Medical Device RFI Performance Details.docx

PERFORMANCE DETAILS

PLACE OF PERFORMANCE

Efforts under this contract shall be performed at the selected VA facilities identified in paragraph three of this PWS and at Contractor facilities. The Government will provide space for Contractor staff at the VA facilities during implementation. Any other site-visits will be handled on an ad-hoc basis as circumstances dictate. Any additional personnel will be located at the Contractor’s facilities.

CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, schedule, to meet both Initial Operating Capability (IOC) within 90 days and Full Operational Capability (FOC) within 360 days of award and tools to be used in execution of this Task Order (TO) effort. The CPMP shall take the form of both a narrative and graphic format that displays the schedule, milestones, risks and resource support. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPMP shall be concurred upon and updated in accordance with Section B of the TO. The Contractor shall update and maintain the VA Project Manager (PM) approved CPMP throughout the Period of Performance (PoP).

Deliverable:

A. Contractor Project Management Plan

REPORTING REQUIREMENTS

The Contractor shall deliver Bi-Weekly (every two weeks) Enterprise Cyber Security Program (ECSP) Status Report detailing the status of all work efforts. These reports shall provide accurate, timely, and complete project information. The Bi-Weekly ECSP Status Report shall include the following data elements:

a. Project Name and Contract/Task Order Name

b. Overview and description of the Task Order

c. Overall high-level assessment of Task Order progress

d. All work in-progress and completed during the reporting period

e. Identification of any Task Order related issues uncovered during the reporting period and especially highlight those areas with a high probability of impacting schedule, cost, or performance goals and their likely impact on schedule, cost, or performance goals

f. Explanations for any unresolved issues, including possible solutions and any actions required of the Government and/or Contractor to resolve or mitigate any identified issue, including a plan and timeframe for resolution

g. Status on previously identified issues, actions taken to mitigate the situation and/or progress made in rectifying the situation

h. Work planned for the subsequent four (4) reporting periods, when applicable.

i. Current Order schedule overlaid on original Task Order schedule showing any delays or advancement in schedule

j. Current definition of user requirements / function points overlaid over the original function points and the last reported function points to specifically identify changes in the function points to be delivered since the previous report

k. Workforce staffing data showing all Contractor personnel performing on the effort during the current reporting period. After the initial labor baseline is provided, each Bi-Weekly Status Report shall identify any changes in staffing identifying each person who was added to the task order or removed from the task order

l. Original schedule of deliverables and the corresponding deliverables made during the current reporting period

These reports shall not be the only means of communication between the Contractor, COR and the Program/Project Manager to advise of performance/schedule issues and to develop strategies for addressing the issues. The Contractor shall continuously monitor performance and report any deviation from the CPMP or previous bi-weekly report to the COR and Program/Project Manager during routine, regular communications.

Deliverable:

A. Bi-Weekly Progress Report

PRIVACY/HIPAA TRAINING

The Contractor shall submit TMS training certificates of completion for VA Privacy and Information Security Awareness and Rules of Behavior and Health Insurance Portability and Accountability Act (HIPAA) training and provide signed copies of the Contractor Rules of Behavior in accordance with Section 9, Training, from Appendix C of the VA Handbook 6500.6, “Contract Security”.

VA Privacy and Information Security Awareness and Rules of Behavior Training Certificate / Signed Contractor Rules of Behavior / VA HIPAA Certificate of Completion

Deliverables:

A. VA Privacy and Information Security Awareness and Rules of Behavior Training Certificate B. Signed Contractor Rules of Behavior C. VA HIPAA Certificate of Completion

TECHNICAL KICKOFF MEETING

The Contractor shall hold a technical kickoff meeting within ten (10) days after TO award. The Contractor shall present, for review and approval by the Government, the details of the intended approach, work plan, and project schedule. The Contractor shall specify dates, locations (can be virtual), agenda (shall be provided to all attendees at least five calendar days prior to the meeting), and meeting minutes (shall be provided to all attendees within three calendar days after the meeting). The Contractor shall invite the Contracting Officer (CO), Contract Specialist (CS), COR, and the Government PM.

PROJECT STATUS MEETINGS

All scheduled meetings will be based on Eastern Standard Time. The Contractor shall conduct weekly Project Status Meetings via teleconference. The Contractor shall discuss any concerns and issues identified in each Bi-Weekly Progress Report. At the conclusion of each meeting, the Contractor shall prepare Weekly Project Status Meeting Minutes summarizing the discussion items.

Deliverable:

A. Weekly Project Status Meeting Minutes

STAFFING

The Contractor shall plan for on-boarding of both initial staff and staff brought on board during this TO. The Contractor shall provide an On-boarding Plan, as an addendum to the CPMP, to detail its approach to affirming key staffing for support of the application/system baseline and all requirements of the PWS, to include the name, location, start date, training, physical, logical and network access, clearance status and all required non-disclosure and other security certifications, as well as the expertise, role, and responsibilities of each staff member.

The On-boarding Plan shall address cross-training of Contractor staff and required training artifacts and job aides. The On-boarding Plan shall demonstrate how the Contractor staff will be provisioned appropriately.

The On-boarding Plan shall include a timeline for on-boarding, compliance, provisioning, and access for expert resources and detail staffing for each software application/system supported under this TO as well as the continuity of key staff. At a minimum, completion dates for the following milestones shall be included for each staff member: The status of these activities shall be reported on a bi-weekly basis, in the Workforce Staffing Report Section of the Product Sustainment Report required in Section 5.3.11 of this PWS.

1. Completion of mandatory on-boarding paperwork (per JIT Process Toolkit.)

2. Fingerprints submitted

3. EQIP invitation

4. EQIP submission

5. Background investigation initiated

6. Background investigation completed

7. Network Access received

8. Submit e-Pas (for elevated privileges if applicable)

9. GFE Issued (as applicable) with elevated privileges (if applicable)

10. CAG/VPN access granted

11. Mandatory Training per JIT Toolkit Completed

12. Rational Training Completed

The Contractor shall provide and maintain an On-boarding, Compliance, Provisioning, and Access Report for Expert Resources as part of the Product Sustainment Report, demonstrating the adequacy of staffing to ensure maintenance for each software application supported under the TO.

Deliverable:

A. On-boarding Plan

FUNCTIONALITY REQUIREMENTS

The Contractor shall deliver and host a cloud based SAAS FEDRAMP IOMT solution in accordance with (IAW) the General Services Administration (GSA) FEDRAMP Certification. The FedRAMP Low certification is to be attained within 6 months.

The Contractor shall maintain constant currency in knowledge of and expertise in use of security tools. Contractor shall need to maintain and efficiently operate security tools necessary to complete VA Authorities to Operate (ATOs) and other security testing.

The IOTM solution shall meet the following functional requirements:

1. Asset Discovery and Recognition:

a. The solution must be able to profile all Internet of Things (IOT) devices on the network to include medical devices and SPS.

b. Passively discover all devices (medical, facilities, security, industrial, workstations, etc.) and gathers hi-resolution information about each including Media Access Protocol/ Internet Protocol (MAC/IP) address, Firmware Version, make, model, serial number and Operating System (OS)-type/patches.

c. Automatically classifies all devices into groups and profiles and separates them by device model & type.

d. Discovers, learns and tracks network anchoring information (MAC/IP, Virtual Local Area Network (VLAN), subnet, access-type, switch/Wireless Lan Controller (WLC), interface/Application Program (AP), OS and Protocols used) about each device automatically.

e. Tracks device activity and automatically determines baseline communication profiles by monitoring packet-level communications and provides flow analytics for each VLAN and subnet, where information is anchored to specific device (e.g. Switch Port Analyzer (SPAN), Test Access Point (TAP)).

f. Collect and maintain Device Inventory of detected devices and ability to query for changes to inventory.

g. Tracks device activity and automatically builds baseline communication profiles by monitoring packet summarization flow data and providing flow analytics for each device (e.g. NetFlow, SFlow, etc.).

h. Provides IoT device utilization tracking.

i. Ability to name and group non IoT devices to assist in traffic mapping.

j. Identify/label assets and other detailed associated information (vendor, Type, Criticality, Risk level, etc.).

k. Save and display historical information of devices including changes of device name, IP(s), MAC addresses, hostname, software/firmware, pattern of communication, configurations, OS/iPhone Operating System (IOS), new devices, applications and databases, disconnected devices, mode/state, etc.

l. Maintain asset historical record.

m. Identify attributes of each labelled asset including model, vendor, hardware type (and attributes such as memory load, condition/errors, mode, etc.), controller code checksum, firmware version, serial number, mac address.

n. Identify assets talking to the Internet or using IPSec, Secure Shell (SSH), or other protocol

o. Differentiates physical IT hardware/appliances with virtual.

p. Allows manually added attributes to an identified asset (e.g. site, physical site location, function, system, description).

q. Identify new additions/assets.

2. Vulnerability Discovery and Remediation Management:

a. Automatically identifies and provides alerts for IOT devices that exhibit anomalous communication behavior.

b. Must support passive vulnerability scanning.

c. Must understand medical device protocols, including but not limited to HL7 and Digital Imaging and Communications within Medicine (DICOM).

d. Must provide context regarding existing and potential cyber threats.

e. Must provide Risk Scoring of Endpoints.

f. Provides device vulnerability insights based on tracking manufacturer patch releases and information disclosures (Industrial Control Systems Cyber Emergency Response Team (ICS-Cert) advisories, Food and Drug Administration (FDA) recall notices, Manufacturer Disclosure Statement for Medical Device Security (MDS2) forms).

g. Automatically tracks vulnerability remediation.

h. Provides the ability to blacklist or quarantine a device without any service interruption.

i. Automatically generates policies to protect devices by type for zero-trust micro segmentation that can be enforced in the network at the access layer (switch port or wireless controller) via (Application Programming Interface (API), Simple Network Management Protocol (SNMP)-Read Only(RO), SNMP-Write, SSH, etc.).

j. Must leverage data gathered through its visibility and detection capabilities to help minimize the device attack surface through clinical micro-segmentation, as well as tailored security policies.

k. Automatically generates policies to protect devices by type for zero-trust zone-based segmentation that can be enforced on firewalls.

l. Ability to detect traffic from outside network to include whitelisted IPs, OCONUS, and unapproved IPs.

m. Proactively Tracks if a medical device has been patched or compensating controls have been applied, (Case Management, Rule Creation).

n. Provide Multilevel Administration (MLA) with Role Based Access Controls (RBAC).

o. Provides Vulnerability Assessment of Endpoints.

p. Proactively Tracks if a medical device has been patched or compensating controls have been applied, (Case Management, Rule Creation).

q. Device Impact level score must match National Institute of Standards and Technology (NIST) Risk Management Framework (RMF) requirements.

3. Alerting and Displaying:

a. Provides a robust display of data that is configurable by the operator to include but not limited (Network Flow, Data Flow, Device Criticality, Inventory etc.).

b. Proactively Alerts and Identifies assets that are vulnerable to the latest high-impact/high-profile vulnerability (WannaCry, NotPetya, BlueKeep, Urgent11).

c. Ability to provide Customized Dashboards National, Regional, VISN and facility level.

d. Integrate with VA existing Splunk Enterprise Security (ES) infrastructure, presenting medical device and IoT related analytics to help Cybersecurity Operations Center (CSOC) teams make more informed decisions around protection and threat prevention.

e. Flag/alert new additions/assets until detailed and acknowledged.

f. Alert on new devices or devices that have not communicated in a period of time.

g. Alert on security related events (Man in the middle, Port scan, Ping scan, active tool scans).

h. Alert forwarding as syslog events to a third-party Security Information and Event Management (SIEM) – Splunk.

i. Identify scanning, reconnaissance activities and log and/or alert via configuration.

j. Notification logged regarding when a new type of event is experienced.

k. Audit Trail of events/ alarms and ability to sort and link to Security Information and Event Management (CVE) and ICS-CERT alerts. (Enterprise View)

4. Reporting Capabilities and Certifications:

a. Centralized administration management console that will provide an enterprise view and assist with policy management.

b. Provides and Enterprise-wide view of the Asset Database with new assets/ info on changes replicated from sites.

c. Capable of performing an individual site view and network topology from a backup during a site outage.

d. Provide graphical mapping topology of monitored IT and IoT network.

e. Graphically mapping topology can filter on IT and/or IoT devices to include medical devices and SPS for assets for viewing.

f. Able to baseline communication traffic, identify anomalies, and have the flexibility to adapt to planned changes (add/remove).

g. Configurable sort/list on assets by system type (e.g. Programmable Logic Controller (PLC)), date of discovery, subnet/IP address, asset labels, undefinable assets, vendor make and Model, and, using specific communication protocol (Transmission Control Protocol (TCP), Ethernet/IP, etc.).

h. Perform Deep Packet Inspection on traditional IT protocols, (TCP/IP, Simple Network Management Protocol (SNMP), SSH, Hypertext Transfer Protocol (Secure) HTTP / HTTPS, Telnet, File Transfer Protocol (FTP), Server Message Block/Common Internet File System (SMB/CIFS), Domain Name System (DNS), Internet Control Message Protocol (ICMP)).

i. Logging capable to be ingested by Splunk.

j. Controls to prevent local login without additional authentication.

k. The solution shall be Federal Information Processing Standard (FIPS) 140-2 certified.

l. Offers private cloud management with the ability to scale indefinitely.

m. FedRamp certified low cloud component.

n. Fingerprint devices using deep packet inspection.

o. Must provide encrypted data transmission.

p. Ensure all API’s are available are exposed for administrative use.

5. Inventory Management Requirements.

a. Device IP address

a. Customizable views at the National, Regional, VISN, and Facility level

b. Functions with real-time Security Information Event and Management (SIEM) software

c. Does not require an agent

d. Device impact level score must match NIST RMF requirements

e. Integration with the VA’s Computerized Maintenance Management Systems (CMMS)

f. Integration with ServiceNow

ARCHITECTURE, DESIGN AND IMPLEMENTATION

Specific Tasks Consider adding the following cloud-specific support requirements:

Total # devices, Total IOT, Total medical devices Device at risk= critical rating critical to low Classification of groups Threat incidents Device/group/profile/application/network Utilization summary Inventory dashboard Incident summary Device risk summary Listing for Devices

Deliverables:

Consider adding the following deliverables:

A. Solution Architecture B. Solution Design

INSTALLATION REQUIREMENTS

The Contractor shall perform the installation at the facilities determined by the VA Project Manager, operational status of device solution, operational dashboard, and sustainment during these periods, to continue support through Special Purpose systems and Managed Services, the identification real time IOT, and medical devices on the network.

The IOTM solution, for the purposes of VA, is defined as all systems that provide services that meet the technical requirements necessary for medical and IOT device discovery and asset management in VA including:

a. The capability to discover and identify medical devices on the VA network.

b. Allow inventory management capabilities by detecting and reporting on the inventory specifications (see Table 1 below).

c. Medical and IOT devices shall be detected and classified as they are connected to the network and assigned the proper security policies based on their unique device characteristics. In addition, special purpose systems (SPS) and to provide accurate inventory of devices detected active and inactive. This does not include any enhancements to the VA wireless or wired network infrastructure. VA understands that enhancements to the VA network infrastructure / wireless network are not within the scope of this contract. The Government takes ownership of this responsibility upon the Contractor notifying VA of any enhancements that are required. Notification should be provided early enough in the process to allow the Government to complete any required enhancements without affecting implementation schedules.

d. Functionality requirements (see FUNCTIONALITY REQUIREMENTS

e. Federal Risk and Authorization Management Program (FedRAMP) Low certification attained within 6 months (VA will sponsor Software as a Service (SAAS))

These services shall be documented in the bi-weekly Progress Reports.

SOLUTION MANAGEMENT

TECHNICAL REQUIREMENTS

The Contractor shall furnish an integrated Software as a Service including software setup and configured to VA technical requirements, data, business needs, features and functionality. The IOMT solution shall be fully automated and web based. The Contractor shall ensure the solution gives VA 100% visibility, management functionality and reporting of the entire IOMT through a “single pane of glass.”

The Contractor shall provide IOMT setup and configuration services including population of the IOMT with data that are consistent with its standard implementation and deployment methodology. The Contractor shall configure the IOMT to meet all requirements of the PWS.

The Contractor shall provide the IOMT by maximizing the use of existing commercial “off-the-shelf” software (COTS).

The Contractor shall notify the VA COR/PM, both by email, and as part of the bi-weekly Progress Report, of any instance where COTS standards will not be used or may not be practical.

The software shall be hosted in a VA-approved Federal Information Security Modernization Act (FISMA), National Institute of Standards and Technology (NIST) SP 800 53A, Federal Risk Authorization and Management Program (FedRAMP) “Low” certified environment and fully managed by the Contractor.

The Contractor shall ensure that IOMT applications include baseline functions such as security controls consistent with VA network and encryption guidelines in accordance with (IAW) PWS Section 6.0, General Requirements. Role based access/privileges, and pre-publishing activities shall be incorporated by the Contractor. The IOMT application(s) shall interface with VA’s instance of Service Now.

1.1.1.1 ACCESS AND AUDITING

Access to the Solution

a. IOMT access shall be via a Web Portal interface.

b. Access to the portal and any of the features and or functionally shall not require any specialized software to be loaded on VA workstations.

c. IOMT shall not require a dedicated connection from the VA internal network and the Contractor’s network.

d. The IOMT shall log all security related events and shall report breaches or failures to VA.

e. IOMT shall have ability to manage role-based permissions for users.

f. IOMT shall support xx Users and xx Concurrent Users (during peak workload periods) with a response times, for simple operations, of less than x second and a response times for complex/reporting operations of less than xx seconds xx% of the time.

g. The IOMT shall log the following events:

1. User identification and authorization processes.

2. Access to or modification of objects or configuration set up.

3. Modification to systems and applications programs.

4. Addition/deletion/modifications

5. Re-sets of user IDs and passwords.

6. Account Logons

7. Object Access

8. Process Tracking

9. Policy Changes

10. Accounts Management

11. Directory Services Access

12. System Events

13. The IOMT shall not co-mingle VA’s data with any other data

INTERFACES WITH VA SYSTEMS (BASE)

1.1.1.2 SERVICE NOW INTERFACE

VA uses Service Now as the Information Technology Service Management tool for all IT requirement requests. The Contractor shall configure the IOMT interface to satisfy the requirements for Service Now Service Catalog and Incident Manager as to enable end users to use Service Now for initial requests and follow those service orders through the entire life cycle to completion/closure via bi-directional interface It is anticipated that this interface will encompass less than 50 data elements with associated templates/attachments to be refined during configuration.

OPERATIONS AND MAINTENANCE

The Contractor shall provide service operations support and systems maintenance support of the IOMT for the life of the contract. This support shall be available twenty-four (24) hours per day and seven (7) days per week and shall be integrated by the Contractor U.S.-based Network Operation Center (NOC) in collaboration with OEM partners and subcontractors.

a) The Contractor shall ensure the services are maintained to the most recent approved COTS baseline. The Contractor shall modify the IOMT configuration to enable services as requested by the VA Contracting Officer.

b) The Contractor shall perform software maintenance activities that may include version and release upgrades, security updates or patches, performance enhancements, data cleansing/archiving, and minor application modifications. The Contractor shall provide updates/upgrades to both IOMT software and operating system during pre-defined maintenance windows. These updates/upgrades shall be performed at least quarterly, if available; and, patches shall be tested and/or performed as required within 5 business days of release date. The Contractor shall provide modifications to the interfaces as needed to process orders or invoices with carriers as required.

c) The Contractor shall implement and maintain a solution that provides a maximum Return to Operations (RTO) of twenty-four (24) hours for the entire IOTM service.

These services apply to the items listed below.

a. Proposed Network Devices

b. Proposed Network Security Applications: CISCO ISE, Firepower, Stealthwatch, Tenable, Red Seal, Q Radar, BigFix, Forescout,

c. Splunk SNOW, CMMS, SIEM, Active Directory, Nuvolo, Inflobox

d. Palo Alto Firewall

e. Solution must meet security standards without requiring any firewall exception to communicate externally

f. Provide ability to extract inventory device file by CSV

g. Provide a splunk app for Splunk integration

h. Ensure passwords for any log in meet VA security standards

i. Provide an interface utility for configuration of all 3rd party data integrations, including Splunk, ServiceNow, etc.

j. Solution must generate security policy and alerting based on Deep Packet Inspection and dynamic real time analysis.

k. Provide Native ACL validation, dynamic policy creation and enforcement for Zero Trust model with existing NAC and NGFW security elements.

l. Additional VA tools