PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Veteran Health Administration

Automated Asset Management Using Passive Radiofrequency Identification and Bluetooth Low Energy

Date: 02/09/2026

TAC- VA-26-00044895

PWS Version Number: 1.0

Automated Asset Management Using RFID and BLE VA-26-00044895

Contents

1.0 BACKGROUND

2.0 APPLICABLE DOCUMENTS

3.0 SCOPE OF WORK

4.0 TECHNOLOGY COMPATIBILITY REQUIREMENTS

5.0 TEAMING AND RESELLER REQUIREMENTS

6.0 PERFORMANCE DETAILS

6.1.1 Performance Period

6.1.2 Place Of Performance

6.1.3 Travel

7.0 SPECIFIC TASKS AND DELIVERABLES

7.1.1 Technology And Project Management

7.1.2 System Design

7.1.3 Hardware Provisioning

7.1.4 Software Provisioning

7.1.5 Staging

7.1.6 Hardware Installation and Configuration

7.1.7 Software Installation and Configuration

7.1.8 User Interface Provisioning and Configuration

7.1.9 System Administration

7.1.10 Professional Services Hours

7.2 Acceptance testing

7.2.1 Transition Planning

7.2.2 Training Requirements

7.2.3 Warranty Services

8.0 GENERAL REQUIREMENTS

8.1 ENTERPRISE AND IT FRAMEWORK

8.1.1 VA TECHNICAL REFERENCE MODEL

8.1.2 FEDERAL IDENTITY, CREDENTIAL, AND ACCESS MANAGEMENT

(FICAM) 20

8.1.3 INTERNET PROTOCOL VERSION 6 (IPV6)

8.1.4 TRUSTED INTERNET CONNECTION (TIC)

8.1.5 STANDARD COMPUTER CONFIGURATION

8.1.6 VETERAN FOCUSED INTEGRATION PROCESS (VIP) AND PRODUCT

LINE MANAGEMENT (PLM)

8.1.7 PROCESS ASSET LIBRARY (PAL)

8.1.8 AUTHORITATIVE DATA SOURCES

8.1.9 SOCIAL SECURITY NUMBER (SSN) REDUCTION

8.2 SECURITY AND PRIVACY REQUIREMENTS

8.2.1 POSITION/TASK RISK DESIGNATION LEVEL(S)

8.2.2 CONTRACTOR PERSONNEL SECURITY REQUIREMENTS

8.3 METHOD AND DISTRIBUTION OF DELIVERABLES

8.4 PERFORMANCE METRICS

8.5 FACILITY/RESOURCE PROVISIONS

8.6 GOVERNMENT FURNISHED PROPERTY

8.7 SHIPMENT OF HARDWARE OR EQUIPMENT

ADDENDUM A – ADDITIONAL VA REQUIREMENTS, CONSOLIDATED

ADDENDUM B – VA INFORMATION AND INFORMATION SYSTEM

SECURITY/PRIVACY LANGUAGE

1.0 BACKGROUND

The mission of the Department of Veterans Affairs (VA) is to deliver benefits and services to United States Veterans. In fulfilling this mission, we are committed to providing high-quality, effective, and efficient operational support to those responsible for caring for Veterans—both at the point of care and across every stage of their healthcare journey—in a timely, compassionate, and impactful manner. To achieve this, the VA Health Care Systems (HCS) under the scope of this contract utilize a combination of proprietary technologies:

1. CenTrak® Real Time Locating Systems (RTLS) – Provides real-time location information for medical equipment, staff, and patients.

2. Zebra® Passive RFID – Supports Non-Expendable (NX) asset management.

3. Infor Location Based Intelligence (LBI®) – Aggregates location data from both

CenTrak® RTLS and Zebra® passive RFID, enabling integration with Computerized Maintenance Management Systems (CMMS) and Enterprise Asset Management (EAM) platforms.

4. AgileRank aRTLS mobile application - Asset tag management

These solutions work together to form an integrated system for operational support designed to provide goal-based intelligence on assets, patients, and staff in real time with a zonal, room-level, and within-room level accuracy.

The purpose of this contract is to maintain, expand and enhance our existing automated asset management platform (AAMP), expand its capabilities, and integrate Bluetooth® Low Energy (BLE) technologies to bridge the gap between active RTLS and passive RFID solutions.

2.0 APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. 44 U.S.C. § 3541, “Federal Information Security Management Act (FISMA) of 2002”

2. Federal Information Processing Standards (FIPS) Publication 140-2, “Security Requirements For Cryptographic Modules”

3. FIPS Pub 201-2, “Personal Identity Verification of Federal Employees and Contractors,” August 2013

4. 10 U.S.C. § 2224, "Defense Information Assurance Program"

5. Carnegie Mellon Software Engineering Institute, Capability Maturity Model®

Integration for Development (CMMI-DEV), Version 1.3 November 2010; and Carnegie Mellon Software Engineering Institute, Capability Maturity Model® Integration for Acquisition (CMMI-ACQ), Version 1.3 November 2010

6. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

7. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”

8. VA Directive 0710, “Personnel Suitability and Security Program,” June 4, 2010, http://www.va.gov/vapubs/ http://www.va.gov/vapubs/

9. VA Handbook 0710, Personnel Suitability and Security Program, September 10, 2004, http://www.va.gov/vapubs

10. VA Directive and Handbook 6102, “Internet/Intranet Services,” July 15, 2008

11. 36 C.F.R. Part 1194 “Electronic and Information Technology Accessibility

Standards,” July 1, 2003

12. Office of Management and Budget (OMB) Circular A-130, “Management of

Federal Information Resources,” November 28, 2000

13. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed

Services (CHAMPUS)”

14. An Introductory Resource Guide for Implementing the Health Insurance

Portability and Accountability Act (HIPAA) Security Rule, October 2008

15. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended by the Workforce Investment Act of 1998 (P.L. 105-220), August 7,

16. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

17. VA Directive 6500, “Managing Information Security Risk: VA Information

Security Program,” September 20, 2012

18. VA Handbook 6500, “Risk Management Framework for VA Information

Systems – Tier 3: VA Information Security Program,” March 10, 2015

19. VA Handbook 6500.1, “Electronic Media Sanitization,” November 03, 2008

20. VA Handbook 6500.2, “Management of Data Breaches Involving Sensitive

Personal Information (SPI)”, January 6, 2012

21. VA Handbook 6500.3, “Assessment, Authorization, And Continuous

Monitoring Of VA Information Systems,” February 3, 2014

22. VA Handbook 6500.5, “Incorporating Security and Privacy in System

Development Lifecycle” March 22, 2010

23. VA Handbook 6500.6, “Contract Security,” March 12, 2010

24. VA Handbook 6500.8, “Information System Contingency Planning”, April 6,

25. Project Management Accountability System (PMAS) portal (reference https://www.voa.va.gov/pmas/)

26. OI&T ProPath Process Methodology (reference process maps at http://www.va.gov/PROPATH/Maps.asp and templates at http://www.va.gov/PROPATH/Templates.asp NOTE: In the event of a conflict, OI&T ProPath takes precedence over other processes or methodologies.

27. One-VA Technical Reference Model (TRM) (reference at http://www.va.gov/trm/TRMHomePage.asp)

28. National Institute Standards and Technology (NIST) Special Publications

(SP)

29. VA Directive 6508, VA Privacy Impact Assessment, October 3, 2008

30. VA Directive 6300, Records and Information Management, February 26,

31. VA Handbook, 6300.1, Records Management Procedures, March 24, 2010

32. OMB Memorandum, “Transition to IPv6”, September 28, 2010 http://www.va.gov/vapubs http://www.va.gov/vapubs https://www.voa.va.gov/pmas/ http://www.va.gov/PROPATH/Maps.asp http://www.va.gov/PROPATH/Templates.asp http://www.va.gov/trm/TRMHomePage.asp

33. VA Directive 0735, Homeland Security Presidential Directive 12 (HSPD-12) Program, February 17, 2011

34. VA Handbook 0735, Homeland Security Presidential Directive 12 (HSPD-12) Program, March 20, 2014

35. OMB Memorandum M-06-18, Acquisition of Products and Services for Implementation of HSPD-12, June 30, 2006

36. OMB Memorandum 05-24, Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors, August 5, 2005

37. OMB memorandum M-11-11, “Continued Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors, February 3,

38. OMB Memorandum, Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation, May 23, 2008

39. Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance, December 2, 2011

40. NIST SP 800-116, A Recommendation for the Use of Personal Identity Verification (PIV) Credentials in Physical Access Control Systems, November 20, 2008

41. OMB Memorandum M-07-16, Safeguarding Against and Responding to the Breach of Personally Identifiable Information, May 22, 2007

42. NIST SP 800-63-2, Electronic Authentication Guideline, August 2013

43. Draft NIST Special Publication 800-157, Guidelines for Derived PIV

Credentials, March 2014

44. NIST Special Publication 800-164, Guidelines on Hardware-Rooted Security in Mobile Devices (Draft), October 2012

45. Draft National Institute of Standards and Technology Interagency Report

(NISTIR) 7981 Mobile, PIV, and Authentication, March 2014

46. VA Memorandum, VAIQ #7100147, Continued Implementation of Homeland

Security Presidential Directive 12 (HSPD-12), April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

47. VA Memorandum, VAIQ # 7011145, VA Identity Management Policy, June 28, 2010 (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

48. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

49. Trusted Internet Connections (TIC) Reference Architecture Document, Version 2.0, Federal Interagency Technical Reference Architectures, Department of Homeland Security, October 1, 2013, https://www.fedramp.gov/files/2015/04/TIC_Ref_Arch_v2-0_2013.pdf

50. OMB Memorandum M-08-05, “Implementation of Trusted Internet Connections (TIC), November 20, 2007

51. OMB Memorandum M-08-23, Securing the Federal Government’s Domain Name System Infrastructure, August 22, 2008 https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514 https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514 https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514 https://www.fedramp.gov/files/2015/04/TIC_Ref_Arch_v2-0_2013.pdf

52. VA Memorandum, VAIQ #7497987, Compliance – Electronic Product Environmental Assessment Tool (EPEAT) – IT Electronic Equipment, August 11, 2014 (reference Document Libraries, EPEAT/Green Purchasing Section, https://www.voa.va.gov/documentlistpublic.aspx?NodeID=552)

53. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (Public Law 110–140), December 19, 2007

54. Section 104 of the Energy Policy Act of 2005, (Public Law 109–58), August 8, 2005

55. Executive Order 13514, “Federal Leadership in Environmental, Energy, and Economic Performance,” October 5, 2009

56. Executive Order 13423, “Strengthening Federal Environmental, Energy, and Transportation Management,” January 24, 2007

57. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 2, 2001

58. VA Directive 0058, “VA Green Purchasing Program”, July 19, 2013

59. VA Handbook 0058, “VA Green Purchasing Program”, July 19, 2013

60. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote

Access”, January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

61. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

62. VA Directive 6071, Project Management Accountability System (PMAS), February 20, 2013

63. VA Memorandum, “Implementation of Federal Personal Identity Verification

(PIV) Credentials for Federal and Contractor Access to VA IT Systems”, (VAIQ# 7614373) July 9, 2015, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

64. VA Memorandum “Mandatory Use of PIV Multifactor Authentication to VA Information System” (VAIQ# 7613595), June 30, 2015, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

65. VA Memorandum “Mandatory Use of PIV Multifactor Authentication for Users with Elevated Privileges” (VAIQ# 7613597), June 30, 2015;

https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

3.0 SCOPE OF WORK

The Contractor shall provide the professional services, hardware, and software required by individual Task Orders (TOs) for the maintenance and expansion of our AAMP at our HCS. The proposed work must include at least:

• Technology and Project Management: master project plan, stakeholder engagement, reporting, and key performance indicators (KPIs).

• Requirements and System Design: workflow discovery, architecture for CenTrak RTLS/RFID/BLE integration, coverage maps, and unified asset data model.

• Procurement and Staging: hardware/software staging, pre-configuration, and interoperability validation.

https://www.voa.va.gov/documentlistpublic.aspx?NodeID=552 https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

• Installation and Deployment: site readiness, hardware installation (readers, gateways, BLE beacons), asset tagging, and zone configuration.

• Integration with Enterprise Systems: Infor LBI®/CenTrak ConnectCore®/Zebra MotionWorks® configuration, CMMS/EAM integration, event-driven alerts, and secure access controls.

• BLE Enablement: beacon placement strategy, calibration for accuracy, gateway integration, and mobile app enablement.

• Data Governance and Cybersecurity: HIPAA compliance, encryption, VA security standards, VA Authority to Operate (ATO) and Enterprise Risk Analysis (ERA) support.

• Testing and Validation: factory/site acceptance tests, accuracy verification, performance and failover testing, and data quality checks.

• Training and Change Management: role-based training, SOPs and job aids, adoption strategies, and Section 508-compliant materials.

• Operations and Sustainment: tiered support model with service level agreement (SLA), preventive/corrective maintenance, system health monitoring, and optimization reviews.

• Documentation and Deliverables: design diagrams, configuration baselines, test reports, operational manuals, and disaster recovery plans.

• System Health and Analytics: real-time dashboards for device uptime, tag battery status, location accuracy, utilization metrics, and predictive analytics for asset demand and workflow optimization.

4.0 TECHNOLOGY COMPATIBILITY REQUIREMENTS

Due to the existing implementation of CenTrak® Active RTLS, Zebra® RFID, Infor® LBI, and AgileRank aRTLS® at our HCS(s), the following non-negotiable requirements apply to all tasks and deliverables under this Performance Work Statement (PWS):

• Hardware Compatibility: The Contractor shall propose a combination of passive RFID and BLE hardware that is fully compatible with Infor® LBI and Zebra® MotionWorks®. Location and asset data from the proposed hardware and software solution must be capable of transmission to Infor® LBI and AgileRank aRTLS.

• Software Interface Compatibility: The Contractor shall propose a software interface that integrates seamlessly with CenTrak® RTLS and Zebra® MotionWorks® solutions for asset tracking. The proposed software and user interfaces must accept and process location data from CenTrak® and Zebra® systems without loss of fidelity or functionality.

• Bluetooth® Low Energy (BLE): The Contractor shall ensure that the proposed BLE software platform integrates fully with the existing CenTrak® RTLS, Zebra MotionWorks®, and AgileRank aRTLS for asset management. BLE-generated location and asset data must be transmittable to Infor® LBI and AgileRank aRTLS and harmonized with CenTrak® and Zebra® data standards to support unified reporting, analytics, and operational workflows.

• Data Architecture Compatibility: The Contractor shall ensure that the proposed solution aligns with the existing CenTrak®, Zebra®, Infor® and aRTLS® data architecture to enable interoperability and data integrity across systems.

• Bluetooth® Low Energy (BLE): The Contractor shall ensure that the proposed BLE software platform integrates fully with the existing CenTrak® RTLS, Zebra MotionWorks®, and AgileRank aRTLS for asset management. BLE-generated location and asset data must be transmittable to Infor® LBI and AgileRank aRTLS and harmonized with CenTrak® and Zebra® data standards to support unified reporting, analytics, and operational workflows.

• UI Integration with Inventory Systems: The Contractor shall ensure that at least one proposed User Interface includes a fully functional interface with VA’s current inventory management systems, AEMS/MERS and IBM Maximo, to enable bidirectional data exchange. In addition, data must be transmissible to the VA Corporate Data Warehouse (CDW). Additionally, the UI shall integrate with our CMMS (Nuvolo©) for facilities and asset lifecycle management and provide reporting capabilities through Microsoft Power BI, enabling customizable dashboards, analytics, and exportable reports for operational and strategic decision-making.

These requirements ensure interoperability and effective data exchange (“cross-talk”) between active RTLS, passive RFID, and BLE asset management systems within our health care systems.

5.0 TEAMING AND RESELLER REQUIREMENTS

The Contractor shall maintain formal teaming agreements or authorized reseller/distributor status with the Original Equipment Manufacturers (OEM) for all proposed hardware, software, and professional services throughout the entire period of performance (POP). Documentation of these agreements shall be provided to the Government prior to contract award and updated upon any change in status. The Contractor shall ensure that all OEM partnerships grant full rights to procure, configure, install, integrate, and support the proposed solutions, including access to OEM technical resources, firmware updates, and warranty services. Failure to maintain OEM authorization or teaming agreements during the POP may result in termination for cause.

6.0 PERFORMANCE DETAILS

This is an Indefinite Delivery/Indefinite Quantity (IDIQ) contract. Individual TOs shall be issued on a Firm Fixed Price (FFP) basis.

The Contractor shall provide and/or acquire the services, hardware, and software required by individual TOs pursuant to the general requirements specified.

6.1.1 PERFORMANCE PERIOD

The ordering period shall be three (3) years from the date of award. The period of performance (PoP) for any task order may go up to 12 months beyond the last day of the ordering period. Each TO will have its own PoP.

Any work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO).

There are eleven (11) Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, four are set by date:

New Year's Day January 1 Juneteenth June 19 Independence Day July 4 Veterans Day November 11 Christmas Day December 25

If any of the above falls on a Saturday, then Friday shall be observed as a holiday.

Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

Martin Luther King's Birthday Third Monday in January Washington's Birthday Third Monday in February Memorial Day Last Monday in May Labor Day First Monday in September Columbus Day Second Monday in October Thanksgiving Fourth Thursday in November

6.1.2 PLACE OF PERFORMANCE

The place of performance shall be identified in individual Task Orders within our HCS(s).

The list of current Health Care Systems support this by this contract, and their addresses, are given in Table 1.

ID Name Address

570 Central California Health Care System

(CCHCS)

2615 E. Clinton Ave. Fresno, CA 93703-2286

612 Northern California Health Care System

(NNHCS)

10535 Hospital Way Mather, CA 95655

640 Palo Alto Health Care System (PAHCS) 3801 Miranda Ave. Palo Alto, CA 94304

654 Sierra Nevada Health Care System (SNHCS) 975 Kirman Avenue Reno, NV 89502

662 San Francisco Health Care System (SFHCS) 4150 Clement St. San Francisco, CA 94121

593 North Las Vegas Health Care System

(NLVHCS)

6900 N. Pecos Road North Las Vegas, NV 89086

459 Pacific Islands Health Care System (PIHCS) 459 Patterson Road Honolulu, HI 96819

Table 1: Health Care Systems covered under the scope of this contract

6.1.3 TRAVEL

The Government anticipates travel under this effort to perform the tasks associated with the effort. Include all estimated travel costs in your firm-fixed price line items. These costs will not be directly reimbursed by the Government.

The total estimated number of trips in support of the program related meetings for this effort will be dependent on each Task Order.

7.0 SPECIFIC TASKS AND DELIVERABLES

Individual Task Orders (TOs) may cover multiple functional areas outlined below. These functional area descriptions are provided to offer greater insight into the complexity and uniqueness of potential TO requirements addressed in this Performance Work Statement (PWS). Functional areas are not mutually exclusive; a single TO may include requirements spanning several areas.

7.1.1 TECHNOLOGY AND PROJECT MANAGEMENT

The Contractor shall implement comprehensive technology and project management practices across all Task Orders (TOs). Responsibilities include developing and maintaining a Master Project Plan (MPP) covering scope, schedule, cost, quality, resources, communications, risks, and procurement; and coordinating multi-disciplinary stakeholders (Nursing, HTM, OIT, SCM, Engineering, etc.). The Contractor shall administer formal governance routines (steering committee, change control board) and maintain artifacts (risk/issue/change logs) in a VA-approved repository. The Contractor shall assist with define, track and continuously refine KPIs aligned to VA objectives including location accuracy, system uptime, and integration success rate, with variance analysis and corrective action plans. Project controls shall include dependency tracking and critical path analysis.

Deliverables:

• Master Project Plan (MPP) — MS PowerPoint or PDF, baseline within 30 days of TO award; updated monthly; includes milestones, dependencies, resource plan, and critical path; accepted when dates/logic are consistent and achievable.

• Stakeholder Engagement Plan — PDF; due within 30 days; meeting cadences, roles/RACI, communications channels, escalation paths; accepted when all VA stakeholder groups are identified and engagement commitments scheduled.

• Risk, Issue, and Change Logs — Living spreadsheet or IT Service Agreement tool export; updated weekly; include probability/impact, owners, target dates, and mitigations; accepted when items have owners and dated actions.

• Status Reports (Monthly) — PDF, MS PowerPoint, or dashboard; schedule performance index (SPI), KPIs, accomplishments/next steps, risks/issues;

accepted when variances >±10% include corrective actions.

• KPI Dashboard —Power BI; refreshed at least weekly; displays system uptime, accuracy, retrieval time, interface error rates; accepted when data sources are validated and thresholds codified.

7.1.2 SYSTEM DESIGN

The Contractor shall lead structured discovery (interviews, workshops, site assessment) to capture clinical workflows, asset classes, patient/staff movement requirements, and compliance constraints. Using these inputs, the Contractor shall produce an end-to-end architecture integrating CenTrak® Active RTLS, Zebra® Passive RFID, BLE, and user interfaces (UI), including coverage designs (zonal, room-level, within-room), capacity plans, and data models (tag schemas, location hierarchies, status states). Designs shall specify accuracy levels (Building, Zonal, Room Level), redundancy, network/security baselines, and interoperability across CMMS/EAM. The Contractor shall conduct design reviews with VA stakeholders and document resolutions.

The Contractor shall develop and maintain hardware and server design document for each site, updating it throughout implementation to reflect current design. The design documents shall include proposed changes to VA-provided maps and Engineering Space Files, hardware installation locations, and a draft server configuration and architecture optimized for facility needs. This draft shall include diagrams detailing server requirements, expected WAN bandwidth utilization, application latency, server specifications (power, BTUs, network connections), and the number of tags supported per server.

The Contractor shall leverage the existing Wi-Fi infrastructure at each facility for technology implementation. If the existing Wi-Fi is unavailable or insufficient to meet application resolution objectives, the Contractor shall promptly notify the Government and propose supplemental technologies to ensure full functionality.

The Contractor shall ensure all applications synchronize with internal VA site time standard. The synchronization of time on this network is critical in every aspect of managing, securing, planning, and debugging as it involves determining when an event occurred.

• Requirements Specification — PDF; due within 45 days; use-case narratives, NFRs (accuracy, latency), constraints; accepted when traced to design and test cases.

• System Architecture Diagram —PDF; due within 60 days; logical/physical views, interfaces, data flows, security zones; accepted after VA review sign-off.

• Coverage Maps & Accuracy Models — Floor plans with reader/beacon placements; propagation models; accepted when modeled accuracy meets targets by area.

• Data Dictionary & Tagging Standards — Spreadsheet/PDF; tag ID format, asset classes, states (clean/dirty/in-use), location hierarchy; accepted when aligned with CMMS/EAM fields.

• Design Review Report — PDF; per review; comments, decisions, action items;

accepted when all critical actions have owners and due dates.

7.1.3 HARDWARE PROVISIONING

The Contractor shall provide all required hardware components as specified and ordered at the Task Order level. All hardware shall be fully compatible with our existing AAMP and any additional proposed interface software, including CenTrak® Active RTLS, Zebra® Passive RFID and MotionWorks®, and Bluetooth® Low Energy (BLE) technologies. Wireless hardware shall meet FIPS compliance standards.

The Contractor shall coordinate delivery schedules with VA stakeholders and obtain written or email concurrence from the Contracting Officer’s Representative (COR) prior to shipment. Upon delivery, the Contractor shall provide the COR with a signed Facility Receiving Report for each site, confirming the order and delivery of components, reconciling any discrepancies, and detailing delivery time, location, and the Government representative who received the shipment.

CATEGORIES OF HARDWARE TO BE PROVIDED:

• CenTrak® Components: Active RFID tags, exciters, readers, gateways, and supporting infrastructure.

• Zebra® Components: Passive RFID tags, handheld RFID scanners, Zebra MotionWorks® readers, and antennas.

• BLE Components: BLE tags, beacons, gateways, and associated mounting hardware.

• Networking and Infrastructure: Switches, cabling, PoE injectors, and any supplemental wireless hardware (FIPS-compliant).

• Server and Storage Hardware: As specified in the HSDD for local or centralized processing.

7.1.4 SOFTWARE PROVISIONING

The Contractor shall provide all required software components for each site as specified and ordered at the Task Order level. All software shall be fully compatible with our AAMP, including CenTrak® RTLS software, Zebra MotionWorks®, Infor LBI®, and any BLE management applications. The Contractor shall ensure that all software licenses are valid for the entire period of performance (POP) and include rights for installation, configuration, integration, and ongoing support. Software shall meet VA cybersecurity requirements, including FIPS-compliant encryption and adherence to VA Handbook 6500 standards.

The Contractor shall coordinate with VA stakeholders to schedule software delivery and installation and obtain written or email concurrence from the COR prior to deployment.

Upon installation, the Contractor shall provide the COR with a signed Software Provisioning Report for each site, confirming delivery, installation, and configuration details, as well as reconciliation of any discrepancies between planned and actual deployment.

CATEGORIES OF SOFTWARE TO BE PROVIDED:

• CenTrak® Software: RTLS Asset Management platform, location engine, and device management tools.

• Zebra® Software: MotionWorks® asset tracking platform, RFID middleware, and handheld scanner applications.

• Infor® Software: LBI® for data aggregation and integration with CMMS/EAM.

• BLE Software: Beacon management platform, user interfaces, calibration tools, and mobile application integration.

• Supporting Software: Database components, APIs, and integration connectors for interoperability.

7.1.5 STAGING

The Contractor shall manage delivery of approved hardware/software (CenTrak®, Zebra®, BLE beacons/gateways, Infor LBI® licenses) and accessories, preparing a detailed Bill of Materials (BoM) and delivery schedule aligned to installation waves.

Staging shall include firmware standardization, configuration pre-loads, and quality checks. Interoperability validation (firmware compatibility, protocol settings) shall be performed prior to shipment to sites. The Contractor shall document serials, MACs, tag IDs, and association procedures to enable traceability.

• Delivery Schedule — PDF or PowerPoint view; delivery windows, critical dependencies; accepted when aligned to installation plan.

• Pre-Configuration Checklist — PDF; per batch; firmware versions, network settings, tag profiles; accepted when spot-checked devices meet baselines.

• Interoperability Test Report — PDF; per release; test matrix for CenTrak/Zebra/BLE/Infor LBI; accepted when all priority tests pass or have mitigation.

• Inventory & Serial Log — Spreadsheet; ongoing; serials/MACs/tag IDs, location, status; accepted when entries reconcile with shipment records.

7.1.6 HARDWARE INSTALLATION AND CONFIGURATION

The Contractor shall perform complete installation and configuration of all hardware and software components as specified in the Task Orders. Hardware installation shall include CenTrak® RTLS infrastructure (readers, exciters, gateways), passive RFID components, BLE components, and supporting network equipment. The Contractor shall ensure that all hardware installation and software configuration are performed strictly in accordance with the Original Equipment Manufacturer (OEM) standards and guidelines for CenTrak®, Zebra®, Infor®, and BLE technologies. This includes adherence to OEM and VA specifications for mounting, power, network connectivity, calibration, firmware versions, and software setup. The Contractor shall document compliance with these standards in the installation and configuration reports and provide evidence of OEM-approved methods for any deviations. Failure to meet manufacturer standards may result in rejection of work and require corrective action at no additional cost to the Government.

Specific tasks include:

Pre-Installation Preparation

• Site Assessment — Conduct walkthroughs to identify installation points for readers, exciters, gateways, and beacons; validate power and network availability;

and update facility maps with proposed hardware placement.

• Hardware Staging — Verify firmware versions for all devices, pre-configure network settings, and label/inventory all components.

Physical Installation

• Mounting Readers — Install ceiling or wall-mounted readers at designated coverage zones, ensuring proper orientation, height, connect to network infrastructure, calibrate read ranges, and validate tag detection performance.

• Installing Exciters — Place exciters at room entry points for room-level accuracy, configure zone IDs and power levels, and test proximity detection for tag activation.

• Gateway Deployment — Install gateways gateways to aggregate data, validate network connectivity, and configure failover and redundancy settings.

• BLE Beacon Placement — Deploy BLE beacons strategically for optimal coverage and accuracy, mount securely, and calibrate signal strength for room-level precision.

• Tag Commissioning — Attach active RFID tags and BLE tags to assets, pair tags with asset records in the RTLS/BLE management system and perform functional tests to confirm activation and location reporting.

The Contractor shall coordinate installation schedules with VA stakeholders, minimize clinical disruption, and provide written confirmation of completion.

7.1.7 SOFTWARE INSTALLATION AND CONFIGURATION

Software configuration shall include deployment of CenTrak® RTLS platform, Zebra® MotionWorks®, Infor LBI® for data aggregation, and BLE management software. All installations shall comply with VA cybersecurity requirements, including FIPS-compliant encryption, and shall be documented with as-built diagrams and configuration baselines.

For the BLE UI, the Contractor shall provide configuration services to integrate the proposed interfaces with our AAMP, CMMS, and AEM. In response to hardware design changes or VA reconfiguration requirements, the Contractor shall update rendered maps within the UI(s). Configuration changes shall be defined during the site assessment at each facility.

Pre-Installation Preparation

• Software Licensing and Validation — Verify valid licenses for Infor LBI®, Zebra MotionWorks®, and BLE UI software; ensure compliance with VA cybersecurity and FIPS requirements.

• Environment Readiness — Confirm server specifications, network connectivity, and database availability for hosting applications; validate compatibility with VA standard configurations (Windows® 10, Edge, etc.).

Software Installation

• Install Infor LBI® Platform — Deploy Infor LBI® application on designated servers, configure database connections, and enable integration connectors for CMMS/EAM systems.

• Install Zebra MotionWorks® Software — Deploy MotionWorks® middleware and asset tracking modules; configure RFID reader communication and data ingestion pipelines.

• Deploy BLE UI Application — Install web-based BLE UI platform on VA-approved servers or cloud environment; ensure HTTPS and secure authentication mechanisms are enabled.

Configuration

• Infor LBI Configuration — Set up dashboards, reporting templates, and data aggregation rules; configure integration with CenTrak® RTLS, Zebra RFID, and BLE data streams.

• Zebra MotionWorks® Configuration — Define asset classes, tag schemas, and location hierarchies; calibrate RFID read zones and configure alert rules for asset movement.

• AgileRank aRTLS Mobile Application Configuration — Install and configure the FedRAMP-approved AgileRank aRTLS mobile app on VA-approved devices, ensure compliance with FedRAMP security controls, enable secure authentication (PIV or MFA), and validate synchronization with BLE UI and enterprise systems for asset tracking.

• BLE UI Configuration — Configure map views, asset search filters, and Power BI reporting integration.

Integration

• Data Synchronization — Validate interoperability between Infor LBI, MotionWorks, and BLE UI; ensure unified asset data model and consistent location updates across platforms.

• API and Connector Setup — Configure APIs for real-time data exchange between BLE UI and VA enterprise systems; test authentication and data integrity.

Testing and Validation

• Functional Testing — Verify UI features such as map rendering, asset search, and reporting; confirm dashboards display accurate data.

• Performance Testing — Validate system response times, data refresh intervals, and failover mechanisms.

7.1.8 USER INTERFACE PROVISIONING AND CONFIGURATION

Any proposed User Interface (UI) shall be a web-based platform that provides comprehensive asset, staff, or patient location management capabilities. The Contractor shall integrate these systems with VA’s CMMS/EAM platforms, configure alert rules, and validate interoperability across all technologies. At a minimum, it must allow users to view individual details for unique asset/staff/patient identification, display facility assets in both list and map views—with search functionality by asset number, type, model, manufacturer, or tag ID. The UI should support exporting asset information in Excel format, implementing fully customizable business rules, generating asset egress alerts (as designated by VA), and producing reports integrated with Microsoft® Power BI. Additionally, the UI must interface with VA’s Automated Engineering Management System/Medical Equipment Reporting System (AEMS-MERS), IBM Maximo®, and Nuvolo©, enabling bidirectional data exchange. This interface shall provide unique asset identification using asset ID and facility number, update the UI at least every 24 hours, allow users to adjust update frequency, post inventory date and time to AEMS-MERS, Maximo©, and Nuvolo©, reflect space creation and asset decommissioning, and stop sending location updates for decommissioned assets.

7.1.9 SYSTEM ADMINISTRATION

The Contractor shall provide Database and System Administration services during implementation and the warranty period, including periodic health checks on servers and databases, monitoring application logs, ensuring security compliance and remediation of vulnerabilities, applying monthly OS security patches from VA OIT, troubleshooting connectivity and server/application startup issues, and implementing software updates and upgrades.

7.1.10 PROFESSIONAL SERVICES HOURS

The Contractor shall provide service hours as requested by the Government for tasks including system and software configuration and administration, ensuring hardware and software compliance with VA standards, implementing workflow solutions, project planning and management, and delivering analytics and business intelligence.

7.2 ACCEPTANCE TESTING

The Contractor shall develop a single Acceptance Test Plan covering all Task Orders and obtain VA approval prior to execution. Testing will occur in two phases.

Phase 1: Performance Testing

The Contractor shall validate system functionality and confirm room-level location accuracy of at least 95%. Testing must ensure compliance with all specifications and verify that no interference occurs with other facility devices. The Contractor shall provide VA with the performance test methodology and results. If the system does not meet requirements, the Contractor shall submit a Facility Remediation Hardware Report detailing additional hardware, software, or services needed. A Final Hardware Deployment Document shall also be provided, listing all installed hardware with unique identifiers and exact locations.

Phase 2: User Acceptance Testing

The Contractor shall schedule user acceptance testing with 30 days’ notice and provide qualified personnel to assist VA during the process. The COR shall be responsible for the test methodology, and the Contractor shall deliver the results. A Facility Acceptance Test Report shall be submitted in Excel format, showing tag IDs, locations, and whether accuracy requirements were met.

Deliverables:

• Performance Test Plan & Results — PDF; includes test steps, accuracy verification, and interference checks; accepted when results meet ≥95% of the requirements.

• Facility Remediation Hardware Report — PDF; lists additional hardware/software/services required for compliance; accepted when all remediation items are documented.

• Final Hardware Deployment Document — PDF and Excel; floor map layout and table of installed hardware with IDs and locations; accepted when reconciled with design documents.

• User Acceptance Test Plan — PDF; outlines UAT process, roles, and schedule;

accepted when approved by VA and Contractor before testing.

• Facility Acceptance Test Report — Excel; provides tag IDs, locations, and accuracy ratings; accepted when accuracy metrics are clearly reported and validated.

7.2.1 TRANSITION PLANNING

The Contractor shall prepare a Transition Plan to transfer all operational responsibilities to VA staff by contract end. The plan must include procedures for hardware, software, maintenance, and configuration management, presented in a RACI matrix. The Contractor shall execute the approved plan and provide User and Technical Manuals for all system components, including troubleshooting guides, diagnostic tools, and parts lists. Each facility shall receive two copies of operator manuals and two copies of technical service manuals.

• Transition Plan — PDF; details step-by-step transition procedures and RACI matrix; accepted when reviewed and approved by VA.

• User and Technical Manuals — PDF; includes operating instructions, troubleshooting guides, and parts lists; accepted when complete and facility-specific.

7.2.2 TRAINING REQUIREMENTS

The Contractor shall provide a Training Plan and deliver on-site or remote sessions for technical and non-technical users, including Biomedical Engineering staff, inventory managers, and system administrators. Training must include schedules, delivery methods, audience profiles, and instructor details. Each session shall be documented with attendee lists and completed according to the approved plan.

• Training Plan — PDF; outlines training objectives, schedule, and delivery method;

accepted when approved by VA.

• Training Material and Schedules — PDF; includes content and timing for each session; accepted when aligned with the Training Plan.

• List of Attendees — Excel or PDF; records participants and trainer details;

accepted when complete and facility-specific.

7.2.3 WARRANTY SERVICES

All hardware, software, and services shall include a one-year manufacturer’s warranty covering parts, labor, and technical support. The Contractor shall provide maintenance during the warranty period, oversee sub-contractor support, and offer extended warranty options if requested. A Warranty Status Report shall detail specifications and warranty end dates. Help desk support must respond within two hours and complete on-site service within 15 business days.

Deliverable:

• Warranty Status Report — PDF; lists hardware/software specifications and warranty expiration dates; accepted when accurate and reconciled with deployment records.

8.0 GENERAL REQUIREMENTS

8.1 ENTERPRISE AND IT FRAMEWORK

8.1.1 VA TECHNICAL REFERENCE MODEL

The Contractor shall support the VA enterprise management framework. In association with the framework, the Contractor shall comply with OIT Technical Reference Model (VA TRM). The VA TRM is one component within the overall Enterprise Architecture (EA) that establishes a common vocabulary and structure for describing the information technology used to develop, operate, and maintain enterprise applications. Moreover, the VA TRM, which includes the Standards Profile and Product List, serves as a technology roadmap and tool for supporting OIT. Architecture & Engineering Services (AES) has overall responsibility for the VA TRM.

8.1.2 FEDERAL IDENTITY, CREDENTIAL, AND ACCESS MANAGEMENT (FICAM)

The Contractor shall ensure Commercial Off-The-Shelf (COTS) product(s), software configuration and customization, and/or new software are Personal Identity Verification (PIV) card-enabled by accepting HSPD-12 PIV credentials using VA Enterprise Technical Architecture (ETA), https://www.ea.oit.va.gov/EAOIT/VA_EA/Enterprise_Technical_Architecture.asp, and VA Identity and Access Management (IAM) approved enterprise design and integration patterns, https://www.oit.va.gov/library/recurring/edp/index.cfm. The Contractor shall ensure all Contractor delivered applications and systems comply with the VA Identity, Credential, and Access Management policies and guidelines set forth in VA Handbook 6510 VA Identity and Access Management, VA Handbook 0735 Homeland Security Presidential Directive 12 (HSPD-12) Program, and align with the Federal Identity, Credential, and Access Management Roadmap and Implementation Guidance v2.0.

https://www.ea.oit.va.gov/EAOIT/VA_EA/Enterprise_Technical_Architecture.asp https://www.oit.va.gov/library/recurring/edp/index.cfm

The Contractor shall ensure all Contractor delivered applications and systems provide user authentication services compliant with the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-63-3, VA Handbook 6500 Appendix F, “VA System Security Controls”, and VA IAM enterprise requirements for direct, assertion based authentication, and/or trust based authentication, as determined by the design and integration patterns. Direct authentication at a minimum must include Public Key Infrastructure (PKI) based authentication supportive of PIV card and/or Common Access Card (CAC), as determined by the business need.

The Contractor shall ensure all Contractor delivered applications and systems conform to the specific Identity and Access Management PIV requirements set forth in the Office of Management and Budget (OMB) Memoranda M-05-24, M-19-17, and NIST Federal Information Processing Standard (FIPS) 201-2. OMB Memoranda M-05-24 and M-19- 17 can be found at:

https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2005/m05- 24.pdf, and https://www.whitehouse.gov/wp-content/uploads/2019/05/M-19-17.pdf respectively. Contractor delivered applications and systems shall be on the FIPS 201-2 Approved Product List (APL). If the Contractor delivered application and system is not on the APL, the Contractor shall be responsible for taking the application and system through the FIPS 201 Evaluation Program.

The Contractor shall ensure all Contractor delivered applications and systems support:

1. Automated provisioning and are able to use enterprise provisioning service.

2. Interfacing with VA’s Master Person Index (MPI) to provision identity attributes, if the solution relies on VA user identities. MPI is the authoritative source for VA user identity data.

3. The VA defined unique identity (Secure Identifier [SEC ID] / Integrated Control Number [ICN]).

4. Multiple authenticators for a given identity and authenticators at every Authenticator Assurance Level (AAL) appropriate for the solution.

5. Identity proofing for each Identity Assurance Level (IAL) appropriate for the solution.

6. Federation for each Federation Assurance Level (FAL) appropriate for the solution, if applicable.

7. Two-factor authentication (2FA) through an applicable design pattern as outlined in VA Enterprise Design Patterns.

8. A Security Assertion Markup Language (SAML) implementation if the solution relies on assertion-based authentication. Additional assertion implementations, besides the required SAML assertion, may be provided as long as they are compliant with NIST SP 800-63-3 guidelines.

9. Authentication/account binding based on trusted Hypertext Transfer Protocol (HTTP) headers if the solution relies on Trust based authentication.

10. Role Based Access Control.

11. Auditing and reporting capabilities.

12. Compliance with VIEWS 00155984, PIV Logical Access Policy Clarification https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896.

https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2005/m05-24.pdf https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2005/m05-24.pdf https://www.whitehouse.gov/wp-content/uploads/2019/05/M-19-17.pdf https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

The required Assurance Levels for this specific effort are Identity Assurance Level 3, Authenticator Assurance Level 3, and Federation Assurance Level 3.

8.1.3 INTERNET PROTOCOL VERSION 6 (IPV6)

The Contractor solution shall support Internet Protocol Version 6 (IPv6) based upon the memo issued by the Office of Management and Budget (OMB) on November 19, 2020 (https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-07.pdf). IPv6 technology, in accordance with the USGv6 Program (https://www.nist.gov/programs-projects/usgv6-program/usgv6-revision-1), NIST Special Publication (SP) 500-267B Revision 1 “USGv6 Profile” (https://doi.org/10.6028/NIST.SP.500-267Br1), and NIST SP 800-119 “Guidelines for the Secure Deployment of IPv6” (https://doi.org/10.6028/NIST.SP.800-119), compliance shall be included in all IT infrastructures, application designs, application development, operational systems and sub-systems, and their integration. In addition to the above requirements, all devices shall support native IPv6 and dual stack (IPv6 / IPv4) connectivity without additional memory or other resources being provided by the Government, so that they can function in a mixed environment. All public/external facing servers and services (e.g.

web, email, DNS, ISP services, etc.) shall support native IPv6 and dual stack (IPv6 / IPv4) users and all internal infrastructure and applications shall communicate using native IPv6 and dual stack (IPv6 / IPv4) operations.

8.1.4 TRUSTED INTERNET CONNECTION (TIC)

The Contractor solution shall meet the requirements outlined in Office of Management and Budget Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative“ (https://www.whitehouse.gov/wp-content/uploads/2019/09/M-19-26.pdf), VA Directive 6513 “Secure External Connections”, and shall comply with the TIC 3.0 Core Guidance Documents, including all Volumes and TIC Use Cases, found at the Cybersecurity & Infrastructure Security Agency (CISA) (https://www.cisa.gov/publication/tic-30-core-guidance-documents). Any deviations must be approved by the VA TIC 3.0 Working Group at vaoisesatic30team@va.gov.

8.1.5 STANDARD COMPUTER CONFIGURATION

The Contractor IT end user solution that is developed for use on standard VA computers shall be compatible with and be supported on the standard VA operating system, currently Windows 10 (64bit), Edge (Chromium based), and 365 Apps for enterprise. Applications delivered to VA and intended to be deployed to Windows 10 workstations shall be delivered as a signed .msi package with switches for silent and unattended installation and updates shall be delivered in signed .msp file formats for easy deployment using Microsoft Endpoint Configuration Manager (CM) VA’s current desktop application deployment tool. Signing of the software code shall be through a vendor provided certificate that is trusted by VA using a code signing authority such as Verizon/Cybertrust or Symantec/VeriSign.