The file's text, extracted by GovTribe without its formatting.
Security Information and Event Management (SIEM) TAC Number: VA-26-00049417
PRODUCT DESCRIPTION (PD)
DEPARTMENT OF VETERANS AFFAIRS
Office of Information & Technology Development Security & Operations Infrastructure Operations
Security Information and Event Management (SIEM)
Date: July 7, 2026 PD Version Number: 1.1
Contents
| 1.0 | PRODUCT REQUIREMENTS | 3 |
| 1.1 | BASE REQUIREMENTS | 3 |
| 1.2 | OPTIONAL REQUIREMENTS | 10 |
| 2.0 | NOTICE OF THE FEDERAL ACCESSIBILITY LAW AFFECTING ALL INFORMATION AND COMMUNICATION TECHNOLOGY (ICT) PROCUREMENTS (SECTION 508) | 11 |
| 2.1 | SECTION 508 – INFORMATION AND COMMUNICATION TECHNOLOGY (ICT) STANDARDS | 11 |
| 2.2 | COMPATABILITY WITH ASSISTIVE TECHNOLOGY | 12 |
| 2.3 | ACCEPTANCE AND ACCEPTANCE TESTING | 12 |
| 3.0 | INFORMATION TECHNOLOGY USING ENERGY-EFFICIENT PRODUCTS | 12 |
| 3.1 | ENERGY STAR | 13 |
| 4.0 | SHIPMENT OF HARDWARE OR EQUIPMENT | 13 |
| 4.1 | SPECIAL SHIPPING INSTRUCTIONS | 14 |
| 5.0 | GENERAL REQUIREMENTS | 14 |
| 5.1 | VA TECHNICAL REFERENCE MODEL | 14 |
| 5.2 | SOCIAL SECURITY NUMBER (SSN) REDUCTION | 15 |
| 5.3 | INTERNET PROTOCOL VERSION 6 (IPV6) | 15 |
| 6.0 | INFORMATION SECURITY CONSIDERATIONS: | 15 |
| 7.0 | POINTS OF CONTACT | 17 |
PRODUCT REQUIREMENTS
The Department of Veterans Affairs (VA) Center for Data and Computational Sciences (C-DACS) has a requirement for the procurement of security and information management equipment for the Veterans Health Administration (VHA). The purpose of this procurement is to enhance the security posture for the research data and analysis systems for the VA Office of Research and Development (ORD). The program features several big data applications and databases which connect to a high-performance computing and storage environment.
The contractor shall provide a Security Information and Event Management (SIEM) solution for deployment in multiple data centers.
BASE REQUIREMENTS
ITEM 1 – SECURITY INFORMATION AND EVENT MANAGEMENT (SIEM) SYSTEM- QUANTITY: 1
SIEM System
SIEM System and support
Required Characteristics
Table 1: Platform Requirements
| 1.1 |
| The solution shall operate in isolated, self-hosted deployment (non-SaaS), air-gapped environments and allow manual updates for patches, threat intelligence libraries, and vulnerability definitions. |
| 1.2 |
| The solution shall support fully container-native architecture supporting deployment of its components as Docker containers using vendor-provided images. The solution must include production-ready documentation for container orchestration using Docker Compose and support horizontal scaling of containerized services. The SIEM shall provide mechanisms for secure configuration and updating of these agents in isolated environments. |
| 1.3 |
| The solution shall support deployment across multiple physical locations, including at least three datacenters during the initial rollout |
| 1.4 |
| The solution shall support RHEL >= 7 and above; Windows Server >=2016 and above; vCenter >= 8 and above; and ESXi >= 7 and above. |
| 1.5 |
| The SIEM system shall be capable of supporting approximately 1000-3000 endpoints across the VA data center locations. The system shall be designed to scale and accommodate a minimum of 10% growth in endpoints per year without degradation in performance, functionality, or security posture. |
| 1.6 |
| All collected log data shall be stored locally in an access controlled read-only, tamper-proof format to ensure integrity and compliance. |
| 1.7 |
| The SIEM shall correlate logs from all sources and alert on anomalies requiring administrator attention. It must minimize false positives and allow administrators to adjust and customize alerting rules. |
| 1.8 |
| The system must assist with forensic investigations during security incidents, including event timeline reconstruction, identification of compromised accounts or systems, log integrity verification, and export of evidence in standard formats. |
| 1.9 |
| The system shall allow for encryption of fields/logs containing sensitive information. (PII/PHI) |
| 1.10 |
| The SIEM solution shall support VA's achievement of, at minimum, Event Logging Tier EL2 (Intermediate) maturity as defined in OMB Memorandum M-21-31, Improving the Federal Government's Investigative and Remediation Capabilities Related to Cybersecurity Incidents. The contractor shall provide documentation at delivery confirming which EL-tier requirements are satisfied as configured and shall include a roadmap for achieving EL3 (Advanced) maturity within 12 months of deployment. |
| 1.11 |
| The contractor shall provide documentation and configuration support to integrate the SIEM into the GenISIS system-level Continuous Monitoring Strategy in accordance with NIST SP 800-137 and VA Handbook 6500. A written Continuous Monitoring Integration Plan shall be delivered within 60 days of installation. This plan shall describe how SIEM alerts map to NIST SP 800-53 control families and how monitoring data is made available for upload to VA's GRC tool as assessment evidence. |
Table 2: Observability Requirements
| 2.1 |
| The solution shall support industry standard log collection methods, including but not limited to syslog, Windows Management Instrumentation (WMI), Java Database Connectivity (JDBC), Open Database Connectivity (ODBC), Simple Network Management Protocol (SNMP), Internet Protocol Flow Information Export (IPFIX), Checkpoint Log Export Application Programming Interface (LEA), Common Internet File System (CIFS), Server Message Block 3.0 (SMB 3), Network File System (NFS), Secure Shell Protocol (SSH) file shares. |
| 2.2 |
| The system shall have the ability to consolidate events across multiple sites and is viewable in one console. |
| 2.3 |
| The solution shall normalize common event fields, e.g., usernames, IP addresses, hostnames, and log source device, other common information across logs from disparate devices and device types from multiple vendors. |
| 2.4 |
| The solution shall provide a common taxonomy of events. |
| 2.5 |
| The solution shall provide the ability to store and retain the normalized and original raw format of the event log for forensic purposes. |
| 2.6 |
| The solution shall provide the ability to customize, for example, to normalize and aggregate event fields that are not represented by the out-of-the-box normalized fields. |
| 2.7 |
| The solution shall support and normalize event time stamps across multiple time zones. |
| 2.7a |
| All log timestamps shall conform to ISO 8601 and RFC 3339 standards using the format YYYY-MM-DDThh:mm:ss.mmmZ (UTC) as required by OMB M-21-31. The SIEM shall synchronize time using a GPS master station clock as the baseline reference. Where GPS is unavailable, NIST's authenticated time service shall be used. Public unauthenticated NTP sources shall not be used as a primary time reference. |
| 2.8 |
| The solution shall support the ingestion of unstructured data, i.e., the ingestion of unstructured, schema less data shall be native to the solution without the need for vendor services including but not limited to pdf, docx, txt. |
| 2.9 |
| The solution shall support retrieval and ingestion of Structured Query Language (SQL) based information, such as but not limited to MS-SQL, MySQL, PostgreSQL, Excel, and other commonly used data management tools. |
| 2.10 |
| The solution shall support the collection and analysis of packet capture (PCAP) data. |
| 2.11 |
| The SIEM shall integrate with VA-approved Data Loss Prevention (DLP) solutions and shall collect, correlate, and retain DLP log data in accordance with OMB M-21-31 Appendix C Criticality Level 2 requirements. DLP logs shall be retained for a minimum of 12 months in active storage and 18 months in cold storage. The SIEM shall correlate DLP events with identity, network, and endpoint log sources to support detection of insider threats, unauthorized data exfiltration, and policy violations involving personally identifiable information (PII) and sensitive VA data. The contractor shall include DLP correlation rule configuration as part of the installation and configuration support deliverable. |
| 2.12 |
| The solution shall support information collected from proprietary telemetry data. |
| 2.13 |
| The solution shall support information collected from Directory, such as but not limited to Active Directory (AD), Lightweight Directory Access Protocol (LDAP) |
| 2.14 |
| The solution shall support information collected from Network infrastructure Devices, e.g., switches, routers, firewalls, and other network devices. |
| 2.14a |
| The SIEM shall support collection and analysis of passive DNS log data in accordance with OMB M-21-31 EL1 requirements, including DNS source and destination IP and port, query and response content, all record types, and zone transfer requests. The system shall include analytics enabling rapid identification of the host sourcing each DNS query, with automated alerting for anomalous DNS activity. Passive DNS data shall be retained for a minimum of 12 months active storage and 18 months cold storage per M-21-31 Appendix C Criticality Level 0 requirements. |
| 2.15 |
| The solution shall support information collected from industry standard vulnerability scanners including but not limited to vulnerability scanning, and vulnerability database updates. |
| 2.16 |
| The system shall provide a development kit to create custom-developed data sources without assistance from the vendor or professional services. |
| 2.17 |
| Log retention policy shall be configurable for different data sources to meet administrative and regulatory requirements. |
| 2.18 |
| The system shall support configurable log storage policy including requirements such as encryption, durability, and redundancy for different data types, for administrative and regulatory compliance needs. |
| 2.18a |
| The SIEM shall enforce log retention in accordance with OMB M-21-31 Appendix C. At minimum: Criticality Level 0 logs (including Identity & Credential Management, Network Device Infrastructure, DNS, DHCP, Operating System logs, and Cloud environment logs) shall be retained for 12 months active storage and 18 months cold storage. Criticality Level 1 logs (including Authentication & Authorization, Firewall, VPN, EDR, Vulnerability Assessment, and Database logs) shall be retained for 12 months active storage and 18 months cold storage. Criticality Level 2 logs (including DLP, Application-level, and Full Packet Capture metadata) shall be retained for 12 months active storage and 18 months cold storage. Full packet capture data shall be retained for a minimum of 72 hours. The system shall enforce retention automatically and provide compliance reporting confirming adherence to these schedules. |
| 2.19 |
| The SIEM shall ingest log data from all required sources in near real-time, defined as no greater than a five (5) minute delay between event occurrence and ingestion. Log forwarding shall be automated, continuous, and encrypted in transit between source and destination consistent with OMB M-21-31 Event Forwarding requirements. The contractor shall configure automated alerting to notify administrators if forwarding from any source is interrupted for more than fifteen (15) minutes. The system shall ensure the original log can be replayed for future forensic use. Log forwarding configuration and associated alerting thresholds shall be documented and delivered as part of the installation support deliverable. |
Table 3: Discovery Requirements
| 3.1 |
| The solution shall provide full text search of all ingested data using pattern matching and regular expressions. |
| 3.2 |
| The solution shall have a web-based user interface (UI) and a network capable Application Programming Interface (API) for executing search functionality. |
| 3.3 |
| The solution shall return a set of log events that match a given search query. |
| 3.4 |
| The solution shall provide a way for a user or administrator to cancel a query. |
| 3.5 |
| The solution shall have a query capability that can use plain English keywords to find and return a set of log events. |
| 3.6 |
| The solution shall provide searching of data immediately after indexing. |
| 3.7 |
| The solution shall provide searching of data within a user-defined date/time range. |
| 3.8 |
| The solution shall allow users to schedule a query to search for events on a given date and/or time range interval. |
| 3.9 |
| The solution shall have a query capability that can return a set of log events grouped by one or more fields to correlate log events. |
| 3.10 |
| The solution shall have a query capability that can use regular expressions to find and return a set of log events. |
| 3.11 |
| The solution shall have the capability to calculate statistics on a queried set of log events. At a minimum, query language statistics shall include, but are not limited to count, sum, average, min, max, standard deviation, and percentile of field values. |
| 3.12 |
| The solution shall have a capability to export a set of log events to a comma-separated values (CSV) |
| 3.13 |
| The vendor shall provide evidence of performance metrics for simple search queries less than 15 seconds for search space of ~5TB. |
| 3.14 |
| The solution shall support set operations including set union, set difference, and set intersection, across two sets of search results. |
| 3.15 |
| The solution shall support the removal of fields specified in a query from search results. |
| 3.16 |
| The solution shall support the ability to perform external table lookups at search time to enrich fields. |
| 3.17 |
| The solution shall provide a way to configure definitions of external lookups for the purpose of field enrichment. Lookups at a minimum shall include: |
· Local file-based sources
· SQL database lookups
· Common directory lookups (eg. AD, LDAP, DNS)
| 3.18 |
| The solution shall have a capability to query log data based on metadata fields associated with the log data. |
| 3.19 |
| The solution shall provide searching to include use of Boolean operators within a single search expression. |
| 3.20 |
| The solution shall provide search capability that generates results in a drilldown output structure. |
| 3.21 |
| The solution shall allow full text searching using strings, numbers, time ranges (specific or relative), Boolean logic, wildcards, Classless Inter-Domain Routing (CIDR), or regular expression (regex) against individual field(s) or freeform against the entire message. |
| 3.22 |
| The solution shall natively provide all search capabilities for structured and unstructured schemeless data. |
| 3.23 |
| The solution shall provide extensible, statistical search time analysis, e.g., count of occurrences, distinct count of occurrences, sum, most/least common values of a field, minimum, maximum, average, mean, mode, median, standard deviation, variance, identification of anomalous values, statistical correlation between fields, clustering of events as a single event based on similarity, truncate outlying numerical values in selected fields to assist in statistical correlation, first and last seen value, percentile, predicted values, union, diff. |
| 3.24 |
| The solution shall provide the ability to search for relationships between pairs of fields by comparing the values of one field to a reference field and value pair. |
| 3.25 |
| The solution shall support field extractions/normalizations that can be created on the fly for new events. |
| 3.26 |
| The solution shall support new field extractions/normalizations that can be used when searching for historical events. |
| 3.27 |
| The solution shall provide the capability to create new search commands, e.g., stored procedures defined with a domain specific language (DSL) or external filters which extend the search interface using an application programing interface (API) usable by programs written in bash, PowerShell, python, etc. The solution shall allow custom filter commands to be made available to other users. |
Table 4: Telemetry Requirements
| 4.1 |
| The solution shall provide summary views for corelated events with the ability to drill down into specific events. |
| 4.2 |
| The solution shall support identification and storage of baseline performance attributes. |
| 4.3 |
| The solution shall allow multiple thresholds per element to define warning and critical levels. |
| 4.4 |
| The solution shall allow users to adjust thresholds for each element being monitored. |
| 4.5 |
| The solution shall identify when an element exceeds a threshold. |
| 4.6 |
| The solution shall allow elements to be put into a maintenance state to suppress alarms from the element. |
| 4.7 |
| The solution shall provide configurable date and timestamp formats for each piece of event data collected. |
| 4.8 |
| The solution shall handle timestamps from different time zones, supporting UTC and offsets. |
| 4.9 |
| The solution shall handle sub-second resolution on timestamp. |
| 4.10 |
| The solution shall identify the source of all event data collected, as provided by the data stream. |
| 4.11 |
| The solution shall maintain a query-able repository of all network devices and event data elements monitored. |
| 4.12 |
| The solution shall maintain the integrity of the chain of events. |
| 4.13 |
| The solution shall support processing large datasets, i.e., greater than five million records three times per day. |
Table 5: Enterprise Command Center Requirements
| 5.1 |
| Real-time display of ingested structured and unstructured data across a wide variety of tools and services available. |
| 5.2 |
| Customizable dashboards for specific programs and requirements. |
| 5.3 |
| Ability to seamlessly integrate with existing and future tools and services supported by APIs or SDKs. |
| 5.4 |
| Creation of comprehensive service trees to visually represent relationships and dependencies between services. |
| 5.5 |
| Predictive analytics capabilities to forecast potential issues and provide early warnings. |
| 5.6 |
| Advanced alerting to notify stakeholders of potential or existing issues. |
| 5.7 |
| Automated anomaly detection and behavioral analysis |
| 5.8 |
| Predictive health scoring to preemptively manage service and infrastructure issues. |
| 5.9 |
| Robust data security measures to protect sensitive information. |
| 5.10 |
| Compliance with VA regulations, including handling of PHI, PII, and other VA-sensitive data. |
| 5.11 |
| Support for existing data connectors and ability to create new connectors as needed. |
| 5.11a |
| The SIEM shall support export and sharing of log data with the Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) upon request, consistent with OMB M-21-31 and 44 U.S.C. § 3553(l). The contractor shall configure data export capabilities in formats and by means consistent with CISA and FBI requirements, including near real-time access when required by those agencies. Export capability configuration shall be documented and delivered as part of the installation support deliverable. |
| 5.12 |
| Interoperability with various data sources including databases and logs. |
| 5.13 |
| Ability to perform historical data analysis for trend identification and decision making. |
| 5.14 |
| Advanced data visualization tools to create meaningful and interactive dashboards. |
| 5.15 |
| Availability of training resources for users and administrators. |
| 5.16 |
| The SIEM shall support integration with Security Orchestration, Automation, and Response (SOAR) capabilities consistent with OMB M-21-31 EL1 planning requirements. The contractor shall deliver a SOAR Readiness Assessment within 90 days of installation, describing native SOAR capabilities, available API integrations, and a recommended implementation approach for automated incident response playbooks aligned with VA's continuous monitoring program. |
| 5.17 |
| The SIEM shall include or support integration with User Behavior Analytics (UBA) capabilities consistent with OMB M-21-31. The solution shall support planning-level UBA at deployment with a documented roadmap for full UBA implementation, to be delivered within 90 days of installation. UBA shall be configurable to detect and alert on, at minimum: compromised user credentials, privileged user compromise, improper asset access, compromised systems or hosts, and lateral movement of a threat actor. Full UBA implementation is required to achieve M-21-31 EL3 maturity. |
OPTIONAL REQUIREMENTS
ITEM 1 – SIEM SUPPORT - QUANTITY: 1
SUPPORT
SIEM Support
Salient Characteristics
1 Year of support for Option year 1
ITEM 2 – SIEM SUPPORT - QUANTITY: 1
SUPPORT
SIEM Support
Salient Characteristics
1 Year of support for Option year 2
ITEM 3 – SIEM SUPPORT - QUANTITY: 1
SUPPORT
SIEM Support
Salient Characteristics
1 Year of support for Option year 3
NOTICE OF THE FEDERAL ACCESSIBILITY LAW AFFECTING ALL INFORMATION AND COMMUNICATION TECHNOLOGY (ICT) PROCUREMENTS (SECTION 508)
On January 18, 2017, the Architectural and Transportation Barriers Compliance Board (Access Board) revised and updated, in a single rulemaking, standards for electronic and information technology developed, procured, maintained, or used by Federal agencies covered by Section 508 of the Rehabilitation Act of 1973, as well as our guidelines for telecommunications equipment and customer premises equipment covered by Section 255 of the Communications Act of 1934. The revisions and updates to the Section 508-based standards and Section 255-based guidelines are intended to ensure that information and communication technology (ICT) covered by the respective statutes is accessible to and usable by individuals with disabilities.
SECTION 508 – INFORMATION AND COMMUNICATION TECHNOLOGY (ICT) STANDARDS
The Section 508 standards established by the Access Board are incorporated into, and made part of all VA orders, solicitations and purchase orders developed to procure ICT. These standards are found in their entirety at: https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines. A printed copy of the standards will be supplied upon request.
Federal agencies must comply with the updated Section 508 Standards beginning on January 18, 2018. The Final Rule as published in the Federal Register is available from the Access Board: https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule.
The Contractor shall comply with “508 Chapter 2: Scoping Requirements” for all electronic ICT and content delivered under this contract. Specifically, as appropriate for the technology and its functionality, the Contractor shall comply with the technical standards marked here:
| |X| | E205 Electronic Content – (Accessibility Standard -WCAG 2.0 Level A and AA Guidelines) |
| |X| | E204 Functional Performance Criteria |
| |X| | E206 Hardware Requirements |
| |X| | E207 Software Requirements |
| |X| | E208 Support Documentation and Services Requirements |
COMPATABILITY WITH ASSISTIVE TECHNOLOGY
The standards do not require installation of specific accessibility-related software or attachment of an assistive technology device. Section 508 requires that ICT be compatible with such software and devices so that ICT can be accessible to and usable by individuals using assistive technology, including but not limited to screen readers, screen magnifiers, and speech recognition software.
ACCEPTANCE AND ACCEPTANCE TESTING
Deliverables resulting from this solicitation will be accepted based in part on satisfaction of the Section 508 Chapter 2: Scoping Requirements standards identified above.
The Government reserves the right to test for Section 508 Compliance before delivery. The Contractor shall be able to demonstrate Section 508 Compliance upon delivery.
INFORMATION TECHNOLOGY USING ENERGY-EFFICIENT PRODUCTS
The Contractor shall comply with Sections 524 and Sections 525 of the Energy Independence and Security Act of 2007; Section 104 of the Energy Policy Act of 2005; Executive Order 13834, “Efficient Federal Operations”, dated May 17, 2018; Executive Order 13221, “Energy-Efficient Standby Power Devices,” dated August 2, 2001; and the Federal Acquisition Regulation (FAR) to provide ENERGY STAR®, Federal Energy Management Program (FEMP) designated, low standby power, and Electronic Product Environmental Assessment Tool (EPEAT) registered products in providing information technology products and/or services.
The Contractor shall deliver and furnish to the Government, or use in the performance of work by Contractor employees at a Federally controlled facility, only servers that at the time of submission of proposals and at the time of award, are EPEAT® bronze registered or higher. For information about EPEAT®, see www.EPEAT.net.)
ENERGY STAR
1. Data Center Equipment- (Data Center Storage, Enterprise Servers, Large Network Equipment, Small Network Equipment, Uninterruptible Power Supplies)
As required in clause 52.223-15 Energy Efficiency in Energy-Consuming Products, the Contractor shall provide products that earn the ENERGY STAR label and meet ENERGY STAR specifications for energy efficiency. For information about ENERGY STAR, see http://www.energystar.gov for complete product specifications and updated lists of qualifying products.
SHIPMENT OF HARDWARE OR EQUIPMENT
Inspection: Destination Acceptance: Destination Free on Board (FOB): Destination
Boston Site: Ship To and Mark For:
Primary
Alternate
| Name: |
| Mark Hewitt |
| Name: |
| Paul Hseih |
| Address: |
| VA Boston Healthcare System |
150 S. Huntington Ave Boston, MA 02130
| Address: |
| VA Boston Healthcare System |
150 S. Huntington Ave Boston, MA 02130
| Voice: |
| 617-899-9182 |
| Voice: |
| 857-488-2368 |
| Email: |
| mark.hewitt@va.gov |
| Email: |
| paul.hsieh@va.gov |
Pittsburg Site: Ship To and Mark For:
Primary
Alternate
| Name: |
| Sean Engel |
| Name: |
| Chris Goodwin |
| Address: |
| VA Pittsburg Health Care |
| Address: |
| VA Pittsburg Health Care |
1010 Delafield Rd Bldg 32 Pittsburg, PA 15215
1010 Delafield Rd Bldg 32 Pittsburg, PA 15215
| Voice: |
| 412-822-3380 - Office |
512-923-8083 - Mobile
| Voice: |
| 412-8223912 – Office |
412-592-6133 - Mobile
| Email: |
| Sean.engel@va.gov |
| Email: |
| Christopher.goodwin2@va.gov |
SPECIAL SHIPPING INSTRUCTIONS
Prior to shipping, Contractor shall notify Site POCs, by phone followed by email, of all incoming deliveries including line-by-line details for review of requirements. The Contractor shall not make any changes to the delivery schedule at the request of Site POC.
Contractors shall coordinate deliveries with Site POCs before shipment of hardware to ensure sites have adequate storage space.
All shipments, either single or multiple container deliveries, shall bear the VA IFCAP Purchase Order number on external shipping labels and associated manifests or packing lists. In the case of multiple container deliveries, a statement readable near the VA IFCAP PO number shall indicate total number of containers for the complete shipment (e.g. “Package 1 of 2”), clearly readable on manifests and external shipping labels.
Packing Slips/Labels and Lists shall also include the following:
IFCAP PO #: ____________ (e.g., 166-E11234 (the IFCAP PO number is located in block #20 of the SF 1449)) Project Description: (e.g. Tier I Lifecycle Refresh)
Total number of Containers: Package ___ of ___. (e.g., Package 1 of 3)
GENERAL REQUIREMENTS
VA TECHNICAL REFERENCE MODEL
The Contractor shall support the VA enterprise management framework. In association with the framework, the Contractor shall comply with OIT Technical Reference Model (VA TRM). The VA TRM is one component within the overall Enterprise Architecture (EA) that establishes a common vocabulary and structure for describing the information technology used to develop, operate, and maintain enterprise applications. Moreover, the VA TRM, which includes the Standards Profile and Product List, serves as a technology roadmap and tool for supporting OIT. Architecture & Engineering Services (AES) has overall responsibility for the VA TRM.
SOCIAL SECURITY NUMBER (SSN) REDUCTION
The Contractor solution shall support the Social Security Number (SSN) Fraud Prevention Act (FPA) of 2017 which prohibits the inclusion of SSNs on any document sent by mail. The Contractor support shall also be performed in accordance with Section 240 of the Consolidated Appropriations Act (CAA) 2018, enacted March 23, 2018, which mandates VA to discontinue using SSNs to identify individuals in all VA information systems as the Primary Identifier. The Contractor shall ensure that any new IT solution discontinues the use of SSN as the Primary Identifier to replace the SSN with the Integrated Control Number (ICN) in all VA information systems for all individuals. The Contractor shall ensure that all Contractor delivered applications and systems integrate with the VA Master Person Index (MPI) for identity traits to include the use of the ICN as the Primary Identifier. The Contractor solution may only use a Social Security Number to identify an individual in an information system if and only if the use of such number is required to obtain information VA requires from an information system that is not under the jurisdiction of VA.
INTERNET PROTOCOL VERSION 6 (IPV6)
The Contractor solution shall support Internet Protocol Version 6 (IPv6) based upon the memo issued by the Office of Management and Budget (OMB) on November 19, 2020 (https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-07.pdf). IPv6 technology, in accordance with the USGv6 Program (https://www.nist.gov/programs-projects/usgv6-program/usgv6-revision-1), NIST Special Publication (SP) 500-267B Revision 1 “USGv6 Profile” (https://doi.org/10.6028/NIST.SP.500-267Br1), and NIST SP 800-119 “Guidelines for the Secure Deployment of IPv6” (https://doi.org/10.6028/NIST.SP.800-119), compliance shall be included in all IT infrastructures, application designs, application development, operational systems and sub-systems, and their integration. In addition to the above requirements, all devices shall support native IPv6 and dual stack (IPv6 / IPv4) connectivity without additional memory or other resources being provided by the Government, so that they can function in a mixed environment. All public/external facing servers and services (e.g. web, email, DNS, ISP services, etc.) shall support native IPv6 and dual stack (IPv6 / IPv4) users and all internal infrastructure and applications shall communicate using native IPv6 and dual stack (IPv6 / IPv4) operations.
INFORMATION SECURITY CONSIDERATIONS:
The Assessment and Authorization (A&A) requirements do not apply and a Security Accreditation Package is not required.
All VA sensitive information shall be protected at all times in accordance with local security field office System Security Plans (SSP’s) and Authority to Operate (ATO)’s for all systems/LAN’s accessed while performing the tasks detailed in this Product Description.
POINTS OF CONTACT
VA Program Manager:
| Name: | | Brian Ibbison |
| Address: | 150 S. Huntington Ave Boston, MA 02130 | |
| Voice: | | 774-826-1269 |
| Email: | | brian.ibbison@va.gov |
Contracting Officer’s Representative:
| Name: | | Margaret Mitchell |
| Address: | Product Delivery Services (PDS) | |
| Voice: | | 571-394-3108 |
| Email: | | Margaret.Mitchell@va.gov |
Contracting Officer:
| Name: | | Edward Hebert |
| Address: | 23 Christopher Way, Eatontown, NJ 07724 | |
| Voice: | | 848-377-5040 |
| Email: | | Edward.Hebert@va.gov |
Contract Specialist:
| Name: | | Ethan Goldring |
| Address: | 23 Christopher Way, Eatontown, NJ 07724 | |
| Voice: | | 848-377-5180 |
| Email: | | Ethan.Goldring@va.gov |
image1.jpeg
