P09 - Draft PWS at RFI - CRM.docx

Cancer Registry Modernization

VA-24-00020603

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Office of Information & Technology Software Product Management Population Health

Cancer Registry Modernization (CRM)

Date: 3/8/2024

VA-24-00020603

PWS Version Number: 1.3

Contents

BACKGROUND

The Department of Veterans Affairs (VA), Office of Information & Technology (OIT), Software Product Management, Population Health strives to provide high quality, effective, and efficient Information Technology (IT) services to those responsible for providing care to Veterans throughout all points of VA’s Veterans health care system in an effective, timely and compassionate manner. VA depends on Information Management/Information Technology (IM/IT) systems to meet mission goals.

The current VA Central Cancer Registry (VACCR) System uses VistA – OncoTraX to provide care to Veterans through all points of VA’s Veterans health care systems. VACCR receives and stores information compiled by local cancer registry staff from each of the 132 separate Veterans Health Information Systems and Technology Architecture (VistA) instances. The information is obtained from a wide variety of medical record documents at the local medical center pertaining to each veteran cancer patient. Details collected include extensive demographics, cancer identification, extent of disease and staging, first course of treatment, and outcomes. OncoTraX has not been able to keep up with the increasing requirements for complex oncology standards and the Commission on Cancer standard for accredited cancer programs. OncoTraX is not compliant with current technological requirements set by other national cancer registry standards organizations such as the North American Association of Central Cancer Registries, the American College of Surgeons' Commission on Cancer, and the American Joint Commission on Cancer, among others.

APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

44 U.S.C. § 3541-3549, “FEDERAL INFORMATION SECURITY MANAGEMENT ACT (FISMA) OF 2002” “Federal Information Security Modernization Act of 2014” Federal Information Processing Standards (FIPS) Publication 140-2, “Security Requirements for Cryptographic Modules” FIPS Pub 199. “Standards for Security Categorization of Federal Information and Information Systems,” February 2004 FIPS Pub 200, “Minimum Security Requirements for Federal Information and Information Systems,” March 2006 FIPS Pub 201-2, “Personal Identity Verification of Federal Employees and Contractors,” August 2013 10 U.S.C. § 2224, "Defense Information Assurance Program" 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974” Public Law 109-461, Veterans Benefits, Health Care, and Information Technology Act of 2006, Title IX, Information Security Matters 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964” VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, https://www.va.gov/vapubs/index.cfm VA Handbook 0710, “Personnel Security and Suitability Program,” May 2, 2016, https://www.va.gov/vapubs/index.cfm VA Directive and Handbook 6102, “Internet/Intranet Services,” August 5, 2019 36 C.F.R. Part 1194 “Information and Communication Technology Standards and Guidelines,” January 18, 2017 Office of Management and Budget (OMB) Circular A-130, “Managing Federal Information as a Strategic Resource,” July 28, 2016 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed Services (CHAMPUS)” NIST SP 800-66 Rev. 1, “An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule,” October 2008 Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended, January 18, 2017 Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004 VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021 VA Handbook 6500, “Risk Management Framework for VA Information Systems VA Information Security Program,” February 24, 2021

VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI),” March 12, 2019 VA Handbook 6500.5, “Incorporating Security and Privacy into the System Development Lifecycle,” March 22, 2010 VA Handbook 6500.6, “Contract Security,” March 12, 2010 VA Handbook 6500.8, “Information System Contingency Planning,” April 6, 2011 VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018 VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017 OIT Process Asset Library (PAL), https://www.va.gov/process/ . Reference Process Maps at https://www.va.gov/process/maps.asp and Artifact templates at https://www.va.gov/process/artifacts.asp One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx) VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014 VA Handbook 6508.1, “Procedures for Privacy Threshold Analysis and Privacy Impact Assessment,” July 30, 2015 VA Handbook 6510, “VA Identity and Access Management,” January 15, 2016 VA Directive and Handbook 6513, “Secure External Connections,” October 12, 2017 VA Directive 6300, “Records and Information Management,” September 21, 2018 VA Handbook, 6300.1, “Records Management Procedures,“ March 24, 2010 NIST SP 800-37 Rev 2, “Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy,” December 2018 NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020) VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015 VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” March 24, 2014 OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005 OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019 OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008 Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance, December 2, 2011, (NOTE: Part A of the FICAM Roadmap and Implementation Guidance, v2.0, was replaced in 2015 with an updated Architecture (https://arch.idmanagement.gov/#what-is-the-ficam-architecture) NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access,“ June 2018 NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, “Digital Identity Guidelines,” updated March 02, 2020 NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014 NIST SP 800-164, “Guidelines on Hardware-Rooted Security in Mobile Devices (Draft),” October 2012 Draft National Institute of Standards and Technology Interagency Report (NISTIR) 7981, “Mobile, PIV, and Authentication,” March 2014 VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514) IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514) VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896 Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019 OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008 Sections 524 and 525 of the Energy Independence and Security Act of 2007, (Public Law 110–140), December 19, 2007 Section 104 of the Energy Policy Act of 2005, (Public Law 109–58), August 8, 2005 Executive Order 13834, “Efficient Federal Operations,” dated May 17, 2018 Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 2, 2001 VA Directive 0058, “VA Green Purchasing Program,” July 19, 2013 VA Handbook 0058, “VA Green Purchasing Program,” July 19, 2013 Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103 “Veteran Focused Integration Process (VIP) Guide 4.0,” January 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371 VA Memorandum “Proper Use of Email and Other Messaging Services,” January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 “DevSecOps Product Line Management Playbook” version 2.0, May 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946 NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020 OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol Version 6 (IPv6),” November 19, 2020 Social Security Number (SSN) Fraud Prevention Act of 2017 Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23, 2018

SCOPE OF WORK

VA, OIT, Software Product Management, Population Health requires provide a Cancer Registry product with integration between the new EHR Cerner product, Millennium EHR, and the Cancer Registry’s vendor applications. The Contractor shall provide a new cancer registry framework maintaining a comprehensive database of the VA Cancer Registry, regardless of Electronic Health Record (her) tool. The Contractor shall comply with current technological requirements and meet the demands of the Commission on Cancer standards for accredited cancer programs. To meet these requirements, the Contractor agrees to provide a new cancer registry framework maintaining a comprehensive database of the VA Cancer Registry, regardless of Electronic Health Record (her) tool. .

To facilitate the consolidation of and transfer of Cancer Registry data from each of the 132 VistA sites, VA intends to use the Veterans Data Integration and Federation Enterprise Platform (VDIF-EP). This platform will allow the new Cancer Registry solution to have a single connection to one source, instead of requiring connections to each of the VistA sites for data.

The Contractor shall be responsible for the transfer of data to the Corporate Data Warehouse (CDW) for analytical functionality. This transfer will be done through a phased implementation to resolve any issues before full deployment across the enterprise.

The Contractor shall provide support for both linked and unlinked abstracts; case finding through various mechanisms such as case management view, case finding notes, imported notes, and case find module; custom fields; edits and data validation; activity and audit logs; definitions for user roles; transfer of reports into dashboards, pivots, and aggregated reports; export of data to Excel.

PERFORMANCE DETAILS

PERFORMANCE PERIOD

The period of performance (PoP) shall be for one 12-month base period with four 12-month option periods and two optional tasks. The total period of performance for the task order shall not exceed 60 months.

Installation, maintenance , and disconnection of services shall take place between 8:00 AM to 4:30 PM (Local Time), Monday through Friday, excluding Federal holidays. Any work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO). If required, the CO may designate the Contractor to work during holidays and weekends.

There are eleven (11) Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, four are set by date:

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

PLACE OF PERFORMANCE

Tasks under this PWS shall be performed at Contractor facilities. The Contractor shall identify the Contractor’s place of performance in their proposal submission.

TRAVEL

The Government anticipates that no travel will be required to perform the tasks required under this effort.

SPECIFIC TASKS AND DELIVERABLES

The Contractor shall perform the following:

5.1 PROJECT MANAGEMENT

5.1.1 CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, timeline and tools to be used in execution of this effort. The CPMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks and resource support. The CPMP shall also include how the Contractor shall coordinate, execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The Contractor shall update and maintain the VA Program Management approved CPMP throughout the period of performance (PoP)

Deliverable:

A. Contractor Project Management Plan

5.1.2 REPORTING REQUIREMENTS

The Contractor shall provide a Monthly Progress Report in electronic form per mutually agreed upon format and media. The report shall include detailed instructions/explanations for each required data element, to ensure that data is accurate and consistent. These reports shall reflect data as of the last day of the preceding month.

The Monthly Progress Report shall cover all work completed during the reporting period and work planned for the subsequent reporting period. The report shall also identify any problems that arose and a description of how the problems were resolved. If problems have not been completely resolved, the Contractor shall provide an explanation including their plan and timeframe for resolving the issue. The Contractor shall monitor performance against the CPMP and report any deviations. It is expected that the Contractor will keep in communication with VA accordingly so that issues that arise are transparent to both parties to prevent escalation of outstanding issues.

The Status Report shall include the following data elements for each product supported:

1. Product Name.

2. Overview and description of the project.

3. Overall high-level assessment of project progress.

4. All Work In-Progress (WIP) vs work in-progress limit and completed during the reporting period.

5. Identification of any project related issues uncovered during the reporting period and especially highlight those areas with a high probability of impacting schedule or performance goals and their likely impact on schedule or performance goals.

6. Explanations for any unresolved issues, including workable solutions and any actions required of the Government and/or Contractor to resolve or mitigate any identified issue, including a plan and timeframe for resolution.

7. Status on previously identified issues, actions taken to mitigate the situation and/or progress made in rectifying the situation.

8. Work planned for the subsequent 3 reporting periods, when applicable Current project schedule overlaid on original project schedule showing any delays or advancement in schedule.

9. Workforce staffing data showing all Contractor personnel performing on the effort during the current reporting period. After the initial labor baseline is provided, each report shall identify any changes in staffing identifying each person who was added to the project or removed from the project.

10. Training Certificates, after initial and updated certificates are provided, each report shall identify any changes for all Contractor personnel including the dates of expiration and the due date for the next time due.

11. A Government Furnished Equipment (GFE) Report for all equipment issued to Contractor personnel performing on the effort during the current reporting period including a record of transfer.

12. Original schedule of deliverables and the corresponding deliverables made during the current reporting period.

Deliverables:

A. Monthly Status Report

5.1.3 TECHNICAL KICKOFF MEETING

A technical kickoff meeting shall be held within ten (10) days after award. The Contractor shall coordinate the date, time and meeting platform (teleconference, MS Teams, WebEx, etc.) with the Contracting Officer (CO), as the Post-Award Conference Chairperson, the VA PM, as the Co-Chairperson, the Contract Specialist (CS), and the COR. The Contractor shall provide a draft agenda to the CO and VA PM at least three (3) calendar days prior to the meeting. Upon Government approval of a final agenda, the Contractor shall distribute to all meeting attendees. During the kickoff-meeting, the Contractor shall present, for review and approval by the Government, the details of the intended approach, work plan, and project schedule for each effort via a Microsoft Office PowerPoint presentation. At the conclusion of the meeting, the Contractor shall update the presentation with a final slide entitled “Summary Report” which shall include notes on any major issues, agreements, or disagreements discussed during the kickoff meeting and the following statement “As the Post-Award Conference Chairperson, I have reviewed the entirety of this presentation and assert that it is an accurate representation and summary of the discussions held during the Technical Kickoff Meeting for the Cancer Registry Modernization program. The Contractor shall submit the final updated presentation to the CO for review and signature within three (3) calendar days after the meeting. The Contractor shall also work with the CS, the Government’s designated note taker, to prepare and distribute the meeting minutes of the kickoff meeting to the CO, COR and all attendees within three (3) calendar days after the meeting. The Contractor shall obtain concurrence from the CS on the content of the meeting minutes prior to distribution of the document.

Deliverable:

A. Technical Kickoff Meeting Summary Report

5.1.4 MANDATORY TRAINING

The Contractor shall submit Talent Management System (TMS) Training Certificates of completion for VA Privacy and Information Security Awareness and Rules of Behavior and Health Insurance Portability and Accountability Act (HIPAA) training and provide signed copies of the Contractor Rules of Behavior in accordance with Section 9, Training, Appendix C of the VA Handbook 6500.6, “Contract Security”. The Contractor shall provide newly obtained certificates as part of the Monthly Status Report.

Contractor employees may be required to complete VA training courses before receiving access to the Data Repository. Contractor employees who have completed these VA training courses within a specified time and have furnished certificates will not be required to re-take the training courses. The Contractor shall collect and store copies of Training Certificates as evidence of completion for each individual. The Contractor shall provide a copy of the Training Roster and certificates to indicate the staff that have completed training in the Monthly Status Report.

Deliverable:

A. Training Certifications

5.1.5 ONBOARDING AND OFFBOARDING

The Contractor shall manage the onboarding of its staff on this project. Onboarding includes steps to obtain a VA Personal Identity Verification (PIV) card, network and email account, complete VA mandatory trainings for Contractors, initiate background investigations, and gain physical and logical access. In addition, the Contractor shall identify individuals which may require elevated privileges to the necessary development and test environments for the Product Lines. After review between the Contractor and VA COR(s), a decision will be made as to the necessity of obtaining GFE for the onboarding staff. If approved, Contractor shall follow the appropriate steps to obtain the equipment.

A single Contractor Onboarding Point of Contact (POC) shall be designated by the Contractor that tracks the onboarding status of all Contractor personnel. The Contractor Onboarding POC shall be responsible for accurate and timely submission of all required VA onboarding paperwork to the VA COR(s). All VA onboarding paperwork shall be stored on the deliverables folder in the COR designated VA SharePoint site or equivalent tool. The Contractor Onboarding POC shall be responsible for tracking the status of all their staff’s onboarding activities to include the names of all personnel engaged on the task, their initial training date for VA Privacy and Information Security training, and their next required training date. The Contractor Onboarding POC shall also report the status of the staff level in the Monthly Status Report.

The Contractor shall manage the offboarding process for VA access and to individual system/environment access for all Contractor staff. The Contractor shall prepare all forms necessary for termination of access to VA information systems, in accordance with VA guidance. The Contractor shall assist in confirming whether the GFE equipment, associated documentation, and PIV card has been returned to the proper receiving authorities in accordance with VA policy.

5.2 CANCER REGISTRY SOFTWARE

The Contractor shall provide an enterprise cancer registry to be used by each VA medical facility (or partnered facilities) to identify and collect data on patients diagnosed with cancer and transmit the data to a single database. This single database will have capabilities for reporting to the VA Central Cancer Registry (VACCR), as well as to state central cancer registries, and to a national database such as National Cancer Database (NCDB) where required, as part of the Veterans Health Administrations National Cancer Strategy.

The cancer registry software, at a minimum, shall include the following functionality:

5.2.1 The user shall have the ability to run a case ascertainment report within the System to understand the potential cancer cases needed for review.

The user shall have the ability to view the source of information from the patient’s electronic health record, which identified the patient for case ascertainment, to determine if the case should be accessioned into the System.

The user shall have the ability to perform case abstraction and data curation within the System to use the data for patient care tracking, reporting, and analytics.

5.2.2 The System will document follow up activities so the user can track patients with cancer from diagnosis until death.

5.2.11 The System shall include an audit trail regarding the information entered into specific data fields, including the old values, new values, who entered the data and a timestamp of the change.

5.2.17 The system shall provide the ability to run standard reports from the application to contain audit information, and to understand which cases were reported and to which entity, date reported, and who reported them.

The following cancer registry requirements are optional:

Deliverables:

A. Enterprise License for Cancer Registry Software B. User Guide for Cancer Registry Software

5.3 DEPLOYMENT

Deliverables:

A. Deployment Final Report – Including system and network diagrams, documentation to support the VA ATO (Authority to Operate) process and any other notes relevant to VA system administrators.

5.4 HISTORICAL DATA IMPORT

5.4.2 The contractor shall devise and execute algorithms to update existing records with missing information (such as treatment, stage, outcome information)

Deliverables:

A. Data Import Report that includes the details from sections 5.4.1, A & B.

B. Electronic copy of algorithms developed under section 5.4.2.

5.5 TRAINING AND SUPPORT

5.5.1 Training

The Contractor shall conduct initial system training. Training will be given prior to go-live with the System application. The Contractor shall provide training as follows:

1. Provide virtual training sessions to train VA staff. Staff may include users, program managers, IT specialists, and others directly involved in the Cancer Registry Modernization initiative.

2. Provide virtual Train-the-Trainer support. Training shall be designed to educate a select amount of staff (approximately 1,500) by providing essential, professional training skills and knowledge to train other VA staff.

3. Provide pre-recorded training on system use for on-going VA staff training.

4. Provide training for new and updated software modules as released.

5. The Contractor shall provide a Cancer Registry Modernization Training Plan, Cancer Registry Modernization User Training Material and Cancer Registry Modernization Train the Trainer Training Material. Training shall occur whenever crucial updates are made to the System software. Crucial updates shall refer to any update that changes the operability of the Solution.

Deliverable:

A. Cancer Registry Modernization Prevention Training Plans B. Cancer Registry Modernization User Training Material in electronic format (PDF/PowerPoint) C. Cancer Registry Modernization Train the Trainer Training Materials in electronic format (PDF/PowerPoint) D. Recordings of virtual trainings

The Contractor shall provide operations support and systems maintenance support 11 hours a day, 5 days per week (Monday-Friday during the hours of 8am-7pm ET) for the solution for the life of the contract as follows:

1. The Contractor shall ensure the application is maintained to the most recent ly approved software baseline.

2. The Contractor shall perform software maintenance activities that may include version and release upgrades, security updates or patches, performance enhancements, data cleansing/archiving, and application modifications. The Contractor shall provide notifications or access to release documentation.

3. The Contractor shall provide proactive operation health monitoring of the solution. The Contractor shall provide status notification or VA IT access to information about the solution health/availability.

4. The Contractor shall provide a toll-free monitored Help Desk number to provide application support services (Tiers 1-3) for users of the application. The Help Desk shall be available during a typical work week. Typical work week refers to Monday-Friday during the hours of 8am-7pm ET excluding federal holiday. Any telephone support provided by the Contractor shall be at no additional cost. Issues designated by VA as urgent, directly affecting workflow or causing work stoppage, require immediate action, not more than 1 hour, by the Contractor to resolve the issue. Issues designated by VA as non-emergent require a response and action towards resolution within two (2) hours from initial call. Unresolved support issues will be elevated to the VA Enterprise Service Desk for submission of a service ticket. The Contractor shall provide input and technical support to VA Help/Service desks on all layers until resolution.

If no solution is available, tier 1 personnel escalate incidents to a higher tier.

Lower-level technical personnel, trained to solve known problems and to fulfill service requests by following scripts.

If no solution is available, tier 2 escalates the incident to tier 3.

Support personnel with deep knowledge of the product or service, but not necessarily those who designed and created the product.

Tier 3 technicians attempt to duplicate problems and define root causes, using product designs, code, or specifications.

Tier 3 specialists are generally the most highly skilled product specialists, and may include the creators, chief architects, or engineers who created the product or service.

Deliverables:

A. Toll-Free Help Desk Phone Number

5.6 OPTIONAL TASK 1: FedRAMP DEPLOYMENT

The contractor shall deploy their software to a FedRamp Compliant cloud in the same manor as prescribed in section 5.3.

5.7 OPTIONAL TASK 2: FedRAMP Hosting

The Contractor shall deploy the proposed solution in a FedRAMP authorized facility on a FedRAMP authorized computing environment.

GENERAL REQUIREMENTS

ENTERPRISE AND IT FRAMEWORK

VA TECHNICAL REFERENCE MODEL

The Contractor shall support the VA enterprise management framework. In association with the framework, the Contractor shall comply with OIT Technical Reference Model (VA TRM). The VA TRM is one component within the overall Enterprise Architecture (EA) that establishes a common vocabulary and structure for describing the information technology used to develop, operate, and maintain enterprise applications. Moreover, the VA TRM, which includes the Standards Profile and Product List, serves as a technology roadmap and tool for supporting OIT. Architecture & Engineering Services (AES) has overall responsibility for the VA TRM.

FEDERAL IDENTITY, CREDENTIAL, AND ACCESS MANAGEMENT (FICAM)

The Contractor shall ensure Commercial Off-The-Shelf (COTS) product(s), software configuration and customization, and/or new software are Personal Identity Verification (PIV) card-enabled by accepting HSPD-12 PIV credentials using VA Enterprise Technical Architecture (ETA), https://www.ea.oit.va.gov/EAOIT/VA_EA/Enterprise_Technical_Architecture.asp, and VA Identity and Access Management (IAM) approved enterprise design and integration patterns, https://www.oit.va.gov/library/recurring/edp/index.cfm. The Contractor shall ensure all Contractor delivered applications and systems comply with the VA Identity, Credential, and Access Management policies and guidelines set forth in VA Handbook 6510 VA Identity and Access Management, VA Handbook 0735 Homeland Security Presidential Directive 12 (HSPD-12) Program, and align with the Federal Identity, Credential, and Access Management Roadmap and Implementation Guidance v2.0.

The Contractor shall ensure all Contractor delivered applications and systems provide user authentication services compliant with the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-63-3, VA Handbook 6500 Appendix F, “VA System Security Controls”, and VA IAM enterprise requirements for direct, assertion based authentication, and/or trust based authentication, as determined by the design and integration patterns. Direct authentication at a minimum must include Public Key Infrastructure (PKI) based authentication supportive of PIV card and/or Common Access Card (CAC), as determined by the business need.

The Contractor shall ensure all Contractor delivered applications and systems conform to the specific Identity and Access Management PIV requirements set forth in the Office of Management and Budget (OMB) Memoranda M-05-24, M-19-17, and NIST Federal Information Processing Standard (FIPS) 201-2. OMB Memoranda M-05-24 and M-19-17 can be found at: https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2005/m05-24.pdf, and https://www.whitehouse.gov/wp-content/uploads/2019/05/M-19-17.pdf respectively. Contractor delivered applications and systems shall be on the FIPS 201-2 Approved Product List (APL). If the Contractor delivered application and system is not on the APL, the Contractor shall be responsible for taking the application and system through the FIPS 201 Evaluation Program.

The Contractor shall ensure all Contractor delivered applications and systems support:

1. Automated provisioning and are able to use enterprise provisioning service.

2. Interfacing with VA’s Master Person Index (MPI) to provision identity attributes, if the solution relies on VA user identities. MPI is the authoritative source for VA user identity data.

3. The VA defined unique identity (Secure Identifier [SEC ID] / Integrated Control Number [ICN]).

4. Multiple authenticators for a given identity and authenticators at every Authenticator Assurance Level (AAL) appropriate for the solution.

5. Identity proofing for each Identity Assurance Level (IAL) appropriate for the solution.

6. Federation for each Federation Assurance Level (FAL) appropriate for the solution, if applicable.

7. Two-factor authentication (2FA) through an applicable design pattern as outlined in VA Enterprise Design Patterns.

8. A Security Assertion Markup Language (SAML) implementation if the solution relies on assertion-based authentication. Additional assertion implementations, besides the required SAML assertion, may be provided as long as they are compliant with NIST SP 800-63-3 guidelines.

9. Authentication/account binding based on trusted Hypertext Transfer Protocol (HTTP) headers if the solution relies on Trust based authentication.

10. Role Based Access Control.

11. Auditing and reporting capabilities.

12. Compliance with VIEWS 00155984, PIV Logical Access Policy Clarification https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896.

The required Assurance Levels for this specific effort are Identity Assurance Level 3, Authenticator Assurance Level 3, and Federation Assurance Level 3.

INTERNET PROTOCOL VERSION 6 (IPV6)

The Contractor solution shall support Internet Protocol Version 6 (IPv6) based upon the memo issued by the Office of Management and Budget (OMB) on November 19, 2020 (https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-07.pdf). IPv6 technology, in accordance with the USGv6 Program (https://www.nist.gov/programs-projects/usgv6-program/usgv6-revision-1), NIST Special Publication (SP) 500-267B Revision 1 “USGv6 Profile” (https://doi.org/10.6028/NIST.SP.500-267Br1), and NIST SP 800-119 “Guidelines for the Secure Deployment of IPv6” (https://doi.org/10.6028/NIST.SP.800-119), compliance shall be included in all IT infrastructures, application designs, application development, operational systems and sub-systems, and their integration. In addition to the above requirements, all devices shall support native IPv6 and dual stack (IPv6 / IPv4) connectivity without additional memory or other resources being provided by the Government, so that they can function in a mixed environment. All public/external facing servers and services (e.g. web, email, DNS, ISP services, etc.) shall support native IPv6 and dual stack (IPv6 / IPv4) users and all internal infrastructure and applications shall communicate using native IPv6 and dual stack (IPv6 / IPv4) operations.

TRUSTED INTERNET CONNECTION (TIC)

The Contractor solution shall meet the requirements outlined in Office of Management and Budget Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative“ (https://www.whitehouse.gov/wp-content/uploads/2019/09/M-19-26.pdf), VA Directive 6513 “Secure External Connections”, and shall comply with the TIC 3.0 Core Guidance Documents, including all Volumes and TIC Use Cases, found at the Cybersecurity & Infrastructure Security Agency (CISA) (https://www.cisa.gov/publication/tic-30-core-guidance-documents). Any deviations must be approved by the VA TIC 3.0 Working Group at vaoisesatic30team@va.gov.

STANDARD COMPUTER CONFIGURATION

The Contractor IT end user solution that is developed for use on standard VA computers shall be compatible with and be supported on the standard VA operating system, currently Windows 10 (64bit), Edge (Chromium based), and 365 Apps for enterprise. Applications delivered to VA and intended to be deployed to Windows 10 workstations shall be delivered as a signed .msi package with switches for silent and unattended installation and updates shall be delivered in signed .msp file formats for easy deployment using Microsoft Endpoint Configuration Manager (CM) VA’s current desktop application deployment tool. Signing of the software code shall be through a vendor provided certificate that is trusted by VA using a code signing authority such as Verizon/Cybertrust or Symantec/VeriSign. The Contractor shall also ensure and certify that their solution functions as expected when used from a standard VA computer, with non-admin, standard user rights that have been configured using the United States Government Configuration Baseline (USGCB) and Defense Information Systems Agency (DISA) Secure Technical Implementation Guide (STIG) specific to the particular client operating system being used.

VETERAN FOCUSED INTEGRATION PROCESS (VIP) AND PRODUCT LINE MANAGEMENT (PLM)

The Contractor shall support VA efforts IAW the updated Veteran Focused Integration Process (VIP) and Product Line Management (PLM). The major focus of the new VIP is on Governance and Reporting and is less prescriptive, with a focus on outcomes and continuous delivery of value. Product Line Management (PLM) is a framework that focuses on delivering functional products that provide the highest priority work to customers while delivering simplified, reliable, and practical solutions to the business, medical staff, and our Veterans. The VIP Guide is a companion guide to the PLM Playbook and can be found at: https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371 and the PLM Playbook can be found at https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946. The PLM Playbook pivots from project-centric to product-centric delivery and contains descriptive practices that focuses on outcomes. The PLM Playbook contains a set of “plays” that implement Development, Security, and Operations (DevSecOps) principles and processes such as automated development, continuous integration/continuous delivery, and release on demand. The PLM Playbook details how product lines implement Lean-Agile principles, methods, practices, and techniques through levels of maturity. VIP and PLM are the authoritative processes that IT projects must follow to ensure development and delivery of IT products.

PROCESS ASSET LIBRARY (PAL)

The Contractor shall perform their duties consistent with the processes defined in the OIT Process Asset Library (PAL). The PAL scope includes the full spectrum of OIT functions and activities, such as VIP project management, operations, service delivery, communications, acquisition, and resource management. PAL serves as an authoritative and informative repository of searchable processes, activities or tasks, roles, artifacts, tools and applicable standards and guides to assist the OIT workforce, Government and Contractor personnel. The Contractor shall follow the PAL processes to ensure compliance with policies and regulations and to meet VA quality standards. The PAL includes the contractor onboarding process consistent with Section 6.2.2 and can be found at https://www.va.gov/PROCESS/artifacts/maps/process_CONB_ext.pdf. The main PAL can be accessed at www.va.gov/process.

AUTHORITATIVE DATA SOURCES

The VA Enterprise Architecture Repository (VEAR) is one component within the overall EA that establishes the common framework for data taxonomy for describing the data architecture used to develop, operate, and maintain enterprise applications. The Contractor shall comply with the department’s Authoritative Data Source (ADS) requirement that VA systems, services, and processes throughout the enterprise shall access VA data solely through official VA ADSs where applicable, see below. The Information Classes which compose each ADS are located in the VEAR, in the Data & Information domain. The Contractor shall ensure that all delivered applications and system solutions support:

1. Interfacing with VA’s Master Person Index (MPI) (formerly the Master Veteran Index (MVI)) to provision identity attributes, if the solution relies on VA user identities. MPI is the authoritative source for VA user identity data.

2. Interfacing with Capital Asset Inventory (CAI) to conduct real property record management actions, if the solution relies on real property records data. CAI is the authoritative source for VA real property record management data.

3. Interfacing with electronic Contract Management System (eCMS) for access to contract, contract line item, purchase requisition, offering vendor and vendor, and solicitation information above the micro-purchase threshold, if the solution relies on procurement data. ECMS is the authoritative source for VA procurement actions data.

4. Interfacing with HRSmart Human Resources Information System to conduct personnel action processing, on-boarding, benefits management, and compensation management, if the solution relies on personnel data. HRSmart is the authoritative source for VA personnel information data.

5. Interfacing with Vet360 to access personal contact information, if the solution relies on VA Veteran personal contact information data. Vet360 is the authoritative source for VA Veteran Personal Contact Data.

6. Interfacing with VA/Department of Defense (DoD) Identity Repository (VADIR) for determining eligibility for VA benefits under Title 38, if the solution relies on qualifying active duty military service data. VADIR is the authoritative source for Qualifying Active Duty military service in VA.

SOCIAL SECURITY NUMBER (SSN) REDUCTION

The Contractor solution shall support the Social Security Number (SSN) Fraud Prevention Act (FPA) of 2017 which prohibits the inclusion of SSNs on any document sent by mail. The Contractor support shall also be performed in accordance with Section 240 of the Consolidated Appropriations Act (CAA) 2018, enacted March 23, 2018, which mandates VA to discontinue using SSNs to identify individuals in all VA information systems as the Primary Identifier. The Contractor shall ensure that any new IT solution discontinues the use of SSN as the Primary Identifier to replace the SSN with the ICN in all VA information systems for all individuals. The Contractor shall ensure that all Contractor delivered applications and systems integrate with the VA Master Person Index (MPI) for identity traits to include the use of the ICN as the Primary Identifier.