for translation to the medical center and updating of the FSC database.

2. e-Pharmacy application enables the VA to submit pharmacy claims electronically. VA pharmacies send pharmacy claims in NCPDP format wrapped on an HL7 transaction to the FSC for processing. The FSC unwraps the claims from their HL7 wrapper and send the NCPDP transaction to the clearinghouse for processing to the payers. The corresponding adjudication results are received by the FSC from the clearinghouse, wrapped and forwarded to the medical centers.

3.3.8 VA FSC VITRIA BUSINESSWARE ENVIRONMENT:

a. Comprised of Vitria version 4.7 (32-bit), installed on Windows 2019.

b. The following applications are hosted and maintained by FTS:

1. The Identity Management (IdM) Service provides the capability to search for a person’s unique identity across the VA organization. Within the current scope, the ECD IdM service utilizes the centrally managed IdM Service to fulfill person search requests based on their localized identity information or trait data. For all successful search requests, the service returns the matched person’s Integration Control Number (ICN) and other available data, in synchronous fashion. Otherwise, the service will return an exception with details.

2. The Identity Management (IdM) Subscription service provides the ability to receive automatic updates from the Master Veteran Index (MVI), Identity Management (IdM) system. The IdM Subscription service routes these updates to the end user application. The Veterans’ information in the end user application is updated when MVI makes changes to Veteran’s information.

3. The CPRS Service enables Purchased Care Non-VA Care (Fee Basis) Program consults entered into Veterans Health Information Systems and Technology Architectures (VistAs) Computerized Patient Record System (CPRS) consult package to be translated and routed to the Healthcare Claims Processing System (HCPS) which generates authorizations for care. When these consults are updated or cancelled in CPRS the changes are reflected in HCPS.

4. The Camp Lejeune Family Member (CLFM) Eligibility system allows medical providers to electronically verify medical benefit coverage for the CLFM program. Medical providers can submit an electronical request and receive member benefit information in real-time allowing medical services for CLFM patients.

3.3.9 EC/EDI PLATFORM UPGRADE

FSC will be migrating the above EC/EDI platforms to a solution based on MuleSoft software. The project to complete this migration is expected to complete by 2024.

PERFORMANCE DETAILS

PERFORMANCE PERIOD

The PoP shall be a12-month base period with four 12-month option periods.

Any work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO).

There are eleven (11) Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, five are set by date:

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

PLACE OF PERFORMANCE

Tasks under this PWS shall be performed in VA facilities, specifically, the VA FSC facilities located at the main FSC office at 7600 Metropolis Drive, Building 5, Austin, TX and other local satellite offices within Austin, Texas. During performance of this effort, work may also be performed at the following locations:

Philadelphia, PA 19144

Austin, Texas 78741

Washington, DC 20420

Minneapolis, MN 55417

North Little Rock, AR 72114

Neosho, MO 64850

Additional locations may be required throughout performance of this effort as VA FSC increases its customer portfolio.

Contractor employees may work off site on a case-by-case basis, with the approval of the COR and/or CO. The Contractor shall be within a commuting radius (50 miles) of the required duty station listed in the PWS placed under the terms of the task order. There shall be no additional cost to the Government for remote workers in terms of travel or labor rates.

When off-site work is permitted by the COR, the Contractor shall utilize the Government Furnished Equipment (GFE). The COR reserves the right to revoke the ability to telework as applicable.

TRAVEL

The Government anticipates travel under this effort to perform the tasks associated with the effort, as well as to attend program-related meetings or conferences throughout the PoP.

The total estimated number of trips in support of the program related meetings for this effort is 88. Anticipated locations include the following, estimated at 1-5 days in duration:

1. PITC support:

Secondary Location and Continuity of Operations (COOP) site: Austin FSC staff may be required to travel to the PITC facility, located at the address above.

1. Conferences:

To support activities under this effort, the Contractor may be required to attend the below conferences. Activities to be performed by the Contractor at these events shall include immersive hands-on training, workshops, roundtables, strategies to address the key priorities VA is working on, and an opportunity to connect with other IT leaders to provide VA with the most up to date technical information and support related to systems and services provided by VA FSC. These conferences shall only be attended with prior approval by the VA COR. The Contractor shall provide a Trip Report in accordance with PWS Paragraph 5.1.9.

a. Accredited Standards Committee’s x12 conference on conducting site visits: three times per year for at least two persons for four days per trip. x12 conference locations change annually and are announced prior to conference registration.

b. MuleSoft Conferences – 2 per year for 2 people for five days per trip

c. Plexis Conference: one time per year for two people for five days per trip. Plexis conference locations change annually and are announced prior to conference registration.

d. Pegaworld Conference: one time per year for two people for five days per trip. Pegaworld conference locations change annually and are announced prior to conference registration.

e. Gartner Conferences: 2 per year for 2 people for five days per trip. Gartner conference’s locations change annually and are announced prior to conference registration.

f. Healthcare Information and Management Systems Society (HIMSS) Conference: one time per year for two people for five days per trip. HIMSS conference locations change annually and are announced prior to conference registration.

g. Red Hat Conferences: 2 per year for 2 people for five days per trip. Red Hat conference locations change annually and are announced prior to conference registration.

h. Additional EDI Conferences: three times per year for two people for four days per trip. EDI conference locations change annually and are announced prior to conference registration.

The Government estimates that additional travel may be required, from time to time, to other remote locations/efforts listed above. The Contractor shall request and receive approval for these trips from the COR prior to travel.

Travel shall be in accordance with the Federal Travel Regulations (FTR) and requires advanced concurrence by the COR. Contractor travel within the local commuting area will not be reimbursed.

SPECIFIC TASKS AND DELIVERABLES

The Contractor shall perform the following:

PROGRAM MANAGEMENT

The Contractor shall provide a single point of contact for the VA COR and FSC FTS management. The Contractor shall manage the tasks, schedules, and analyze work discrepancies, communicate policies, purposes, and goals of the organization for all projects. The Contractor shall assist in analyzing and resolving programmatic issues, facilitate information exchange, and enhance management coordination between the COR/VA PM(s). This support shall include managing on-site and off-site support, any tracking of resources across projects, transitioning and onboarding of new support required, and scheduling staff to ensure support services are providing during the FSC operational hours. The Contractor shall identify point(s) of contact for all tasks under this PWS. The Contractor shall:

Deliverable:

A. Monthly Management Reports

TRANSITION-IN SUPPORT

The existing TO for the FSC IT support services expires on July 31, 2024. Since interruptions or delays to the work will adversely impact the mission, it is essential that attention be given to minimizing the interruption. Upon award of this effort, the Contractor shall ensure a smooth transition with the incumbent Contractor for any work requirements that are in progress at the time the incumbent TO expires. This includes providing an orderly transition of work acceptance and accomplishment so that impact to VA-FSC IT services is minimal. It also includes providing for maximum cooperation with the incumbent while ensuring that no work receives inadequate attention at the onset of this TO.

The Contractor shall plan for the transition of work to ensure continuity of services during the transition of the work from the existing contract to this TO. The Contractor shall provide a Transition-In Plan that documents the process the Contractor shall use to coordinate with the incumbent Contractor for all activities related to transition from one Contractor to another. The Contractor shall ensure link(s) to FSC SharePoint site or shared folder location where all documentation related to the contract support is stored. Additionally, the Contractor shall provide a list of meetings that require Contractor participation and the role of the Contractor staff on each meeting.

Deliverable:

A. Transition-In Plan

CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, timeline, and tools to be used in execution of the contract. The CPMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks, and resource support. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPMP shall be concurred upon and updated in accordance with Section B of the contract. The Contractor shall update and maintain the VA PM approved CPMP throughout the PoP.

Deliverable:

A. Contractor Project Management Plan

REPORTING REQUIREMENTS

The Contractor shall provide a Weekly Division Status Report in electronic form in Microsoft Word and Project formats that describes those activities or efforts the Contractor performed for each division. The report shall include detailed instructions/explanations for each required data element, to ensure that data is accurate and consistent. The report shall identify status for each project/assignment in the division following a template to be provided by FSC. Specific projects will require additional information per management priorities as identified by the COR. The Contractor shall include a summary of each Weekly Division Status Report for the month in the monthly update to the CPMP. The Contractor shall also provide timely, ad-hoc reporting support for FSC, Congressional, or VA-Leadership through Ad-Hoc Reports, which will be defined and identified by the COR. These reports shall reflect data as of the last day of the preceding week.

The Contractor shall provide Weekly Progress Reports that cover all work completed during the reporting period and work planned for the subsequent reporting period. The report shall also identify any problems that arose and a description of how the problems were resolved. If problems have not been completely resolved, the Contractor shall provide an explanation including their plan and timeframe for resolving the issue. The report shall also include an itemized list of all Information and Communication Technology (ICT) deliverables and their current Section 508 conformance status. The Contractor shall monitor performance against the CPMP and report any deviations. It is expected that the Contractor will keep in communication with VA accordingly so that issues that arise are transparent to both parties to prevent escalation of outstanding issues.

Deliverable:

A. Weekly Division Status Report B. Weekly Progress Report

TECHNICAL KICKOFF MEETING

A technical kickoff meeting shall be held within 10 days after TO award. The Contractor shall coordinate the date, time, and location (can be virtual) with the Contracting Officer (CO), as the Post-Award Conference Chairperson, the VA PM, as the Co-Chairperson, the Contract Specialist (CS), and the COR. The Contractor shall provide a draft agenda to the CO and VA PM at least five (5) calendar days prior to the meeting. Upon Government approval of a final agenda, the Contractor shall distribute to all meeting attendees. During the kickoff-meeting, the Contractor shall present, for review and approval by the Government, the details of the intended approach, work plan, and project schedule for each effort via a Microsoft Office PowerPoint presentation. At the conclusion of the meeting, the Contractor shall update the presentation with a final slide entitled “Summary Report” which shall include notes on any major issues, agreements, or disagreements discussed during the kickoff meeting and the following statement “As the Post-Award Conference Chairperson, I have reviewed the entirety of this presentation and assert that it is an accurate representation and summary of the discussions held during the Technical Kickoff Meeting for the VA FSC FTS Support Effort. The Contractor shall submit the final updated presentation to the CO for review and signature within three (3) calendar days after the meeting. The Contractor shall also work with the CS, the Government’s designated note taker, to prepare and distribute the meeting minutes of the kickoff meeting to the CO, COR and all attendees within three (3) calendar days after the meeting. The Contractor shall obtain concurrence from the CS on the content of the meeting minutes prior to distribution of the document.

CONTRACTOR PERSONNEL REQUIREMENTS

Contractor personnel shall maintain a work schedule that coincides with the schedule of the VA-FSC organizations that they support. Contractor personnel shall provide services on normal Federal Government workdays during the core hours of 6:00 am Central Time (CT) to 6:00 pm CT. The Government may also require onsite support after core hours for activities covered under PWS Task 5.2 and its subparagraphs during the hours of 06:00 PM CST to 06:00 AM CST. The Contractor shall maintain the ability to increase support as required for surges in activity and shall maintain the ability to increase the level of support for all labor categories. The Contractor shall provide and continuously update a Contractor Staff Roster over the life of the TO. Contractor services at VA-FSC sites shall not occur on Federal holidays or weekends, unless authorized in advance by the COR. In general, Contractor duties shall be performed during normal business hours. However, when necessary, Contractor personnel may be required to provide services outside the normal hours of duty. These occasions will be infrequent and will require services to be performed after normal working hours, evenings, weekends (Saturday and Sunday) and/or holidays. The COR and the Contractor will mutually agree upon all deviations to the normal work schedule.

Deliverable:

A. Contractor Staff Roster

TRAINING

The Contractor shall submit TMS training certificates of completion for VA Privacy and Information Security Awareness and Rules of Behavior and Health Insurance Portability and Accountability Act (HIPAA) training and provide signed copies of the Contractor Rules of Behavior in accordance with Section 9, Training, from Appendix C of the VA Handbook 6500.6, “Contract Security”.

Additional future training classes may be required, which will be identified by the COR. The Contractor shall ensure completion of these classes for itself and its subcontractors. Any person who does not complete required VA training will not be granted access to VA information, VA information systems, or the VA network.

Contractors who have completed these VA training courses within the past 12 months and have furnished certificates will not be required to re-take the training courses.

Deliverables:

A. VA Privacy and Information Security Awareness and Rules of Behavior Training Certificate/Signed Contractor Rules of Behavior/VA HIPAA Certificate of Completion

FACILITY REQUIREMENTS

PHYSICAL SECURITY REQUIREMENTS

The VA-FSC is a high-security Government facility. For purposes of this specification section, “FSC”, “VA-FSC”, “premises”, “site,” “Center,” and “facility” shall mean the FSC building, any satellite offices or Philadelphia and surrounding property, including parking areas.

All Contractor and subcontractor personnel shall read and abide by the security requirements in place at this facility. Failure to comply with these security requirements may result in revocation of physical and/or electronic access privileges.

Failure to complete the work in a timely manner, or by any required completion date, caused by delays in requesting security clearances, or due to revocation of access privileges resulting solely from the actions of the Contractor or their personnel, shall not serve as the basis for an extension in task order time or cost.

The Contractor, or any subcontractors performing work on this project, shall not take any photographs on, of, or within any area of the FSC, Philadelphia or satellite locations or personnel thereon. Further, the Contractor shall not use or allow to be used any aspect of this task order for publicity or advertising purposes without specific written approval of both the FSC’s Chief of Security Services and the Contracting Officer.

Parking is provided on a “first-come, first-served” and “space available” basis. Parking is not allowed in any other location, nor is it allowed alongside the building, loading docks, or alleyways without the approval of the Physical Security Officer. Vehicles parked illegally or improperly will be ticketed or towed at the operator’s expense.

The FSC reserves the right to close the job site and order Contractor personnel off the site in the event of an emergency, Government shutdown, times of elevated security risk, or any other reason deemed necessary by FSC management or security staff. Contractor personnel must immediately leave the site and may not return until authorized by the FSC.

Security Violations: The FSC has a three-violation limit policy regarding Contractors committing security violations. The FSC is not required to provide the Contractor with any documentation related to any security violations committed by their personnel to implement any of the actions listed below:

First occurrence: A verbal warning may be given by an FSC security guard, COR, and/or Physical Security Officer.

Second occurrence: For the second occurrence of the same (or similar) violation by the same person, the person’s badge may be confiscated (by an FSC security guard, the Physical Security Officer or the Chief, Security Services); if so, the person must immediately leave the site and the person will be denied access until 7:00 a.m. the next business day.

Third occurrence: For the third occurrence of the same (or similar) violation by the same person, the person’s badge may be confiscated (by an FSC security guard, the Physical Security Officer or the Chief, Security Services); if so, the person must immediately leave the site and the person will not be allowed to access the site again.

Multiple violations and/or intentional disregard for security regulations: Any person deemed by the CO or Physical Security Officer to intentionally disregard FSC security regulations shall have his / her badge confiscated and must immediately leave the site. Future access shall be at the discretion of the CO and Physical Security Officer.

FSC ACCESS PRIVILEGES

Access into the FSC is only allowed through the main (south-west) entrance. The loading dock may be used to load and unload materials only (not to gain access in and out of the FSC), and only during the hours it is open (Monday – Friday, 8:00 AM to 4:00 PM CST excluding official Government holidays).