P09 - PWS Survey SaaS v4.2.pdf

PERFORMANCE WORK STATEMENT

DEPARTMENT OF VETERANS AFFAIRS

Veterans Health Administration (VHA) Human Capital Management (HCM)

Survey Management SaaS

Date: February 2021

PWS Version Number: 4.2

CONTENTS

1.0 BACKGROUND

2.0 APPLICABLE DOCUMENTS

3.0 SCOPE OF WORK

4.0 PERFORMANCE DETAILS

4.1 PERFORMANCE PERIOD

5.0 SPECIFIC TASKS AND DELIVERABLES

5.1 KICKOFF MEETING .......................................... Error! Bookmark not defined.

5.2 SAAS SUBSCRIPTIONS AND HOSTING

5.3 FEDRAMP ATO (Authority to Operate) MAINTENANCE

5.4 CONFIGURATION SUPPORT ........................... Error! Bookmark not defined.

5.5 OPERATIONS AND MAINTENANCE SUPPORT ............. Error! Bookmark not defined.

5.6 SYSTEM TRAINING .......................................... Error! Bookmark not defined.

5.7 OPTIONAL TASK - TRANSITION SUPPORT

5.8 OPTIONAL TASK 2 – ADDITIONAL RESPONSES

6.0 GENERAL REQUIREMENTS

6.1 VA TECHNICAL REFERENCE MODEL

6.2 FEDERAL IDENTITY, CREDENTIAL, AND ACCESS MANAGEMENT (FICAM)

6.3 INTERNET PROTOCOL VERSION 6 (IPV6)

6.4 TRUSTED INTERNET CONNECTION (TIC)

6.5 STANDARD COMPUTER CONFIGURATION

6.6 VETERAN FOCUSED INTEGRATION PROCESS (VIP)

6.7 PROCESS ASSET LIBRARY (PAL)

6.8 AUTHORITATIVE DATA SOURCES

6.9 SECURITY AND PRIVACY REQUIREMENTS

6.9.1 POSITION/TASK RISK DESIGNATION LEVEL(S)

6.9.2 RESPONSIBILITIES

6.10 METHOD AND DISTRIBUTION OF DELIVERABLES

6.11 PERFORMANCE METRICS

ADDENDUM A – ADDITIONAL VA REQUIREMENTS, CONSOLIDATED

ADDENDUM B – Information Security Requirements

ADDENDUM C – VA INFORMATION SYSTEM SECURITY AND PRIVACY

Points of Contact ADDENDUM D – VA SOFTWARE AS A SERVICE (SaaS)

6.12 ASSESSMENT, AUTHORIZATION, and CONTINUOUS MONITORING

1.0 BACKGROUND

The Department of Veterans Affairs (VA), Veterans Health Administration (VHA), Human Capital Management is seeking interested offerors who have the capability to provide subscriptions, configuration, training and support services for a FedRAMP certified Survey SaaS (Software as a Service). The online survey platform will be used to create customized and standardized surveys to collect data and develop reports for learning and workforce related measurement activities such as evaluations and needs assessments. SMEs (Subject Matter Experts) must have administrative access to the software and will work within the survey system to directly create, deploy, and analyze surveys and data.

Objectives: The contractor will only be responsible for providing access to the online software system and will not be responsible for developing survey questions, distributing surveys to participants, analyzing data outside of the standard functions of the software, or conducting evaluations. The system shall be operational, FedRAMP approved, and ready for the VA to use on the period of performance start date.

2.0 APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. 44 U.S.C. § 3541-3549, “Federal Information Security Management Act (FISMA) of 2002”

2. “Federal Information Security Modernization Act of 2014”

3. Federal Information Processing Standards (FIPS) Publication 140-2, “Security Requirements For Cryptographic Modules”

4. FIPS Pub 199. Standards for Security Categorization of Federal Information and Information Systems, February 2004

5. FIPS Pub 200, Minimum Security Requirements for Federal Information and

Information Systems, March 2016

6. FIPS Pub 201-2, “Personal Identity Verification of Federal Employees and

Contractors,” August 2013

7. 10 U.S.C. § 2224, "Defense Information Assurance Program"

8. Carnegie Mellon Software Engineering Institute, Capability Maturity Model®

Integration for Development (CMMI-DEV), Version 1.3 November 2010; and Carnegie Mellon Software Engineering Institute, Capability Maturity Model® Integration for Acquisition (CMMI-ACQ), Version 1.3 November 2010

9. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

10. Public Law 109-461, Veterans Benefits, Health Care, and Information

Technology Act of 2006, Title IX, Information Security Matters

11. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”

12. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, https://www.va.gov/vapubs/index.cfm

13. VA Handbook 0710, Personnel Security and Suitability Program, May 2, 2016, https://www.va.gov/vapubs/index.cfm

14. VA Directive and Handbook 6102, “Internet/Intranet Services,” August 5, https://www.va.gov/vapubs/index.cfm https://www.va.gov/vapubs/index.cfm http://www.va.gov/vapubs http://www.va.gov/vapubs

15. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and Guidelines,” January 18, 2017

16. Office of Management and Budget (OMB) Circular A-130, “Managing Federal Information as a Strategic Resource,” July 28, 2016

17. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed Services (CHAMPUS)”

18. NIST SP 800-66 Rev. 1, An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule, October 2008

19. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended, January 18, 2017

20. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

21. VA Directive 6500, “VA Cybersecurity Program,” January 24, 2019

22. VA Handbook 6500, “Risk Management Framework for VA Information

Systems – Tier 3: VA Information Security Program,” March 10, 2015

23. VA Handbook 6500.2, “Management of Breaches Involving Sensitive

Personal Information (SPI)”, July 28, 2016

24. VA Handbook 6500.3, “Assessment, Authorization, And Continuous

Monitoring Of VA Information Systems,” February 3, 2014

25. VA Handbook 6500.5, “Incorporating Security and Privacy into the System

Development Lifecycle”, March 22, 2010

26. VA Handbook 6500.6, “Contract Security,” March 12, 2010

27. VA Handbook 6500.8, “Information System Contingency Planning”, April 6,

28. VA Handbook 6500.11, “VA Firewall Configuration”, August 22, 2017

29. OI&T Process Asset Library (PAL), https://www.va.gov/process/ . Reference

Process Maps at https://www.va.gov/process/maps.asp and Artifact templates at https://www.va.gov/process/artifacts.asp

30. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

31. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014

32. VA Handbook 6508.1, “Procedures for Privacy Threshold Analysis and Privacy Impact Assessment,” July 30, 2015

33. VA Handbook 6510, “VA Identity and Access Management”, January 15,

34. VA Directive and Handbook 6513, “Secure External Connections”, October 12, 2017

35. VA Directive 6300, Records and Information Management, September 21,

36. VA Handbook, 6300.1, Records Management Procedures, March 24, 2010

37. NIST SP 800-37 Rev 1, Risk Management Framework for Information

Systems and Organizations: A System Life Cycle Approach for Security and Privacy, December 2018

38. NIST SP 800-53 Rev. 4, Security and Privacy Controls for Federal Information Systems and Organizations, January 22, 2015 https://www.va.gov/process/ https://www.va.gov/process/maps.asp https://www.va.gov/process/artifacts.asp https://www.va.gov/trm/TRMHomePage.aspx

39. OMB Memorandum, “Transition to IPv6”, September 28, 2010

40. VA Directive 0735, Homeland Security Presidential Directive 12 (HSPD-12)

Program, October 26, 2015

41. VA Handbook 0735, Homeland Security Presidential Directive 12 (HSPD-12)

Program, March 24, 2014

42. OMB Memorandum M-06-18, Acquisition of Products and Services for

Implementation of HSPD-12, June 30, 2006

43. OMB Memorandum 04-04, E-Authentication Guidance for Federal Agencies, December 16, 2003

44. OMB Memorandum 05-24, Implementation of Homeland Security

Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors, August 5, 2005

45. OMB memorandum M-11-11, “Continued Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors, February 3,

46. OMB Memorandum, Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation, May 23, 2008

47. Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance, December 2, 2011

48. NIST SP 800-116 Rev 1, Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access, June 2018

49. OMB Memorandum M-07-16, Safeguarding Against and Responding to the Breach of Personally Identifiable Information, May 22, 2007

50. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, Digital Identity Guidelines, December 2017

51. NIST SP 800-157, Guidelines for Derived PIV Credentials, December 2014

52. NIST SP 800-164, Guidelines on Hardware-Rooted Security in Mobile

Devices (Draft), October 2012

53. Draft National Institute of Standards and Technology Interagency Report

(NISTIR) 7981 Mobile, PIV, and Authentication, March 2014

54. VA Memorandum, VAIQ #7100147, Continued Implementation of Homeland

Security Presidential Directive 12 (HSPD-12), April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

55. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

56. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

57. Trusted Internet Connections (TIC) Reference Architecture Document, Version 2.2, Federal Interagency Technical Reference Architectures, Department of Homeland Security, June 19, 2017, https://www.dhs.gov/sites/default/files/publications/TIC_Ref_Arch_v2.2_2017 .pdf https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514 https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896 https://www.dhs.gov/sites/default/files/publications/TIC_Ref_Arch_v2.2_2017.pdf

58. OMB Memorandum M-08-05, “Implementation of Trusted Internet Connections (TIC), November 20, 2007

59. OMB Memorandum M-08-23, Securing the Federal Government’s Domain Name System Infrastructure, August 22, 2008

60. VA Memorandum, VAIQ #7497987, Compliance – Electronic Product Environmental Assessment Tool (EPEAT) – IT Electronic Equipment, August 11, 2014 (reference Document Libraries, EPEAT/Green Purchasing Section, https://www.voa.va.gov/documentlistpublic.aspx?NodeID=552)

61. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (Public Law 110–140), December 19, 2007

62. Section 104 of the Energy Policy Act of 2005, (Public Law 109–58), August 8, 2005

63. Executive Order 13834, “Efficient Federal Operations”, dated May 17, 2018

64. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August

2, 2001

65. VA Directive 0058, “VA Green Purchasing Program”, July 19, 2013

66. VA Handbook 0058, “VA Green Purchasing Program”, July 19, 2013

67. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote

Access”, January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

68. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

69. “Veteran Focused Integration Process (VIP) Guide 3.2”, December 2018, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

70. VA Memorandum “Proper Use of Email and Other Messaging Services”, January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

3.0 SCOPE OF WORK

VHA Human Capital Management requires access to an online survey system that will enable personnel to create customized and standardized surveys to collect data and develop reports for learning and workforce related measurement activities such as evaluations and needs assessments. SMEs (Subject Matter Experts) must have administrative access to the software and will work within the survey system to directly create, deploy, and analyze surveys and data.

4.0 PERFORMANCE DETAILS

4.1 PERFORMANCE PERIOD

The period of performance (PoP) shall be one (1) year from date of award, with four (4) twelve (12) month option periods and two optional tasks.

https://www.voa.va.gov/documentlistpublic.aspx?NodeID=552 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

5.0 SPECIFIC TASKS AND DELIVERABLES

The Contractor shall perform the tasks and complete the associated deliverables under this procurement by the scheduled due dates within the overall period of performance.

If the Contractor cannot deliver those deliverables specified by this task order by the required due date, then the Contractor shall provide a written explanation to the Contracting Officer (CO) and Contracting Officer Representative (COR). This written transmittal shall include the reasons for the delay; when the Contractor knew or should have known a delay would incur; due diligence taken to mitigate the problems, the impact on the overall project; and a firm commitment of when the work is to be completed. The CO will then review the facts and issue a response in accordance with applicable regulations.

The Contractor shall perform the tasks and complete the associated deliverables as follows:

5.1 SAAS SUBSCRIPTIONS AND HOSTING

The vendor shall provide VA access to the online survey platform with 200,000 survey responses annually, unlimited survey authors, creator, statistical analysis tool (Stats IQ or equivalent), and the option to increase system capacity to over 200,000 annual survey responses in the future (see optional task 5.4). The vendor shall provide the solutions as a Commercially Available Off the Shelf (COTS) Software as a Service (SaaS) solution for conducting surveys electronically, collecting and analyzing data, and generating standard and custom reports. VA personnel must have direct administrative access to the system to create and deploy surveys, collect responses, and access raw data and summary reports. The Contractor shall provide and maintain the cloud hosting environment, system, and other related equipment and procedures to support the survey platform and configuration requirements. The Contractor shall ensure the solution is configured to comply with the following system requirements or equivalent:

(Note: “users” refers to administrative users who will directly access the administrative environment to create, deploy, and analyze surveys and “respondents” refers to those who will be completing the surveys)

1. Vendor’s software will be hosted and not require local installation (cloud-based).

2. The contractor shall provide an introductory training to the software for new users covering the basics of

a. Survey creation

b. Survey launch

c. Survey monitoring

d. Importing/exporting surveys

e. Importing/exporting survey data

f. Survey close-out

g. Analysis of data functionality

h. Reporting functionality

The training will be provided virtually, and all training materials will be provided to VA. The vendor will provide 24/7 access to online training/help materials as needed by the customer to understand product best practices. The vendor will provide product support online and via phone to provide additional training and documentation as needed. Documentation is defined as a video walkthrough or step by step tutorials.

3. The Contractor shall provide support for the SaaS (Software as a Solution), system configuration, change requests, bug defects necessary to support the contract.

4. The Contractor shall provide support with unlimited business-day telephone and/or on-line support. A business day is defined as Monday through Friday during standard business hours. Support includes technical assistance in troubleshooting issues, problems or symptoms with the software and answering questions regarding documented properties, methods, events, function calls, parameters and specific functionality of software components. The Contractor shall acknowledge receipt of all support inquires according to the timelines shown in the table below. The Contractor shall communicate to the VA customer on system outages 72 hours prior to scheduled outages and within 1 hour of identified emergency issues.

5. The Contractor shall provide to the Government System up-time and URL Monitoring for Continuity of Operations.

6. The Contractor shall monitor the system performance and scale the environment should the concurrency needs increase over time or system responsiveness fail to perform to the service level agreement.

7. The Contractor shall be compliant with Section 508 of the Workforce Rehabilitation Act of 1973 and VA Handbook 6102.

8. The system shall provide access to Web Services/APIs (Application Programming Interface) necessary for integration with other systems.

9. The contractor shall configure the system to use the VA SSO (Single Sign On).

The system shall allow Just in Time (JIT) provisioning of users and automatically notify administrative users upon new self-enrollment of a user.

10. The SaaS solution should provide top level administrative users the ability to create and assign user types and their permissions, create groups, track metrics related to response usage, remove users, transfer surveys between users, log into any user account, control all organizational settings data privacy.

11. The SaaS solution (surveys, evaluations, etc.) will be accessible via commonly accepted web browsers inside and outside of the VA intranet by VA and non-VA training participants.

12. The contractor shall provide essential administrative software to manage surveys electronically, collect and analyze data, and generate standard and custom reports based on the rough order of magnitude.

13. The contractor shall provide equivalent essential evaluation, survey setup and launch elements:

a. The software should support fully customizable surveys that can be created quickly and efficiently by personnel in the administrative environment.

b. Ability to preview the survey prior to finalizing, launching, or activating.

c. Ability to support logic branching functionality and skip patterns within surveys.

d. Automatic numbering (and renumbering) of questions when entered and arranged on a survey.

e. A customized branded theme that can be applied to surveys

f. Import/build Functionality to support standard questions.

g. Ability to copy full surveys or individual survey items within and across surveys

h. Ability to adjust automatically to mobile environments.

i. Scoring functionality.

j. Multiple survey question types available (T/F, Multiple Choice, Matrix

Table, Text, Rank Order, Slider, Sum, Group and Rank, Drill Down, Side-by-side, Signature, etc.) and document upload.

k. Ability to upload CSV files with response options for drill down question types

l. Ability to include graphics and videos within surveys

m. Ability to distribute surveys via multiple mechanisms including anonymous links, QR codes, and automated e-mail system. Email system should include ability to send automatic email reminders.

n. System check in place to prevent duplication of survey submission – participants are unable to take a survey more than once.

o. Ability to generate retake survey links and build retake survey links for bulk and automated distribution which pre-populate previous responses with option to record as a new response or replace the original response;

option to only display some content for retake surveys or display additional content only for retakes

p. Ability to set specific active dates for surveys, password protect surveys, and authentication of respondents.

q. Ability to send e-mail notifications upon survey completion to respondents and other designated contacts including notifications that are conditional to a survey response value.

r. Provide an estimate of the average time expected to complete a survey.

s. Standard Reports available with graphic representations of data.

t. Ability to develop customizable reports; also supported by graphic representation.

u. Real-time response data available throughout the survey open period to those accessing reports or system administrators.

v. Ability to sort, filter, or stratify data and reports

w. Automated descriptive statistics including percentages, mean, and standard deviation.

x. Data export at individual level to Excel or CSV and SPSS (Statistical

Product and Service Solutions).

y. Ability to export surveys in Word or PDF format

z. Ability to import surveys via .txt or .doc files

aa. Ability to import survey data

bb. Reports exportable to Excel/CSV, PDF, and Word.

cc. Ability to create link to reports available outside of administrative environment that update in real-time as surveys are completed.

dd. Consistent reporting format across varying reports.

ee. Ability to calculate additional variables from responses to survey items during response collection that can be included in later survey elements or shown to respondents and after a survey has been completed.

ff. Product improvements, updates and enhancements on a regularly scheduled basis as the product evolves.

gg. Ability to fully customize survey appearance including: adding a logo, background image, and header/footer, edit Next and Back button text, include a progress bar with options to change color/text, set survey colors, set text fonts globally and by question

hh. Ability to group questions into blocks that can be included in branching

ii. Allow respondents to continue a survey at a later date.

jj. Support custom validation, error, inactive survey, and end of survey messages.

kk. Essential features from the rough order of magnitude.

i. Advanced Quotas

ii. Advanced Question Types

iii. ExpertReview - Compliance Assist

iv. CoreXM ExpertReview - Response Quality (Advanced)(Research

Core)

v. Custom Theme: 4

vi. Offline App

vii. Screen Out Reporting

viii. SMS

ix. Stats IQ (Describe and Relate)

x. Stats IQ (Pivot and Regression)

xi. XM Directory - CoreXM Advanced

xii. Admin User (Unlimited)

xiii. CoreXM Core Number of Responses: up to 200,000

xiv. Text IQ

xv. Developer Tools

xvi. Branded URL: 2

xvii. CoreXM Standard Plus Implementation Package

Deliverable:

A. Verification of SaaS access B. Excel spreadsheet for each requirement indicating a Yes or No if the vendor solution supports the requirement by the contract award date.

5.2 FEDRAMP ATO (Authority to Operate) MAINTENANCE (Assessment, Authorization and Continuous Monitoring)

This software shall be cloud-based with a FedRAMP(SaaS FedRAMP, not just a PaaS (Platform as a Service) FedRAMP), VA ATO and VA SSO (Single Sign On) certified by the start of the contract. An additional 60 days may be requested if additional configuration is needed. The Contractor shall comply with FedRAMP requirements as mandated by Federal laws and policies, including making available any documentation and logical access needed to support this requirement. The Contractor shall provide and update all artifacts necessary to obtain and maintain the ATO.

The Contractor shall:

1. Coordinate with applicable Veterans Affairs stakeholders for an Authority to Operate to interface the hosted environments to the Veterans Affairs Network.

2. Provide all Assessment and Authorization support and documentation required to achieve and maintain full Assessment and Authorization certification using the process specified in the FedRAMP Program Requirements (https://www.fedramp.gov/issuing-an-authority-to-operate/).

3. Generate the Assessment and Authorization Authority to Operate Package that includes the following security documentation:

a. System Security Plan,

b. Risk Assessment,

c. Incident Response Plan,

d. Information Security Contingency Plan,

e. Disaster Recovery Plan,

f. Configuration Management Plan,

g. Interconnection Security Agreement/Memorandum of Understanding,

h. Additional system description/and diagrams required by Veterans Affairs to gain access to Veterans Affairs network and receive an Authority to Operate.

1. The information system solution selected by the Contractor shall comply with the Federal Information Security Management Act (FISMA).

2. The Contractor shall comply with FedRAMP requirements as mandated by Federal laws and policies, including making available any documentation, physical access, and logical access needed to support this requirement.

3. The Contractor shall, where applicable, assist with the VA ATO Process to help achieve agency authorization of the cloud service or migrated application.

4. The Contractor shall complete a FedRAMP System Security Plan (SSP) and supporting documentation within 30 days after contract award.

5. The Contractor shall complete a Third-Party Assessment Organization (3PAO) Security Assessment Plan (SAP) within 75 days after contract award.

6. The Contractor shall complete a 3PAO Security Assessment Report (SAR) within 90 days after contract award.

https://gcc01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.fedramp.gov%2Fissuing-an-authority-to-operate%2F&data=04%7C01%7C%7C944a2a5dec82455cfee008d881c96dcd%7Ce95f1b23abaf45ee821db7ab251ab3bf%7C0%7C0%7C637402049431774807%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=IoE79lVghBBL86fAmuc7W4RDCBem%2BqHgd%2F7OOT2NMJo%3D&reserved=0

7. The Contractor shall afford VA access to the Contractor’s and Cloud Service Provider’s (CSP) facilities, installations, technical capabilities, operations, documentation, records, and databases.

8. If new or unanticipated threats or hazards are discovered by either VA or the Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party in accordance with the security addendum B.

9. The Contractor shall not release any data without the consent of VA in writing. All requests for release must be submitted in writing to the Contracting Officer’s Representative (COR)/Contracting Officer (CO).

10. In order for live VA data to be used in this system, a FedRAMP Authorization and Agency ATO will be required.

A. Assessment and Authorization Authority to Operate Package B. FedRAMP System Security Plan (SSP) and supporting documentation C. 3PAO Security Assessment Plan (SAP) D. 3PAO Security Assessment Report (SAR)

5.3 Optional Task 1: TRANSITION SUPPORT

The Contractor shall provide transition support of the product only for EES Survey’s and Data (approximately 315 active surveys and data). The Contractor will be responsible for costs and workload of transitioning all existing VA EES survey data to the awarded solution (As of January 2021, EES’s current solution is Qualtrics).

The contractor will be responsible for also providing a tool to assist other organizations within HCM to easily migrate Verint Enterprise Feedback Management survey’s and survey data to the awarded solution. In accordance with the Government-approved plan, the Contractor shall assist the Government in implementing a complete EES transition from this contract to a new support provider. This shall include formal coordination with Government staff.

This Transition Plan shall include:

1. Coordination with Government representatives.

2. Transition of EES Survey’s and historic data to a new Contractor system.

1.1. If applicable, the vendor shall develop and execute a plan for transitioning from

EES’ current cloud-based software system, Qualtrics, to the vendor’s cloud-based system. This plan shall cover configuration, data migration, and testing procedures necessary. The transition will include creating a branded theme, standard survey templates, standard reports, and transferring approximately 315 active surveys and data from the current system to the vendor’s system.

A. Transition plan B. Transfer existing surveys and data into the vendor’s cloud-based system

1.2. If applicable, prior to final product implementation the vendor shall conduct a pilot phase of the software to ensure the software is functional and meets MEU expectations.

A. Testing Plan B. After Action Report

5.4 OPTIONAL TASK 2 – ADDITIONAL RESPONSES

VA may exercise this optional task for an additional 5,000 responses dependent on workload requirements. The specific workload requirements will be determined by the VA PM, Supervisor, COR and business owners based on current business priorities. This optional task may be exercised as many times as needed by the VA in the base period and each option period. All deliverables in this document shall be required for the optional tasks if exercised.

Deliverables

Contract

Line

Number

PWS

Section

Description Qty/Frequency Delivery Estimate

0001 5.1 SaaS system access One (1) NLT 10 calendar days from contract award

0002 5.2 Verification of

FedRAMP certification and

Continuous

Monitoring

One (1) Ongoing throughout the contract

0003 5.3 EES Survey

Transition Support

(Optional Task 1)

One (1) NLT 30 calendar days from contract award

0004 5.4 Additional

Responses

(Optional Task 2

One (1) Optional task that can be requested by VA

6.0 GENERAL REQUIREMENTS

6.1 VA TECHNICAL REFERENCE MODEL

The Contractor shall support the VA enterprise management framework. In association with the framework, the Contractor shall comply with OI&T Technical Reference Model (VA TRM). The VA TRM is one component within the overall Enterprise Architecture (EA) that establishes a common vocabulary and structure for describing the information technology used to develop, operate, and maintain enterprise applications. Moreover, the VA TRM, which includes the Standards Profile and Product List, serves as a technology roadmap and tool for supporting OI&T. Architecture & Engineering Services (AES) has overall responsibility for the

VA TRM.

6.2 FEDERAL IDENTITY, CREDENTIAL, AND ACCESS MANAGEMENT

(FICAM)

The Contractor shall ensure Commercial Off-The-Shelf (COTS) product(s), software configuration and customization, and/or new software are Personal Identity Verification (PIV) card-enabled by accepting HSPD-12 PIV credentials using VA Enterprise Technical Architecture (ETA), https://www.ea.oit.va.gov/EAOIT/VA_EA/Enterprise_Technical_Architecture.asp, and VA Identity and Access Management (IAM) approved enterprise design and integration patterns, https://www.oit.va.gov/library/recurring/edp/index.cfm. The Contractor shall ensure all Contractor delivered applications and systems comply with the VA Identity, Credential, and Access Management policies and guidelines set forth in the VA Handbook 6510 and align with the Federal Identity, Credential, and Access Management Roadmap and Implementation Guidance v2.0.

The Contractor shall ensure all Contractor delivered applications and systems provide user authentication services compliant with the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-63-3, VA Handbook 6500 Appendix F, “VA System Security Controls”, and VA IAM enterprise requirements for direct, assertion based authentication, and/or trust based authentication, as determined by the design and integration patterns. Direct authentication at a minimum must include Public Key Infrastructure (PKI) based authentication supportive of PIV card and/or Common Access Card (CAC), as determined by the business need.

https://www.ea.oit.va.gov/EAOIT/VA_EA/Enterprise_Technical_Architecture.asp https://www.oit.va.gov/library/recurring/edp/index.cfm

The Contractor shall ensure all Contractor delivered applications and systems conform to the specific Identity and Access Management PIV requirements set forth in the Office of Management and Budget (OMB) Memoranda M-04-04, M-05-24, M- 11-11, and NIST Federal Information Processing Standard (FIPS) 201-2. Contractor delivered applications and systems shall be on the FIPS 201-2 Approved Product List (APL). If the Contractor delivered application and system is not on the APL, the Contractor shall be responsible for taking the application and system through the FIPS 201 Evaluation Program.

The Contractor shall ensure all Contractor delivered applications and systems support:

1. Automated provisioning and are able to use enterprise provisioning service.

2. Interfacing with VA’s Master Veteran Index (MVI) to provision identity attributes, if the solution relies on VA user identities. MVI is the authoritative source for VA user identity data.

3. The VA defined unique identity (Secure Identifier [SEC ID] / Integrated Control Number [ICN]).

4. Multiple authenticators for a given identity and authenticators at every Authenticator Assurance Level (AAL) appropriate for the solution.

5. Identity proofing for each Identity Assurance Level (IAL) appropriate for the solution.

6. Federation for each Federation Assurance Level (FAL) appropriate for the solution, if applicable.

7. Two-factor authentication (2FA) through an applicable design pattern as outlined in VA Enterprise Design Patterns.

8. A Security Assertion Markup Language (SAML) implementation if the solution relies on assertion based authentication. Additional assertion implementations, besides the required SAML assertion, may be provided as long as they are compliant with NIST SP 800-63-3 guidelines.

9. Authentication/account binding based on trusted Hypertext Transfer Protocol (HTTP) headers if the solution relies on Trust based authentication.

10. Role Based Access Control.

11. Auditing and reporting capabilities.

12. Compliance with VIEWS 00155984, PIV Logical Access Policy Clarification https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896.

The required Assurance Levels for this specific effort are Identity Assurance Level 3, Authenticator Assurance Level 3, and Federation Assurance Level 3.

6.3 INTERNET PROTOCOL VERSION 6 (IPV6)

The Contractor solution shall support the latest Internet Protocol Version 6 (IPv6) based upon the directives issued by the Office of Management and Budget (OMB) on August 2, 2005 and September 28, 2010 IPv6 technology, in accordance with the USGv6 Profile, NIST Special Publication (SP) 500-267 (https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication500-267.pdf), the Technical Infrastructure for USGv6 Adoption (https://www.nist.gov/programs-https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896 https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication500-267.pdf https://www.nist.gov/programs-projects/usgv6-program projects/usgv6-program), and the NIST SP 800 series applicable compliance (https://csrc.nist.gov/publications/sp) shall be included in all IT infrastructures, application designs, application development, operational systems and sub-systems, and their integration. In addition to the above requirements, all devices shall support native IPv6 and/or dual stack (IPv6 / IPv4) connectivity without additional memory or other resources being provided by the Government, so that they can function in a mixed environment. All public/external facing servers and services (e.g. web, email, DNS, ISP services, etc.) shall support native IPv6 and/or dual stack (IPv6/ IPv4) users and all internal infrastructure and applications shall communicate using native IPv6 and/or dual stack (IPv6/ IPv4) operations. Guidance and support of improved methodologies which ensure interoperability with legacy protocol and services in dual stack solutions, in addition to OMB/VA memoranda, can be found at:

https://www.voa.va.gov/documentlistpublic.aspx?NodeID=282.

6.4 TRUSTED INTERNET CONNECTION (TIC)

The Contractor solution shall meet the requirements outlined in Office of Management and Budget Memorandum M08-05 mandating Trusted Internet Connections (TIC), M08-23 mandating Domain Name System Security (NSSEC), and shall comply with the Trusted Internet Connections (TIC) Reference Architecture Document, Version 2.0 https://www.dhs.gov/sites/default/files/publications/TIC_Ref_Arch_v2.2_2017.pdf.

6.5 STANDARD COMPUTER CONFIGURATION

The Contractor IT end user solution that is developed for use on standard VA computers shall be compatible with and be supported on the standard VA operating system, currently Windows 10 (64bit), Internet Explorer 11 and Office 365 ProPlus. Applications delivered to VA and intended to be deployed to Windows 10 workstations shall be delivered as a signed .msi package with switches for silent and unattended installation and updates shall be delivered in signed .msp file formats for easy deployment using System Center Configuration Manager (SCCM) VA’s current desktop application deployment tool. Signing of the software code shall be through a vendor provided certificate that is trusted by VA using a code signing authority such as Verizon/Cybertrust or Symantec/VeriSign. The Contractor shall also ensure and certify that their solution functions as expected when used from a standard VA computer, with non-admin, standard user rights that have been configured using the United States Government Configuration Baseline (USGCB) and Defense Information Systems Agency (DISA) Secure Technical Implementation Guide (STIG) specific to the particular client operating system being used.

6.6 VETERAN FOCUSED INTEGRATION PROCESS (VIP)

The Contractor shall support VA efforts IAW the Veteran Focused Integration Process (VIP). VIP is a Lean-Agile framework that services the interest of Veterans https://www.nist.gov/programs-projects/usgv6-program https://csrc.nist.gov/publications/sp https://www.voa.va.gov/documentlistpublic.aspx?NodeID=282 through the efficient streamlining of activities that occur within the enterprise. The VIP Guide can be found at https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371. The VIP framework creates an environment delivering more frequent releases through a deeper application of Agile practices. In parallel with a single integrated release process, VIP will increase cross-organizational and business stakeholder engagement, provide greater visibility into projects, increase Agile adoption and institute a predictive delivery cadence. VIP is now the single authoritative process that IT projects must follow to ensure development and delivery of IT products

6.7 PROCESS ASSET LIBRARY (PAL)

The Contractor shall perform their duties consistent with the processes defined in the OIT Process Asset Library (PAL). The PAL scope includes the full spectrum of OIT functions and activities, such as VIP project management, operations, service delivery, communications, acquisition, and resource management. PAL serves as an authoritative and informative repository of searchable processes, activities or tasks, roles, artifacts, tools and applicable standards and guides to assist the OIT workforce, Government and Contractor personnel. The Contractor shall follow the PAL processes to ensure compliance with policies and regulations and to meet VA quality standards. The PAL includes the contractor onboarding process consistent with Section 6.2.2 and can be found at https://www.va.gov/PROCESS/artifacts/maps/process_CONB_ext.pdf. The main PAL can be accessed at www.va.gov/process.

6.8 AUTHORITATIVE DATA SOURCES

The VA Enterprise Architecture Repository (VEAR) is one component within the overall Enterprise Architecture (EA) that establishes the common framework for data taxonomy for describing the data architecture used to develop, operate, and maintain enterprise applications. The Contractor shall comply with the department’s Authoritative Data Source (ADS) requirement that VA systems, services, and processes throughout the enterprise shall access VA data solely through official VA ADSs where applicable, see below. The Information Classes which compose each ADS are located in the VEAR, in the Data & Information domain. The Contractor shall ensure that all delivered applications and system solutions support:

1. Interfacing with VA’s Master Veteran Index (MVI) to provision identity attributes, if the solution relies on VA user identities. MVI is the authoritative source for VA user identity data.

2. Interfacing with Capital Asset Inventory (CAI) to conduct real property record management actions, if the solution relies on real property records data. CAI is the authoritative source for VA real property record management data.

3. Interfacing with electronic Contract Management System (eCMS) for access to contract, contract line item, purchase requisition, offering vendor and vendor, and solicitation information above the micro-purchase threshold, if the solution relies https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371 https://www.va.gov/PROCESS/artifacts/maps/process_CONB_ext.pdf http://www.va.gov/process on procurement data. ECMS is the authoritative source for VA procurement actions data.

4. Interfacing with HRSmart Human Resources Information System to conduct personnel action processing, on-boarding, benefits management, and compensation management, if the solution relies on personnel data. HRSmart is the authoritative source for VA personnel information data.

5. Interfacing with Vet360 to access personal contact information, if the solution relies on VA Veteran personal contact information data. Vet360 is the authoritative source for VA Veteran Personal Contact Data.

6. Interfacing with VA/Department of Defense (DoD) Identity Repository (VADIR) for determining eligibility for VA benefits under Title 38, if the solution relies on qualifying active duty military service data. VADIR is the authoritative source for Qualifying Active Duty military service in VA.

6.9 SECURITY AND PRIVACY REQUIREMENTS

6.9.1 POSITION/TASK RISK DESIGNATION LEVEL(S)

In accordance with VA Handbook 0710, Personnel Security and Suitability Program, the position sensitivity and the level of background investigation commensurate with the required level of access for the following tasks within the PWS are:

Position Sensitivity and Background Investigation Requirements by Task Task Number Tier1 / Low Risk Tier 2 / Moderate

Risk Tier 4 / High Risk

5.1

5.2

5.3

5.4

5.5

5.6

5.7

5.8

The Tasks identified above and the resulting Position Sensitivity and Background Investigation requirements identify, in effect, the Background Investigation requirements for Contractor individuals, based upon the tasks the particular Contractor individual will be working. The submitted Contractor Staff Roster must indicate the required Background Investigation Level for each Contractor individual based upon the tasks the Contractor individual will be working, in accordance with their submitted proposal.

6.9.2 RESPONSIBILITIES

Contractor Responsibilities:

a. Engages with Customer throughout the Project, keeping Customer informed of timelines and progress toward completion throughout the Project.

b. Completes all items listed under Delivery Team Responsibilities in Schedule 1 for each Deliverable.

c. Shares training resources as appropriate for each Deliverable, which may be in the form of live online training, online materials, and/or free online webinars.

d. Offers guidance and support required to ensure Customer can fulfill responsibilities listed in Schedule 1 for each Deliverable.

e. The purpose of the Project is to train Customer to be able to manage the program when the Project is complete. As such, the Delivery Team does not perform full setup and configuration of the Survey Solution as a full-service implementation. Please see Schedule 1 for a list of Delivery Team and Customer responsibilities.

Customer Responsibilities:

a) Engages actively throughout the Project, following a cadence decided with Delivery Team during kickoff call; changes or cancellations of any meetings require 24 hours’ notice in order to avoid forfeiture of allotted time.

b) Manages User Acceptance Testing (“UAT”) process and any special testing requirements, ensuring that each stage of the Project is complete and the scope of work has been met. This may include:

a. Uploading sample data to the Survey platform to test system functionality and license settings.

b. Validating that scoped features and settings were implemented correctly and meet the requirements of the Project.

c. Engaging other stakeholders within Customer’s organization as needed to test technical or functional aspects of the Survey platform.

c) As needed, provides resources to fill all required roles for successful implementation, which may include project sponsorship, signatory, stakeholder management, project coordination, customer experience lead, technical lead, operational support.

d) Completes all steps listed under Customer Responsibilities in Schedule 1 for each applicable Deliverable.

e) Maintains all features included in the license after the implementation period, including any updates to Deliverables created during the Project, as well as the creation of any new Deliverables, including surveys and dashboards.

f) For projects that involve a new license setup, provides required information for setup of brand administrator accounts; brand administrator users may create additional user accounts and manage access to the license, in accordance with any limitations specified in the license terms.

CHANGE ORDERS:

a) If Customer or Delivery Team wishes to change the scope of the Project, they will submit details of the requested change to the other in writing. Delivery Team will, within a reasonable time after such request is received, provide a written estimate to Customer of changes to Project cost, timeline, and/or scope.

b) Promptly after receipt of the written estimate, Customer and Delivery Team will negotiate and agree in writing on the terms of such change (a “Change Order”).

Each Change Order complying with this Section will be considered an amendment to this Order Form.

6.10 METHOD AND DISTRIBUTION OF DELIVERABLES

The Contractor shall deliver documentation in electronic format, unless otherwise directed in Section B of the solicitation/contract. Acceptable electronic media include:

Microsoft Word, Microsoft Excel, Microsoft PowerPoint, Microsoft Project, Microsoft Visio and Adobe Postscript Data Format (PDF).

6.11 PERFORMANCE METRICS

The table below defines the Performance Standards and Acceptable Levels of Performance associated with this effort.

Performance Objective

Performance Standard Acceptable Levels of Performance

A. Technical / Quality of Product or Service

1. Demonstrates understanding of requirements

2. Efficient and effective in meeting requirements

3. Meets technical needs and mission requirements

4. Provides quality services/products

5. Incorporates “ease of use” Human Centered Design principles in any software developed.

Satisfactory or higher

B. Project Milestones and Schedule

1. Established milestones and project dates are met

2. Products completed, reviewed, delivered in accordance with the established schedule

3. Notifies customer in advance of potential problems

Satisfactory or higher

C. Cost & Staffing 1. Currency of expertise and staffing levels appropriate to perform tasks required

2. Personnel possess necessary knowledge, skills and abilities to perform tasks

Satisfactory or higher

D. Management 1. Integration and coordination of all activities to execute effort

Satisfactory or higher

The COR will utilize a Quality Assurance Surveillance Plan (QASP) throughout the life of the contract to ensure that the Contractor is performing the services required by this PWS in an acceptable level of performance. The Government reserves the right to alter or change the surveillance methods in the QASP at its own discretion. A Performance Based Service Assessment will be used by the COR in accordance with the QASP to assess Contractor performance.

ADDENDUM A – ADDITIONAL VA REQUIREMENTS, CONSOLIDATED

ADDENDUM B – INFORMATION SECURITY REQUIREMENTS

The Contractor shall ensure adequate LAN/Internet, data, information, and system security in accordance with VA standard operating procedures and standard PWS language, conditions, laws, and regulations. The Contractor’s firewall and web server shall meet or exceed VA minimum requirements for security. All VA data shall be protected behind an approved firewall. Any security violations or attempted violations shall be reported to the VA Program Manager and VA Information Security Officer as soon as possible. The Contractor shall follow all applicable VA policies and procedures governing information security, especially those that pertain to certification and accreditation.

Contractor supplied equipment, PCs of all types, equipment with hard drives, etc. for contract services must meet all security requirements that apply to Government Furnished Equipment (GFE) and Government Owned Equipment (GOE). Security Requirements include: a) VA Approved Encryption Software must be installed on all laptops or mobile devices before placed into operation, b) Bluetooth equipped devices are prohibited within VA; Bluetooth must be permanently disabled or removed from the device, unless the connection uses FIPS 140-2 (or its successor) validated encryption,

c) VA approved anti-virus and firewall software, d) Equipment must meet all VA sanitization requirements and procedures before disposal. The COR, CO, the PM, and the Information Security Officer (ISO) must be notified and verify all security requirements have been adhered to.

Each documented initiative under this contract incorporates VA Handbook 6500.6, “Contract Security,” March 12, 2010 by reference as though fully set forth therein. The VA Handbook 6500.6, “Contract Security” shall also be included in every related agreement, contract or order. The VA Handbook 6500.6, Appendix C, is included in this document as Addendum B.

Training requirements: The Contractor shall complete all mandatory training courses on the current VA training site, the VA Talent Management System (TMS) 2.0, and will be tracked therein. The TMS 2.0 may be accessed at https://www.tms.va.gov/SecureAuth35/ . If you do not have a TMS 2.0 profile, go to https://www.tms.va.gov/SecureAuth35/ and click on the “Create New User” link on the TMS 2.0 to gain access.

Contractor employees shall complete a VA Systems Access Agreement if they are provided access privileges as an authorized user of the computer system of VA.

A1.0 VA Enterprise Architecture Compliance The applications, supplies, and services furnished under this contract must comply with VA Enterprise Architecture (EA), available at http://www.ea.oit.va.gov/index.asp in force at the time of issuance of this contract, including the…