FY20 VISN 1 IDIQ RTLS PWS v1.pdf

STATEMENT OF WORK (SOW)

DEPARTMENT OF VETERANS AFFIARS

Veterans Health Administration

Veterans Integrated Services Network 1

Real Time Location System (RTLS)

Asset Tracking (AT) Application Sustainment Indefinite Delivery Indefinite Quantity

Date: December 16, 2019 SOW Version Number: 1.0

1. BACKGROUND

Veterans Integrated Service Network 1 (VISN 1) has installed a standardized RTLS systems at all major sites (see Table 1) to better enable the VA to manage and track assets. RTLS solutions address many of the VA’s needs by providing additional capabilities beyond barcoding and can result in design process improvements for higher quality patient care, reductions in staff hours spent searching for equipment, and the ability to maintain effective inventory levels.

To enable this Asset Tracking (AT) RTLS system, hardware and multiple software applications are integrated at the VISN-level to form a VISN 1-wide standard of technology and capability. This standardization process included the use of Intelligent Insites (Asset Tracking Application) and Centrak (Location Services Technology) as two core components. The RTLS system in place is an enterprise solution for VISN 1 in both standard of technology and meets VA policies.

2. SCOPE OF SERVICES AND SUPPLIES SOUGHT

VISN 1 seeks to obtain RTLS maintenance and operation services and supplies at locations shown on Table 1 through a single-award, Indefinite Delivery, Indefinite Quantity (IDIQ) vehicle. The Contractor shall be able to provide the routine services and supplies, as well as be capable of updating RTLS application configurations that come about due to changes caused by minor construction projects (such as a floor or wing renovation) or major construction (such as a new building on campus).

The successful offeror shall be able to meet the required specifications of the RTLS infrastructure that provides the current VISN 1 standard. Offerors that seek to replace the existing standard with another will be found non-responsive. Additional, related work may be ordered off the resulting -contract without further competition at the discretion of the Contracting Officer (CO).

The Contractor shall provide RTLS Operation and Maintenance (O&M) services and supplies, inclusive of RTLS application client and server software, operating system maintenance, operational support services, supplies, and hardware in accordance with the terms detailed in the PWS below.

2.1 PLACE OF PERFORMANCE

This requirement covers RTLS components located in the Veterans Affairs Medical Centers (VAMCs) and Regional Data Center (RDC) as indicated in Table 1. Services may be performed on-site as well as remotely, as appropriate.

Table 1. VAMC and Regional Data Center Locations

Bedford VA Medical Center 200 Springs Road Bedford, MA 01730

VA Boston Healthcare System Brockton Campus 940 Belmont Street Brockton, MA 02301

Jamaica Plain Campus 150 South Huntington Ave Jamaica Plain, MA 01230

West Roxbury Campus 1400 VFW Parkway West Roxbury, MA 02132

VA Central Western Massachusetts 421 North Main Street Leeds, MA 01053VA

VA Connecticut Healthcare System Newington Campus 555 Willard Ave Newington, CT 06111

VA Connecticut Healthcare System West Haven Campus 950 Campbell Ave West Haven, CT 06516

VA Maine Healthcare System 1 VA Center Augusta, ME 04330

Manchester VA Medical Center 718 Smyth Road Manchester, NH 03104

Providence VA Medical Center 830 Chalkstone Ave Providence, RI 02908

Secaucus Regional Data Center* 105 Enterprise Ave South Suite 1144 Secaucus, NJ 07094

White River Junction 215 North Main Street White River Junction, VT 05009

2.2 SYSTEM ARCHITECTURE OVERVIEW

The RTLS architecture is divided into two component groups: VAMC or local facility level and VISN level components groups. The general scope of RTLS is outlined in the RTLS architecture depicted in Figure 1 below. The VISN level components are currently located at the Secaucus Regional Data Center (SRDC).

The facility level components are currently located at the VAMCs listed in Table 1.

Figure 1. VISN 1 Asset Tracking System Architecture

The RTLS sustainment services are inclusive of the components depicted in the VAMC and VISN 1 component group. This includes CenTrak and Intelligent InSites (AT) components. Common infrastructure to be supported includes items required to operate Single Sign-On (SSO) and F5 load balancer (configuration only). The complete list of software to be supported is specified in Table 2.

The RDC component group includes all RTLS backend server components located in the RDC, including select communication interfaces to external systems.

The two RTLS component groupings at the VAMC and RDC are interdependent. As such, operations and maintenance efforts are coordinated with the Contracting Officer’s Representative (COR) at the VISN level, the COR(s) at the individual VAMCs, and other VA entities as specified by the CO and COR. This coordination is critical to assist with isolating issues for full resolution.

RTLS HARDWARE

RTLS computing hardware is provided in the form of two rack mounted suites currently installed at the SRDC (see Figure 2). RTLS data center software runs in a VMware® environment, with virtual machines

(VMs) being hosted in a blade server environment with multiple 2.5GHz, Intel Xeon CPU processors, or other equally capable hardware. RTLS SDD 8.0 specifies the use of HP C7000 enclosure and ProLiant Gen8 blades, although these may be substituted for equally capable hardware.

Due to the age of the current hardware installed at the Regional Data Center and the potential of the VISN level components moving to another environment/location, the Contractor shall be able to perform all work to load and configure RTLS Applications and migrate to new hardware, VA hosted environment or cloud environment. If the current hardware components fail, the contractor shall price out a replacement to support the RTLS Solution.

VISN DataCenter RTLS 42U rack

C7000 Enclosure

1 U

10 U

1 U F5 LTM 1600 LoadBalancers (2)

1 U 1 U SAN Switch (2)

VISN DataCenter RTLS new 42U rack

P2000/3 FC/iSCSI

MSA

2 U

2 U

2 U

2 U

2 U

2 U

2 U

2 U

Figure 2. SRDC Hardware

RTLS VAMC Asset Tracking Application and software components runs in a VMware ® environment with VMs being hosted by VA’s facility converged virtual infrastructure.

SERVICES AND SUPPLIES REQUIRED

The items needed include the following functions:

• Preventive Maintenance: The post-operation, proactive modification of RTLS products to detect and correct latent operating defects or conditions before they become effective faults.

• Corrective Maintenance: The reactive maintenance performed to identify, isolate, and rectify RTLS operating faults.

• Adaptive Maintenance: The performance of modifications required to keep RTLS operations viable and products usable in a changing environment.

These tasks are further detailed below.

RTLS SUSTAINMENT EFFORT

The Contractor shall provide O&M sustainment services for the RTLS production and pre-production environments. O&M sustainment services shall be provided for the software components identified below, including operating system patches/upgrades, RTLS software component patches/upgrades, network administration, software license installation, system configuration changes, and virtual machine reboots.

Table 2. Software Components Covered Under this Task Order Products

CenTrak Fingerprinting Software Module CenTrak Connect CenTrak Pulse (formerly GMS)

Intelligent InSites (Connector, Platform, BI, NSSM)

Java JDK

Java SE

Microsoft Internet Information Services (IIS) Microsoft .NET Framework Microsoft SQL Server 2012 Microsoft SQL Server 2014 Microsoft SQL Server 2016 (SQL Always-on configuration) Oracle WebLogic Server (Clustered)

RabbitMQ

Red Hat Enterprise Linux 6.X Red Hat Enterprise Linux 7.X

Products WildFly – JBoss: App Server (IAM) Windows Server 2012 Windows Server 2016

The RTLS sustainment effort includes all the updates, patching and maintenance, particularly for preventive and corrective maintenance on each of the RTLS constitute system capabilities, which include AT. As illustrated in the architecture above (Figure 1), RTLS has a number of shared backend services and interfaces to external systems.

RTLS programs that interface with external systems are software solutions orchestrated by a series of Enterprise Service Bus (ESB) flows. To support RTLS interfaces, the VA uses MuleSoft, a lightweight, open source ESB and integration framework that implements a communication messaging system between mutually interacting software applications. It is a Java-based ESB and integration platform to facilitate message routing and data transformation. Within the ESB flows, RESTful web services are employed on both ends to facilitate communication. Communication with VistA is managed with a series of RESTful web service methods designed for the RTLS Enterprise solution called Vista Service.

Troubleshooting the interface middleware and servers that run the interface software (such as MuleSoft ESB, and VistAService’s Weblogic) is a key task for the Contractor.

RTLS software is highly virtualized, with software components spread across multiple virtual machines running on VA-provided hardware. A load balancer directs traffic to different RTLS servers, the number of which varies depending on the size of the VISN and individual VAMCs’ usage. To prevent outages, a high availability model is used to failover Virtual Machines (VM) and Storage Area Network (SAN) components. The list of virtual servers broken out by function is included as Government Furnished Information as RTLS Virtual Server List by Function (Attachment A).

RTLS DEPLOYMENT

The RTLS sustainment effort will support O&M of the production and pre-production environments at the RDC. This includes applying patches and upgrades just as with the production environment. The sustainment effort will also verify the function and stability of upgrades in all environments prior to advancing to operational deployment into the production environment. This will include regression testing sufficient to verify basic functionality (e.g., login, search, asset tracking, reporting, accurate monitoring and synchronization of inventory).

This RTLS Sustainment PWS does not include software development (which is defined as Contractor modification to the baseline codebase of a product).

TECHNICAL EXPERTISE

In performance of the tasks in this PWS, the Contractor shall use and have expertise or certification as necessary in the following software and technologies:

Table 3. RTLS Technology

Technology Technology Microsoft SharePoint 2010, 2013 or later SharePoint versions, and related technologies

XML, XSL, XSLT

SQL Server 2012, 2014, 2016 Reporting tools including SQL Server Reporting Services (SSRS) SQL Server Analysis Services (SSAS) SQL Server Integration Services (SSIS) Splunk Nagios Red Hat Linux system administration Windows System Administration

Intelligent InSites CenTrak Java JDK/SE RabbitMQ VA Technical Reference Model (TRM) VMWare vSphere

PROJECT MANAGEMENT

The Contractor shall identify a single Point of Contact (POC) to oversee the management of the BPA and resulting BPA Orders in VISN1. The POC shall be responsible for:

• Effectively communicating and providing timely project progress status to VA and Contractor team members using the progress reports.

• Ensuring the submission of contract deliverables

• Coordinating, escalating, and resolving Contractor-related project issues.

• Representing the Contractor in status meetings.

• Complying with VA’s change management process.

REPORTING REQUIREMENTS

The Contractor shall manage the RTLS Sustainment work effort and provide a Monthly Activity Report.

These reports shall convey the status of Task Order performance. A standard format will be provided by VA and shall be utilized for submission of required information. Required information includes:

1. All planned or scheduled maintenance that will occur in the next reporting period, including patches, OS upgrades, and hardware replacements.

2. Maintenance activity log showing all patches / upgrades / licenses installed, failures and faults detected, system performance deviations, including security vulnerabilities identified by VA from the monthly Nessus and on demand Oracle and SQL Server database scans, and the operational time to restore.

3. Customer support log which shall include a description of all support issues identified, severity level, and how the issues were resolved.

4. Corrective actions taken and status, whether closed or open.

5. Anticipated closure date and roadblocks (if any) for open items.

6. All known significant issues or risks.

7. A summary of all closed and completed items.

WEEKLY STATUS MEETING

The Contractor shall hold a weekly status meeting with the VISN COR and VAMC COR(s) to discuss all the items identified in Monthly Activity Report and other issues as identified by the COR(s). The Contractor shall provide weekly status meeting minutes to all attendees within three (3) business days after the meeting.

PREVENTIVE MAINTENANCE

The Contractor shall deploy software updates and upgrades in the execution of RTLS preventive maintenance tasks. Additionally, the Contractor shall maintain and modify infrastructure system configurations to address functionality, security, connectivity or load issues. Most RTLS application minor updates are released once or twice a year, while major updates are done annually. Updates to any individual application may vary in a given period of performance but will collectively average out over time.

For RTLS preventive maintenance, the Contractor shall:

1. Perform modifications to RTLS software installations and operational configurations to maintain and improve system performance, and to detect and correct latent faults in software and hardware products before they become operative faults. A latent defect or condition is one that is present but hidden from regular means of detection or yet to have an operational impact. An operative or effective fault is a fault activity impacting nominal system operations or business functionality.

2. Monitor the performance of the RTLS system, including system resources such as processor, memory and disk utilization. The Contractor shall verify that performance thresholds are within nominal operating range and take corrective action necessary to mitigate or relieve RTLS performance deviations and respond proactively to actionable alert and threshold notifications.

The Contractor shall log and notify VA of any performance deviation, and any known or suspected rationale for the deviation in the Maintenance Activity Log as part of the Monthly Activity Report.

3. Engage in an ongoing inspection of RTLS to identify operative and latent defects in RTLS functions, software scripts, and software and hardware configuration. The Contractor shall make actionable recommendations that address any defects detected. Recommendations shall be relayed to the COR by email or vocally and also documented in the Maintenance Activity Log as part of the Monthly Activity Report.

4. Coordinate with appropriate COR(s) to schedule patch / upgrade installations. This may take place outside of regular business hours.

5. Identify, download, and manage the installation of RTLS application software patches and upgrades.

6. Coordinate with COR(s) to shut down, reboot, or restart RTLS systems (e.g., Intelligent InSites, CenTrak) and RTLS supporting Systems (e.g., SSOi), following VA or RTLS IT maintenance, recovery, or software patching.

7. Proactively download Linux patches and upgrades from a server identified by VA, install those patches, and reboot the patched VMs.

8. Verify correct operation of RTLS after every patch installation.

9. If operating system patches are shown to interfere with RTLS operation, coordinate with VA POCs identified by the COR before backing out any operating system patch(es).

10. Provide RTLS network administration support to include maintenance of the application connection ports, firewall, load-balancer, Secure Socket Layer Off-loading, and Single Sign-On Integration (SSOi) requirements and configurations.

11. Proactively replace non hot-swappable hardware (e.g., hard drives, motherboards) when it is in imminent danger of failure, based on alert notification from Nagios or other system and component monitoring tools.

12. Administer RTLS subsystem databases. This includes addressing database security remediation, capacity planning, performance monitoring, troubleshooting, modification of database tables, allocating additional space and archiving/purging data as required by the COR(s). Coordinate with COR(s) if new storage hardware is added to configure new storage space for database use. VA IT will coordinate the granting of administrator privileges to Contractor staff to carry out database administration.

SOFTWARE UPDATES, UPGRADES AND ADMINISTRATION

The application components of RTLS are hosted on platforms that contain VA standard operating systems, virtual machines, and ancillary software. The Contractor shall be responsible for identifying and downloading updates. Some of the software listed in Table 2 are sub-components of the RTLS application software. The maintenance updates and upgrades to VA standard environments are the responsibility of VA Office of Information & Technology (OIT). For RTLS software updates or upgrades, the Contractor shall:

1. Perform the installation, configuration, update (patching operational software) and/or upgrade (replacing or supplementing the software baseline) of RTLS software to remain compliant with VA Technical Reference Model (TRM) approved software, to mitigate the development of future faults, correct latent faults (present but hidden from routine (i.e., non-extraordinary) means of detection), rectify operative faults, restore nominal operations, or enhance component and system performance/capacity. For RTLS application software, the Contractor may expect approximately one major update and 2-3 minor updates a year. Linux patches are issued by VA monthly. The Contractor shall coordinate with COR(s) to schedule installation before the next set of patches becomes available (less than 30 days). For RTLS application patches, the Contractor shall coordinate with COR(s) to schedule installation within 30 days from when the software update is available. If issues are encountered, this timeframe may be extended with agreement from the COR.

2. Notify COR three (3) weeks in advance of installing new RTLS application releases or upgrades or any other disruptive maintenance activity in any environment. The Contractor shall delay or terminate any planned update or upgrade, at the direction of the appropriate COR(s).

3. Perform the installation of software patches, new releases and software updates in the pre-production environment. New releases and upgrades may provide new functionality as well as any needed system corrections.

4. Ensure that the installation, operation, maintenance, updating, and patching of software shall not alter prior configuration settings or those from the VA-approved configuration.

5. Verify the function and stability of upgrades in all environments (subject to the connectivity limits of those environments) prior to advancing to operational deployment into the production environment. This will include regression testing sufficient to verify basic functionality (e.g., login, search, asset tracking, reporting, accurate monitoring and synchronization of inventory).

6. Perform routine RTLS system administration functions and serve as system administrator for all RTLS applications. In addition to system patches and updates, the Contractor shall monitor system logs and resource utilization, and archive system data and audit logs as needed.

7. Provide written notice to COR(s) that each patch has been validated as not affecting the Systems within 10 working days when security fixes involve installing third party patches in pre-production (such as Linux Red Hat). Notification shall come in the form of an email to the COR.

8. Provide VA any necessary information to update the One-VA TRM entry for any software components updated.

9. Contractor shall provide supporting data as requested by the COR to complete VA IT requests such as Authority to Operate (ATO) and TRM waivers.

WIRELESS HARDWARE AND SOFTWARE UPGRADES

The VA wireless infrastructure upon which RTLS depends, is updated, upgraded and maintained by VA OI&T, including wireless access points, Cisco Mobility Services Engine (MSE), Cisco Wireless Local Area Network (LAN) Controller, and Cisco Connected Mobile Experiences (CMX).

The Contractor shall:

• Perform the provisioning, installation, configuration, update, or upgrade of RTLS hardware and software to remain compliant with VA’s wireless infrastructure components.

HARDWARE UPDATES AND UPGRADES

For RTLS Hardware (HW) updates or upgrades, the Contractor shall:

1. Perform the provisioning, installation, configuration, update, or upgrade of RTLS hardware to mitigate the development of future faults and maintain nominal system performance or capacity.

The term provisioning refers to the planned allocation and distribution of available or acquired hard assets.

2. Develop recommendations for the replacement or substitution of RTLS hardware components in the RTLS System, as necessary to prevent faults or sustain performance thresholds.

3. Develop requisition requests and documentation for the procurement of additional RTLS software and hardware necessary to sustain RTLS functional capabilities at nominal levels. The CO and VISN COR shall provide guidance on how the recommendations may be implemented.

4. Execute the provisioning and installation of substitute RTLS components into the operational RTLS system, upon the authorization of the VISN COR.

SOFTWARE LICENSE INSTALLATION

All RTLS software licenses will be purchased by VA and given to the Contractor for installation and use when required. For RTLS software license installation, the Contractor shall:

1. Receive from the VISN COR available license renewal data.

2. Install RTLS licenses, upon the authorization of the VISN COR. Licenses to operate RTLS software applications at the RDC are listed in Table 2 (Software Components Covered Under This Task Order).

CORRECTIVE MAINTENANCE

Corrective Maintenance is the reactive maintenance performed to identify, isolate, and rectify RTLS operating faults. Corrective Maintenance is applicable to both RTLS software and hardware. For RTLS corrective maintenance, the Contractor shall:

1. Perform troubleshooting to identify and isolate faults causing any failure or degradation of service in RTLS software and hardware components and systems.

2. Execute RTLS backup procedures in the event of RTLS primary software and hardware component service failures.

3. Execute the appropriate RTLS recovery procedures following the restoration of RTLS primary services from a partial or full system failure. Restoration shall include resumption with all data and capabilities available prior to the backup inducing event, and restoration to nominal operational state of RTLS hardware devices, including hard drives, component boards and processing units.

4. VA will perform Federal Information Security Management Act (FISMA) compliance audits and Nessus scans monthly, and the Contractor shall address and resolve all security remediation and vulnerabilities identified within the timeframe specified below, starting from notification of findings. VA maintains a tracking database for all security scan findings and compliance audits. The Contractor shall update that database to indicate the status of issue resolution and/or the plan to resolve issues that will take longer to resolve, in case of delays beyond the Contractor’s control (e.g., a VA delay or vendor dependency for software patches). Based on historical data, the Contractor may expect approximately 10 new findings per month (1/8 critical priority, 1/2 high priority, 3/8 medium priority).

a. Critical – patches shall be tested and applied within 30 days

b. High – patches shall be tested and applied within 60 days

c. Moderate – patches shall be tested and applied within 90 days

d. Low – the System owner will determine the patching timeframe

e. Emergent – patches shall be tested and applied as soon as possible

5. Respond to and resolve notifications that RTLS servers, software, and hardware are down or inoperable.

6. Non hot-swappable components shall be included as part of the contract for equipment located at the RDC. For hot-swappable components at the RDC, a separate contractor performs the swaps.

The Contractor shall provide and replace failed hardware components that are not hot-swappable and restore/configure the new hardware to the previous working condition at the RDC. Monitoring of equipment and notification of failed parts to the COR(s) at the RDC are included in the requirement. Monitoring and replacement of failed hardware components for equipment at the VAMCs are not be included in this requirement.

7. Troubleshoot, isolate, and repair connectivity and communication issues for data presented to or received from the Mule ESB. Resolution of these issues may require coordination with other POCs as identified by the COR(s).

8. Coordinate with VA OIT to obtain the status of the VA wide area network (WAN) and wireless infrastructure upon which RTLS depends to determine the operational impact on RTLS. The Contractor shall obtain information on WAN and wireless updated, upgraded, and maintenance performed by VA OI&T. OIT maintenance includes wireless access points and Cisco Mobility Services Engine (MSE).

9. Perform the provisioning, installation, configuration, update or upgrade of RTLS hardware to correct latent faults, rectify operative faults, and restore nominal operations. The term provisioning refers to the planned allocation and distribution of available or acquired hard assets.

10. Develop recommendations for the replacement or substitution of RTLS hardware components in the RTLS System, as necessary to resolve faults, restore performance or enhance performance.

11. Execute the provisioning and installation of substitute RTLS components into the operational RTLS system, upon the authorization of the VISN COR at the RDC. VA IT will perform this function at the VAMCs.

ADAPTIVE MAINTENANCE

VISN 1 has already procured and installed RTLS solutions at the SRDC and VAMCs. As part of the system sustainment efforts, the Contractor shall have the capability to update the items and areas tracked, as detailed below:

1. Execute modifications or supplementation of RTLS software maps and software/ hardware configurations that adjust RTLS functions and operations to a new or modified deployment environment. The deployment environment may be modified because of new construction, changes to facility floorplans, or changes to the business use of facilities, rooms and other assets using RTLS. The VA will provide new drawings. The Contractor shall verify that modifications or supplementations are following VA RTLS Deployment Standards (Attachment B). Contractor shall provide Intelligent Insites software configuration, such as regioning of map, map rendering, and preparation work for locations. Contractor shall provide Centrak software configuration, hardware installation, and verification. The contractor shall implement Centrak approved fingerprinting technology. The Contractor shall coordinate all activities in each system and the integration of data between systems.

2. The Contractor shall obtain VISN COR authorization prior to implementing any RTLS modification or supplementation steps. The Contractor shall update the Facility Hardware Deployment Design Document and Certified Space File (CSF) (Attachment C).

3. Under a separate ESE Task Order, several Interfaces between the Intelligent InSites Real Time Location System (RTLS) solution and the Department of Veterans Affairs (VA) Veterans Integrated System Architecture (VISTA) were developed and implemented under the National RTLS Project. The Contractor shall install and configure the interfaces (Attachment D – RTLS Vista Interface Package).

CUSTOMER SUPPORT

The Contractor shall work to resolve issues identified by the appropriate COR(s). The COR(s) and local staff from Clinical Engineering will perform initial review of all issues, and if they are unable to resolve the issues, will submit a help desk support ticket for escalation. The source of these issues may be Tier 2 or 3 trouble tickets. During regular business hours (7am to 7pm Eastern), the Contractor shall:

1. Respond to service requests from COR or designee (via telephone or email) to resolve or support the troubleshooting, identification and resolution of RTLS technical requests which involve RTLS components at the RDC. The Contractor shall log all requests that are received in the Maintenance Activity Log as part of the Monthly Activity Report.

2. Classify all service request received by assigning a severity level, in accordance with Table 4 below.

It is expected (but not guaranteed) that the Contractor may anticipate 2-3 service requests per month per site, typically of the Non-Critical and Important severity.

3. Coordinate with the COR(s) if access to resources at a VAMC are required to fully diagnose or resolve an issue and work collaboratively with the POC(s) identified by the COR to resolve issues within RDC boundaries as depicted in Figure 1 (shown previously in PWS). RTLS malfunctions may originate within RDC boundaries, outside RDC boundaries, or both, if the RDC components have a dependency on external RTLS components (i.e., RTLS components at a VAMC).

4. Collaborate with any identified POCs to cooperatively troubleshoot and resolve issues.

5. Provide issue resolution response to resolve faults and requests, in accordance with the response timeline provided in Table 4 below. Issues, status, and resolution notification shall be communicated to the appropriate COR(s).

6. Document all customer support issues in the Customer service log, a component of the Monthly Activity Report.

7. Develop and submit service requests to COR-identified POCs to request OIT support services to resolve RTLS faults and other operating problems caused by components outside the maintenance responsibility of this TO.

Table 4: Event Response Time Intervals Severity Code Impact Initial

Response to Customer

Resolution Time

1 - Critical Complete work stoppage. Critical Service Request

30 minutes 4 hours

2 - Important Inability to perform a job function. Important Service Request

1 hour 10 hours

3 - Non-critical Low/No Impact (Able to perform work functions) Non-critical Service Request

16 hours 80 hours

2.4 GENERAL SECURITY REQUIREMENTS

The Contractor shall comply with VA security, privacy and records management policies, directives, handbooks, and guidelines.

INFORMATION SECURITY, PRIVACY AND RECORDS MANAGEMENT

Contractors and subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA personnel regarding information and information system security.

ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS

1. The Contractor shall request logical or physical access to VA information and VA information systems for their employees, subcontractors, and affiliates only to the extent necessary to perform the services specified in this contract or supplemental agreement.

2. All Contractors and Affiliates supporting this contract must be in the continental U.S.

3. Background security investigations for contractors must be in accordance with VA Directive and

Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures. Verification of a Security Clearance must be processed through the Special Security Officer located in the Planning and National Security Service within the Office of Operations, Security, and Preparedness.

4. The Contractor must notify the Contracting Officer immediately when an employee or subcontractor employee working on a VA system or with access to VA information is reassigned, leaves the contractor or subcontractor's employ, and/or prior to an unfriendly termination.

VA INFORMATION CUSTODIAL LANGUAGE

If VA determines that the Contractor has violated any of the information confidentiality, privacy, and security provisions of this contract, it shall be sufficient grounds for VA to withhold payment to the Contractor and to terminate the contract for default or terminate for cause.

If a VHA contract is terminated for cause, all Business Associate Agreement (BAA) must also be terminated and appropriate actions taken in accordance with VHA Handbook 1600.05, BAAs. Absent an agreement to use or disclose protected health information, there is no business associate relationship.

For Contractor custodial responsibilities, the Contractor shall:

1. Store, transport, or transmit VA sensitive information in an encrypted form, using a FIPS 140-2 compliant solutions.

2. Have access to privileged and confidential materials of VA. These printed and electronic documents are for internal use only, are not to be copied or released without permission, and remain the sole property of VA.

3. Release no VA information. Any request for information presented to the Contractor shall be submitted to the VA Contracting Officer for response. The CO will be the sole authorized official to release any data, draft deliverables, final deliverables, or any other documentation or materials pertaining to this contract.

SECURITY INCIDENT INVESTIGATION

The Contractor shall cooperate with authorized Government offices concerning facility access, audits, security incident notification, and hosting location. Specifically, the Contractor shall:

1. Immediately and simultaneously notify the COR, designated ISO, and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/ subcontractor has access, and the discovery or disclosure of successful exploits of the vulnerability which can compromise the security of the Systems. For the purposes of this PWS, an incident is defined as an occurrence that (a) jeopardizes the confidentiality, integrity, or availability of an information system, (b) jeopardizes the information being processed, computed, stored, or transmitted, or (c) anything that constitutes an imminent or occurring threat of violation of security policies, security procedures, acceptable use policies, or Agency data sharing agreements.

2. Report to the appropriate law enforcement entity, instances of theft or break-in or other criminal activity, including the VA OIG and Security and Law Enforcement.

3. Cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of possible criminal law violation(s) associated with any incident. The Contractor shall also cooperate with VA in civil litigation to recover VA information, obtain monetary or other compensation from a third party for damages arising from any incident, or obtain injunctive relief against third party arising from, or related to, the incident.

4. Cooperate with all audits, inspections, investigations, or other reviews conducted by or on behalf of the CO or other authorized Government offices as described in prior subparagraphs. Cooperation includes, but is not limited to, prompt disclosure of requests of data, information, and records about any audit, inspection, investigation, or review and making employees of the Contractor available for interview by auditors, inspectors, and investigators within ten (10) business days from such request, unless otherwise directed by the OIG.

5. Preserve such data, records, logs and other evidence reasonably necessary to conduct a thorough investigation of any computer security incident.

INFORMATION SYSTEM MAINTENANCE

For Information System Maintenance, the Contractor shall:

1. Include this Privacy Act clause, including this subparagraph (3), in all subcontracts awarded under this contract which requires the operation of such a SOR.

a. In the event of violations of the Act, a civil action may be brought against the agency involved when the violation concerns the operation of a SOR on Individuals. Criminal penalties may be imposed upon the officers or employees of the agency when the violation concerns the operation of a SOR on individuals to accomplish an agency function. For purposes of the Act, when the contract is for the operation of a SOR on individuals to accomplish an agency function, the Contractor is considered to be an employee of the agency.

i. "Operation of a System of Records" means performance of any of the activities associated with maintaining the SOR, including the collection, use, maintenance, and dissemination of records.

ii. "Record" means any item, collection, or grouping of information about an individual that is maintained by an agency, including, but not limited to, education, financial transactions, medical history, and criminal or employment history and contains the person's name, or identifying number, symbol, or any other identifying aspect assigned to the individual, such as a fingerprint.

iii. "System of Records" means a group of any records under the control of any agency from which information is retrieved by the name of the individual or by some identifying number, symbol, or other identifying aspect assigned to the individual.

2. Safeguard the security of all technologies being maintained, including their subcomponents (hereinafter referred to as "Systems"), throughout the life of this contract and any extension, warranty, or maintenance periods. This includes, but is not limited to workarounds, patches, hotfixes, upgrades, and any physical components (hereafter referred to as Security Fixes) which may be necessary to fix all security vulnerabilities published or known to the vendor anywhere in the Systems, including Operating Systems and firmware. The vendor shall ensure that Security Fixes shall not negatively impact the Systems beyond known OEM Operating thresholds.

SECURITY CONTROLS COMPLIANCE TESTING

On a periodic basis, VA, including the OIG, reserves the right to evaluate any or all the security controls and privacy practices implemented by the contractor under the clauses contained within the contract.

With ten (10) working-days’ notice, at the request of the government, the contractor must fully cooperate and assist in a government-sponsored security controls assessment at each location wherein VA information is processed or stored, or information systems are developed, operated, maintained, or used on behalf of VA, including those initiated by the OIG. The government may conduct a security control assessment on shorter notice (to include unannounced assessments) as determined by VA in the event of a security incident or at any other time.

SECURITY AND PRIVACY AWARENESS TRAINING

All Contractor employees and subcontractors requiring access to VA information and VA information systems shall complete VA security and privacy training before being granted access to VA information and its systems. The Contractor shall:

1. Sign and acknowledge (either manually or electronically) understanding of and responsibilities for compliance with the Contractor Rules of Behavior, Appendix E relating to access to VA information and information systems.

2. Successfully complete the Privacy and Information Security Awareness and Rules of Behavior (TMS# VA10176), Privacy and HIPAA Training (TMS# VA10203), any additional cyber security or privacy training required for VA personnel with equivalent information system access, and any role-based information security training required in accordance with NIST Special Publication 800-16, Information Technology Security Training Requirements.

3. Provide to the CO and/or the COR a copy of the training certificates and certification for each applicable employee within ten (10) business days of onboarding in the VA Talent Management System (TMS), and annually thereafter for the life of the Contract.

4. Failure to complete the mandatory annual training and sign the Rules of Behavior annually, within the timeframe required, is grounds for suspension or termination of all physical or electronic access privileges and removal from work on the contract until the training and documents are complete.

POSITION/TASK RISK DESIGNATION LEVEL(S)

In accordance with VA Handbook 0710, Personnel Security and Suitability Program, the position sensitivity and the level of background investigation commensurate with the required level of access for the following tasks within the PWS are considered Tier 1/Low Risk.

2.5 PERFORMANCE CONSIDERATIONS

VAMC WORK CONDITIONS

Contractor service visits shall be scheduled in advance with the permission of the COR. Contractor employees and subcontractors that show up without prior permission may be turned away at the fault of the Contractor. The government retains the right to refuse entry to the VAMC to any personnel for any or no reason.

When the Contractor arrives at the location to perform the work, the Contractor shall check in with the designated facility representative and follow their directions in performing the work in accordance with location’s standards.

QUALITY ASSURANCE

The COR(S) shall monitor contractor performance quality, and the COR’s feedback will inform the performance evaluations created by the CO. Key items the COR will watch for include, but are not limited to: response timeliness, technician preparation and readiness to perform the work, the quality of the work performed, professionalism of the technicians, and compliance with contract and facility requirements.

In the event of a quality issue arising, the COR will investigate and attempt to resolve the issue with the technician or contractor directly. If the COR is unable to resolve the issue, the COR shall refer the issue to the CO for fact-finding, evaluation, and resolution in a manner the CO sees fit, with all legal remedies available for use.

The table below defines the Performance Standards and Acceptable Levels of Performance associated with this effort.

Table 5: Performance Standards Performance Objective

Performance Standards Level of Performance

Technical / Quality of Product or Service

Shows understanding of requirements Efficient and effective in meeting requirements Meets technical needs and mission requirements Provides quality services/products

Satisfactory or higher

Project Milestones and Schedule

Quick response capability Products completed, reviewed, delivered in accordance with the established schedule Notifies customer in advance of potential problems

Cost & Staffing Currency of expertise and staffing levels appropriate Personnel possess necessary knowledge, skills and abilities to perform tasks

Management Integration and coordination of all activities to execute effort

The COR(s) will utilize a Quality Assurance Surveillance Plan (QASP) throughout the life of the PO to ensure that the Contractor is performing the services required by this PWS in an acceptable level of performance.

The Government reserves the right to alter or change the QASP at its own discretion. A Performance Based Service Assessment will be used by the COR in accordance with the QASP to assess Contractor performance.

3. APPLICABLE DOCUMENTS

The Contractor may reference the following documents to understand the performance tasks of this effort:

1. Public Law 109-461, Veterans Benefits, Health Care, and Information Technology Act of 2006, title IX Information Security Matters

2. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

3. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

4. Office of Management and Budget (OMB) Circular A-130, “Managing Federal Information as a

Strategic Resource”, July 28, 2016

5. Office of Management and Budget (OMB) Memorandum M-08-05, “Implementation of Trusted

Internet Connections (TIC), November 20, 2007

6. VA Directive 6300, Records and Information Management, February 26, 2009

7. VA Directive 0735, Homeland Security Presidential Directive 12 (HSPD-12) Program, October 26, 2015)

8. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010

9. VA Handbook 6102 (Internet/Intranet Services), July 15, 2008 Health Insurance Portability and

Accountability Act (HIPAA); 45 CFR Part 160, 162, and 164; Health Insurance Reform: Security Standards; Final Rule dated February 20, 2003

10. VA Handbook 6500.3, “Assessment, Authorization, And Continuous Monitoring of VA Information Systems,” February 3, 2014

11. VA Handbook 6500.8, “Information System Contingency Planning”, April 6, 2011 (http://www1.va.gov/vapubs/)

12. VHA Handbook 1605.05, Business Associate Agreements, July 22, 2014(http://www.va.gov/vhapublications/)

13. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote Access”, January 15, 2014,

14. VA Memorandum, VAIQ # 7011145, VA Identity Management Policy, June 28, 2010 http://www1.va.gov/vapubs/ http://www.va.gov/vhapublications/

15. VA Memorandum, “Implementation of Federal Personal Identity Verification (PIV) Credentials for Federal and Contractor Access to VA IT Systems”, (VAIQ# 7614373) July 9, 2015,

16. VA Memorandum “Mandatory Use of PIV Multifactor Authentication to VA Information System” (VAIQ#7613595), June30, 2015,

17. VA Memorandum “Mandatory Use of PIV Multifactor Authentication for Users with Elevated Privileges” (VAIQ#7613597), June30, 2015; (VAIQ#7613597), June30, 2015;

18. Attachment A – RTLS Virtual Server List by Function

19. Attachment B - RTLS_National_AT_Application Usage Document_5.0

20. Attachment C - Facility RTLS Hardware Deployment Design Document and Certified Space File

(Deployment Design Document is available upon request to the CO)

21. Attachment D – Vista Interface Control Document