P09 Retirement Administration Software as a Service Solution PWS for RFI.pdf

PERFORMANCE WORK STATEMENT

VETERANS BENEFITS ADMINISTRATION (VBA) RETIREMENT ADMINISTRATION SOFTWARE AS A SERVICE

(SaaS)

SUBSCRIPTION SOLUTION

1. PURPOSE

VBA has a need for a Commercial off‐the‐shelf web‐based, Retirement Administration software, which provides a comprehensive single source repository for VBA employees Health Insurance, Life Insurance, Dental & Vision Insurance, Long Term Care Insurance, Flexible Spending Account, Workers Compensation Benefits, Pay and Leave Retirement services, Thrift Savings Plan, and Social Security user information.

Retirements require benefits calculator(s)/report generation with capabilities to accurately compute various complex estimates needed in assisting employees with their retirement decisions and review all available benefits to VA members. The calculator software will be used for computing retirement benefits to employees under the Civil Service Retirement System (CSRS), Federal Employees Retirement System (FERS), the Federal Thrift Savings Plan and the Social Security program. The calculator software will also be available as “self‐service” to employees, for computing Retirement benefits under the Civil Service Retirement System (CSRS), and Federal Employees Retirement System (FERS).

Retirement services require entitlements calculator(s)/report generation with capabilities to accurately compute various complex estimates needed in assisting employees with their retirement decisions and review all available benefits to VA members. The Service Computation Date (SCD) calculator software will be used for computing retirement benefits to employees under the Civil Service Retirement System (CSRS), Federal Employees Retirement System (FERS), the Federal Thrift Savings Plan and the Social Security program and assisting with onboarding VA employees with prior federal service. The calculator software will also be available as “self‐service” to employees, for computing Retirement benefits under the Civil Service Retirement System (CSRS), and Federal Employees Retirement System (FERS).

Additionally, the application generates approved versions of forms required for processing that meet standards and guidance set forth by the Office of Personnel Management (OPM).

To achieve the goal of a fully integrated retirement system, VA plans to procure a Software‐as‐a‐Service (SaaS) Federal Retirement Administration solution that meets the goals and objectives of the VA HR Line of Business (HRLoB). The Software should be offered on a subscription basis which allows unrestricted access to all the features and functionality which will automate the entire retirement and providing estimates, computations, analysis, reporting, tools, and forms to completed retirement documents submitted to Defense Finance and Accounting Services (DFAS) and OPM. The system shall comply with all VA, VBA, DFAS, and OPM requirements for retirements and system security requirements.

2. SCOPE

The Contractor shall provide a Retirement and Benefits production software and training/test environment with an integrated suite of web‐based software modules specifically for the Federal security, which combines tools and capabilities for human resource specialists, managers, and employees into a common system. The Software must contain a flexible, bi‐directional interface to communities with VA’s payroll/human resource information system (HRIS), third‐party providers, and any outside parties with secure electronic file transfer protocols (sFTP) for electronic file (eFiles) to export and log transactions as necessary. The Software must be certified and/or accredited under FIPS

199 and NIST 800‐60. The Software shall provide HR Specialists with a suite of tools for assisting employees with their retirement decisions which increases productivity and lowers cost by providing a single framework for organizing and managing high‐volume caseloads.

The Software must be capable of using Personally Identifiable Information (PII), which will be provided through the DFAS payroll system and VA HR Smart (PeopleSoft) system employee information. DFAS serves as the data collection for the employment and compensation data. The Software must be capable of electronically submitting retirement packages to the DFAS office.

HR Smart serves as the official data base of record for VA member employee information. Only pertinent PII that is necessary to accurately compute retirement estimates will be extracted from DFAS and HR Smart. The Software must be capable of integrating with HR Smart (People Soft) and allow for automated electronic data feeds from HR Smart.

The Software must be capable to electronic submit retirement packages to Office of Personnel Management (OPM).

3. FUNCTIONAL AND TECHNICAL REQUIREMENTS

Application Features / Functionality

Calculate creditable years of service in conjunction with the Federal Retirement Entitlements (FRB) retirement calculator.

The retirement software must feature a retirement calculator for federal retirement, Service Computation Date, Average Salary, and entitlements calculations.

This software must be designed for HR Specialist to use a centralized database of personnel and retirement data to perform calculations for Federal retirement, Thrift Savings Plan annuity options, Average Salary, Deposits/Redeposits, Part‐time Proration, FERCCA Entitlement Comparisons, Severance Pay, Reemployed Annuitant Supplemental Annuity, CSRS Voluntary Contributions, and Social Security entitlements.

Software must be able to utilize two factor authentication connections compatible with the VA Personal Identity Verification (PIV) Access card.

Software designed for an unlimited number of users and an on‐line tutorial for training needs.

The software must have eRetirement capability for employees to self‐service and obtain their own estimates and projection and eSeminars available for self‐service retirement counseling.

Retirement Entitlements Calculation Engine that can accurately calculate retirement entitlements associated with nearly every type of Federal employment.

Handles voluntary, early, and disability retirement entitlements; part‐time and intermittent service; deposits and redeposits owed; Social Security/ FERS supplement entitlements.

Thrift Savings Plan entitlements; survivor entitlements; and severance pay.

The solution must contain CSRS, FERS, and other OPM forms for electronic form filling, data storage, and case management.

Data in the central database may be updated as determined (frequency) with data from the agency payroll/personnel system. (API, flat file imports)

Unlimited HR user accounts should be available with full access to the Retirement Calculator to address their duties to prepare retirement estimates, counsel employees and prepare the retirement application and related forms for transmittal to the Office of

Personnel Management (OPM).

The software must include an OPM vetted Federal Employees Erroneous Retirement Coverage Correction Act (“FERCCA Calculator”), a tool that facilitates the management and filing of electronic forms for retirement application packages and service history calculations.

Software must be in compliance with section 508 of the Rehabilitation Act of 1973, as amended (29U.S.C 794d).

A Forms Manager within the Retirement section that facilitates the management and filling of electronic forms for retirement application packages and service history calculations.

Secure portal access for Employees to calculate their own retirement estimates and obtain their Entitlements Statement “on‐demand”.

A Retirement Planner that also combines federal and non‐federal retirement funds (including spouses) and estimates probability of meeting the retirement goals established by the employee. (Total USER Compensation Statement)

The contractor shall perform a quarterly review of ATC creditable service determinations that were completed by the servicing HR offices to ensure the HR offices are correctly applying the laws, rules, regulations, and guidance related to the special provisions of ATC retirement.

The software must enable users to initiate requests which allows HR staff to capture and flag a case with a status, date, and comments.

The software must allow employees the opportunity for continued updates on pending

HR actions and email dialogue with the HR office.

Provides standard and ad hoc reports for the HR community to meet management reporting and program administration requirements.

Software that downloads data from payroll provider. This data import shall automatically create a record in the retirement calculator and/or other applications for every employee and populate it with information regarding their current entitlements enrollment and salary history going back as far as payroll office has data.

The opportunity to move completed (e‐files) packet forms established transmission directly to DFAS, OPM, and eOPF.

Any data is the property of Department of Veterans Affairs, Veterans Health Administration.

Customer Features / Resource Management

Provide a centralized dashboard (benefits/TSP/Insurance/retirements, etc.)

Multiple Case Requests availability with rules/restrictions

Home user screen page customizable for optional entitlement selections

Case management to Open, Close, Re‐Open tracked activity

Case Request ICONs for Training/Document informational section

Provide a user self‐service calculator (Retirements, High Three Salary, Severance/VSIP)

User "Extended Attributes" (Look up, drop down selector, text, yes/no check box)

Customer Case and system e‐file attachments (excel, .pdf, .tiff, .gif, .png, .jpg, .bmp, word)

User notes section for detailed interactions not case specific (HR Views Only)

Customer email notifications

Custom email functionality (HR/user responses "bi‐directional")

Detailed History notes section for tracking

Ability to accept and upload VA’s data file from current vendor in XLM file format

Disaster Recovery

Vendor provides “Hot” disaster recovery

In the event of more than 24 Hours outage, for a full recovery, vendor to provide a substitute shell (sandbox) for continued VA productivity/retirement and SCD calculations

Vendor to provide cloud document access ‐ only in the event of a disaster

HR Features / Functionality

Case creations for multiple types of HR/Entitlements actions to include:

Case Management View(s) – complete view of assigned HR cases with filtering Case Type(s) – multiple Case Assignment(s) designated group assignments/automated/internal transferring (HR to HR) Case Reporting Case Workflow functionality Case "Extended Attributes" (Look up, drop down selector, text, yes/no check box) Case History Notes section (manual and automated) Case user resolution response section Case e‐file attachments (excel, .pdf, .tiff, .gif, .png, .jpg, .bmp, word)

ROLE Permissions/Administration HR Only HR Read Only HR Manager SCD Report Only Administrator

Assignable Permissions to Roles System Reporting Case Type (Create/Edit/View) permissions

Domain Assignments One to multiple assignments availability Case creation specific to domain(s) (manual/automated)

4. SPECIFIC TASKS AND DELIVERABLES

The contractor shall perform the tasks and complete the associated deliverables under this task order by the scheduled due dates within the overall period of performance. If the contractor cannot present those deliverables specified by this task order by the required due date, then the contractor shall provide a written explanation to the Contracting Officer (CO) within three business days of the required due date. This written transmittal shall include the reasons for the delay; when the Contractor knew or should have known a delay would incur; due diligence taken to mitigate the problems; the impact on the overall project; and a firm commitment of when the work is to be completed. The CO will then review the facts and issue a response in accordance with applicable regulations. For other problems or concerns, the contractor shall notify VA Project manager (PM), Contracting Officer’s Representative (COR), and CO, in writing, immediately if problems arise adversely impacting the performance of the contract. In most instances, the COR will serve as the contractor’s primary point of contact.

The contractor shall provide services, materials, and equipment to complete the tasks described below.

Within 10 business days after task order effective date (or as agreed upon between the VBA PM and contractor), the contractor shall participate in a task order kick‐off meeting with the program office comprised of key stakeholders and subject matter experts (SMEs) to be identified by the VBA PM, including the COR and the CO. The kick‐off meeting will be conducted via video or teleconference.

Prior to the Kickoff, the Contractor shall collaborate with the VBA COR, then prepare and distribute the Kickoff meeting agenda to planned attendees. During the Kickoff meeting, the contractor shall present the details of its intended approach, work plan and project schedule, along with a staff roster. The contractor shall prepare and deliver to attendees meeting minutes captured during the Kickoff.

Deliverables:

1A Kickoff Meeting Participation/ Presentation 1B Kickoff Agenda (before) and Meeting Minutes (after) 1C Staff Roster

The contractor shall provide a retirement software with licenses to accommodate up to 36,000 users annually. Included in the subscription includes hosting, maintenance, helpdesk, security FedRAMP and VA ATO (Authority to Operate) maintenance, and system training.

Licensing for this retirement calculator will grant users access to the following features all of which are OPM‐ or VBA‐required:

Computational Functionality Full and part‐time retirement annuity estimates

Optional

MRA+10

Involuntary/Early

Deferred

Disability

Survivor Benefits

Special Groups (LEO, Firefighters, ATCs)

Phased Retirement

VA Title‐38

5.2 LICENSING

5.1 POST‐AWARD KICK‐OFF MEETING (NSP)

Other Retirement Computations FERS Annuity Supplement

FERCCA Election Comparison

Alternative Form of Annuity

Supplemental Annuity for Reemployed Annuitants

CSRS Voluntary Contributions

Part‐Time Service Proration Factors

Severance Pay

Lump‐Sum Annual Leave Payment

Divorce/Court Orders – Former Spouse

Service Credit Computations Civilian Deposits

Civilian Redeposits

Post‐1956 Military Service Deposits

Peace Corp/VISTA Service Deposits

Service Analysis Retirement Coverage Determination

Creditability of Service Determination

FERCCA Determination

Average Salary Computations High‐3 Salary

Breaks in Service

Less Than 3‐Year Period

Part‐Time Employment

Service Computation Dates Retirement SCD

Leave/RIF SCD

TSP SCD

Agency SCD Social Security Estimates

Retirement Benefits

Survivor Benefits

Disability Benefits

Amount of CSRS Offset

Windfall Elimination Penalty (WEP) TSP Tools

Single/Joint Life Annuities

Withdrawal Estimates

Account Balance Projection Loan Calculator

Retirement Calculator Reports

Create various reports to include retirement analyses, including retirement estimates, annuity estimates, service computation dates, average salary, part‐time proration factor, Thrift Savings Plan, Social Security, military service, and civilian deposit/redeposits. The report displayed on screen shall look identical when being printed on paper and can be saved in PDF format.

Annuity estimates shall be computed with the utmost accuracy which includes considering the applicable reductions and deductions from their gross monthly annuity computation. The reductions and deductions from the gross monthly annuity shall include calculations for health benefits, life insurance, dental and vision premiums, federal tax, survivor benefits, unpaid deposits/redeposits, alternative annuity, and early retirement age.

Forms The license shall provide access to produce any OPM authorized or custom requested forms and come with an integrated forms package containing a variety of retirement and benefits related forms. Forms will automatically pre‐populate with employee information saving significant time and minimizing manual data entry.

2A Retirement software with licenses to accommodate up to 36,000 users 2B Computational Functionality, Retirement Calculator Report, Forms

The Contractor shall provide any/all software subscriptions necessary to support a retirement calculator, to allow up to 36K VBA employees access, in addition to providing including installation support through help desk support and a data loss prevention mechanism. The Contractor shall provide hosting for the retirement calculator in a secure environment made available to VA via web access. Contractor shall also provide support services via telephone or email. For system assistance during standard support hours; the times are 9:00 AM to 5:00 PM EST Monday – Friday, excluding Federal Holidays.

3A Software subscriptions and support for up to 36,000 VBA employees.

Contractor shall provide a separate Service Computation Date (SCD) only platform. This platform shall provide users with the following features:

5.3 RETIREMENT CALCULATOR SUPPORT

5.4 SCD ONLY PLATFORM

Computational Functionality

Service Computation Dates

Retirement SCD

Leave/RIF SCD

TSP SCD

Agency SCD

Social Security Estimates Retirement Benefits

Survivor Benefits

Disability Benefits

Amount of CSRS Offset

Windfall Elimination Penalty (WEP)

TSP Tools Single/Joint Life Annuities

Withdrawal Estimates

Account Balance Projection Loan Calculator

Forms The license shall provide access to produce any OPM authorized or custom requested forms and come with an integrated forms package containing a variety of retirement and entitlements related forms. Forms will automatically pre‐populate with employee information saving significant time and minimizing manual data entry.

4A SCD Only Software and support for 300 HR personnel 4B Computational Functionality, Forms

The Contractor shall provide Case management functionality to manage case activity and tracking with extended attribute functionality to include look‐up/drop down values, free form text, and Boolean values. The case management system will include user case management system generated emails with customized (editable) agency responses. The functionality will include HR administrative permissions to include case view, case edit, case deletion, case re‐open/close management. Functionality will include user history logs with date time stamps and action details

5.5 CASE MANAGEMENT

and document repository. Document retention for up to 36,000 users to include .pdf, .tiff, .gif, .png, .jpg, .bmp, .xls, and .doc

5A Case Management 5B User Case management System Generated Emails 5C HR Administrative Permissions 5D User History Logs 5E Document Repository

The Contractor shall send an extensible markup language file to the program office on a daily basis.

This will be a case export XML job.

Deliverable:

6A Extensible Markup Language File

The Contractor shall provide user virtual training under this optional task. The Contractor shall provide all training materials, soft and hard copies, per the Government’s request. Each training session shall be at least 90 minutes for up to 50 people. The Contractor shall ensure that users have access to training materials online, including web seminars for users’ quick reference.

Trainer’s guide

Participant handbook

All supplemental materials job aids, videos, etc.

The contractor must ensure that all training materials are free of errors and contain relevant and up‐ to‐date references, PowerPoint presentations and/or handouts.

Deliverable:

7A Virtual training

The Contractor shall provide transition support of the product. The Contractor shall provide a plan for 60 days of outgoing transition support for transitioning work from the current task order to a follow‐on task order or other entity. This transition may be to a Government entity or to another Contractor or to the incumbent Contractor under a new task order. In accordance with the Government‐approved plan, the Contractor shall assist the Government in implementing a complete transition from this contract to a new support provider. This shall include formal coordination with Government staff and successor staff and management. It shall also include delivery of copies of all artifacts delivered under this contract including all VA data, as well as existing policies and procedures, training materials, and delivery of baseline metrics and statistics.

5.6 EXTENSIBLE MARKUP LANGUAGE FILE

5.7 VIRTUAL TRAINING (OPTIONAL TASK)

5.8 TRANSITION SUPPORT (OPTIONAL TASK)

This Transition Plan shall include:

1. Coordination with Government representatives.

2. Review, evaluation, and transition of current support services.

3. Transition of historic data to a new contractor system.

4. Transfer of all necessary business and/or technical documentation.

Deliverables 8A Transition Plan 8B Transition Support

5. DELIVERY SCHEDULE

Days used in the table below refer to calendar days unless otherwise stated. Deliverables with due dates falling on a weekend or holiday shall be submitted the following Government workday after the weekend or holiday. The Contractor shall deliver documentation in electronic format, unless otherwise directed in Section B of the solicitation/contract. Acceptable electronic media include Microsoft Word, Microsoft Excel, Microsoft PowerPoint, Microsoft Project, Microsoft Visio, and Adobe Postscript Data Format (PDF). Deliverables annotated in yellow will not be included in the price cost schedule they are identified as the cost of doing business with the Government.

Deliverables

Task/ Deliv.

Deliverable Description Qty Base (B) or Option (O)

Due

5.1 POST‐AWARD KICK‐OFF MEETING

1A Kickoff Meeting Participation/ Presentation

1 B only Within Ten (10) business days of the start of period of performance

1B

Kickoff Agenda and Meeting Minutes

B only

Agenda‐ 2 business days prior to Kickoff

Minutes‐ 3 business days following Kickoff

1C Staff Roster 1 B only At Kickoff Meeting

5.2 LICENSING

2A Retirement software with up to 36,000 Licenses for employee user

B/O

Available NLT 14 calendar days from contract award

2B Computational Functionality, Retirement Calculator Report, Forms

B/O

Available NLT 14 calendar days from contract award

5.3 RETIREMENT CALCULATOR SUPPORT

3A Software subscriptions necessary to support a retirement calculator for up to 36,000 employee users

1 B/O Available NLT 14 calendar days from contract award

5.4 SCD ONLY SOFTWARE

4A SCD Only Software and support for up to 300 HR personnel

1 B/O Available NLT 14 calendar days from contract award

4B Computational Functionality, Forms

1 B/O Available NLT 14 calendar days from contract award

5.5 CASE MANAGEMENT

5A Case Management 1 B/O Available NLT 14 calendar days from contract award

5B User Case management System Generated Emails

1 B/O Available NLT 14 calendar days from contract award

5C HR Administrative Permissions

1 B/O Available NLT 14 calendar days from contract award

5D User History Logs 1 B/O Available NLT 14 calendar days from contract award

5E Document Repository 1 B/O Available NLT 14 calendar days from contract award

5.6 EXTENSIBLE MARKUP LANGUAGE FILE

6A Extensible Markup Language File

365 B/O Available NLT 14 calendar days from contract award

5.7 VIRTUAL TRAINING (OPTIONAL TASK)

7A Virtual Training 1 B/O Available NLT 14 calendar days from contract award

5.8 TRANSITION SUPPORT (OPTIONAL TASK)

8A Transition Plan 1 B/O Sixty (60) business days prior to contract termination

8B Transition Support

B/O On‐going monthly during the final 90 days of contract

5.1 FORMAL ACCEPTANCE OR REJECTION OF DELIVERABLES:

The Government will have five (5) business days to review each deliverable and provide feedback/ comments. The contractor shall have three (3) business days to incorporate feedback/comments and make appropriate revisions. The contractor shall provide the revised version of each deliverable to the Contracting Officer Representative (COR) and VBA Program Manager (VBA PM). The COR will review and determine final acceptance by the Government. The COR will notify the contractor of final acceptance within five business days. Failure to receive the COR notification within this time shall not serve as and/or be construed as final acceptance.

The contractor shall be responsible for adhering to all pertinent VA standards including but not limited to ensuring that all documentation and deliverables are stored on appropriate VA servers within one week of their completion. The contractor shall use the Microsoft TEAMS for all pertinent conference calls, and the VA Exchange server for all pertinent email. Upon assignment of VA email accounts, use of external email accounts for the purpose of VA communications and business will be prohibited. The contractor shall be responsible for adhering to all pertinent VA information technology policies and procedures, which will be made available at the contractor’s request on award.

5.2 METHOD AND DISTRIBUTION OF DELIVERABLES

All deliverables shall be submitted as Oral Presentation (when applicable), Editable Microsoft Office 365 compatible file (i.e., Word, Excel, Project, and/or PowerPoint) or Adobe.pdf as requested by the VBA Program Manager and COR.

6.2 PERFORMANCE METRICS

The table below defines the Performance Standards and Acceptable Performance Levels for Objectives associated with all tasks outlined in this PWS.

Performance Objective Performance Standard Minimum Acceptable Performance Levels

Method(s) of Surveillance

Technical Needs Demonstrates understanding of requirements

Efficient and effective in meeting requirements

Meets technical needs and mission requirements

Offers quality services/ products

95% Inspection/ review, direct observation

Project Milestones and Schedule

Quick response capability

Products completed, reviewed, delivered in timely manner

Notifies customer in advance of potential problems, recommends solutions

Staffing Currency of Expertise Personnel possess necessary knowledge, skills, and abilities to perform tasks

Value Added Provided valuable service to Government

Services/ products delivered were of desired quality

Proactively meets government’s needs, including responding to changing requirements, systems, etc.

6.3 OPERATIONS AND MAINTENANCE SUPPORT

The Contractor shall provide support for the SaaS (Software as a Solution), system configuration, change requests, bug defects necessary to support the contract. The Contractor shall provide technical support of the solution. The Contractor shall provide unlimited business‐day telephone and/or on‐line support.

A business day is defined as Monday through Friday during standard business hours, the times are 9:00 AM to 5:00 PM EST Monday – Friday, excluding Federal Holidays.

Support includes technical assistance in troubleshooting issues, problems or symptoms with the software and answering questions regarding documented properties, methods, events, function calls, parameters, and specific functionality of software components. The Contractor shall acknowledge receipt of all support inquires and provide resolution of support requests according to the timelines shown in the table below. The Contractor shall communicate to the VA PM (Project Manager) on system outages to include:

a. 72 hours prior to scheduled outages

b. Within 1 hour of identified emergency issues

The Contractor shall provide to the Government System Performance Specification showing system performance and up‐time, specific indication of system issues, restarts and system maintenance activities including scheduled and unscheduled, and best practices used.

Table 1. Response Times for Support

Severity Code Tier 2 initial response to customer

Tier 2 escalates to Tier 3 for initial contact

Tier 3 response back to Tier 2

Tier 2 requests updates from Tier 3 based on SLA resolution

Resolution time based on SLA from time incident initially reported

1 – Critical 15 minutes 0‐15 minutes 15 minutes On call until issue resolved or hourly status check

0‐2 business hours

2 – Serious 1 hour 30 minutes 1 hour On call until issue resolved or hourly status check

2‐4 business hours

3 – Moderate 4 hours 1 hour 4 hours Daily 4‐8 business hours

6. PERIOD OF PERFORMANCE

The period of performance shall be 12‐months from date of award, with four 12‐month option periods (if exercised).

7. PLACE OF PERFORMANCE

N/A – Contract is for a SaaS application.

8. CONTRACT TYPE

Firm Fixed Price (FFP).

9. APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

a. 44 U.S.C. § 3541, “Federal Information Security Management Act (FISMA) of 2002”

b. Federal Information Processing Standards (FIPS) Publication 140‐2, “Security Requirements for

Cryptographic Modules”

c. FIPS Pub 201, “Personal Identity Verification of Federal Employees and Contractors,” March

d. 10 U.S.C. § 2224, "Defense Information Assurance Program"

e. Software Engineering Institute, Software Acquisition Capability Maturity Modeling (SA CMM)

Level 2 procedures and processes

f. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

g. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”

h. Department of Veterans Affairs (VA) Directive 0710, “Personnel Suitability and Security

Program,” October 11, 2018

i. VA Directive 6102, “Internet/Intranet Services,” August 5, 2019

j. 36 C.F.R. Part 1194 “Electronic and Information Technology Accessibility Standards,” December

21, 2000

k. OMB Circular A‐130, “Managing Information as a Strategic Resource”, November 28, 2000

l. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed Services (CHAMPUS)”

m. An Introductory Resource Guide for Implementing the Health Insurance Portability and

Accountability Act (HIPAA) Security Rule, October 2008

n. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended by the Workforce

Investment Act of 1998 (P.L. 105‐220), August 7, 1998

o. Homeland Security Presidential Directive (12) (HSPD‐12), August 27, 2004

p. VA Directive 6500, “VA Cybersecurity Program”, February 24, 2021

q. VA Handbook 6500, “Risk Management Framework for VA Information Systems VA Information

Security Program,” February 24, 2021

r. VA Handbook 6500.1, “Mobile Device Security Policy”, February 15, 2018

s. VA Handbook 6500.2, “Management of Data Breaches Involving Sensitive Personal

Information”, March 12, 2019

t. VA Handbook, 6500.5, “Incorporating Security and Privacy in System Development Lifecycle”

March 22, 2010

u. VA Handbook 6500.6, “Contract Security,” March 12, 2010

v. National Institute Standards and Technology (NIST) Special Publications, NIST SP 800‐145, NIST

SP 800‐207, NIST 800‐210

10. ASSESSMENT, AUTHORIZATION, AND CONTINUOUS MONITORING

1. The information system solution selected by the Contractor shall comply with the Federal

Information Security Management Act (FISMA).

2. The Contractor shall comply with FedRAMP requirements as mandated by Federal laws and policies, including making available any documentation, physical access, and logical access needed to support this requirement.

3. Following guidance from the Federal CIO, VA will utilize existing JAB ATO or agency ATO issued by another agency as a starting point for FedRAMP requirements. If neither of those exist, VA will sponsor FedRAMP ATO. VA will be using the FedRAMP baselines as a starting point, since they are specifically tailored for cloud services.

4. The Contractor shall, where applicable, assist with the VA ATO Process to help achieve agency authorization of the cloud service or migrated application.

5. The Contractor shall complete a FedRAMP System Security Plan (SSP) and supporting documentation within 45 calendar days after contract award. (If Data Security Categorization is High Impact, this will be due 85 calendar days after contract award.)

6. The Contractor shall complete a Third‐Party Assessment Organization (3PAO) Security Assessment Plan (SAP) within 90 calendar days after contract award. (If Data Security Categorization is High Impact, this will be due after 130 calendar days after contract award.)

7. The Contractor shall complete a 3PAO Security Assessment Report (SAR) within 140 calendar days after contract award. (If Data Security Categorization is High Impact, this will be due 180 calendar days after contract award.)

8. The Contractor shall afford VA access to the Contractor’s and Cloud Service Provider’s (CSP) facilities, installations, technical capabilities, operations, documentation, records, and databases.

9. If new or unanticipated threats or hazards are discovered by either VA or the Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party in accordance with the security addendum B.

10. The Contractor shall not release any data without the consent of VA in writing. All requests for release must be submitted in writing to the Contracting Officer’s Representative (COR)/Contracting

Officer (CO).

11. In order for live VA data to be used in this system, a FedRAMP Authorization and Agency ATO will be required.

A. FedRAMP System Security Plan (SSP) and supporting documentation

B. VA Implementation Diagram: This is a VA specific architecture diagram demonstrating the proposed implementation of this system at VA (VAID)

C. 3PAO Security Assessment Plan (SAP)

D. 3PAO Security Assessment Report (SAR)

FedRAMP

There are relatively few SaaS products that are already FedRAMP authorized. Because of this, VA has created a process to onboard new SaaS applications to VA, including sponsoring the desired SaaS product for FedRAMP. Some important points to know:

VA has dedicated specific resources to help bring a newly‐awarded vendor into a FedRAMP Authorization (the DTC SaaS Team). A FedRAMP Authorization is not necessary at the time of award.

By FedRAMP policy, Agencies cannot sponsor a product for FedRAMP unless they already have an awarded contract in place with the vendor. So, no product could ever be added to FedRAMP by Agency sponsorship if it had to be Authorized prior to award.

Possible Invoicing Schedule (TBD)

The biggest challenge is to avoid paying for subscriptions that the VA cannot utilize. Since this SaaS

Product is processing VA data it cannot be utilized until FedRAMP Authorization and Agency ATO are both approved.

However, in order to best use VA resources and not pay for something that the end user is not permitted to access, Product Engineering and the Digital Transformation Center recommends that the following deliverable timelines be included in procurement documents to accelerate the FedRAMP preparation process.

Completed FedRAMP System Security Plan (SSP), VAID, and all supporting documentation (10% of contract value billable upon receipt)

3PAO Security Assessment Plan (SAP) (10% of contract value billable upon receipt)

3PAO Security Assessment Report (SAR) (10% of contract value billable upon receipt) The remaining 70% will be billable when all ATO work is complete

13. ADDENDUM A

Cyber and Information Security Requirements for VA IT Services The Contractor shall ensure adequate LAN/Internet, data, information, and system security in accordance with VA standard operating procedures and standard PWS language, conditions, laws, and regulations. The Contractor’s firewall and web server shall meet or exceed VA minimum requirements for security. All VA data shall be protected behind an approved firewall. Any security violations or attempted violations shall be reported to the VA Program Manager and VA Information Security Officer as soon as possible. The Contractor shall follow all applicable VA policies and procedures governing information security, especially those that pertain to certification and accreditation.

Contractor supplied equipment, PCs of all types, equipment with hard drives, etc. for contract services must meet all security requirements that apply to Government Furnished Equipment (GFE) and Government Owned Equipment (GOE). Security Requirements include a) VA Approved Encryption Software must be installed on all laptops or mobile devices before placed into operation, b) Bluetooth equipped devices are prohibited within VA; Bluetooth must be permanently disabled or removed from the device, c) VA approved anti‐virus and firewall software, d) Equipment must meet all VA sanitization requirements and procedures before disposal. The COR, CO, the Project Manager, and the Information Security Officer (ISO) must be notified and verify all security requirements have been adhered to.

Each documented initiative under this contract incorporates VA Handbook 6500.6, “Contract Security,” March 12, 2010, by reference as though fully set forth therein. The VA Handbook 6500.6, “Contract Security” shall also be included in every related agreement, contract, or order. The VA Handbook 6500.6, Appendix C, is included in this document as Addendum B.

Training requirements: The Contractor shall complete all mandatory training courses on the current VA training site, the VA Talent Management System (TMS), and will be tracked therein. The TMS may be accessed at https://www.tms.va.gov. If you do not have a TMS profile, go to https://www.tms.va.gov and click on the “Create New User” link on the TMS to gain access.

Contractor employees shall complete a VA Systems Access Agreement if they are provided access privileges as an authorized user of the computer system of VA.

VA Internet and Intranet Standards The Contractor shall adhere to and comply with VA Directive 6102 and VA Handbook 6102, Internet/Intranet Services, including applicable amendments and changes, if the Contractor’s work includes managing, maintaining, establishing, and presenting information on VA’s Internet/Intranet Service Sites. This pertains but is not limited to creating announcements; collecting information;

databases to be accessed, graphics and links to external sites.

Internet/Intranet Services Directive 6102 is posted at (copy and paste the following URL to browser):

http://www1.va.gov/vapubs/viewPublication.asp?Pub_ID=409&FType=2 Internet/Intranet Services Handbook 6102 is posted at (copy and paste following URL to browser):

http://www1.va.gov/vapubs/viewPublication.asp?Pub_ID=410&FType=2

Notice of the Federal Accessibility Law Affecting All Electronic and Information Technology Procurements (Section 508) On August 7, 1998, Section 508 of the Rehabilitation Act of 1973 was amended to require that when Federal departments or agencies develop, procure, maintain, or use Electronic and Information Technology, that they shall ensure it allows Federal employees with disabilities to have access to and use of information and data that is comparable to the access to and use of information and data by other Federal employees. Section 508 required the Architectural and Transportation Barriers Compliance Board (Access Board) to publish standards setting forth a definition of electronic and information technology and the technical and functional criteria for such technology to comply with Section 508. These standards have been developed are published with an effective date of December 21, 2000. Federal departments and agencies shall develop all Electronic and Information Technology requirements to comply with the standards found in 36 CFR 1194.

Section 508 – Electronic and Information Technology (EIT) Standards:

The Section 508 standards established by the Architectural and Transportation Barriers Compliance Board (Access Board) are incorporated into, and made part of all VA orders, solicitations and purchase orders developed to procure Electronic and Information Technology (EIT). These standards are found in their entirety at: http://www.section508.gov and http://www.access‐board.gov/sec508/standards.htm.

A printed copy of the standards will be supplied upon request. The Contractor shall comply with the technical standards as marked:

_x_§ 1194.21 Software applications and operating systems _x_§ 1194.22 Web‐based intranet and internet information and applications _x_§ 1194.23 Telecommunications products _x_§ 1194.24 Video and multimedia products _x_§ 1194.25 Self‐contained, closed products _x_§ 1194.26 Desktop and portable computers _x_§ 1194.31 Functional Performance Criteria _x_§ 1194.41 Information, Documentation, and Support

The standards do not require the installation of specific accessibility‐related software or the attachment of an assistive technology device, but merely require that the EIT be compatible with such software and devices so that it can be made accessible if required by the agency in the future.

Physical Security & Safety Requirements:

The Contractor and their personnel shall follow all VA policies, standard operating procedures, applicable laws, and regulations while on VA property. Violations of VA regulations and policies may result in citation and disciplinary measures for persons violating the law.

1. The Contractor and their personnel shall wear visible identification at all times while they are on the premises.

2. VA does not provide parking spaces at the work site; the Contractor must obtain parking at the work site if needed. It is the responsibility of the Contractor to park in the appropriate designated parking areas. VA will not invalidate or make reimbursement for parking violations of the Contractor under any conditions.

3. Smoking is prohibited inside/outside any building other than the designated smoking areas.

4. Possession of weapons is prohibited.

5. The Contractor shall obtain all necessary licenses and/or permits required to perform the work, with the exception of software licenses that need to be procured from a Contractor or vendor in accordance with the requirements document. The Contractor shall take all reasonable precautions necessary to protect persons and property from injury or damage during the performance of this contract.

Confidentiality and Non‐Disclosure The Contractor shall follow all VA rules and regulations regarding information security to prevent disclosure of sensitive information to unauthorized individuals or organizations.

The Contractor may have access to Protected Health Information (PHI) and Electronic Protected Health Information (EPHI) that is subject to protection under the regulations issued by the Department of Health and Human Services, as mandated by the Health Insurance Portability and Accountability Act of 1996 (HIPAA); 45 CFR Parts 160 and 164, Subcontracts A and E, the Standards for Privacy of Individually Identifiable Health Information (“Privacy Rule”); and 45 CFR Parts 160 and 164, Subcontracts A and C, the Security Standard (“Security Rule”). Pursuant to the Privacy and Security Rules, the Contractor must agree in writing to certain mandatory provisions regarding the use and disclosure of PHI and EPHI.

1. The Contractor will have access to some privileged and confidential materials of VA. These printed and electronic documents are for internal use only, are not to be copied or released without permission, and remain the sole property of VA. Some of these materials are protected by the Privacy Act of 1974 (revised by PL 93‐5791) and Title 38. Unauthorized disclosure of Privacy Act or Title 38 covered materials is a criminal offense.

2. The VA Contracting Officer will be the sole authorized official to release in writing, any data, draft deliverables, final deliverables, or any other written or printed materials pertaining to this contract. The Contractor shall release no information. Any request for information relating to this contract presented to the Contractor shall be submitted to the VA Contracting Officer for response.

3. Contractor personnel recognize that in the performance of this effort, Contractor personnel may receive or have access to sensitive information, including information provided on a proprietary basis by carriers, equipment manufacturers and other private or public entities. Contractor personnel agree to safeguard such information and use the information exclusively in the performance of this contract. Contractor shall follow all VA rules and regulations regarding information security to prevent disclosure of sensitive information to unauthorized individuals or organizations as enumerated in this section and elsewhere in this Contract and its subcontracts and appendices.

Page 110 of

4. Contractor shall limit access to the minimum number of personnel necessary for contract performance for all information considered sensitive or proprietary in nature. If the Contractor is uncertain of the sensitivity of any information obtained during the performance this contract, the Contractor has a responsibility to ask the VA Contracting Officer.

5. Contractor shall train all of their employees involved in the performance of this contract on their roles and responsibilities for proper handling and nondisclosure of sensitive VA or proprietary information. Contractor personnel shall not engage in any other action, venture or employment wherein sensitive information shall be used for the profit of any party other than those furnishing the information. The sensitive information transferred, generated, transmitted, or stored herein is for VA benefit and ownership alone.

6. Contractor shall maintain physical security at all facilities housing the activities performed under this contract, including any Contractor facilities according to VA‐approved guidelines and directives. The Contractor shall ensure that security procedures are defined and enforced to ensure all personnel who are provided access to patient data must comply with published procedures to protect the privacy and confidentiality of such information as required by VA.

7. Contractor must adhere to the following:

a. The use of “thumb drives” or any other medium for transport of information is expressly prohibited.

b. Controlled access to system and security software and documentation.

c. Recording, monitoring, and control of passwords and privileges.

d. All terminated personnel are denied physical and electronic access to all data, program listings, data processing equipment and systems.

e. VA, as well as any Contractor (or Subcontractor) systems used to support development, provide the capability to cancel immediately all access privileges and authorizations upon employee termination.

f. Contractor PM and VA PM are informed within twenty‐four (24) hours of any employee termination.

g. Acquisition sensitive information shall be marked "Acquisition Sensitive" and shall be handled as "For Official Use Only (FOUO)".

h. Contractor does not require access to classified data.

8. Regulatory standard of conduct governs all personnel directly and indirectly involved in procurements. All personnel engaged in procurement and related activities shall conduct business in a manner above reproach and, except as authorized by statute or regulation, with complete impartiality and with preferential treatment for none. The general rule is to strictly avoid any conflict of interest or even the appearance of a conflict of interest in VA/Contractor relationships.

9. VA Form 0752 shall be completed by all Contractor employees working on this contract and shall be provided to the CO before any work is performed. In the case that Contractor personnel are replaced in the future, their replacements shall complete VA Form 0752 prior to beginning work.

14. ADDENDUM B – VA INFORMATION SYSTEM SECURITY AND PRIVACY

APPLICABLE PARAGRAPHS TAILORED FROM: THE VA INFORMATION AND INFORMATION SYSTEM

SECURITY/PRIVACY LANGUAGE, VA HANDBOOK 6500.6, APPENDIX C, MARCH 12, 2010

GENERAL

Contractors, Contractor personnel, Subcontractors, and Subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security.

ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS

a. A Contractor/Subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, Subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order.

b. All Contractors, Subcontractors, and third‐party servicers and associates working with VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for Contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures.

c. Contract personnel who require access to national security programs must have a valid security clearance. National Industrial Security Program (NISP) was established by Executive Order 12829 to ensure that cleared U.S. defense industry contract personnel safeguard the classified information in their possession while performing work on contracts, programs, bids, or research and development efforts. The Department of Veterans Affairs does not have a Memorandum of Agreement with Defense Security Service (DSS). Verification of a Security Clearance must be processed through the Special Security Officer located in the Planning and National Security Service within the Office of Operations, Security, and Preparedness.

d. Custom software development and outsourced operations must be located in the U.S. to the maximum extent practical. If such services are proposed to be performed abroad and are not disallowed by other VA policy or mandates (e.g., Business Associate Agreement, Section 3G), the Contractor/Subcontractor must state where all non‐U.S. services are provided and detail a security plan, deemed to be acceptable by VA, specifically to address mitigation of the resulting problems of communication, control, data protection, and so forth. Location within the U.S. may be an evaluation factor.

e. The Contractor or Subcontractor must notify the CO immediately when an employee working on a VA system or with access to VA information is reassigned or leaves the Contractor or Subcontractor’s employ.