PD for RFI.docx

Enhanced Digital Signature Workflow VA-26-00041731

PRODUCT DESCRIPTION (PD)

DEPARTMENT OF VETERANS AFFAIRS (VA)

Veteran Health Administration (VHA) Oscar G. Johnson Medical Center (OGJMC) Iron Mountain (VHAIRO)

Enhanced Digital Signature Workflow

Date: March 13, 2026

VA-26-00041731

PD Version Number: 1.0

1.0 PRODUCT REQUIREMENTS

The Department of Veterans Affairs (VA), Veteran Health Administration (VHA), Oscar G. Johnson VA Medical Center (OGJVAMC), Iron Mountain (VHAIRO) has a requirement for an Enterprise electronic signature (eSig) SaaS term solution, inclusive of up to 30,000 transactions, which would allow the VA to continue to meet the needs of current and planned electronic and digital signature VA-wide. In compliance with OMB Memo M-19-12 and VA Directive 6517, all Federal agencies are required to manage permanent records electronically. To meet this mandate, the VA needs a digital signature solution that not only integrates seamlessly with existing VHA enterprise systems but also delivers robust security, accessibility, and privacy features in accordance with the Federal Information Security Modernization Act (FISMA), the Health Insurance Portability and Accountability Act (HIPAA), and VHA-specific security policies. The solution should increase clinical efficiency by significantly reducing the time clinicians spend on signature processes, with a particular focus on streamlining community care records. The solution must automatically provide visible date and time stamps directly on each signature. This ensures that audits can confirm all entries are properly dated and timed, as required. The solution must integrate seamlessly with VA’s Microsoft O365, SharePoint, Teams, ServiceNow, ecFAX, and other approved platforms.

The proposed solution must provide a way to manage the eSig account using features that allow administrators to manage many sub-accounts under one umbrella. This option will provide VA stakeholders the ability to have administrative oversite of their sub-accounts with regards to reports, user additions, deletions, and updates specifically and generally more ease of use for our stakeholders once transactions have been funded. It needs to provide the ability to render in different mobile formats for the sender and recipients as well as the ability to have multi-signing capabilities and the ability to sign using either an electronic signature or digital signature with PIV. VA requires Section 508-compliant accessibility features for end-users and administrators, enterprise integration support, and configuration for VA server storage and audit requirements.

The table below provides the basic functional requirements required by VA.

Table 1: Software Functional Matrix

The period of performance shall be a 12-month base period, with four (4) 12-month option periods.

Base Period – Transactions and Enterprise Electronic Signature SaaS solution inclusive up to 30,000 transactions.

Option Period One – Transactions and Enterprise Electronic Signature SaaS solution inclusive up to 30,000 transactions.

Option Period Two – Transactions and Enterprise Electronic Signature SaaS solution inclusive up to 30,000 transactions.

Option Period Three – Transactions and Enterprise Electronic Signature SaaS solution inclusive up to 30,000 transactions.

Option Period Four – Transactions and Enterprise Electronic Signature SaaS solution inclusive up to 30,000 transactions.

1.1 PREMIER SUPPORT SERVICES

The contractor shall provide the following:

a. Demo Access

b. Elite Support- Target Response times:

· Critical Response time – 30 minutes

· Urgent Response time- 1 hour

· Important Response time – 4 Hours

· Minor Response time -8 hours

c. Integration Support with a proposed 30 day transition plan

d. Training for end users to include live and on demand training.

e. Contiued review of optimization

1.2 PROFESSIONAL SERVICES

The contractor shall provide the following:

a. Schedule remote support with VA team and contractor professional services team to provide guidance and assistance to set-up and implement the eSig SaaS environment and ensure all are operational within each unique environment to include the potential development of APIs and connectors. Remote support will be provided for configuration (implementation) of the eSig SaaS service and related support.

For any engagements which will utilize the Professional Services a proposed task duration shall be prepared by the Contractor and provided to the COR for review and acceptance prior to initiating any work which depletes the professional service hours.

1.3 TRANSITION IN SUPPORT

The contractor shall provide a transition plan to include a timeline for the migration of any current templates used after award, not to exceed 30 days after contract award. Upon government review and approval of the plan, the contractor shall assist the government in implementing a complete transition plan. This shall include formal coordination with government staff. It copies of all artifacts delivered under this contract, as well as existing policies and procedures, and delivery of baseline metrics and statistics.

1.4 SAAS FEDRAMP ASSESSMENT AND AUTHORIZATION AND CONTINUOUS MONITORING REQUIREMENTS

1. The information system solution selected by the Contractor shall comply with the Federal Information Security Management Act (FISMA) and have a current VA authorization.

2. The Contractor shall remain in compliance with FedRAMP requirements as mandated by Federal laws and policies, including making available any documentation, physical access, and logical access needed to support this requirement.

3. The FedRAMP Authorization level and existing VA ATO should be no less than the level required for this use case which has been defined as Moderate Level from the Data Security Categorization.

4. The Contractor shall, where applicable, assist with the VA ATO Sustainment Process to help maintain health and quality of agency authorization of the cloud service or migrated application.

5. The Contractor shall exclusively provide subscription licenses to FedRAMP authorized and VA authorized environments.

6. If new or unanticipated vulnerabilities are discovered by either VA or the Contractor, or if existing safeguards have ceased to function, the discoverer shall bring the situation to the attention of the other party within one hour in accordance with Addendum B, VA Information and Information System Security/Privacy Language. VA Privacy and Security deliverables as directed by the VA System owner.

7. The Contractor shall comply with FedRAMP data management requirements.

8. Successful issuance of a VA ATO will be required before live VA data can be used in the system.

9. The Contractor shall participate in FedRAMP Continuous Monitoring activities as outlined by FedRAMP’s Continuous Monitoring Strategy Guide found on the FedRAMP Website.

10. The Contractor shall provide continuous monitoring activities including, but not limited to, scans, security artifacts, and provide Continuous Monitoring Monthly Scans and monthly Plan of Action and Milestones (POAM) reports as outlined by FedRAMP requirements.

11. The Contractor shall participate in monthly Agency and FedRAMP Sustainment meetings following the granting of a VA ATO.

12. The Contractor shall provide a Monthly VA License report of VA sites currently utilizing the cloud product post ATO award. The license report shall include the number of subscription licenses being utilized and the specific VA site where they’re in use.

Deliverables:

A. Continuous Monitoring Monthly Scans B. Plan of Action and Milestones Reports.

C. Monthly VA License Report

2.0 NOTICE OF THE FEDERAL ACCESSIBILITY LAW AFFECTING ALL INFORMATION AND COMMUNICATION TECHNOLOGY (ICT) PROCUREMENTS (SECTION 508) On January 18, 2017, the Architectural and Transportation Barriers Compliance Board (Access Board) revised and updated, in a single rulemaking, standards for electronic and information technology developed, procured, maintained, or used by Federal agencies covered by Section 508 of the Rehabilitation Act of 1973, as well as our guidelines for telecommunications equipment and customer premises equipment covered by Section 255 of the Communications Act of 1934. The revisions and updates to the Section 508-based standards and Section 255-based guidelines are intended to ensure that information and communication technology (ICT) covered by the respective statutes is accessible to and usable by individuals with disabilities.

2.1 SECTION 508 – INFORMATION AND COMMUNICATION TECHNOLOGY (ICT) STANDARDS

The Section 508 standards established by the Access Board are incorporated into, and made part of all VA orders, solicitations and purchase orders developed to procure ICT. These standards are found in their entirety at: https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines. A printed copy of the standards will be supplied upon request.

Federal agencies must comply with the updated Section 508 Standards beginning on January 18, 2018. The Final Rule as published in the Federal Register is available from the Access Board: https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule.

The Contractor shall comply with “508 Chapter 2: Scoping Requirements” for all electronic ICT and content delivered under this contract. Specifically, as appropriate for the technology and its functionality, the Contractor shall comply with the technical standards marked here:

2.2 COMPATABILITY WITH ASSISTIVE TECHNOLOGY

The standards do not require installation of specific accessibility-related software or attachment of an assistive technology device. Section 508 requires that ICT be compatible with such software and devices so that ICT can be accessible to and usable by individuals using assistive technology, including but not limited to screen readers, screen magnifiers, and speech recognition software.

2.3 ACCEPTANCE AND ACCEPTANCE TESTING

Deliverables resulting from this solicitation will be accepted based in part on satisfaction of the Section 508 Chapter 2: Scoping Requirements standards identified above.

The Government reserves the right to test for Section 508 Compliance before delivery. The Contractor shall be able to demonstrate Section 508 Compliance upon delivery.

3.0 GENERAL REQUIREMENTS

3.1 VA TECHNICAL REFERENCE MODEL

The Contractor shall support the VA enterprise management framework. In association with the framework, the Contractor shall comply with OIT Technical Reference Model (VA TRM). The VA TRM is one component within the overall Enterprise Architecture (EA) that establishes a common vocabulary and structure for describing the information technology used to develop, operate, and maintain enterprise applications. Moreover, the VA TRM, which includes the Standards Profile and Product List, serves as a technology roadmap and tool for supporting OIT. Architecture & Engineering Services (AES) has overall responsibility for the VA TRM.

3.2 SOCIAL SECURITY NUMBER (SSN) REDUCTION

The Contractor solution shall support the Social Security Number (SSN) Fraud Prevention Act (FPA) of 2017 which prohibits the inclusion of SSNs on any document sent by mail. The Contractor support shall also be performed in accordance with Section 240 of the Consolidated Appropriations Act (CAA) 2018, enacted March 23, 2018, which mandates VA to discontinue using SSNs to identify individuals in all VA information systems as the Primary Identifier. The Contractor shall ensure that any new IT solution discontinues the use of SSN as the Primary Identifier to replace the SSN with the Integrated Control Number (ICN) in all VA information systems for all individuals. The Contractor shall ensure that all Contractor delivered applications and systems integrate with the VA Master Person Index (MPI) for identity traits to include the use of the ICN as the Primary Identifier. The Contractor solution may only use a Social Security Number to identify an individual in an information system if and only if the use of such number is required to obtain information VA requires from an information system that is not under the jurisdiction of VA.

3.3 INTERNET PROTOCOL VERSION 6 (IPV6)

The Contractor solution shall support Internet Protocol Version 6 (IPv6) based upon the memo issued by the Office of Management and Budget (OMB) on November 19, 2020 (https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-07.pdf). IPv6 technology, in accordance with the USGv6 Program (https://www.nist.gov/programs-projects/usgv6-program/usgv6-revision-1), NIST Special Publication (SP) 500-267B Revision 1 “USGv6 Profile” (https://doi.org/10.6028/NIST.SP.500-267Br1), and NIST SP 800-119 “Guidelines for the Secure Deployment of IPv6” (https://doi.org/10.6028/NIST.SP.800-119), compliance shall be included in all IT infrastructures, application designs, application development, operational systems and sub-systems, and their integration. In addition to the above requirements, all devices shall support native IPv6 and dual stack (IPv6 / IPv4) connectivity without additional memory or other resources being provided by the Government, so that they can function in a mixed environment. All public/external facing servers and services (e.g. web, email, DNS, ISP services, etc.) shall support native IPv6 and dual stack (IPv6 / IPv4) users and all internal infrastructure and applications shall communicate using native IPv6 and dual stack (IPv6 / IPv4) operations.

4.0 POSITION/TASK RISK DESIGNATION LEVEL(S)

In accordance with VA Handbook 0710, Personnel Security and Suitability Program, the position sensitivity and the level of background investigation commensurate with the required level of access for the following tasks within the PD are:

Position Sensitivity and Background Investigation Requirements by Service Task/Item Number Service Task/ Item Number

The Tasks identified above and the resulting Position Sensitivity and Background Investigation requirements identify, in effect, the Background Investigation requirements for Contractor individuals, based upon the tasks the particular Contractor individual will be working. The submitted Contractor Staff Roster must indicate the required Background Investigation Level for each Contractor individual based upon the tasks the Contractor individual will be working, in accordance with their submitted proposal.

Product Description Template_JUL_21_2021 image1.jpeg