Attachment 1 - Risk Analysis_Update_14MAR2024.xlsx
XLSX spreadsheet 36 KB Posted
- Attached to
- Health Care Delivery Solutions (MHS GENESIS)
- Solicitation number
- HT0038-24-R-0004
- Issued by
-
Defense Health Agency
About this file
This risk analysis update and related federal contract opportunity outline the Defense Health Agency's plans for its Health Care Delivery Solutions contract. The risk analysis provides the government's assessments of transition risks for various work breakdown structure items under three goals: keeping the system operational and compliant, modernizing capabilities, and maximizing value. It requests industry feedback on the assessments by February 5, 2024.
The federal contract opportunity notes that the current Health Care Delivery Solutions contract serving the Military Health System GENESIS electronic health record is expiring. It seeks industry input by February 5, 2024 to assist in developing the new contract strategy. An in-person or virtual discussion is scheduled for February 8, 2024 to review the requested risk analysis information and answer questions. The opportunity does not involve an active solicitation but aims to obtain information to support contract planning for products and services supporting the Military Health System GENESIS and other clinical applications.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| Industry Engagement_23JUL2024.pptx | PPTX presentation | |
| Risk Analysis Industry Engagement_Update_13FEB2024.pdf | ||
| Health Care Delivery Solutions (MHS GENESIS)_Industry Engagement Q_A_8 Feb_2024_Final.pdf | ||
| Risk Analysis Industry Engagement_5FEB2024.pdf | ||
| Attachment 1 - Risk Analysis_5FEB2024.xlsx | XLSX spreadsheet |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Directions
| Risk Level to Transition Key | |
| N/A | Does not apply or risk analysis is completed at a lower level WBS |
| Low | The risk to transition is minimal or can be predicted with an acceptable degree of certainty |
| Medium | The risk to transition is moderate due to system level complexity and may impact end user performance, cost, and/or schedule. |
| High | The risk to transition is significant due to the high level of system complexity with a high probability of impact to end user performance, cost, and/or schedule. |
| Tab Name | Goal |
| Keep Operational | (Refer to slide 15: Keep the System Operational and Compliant) Maintain the current health care delivery solutions and ensure they remain compliant with cybersecurity posture, conduct defect resolutions, maintain commercial baseline, and centrally host the fully integrated solution(s). |
| Modernize | (Refer to slide 16: Keep the System Modern) Provide continuous capability delivery, enhance the end user experience, and leverage new technologies. |
| Maximize Value | (Refer to slide 17: Promote maximum value from the use of Health Care Delivery Solutions) Optimize the health care delivery solutions to maximize the value and provide benefits to end users and patients. |
| Instructions | |
| For each tab: the Government has assessed the risk associated with each work breakdown structure (WBS) in context with the goal identified. At the WBS level, the Government is requesting industry to review the Government's risk assessment and provide their assessment of the risk to transition. Populate the Risk Level to transtiion (n/a, low, medium, high) leveraging the key above and then provide a reason for the assessment. |
Keep Operational
| MIL-STD-881F | Government Update Assessment | ||
| Keep the System Operational and Compliant | Contractor Updated Assessment |
Keep the System Operational and Compliant
| WBS | WBS Title | Description | Risk Level to Transition | Reason | Risk Level to Transition | Reason | |
| 2.0 | IS/DBS Sustainment (MHS GENESIS) | Sustainment is a critical part of delivering and ensuring information systems/defense business systems (IS/DBS) hardware and software are continuously maintained, updated, and enhanced throughout the acquisition process until Material Support Date (MSD). Since IS/DBS systems are often deployed incrementally over time, the effort to keep them functionally up to date needs to be captured. This sustainment structure is intended to be used for IS/DBS sustainment activities vs. the CAPE O&S structure, which does not address sustainment for IS/DBS projects/systems | N/A | See lower levels | |||
| 2.1 | Program Management | This element includes costs for management activities continuing from development or production or started during the sustainment phase. Program management activities are similar to those performed during development or production. This element also includes management efforts related to maintenance and supply chain, possibly started in production and continuing into sustainment. | N/A | Each contract has some level of program management oversight required. | |||
| 2.2 | Systems/Sustaining Engineering | The cost associated with software specific sustaining engineering activities such as studies/investigations for software specific issues. Sustaining engineering does not include any effort or cost for either maintenance (corrections) or capability enhancements: these are included in the release data. User support should not include field software engineering, nor data in other subcategories | high | Knowledge of MHS GENESIS configuration, as well as the underlying Commercial Off the Shelf (COTS) solutions, is required to support this effort. Although there is significant documentation and sufficient transition timeframe, the documentation is not digestible. Another contractor would have significant challenges providing sustaining engineering activities such as studies/ investigations for specific software issues without the in-depth knowledge of the system and digestible documentation. | |||
| 2.3 | Change Management | Change management refers to the broad process for managing organizational change. Change management encompasses planning, oversight, governance, project management, testing and implementation. | low | Although a new contractor would need to learn the MHS GENESIS system, organizational change management practices are consistently evolving. The risk to transition is low due to the additional resources available, such as DHA-Health Informatics and Solution Owners, to assist in filling gaps even after the transition is completed. | |||
| 2.4 | Help Desk | This element captures the costs of providing help desk support for end users. It includes Level I through III. This support will include user account management. The reporting system must specify which tier is applicable. The help desk/operations support team (OST) will provide Tier I level support for problems related to systems administration and monitoring, event management, and database administration including restart, recovery, backups, and restorals. The help desk support staff is the initial focal point for answering questions and providing status information for the hosted site. The typical support hours are 24 x 7 x 365. | N/A | See lower levels | |||
| 2.4.1 | Tier 1 | The help desk/operations support team (OST) will provide Tier I level support for problems related to systems administration and monitoring, event management, and database administration including restart, recovery, backups, and restorals. | low | Although a new contractor would need to learn the MHS GENESIS system, the contractor has developed standard scripts and a knowledge base of common problems to assist Tier 1. The System contractor also provides updates to the scripts and trains the Tier 1 and Tier 2 help desk customer agents when required (e.g. prior to a release). | |||
| 2.4.2 | Tier2 | Tier 2 support provided by experienced and knowledgeable support personnel who assess issues and | |||||
| provide solutions for problems. | low | Although a new contractor would need to learn the MHS GENESIS system, the contractor has developed standard scripts and a knowledge base of common problem to assist Tier 2. The System contractor also provides updates to the scripts and trains the Tier 1 and Tier 2 help desk customer agents when required (e.g. prior to a release). | |||||
| 2.4.3 | Tier 3 | Tier 3 support provided by highly skilled product specialists who have an expert knowledge of the |
application and can resolve issues or problems and fix defects in the production baseline by changing
| the system software. | high | Defect fixes typically reside with the software developer as part of license maintenance. Although there is significant documentation and transition timeframe, the documentation is not digestible. Another contractor would have significant challenges providing Tier 3 help desk support without the in depth knowledge of the system and digestible documentation. NOTE: Tier 3 also provides services that require access to the database to support an approved change (e.g. add a new role, adjust orders, add medication, etc.). | |||
| 2.5 | Data Cleansing/ Data Maintenance | This element includes the effort for translating data from one format to another. This should cover only those efforts that are incurred at the maintenance site. Also include any expense associated with the transition of data from the legacy systems to the IS/DBS solution. Use lower levels to identify individual legacy systems. | high | A new contactor would need to learn the logical data layer of the MHS GENESIS system. The data dictionary for some of the COTS systems is considered proprietary and unavailable to the Government. | |
| 2.6 | System/Database Administration | This element captures the costs of providing system/database administration for the IS/DBS solution computer resources once operational site activation is complete and the system has reached full operational capability (FOC). These could be costs incurred as a result of continuing contractor support or by the Government. | high | A new contactor would need to learn the logical data layer of the MHS GENESIS system. The data dictionary for some of the COTS systems is considered proprietary and unavailable to the Government. | |
| 2.7 | IT Infrastructure/Network Maintenance Support | Provide day-to-day management and operation of IT assets and processes. IT management are divided into three key sub-segments: operations services (for IT infrastructure), application management services, and help desk management services. | high | Most of the IT infrastructure and network maintenance support is provided by DHA- J6 via the Med COI, but there are several enclaves that require a mix of support between the current system integrator and DHA-J6. Knowledge of the breakout between what is DHA-J6 and the current system integreator is required to support this effort. | |
| 2.8 | Operational Hardware Refresh/ Upgrade | This element includes the costs of periodic replacement of computers and peripherals, including end-user, cybersecurity, and IT infrastructure and enterprise services. | high | Priorietary Hardware Only: High risk of changing contractors due to the proprietary hardware solutions that are part of the overarching system and can not be replaced by a different hardware solution unless it is determined to be compatible with MHS GENESIS. This would be determined when technical refresh/ upgrade occurrs. | |
| 2.9 | Operational Software License Refresh/ Update | The cost associated with the procurement and renewal of software licenses for operational software. Also includes effort to manage licenses for the maintenance facility as well as deployed systems. | low | The current license terms and agreements are well documented. In "keeping the system operational", the assumption is the license terms would not change significantly. Transitioning the licenses and license maintenance would be minimal risk to the Government. | |
| 2.10 | Cybersecurity Maintenance Management | The cost associated with activities such as software cybersecurity and information assurance vulnerability management (IAVM), which is the management of the overall IAVA process. Cybersecurity and the risk management framework (RMF) for DoD information technology verifies the software system against externally defined domain performance criteria | medium | Knowledge of MHS GENESIS solution(s) that is(are) in the MHS GENESIS enclave, as well as the underlying COTS solutions, is required to support this effort. The DoD is primarily responsible for implementing the cyber controls for MHS GENESIS in coordination with other partners, including the Department of Veterans Affairs, the United States Coast Guard, and other federal entities. The cybersecurity posture of MHS GENESIS enclave is well documented. There are currently six (6) different ATO's with renewal scheduled for FY2025. Risk does not reside with the transition, but with the overall maintenance of the system and the cybersecurity posture. The risk increases when multiple contractors support the maintnenance of the cybersecurity posture. | |
| 2.11 | Follow-on User Training | The cost associated with follow-on user training. | low | Although a new contractor would need to learn the MHS GENESIS system, user training practices are consistently evolving. Follow-on user training should be coupled with change management to be most effective. The risk to transition is low given that the significant training material already owned by the Government, that MHS GENESIS is already deployed, and that additional resources are available, such as DHA-Health Informatics and Solution Owners, to assist in filling gaps even after the transition is completed. | |
| 2.12 | System Independent Verification and Validation | This element contains all costs associated with information system and software independent verification and validation (IV&V). IV&V is a third-party review that ensures that the system is well engineered (verification) and that the system meets the users’ needs (validation). This may be performed by the Government. | N/A | See lower levels | |
| 2.12.1 | System Independent Verification and Validation (cyber) | This element contains all costs associated with information system and software independent verification and validation (IV&V). IV&V is a third-party review that ensures that the system is well engineered (verification). | N/A | This is a Government activity | |
| System Independent Verification and Validation (Government testing) | This element contains all costs associated with information system and software independent verification and validation (IV&V). IV&V is a third-party review that ensures that the system is well engineered (verification) and that the system meets the users’ needs (validation). This may be performed by the Government. | N/A | This is a Government activity | ||
| 2.13 | Continuing System Improvements | This element includes the costs of hardware and software updates that occur after deployment of a system. These updates improve a system’s safety, reliability, maintainability, or performance characteristics and enable the system to meet its basic operational requirements throughout its life. | N/A | See lower levels | |
| 2.13.1 | Operational Hardware Modification | The cost of development, procurement, and installation of modification kits. Modification kits will consist of both kits of equipment to be installed and kits for provisions such as cables, brackets, or other interface devices. Also includes costs associated with the modifications for support equipment, training equipment, technical publications/data, and initial spares and repair parts (consistent with the approved modification content). These modifications are needed to achieve critical capabilities | high | Proprietary Hardware Only: High risk of changing contractors to maintain proprietary hardware solutions and provide upgrades. Other contractors will not have the experience or ability to maintain the proprietary hardware solution. | |
| 2.13.2 | Software Release Modification/ Enhancement 1…n | The cost of modifying/enhancing, performing routine fixes and deficiency corrections on software, as well as IAVAs/security patches which include the cost associated with changing the software to address information assurance vulnerability alert. | N/A | See below | |
| 2.13.2.1 | Modification/ Enhancements | This element includes the cost to modify or enhance the existing system. | medium | Modification and Enhancements are defined as modification to the existing system configuration, and enhancements are Software COTS enhancements that are configured to meet the Government requirements that may or may not be part of the current baseline. This does NOT include any custom development to meet the needs of the Government. |
Knowledge of MHS GENESIS configuration, as well as the underlying COTS solutions, is required to support this effort. Although there is significant documentation and a sufficient transition timeframe, the documentation is not digestible. Another contractor would have significant challenges providing modification to an existing configuration. There is a higher risk to configuring an enhancement to an existing capability, as the contractor must understand the configurations the enhancement will impact in order to ensure the modification does not impact other configurations and meets the enhancement requirements. There is a lower risk to a new "enhancement" for another contractor to complete the configuration of the new COTS capability. The risk is ensuring the new capability is linked to current existing capabilities (as needed) and understanding the impact to those other capabilities.
2.13.2.2 Routine Fixes and Deficiency Corrections This element includes the cost to perform routine fixes or deficiency corrections not covered under the terms of the software license maintenance. high Defect fixes typically reside with the software developer as part of license maintenance. Although there is significant documentation and a sufficient transition timeframe, the documentation is not digestible. Another contractor would have significant challenges providing routine fixes and deficiency corrections without access to the system code (if required) and without in-depth knowledge of the system.
Routine fixes may include, but are not limited to, changes required due to a "partner" system change in order to maintain compatability and functionality.
| 2.13.2.3 | Installation/ Test | This element includes the cost to prepare, support, and execute the installation and testing of system changes. | high | Knowledge of MHS GENESIS configuration, as well as the underlying COTS solutions, is required to support this effort. Although there is significant documentation and a sufficient transition timeframe, the documentation is digestible. Another contractor would have significant challenges providing successful installation/test activities in order to ensure the routine fix, deficiency correction, modification, and/or enhancement is working as designed, as well as not negatively impacting other parts of the system. |
| 2.13.2.4 | IAVAs | The cost associated with software cyber security, hardware cyber security, Federal Information Security Management Act (FISMA) compliance, security technical implementation guide (STIG) implementations, information assurance vulnerability management (IAVM), and zero trust (ZT) which is the management of the overall security posture of the system. Cyber security and the risk management framework (RMF) for DoD information technology balances security controls against the risk to the system assets and data against known and emergent threats. | high | Knowledge of MHS GENESIS solution(s) that is(are) in the MHS GENESIS enclave, the underlying COTS Solutions, and an understanding of known and emergent cybersecurity threat vectors is required to support this effort. The Lead Integrator, in coordination with the DoD, is primarily responsible for implementing the cyber controls for MHS GENESIS in coordination with partners, including the Department of Veterans Affairs, the United States Coast Guard, and other federal entities. The cybersecurity posture of MHS GENESIS enclave is well documented. MHS GENESIS has implemented persistent cyber operations and there are currently six (6) different ATO's with renewal scheduled in FY2025. Risk does not reside with the transition, but with the ongoing maintenance of the cybersecurity posture of the system. |
| 2.14 | AW/Safety/Networthiness Certification | This element includes the cost to prepare, support, and execute certification activities for a software release to include airworthiness, safety, and networthiness certifications. | N/A | The Government has no requirement for AW/Safety/Networthiness Certification |
| 2.15 | Facilities | This element contains all costs associated with facilities operations which can be directly attributed to the system being fielded or in support of its personnel. These costs include, but are not limited to: facilities, power requirements, special material and supplies, leased or owned facilities and construction, operations, and maintenance of facilities. | high | Current solution is hosted in the Oracle/Cerner Data Center. Risk to transition is high and cost-prohibitive for all solutions that are on-prem. For all solutions that are "cloud" compatible, those should be hosted in the Government provided "cloud". |
Modernize
| MIL-STD-881F | Government Update Assessment | ||
| Keep the System Modern | Contractor Update Assessment |
Keep the System Modern
| WBS | WBS Title | Description | Risk Level to Transition | Reason | Risk Level to Transition | Reason | |
| 2.0 | IS/DBS Sustainment (MHS GENESIS) | Sustainment is a critical part of delivering and ensuring information systems/defense business systems (IS/DBS) hardware and software are continuously maintained, updated, and enhanced throughout the acquisition process until Material Support Date (MSD). Since IS/DBS systems are often deployed incrementally over time, the effort to keep them functionally up to date needs to be captured. This sustainment structure is intended to be used for IS/DBS sustainment activities vs. the CAPE O&S structure, which does not address sustainment for IS/DBS projects/systems | N/A | See lower levels | |||
| 2.1 | Program Management | This element includes costs for management activities continuing from development or production or started during the sustainment phase. Program management activities are similar to those performed during development or production. This element also includes management efforts related to maintenance and supply chain, possibly started in production and continuing into sustainment. | N/A | Each contract has some level of program management oversight required. | |||
| 2.2 | Systems/Sustaining Engineering | The cost associated with software specific sustaining engineering activities such as studies/investigations for software specific issues. Sustaining engineering does not include any effort or cost for either maintenance (corrections) or capability enhancements: these are included in the release data. User support should not include field software engineering, nor data in other subcategories | N/A | The system/sustaining engineering as described in the WBS would not be applicable to keeping the system modern. System engineering is required to support "keeping the system modernized". | |||
| 2.3 | Change Management | Change management refers to the broad process for managing organizational change. Change management encompasses planning, oversight, governance, project management, testing and implementation. | low | Change management practices are consistently evolving. In order to take advantage of the newest methods for change management and couple it with a system modernization effort, would pose minimal risk to the Government. | |||
| 2.4 | Help Desk | This element captures the costs of providing help desk support for end users. It includes Level I through III. This support will include user account management. The reporting system must specify which tier is applicable. The help desk/operations support team (OST) will provide Tier I level support for problems related to systems administration and monitoring, event management, and database administration including restart, recovery, backups, and restorals. The help desk support staff is the initial focal point for answering questions and providing status information for the hosted site. The typical support hours are 24 x 7 x 365. | N/A | See lower levels | |||
| 2.4.1 | Tier 1 | The help desk/operations support team (OST) will provide Tier I level support for problems related to systems administration and monitoring, event management, and database administration including restart, recovery, backups, and restorals. | low | The Government would want a single, integrated Tier 1 help desk supporting all of MHS GENESIS, to include modernization efforts. Minimal risk to transition Tier 1 help desk. Contractor would be responsible for providing scripts, training, and following up with Tier 1 Help desk resources to ensure Tier 1 Help Desk resources are resolving tickets at the lowest possible level. | |||
| 2.4.2 | Tier2 | Tier 2 support provided by experienced and knowledgeable support personnel who assess issues and | |||||
| provide solutions for problems. | low | The Government would want a single, integrated Tier 2 help desk supporting all of MHS GENESIS, to include modernization efforts. Minimal risk to transition Tier 2 help desk. Contractor would be responsible for providing scripts, training, and following up with Tier 2 Help desk resources to ensure Tier 2 Help Desk resources are resolving tickets at the lowest possible level. | |||||
| 2.4.3 | Tier 3 | Tier 3 support provided by highly skilled product specialists who have an expert knowledge of the |
application and can resolve issues or problems and fix defects in the production baseline by changing
| the system software. | medium | Defect fixes typically reside with the software developer as part of license maintenance. Tier 3 would not be transitioned from the contractor that developed/ configured the modernization effort, but the contractor supporting the modernization effort would need to provide Tier 3 support to resolve issues or problems and fix defects in the production baseline by changing the system software that was modernized. Risk is deconflicting the defect/ issue/ problem between the MHS GENESIS baseline and the modernization effort as well as how the system integrator is leveraged as part of Tier 3. | |||
| 2.5 | Data Cleansing/ Data Maintenance | This element includes the effort for translating data from one format to another. This should cover only those efforts that are incurred at the maintenance site. Also include any expense associated with the transition of data from the legacy systems to the IS/DBS solution. Use lower levels to identify individual legacy systems. | n/a | Should not impact future "Modernization" efforts. | |
| 2.6 | System/Database Administration | This element captures the costs of providing system/database administration for the IS/DBS solution computer resources once operational site activation is complete and the system has reached full operational capability (FOC). These could be costs incurred as a result of continuing contractor support or by the Government. | low | A new contractor would need to learn the logical data layer of the MHS GENESIS system. The data dictionary for some of the COTS systems is considered proprietary and unavailable to the Government. The COTS solutions has system/ database administrators as part of the "services" provided. | |
| 2.7 | IT Infrastructure/Network Maintenance Support | Provide day-to-day management and operation of IT assets and processes. IT management are divided into three key sub-segments: operations services (for IT infrastructure), application management services, and help desk management services. | N/A | Most of the IT Infrastructure and Network Maintenance support is provided by DHA- J6 via the MedCOI. | |
| 2.8 | Operational Hardware Refresh/ Upgrade | This element includes the costs of periodic replacement of computers and peripherals, including end-user, cybersecurity, and IT infrastructure and enterprise services. | medium | Not applicable for modernization, as there should be no hardware refresh/upgrade initially. If a hardware appliance is part of the modernization solution and is proprietary, the risk increases significantly when refresh/upgrade is presented. The risk identified is the contractor's understanding of the current baseline of the system and of system compatibility with more modern technologies. | |
| 2.9 | Operational Software License Refresh/ Update | The cost associated with the procurement and renewal of software licenses for operational software. Also includes effort to manage licenses for the maintenance facility as well as deployed systems. | medium | Not applicable for modernization, as there should be no software license refresh/upgrade initially. However, if a software license/maintenance is part of the modernization solution, the risk may increase when refresh/upgrade is presented. The risk identified is the contractor's understanding of the current baseline of the system and of system compatibility with more modern technologies | |
| 2.10 | Cybersecurity Maintenance Management | The cost associated with activities such as software cybersecurity and information assurance vulnerability management (IAVM), which is the management of the overall IAVA process. Cybersecurity and the risk management framework (RMF) for DoD information technology verifies the software system against externally defined domain performance criteria | medium | Knowledge of MHS GENESIS solution(s) that is(are) in the MHS GENESIS enclave, as well as the underlying COTS solutions, is required to support this effort. The DoD is primarily responsible for implementing the cyber controls for MHS GENESIS in coordination with other partners including the Department of Veterans Affairs, the United States Coast Guard, and other federal entities. The cybersecurity posture of the MHS GENESIS enclave is well documented. There are currently six (6) different ATO's with renewal scheduled for FY2025. Risk does not reside with the transition, but with the overall maintenance of the system. The risk increases when multiple contractors support the maintenance of the cybersecurity posture. When a new capability is introduced as part of MHS GENESIS, an additional risk is identifying how the new capability fits into the current cybersecurity strategy. | |
| 2.11 | Follow-on User Training | The cost associated with follow-on user training. | low | End User Training practices are consistently evolving. Taking advantage of the newest methods would pose minimal risk to the Government. | |
| 2.12 | System Independent Verification and Validation | This element contains all costs associated with information system and software independent verification and validation (IV&V). IV&V is a third-party review that ensures that the system is well engineered (verification) and that the system meets the users’ needs (validation). This may be performed by the Government. | N/A | Performed by the Government | |
| 2.13 | Continuing System Improvements | This element includes the costs of hardware and software updates that occur after deployment of a system. These updates improve a system’s safety, reliability, maintainability, or performance characteristics and enable the system to meet its basic operational requirements throughout its life. | N/A | See lower levels | |
| 2.13.1 | Operational Hardware Modification | The cost of development, procurement, and installation of modification kits. Modification kits will consist of both kits of equipment to be installed and kits for provisions such as cables, brackets, or other interface devices. Also includes costs associated with the modifications for support equipment, training equipment, technical publications/data, and initial spares and repair parts (consistent with the approved modification content). These modifications are needed to achieve critical capabilities | N/A | The Government does not anticipate any new proprietary hardware solution(s) as part of keep the system modern. | |
| 2.13.2 | Software Release Modification/ Enhancement 1…n | The cost of modifying/enhancing, performing routine fixes and deficiency corrections on software, as well as IAVAs/security patches which include the cost associated with changing the software to address information assurance vulnerability alert. | N/A | See lower levels | |
| 2.13.2.1 | Modification/ Enhancements | This element includes the cost to modify or enhance the existing system. | medium | Modification and Enhancements are defined as modification to the existing system configuration and enhancements are Software COTS enhancements that are configured to meet the Government requirements that may or may not be part of the current baseline. This does NOT include any custom development to meet the needs of the Government. |
Knowledge of MHS GENESIS configuration as well as the underlying COTS solutions is required to support this effort. Although there is significant documentation and a sufficient transition timeframe, the documentation is not digestible. Another contractor may have significant challenges providing modification to an existing configuration. This risk is associated with the contractor's ability to identify the parts of the configuration that need to be modified to meet the requirement without negatively impacting the overall configuration.
There is a lower risk to a contractor doing an enhancement. The risk is ensuring the enhancement is properly linked to current capabilities (as needed) to meet the requirement without negatively impacting the overall system.
| 2.13.2.2 | Routine Fixes and Deficiency Corrections | This element includes the cost to perform routine fixes or deficiency corrections not covered under the terms of the software license maintenance. | n/a | Would not require transition as part of modernization. |
| 2.13.2.3 | Installation/ Test | This element includes the cost to prepare, support, and execute the installation and testing of system changes. | medium | Knowledge of MHS GENESIS configuration, as well as the underlying COTS solutions, is required to support this effort. Although there is significant documentation and a sufficient transition timeframe, the documentation is not digestible. Another contractor would have significant challenges providing successful installation/test activities in order to ensure the routine fix/deficiency correction or modification/enhancement works as designed, as well as not breaking any current configuration. Currently have design patterns in place, and as long as those are followed, it reduces the risk to a medium. |
| 2.13.2.4 | IAVAs | The cost associated with software cyber security, hardware cyber security, Federal Information Security Management Act (FISMA) compliance, security technical implementation guide (STIG) implementations, information assurance vulnerability management (IAVM), and zero trust (ZT) which is the management of the overall security posture of the system. Cyber security and the risk management framework (RMF) for DoD information technology balances security controls against the risk to the system assets and data against known and emergent threats. | high | Knowledge of MHS GENESIS solution(s) that is(are) in the MHS GENESIS enclave, the underlying COTS Solutions, and an understanding of known and emergent cybersecurity threat vectors is required to support this effort. The Lead Integrator, in coordination with the DoD, is primarily responsible for implementing the cyber controls for MHS GENESIS in coordination with partners, including the Department of Veterans Affairs, the United States Coast Guard, and other federal entities. The cybersecurity posture of MHS GENESIS enclave is well documented. MHS GENESIS has implemented persistent cyber operations and there are currently six (6) different ATO's with renewal scheduled in FY2025. Risk does not reside with the transition, but with the ongoing maintenance of the cybersecurity posture of the system. |
| 2.14 | AW/Safety/Networthiness Certification | This element includes the cost to prepare, support, and execute certification activities for a software release to include airworthiness, safety, and networthiness certifications. | N/A | The Government has no requirement for AW/Safety/Networthiness Certification |
| 2.15 | Facilities | This element contains all costs associated with facilities operations which can be directly attributed to the system being fielded or in support of its personnel. These costs include, but are not limited to: facilities, power requirements, special material and supplies, leased or owned facilities and construction, operations, and maintenance of facilities. | high | Current solution is hosted in the Oracle/Cerner Data Center. Risk to transition is high and cost-prohibitive for all solutions that are on-prem. For all solutions that are "cloud" compatible, those should be hosted in the Government provided "cloud". |
Maximize Value
| MIL-STD-881F | Government Update Assessment | ||
| Promote Maximum Value from Use | Contractor Updated Assessment |
Promote Maximum Value from Use
| WBS | WBS Title | Description | Risk Level to Transition | Reason | Risk Level to Transition | Reason | |
| 2.0 | IS/DBS Sustainment (MHS GENESIS) | Sustainment is a critical part of delivering and ensuring information systems/defense business systems (IS/DBS) hardware and software are continuously maintained, updated, and enhanced throughout the acquisition process until Material Support Date (MSD). Since IS/DBS systems are often deployed incrementally over time, the effort to keep them functionally up to date needs to be captured. This sustainment structure is intended to be used for IS/DBS sustainment activities vs. the CAPE O&S structure, which does not address sustainment for IS/DBS projects/systems | N/A | See lower level | |||
| 2.1 | Program Management | This element includes costs for management activities continuing from development or production or started during the sustainment phase. Program management activities are similar to those performed during development or production. This element also includes management efforts related to maintenance and supply chain, possibly started in production and continuing into sustainment. | N/A | Each contract has some level of program management oversight required. | |||
| 2.2 | Systems/Sustaining Engineering | The cost associated with software specific sustaining engineering activities such as studies/investigations for software specific issues. Sustaining engineering does not include any effort or cost for either maintenance (corrections) or capability enhancements: these are included in the release data. User support should not include field software engineering, nor data in other subcategories | n/a | The system/sustaining engineering as described in the WBS would not be applicable to maximize value. System engineering is required to support "maximize value". | |||
| 2.3 | Change Management | Change management refers to the broad process for managing organizational change. Change management encompasses planning, oversight, governance, project management, testing and implementation. | low | Change management practices are consistently evolving. In order to take advantage of the newest methods for change management and couple it with a system modernization effort, would pose minimal risk to the Government. | |||
| 2.4 | Help Desk | This element captures the costs of providing help desk support for end users. It includes Level I through III. This support will include user account management. The reporting system must specify which tier is applicable. The help desk/operations support team (OST) will provide Tier I level support for problems related to systems administration and monitoring, event management, and database administration including restart, recovery, backups, and restorals. The help desk support staff is the initial focal point for answering questions and providing status information for the hosted site. The typical support hours are 24 x 7 x 365. | N/A | See lower level | |||
| 2.4.1 | Tier 1 | The help desk/operations support team (OST) will provide Tier I level support for problems related to systems administration and monitoring, event management, and database administration including restart, recovery, backups, and restorals. | low | The Government would want a single, integrated Tier 1 help desk supporting all of MHS GENESIS. Minimal risk to transition Tier 1 help desk. Contractor would be responsible for providing scripts, training, and following up with Tier 1 Help desk resources to ensure Tier 1 Help Desk resources are resolving tickets at the lowest possible level. | |||
| 2.4.2 | Tier2 | Tier 2 support provided by experienced and knowledgeable support personnel who assess issues and | |||||
| provide solutions for problems. | low | The Government would want a single, integrated Tier 2 help desk supporting all of MHS GENESIS. Minimal risk to transition Tier 2 help desk. Contractor would be responsible for providing scripts, training, and following up with Tier 2 Help desk resources to ensure Tier 2 Help Desk resources are resolving tickets at the lowest possible level. | |||||
| 2.4.3 | Tier 3 | Tier 3 support provided by highly skilled product specialists who have an expert knowledge of the |
application and can resolve issues or problems and fix defects in the production baseline by changing
| the system software. | medium | Defect fixes typically reside with the software developer as part of license maintenance. Tier 3 would not be transitioned from the current contractor, but the contractor supporting efforts to promote maximum value would need to provide Tier 3 support to resolve issues or problems and fix defects in the production baseline. The risk is deconflicting the defect/ issue/ problem between contractors, as well as how the system integrator is leveraged as part of Tier 3. | |||
| 2.5 | Data Cleansing/ Data Maintenance | This element includes the effort for translating data from one format to another. This should cover only those efforts that are incurred at the maintenance site. Also include any expense associated with the transition of data from the legacy systems to the IS/DBS solution. Use lower levels to identify individual legacy systems. | n/a | Should not impact future "maximize value" efforts. | |
| 2.6 | System/Database Administration | This element captures the costs of providing system/database administration for the IS/DBS solution computer resources once operational site activation is complete and the system has reached full operational capability (FOC). These could be costs incurred as a result of continuing contractor support or by the Government. | low | A new contractor would need to learn the logical data layer of the MHS GENESIS system. The data dictionary for some of the COTS systems is considered proprietary and unavailable to the Government. The COTS solutions has system/ database administrators as part of the "services" provided. | |
| 2.7 | IT Infrastructure/Network Maintenance Support | Provide day-to-day management and operation of IT assets and processes. IT management are divided into three key sub-segments: operations services (for IT infrastructure), application management services, and help desk management services. | N/A | Most of the IT Infrastructure and Network Maintenance support is provided by DHA- J6 via the MedCOI. | |
| 2.8 | Operational Hardware Refresh/ Upgrade | This element includes the costs of periodic replacement of computers and peripherals, including end-user, cybersecurity, and IT infrastructure and enterprise services. | medium | Not applicable for promoting maximum value, as there should be no hardware refresh/upgrade. The risk identified is the contractor's understanding of the current system baseline and of system compatibility with more modern technologies. | |
| 2.9 | Operational Software License Refresh/ Update | The cost associated with the procurement and renewal of software licenses for operational software. Also includes effort to manage licenses for the maintenance facility as well as deployed systems. | medium | Not applicable for promoting maximum value, as there should be no hardware refresh/upgrade. The risk identified is the contractor's understanding of the current system baseline and of system compatibility with more modern technologies. | |
| 2.10 | Cybersecurity Maintenance Management | The cost associated with activities such as software cybersecurity and information assurance vulnerability management (IAVM), which is the management of the overall IAVA process. Cybersecurity and the risk management framework (RMF) for DoD information technology verifies the software system against externally defined domain performance criteria | medium | Knowledge of MHS GENESIS solution(s) that is(are) in the MHS GENESIS enclave, as well as the underlying COTS solutions, is required to support this effort. The DoD is primarily responsible for implementing the cyber controls for MHS GENESIS in coordination with other partners including the Department of Veterans Affairs, the United States Coast Guard, and other federal entities. The cybersecurity posture of the MHS GENESIS enclave is well documented. There are currently six (6) different ATO's with renewal scheduled for FY2025. Risk does not reside with the transition, but with the overall maintenance of the system. The risk increases when multiple contractors support the maintenance of the cybersecurity posture. When a new capability is introduced as part of MHS GENESIS, an additional risk is identifying how the new capability fits into the current cybersecurity strategy. | |
| 2.11 | Follow-on User Training | The cost associated with follow-on user training. | low | End User Training practices are consistently evolving. In order to take advantage of the newest methods there would be minimal risk to the Government. | |
| 2.12 | System Independent Verification and Validation | This element contains all costs associated with information system and software independent verification and validation (IV&V). IV&V is a third-party review that ensures that the system is well engineered (verification) and that the system meets the users’ needs (validation). This may be performed by the Government. | medium | Knowledge of MHS GENESIS solution(s) that is(are) in the MHS GENESIS enclave, as well as the underlying COTS solutions, is required to support this effort. The DoD is primarily responsible for implementing the cyber controls for MHS GENESIS in coordination with other partners including the Department of Veterans Affairs, the United States Coast Guard, and other federal entities. The cybersecurity posture of the MHS GENESIS enclave is well documented. There are currently six (6) different ATO's with renewal scheduled for FY2025. Risk does not reside with the transition, but with the overall maintenance of the system. The risk increases when multiple contractors support the maintenance of the cybersecurity posture and IAVA patching. | |
| 2.13 | Continuing System Improvements | This element includes the costs of hardware and software updates that occur after deployment of a system. These updates improve a system’s safety, reliability, maintainability, or performance characteristics and enable the system to meet its basic operational requirements throughout its life. | N/A | See lower level | |
| 2.13.1 | Operational Hardware Modification | The cost of development, procurement, and installation of modification kits. Modification kits will consist of both kits of equipment to be installed and kits for provisions such as cables, brackets, or other interface devices. Also includes costs associated with the modifications for support equipment, training equipment, technical publications/data, and initial spares and repair parts (consistent with the approved modification content). These modifications are needed to achieve critical capabilities | N/A | The Government does not anticipate any new proprietary hardware solution(s) as part of promote maximum value from use of the health care delivery solutions. | |
| 2.13.2 | Software Release Modification/ Enhancement 1…n | The cost of modifying/enhancing, performing routine fixes and deficiency corrections on software, as well as IAVAs/security patches which include the cost associated with changing the software to address information assurance vulnerability alert. | N/A | See lower level | |
| 2.13.2.1 | Modification/ Enhancements | This element includes the cost to modify or enhance the existing system. | medium | Modification and Enhancements are defined as modification to the existing system configuration and enhancements are Software COTS enhancements that are configured to meet the Government requirements that may or may not be part of the current baseline. This does NOT include any custom development to meet the needs of the Government. |
Knowledge of MHS GENESIS configuration, as well as the underlying COTS solution, is required to support this effort. Although there is significant documentation and a sufficient transition timeframe, the documentation is not digestible. Another contractor may have significant challenges providing modification to an existing configuration. This risk is associated with the contractor's ability to identify the parts of the configuration that need to be modified to meet the requirement without negatively impacting the overall configuration.
There is a lower risk to a contractor doing an enhancement. The risk is ensuring the enhancement is properly linked to current capabilities (as needed) to meet the requirement without negatively impacting the overall system.
| 2.13.2.2 | Routine Fixes and Deficiency Corrections | This element includes the cost to perform routine fixes or deficiency corrections not covered under the terms of the software license maintenance. | n/a | Would not require transition as part of maximize value |
| 2.13.2.3 | Installation/ Test | This element includes the cost to prepare, support, and execute the installation and testing of system changes. | medium | Knowledge of MHS GENESIS configuration, as well as the underlying COTS solutions, is required to support this effort. Although there is significant documentation and a sufficient transition timeframe, the documentation is not in state that is digestible. Another contractor would have significant challenges providing successful installation/test activities in order to ensure the routine fix/deficiency correction or modification/enhancement works as designed, as well as not breaking any current configuration. Currently have design patterns in place, and as long as those are followed, it reduces the risk to a medium. |
| 2.13.2.4 | IAVAs | The cost associated with software cyber security, hardware cyber security, Federal Information Security Management Act (FISMA) compliance, security technical implementation guide (STIG) implementations, information assurance vulnerability management (IAVM), and zero trust (ZT) which is the management of the overall security posture of the system. Cyber security and the risk management framework (RMF) for DoD information technology balances security controls against the risk to the system assets and data against known and emergent threats. | high | Knowledge of MHS GENESIS solution(s) that is(are) in the MHS GENESIS enclave, the underlying COTS Solutions, and an understanding of known and emergent cybersecurity threat vectors is required to support this effort. The Lead Integrator, in coordination with the DoD, is primarily responsible for implementing the cyber controls for MHS GENESIS in coordination with partners, including the Department of Veterans Affairs, the United States Coast Guard, and other federal entities. The cybersecurity posture of MHS GENESIS enclave is well documented. MHS GENESIS has implemented persistent cyber operations and there are currently six (6) different ATO's with renewal scheduled in FY2025. Risk does not reside with the transition, but with the ongoing maintenance of the cybersecurity posture of the system. |
| 2.14 | AW/Safety/Networthiness Certification | This element includes the cost to prepare, support, and execute certification activities for a software release to include airworthiness, safety, and networthiness certifications. | N/A | The Government has no requirement for AW/Safety/Networthiness Certification |
This is the start of the file's text. The full file is on GovTribe.
File details come from the government source that posted it. Updated .