LSRP Performance Work Statement 24Nov2025.pdf

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Office of Information & Technology DevSecOps, Software Product Management (SPM), Health Services Portfolio

LABORATORY SYSTEM RE-ENGINEERING PROJECT (LSRP)

Hosting, Maintenance, and Sustainment

Date: 11/24/2025

VA-26-00012167

PWS Version Number: 1.0

DRAFT VERSION ONLY

Laboratory System Re-Engineering Project

Contents

1.0 BACKGROUND

2.0 APPLICABLE DOCUMENTS

3.0 SCOPE OF WORK

4.0 PERFORMANCE DETAILS

4.1 PERFORMANCE PERIOD

4.2 PLACE OF PERFORMANCE

4.3 TRAVEL

5.0 SPECIFIC TASKS AND DELIVERABLES

5.1 PROJECT MANAGEMENT

5.1.1 CONTRACTOR PROJECT MANAGEMENT PLAN

5.1.2 MONTHLY PROGRESS REPORT

5.1.3 REPORTING REQUIREMENTS

5.1.4 COMPLIANCE REVIEWS AND AUDITS

5.2 SITE MAINTENANCE AND SOFTWARE SUPPORT

5.3 REMOTE HOSTING OF THE LSRP Product

5.3.1 TECHNICAL SUPPORT

5.3.2 TECHNOLOGY CHANGES

5.3.3 HARDWARE PLATFORM

5.3.4 SUBLICENSED SOFTWARE

5.3.5 MAINTENANCE AND SUPPORT

5.3.6 NETWORK CONNECTIVITY

5.4 FULL HARDWARE AND SOFTWARE DISASTER RECOVERY (DR)

SUPPORT

5.5 SYSTEM SECURITY

5.5.1 DATA SECURITY

5.6 APPLICATION SUPPORT REQUIREMENTS

5.6.1 NEW INSTRUMENT INTEGRATION

5.6.2 CAPACITY PLANNING

5.6.3 OPERATIONS AND MAINTENANCE

5.7 SOFTWARE MAINTENANCE UPGRADES CONTINUOUS INTEGRATION

AND CONTINUOUS DELIVERY (CICD)

5.7.1 UPGRADE MANAGEMENT

5.7.2 UPGRADE CENTER MANAGED SERVICES TESTING FOR

SUSTAINMENT

5.7.3 CONFIGURATION MANAGEMENT AND SME EXPERTISE:

5.7.4 SOFTWARE MAINTENANCE SUPPORT

5.7.4.1 AGILE REQUIREMENTS ELABORATION

5.7.5 SOFTWARE MAINTENANCE PROJECT SPECIFIC REQUIREMENTS

5.7.6 TRAINING

5.7.7 MEDICAL MANAGEMENT REPORTING

6.0 GENERAL REQUIREMENTS

6.1 ENTERPRISE AND IT FRAMEWORK

6.1.1 VA TECHNICAL REFERENCE MODEL

6.1.2 ZERO TRUST – VA CRITICAL SECURITY CONTROLS

6.1.3 FEDERAL IDENTITY, CREDENTIAL, AND ACCESS MANAGEMENT

(FICAM)

6.1.4 INTERNET PROTOCOL VERSION 6 (IPv6)

6.1.5 TRUSTED INTERNET CONNECTION (TIC)

6.1.6 STANDARD COMPUTER CONFIGURATION

6.1.7 VETERAN FOCUSED INTEGRATION PROCESS (VIP) AND PRODUCT

LINE MANAGEMENT (PLM)

6.1.8 PROCESS ASSET LIBRARY (PAL)

6.1.9 AUTHORITATIVE DATA SOURCES

6.1.10 SOCIAL SECURITY NUMBER (SSN) REDUCTION

6.1.11 SOFTWARE AND LICENSING REQUIREMENTS

6.2 SECURITY AND PRIVACY REQUIREMENTS

6.2.1 POSITION/TASK RISK DESIGNATION LEVEL(S)

6.2.2 CONTRACTOR PERSONNEL SECURITY REQUIREMENTS

6.3 METHOD AND DISTRIBUTION OF DELIVERABLES

6.4 PERFORMANCE METRICS

6.5 FACILITY/RESOURCE PROVISIONS

6.6 GOVERNMENT FURNISHED PROPERTY

ADDENDUM A – ADDITIONAL VA REQUIREMENTS, CONSOLIDATED

ADDENDUM B – VA INFORMATION AND INFORMATION SYSTEM SECURITY/

PRIVACY LANGUAGE

ADDENDUM C – REMOTE HOSTING SERVICE COMMITMENT

1.0 BACKGROUND

The Department of Veterans Affairs (VA), Office of Information & Technology (OIT), Development, Security and Operations (DevSecOps), Software Product Management (SPM), Health Services Portfolio, Clinical Services strives to provide high quality, effective, and efficient Information Technology (IT) services to those responsible for providing care to the Veterans at the point-of-care as well as throughout all the points of the Veterans’ health care in an effective, timely and compassionate manner. VA depends on Information Management/Information Technology (IM/IT) systems to meet mission goals.

The Department of Veterans Affairs (VA) Office of Information and Technology (OI&T) Laboratory System Re-engineering Project (LSRP) uses the Oracle Health General Laboratory solution for the Huntington, West Virginia Medical Center (referred to as the Alpha site). The Oracle Health General Laboratory Commercial Off-The-Shelf (COTS) application is interfaced with VistA and other VA systems. This LSRP product provides the principal medical diagnostic laboratory testing functionality for the VA; the results of which are significant drivers in clinical decision making.

2.0 APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement (PWS), the Contractor shall comply with the following:

1. “Federal Information Security Modernization Act of 2014”

2. Federal Information Processing Standards (FIPS) Publication 140-3, “Security Requirements for Cryptographic Modules”, March 22, 2019

3. FIPS Pub 199. “Standards for Security Categorization of Federal Information and Information Systems,” February 2004

4. FIPS Pub 200, “Minimum Security Requirements for Federal Information and

Information Systems,” March 2006

5. FIPS Pub 201-3, “Personal Identity Verification of Federal Employees and

Contractors,” January 2022

6. 10 U.S.C. § 2224, "Defense Information Assurance Program", as amended

7. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

8. Public Law 109-461 (P.L. 109-461), Veterans Benefits, Health Care, and

Information Technology Act of 2006, as amended, Title IX, Information Security Matters

9. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”, as amended

10. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, https://www.va.gov/vapubs/index.cfm

11. VA Handbook 0710, “Personnel Security and Suitability Program,” May 2, 2016, https://www.va.gov/vapubs/index.cfm

12. VA Directive 6102, “Internet/Intranet Services,” August 5, 2019

13. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and Guidelines,” as amended https://www.va.gov/vapubs/index.cfm https://www.va.gov/vapubs/index.cfm http://www.va.gov/vapubs http://www.va.gov/vapubs

14. Office of Management and Budget (OMB) Circular A-130, “Managing Federal Information as a Strategic Resource,” July 28, 2016

15. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed Services (CHAMPUS)”, as amended

16. NIST SP 800-66 Rev. 2, “Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule: A Cybersecurity Resource Guide,” February 2024

17. 45 C.F.R Parts 160 and 164, Subparts A and E, the Standards for Privacy of Individually Identifiable Health Information (“Privacy Rule”); and 45 C.F.R.

Parts 160 and 164, Subparts A and C, the Security Standard (“Security Rule”); as amended

18. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended

19. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

20. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021 (see VA

NOTICE 24-18, dated September 27, 2024, “Update to VA Directive 6500 Cybersecurity Program”, and VA Notice 25-07, dated 3/18/25, “Amending VA Directive 6500 to incorporate M-24-15”)

21. VA Handbook 6500, “Risk Management Framework for VA Information Systems VA Information Security Program,” February 24, 2021 (see VA Notice 25-01, dated October 15, 2024, “Update to VA Handbook 6500 Risk Management Framework for VA Information Systems VA Information Security Program”, and VA Notice 25-06, dated 3/18/25, “Amending VA Directive 6500 to incorporate M-24-15”)

22. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI),” June 30, 2023

23. VA Handbook 6500.6, “Contract Security,” March 12, 2010 (see VA Notice 24-12, dated April 22, 2024, “Update to VA Handbook 6500.6, Contract Security, Appendix C VA Information and Information System Security/Privacy Language For Inclusion Into Contracts, As Appropriate”)

24. VA Handbook 6500.8, “Information System Contingency Planning,” March 25, 2025

25. VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018

26. VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017

27. OIT Process Asset Library (PAL), OIT Process Asset Library.

28. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

29. VA Directive 6508, “Implementation of Privacy Threshold Analysis and

Privacy Impact Assessment,” October 15, 2014

30. VA Directive 6510, “VA Identity, Credential and Access Management,”

September 3, 2024

31. VA Handbook 6510, “VA Identity, Credential and Access Management,”

September 27, 2024

32. VA Directive and Handbook 6513, “Secure External Connections,” October

12, 2017 https://digital.va.gov/process-asset-library/ https://www.va.gov/trm/TRMHomePage.aspx

33. VA Directive 6300, “Records and Information Management,” September 21,

34. VA Handbook, 6300.1, “Records Management Procedures,“ March 24, 2010

35. NIST SP 800-37 Rev 2, “Risk Management Framework for Information

Systems and Organizations: A System Life Cycle Approach for Security and Privacy,” December 2018

36. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020)

37. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015

38. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-

12) Program,” March 24, 2014

39. OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005

40. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019

41. OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008

42. Federal Identity, Credential, and Access Management (FICAM) Architecture, June 30, 2023 (FICAM Architecture (idmanagement.gov))

43. NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access,“ June 2018

44. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, “Digital Identity Guidelines,” updated March 02, 2020

45. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014

46. VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland

Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

47. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

48. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

49. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

50. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019

51. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008

52. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (P.L. 110–140), December 19, 2007

53. Section 104 of the Energy Policy Act of 2005, (P.L. 109–58), August 8, 2005 https://www.idmanagement.gov/arch/#:~:text=FICAM%20is%20the%20federal%20government%E2%80%99s%20enterprise%20approach%20to,identity%20processes%2C%20practices%2C%20policies%2C%20and%20information%20security%20disciplines.

https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514 https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896 https://www.cisa.gov/publication/tic-30-core-guidance-documents

54. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 2, 2001

55. VA Directive 0057, “VA Environmental Management Program,” October 25,

56. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

57. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

58. “Veteran Focused Integration Process (VIP) Guide 4.0,” March 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

59. VA Memorandum “Proper Use of Email and Other Messaging Services,”

January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

60. “Product Line Management Transformation Playbook” version 3.1, August 2023, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

61. NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020

62. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol

Version 6 (IPv6),” November 19, 2020

63. Social Security Number (SSN) Fraud Prevention Act of 2017

64. Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23,

65. C.F.R Title 15 Part 7, “Securing the Information and Communications

Technology and Services (ICTS) Supply Chain”, as amended

66. Executive Order 14028, “Executive Order on Improving the Nation's

Cybersecurity,” May 12, 2021, https://bidenwhitehouse.archives.gov/briefing-room/presidential-actions/2025/01/16/executive-order-on-strengthening-and-promoting-innovation-in-the-nations-cybersecurity/

67. OMB Memorandum M-22-09, “Moving the U.S. Government Toward Zero Trust Cybersecurity Principles”, January 26, 2022, https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf.

68. NIST SP 800-52 Revision 2, “Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations

69. OMB M-22-18, “Enhancing the Security of the Software Supply Chain through Secure Software Development Practices,” September 14, 2022

70. OMB M-23-16, “Update to Memorandum M-22-18,” June 9, 2023

71. OMB M-21-31, “Improving the Federal Government’s Investigative and

Remediation Capabilities Related to Cybersecurity Incidents,” August 27,

72. NIST SP 800-88 Revision 1 “Guidelines for Media Sanitization,” December

73. CISA Binding Operational Directive (BOD) 19-02: “Vulnerability Remediation Requirements of Internet-Accessible Systems,” April 29, 2019, BOD 19-02:

Vulnerability Remediation Requirements for Internet-Accessible Systems |

CISA

https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371 https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946 https://bidenwhitehouse.archives.gov/briefing-room/presidential-actions/2025/01/16/executive-order-on-strengthening-and-promoting-innovation-in-the-nations-cybersecurity/ https://bidenwhitehouse.archives.gov/briefing-room/presidential-actions/2025/01/16/executive-order-on-strengthening-and-promoting-innovation-in-the-nations-cybersecurity/ https://bidenwhitehouse.archives.gov/briefing-room/presidential-actions/2025/01/16/executive-order-on-strengthening-and-promoting-innovation-in-the-nations-cybersecurity/ https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf https://www.cisa.gov/news-events/directives/bod-19-02-vulnerability-remediation-requirements-internet-accessible-systems https://www.cisa.gov/news-events/directives/bod-19-02-vulnerability-remediation-requirements-internet-accessible-systems https://www.cisa.gov/news-events/directives/bod-19-02-vulnerability-remediation-requirements-internet-accessible-systems

74. CISA BOD 22-01: “Reducing the Significant Risk of Known Exploited Vulnerabilities,” November 3, 2021, BOD 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities | CISA

75. CISA BOD 23-01: Improving Asset Visibility and Vulnerability Detection on Federal Networks.” Cybersecurity & Infrastructure Security Agency (CISA), BOD 23-01: Improving Asset Visibility and Vulnerability Detection on Federal Networks | CISA

76. VA Directive 6550, Pre-Procurement Assessment and Implementation of Medical Devices/Systems, June 03, 2019

77. VA Memorandum, “VA Security Controls,” January 17, 2025, https://www.voa.va.gov/DocumentView.aspx?DocumentID=5010

3.0 SCOPE OF WORK

The Contractor shall maintain the Oracle Health General Laboratory LSRP implementation, heretofore known as LSRP, for the Huntington LSRP Alpha site. The contractor shall provide the following capabilities and services:

A. LSRP monthly status and on-boarding reports.

B. LSRP remote hosting and maintenance.

C. LSRP disaster recovery implementation and support.

D. LSRP technical support (24/7/365).

E. LSRP cyber security implementation and maintenance per VA Authority to

Operate (ATO) requirements.

F. LSRP network and application support.

G. LSRP testing, capacity planning, and operations & maintenance support.

The Contractor shall provide training on the LSRP/Oracle Health General Laboratory application and device integration on a quarterly basis. Specifically, the contractor shall train and implement new instruments to the Oracle Health General Laboratory application every 90 days.

4.0 PERFORMANCE DETAILS

4.1 PERFORMANCE PERIOD

The Period of Performance (PoP) shall be a 12-month base period commencing on February 1, 2026 with two (2) 12-month option periods.

There are 11 Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, five are set by date:

New Year's Day January 1 Juneteenth June 19 Independence Day July 4 https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities https://www.cisa.gov/news-events/directives/bod-23-01-improving-asset-visibility-and-vulnerability-detection-federal-networks https://www.cisa.gov/news-events/directives/bod-23-01-improving-asset-visibility-and-vulnerability-detection-federal-networks https://www.voa.va.gov/DocumentView.aspx?DocumentID=5010

Veterans Day November 11 Christmas Day December 25

If any of the above falls on a Saturday, then Friday shall be observed as a holiday.

Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

Martin Luther King's Birthday Third Monday in January Washington's Birthday Third Monday in February Memorial Day Last Monday in May Labor Day First Monday in September Columbus Day Second Monday in October Thanksgiving Fourth Thursday in November

4.2 PLACE OF PERFORMANCE

Tasks under this PWS shall be performed at Contractor facilities. The Contractor shall identify the Contractor’s place of performance in their proposal submission.

4.3 TRAVEL

Travel is not anticipated for this contractual agreement.

5.0 SPECIFIC TASKS AND DELIVERABLES

The Contractor shall perform the following:

5.1 PROJECT MANAGEMENT

5.1.1 CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, timeline, and tools to be used in execution of the contract. The CPMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks, and resource support. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPMP shall be submitted within 30 days of award. The Contractor shall update and maintain the VA PM approved CPMP throughout the period of performance.

Deliverable:

A. Contractor Project Management Plan

5.1.2 MONTHLY PROGRESS REPORT

The Contractor shall provide the Contracting Officer Representative (COR) and VA Program Manager (PM) with Monthly Progress Reports in electronic form in Microsoft Word and/or PostScript Document Format (PDF) formats. The report shall include detailed instructions/explanations for each required data element, to ensure that data is accurate and consistent. These reports shall reflect data as of the last day of the preceding month.

The Monthly Progress Reports shall cover all work completed during the reporting period and work planned for the subsequent reporting period. The report shall also identify any problems that arose and a description of how the problems were resolved.

This includes any disaster recovery efforts detailing what happened, how it was fixed and the remaining issues. If problems have not been completely resolved, the Contractor shall provide an explanation including their plan and timeframe for resolving the issue. The report shall also include an itemized list of all Electronic and Information Technology (EIT) deliverables and their current Section 508 conformance status. The Contractor shall monitor performance against the Contractor Performance and Management Plan (CPMP) and report any deviations. The Monthly Progress Report shall also include updates for Application Support Requirements (PWS paragraph 5.6).

The Contractor shall keep in communication with VA accordingly so that issues that arise are transparent to both parties to prevent escalation of outstanding issues.

The Contractor shall meet with the COR/VA PM weekly (via a conference call) to review project team information requests and shall track this activity in the Monthly Progress Report.

A. Monthly Progress and 508 Compliance Report

5.1.3 REPORTING REQUIREMENTS

The Contractor shall hold a technical meeting within 10-days of contract award. The Contractor shall present, for review and approval by the Government, the details of the intended approach, work plan, and project schedule. The Contractor shall specify dates, locations (can be virtual), agenda (shall be provided to all attendees at least five calendar days prior to the meeting), and meeting minutes (shall be provided to all attendees within three calendar days after the meeting). The Contractor shall invite the Contracting Officer (CO), Contract Specialist, COR, and the VA PM.

Deliverable:

A. Meeting Agenda B. Meeting Minutes

5.1.4 COMPLIANCE REVIEWS AND AUDITS

The Contractor shall provide the required services outlined in the tasks below based on applicable federal and VA regulations. However, new federal laws as well as VA regulations, including, but not limited to, U.S. Food and Drug Administration regulations and U.S. Centers for Medicare & Medicaid Services regulations may arise during the performance of this effort that may require compliance by the Contractor in order to keep VA in compliance. To maintain such compliance, the Contractor and/or VA may require changes to existing technology or the implementation of new technology (e.g., hardware, storage, network, database, tools, etc.). As a result, the Contractor and VA agree to periodic reviews in order to evaluate any new federal laws and VA regulations that could impact providing and meeting the required services in the PWS.

If audits are required, VA shall provide written notice to the Contractor as required. Upon notification, the Contractor shall permit access to the Contractor Technology Center (CTC) and processing environment for VA’s auditors and/or an independent auditor retained by VA. Within a reasonable timeframe, VA will provide the Contractor an audit agenda prior to any audit date. Any such audit conducted by VA auditors and/or an independent auditor retained by VA shall be limited to one (1) audit per calendar year.

The Contractor shall be required to provide reasonable support and assistance during any such audit(s) to include preparation, pre-audit events and one (1) business day of escorted physical CTC access. The Contractor shall conduct a periodic independent audit (internal or external agent) of the CTC operating environment in accordance with applicable standards. Any questions regarding CTC audits should be directed to its Executive for Regulatory Affairs.

Additionally, the Contractor shall cooperate with the VA Office of the Inspector General (OIG) in the areas of facilities access, audits, security incident notification, and hosting location. Specifically, the Contractor (and any Subcontractors) shall:

A. Provide the Contracting Officer, COR, VA Project Manager, and representatives of the agency's Office of Inspector General, supervised access to the Contractor's facilities, installations, operations, documentation, databases, and personnel used for contract hosting services; provided the VA provides no less than 10 business days prior notice to the Contractor of its requested access unless at directed request from OIG. This access shall be provided to the extent required to carry out audits, inspections, investigations, or other reviews to ensure compliance with contractual requirements for IT and information security, and to safeguard against threats and hazards to the integrity, availability, and confidentiality of agency information in the possession or under the control of the Contractor (or Subcontractor).

B. Fully cooperate with all audits, inspections, investigations, or other reviews conducted by or on behalf of the Contracting Officer or the agency Office of Inspector General as described in subparagraph (a). Full cooperation includes, but is not limited to, prompt disclosure (per agency policy) to authorized requests of data, information, and records requested in connection with any audit, inspection, investigation, or review, making employees of the Contractor available for interview by auditors, inspectors, and investigators within ten (10) business days from such request unless at the direct request of OIG. The Contractor shall provide access (per agency policy) to Contractor facilities, systems, data and personnel to the extent the auditors, inspectors, and investigators reasonably believe necessary to complete the audit, inspection, investigation, or other review. The Contractor's (and any Subcontractors') cooperation with audits, inspections, investigations, and reviews

5.2 SITE MAINTENANCE AND SOFTWARE SUPPORT

The contractor shall ensure that the necessary software support and maintenance of the LSRP Product is maintained until such time as the new Electronic Health Record Management (EHRM) system is implemented. This includes quarterly (e.g., every 90 days) software upgrades and patches that are necessary for the LSRP product to remain current. Support shall be available on a 24X7X365 basis for the production domain, including both emergency maintenance and emergency support. Maintenance support for emergency support and scheduled maintenance shall be made available via the Oracle service desk.

The Contractor shall provide a quarterly Software Support Report to the VA COR. In this report the Contractor shall document the work performed during the reporting period as defined in this task.

Description Quantity

Software Support for Oracle Health General Laboratory LSRP Product

Software Maintenance Support for Oracle Health General Laboratory LSRP Product

A. Quarterly (no longer than every 90 days) LSRP Software Support Report

5.3 REMOTE HOSTING OF THE LSRP PRODUCT

The Contractor shall provide a high availability remote hosting environment for the LSRP Product and associated data.

Metric Limit

Peak Concurrent Logons (PCL) Forty (40) Peak Concurrent Logons

Number of Sites One (1) located in Huntington, WV

Total Lab Procedures (per Year)

(Total Lab Procedures as defined in the Licensed Software Scope of Use Limits)

Two Million (2,000,000) Lab Tests per Year

Note – It is assumed that no major volume fluctuations occur from month to month and that monthly order volume is approximately equal to 1/12 of the annual scope limit.

Note – It is assumed there are no more than twenty-one million (21,000,000) interface transactions per year associated with this Lab Order volume. (combined inbound and outbound interface volumes including application acknowledgement functionality)

Solutions to be Remote Hosted Oracle Health General Laboratory

(Gen Lab, Micro, AP, Synoptic Reporting, Open Engine, CareAware iBus (historically referred to as MDBus),Registration, Core)

Mock Upgrades Up to two (2) during the life of the contract inclusive of optional periods, with no more than one (1) during any contiguous 12 months.

Mock Upgrades require written notice from VA, no less than 90 days prior to project kickoff not inclusive of option execution and notice required to the Upgrade Center for upgrade services.

CareAware iBus • One (1) Production CareAware iBus cluster configured in N+1 to support up to 1,000 Device Connections; excludes fetal monitor or other wave form devices.

• One (1) Non-Production CareAware iBus instance configured in N only.

• • Location: o

Servers owned and remotely managed by the Contractor at the

CTC.

• CareAware iBus is not included in the DR scope of service until after migrated to

CTC.

The Contractor shall provide the following LSRP domains for VA use during each period of performance:

• One (1) Production Domain, and

• One (1) Pre-Production Domain, and

• One (1) Test Domain.(Temporary during upgrades and projects only)

NOTE: Live data will not be used in the pre-production or testing environments.

The Contractor shall provide remote hosting services to include servers, software, monitoring and management, hardware infrastructure, testing automation, network infrastructure, and storage and backups solutions.

The Contractor shall meet or exceed the guidance provided in the following high availability and redundancy requirements for the Primary production data center.

a. Minimum n+1 facility design.

b. Federal Emergency Management Agency (FEMA) 361 standard for

Enhanced Fujita (EF) scale EF-5 tornado survivability.

c. Fire protection systems with multiple command and control rooms.

d. n+2 chiller plants and n+1 cooling loops.

e. Dual stack redundant “fail on” control architecture to support mechanical operations.

f. Multiple power feeds including commercial power, Uninterruptible Power

Supply (UPS), and n+2 emergency generators.

g. Water intrusion alarms.

h. Network diversity to include Internet connections, direct client connection circuits, communications suppliers, and n+1 systems supporting client application needs.

i. Redundant Storage Area Networks (SAN).

j. Physical security of data center floor space manned by armed guards and using biometric readers in high-security areas.

k. VA security controls including antivirus software, stateful-inspection firewalls, intrusion prevention systems, virtual private networks with FIPS 140-2 in transit data encryption, system hardening, enterprise logging and proxy servers.

l. HIPAA Security Compliance in accordance with (IAW) Paragraph 2.0, Applicable Documents.

m. Update existing DR Plan. Guidance is found in VA Handbook 6500,

6500.8 IAW Paragraph 2.0, Applicable Documents.

n. The Contractor shall provide services 24 hours a day, seven (7) days a week, and 365 days a year with a 99.9 percent uptime for the production PathNet system (excluding planned maintenance - See Appendix C for further details).

o. The Contractor shall implement data backup procedures to ensure no loss of data. At a minimum, incremental data and system back-ups shall be performed once daily and a full data and system back-up shall be performed once weekly.

5.3.1 TECHNICAL SUPPORT

The Contractor shall provide the following technical support for production systems according to the Contractor’s best commercial practices:

A. Provide LSRP application and technical support twenty-four (24) hours per day, seven (7) days per week, and three hundred and sixty-five (365) days per year including Federal Holiday, utilizing both telephone and internet services.

B. Manage and support the entire LSRP solution including: all server operating systems as well as Millennium, Oracle, Citrix, and MQSeries (WebSphere MQ) software.

C. Maintain support for existing security, network, system, database, application, and bi-directional interfaces to the LSRP product.

D. Install and provide support on contractor hosted front end services such as Windows Operating System (OS), Active Directory, Web Interface Services, and Antivirus monitoring.

E. Provide server services (back end) required to support the LSRP product, including installing and monitoring back-end systems and providing database support.

F. Provide and support network connectivity and data center operations.

G. Provide telecommunications to the VA TIC, and support telecommunications between the remote hosted application and Alpha site to which Millennium solution is delivered.

H. Handle storage requests and maintenance/issues within the Storage Area Network (SAN).

I. Provide remote support for the installation of identical replacement new lab instruments.

J. Provide remote support for the installation of printers. This does not include the physical installation and connectivity of the lab instruments or printers to the network or terminal servers.

K. Provide system monitoring, optimization, performance, and availability services.

L. Provide VA with 99.9% uptime availability (excluding planned maintenance).

5.3.2 TECHNOLOGY CHANGES

The high availability configuration and the day-to-day responsibility of managing this environment is exclusively the Contractor’s responsibility. The Contractor bears the risk for any changes in the underlying technology needed to support the Millennium solution (such as hardware obsolescence).

5.3.3 HARDWARE PLATFORM

The Contractor shall provide hardware platform support for Millennium. The hardware platform support shall consist of the following:

A. The Contractor shall supply all hardware required at the Contractor’s facilities to provide Millennium remote operation. This shall include production, pre-production, and test environments when required.

a. NOTE: Live data will not be used in the pre-production or testing environments.

B. The Contractor shall refresh hardware as needed regardless of the reason (e.g.

obsolescence, lack of sufficient capacity, or age).

C. The Contractor bears the risk of keeping the system available and performing at optimal levels regardless of changes in technology or requirements of the Oracle architecture.

D. D. The Contractor is responsible for data center upgrades needed to meet the 99.9% uptime requirement as defined in this document.

5.3.4 SUBLICENSED SOFTWARE

The Contractor shall supply all sublicensed software required for the proposed solution and is responsible for maintaining and keeping all application and sublicenses current.

5.3.5 MAINTENANCE AND SUPPORT

The Contractor shall provide maintenance support for LSRP. The maintenance support shall consist of the following:

A. Perform system health checks and system upgrades, first coordinating with the VA Medical Centers via email messages and conference calls. These events must be acceptable to the Medical Centers to minimize disruption to VA work schedules, priorities, and patient care. The Contractor shall provide documentation of any changes agreed upon. The VA COR shall be included in any related discussions.

B. Notify the VA client through their Tier 1 support team of issues found that affect service.

C. Reboot servers on a recurring schedule to optimize performance and maintain security fixes.

D. Proactively monitor database health, availability, and performance.

E. Manage database (size, disk layout, performance, and upgrades).

F. Monitor System security errors, exceptions, and attempted violations.

G. Store VA’s backup media in a manner that will protect the confidentiality, integrity and availability of the data stored on them and ensure that such data remain VA’s property.

H. Implement and monitor network intrusion and virus detection systems throughout the LSRP product.

I. Provide a corporate IT Security Manager to enforce security procedures and resolve issues.

J. Maintain contractor-provided equipment located at VA site and manage remotely from the CTC.

K. For Contractor-requested changes requiring a change on the part of the VA, Contractor shall support COR or a designated representative in the submission of any VA-required change control process (i.e. Enterprise Security External Change Council (ESECC)). It shall be noted, however, that VA reserves the right to refuse a Contractor-requested change.

5.3.6 NETWORK CONNECTIVITY

The Contractor shall adhere to all VA network connectivity policies set forth in this PWS in accordance with Paragraph 2.0, Applicable Documents. For this effort, the VA shall provide the physical environment for the Contractor to install the necessary Contractor-managed networking equipment at the designated VA WAN gateway. This includes locked rack space (standard 19 in. wide rack) with adequate access control, dual power, and necessary cooling, as well as suitable analog (Plain Old Telephone Service (POTS)) line(s) for out-of-band management of WAN termination equipment by a means other than the provisioned WAN circuits.VA shall provide physical assistance as needed for installing and supporting the network equipment located at VA points of demarcation (e.g., receiving, unpacking, racking, network connection, loading a Compact Disk (CD), asset tracking).

The Contractor shall be responsible for the following:

A. If redundancy is required from a network perspective, the Contractor shall provide redundancy in the physical environment (i.e. primary and secondary routers should not be installed in the same physical cabinet).

B. Logging all access to the VA environment hosting the Contractor-owned network equipment which includes VA production and non-production systems. These logs shall be available for VA inspection through the COR/VA PM. The log shall contain at a minimum: the time someone first accessed, who accessed and when the access ended. If possible, the log shall also record what was accessed.

C. For the VA-managed network equipment, perform physical maintenance by a schedule determined by VA.

D. Support any requirements required by a Network Service Provider (e.g., CenturyLink, AT&T, Verizon) to install circuits that are to be terminated on the VA-managed networking equipment.

E. Provide and maintain any demarcation equipment (e.g., router, switch, firewall) that is needed to support the backend network. The Contractor shall maintain the backend network. It shall be noted that both WAN circuits described above shall terminate at separate points of demarcation defined by the VA.

F. Peer with VA using VA standards and templates (e.g., Static, Border Gateway Protocol (BGP)authenticated), or Open Shortest Path First (OSPF) (authenticated)).

Peering IPs will be provided by VA through the COR/VA PM.

G. The Contractor’s solution shall support IPv4 protocol. A transition from IPv4 to IPv6 is not anticipated to be performed during this effort’s period of performance.

H. Provide support to COR or a VA technical representative as part of VA’s connection approval and network change control processes, (e.g. Enterprise Security Change Control Board (ESCCB)). This support may include required technical information and proposed language for the change control process.

I. Maintain FIPS 140-2 standards at both hardware and software levels (REF URL:

https://www.nist.gov/itl/publications-0)

5.4 FULL HARDWARE AND SOFTWARE DISASTER RECOVERY (DR) SUPPORT

The Contractor is responsible for full DR Support upon joint designation of a disaster event which prevents recovery at the primary data center. The Contractor shall provide Hot Site Tier One DR Services support only for any hardware, telecommunications, infrastructure, and facility required to maintain Hot Site Tier One capabilities at an alternate data center location. The Contractor may rely on Business Continuity DR (BCDR) best practices when defining goals, standards, and a framework for business continuity processes.

The Contractor shall provide DR support to include:

A. Provide a DR data center that shall meet or exceed the primary data center high availability and redundancy requirements as defined in 5.2. The building(s) and site shall be geographically separated from the primary data center location and all components shall be designed to survive EF5 tornados and meet or exceed Federal Emergency Management Agency (FEMA) 361 Standards. The Contractor shall ensure that multiple copies of the primary Oracle database are online at any given time and incremental archive logs are stored. The Contractor shall establish the connectivity between the CTC and the site.

B. The Contractor’s DR solution shall adhere to Federal Continuity Directive 1 (FCD-1), authority for which is (National Security Presidential Directive-51) NSPD-51/HSPD-20 National Continuity Policy.

C. The Contractor shall implement data backup procedures to ensure no loss of data while DR is active. At a minimum, incremental data and system back-ups shall be performed once daily and a full data and system back-up shall be performed once weekly.

D. The Contractor shall, when a disaster is declared, fail over VA’s Millennium Production Domain to an alternate data center utilizing the Hot Site Tier One Again The DR Services are provided utilizing no less than an N configuration. In the event of a disaster or during DR testing, the Contractor may be required to shut down the non-production domains in order to expedite recovery of the production domain or pride additional capacity required. It shall be noted that unless otherwise specified, solutions purchased at a future date are excluded from the scope of Oracle Health Hosting (OHH) Remote Hosting Operation (RHO) and DR services.

E. The Contractor shall procure, implement and manage required hardware to support DR solution at an alternate data center to include:

• Backend Application Node

• Backend Database Node

• Disk space for Production recovery

• Citrix servers

• Chart servers

• Other servers required for in-scope solution(s).

F. The Contractor shall also perform as part of DR services the following with the agreement that Contractor’s ability to fully recover all VA-required functionality is dependent upon VA executing steps required to point all VA network and interface connection points to the Alternate Data Center. The DR Plan outlines the Contractor and VA roles during DR services:

• Complete successful test of the DR environment;

• Manage and maintain DR configuration at an alternate data center;

• Monitor the DR solution for continued successful data/code synchronization and backups (as applicable.);

• Perform ongoing capacity analysis to ensure configuration at DR location supports production scope of users;

• Upgrade DR configuration at the alternate data center as needed to accommodate system configuration changes with the Production system (e.g. Oracle upgrades, O/S upgrades and migrations, etc.);

• Provide timely communication with respect to Production system changes and updates that may have an end-user impact;

• Perform system validation and test solution functionality;

• Situation assessment and disaster declaration as coordinated with the VA;

• Activate and validate systems:

• Activate Production Instance on DR backend application and database nodes;

• Activate DR database for live use;

• Activate front-end code warehouse and related components

• Turn over system to Government for validation;

• Allow users on the system

5.5 SYSTEM SECURITY

The Contractor shall perform system security tasks IAW VA system security policies set forth in this PWS IAW Paragraph 2.0, Applicable Documents. The VA system security policies shall be used as guidance in performance of the following work effort:

A. Sign and comply with an approved VA Memorandum of Understanding/Interconnection Security Agreement (MOU/ISA).

B. The data center shall be ISO 9001 Certified, HIPAA Compliant, and Statement on Standards for Attestation Engagements (SSAE) No. 18 compliant.

C. Manage the Assessment and Authorization process for the Primary datacenter and maintain the current ATO (ATO). The Contractor shall provide a System Steward. The System Steward performs continuous monitoring to ensure the system is operating in accordance with an Authority to Operate (ATO), its conditions, and VA policies on security and privacy controls.

D. Deliver to COR/VA PM the A&A Artifacts package required in this section, which make up the artifacts of this System and submit into the VA system of records for A&A, IAW VA security policy.

E. Submit appropriate A&A Artifacts and make arrangements to share confidential and/or sensitive information with identified VA personnel in secured meetings as needed on an annual basis (or as required) and submit these artifacts for review and approval when requested by the VA Information Security Officer (ISO), The A&A Artifacts shall be submitted as part of the VA system of records for A&A, IAW VA

Security Policy. The required A&A Artifacts are listed below and shall be delivered to the COR/VA PM as the A&A Artifact Package. If the Contractor does not have access to the Information Protection Portal, either VA will provide access or supply the templates in electronic format to the Contractor:

1. Memorandum of Understanding (MOU)/Interconnection Security Agreement (ISA)

2. Risk Assessment Report (RAR)

3. Privacy Threshold Analysis (PTA)

4. Privacy Impact Assessment (PIA)

5. Incident Response Plan (IRP)

6. System Security Plan (SSP)

7. Configuration Management Plan (CMP)

8. Information Security Contingency Plan (ISCP)

9. Disaster Recovery Plan (DRP)

10. Plan of Action and Milestones (POA&M)

11. The following security related tests shall be performed:

a. Incident Response Plan Test

b. Information Security Contingency Plan Test

c. Disaster Recovery Plan Test

12. The following security activities (including scanning) shall be performed, remediated, or mitigated and properly documented:

a. Security Configuration Compliance Data (SCCD)

b. Security Control Assessment (Security and Privacy)

c. Penetration Testing

d. Database Scans

e. Nessus Scans

*Performance of some of these services is contingent upon migration to the Federal Enclave.

A. A&A Artifact Package

5.5.1 DATA SECURITY

The Contractor shall use all VA data security policies set forth in this PWS as guidance in performance of this work effort IAW Paragraph 2.0, Applicable Documents. The Contractor shall:

A. Not comingle VA data with non-VA data. If the Contractor shares SAN, VA data shall be stored on a physically different dedicated disk.

B. Encrypt all data in motion using a FIPS 140-2 or higher encryption module.

C. Encrypt all data in storage or at rest using a FIPS 140-2 or higher validated encryption module. The Contractor shall provide the certificate number and a copy of the FIPS Security Certificates along with proof that the module in use is configured as identified in the FIPS certificate to the COR/VA PM.

D. Encrypt all data on back-up media using a FIPS 140-2 or higher validated encryption module. The Contractor shall provide the certificate number and a copy of the FIPS Security Certificates, along with proof that the module in use is configured as identified in the FIPS certificate to the COR/VA PM.

E. Inventory all drives by serial number and certificates of destruction maintained after any drive failure or replacement.

F. If replacing a disk containing VA data, the original disk shall be destroyed per NIST 800-88 guidelines. This process requires that a certificate of destruction be provided to the COR/VA PM.

5.6 APPLICATION SUPPORT REQUIREMENTS

The contractor shall conduct reviews and update the existing Application Management Plan and existing System Management Plan that includes a description of the management, maintenance, monitoring, reporting, and problem resolution processes for the LSRP solution application on a quarterly basis, unless otherwise agreed upon.

The Contractor shall also perform, as part of application management support, service management activities as detailed below:

A. Provide and maintain an automated Change Management system for the centralized reporting and tracking of changes made by the Contractor.

B. Provide and maintain a method for proper notification and escalation of incidents and problems in accordance with Contractor’s standard operating procedures.

C. Log incidents and problems in accordance with Contractor’s standard operating procedures. Notify VA help desk of issues found that affect service.

D. Maintain ownership of all problems related to Oracle services through closure or until agreement that the problem is not within the Oracle scope of responsibility.

Scope of Use Limits. The Application Management Services (AMS) fees set forth in the contract are based on the following scope of use limits:

Scope of Use Metric Scope of Use Limit

Licensed Software to be managed (“Managed Software”)

Oracle Millennium PathNet System (Gen Lab, Micro, AP, Handheld Specimen Collections, Synoptic Reporting, PathNet Helix)

Production Domains One (1) production domain commencing on First Productive Use of the Managed Software and continuing through the Term.

Non-Production Domains One (1) certification domain commencing on First Productive Use of the Managed Software and continuing through the Term.

Facilities One Facility

ICD-10 Updates* One (1) per year

CPT-4 Updates* One (1) per year

*Note: VA must have or purchase subscription licenses to ICD-10 and CPT-4. Such licenses are not provided as part of the AMS Services offered.

Scope of Use Limit Exclusions:

1) Technical Infrastructure required to run Managed Software

2) Third party software

3) Professional services for the design and/or build of additional Licensed Software not included in this Oracle System Schedule

4) Professional services for the implementation of the Managed Software

5) Modifications to source code

6) Development of and/or delivery of end-user training for any Managed Software

7) Application Monitoring Services (as set forth in Section IV.D.) do not apply to non-production domains

8) Facility or clinic professional services roll-outs

9) Maintain first line of support for end-users (e.g., workstation devices, local area network, training issues, etc.).

10) Maintain “superuser” account(s) at VA site to address application-specific issues.

11) The Contractor shall provide System and Application Management progress in the Monthly Progress Report (listed in paragraph 5.1.1 of this document), to include reports that include status, issues, capacity and performance reports, and anticipated systems and application management tasks, including user impact and estimated downtime.

5.6.1 NEW INSTRUMENT INTEGRATION

Every 90 days, the Contractor shall assist VA in the integration of one (1) replacement for an existing (currently integrated and interfaced) Laboratory Instrument to the remote hosted database. The Lab Instrument will be a newer model from the same device manufacturer as the device being replaced, or a new device from a different manufacturer but in either case will be connected to the same laboratory subspecialty (e.g.