(P02)_PWS_Section 508 Audit Testing and Training Services.docx

Section 508 Audit, Testing and Training Services

VA-24-00029932

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Office of Information & Technology (OIT) Enterprise Program Management Office (EPMO)

Section 508 Audit, Testing and Training Services

Date: December 6, 2023

VA-24-00029932

PWS Version Number: 1.0

Contents

BACKGROUND

The Department of Veterans Affairs (VA), Office of Information & Technology (OIT), Enterprise Program Management Office (EPMO) strives to provide high quality, effective, and efficient Information Technology (IT) services to those responsible for providing care to the Veterans at the point-of-care as well as throughout all the points of the Veterans’ health care in an effective, timely and compassionate manner. VA depends on Information Management/Information Technology (IM/IT) systems to meet mission goals.

Historically, VA has achieved success in providing accessible and usable IT for its disabled employees and customers. VA has established a Section 508 Program Office and Auditing Facility, located in the VA Central Office, which provides accessible services, conformance testing solutions, and innovative strategies in implementing the goals and objectives of the Section 508 legislation while helping to increase awareness of accessibility issues and programs for internal and external VA stakeholders. VA’s current Section 508 activities, in some areas, serve as a model for other Federal agencies and the private sector.

The Architectural and Transportation Barriers Compliance Board (Access Board) issues accessibility standards for Information and Communication Technology (ICT) and the technical and functional criteria for such technology to comply with Section 508 legislation.

ICT refers to equipment or interconnected system or subsystem of equipment that is used in the creation, conversion or duplication of data or information. The term ICT applies to computers and networks, hardware, software, web pages and email as well as equipment used for transmitting, receiving, using or storing information such as fax machines, copiers, telephones, communication devices, information kiosks, transaction machines, multimedia, interconnected systems or subsystems of equipment that is used in the creation, conversion, or duplication of data or information. The term does not include any equipment that contains embedded IT that is used as an integral part of the product, but the principal function of which is not the acquisition, storage, manipulation, management, movement, control, display, switching, interchange, transmission, or reception of data or information. Section 508 requires that the ICT be compatible with such software and devices so that ICT can be accessible to and usable by individuals using assistive technology, including but not limited to screen readers, screen magnifiers, and speech recognition software.

The VA Chief Information Officer (CIO) has mandated that all ICT shall meet Section 508 compliance. VA requires independent validation audits and testing of ICT against Section 508 compliance standards and training on Section 508. This Task Order (TO) will be used to verify that the products developed, procured, maintained, or used by VA meet those requirements. These requirements are validated by independent auditing and testing done by the Section 508 Program Office.

APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. 44 U.S.C. § 3541-3549, “Federal Information Security Management Act (FISMA) of 2002”

2. “Federal Information Security Modernization Act of 2014”

3. Federal Information Processing Standards (FIPS) Publication 140-2, “Security Requirements for Cryptographic Modules”

4. FIPS Pub 199. “Standards for Security Categorization of Federal Information and Information Systems,” February 2004

5. FIPS Pub 200, “Minimum Security Requirements for Federal Information and Information Systems,” March 2006

6. FIPS Pub 201-2, “Personal Identity Verification of Federal Employees and Contractors,” August 2013

7. 10 U.S.C. § 2224, "Defense Information Assurance Program"

8. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

9. Public Law 109-461, Veterans Benefits, Health Care, and Information Technology Act of 2006, Title IX, Information Security Matters

10. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”

11. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, https://www.va.gov/vapubs/index.cfm

12. VA Handbook 0710, “Personnel Security and Suitability Program,” May 2, 2016, https://www.va.gov/vapubs/index.cfm

13. VA Directive and Handbook 6102, “Internet/Intranet Services,” August 5, 2019

14. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and Guidelines,” January 18, 2017

15. Office of Management and Budget (OMB) Circular A-130, “Managing Federal Information as a Strategic Resource,” July 28, 2016

16. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed Services (CHAMPUS)”

17. NIST SP 800-66 Rev. 1, “An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule,” October 2008

18. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended, January 18, 2017

19. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

20. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021

21. VA Handbook 6500, “Risk Management Framework for VA Information Systems VA Information Security Program,” February 24, 2021

22. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI),” March 12, 2019

23. VA Handbook 6500.5, “Incorporating Security and Privacy into the System Development Lifecycle,” March 22, 2010

24. VA Handbook 6500.6, “Contract Security,” March 12, 2010

25. VA Handbook 6500.8, “Information System Contingency Planning,” April 6, 2011

26. VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018

27. VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017

28. OIT Process Asset Library (PAL), https://www.va.gov/process/ . Reference Process Maps at https://www.va.gov/process/maps.asp and Artifact templates at https://www.va.gov/process/artifacts.asp

29. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

30. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014

31. VA Handbook 6508.1, “Procedures for Privacy Threshold Analysis and Privacy Impact Assessment,” July 30, 2015

32. VA Handbook 6510, “VA Identity and Access Management,” January 15, 2016

33. VA Directive and Handbook 6513, “Secure External Connections,” October 12, 2017

34. VA Directive 6300, “Records and Information Management,” September 21, 2018

35. VA Handbook, 6300.1, “Records Management Procedures,“ March 24, 2010

36. NIST SP 800-37 Rev 2, “Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy,” December 2018

37. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020)

38. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015

39. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” March 24, 2014

40. OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005

41. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019

42. OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008

43. Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance, December 2, 2011, (NOTE: Part A of the FICAM Roadmap and Implementation Guidance, v2.0, was replaced in 2015 with an updated Architecture (https://arch.idmanagement.gov/#what-is-the-ficam-architecture)

44. NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access,“ June 2018

45. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, “Digital Identity Guidelines,” updated March 02, 2020

46. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014

47. NIST SP 800-164, “Guidelines on Hardware-Rooted Security in Mobile Devices (Draft),” October 2012

48. Draft National Institute of Standards and Technology Interagency Report (NISTIR) 7981, “Mobile, PIV, and Authentication,” March 2014

49. VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

50. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

51. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

52. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

53. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019

54. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008

55. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (Public Law 110–140), December 19, 2007

56. Section 104 of the Energy Policy Act of 2005, (Public Law 109–58), August 8, 2005

57. Executive Order 13834, “Efficient Federal Operations,” dated May 17, 2018

58. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 2, 2001

59. VA Directive 0058, “VA Green Purchasing Program,” July 19, 2013

60. VA Handbook 0058, “VA Green Purchasing Program,” July 19, 2013

61. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

62. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

63. “Veteran Focused Integration Process (VIP) Guide 4.0,” January 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

64. VA Memorandum “Proper Use of Email and Other Messaging Services,” January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

65. “DevSecOps Product Line Management Playbook” version 2.0, May 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

66. NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020

67. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol Version 6 (IPv6),” November 19, 2020

68. Social Security Number (SSN) Fraud Prevention Act of 2017

69. Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23, 2018

SCOPE OF WORK

The Contractor shall conduct VA Department-wide Section 508 Training, Section 508 Testing and Section 508 conformance auditing, testing and training of VA ICT products and systems. All results of the auditing, testing and training performed by the Contractor shall be measured and reported to VA Leadership, the Office of Management and Budget (OMB) and the Department of Justice (DOJ). The Contractor shall provide demonstrations and explanations of any Section 508 finding. The Contractor shall provide Section 508 Testing reports and suggest defect remediation to stakeholders with demonstration upon demand. All Section 508 testing shall be measured and reported to the Section 508 office. All Section 508 training will be conducted virtual/onsite to VA Enterprise members and those doing business with the VA. The Contractor shall provide increased awareness through Section 508 training for internal and external VA stakeholders. The Contractor shall report conformance metrics and trend analysis to Section 508 office for distribution to various organizations within VA and directly to the VA CIO as an important aspect of improving accessibility within VA.

Order Type The effort shall be proposed on a Firm Fixed Price (FFP) basis, including Optional Tasks.

PERFORMANCE DETAILS

PERFORMANCE PERIOD

The period of performance (PoP) shall be a 12-month base period with four 12-month option periods and three Optional Tasks. The total PoP for this contract shall not exceed 60 months, inclusive of all Options.

Any work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO).

There are 11 Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, five are set by date:

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

PLACE OF PERFORMANCE

Efforts under this TO shall be performed at Contractor facilities. The Contractor shall identify the Contractor’s place of performance in their proposal submission.

TRAVEL

The Government does not anticipate travel under this effort to perform the tasks associated with the effort.

SPECIFIC TASKS AND DELIVERABLES

PROJECT MANAGEMENT

CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, timeline, and tools to be used in execution of the contract. The CPMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks, and resource support. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPMP shall be concurred upon and updated in accordance with Section B of the TO. The Contractor shall update and maintain the VA Program Manager (PM) approved CPMP throughout the PoP.

Deliverable:

A. Contractor Project Management Plan

REPORTING REQUIREMENTS

The Contractor shall provide the COR with Weekly Progress Reports in electronic form in Microsoft Word formats. The report shall include detailed instructions/explanations for each required data element, to ensure that data is accurate and consistent. These reports shall reflect data as of the last day of the preceding week.

The Weekly Progress Reports shall cover all work completed during the reporting period and work planned for the subsequent reporting period. The report shall also identify any problems that arose and a description of how the problems were resolved. If problems have not been completely resolved, the Contractor shall provide an explanation including their plan and timeframe for resolving the issue. The report shall also include an itemized list of all Information and Communication Technology (ICT) deliverables and their current Section 508 conformance status. The Contractor shall monitor performance against the CPMP and report any deviations. It is expected that the Contractor will keep in communication with VA accordingly so that issues that arise are transparent to both parties to prevent escalation of outstanding issues.

Deliverable:

A. Weekly Progress Report

PRODUCT DEVELOPMENT (PD) REPORTING REQUIREMENTS

The Contractor shall provide a Weekly Project Schedule, which includes the following:

1. All activities and deliverables required under this TO. The schedule format shall be approved by the COR.

2. All project tasks that are required to execute the activities and deliverables under this TO. The Contractor shall define all individual activities, regardless of how minimal the hours are for the individual activity.

3. The status for all activities.

The Contractor shall deliver a Monthly 508 Audit, Testing and Training Status Report. This report shall provide accurate, timely, and complete project information. The Monthly 508 Audit, Testing and Training Status Report shall include the following data elements:

1. Project Name and TO Name.

2. Overview and description of the TO.

3. Overall high-level assessment of TO progress.

4. All work in-progress and completed during the reporting period.

5. Identification of any TO related issues uncovered during the reporting period and their likely impact on schedule, cost, or performance goals; especially highlighting issues with a high probability of impacting schedule, cost or performance goals.

6. Explanations for any unresolved issues, including possible solutions and any actions required of the Government and/or Contractor to resolve or mitigate any identified issue, including a plan and timeframe for resolution.

7. Status on previously identified issues, actions taken to mitigate the situation and/or progress made in rectifying the situation.

8. Work planned for the following four reporting periods, when applicable.

9. Current TO schedule overlaid on original TO schedule showing any delays or advancement in schedule.

10. For Firm Fixed Priced efforts, provide expenditures based upon the Contractor’s proposed spend plan for the TO.

11. Workforce staffing data showing all Contractor personnel performing on the effort during the current reporting period. After the initial labor baseline is provided, each Bi-Weekly EPMO Status Report shall identify any changes in staffing, including identifying each person who was added to the TO or removed from the TO.

12. Original schedule of deliverables and the corresponding deliverables made during the current reporting period.

13. Provide and maintain audit, testing and training burn down information.

14. Document audit timeline to include

1. Initial Request

2. Full access

3. Completion date

4. Total days used to complete the audit, testing and training.

This report shall not be the only means of communication between the Contractor, COR and the PM to advise of performance and schedule issues and to develop strategies for addressing the issues. The Contractor shall continuously monitor performance and report any deviation from the CPMP or previous progress Report to the COR and PM upon recognition of deviation and during routine, regular communications.

Deliverable:

A. Weekly Project Schedule B. Monthly 508 Audit, Testing and Training Status Report

TECHNICAL KICKOFF MEETING

A technical kickoff meeting shall be held within 10 days after TO award. The technical kickoff meeting shall be virtual via Microsoft Teams. The Contractor shall coordinate the date and time with the Contracting Officer (CO), as the Post-Award Conference Chairperson, the VA PM (Co-Chairperson), the 508 Director, the Contract Specialist (CS), and the COR. The Contractor shall provide a draft agenda to the CO and VA PM at least five calendar days prior to the meeting. Upon Government approval of a final agenda, the Contractor shall distribute to all meeting attendees. During the kickoff-meeting, the Contractor shall present, for review and approval by the Government, the details of the intended approach, work plan, and project schedule for each effort via a Microsoft Office PowerPoint presentation. At the conclusion of the meeting, the Contractor shall update the presentation with a final slide entitled “Summary Report” which shall include notes on any major issues, agreements, or disagreements discussed during the kickoff meeting and the following statement “As the Post-Award Conference Chairperson, I have reviewed the entirety of this presentation and assert that it is an accurate representation and summary of the discussions held during the Technical Kickoff Meeting for the Section 508 Audit, Testing and Training Services”. The Contractor shall submit the final updated presentation to the CO for review and signature within three calendar days after the meeting. The Contractor shall also work with the CS and the Government’s designated note taker, to prepare and distribute the Meeting Minutes of the kickoff meeting to the CO, COR and all attendees within three calendar days after the meeting. The Contractor shall obtain concurrence from the CS on the content of the Meeting Minutes prior to distribution of the document.

PRIVACY TRAINING

The Contractor shall submit status of VA Privacy and Information Security Awareness and Rules of Behavior training for all individuals engaged on the task. The status reporting shall identify; a single Contractor Security Point Of Contact, the names of all personnel engaged on the task, their initial training date for VA Privacy and Information Security and Rules of Behavior training, and their next required training date. This information shall be submitted as part of the Weekly Progress Report.

The Contractor shall submit VA Privacy and Information Security and Rules of Behavior training certificates in accordance with Section 9, Training, from Appendix C of the VA Handbook 6500.6, “Contract Security”.

Deliverable:

A. VA Privacy and Information Security and Rules of Behavior Training Certificates monthly as applicable

1.1 SECTION 508 AUDIT SUPPORT

The Contractor shall perform United States Access Board’s Section 508 Standards assessments applying to ICT. The 508 compliance audit shall be a sampling of the ICT covering all the relevant Section 508 standards. The scope of the audit will consist of approximately 25% of the ICT product.

The Contractor shall coordinate all activities from project intake and project assessment to the delivery of the final audits for approximately 3,600 ICT per year. Audits include approximately 2,000 ICT applications (web hosted, SharePoint, Mobile, Multi-media, self-contained/Closed products, Desktop products, websites, eLearning as a minimum). Additionally, the Contractor shall conduct document audits with approximately 1000 Simple document audits (under 10 pages), 500 Simple complex document audits (11-99 pages) and 100 Complex documents audits (more than 100 pages) per year. All delivered documents must be 508 Compliant.

SECTION 508 COMPLIANCE AUDITS

The Contractor shall create a Section 508 Compliance Audit Report for each requested audit of VA ICT products. The audit report shall be maintained in the 508 Defect Tracking System.

The Contractor shall conduct a 508 Compliance audit to identify 508 standards which are deficiencies, nonconformance, and problems encountered, and to recommend suggestions for improvements and best practices for each ICT product assessed.

The Contractor shall perform the 508 compliance audits in accordance with the United States Access Board’s Section 508 of the ICT standards. Application ICT Audits shall be completed within eight business days once full access is provided to the assigned auditor. Simple document audits (under 10 pages) shall have the audit report completed in two business days. Simple Complex audits of 11-99 pages shall be completed in four business days. Complex audits of 100 pages or more shall be completed in six business days. Products may include, but are not limited to, electronic documents and VA forms, authoring tools, software applications, applications on platforms including Java and SharePoint, plug-ins, websites, web application and non-web-based applications.

The Contractor shall conduct, document, and report the audit within the 508 Defect Tracking System. Audits may include automation but shall include use of assistive technology tools, such as screen readers, screen magnifiers, and speech recognition software, in multiple environments to include legacy applications written in VB6, Delphi, or MUMPS, and modern applications written in HTML or Java Script and electronic healthcare record /Cerner products.

The Contractor shall use, as a minimum, Job Access With Speech (JAWS), Fusion, Dragon, and Color Contrast Analyzer accessibility tools.

The Contractor shall provide support to include demonstrations (Show and Tells) of audit results, if requested. Upon request of a Show and Tell, the Contractor shall provide a demonstration of audit defects noted in the Compliance Audit Report within 10 days of the request. A Show and Tell Summary Report shall be provided monthly and include the name of the project, the audit number, the show and tell date, and duration of meeting.

The Compliance Audit Report maintained within the 508 Defect Tracking Tool shall include the following:

1) Audit Tracking Number

2) Project Government PM/COR

3) Audit Environment

4) Section 508 defective Standard

5) Standard Severity

6) Status of the defect

7) A sampling of example(s) of each defective standard.

The Compliance Audit Reports are due within eight (8) business days after an auditor is assigned and all necessary access is granted.

The assessment progress shall be tracked by the Contractor in a VA-accessible Compliance Tracking System.

Deliverables:

A. Compliance Audit Report B. Show and Tell Summary Report

SECTION 508 AUDIT CUMULATIVE SUMMARY

The Contractor shall create a Section 508 Assessment Status Document that summarizes the conformance status of all ICT audited by the Contractor over the life of the TO. The Contractor shall update the document monthly.

Deliverables:

A. Section 508 Assessment Status Document

1.2 SECTION 508 TESTING SUPPORT

The Contractor shall coordinate all activities from project intake and project assessment to the delivery of the final Section 508 end to end testing report for approximately 500 ICT per year. Section 508 end to end testing include multiple application types to include web hosted, SharePoint, Mobile, Multi-media, self-contained/Closed products, Desktop products, websites, eLearning as a minimum. All delivered documents must be 508 Compliant.

SECTION 508 COMPLIANCE PRODUCT TESTING

The Contractor shall create a Section 508 Compliance Test Report for each requested test of VA ICT products. The test report shall be maintained in the 508 Defect Tracking System.

The Contractor shall conduct a 508 Compliance Test to identify 508 standards which are deficiencies, nonconformance, and problems encountered, and to recommend suggestions for improvements and best practices for each ICT product tested.

The Contractor shall perform the 508 compliance tests in accordance with the United States Access Board’s Section 508 of the ICT standards. Application ICT tests shall be completed within15 business days once full access is provided to the assigned tester.

Simple document tests (under 10 pages) shall have the test report completed in two business days. Simple Complex tests of 11-99 pages shall be completed in four business days. Complex tests of 100 pages or more shall be completed in six business days. Products may include, but are not limited to, electronic documents and VA forms, authoring tools, software applications, applications on platforms including Java and SharePoint, plug-ins, websites, web application and non-web-based applications.

The Contractor shall conduct, document, and report the tests within the 508 Defect Tracking System. Tests may include automation but shall include use of assistive technology tools, such as screen readers, screen magnifiers, and speech recognition software, in multiple environments to include legacy applications written in VB6, Delphi, or MUMPS, and modern applications written in HTML or Java Script and electronic healthcare record /Cerner products.

The Contractor shall use Technical Reference Model (TRM) approved VA accessibility tools.

The Contractor shall provide support to include demonstrations (Show and Tells) of test results, if requested. Upon request of a Show and Tell Test report, the Contractor shall provide a demonstration of test defects noted in the Compliance test Report within 10 days of the request. A Show and Tell Summary Report shall be provided monthly and include the name of the project, the test number, the show and tell date, and duration of meeting.

The Compliance Test Reports are due within fifteen business days after a tester is assigned and all necessary access is granted.

The assessment progress shall be tracked by the Contractor in a VA-accessible Compliance Tracking System.

Deliverables:

A. Compliance Test Report B. Show and Tell Summary Report

SECTION 508 TEST CUMULATIVE SUMMARY

The Contractor shall create a Section 508 Test Cumulative Summary Document that summarizes the conformance status of all ICT tested by the Contractor over the life of the TO. The Contractor shall update the document monthly.

Deliverables:

A. Section 508 Test Cumulative Summary Document

SECTION 508 AWARENESS TRAINING

The Contractor shall coordinate all activities from project intake and project assessment to the delivery of the Section 508 Awareness Training. All delivered documents must be 508 Compliant.

SECTION 508 TRAINING

The Contractor shall deliver awareness training activities and develop Section 508 Slide Presentations and Training Modules to increase the awareness of Section 508 for VA employees and supporting staff involved in development work or producing ICT. Training shall be done in two ways: virtual classroom training (Live Meeting or Smart classroom) and E-Learning. All Classes will be taught monthly for the duration of the contract for a minimum of one hour with customer feedback survey for each course taught. All classes must have a minimum of one participant.

The Contractor shall conduct the following training sessions monthly with COR/PM schedule approval at a minimum:

A. Accessibility Documents:

a. MS PowerPoint Class two times a month.

b. MS Excel Class one time a month.

c. MS Word Class two times a month.

d. Adobe PDF Class four times a month.

e. AD-Hoc 508 Accessibility class five times a month.

B. Section 508 Basics: (Monthly)

a. Introduction to Section 508 (Awareness Training)

b. Developing and Testing Web Hosted Applications.

c. Developing and Testing SharePoint sites with accessibility.

d. Developing and Testing Mobile applications with accessibility.

e. Section 508 Standards.

f. Section 508 and Acquisitions.

g. Accessibility Testing Basics

h. Ad-Hoc Section 508.

General Section 508 basics and document accessibility training shall be done monthly using MS TEAMS Meeting. Class size may vary from 1 – 2500 participants.

The Contractor shall develop a web-based, interactive Section 508 Training Module to reside on VA’s E-Learning site which mirrors the classroom virtual training provided by the Contractor to VA. The Contractor shall present the virtual training modules and training modules to VA for approval before release or use.

Deliverable:

A. Section 508 Slide Presentations and Training Modules for each course

METRICS AND REPORTING SECTION 508 CONFORMANCE

The Contractor shall provide a 508 Office Weekly Activity Report (WAR) which includes status of all work that has been received, is in progress, and has been completed within the VA 508 office.

The Contractor shall prepare an Operational Progress Report (OPR) that includes statistics, data metrics, and various charts and graphics to show status on Section 508 Office activities.

The Contractor shall prepare VA input to OMB annual Report (https://www.whitehouse.gov/sites/default/files/omb/procurement/memo/strategic-plan-508-compliance.pdf)).

The Contractor shall prepare Ad Hoc Reports in response to data calls which VA estimates at approximately 2-3 data calls per week.

Deliverables:

A. 508 Office Weekly Activity Report B. Operational Progress Report C. OMB Annual Report D. Ad Hoc Reports

QUALITY IMPROVEMENT REPORT

The Contractor shall provide a Quality Improvement Report containing an overall assessment of VA’s Section 508 compliance efforts, the identification of problems encountered and recommended suggestions for improvements and best practices. This report shall also provide a development checklist that can be utilized as a reference tool for future design and development of ICT products.

The Contractor shall provide a Quality Improvement Report for VA Section 508. This Quality Improvement Report shall be generated in part from data and analysis provided by the Section 508 compliance defect tracking tools.

Deliverable:

A. Quality Improvement Report SECTION 508 Best PractiCe SUPPORT The Contractor shall provide the VA Section 508 office information of best practices as they relate to coding of web pages and how to comply with document accessibility requirements. These best practices can include links to other websites that provide instructions on how to make websites and documents accessible. The Contractor shall provide a Listing of Best Practices and Training Materials that includes a summary of best practices and exposition on web programming and application development 508 training topics to include Asynchronous JavaScript and XML (AJAX), JAVA, HyperText Markup Language (HTML) 5, and Mobile.

Deliverables:

A. Listing of Best Practices and Training Materials OPTION PERIODS One through four If VA exercises the Option Periods, the Contractor shall continue to provide the same services as sections 5.1 (except 5.1.4) through 5.7 of the PWS to include all associated deliverables for each Option Period exercised.

SECTION 508 AUDIT SURGE (OPTIONAL TASK ONE)

If VA requires audits of more than 3,600 ICT products per year (reference PWS 5.2), this optional task may be exercised. The Contractor shall perform United States Access Board’s Section 508 Standards assessments applying to ICT. The 508 compliance audit shall be a sampling of the ICT covering all the relevant Section 508 standards. The scope of the audit will consist of approximately 25% of the ICT product.

The Contractor shall coordinate all activities from project intake and project assessment to the delivery of the final validation report for approximately 250 ICT products per exercise. This optional task may be exercised up to 20 times at any time and from time to time throughout the TO period of performance, at the discretion of the Government and can be exercised during the Base Period and each Option Period of performance. This Optional Task PoP shall run concurrently with the period in which it was exercised.

The Contractor shall conduct, document, and report the audit within the 508 Defect Tracking System. Audits may include automation but shall include use of assistive technology tools, such as screen readers, screen magnifiers, and speech recognition software, in multiple environments to include legacy applications written in VB6, Delphi, or MUMPS, and modern applications written in HTML or Java Script and electronic healthcare record /Cerner products.

The Contractor shall use as a minimum JAWS, Fusion, Dragon, and Color Contrast Analyzer accessibility tools.

The Contractor shall provide support to include demonstrations (Show and Tells) of audit results, if requested. Upon request of a Show and Tell, the Contractor shall provide a demonstration of audit defects noted in the Compliance Audit Report within 10 days of the request. A Show and Tell Summary Report shall be provided monthly and include the name of the project, the audit number, the show and tell date, and duration of meeting.

The Compliance Audit Report maintained within the 508 Defect Tracking Tool shall include the following:

1) Audit Tracking Number

2) Project Government PM/COR

3) Audit Environment

4) Section 508 defective Standard

5) Standard Severity

6) Status of the defect

7) A sampling of example(s) of each defective standard.

The Compliance Audit Reports are due within eight (8) business days after an auditor is assigned and all necessary access is granted.

The assessment progress shall be tracked by the Contractor in a VA-accessible Compliance Tracking System.

Deliverables:

A. Compliance Audit Report B. Show and Tell Summary Report

SECTION 508 TEST SURGE (OPTIONAL TASK TWO)

If VA requires tests of more than 500 ICT applications per year (reference PWS 5.3), this optional task may be exercised. The Contractor shall coordinate all activities from project intake and project assessment to the delivery of the final testing report for approximately 250 ICT applications per exercise. All delivered documents must be 508 Compliant. This optional task may be exercised up to 20 times at any time and from time to time throughout the TO period of performance, at the discretion of the Government and can be exercised during the Base Period and each Option Period of performance. This Optional Task PoP shall run concurrently with the period in which it was exercised.

The Contractor shall provide support to include demonstrations (Show and Tells) of test results, if requested. Upon request of a Show and Tell Test report, the Contractor shall provide a demonstration of test defects noted in the Compliance test Report within 10 days of the request. A Show and Tell Summary Report shall be provided monthly and include the name of the project, the test number, the show and tell date, and duration of meeting.

The Compliance Test Reports are due within fifteen business days after a tester is assigned and all necessary access is granted.

The assessment progress shall be tracked by the Contractor in a VA-accessible Compliance Tracking System.

Deliverables:

A. Compliance Testing Report B. Show and Tell Summary Report

SECTION 508 TRAINING SURGE (OPTIONAL TASK THREE)

If VA requires more than 14 Accessibility Documents and eight Section 508 Basics training courses (reference PWS 5.4.1) on a monthly basis, this optional task may be exercised. The Contractor shall deliver awareness training activities and develop Section 508 Slide Presentations and Training Modules to increase the awareness of Section 508 for VA employees and supporting staff involved in development work or producing ICT. Training shall be done in two ways: virtual classroom training (Live Meeting or Smart classroom) and E-Learning. All Classes will be taught monthly for the duration of the contract for a minimum of one hour with customer feedback survey for each course taught. The Contractor shall provide one additional Accessibility documents course or one additional 508 Basics training class, if exercised. This optional task may be exercised up to 10 times at any time and from time to time throughout the period of performance, at the discretion of the Government and can be exercised during the Base Period and each Option Period of performance. This Optional Task PoP shall run concurrently with the period in which it was exercised.

The Contractor shall develop a web-based, interactive Section 508 Training Module to reside on VA’s E-Learning site which mirrors the classroom virtual training provided by the Contractor to VA. The Contractor shall present the virtual training modules and training modules to VA for approval before release or use.

Deliverable:

A. Section 508 Slide Presentations and Training Modules

1.3 TRANSITION SUPPORT (OPTIONAL TASK FOUR)

If this Optional Task is exercised by VA, the Contractor shall provide 60 days of outgoing support to transition services performed under this TO to a follow-on TO or back to the Government.

1. The Contractor shall provide a Phase-Out Section 508 Audit, Testing and Training Transition Plan which shall detail both the assumption of responsibilities and the transfer of responsibilities to follow on parties at the conclusion of the PoP. This Transition Plan shall discuss, at a minimum, performance of the following activities:

2. Coordination with Government representatives.

2. Review, evaluation, and transition of current support services.

3. Transition of historic data to new Contractor system.

4. Transfer of all necessary business and/or technical documentation.

5. Introduce and provide knowledge transfer of the Contractor team’s tools, methodologies, and business processes to the Government/follow-on Contractor.

6. Transfer/Return of Government Furnished Equipment (GFE) and Government Furnished Information and providing GFE inventory management assistance.

7. Turn-in of all Government keys, ID/access cards, and security codes.

The Contractor shall execute the Transition Plan upon Government approval. The Contractor shall provide subject matter expertise support to affect the requisite knowledge transfer in accordance with the resulting Transition Plan. The Contractor shall work collaboratively with other support contractors and/or Government personnel. As part of collaboration, the Contractor shall convey any and all information, as it pertains to the Section 508 Audit, Testing and Training effort. This support shall also consist of providing advice, clarification, or explanation to facilitate the understanding of the information presented.

Deliverable:

A. Phase-Out Section 508 Audit, Testing and Training Transition Plan

GENERAL REQUIREMENTS

ENTERPRISE AND IT FRAMEWORK

VA TECHNICAL REFERENCE MODEL

The Contractor shall support the VA enterprise management framework. In association with the framework, the Contractor shall comply with OIT Technical Reference Model (VA TRM). The VA TRM is one component within the overall Enterprise Architecture (EA) that establishes a common vocabulary and structure for describing the information technology used to develop, operate, and maintain enterprise applications. Moreover, the VA TRM, which includes the Standards Profile and Product List, serves as a technology roadmap and tool for supporting OIT. Architecture & Engineering Services (AES) has overall responsibility for the VA TRM.

FEDERAL IDENTITY, CREDENTIAL, AND ACCESS MANAGEMENT (FICAM)

The Contractor shall ensure Commercial Off-The-Shelf (COTS) product(s), software configuration and customization, and/or new software are Personal Identity Verification (PIV) card-enabled by accepting HSPD-12 PIV credentials using VA Enterprise Technical Architecture (ETA), https://www.ea.oit.va.gov/EAOIT/VA_EA/Enterprise_Technical_Architecture.asp, and VA Identity and Access Management (IAM) approved enterprise design and integration patterns, https://www.oit.va.gov/library/recurring/edp/index.cfm. The Contractor shall ensure all Contractor delivered applications and systems comply with the VA Identity, Credential, and Access Management policies and guidelines set forth in VA Handbook 6510 VA Identity and Access Management, VA Handbook 0735 Homeland Security Presidential Directive 12 (HSPD-12) Program, and align with the Federal Identity, Credential, and Access Management Roadmap and Implementation Guidance v2.0.

The Contractor shall ensure all Contractor delivered applications and systems provide user authentication services compliant with the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-63-3, VA Handbook 6500 Appendix F, “VA System Security Controls”, and VA IAM enterprise requirements for direct, assertion based authentication, and/or trust based authentication, as determined by the design and integration patterns. Direct authentication at a minimum must include Public Key Infrastructure (PKI) based authentication supportive of PIV card and/or Common Access Card (CAC), as determined by the business need.

The Contractor shall ensure all Contractor delivered applications and systems conform to the specific Identity and Access Management PIV requirements set forth in the Office of Management and Budget (OMB) Memoranda M-05-24, M-19-17, and NIST Federal Information Processing Standard (FIPS) 201-2. OMB Memoranda M-05-24 and M-19-17 can be found at: https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2005/m05-24.pdf, and https://www.whitehouse.gov/wp-content/uploads/2019/05/M-19-17.pdf respectively. Contractor delivered applications and systems shall be on the FIPS 201-2 Approved Product List (APL). If the Contractor delivered application and system is not on the APL, the Contractor shall be responsible for taking the application and system through the FIPS 201 Evaluation Program.

The Contractor shall ensure all Contractor delivered applications and systems support:

1. Automated provisioning and are able to use enterprise provisioning service.

2. Interfacing with VA’s Master Person Index (MPI) to provision identity attributes, if the solution relies on VA user identities. MPI is the authoritative source for VA user identity data.

3. The VA defined unique identity (Secure Identifier [SEC ID] / Integrated Control Number [ICN]).

4. Multiple authenticators for a given identity and authenticators at every Authenticator Assurance Level (AAL) appropriate for the solution.

5. Identity proofing for each Identity Assurance Level (IAL) appropriate for the solution.

6. Federation for each Federation Assurance Level (FAL) appropriate for the solution, if applicable.

7. Two-factor authentication (2FA) through an applicable design pattern as outlined in VA Enterprise Design Patterns.

8. A Security Assertion Markup Language (SAML) implementation if the solution relies on assertion-based authentication. Additional assertion implementations, besides the required SAML assertion, may be provided as long as they are compliant with NIST SP 800-63-3 guidelines.

9. Authentication/account binding based on trusted Hypertext Transfer Protocol (HTTP) headers if the solution relies on Trust based authentication.

10. Role Based Access Control.

11. Auditing and reporting capabilities.

12. Compliance with VIEWS 00155984, PIV Logical Access Policy Clarification https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896.

The required Assurance Levels for this specific effort are Identity Assurance Level 3, Authenticator Assurance Level 3, and Federation Assurance Level 3.

INTERNET PROTOCOL VERSION 6 (IPV6)

The Contractor solution shall support Internet Protocol Version 6 (IPv6) based upon the memo issued by the Office of Management and Budget (OMB) on November 19, 2020 (https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-07.pdf). IPv6 technology, in accordance with the USGv6 Program (https://www.nist.gov/programs-projects/usgv6-program/usgv6-revision-1), NIST Special Publication (SP) 500-267B Revision 1 “USGv6 Profile” (https://doi.org/10.6028/NIST.SP.500-267Br1), and NIST SP 800-119 “Guidelines for the Secure Deployment of IPv6” (https://doi.org/10.6028/NIST.SP.800-119), compliance shall be included in all IT infrastructures, application designs, application development, operational systems and sub-systems, and their integration. In addition to the above requirements, all devices shall support native IPv6 and dual stack (IPv6 / IPv4) connectivity without additional memory or other resources being provided by the Government, so that they can function in a mixed environment. All public/external facing servers and services (e.g. web, email, DNS, ISP services, etc.) shall support native IPv6 and dual stack (IPv6 / IPv4) users and all internal infrastructure and applications shall communicate using native IPv6 and dual stack (IPv6 / IPv4) operations.

TRUSTED INTERNET CONNECTION (TIC)

The Contractor solution shall meet the requirements outlined in Office of Management and Budget Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative“ (https://www.whitehouse.gov/wp-content/uploads/2019/09/M-19-26.pdf), VA Directive 6513 “Secure External Connections”, and shall comply with the TIC 3.0 Core Guidance Documents, including all Volumes and TIC Use Cases, found at the Cybersecurity & Infrastructure Security Agency (CISA) (https://www.cisa.gov/publication/tic-30-core-guidance-documents). Any deviations must be approved by the VA TIC 3.0 Working Group at vaoisesatic30team@va.gov.

STANDARD COMPUTER CONFIGURATION

The Contractor IT end user solution that is developed for use on standard VA computers shall be compatible with and be supported on the…