P09 - Draft Modernized Messaging PWS 26 Nov 2024 CLEAN.docx

Modernized Messaging

<VA-25-XXXXXXXX>

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS (VA)

Office of Information & Technology (OIT) End User Services (EUS)

Modernized Messaging

Date: <date>

VA-25-XXXXXXXX>

PWS Version Number: 1.0

Contents

BACKGROUND

The VA Office of Information and Technology (OIT), End User Services (EUS), strives to provide high quality, effective, and efficient Information Technology (IT) services to those responsible for providing care to the Veterans at the point-of-care as well as throughout all the points of the Veterans’ health care in an effective, timely and compassionate manner. VA depends on Information Management/Information Technology (IM/IT) systems to meet mission goals.

OIT EUS is leading the effort to modernize alpha-numeric and numeric text messaging communication technology from mobile physical pagers, that utilize a combination of satellite and terrestrial radio networks, to a non-physical pager, non-life safety packet switching and Transmission Control Protocol (TCP)/Internet Protocol (IP) protocols mobile device software application text messaging communication solution architecture. The solution’s mission critical principal strategic requirement shall be secure, encrypted, and Health Insurance Portability and Accountability Act (HIPAA)-compliant text messages. Additionally, bedrock privacy, security, and performance characteristics of the solution shall include:

· Security and privacy of Veteran data and information is built into the solution

· Veteran Protected Health Information (PHI), Personally Identifiable Information (PII), Sensitive Personal Information (SPI) are protected (No unauthorized access and use)

· Text messaging transmission is security enabled (All text messages encrypted)

· No government data or information exists on device (No VA information or data exists, stored, or saved on device)

· 100% separation of government/corporate and personal device data and information (Preserves end-user privacy)

· 100% privacy of personal data (Reduces security risks with no data at rest and no data in transit)

The specific salient characteristics of the software/application-based requirements are as follows:

1. Ensure the proposed messaging solution is designed to protect the confidentiality and integrity of all electronic Protected Health Information (PHI), Personally Identifiable information (PII), Sensitive Personal Information (SPI), and VA sensitive information, created, transmitted, received, and maintained/stored as alpha-numeric text messages.

2. Enable the full capability and functionality of the solution with Government Furnished Equipment (GFE) smartphones and user Bring Your Own Device (BYOD) non-GFE smartphones.

3. All messages must be encrypted according the Federal and Agency standards for all data at rest and in transmission to include compliance with Federal Information Security Management Act (FISMA) and Federal Information Processing Standards (FIPS).

4. Ensure no VA data, of any nature, is stored on the device.

5. This VA request will not include Life Safety-based messaging thus no capability for Life Safety messaging (Code Blue and other critical Life Safety team notifications) is required as a component of the solution.

APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. 44 U.S.C. § 3541-3549, “Federal Information Security Management Act (FISMA) of 2002”

2. “Federal Information Security Modernization Act of 2014”

3. Federal Information Processing Standards (FIPS) Publication 140-2, “Security Requirements for Cryptographic Modules”

4. FIPS Pub 199. “Standards for Security Categorization of Federal Information and Information Systems,” February 2004

5. FIPS Pub 200, “Minimum Security Requirements for Federal Information and Information Systems,” March 2006

6. FIPS Pub 201-2, “Personal Identity Verification of Federal Employees and Contractors,” August 2013

7. 10 U.S.C. § 2224, "Defense Information Assurance Program"

8. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

9. Public Law 109-461, Veterans Benefits, Health Care, and Information Technology Act of 2006, Title IX, Information Security Matters

10. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”

11. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, https://www.va.gov/vapubs/index.cfm

12. VA Handbook 0710, “Personnel Security and Suitability Program,” May 2, 2016, https://www.va.gov/vapubs/index.cfm

13. VA Directive and Handbook 6102, “Internet/Intranet Services,” August 5, 2019

14. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and Guidelines,” January 18, 2017

15. Office of Management and Budget (OMB) Circular A-130, “Managing Federal Information as a Strategic Resource,” July 28, 2016

16. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed Services (CHAMPUS)”

17. NIST SP 800-66 Rev. 1, “An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule,” October 2008

18. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended, January 18, 2017

19. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

20. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021

21. VA Handbook 6500, “Risk Management Framework for VA Information Systems VA Information Security Program,” February 24, 2021

22. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI),” March 12, 2019

23. VA Handbook 6500.5, “Incorporating Security and Privacy into the System Development Lifecycle,” March 22, 2010

24. VA Handbook 6500.6, “Contract Security,” March 12, 2010

25. VA Handbook 6500.8, “Information System Contingency Planning,” April 6, 2011

26. VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018

27. VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017

28. OIT Process Asset Library (PAL), https://www.va.gov/process/ . Reference Process Maps at https://www.va.gov/process/maps.asp and Artifact templates at https://www.va.gov/process/artifacts.asp

29. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

30. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014

31. VA Handbook 6508.1, “Procedures for Privacy Threshold Analysis and Privacy Impact Assessment,” July 30, 2015

32. VA Handbook 6510, “VA Identity and Access Management,” January 15, 2016

33. VA Directive and Handbook 6513, “Secure External Connections,” October 12, 2017

34. VA Directive 6300, “Records and Information Management,” September 21, 2018

35. VA Handbook, 6300.1, “Records Management Procedures,“ March 24, 2010

36. NIST SP 800-37 Rev 2, “Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy,” December 2018

37. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020)

38. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015

39. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” March 24, 2014

40. OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005

41. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019

42. OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008

43. Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance, December 2, 2011, (NOTE: Part A of the FICAM Roadmap and Implementation Guidance, v2.0, was replaced in 2015 with an updated Architecture (https://arch.idmanagement.gov/#what-is-the-ficam-architecture)

44. NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access,“ June 2018

45. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, “Digital Identity Guidelines,” updated March 02, 2020

46. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014

47. NIST SP 800-164, “Guidelines on Hardware-Rooted Security in Mobile Devices (Draft),” October 2012

48. Draft National Institute of Standards and Technology Interagency Report (NISTIR) 7981, “Mobile, PIV, and Authentication,” March 2014

49. VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

50. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

51. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

52. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

53. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019

54. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008

55. OMB M-06-16 “Protection of Sensitive Agency Information,”

56. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (Public Law 110–140), December 19, 2007

57. Section 104 of the Energy Policy Act of 2005, (Public Law 109–58), August 8, 2005

58. Executive Order 13834, “Efficient Federal Operations,” dated May 17, 2018

59. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 2, 2001

60. VA Directive 0058, “VA Green Purchasing Program,” July 19, 2013

61. VA Handbook 0058, “VA Green Purchasing Program,” July 19, 2013

62. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

63. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

64. “Veteran Focused Integration Process (VIP) Guide 4.0,” January 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

65. VA Memorandum “Proper Use of Email and Other Messaging Services,” January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

66. “DevSecOps Product Line Management Playbook” version 2.0, May 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

67. NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020

68. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol Version 6 (IPv6),” November 19, 2020

69. Social Security Number (SSN) Fraud Prevention Act of 2017

70. Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23, 2018

71. Committee on National Security Systems Instruction No. 1253 (CNSSI 1253)

72. Health Information Technology for Economic and Clinical Health (HITECH) Act

73. National Institute of Standards and Technologies (NIST) Cybersecurity Framework (CSF) - Core Identify Function

74. NIST SP 800-18, Guide for Developing Security Plans for Federal Information Systems

75. NIST SP 800-60 Volume 1 Revision 1: Guide for Mapping Types of Information and Information Systems to Security Categories (The SP 800-60 information types and security impact levels are based on the OMB Federal Enterprise Architecture Program Management Office’s October 2007 FEA Consolidated Reference Model Document, Version 2.3 inputs from participants in NIST SP 800-60 workshops, and FIPS 199).

76. NIST SP 800-60 Volume 2 Revision 1: Guide for Mapping Types of Information and Information Systems to Security Categories: Appendices

77. The Privacy Act of 1974

78. VA Directive 0900, VA Enterprise Data Management (VADM)

79. VA Handbook 6517, Risk Management Framework for Cloud Computing Services NIST Special Publication (SP) 800-60 may be used by organizations in conjunction with a family of security-related publications including: NIST SP 800-30, Risk Management Guide for Information Technology Systems.

NIST Draft SP 800-39, Managing Risk from Information Systems: An Organizational Perspective.

NIST SP 800-59, Guideline for Identifying an Information System as a National Security System.

80. NIST SP 800-145: The NIST Definition of Cloud Computing

81. NIST SP 800-122 “Guide to Protecting the Confidentiality of Personally Identifiable Information (PII),”

82. NIST SP 800-171 “Protecting Controlled Unclassified Information in the Nonfederal Information Systems and Organizations,”

83. NIST SP 500-322 Evaluation of Cloud Computing Services based on NIST SP 800-145

84. VA Directive 6517, Cloud Computing Services

85. VA Directive 6066, Protected Health Information (PHI) and Business Associate Agreements Management

SCOPE OF WORK

The Contractor shall provide a non-physical pager, non-life safety text messaging software application solution that delivers Federal Risk and Authorization Management Program (FedRAMP) HIGH secure, and encrypted alpha, numeric and graphic communications. The Contractor shall either demonstrate/document current FedRAMP HIGH Authorization or document FedRAMP In-Process designation provided to Cloud Service Providers (CSPs) actively working towards a FedRAMP HIGH Authorization. Additionally, the CSP offering the mobile application solution shall be responsible for management of the application, safeguarding of data stored or processed by the application, and all elements of the underlying infrastructure. The mobile messaging software application vendor shall be responsible to demonstrate/document current Federal Information Processing Standards (FIPS)-199 Security Characterization HIGH.

The Contractor shall describe their Modernized Messaging solution’s transition, deployment, implementation, operations, maintenance, and sustainment (OMS) plan with notional schedule portrayed across the enterprise.

PERFORMANCE DETAILS

PERFORMANCE PERIOD

The PoP shall be 12 months from date of award, with two 12-month option period(s). The overall Period of Performance shall not exceed 36 months.

Any work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO).

There are eleven (11) Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, five are set by date:

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

PLACE OF PERFORMANCE

Tasks under this PWS shall be performed in VA facilities located in VA Medical Centers (VAMCs), Community Based Outpatient Clinics (CBOCs), field and program offices and other remote users that are geographically dispersed throughout the United States (US), Guam, Saipan, American Samoa, Philippines, and Puerto Rico. Work may be performed at remote locations with prior concurrence from the Contracting Officer’s Representative (COR).

Tasks under this PWS shall be performed at Contractor and Government facilities. The Contractor shall identify the Contractor’s place of performance in their proposal submission.

TRAVEL

The Government anticipates travel under this effort to perform the tasks associated with the effort, as well as to attend program-related meetings or conferences throughout the PoP. Include all estimated travel costs in your firm-fixed price line items. These costs will not be directly reimbursed by the Government.

The total estimated number of trips in support of the program related meetings for this effort is 2 per year. Anticipated locations include the following, estimated at 1-2 days in duration:

1. TBD

Travel shall be in accordance with the Federal Travel Regulations (FTR) and requires advanced concurrence by the COR. Contractor travel within the local commuting area will not be reimbursed.

SPECIFIC TASKS AND DELIVERABLES

The Contractor shall provide a non-physical pager, non-life safety messaging software application solution which shall not store or save any Government data on Government Furnished Equipment (GFE) mobile smartphone devices or Bring Your Own Device (BYOD) mobile smartphone. The Contractor shall be responsible for the management of network, servers, operating systems, storage, and application capabilities infrastructures, apart from limited Government user-specific applications configuration settings. The messaging software application solution shall have on-demand self-service, broad network access, resource pooling, handle varying workloads, scalable resource that shall be able to add computing power, storage, or network capacity. The messaging software application solution shall be hosted within the continental United States (CONUS) to include data storing and transmission exclusively in CONUS. The Contractor shall complete the process to obtain a VA Authority to Operate (ATO) and maintain the ATO throughout the life of the contract. The Contractor shall provide the plan of approach and project management plan that will deliver the solution.

The Contractor shall provide all required hardware, software, and licensing for the operations, sustainment, and maintenance (OMS) of the solution.

PROJECT MANAGEMENT

The Contractor shall provide program management to accomplish the administrative, managerial, logistical, technical, quality assurance/quality improvement, reporting, and security requirements as described in this PWS. The Contractor shall identify an individual as the primary Point of Contact (POC) for all project matters. Intellectual property owned by the VA shall be provided to the Contractor in an electronic format and transmitted by a secure communication methodology for use under this PWS.

PROJECT KICKOFF MEETING

A kickoff meeting shall be held virtually within seven calendar days after receipt of order. The Contractor shall coordinate the date and time of the virtual meeting with the Contracting Officer (CO), the VA PM, the Contract Specialist (CS), the COR, the Delivery Date Coordinator, the Implementation Manager and/or VA-designee. The Contractor shall provide a draft agenda to the CO and VA PM at least three calendar days prior to the meeting. Upon Government approval of a final agenda, the Contractor shall distribute to all meeting attendees. During the kickoff-meeting, the Contractor shall present, for review and approval by the Government, the details of the intended approach, work plan, and project schedule for each effort via a Microsoft Office PowerPoint presentation. This shall include a plan to discuss delivery schedule requirements. At the conclusion of the meeting, the Contractor shall update the presentation with a final slide entitled “Summary Report” which shall include notes on any major issues, agreements, or disagreements discussed during the kickoff meeting. The Contractor shall submit the final updated presentation to the CO for review within three calendar days after the meeting. The Contractor shall also work with the CS, the Government’s designated note taker, to prepare and distribute the meeting minutes of the kickoff meeting to the CO, COR, and all attendees within three calendar days after the meeting. The Contractor shall obtain concurrence from the CS on the content of the meeting minutes prior to distribution of the document.

For option periods, a kick-off meeting is only needed if requested by the VA PM.

Deliverables:

A. Project Kickoff Meeting Agenda B. Project Kickoff Meeting Minutes

GO-LIVE TASKS

The Contractor shall provide the following activities to achieve readiness for go-live and beyond:

· Develop and provide introductory and ongoing Go-Live communications, Bulletins, Notices as applicable.

· Prepare (author), update, provide, publish, and revise Knowledge Documents / yourIT Knowledge Base, your IT Service Portal, yourIT Technical Services Catalogue; end-user application provisioning and installation instructions; Instructions; How-tos; frequently asked questions; end-user guides.

· Include details about transitioning/migrating to solution, provisioning, initial setup and installation, user training and instruction, end user technical support, and post-implementation operations, maintenance and sustainment (OMS).

· Document, coordinate, and resolve Troubleshooting, Incident, and Problem Ticket Reporting and Escalation

· Coordinate mobile applications VA compliance approval (Privacy, Security, Section 508, security updates, operating system updates, application version updates, etc)

· Provide checklist or guidance for Day 1 readiness (Technical Checklist & Other Checklists necessary for go-live).

· Identify and track the count down of activities and milestones to provide leadership with assessment of Day 1 Production Go-Live readiness and beyond

· Scale up Contractor operations and activities to achieve Go-Live implementation, operations, maintenance and sustainment (OMS) at more that one facility at the same time across the enterprise

· The Contractor shall lead ongoing operations and maintenance (O&M) and sustainment (OMS) activities to achieve facility’s readiness for go-live and beyond.

CONTRACTOR PROJECT MANAGEMENT PLAN (CPMP)

The Contractor shall develop, maintain, and execute an implementation Plan, that defines the implementation approach, processes, and activities (prior to, during, and after), test strategy, setup, and configuration procedure, inventory of IT assets, implementation checklist, risk assessment, key dependencies, and schedule. The Contractor shall recommend the compatible Software as a Service (SaaS) Cloud Service Provider (CSP). . The Contractor shall develop and execute a Transition Plan, as part of the Implementation Plan, that defines the approach, and actions plans to prepare VA stakeholders to receive and operate the solution. This includes improving end user experience engagement, outreach, and communications. The Contractor shall develop and update the project’s VIP guide Deployment and Installation, Back-out, and Rollback Plan that describes the installation, back-out, and rollback approach, processes and activities, dependencies, and schedule. The plan shall also include the provisioning and installation procedures for VA resources. The CPMP shall determine cloud capacity and workload requirements. VA will review and approve cloud capacity requirements. The CPMP shall take the form of both a narrative and graphic format that displays the schedule, milestones, risks, and resource support. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc maintenance. The initial baseline CPMP shall be concurred upon and updated in accordance with Section B of the contract. The Contractor shall update and maintain the VA PM approved CPMP throughout the PoP.

Deliverable:

A. Contractor Project Management Plan B. Contractor Implementation Plan

REPORTING REQUIREMENTS

The Contractor shall provide the COR with Weekly Progress Reports in electronic form in Microsoft Word and Project formats. The report shall include detailed instructions/explanations for each required data element, to ensure that data is accurate and consistent. These reports shall reflect data as of the last day of the preceding Week.

The Weekly Progress Reports shall cover all work completed during the reporting period and work planned for the subsequent reporting period. The report shall also identify any problems that arose and a description of how the problems were resolved. If problems have not been completely resolved, the Contractor shall provide an explanation including their plan and timeframe for resolving the issue. The report shall also include an itemized list of all Information and Communication Technology (ICT) deliverables and their current Section 508 conformance status. The Contractor shall monitor performance against the CPMP and report any deviations. It is expected that the Contractor will keep in communication with VA accordingly so that issues that arise are transparent to both parties to prevent escalation of outstanding issues.

Deliverable:

A. Weekly Progress Report

MAINTENANCE OF AUTHORITY TO OPERATE (ATO)

After Authority to Operate (ATO) is achieved, the Contractor shall update and maintain the VA Assessment and Authorization (A&A) documentation as required to ensure continued compliance. The Contractor shall monitor, track, and respond to Plan of Action and Milestones (POAM). The Contractor shall provide input to update the ATO, as needed. The Contractor shall provide information and documentation to support operational and production readiness reviews and go-no-go decisions. The Contractor shall execute corrective actions to address gaps and provide all required data, to include preparing supporting documents and artifacts for the reviews.

Authority to Operate (ATO) The Contractor shall develop necessary artifacts to obtain a VA authority to operate (ATO) for the solution (both cloud service provider SaaS platform and mobile text messaging software application) and complete VA Assessment and Authorization (A&A) process. All deliverables shall be provided within one year of award.

The Contractor shall:

a. Comply with VA ATO process.

b. Use VA FISMA control tracking system as the security documentation repository to complete and update security controls.

c. Coordinate with the VA Security Office and adhere to its policies.

d. Create, as directed, a wide variety of NIST SP800-Series security artifacts per FISMA High requirements for VA systems.

e. Enter data into the VA security documentation repository, which is currently known as Enterprise Mission Assurance Support Service (EMASS).

f. Manually review upcoming due dates for security artifacts and work with system maintainers or appropriate representatives to ensure artifacts are updated annually.

g. Support and develop annual attestation documentation in conjunction with the system maintainer and business owner.

h. Provide peer review security artifacts and provide feedback to document authors.

i. Provide, on demand, security documentation reporting to Program Managers (PMs), Information Security Officers (ISO), and others.

Deliverable:

a. ATO Package Document

MESSAGING SOFTWARE APPLICATION SOLUTION

The Contractor shall provide 20,000 licenses of a SaaS solution that has the most current software release with all the patches applied or specified at the time of installation. The Contractor shall provision all required hardware, software, and ancillary products for solution. The solution shall replicate the non-life safety features and functions of the current VA legacy 2-way pagers using Wireless Communications Transfer Protocol (WCTP). The solution shall function on both GFE mobile devices and non-GFE owned mobile bring your own device (BYOD) that are approved as compliant by VA. The solution shall on demand be able to have Government message data wiped remotely by a VA Administrator. The solution shall provide a web-based portal for administration activities such as activating and deactivating users, and performance report generation that provide GFE user list, BYOD users, usage capacity, help desk activities, and service capacity by type and user profile identifiers. The Contractor provided software application messaging solution shall integrate fully with the capability and functionality of GFE and non-GFE smartphones cellular communication devices. Similarly, the Contractor provided software application messaging solution shall seamlessly transition VA legacy pagers/beepers into a modernized messaging mobile platform, that is designed for simple operation by non-technical users, while enhancing VA mobile messaging communication for the end user.

The BYOD functionality of the solution software shall be a secure architecture. Likewise, the BYOD devices shall be provisioned with downloaded application that all communications and application data can be sanitized remotely if the device is lost, stolen, upgraded and or no longer in possession by the approved non-GFE BYOD user.

Deliverables:

A. Web-based Portal Interface Login Credentials B. VA Legacy Pagers/Beepers to a modernized messaging mobile Transition Plan

MESSAGING SOFTWARE APPLICATION PRIVACY AND SECURITY

The Contractor shall provide a messaging software application that protects the confidentiality and integrity of all electronic Protected Health Information (PHI), Personally Identifiable information (PII), Sensitive Personal Information (SPI), VA sensitive information, created, transmitted, received, and maintained/stored as alpha-numeric text messages. The Contractor provided software application messaging solution shall encrypt all transmissions according to Federal and Agency standards for all data at rest and in transmission to include compliance with Federal Information Security Management Act (FISMA) and Federal Information Processing Standards (FIPS). For all solutions, the highest water mark FIPS Data Security Characterization attributable to VA’s Personal Identifiable Information (PII), Personal Health Information (PHI), and VA Sensitive Patient Information (SPI) is HIGH. The Contractor shall demonstrate the solution incorporates a documented Data Security Characterization HIGH.

The Contractor provided mobile software application messaging solution shall prevent VA data, of any nature, from being stored on the device. Additionally, the software application messaging solution shall petition on non-GFE BYOD the separation of 100% of all Government data and non-GFE BYOD data. Likewise, the software application messaging solution shall ensure 100% privacy of non-GFE BYOD data. Similarly, the Contractor provided software application messaging solution shall seamlessly transitioning VA legacy pagers/beepers into a modernized platform, that ensures data is protected from unauthorized use. Additionally, the software application messaging solution shall be capable of audit trails that journal and capture user activities with Government data. The Contractor shall provide a solution that supports transmitting text, images, pictures, and documents that protects Personally identifiable information (PII), Protected Health Information (PHI), and Sensitive Personal Information (SPI). The solution shall encrypt all text messages. The solution shall not store any Government data or information on either GFE devices or BYOD devices. The solution shall keep 100% of Government and non-Government BYOD device data separated. The solution shall prevent the Government from having access to the BYOD personal data and applications. The solution shall have device screen display personalized passcode login authentication.

MESSAGING SOFTWARE APPLICATION FUNCTIONALITY

The Contractor shall provide a solution that functionality is end-user centric with intuitive and straight forward navigation with minimal end-user effort. The solution loading content shall respond between 1 to 10 seconds without user long loading time and lag that significantly detract from the user experience. The solution shall have the functionality that sends messages to an individual and or a group. Similarly, the solution shall have the capability and functionality to track and confirm the status of messages by acknowledging received and read. Likewise, the solution shall have the capability and functionality to create and define groups, create role base profiles, role base login designations, role base hierarchy, and role base availability customization parameters, for the transmission of messages. The vendor shall describe in detail the end-users enrollment/registration/login for the secure, encrypted, HIPAA-compliant use of the modernized messaging application as well as the enrollment/registration/login of GFE and BYOD smartphone devices. The SaaS solution shall provide the capability and functionality to administratively have messages escalation cascades rules, for individuals, roles, and groups, that set processing timings and workflows of messages based on the tag levels of priority, urgent and standard. The solution shall provide the capability and functionality for rapid real-time end-user message recipient modification on demand. The solution shall provide the capability and functionality to override device settings for priority and urgent message tag levels and deliver message on the devices as soon as they are received by the solution. The solution shall provide the functionality for free text space for messages greater than 240 characters. The solution shall provide Hotlinking functionality, that is capable of embedding phone numbers in a message for initiating a call from the mobile device.

MESSAGING SOFTWARE APLICATION NOTIFICATIONS AND ALERTS

The Contractor shall provide a solution that has customizable notifications and alerts functionality. Similarly, the solution shall have the capability and functionality to reply, and receive secure HIPAA compliant peer to peer texting, and document transmissions. The solution shall provide a confirmation that messages are delivered, read, and received.

MESSAGE SOFTWARE APPLICATION SOLUTION TRAINING

The Contractor shall provide multiple modes of delivery pre-deployment readiness for all end-user and support personnel training, that provides an overview of the benefits and purpose of the solution, that is tailored to an audience with diverse technical skill levels. The modes of delivery shall be self-paced online modules. Furthermore, the training shall discuss the security features of the solution and the best practices for maintain data privacy and data security assurances. Similarly, the training shall provide interactive step by step instructions, hands-on exercises on how to install and set up the application on both GFE devices and non-GFE BYOD devices that give the end-users opportunities to practice and reinforce their learnings. Likewise, the training shall instruct users and support personnel on the user interface capabilities with any dashboard, application menus, toolbars, any needed initial configurations, and any other elements such as frequently asked questions knowledge repositories. Also, the training shall cover the main functions and features of the application, while explaining how to use them by utilizing use case demonstrations. Additionally, the training shall cover any advanced features that may not be frequently used but provide significant value to the user experience. The training shall provide end-user and support personnel on how to utilize any customization capability of the solution to fit diverse workflows. In addition, the training shall cover any functions of the solution that can be integrated with non-life safety healthcare IT systems and how to set up and manage those integrations. The training shall cover troubleshooting solutions of common problems and issues for both user and support personnel. Moreover, the Contractor shall provide self-paced on-demand online modules post deployment training for end-user and support personnel that covers all training areas.

Deliverables:

A. Message Software Application Training Plan

MESSAGING SOFTWARE APPLICATION FUNCTIONAL PERFORMANCE

The Contractor shall provide a messaging software application that meet the following specified standard set of key performance indicators (KPIs) that the Government will use to evaluate and measure the solutions effectiveness:

a. CONUS Wi-Fi Offloading and Handoff Availability (Service) (Av(S)) 99.95%

b. Time to Restore (TTR) 4 hours,

c. Response Time (Messaging) (RT) 100 milliseconds

The Contractor SaaS shall provide secure, reliable transport of agency business critical non-life saving messaging transactions. The solution shall provide isolation of messaging to only authenticated users. The solution shall provide enhanced class internet protocol service for critical non-life safety messaging traffic. The SaaS solution shall provide the ability to select and provision services as needed; provide broad network access to mobile devices; be location independent for users throughout the Government’s enterprise; the ability to rapidly scale up or down based on user peak and off-peak demands. The solution shall be responsive with instantaneous interactions from button pressing and toggle settings.

MESSAGING SOFTWARE APPLICATION CAPABILITIES AND EFFECTIVENESS

The Contractor shall provide a capabilities and effectiveness report of the Messaging Software Application solution using an appropriate diagram. For example, a Flowchart, a Swimlane, a business process model and notation, or Gantt chart that visually provides tangible demonstrations of accomplishing the following use cases:

Use Case A Send a message to a peer (Escalation and Role-Based one-to-one relationship). Examples include:

• Role Based Communication, such as “Cardiology Fellow” or “Critical Care Attending”

• Trainee clinician (physician, PA or NP) to reach my supervising clinician (Physician, PA or NP) to provide updates and ask questions about patients' care.

• Bedside nurse to reach clinicians to ask routine order clarification questions.

• Bedside nurse to summon a practitioner or security to the bedside.

• Bedside nurse to reach pharmacist for assistance with medication questions.

Use Case B Send a message to a group (Escalation and Role-Based one-to-many relationship). Examples include:

• Bedside nurse to request or summon other support professionals to the bedside (respiratory therapy, facility maintenance for electrical/plumbing, radiology tech, biomedical engineering, etc).

• Operating room nurse or surgical technician to reach sterile processing or supply technicians for missing instruments or unexpected needs during a surgical case.

• Operating room circulating nurse to summon clinicians or groups to the operating room based on verbal requests of the surgeons & anesthesiologists.

Use Case C Contact a peer or group (Escalation and Role-Based) when I don't have a name of the person or group I need to contact/reach. Examples include:

• Directory function with messaging application – needs to have a strong search function to help nurses find providers

• Lab technician, pathologist, or radiologist communicate urgent results to the clinicians who is/are responsible for the patient during off-hours.

• Allied health professional to reach the nurse taking care of a patient to provide information or ask questions regarding a patient.

• Practitioner to reach other practitioners from different specialties to consult/ask for clinical advice.

• Nurse working in the call center need to provide a warm hand-off to a practitioner with details about a patient that has been advised to walk-in to their clinic or emergent department by reaching clinicians across multiple VAMCs and sometimes in other VISNs.

Use Case D Encounter inability to find on-call peers or groups (Escalation and Role-Based) due to outdated or missing on-call schedules. Potential solution discussion: Staff join (and leave) specific roles and are messaged based on their roles (of which they can have more than 1 simultaneously). For example, When Dr. Smith comes to work, she can manually join a role (such a “medicine admitting provider”). Then, when it’s time for someone to find whomever the doctor is that is admitting patients, there is no need to find a schedule or page a specific person, but instead they will always know to page “medicine admitting provider.

Use Case E Surrogate or Coverage – Need to be able to assign to someone else if someone is on leave or suddenly unable to cover calls.

Use Case F Encryption – Allow Bring Your Own Device (BYOD) – not practical or desirable to have a system that requires a separate physical pager or phone. Don’t display personal phone number. System must be more reliable than cell phones – cover dead zones. Uses both Wi-Fi and cellular.

Use Case G Any clinical staff in a Medical Center needs to be able to reach out to other clinicians based on the following:

• name,

• role that they're fulfilling,

• team (or group) in which to coordinate, and that's usually in an emergency setting.

Deliverables:

A. Capabilities and Effectiveness Report

MESSAGING SOFTWARE SaaS Cloud infrastructure The Contractor shall provide a messaging software application capability that operates on software as a service cloud infrastructure, which is accessible from a diverse type of mobile operating systems (i.e. Android, iPhone Operating System (iOS)). The message software solution shall provide the functionality to adapt features and functionality on demand as the needs of the VA non-left saving alpha, numeric and image communication message traffic changes. The Contractor shall control the solution’s underlying cloud infrastructure management. The SaaS solution shall have a mechanized resource scaling capability for provisioning and decommissioning of application capabilities and use capacity tiers. Additionally, the Contractor shall manage the operation, delivery, integration, sustainment, and maintenance of the SaaS solution. The SaaS solution shall provide tools via the internet to allow the VA to fully access SaaS related data in usable formats for account information management that administers user activities, such as enrollment, assignment, activate, swap, and de-commissioning. Additionally, the portal shall provide the functionality to execute reports that provide user types and profiles (i.e., GFE, BYOD), summary of trouble tickets activities, and account billing details.

MESSAGING solution OPERATionS, MAINTeNance, and sustainment (Oms) The Contractor shall provide all the technical support for the solutions hardware and software necessary for the messaging solution features and functions to operate 24 hours a day, seven days a week three hundred and sixty-five days a year (24/7/365). The Contractor shall provide a toll-free number that is available 24/7/365 for technical support. The Contractor shall coordinate mobile applications VA compliance approval (Privacy, Security, Section 508, security updates, operating system updates, application version updates, etc).

· Service Availability: All deployed services shall be available and functional to serve user requests at no less than 99.95% availability. Services that are faulted due to an external entity shall have trouble tickets logged with the responsible party, with all outage time attributable to this team until the ticket is logged with the responsible entity. An Application Monitoring Plan, with an execution frequency of no more than 300 seconds. Any faulted services attributed to an external entity shall include a record of the trouble ticket that was issued to the responsible party. This record shall include the time that it was filed, and if resolved, the time of resolution. Any maintenance window outages due to upstream or downstream maintenance shall include a record of the notification that was distributed to VA Stakeholders, and the time which the record was distributed.

· Service Reachability: Services on this platform shall be reachable by internal and external entities no less than 99.95% of the time. All required routing and proxying services are correctly functioning and forwarding traffic. Services that are faulted due to an external entity shall have trouble tickets logged with the responsible party, with all outage time attributable to this team until the ticket is logged with the responsible entity. Services that are unavailable due to upstream maintenance must have an outage notification to all VA stakeholders prior to the maintenance window. The Contractor shall coordinate all maintenance windows times and dates with the CO, COR and PM. An Application Monitoring Plan, that includes time that the incident was reported and resolved.

The Contractor shall operate and maintain the solution in accordance with the following application service level agreements.

a. Service Availability expected up time of 99.95% excluded Government approved pre-scheduled maintenance windows.

b. Acceptable Quality Level (AQL) performance metrics expected response times for time to restore threshold is 4 hours.

c. Redundancy and Performance capability shall provide continuity of operations during any SaaS operation service availability and acceptable quality failures.

d. Data Management and analysis capability shall complement and extend log management that the VA retains exclusive ownership over all its data in the SaaS. Likewise, capability shall include data protection, backup, and recovery procedures in the event of data loss.

e. Support Services that provide VA specific help desk request and resolutions via email and telephone to users.

f. Compliance with all relevant Federal regulations, Federal standards, and agency specific directives.

g. Escalation Procedures that provide a tiered matrix for support beyond normal channels if necessary.

Deliverables:

A. Application Monitoring Plan

OPTION PERIODS (IF EXERCISED) OPTIONS TO EXTEND THE TERM OF THE CONTRACT

This requirement may be exercised annually, no more than two 12-month option periods. If exercised by VA, the Contractor shall provide Program Management IAW paragraph 5.1 and all subtasks, Messaging Solution Operation, Maintenance, and Sustainment IAW paragraph 5.5, during each option period.

OPTIONAL TASK One: ADDITIONAL SaaS LICENSE (IF EXERCISED) The Contractor shall provide SaaS licenses and support for up to 100,000 licenses for up to 12 months in the Base Period and Option Periods One through Two. This optional task may be exercised during the base period and/or any of the two option periods. Requirements in paragraphs 5.1, 5.5, and 5.6 apply. Licenses purchased under this optional task shall be co-termed to the end of the Base Period or any option period in which Optional Task One is exercised.

GENERAL REQUIREMENTS

ENTERPRISE AND IT FRAMEWORK

VA TECHNICAL REFERENCE MODEL

The Contractor shall support the VA enterprise management framework. In association with the framework, the Contractor shall comply with OIT Technical Reference Model (VA TRM). The VA TRM is one component within the overall Enterprise Architecture (EA) that establishes a common vocabulary and structure for describing the information technology used to develop, operate, and maintain enterprise applications. Moreover, the VA TRM, which includes the Standards Profile and Product List, serves as a technology roadmap and tool for supporting OIT. Architecture & Engineering Services (AES) has overall responsibility for the VA TRM.

FEDERAL IDENTITY, CREDENTIAL, AND ACCESS MANAGEMENT (FICAM)

The Contractor shall ensure Commercial Off-The-Shelf (COTS) product(s), software configuration and customization, and/or new software are Personal Identity Verification (PIV) card-enabled by accepting HSPD-12 PIV credentials using VA Enterprise Technical Architecture (ETA), https://www.ea.oit.va.gov/EAOIT/VA_EA/Enterprise_Technical_Architecture.asp, and VA Identity and Access Management (IAM) approved enterprise design and integration patterns, https://www.oit.va.gov/library/recurring/edp/index.cfm.