PD_PMIS CFM_Draft.pdf

PRODUCT DESCRIPTION

Construction and Facilities Management (CFM) CFM Project Management Information System (PMIS)

Date: March 26, 2024

VA-24-00057428

PD Version Number: 10.0

TAC Number:VA-24-00057428

Contents

1.0 PRODUCT REQUIREMENTS

1.1 SaaS PRODUCT REQUIREMENTS

1.2 IMPLEMENTATION AND PLANNING

1.3 TRAINING AND CHANGE MANAGEMENT

1.4 PRODUCT SUPPORT & MAINTENANCE

1.5 ASSESSMENT, AUTHORIZATION, AND CONTINUOUS MONITORING

1.6 OUTGOING TRANSITION MANAGEMENT (OPTIONAL TASK 1)

2.0 NOTICE OF THE FEDERAL ACCESSIBILITY LAW AFFECTING ALL

INFORMATION AND COMMUNICATION TECHNOLOGY (ICT)

PROCUREMENTS (SECTION 508)

2.1 SECTION 508 – INFORMATION AND COMMUNICATION TECHNOLOGY (ICT)

STANDARDS

2.2 COMPATABILITY WITH ASSISTIVE TECHNOLOGY

2.3 ACCEPTANCE AND ACCEPTANCE TESTING

3.0 INFORMATION TECHNOLOGY USING ENERGY-EFFICIENT PRODUCTS ... 19

4.0 SHIPMENT OF SOFTWARE OR RELATED ITEMS

5.0 GENERAL REQUIREMENTS

5.1 VA TECHNICAL REFERENCE MODELIS

5.2 SOCIAL SECURITY NUMBER (SSN) REDUCTION

5.3 INTERNET PROTOCOL VERSION 6 (IPV6)

5.4 SOFTWARE AND LICENSING REQUIREMENTS

5.5 POSITION/TASK RISK DESIGNATION LEVEL(S)

ADDENDUM B – VA INFORMATION AND INFORMATION SYSTEM

SECURITY/PRIVACY LANGUAGE

1.0 PRODUCT REQUIREMENTS

The mission of the Department of Veterans Affairs (VA), Office of Construction & Facilities Management (CFM) is to provide planning, design, major construction, and lease project management, design and construction standards, and expertise to VA to deliver high-quality, cost-effective facilities in support of our nation's Veterans. CFM customers are VA employees in medical centers, community-based clinics, regional offices and national cemeteries across this country who proudly work at the front lines of service delivery to our nation’s Veterans.

Use of Present PMIS System VA CFM presently uses the PMIS primarily as a collaborative management system between the contractor, Architect Engineer (AE), and CFM staff for construction administration, with applications like submittals, Request for Information (RFI), Request for Proposals (RFQ), Potential Change Orders (unsolicited proposals), and Daily Logs.

This is VA CFM’s tool for day-to-day operations primarily in the field.

PMIS requirements for this procurement The CFM Major Project lifecycle is complex. It starts with baseline analysis, project development, project execution and requires providing some support even after project turnover to CFM’s customers (Veteran’s Health Administration (VHA) and National Cemetery Association (NCA)).

This complex process requires having a clear picture of every major and minor step in the process, each office/stakeholder’s role, how it relates to the role of other offices/stakeholders and decision tracking for improved accountability & collaboration.

Project Management Information Systems (PMIS) must provide CFM with the opportunity to not only capture a digital record of all lifecycle data but the ability to review, analyze and report the data and it’s derivates for continuous improvement. The system will be used for program, project, document and process management to overcome the multitude of software that are disjointed and does not work together, process tracking, knowledge loss (as various process steps presently do not live in one place), to accommodate standardized work process across the lifecycle and improving overall speed agility.

There has been tremendous advancement in the area of Commercial-off-the-Shelf COTS that are rapidly adding industry specific applications: such as Healthcare, Funding and Construction management suites. CFM would like to take advantage of such a system and tailor it to it’s complex lifecycle needs. CFM requires a Software as a Service (SaaS) offering brand name Kahua or equal system to replace its current PMIS.

The system must be FedRAMP approved at a MODERATE FISMA impact. CFM requires a system provider to provide subscriptions to PMIS software along with comprehensive support services to ensure successful deployment of the PMIS.

The model for this PMIS shall be subscription-based licenses based on a price per licensed user. The base year requires 1,500 Licensed users that must be able to access the system simultaneously and up to 2,800 Licensed users, if all option periods are exercised.

The Contractor shall provide the commercial software subscriptions for a Project Management Information System. The required Brand Name or Equal to Kahua shall meet all of the salient characteristics identified in Section 1.1 SaaS Product Requirements.

The period of performance is a base period of one (1) year and four (4) 1-year option periods.

1.1. SAAS PRODUCT REQUIREMENTS

1. The core platform must satisfy the greatest number of healthcare construction business processes that are industry standard. The system should provide ready features that require minimal changes to adjust to VA’s processes. Where substantial configuration effort is required to adapt to VA’s needs, the Application Programming Interfaces (APIs) must be clearly defined. This system should provide CFM one system for Lifecycle management of our healthcare and cemeteries programs and ability to integrate with other VA systems (planning, design, acquisition – including bid management, minority participation tracking. construction, resource management, contract administration, management of initiatives related to lifecycle phases and sub phases, capital and budget planning)

2. Ability to configure must exist to model VA’s processes and workflows.

3. System shall be a centralized repository that helps with project tracking, project progress, efficient transfer of documents between the team, and provide automatic reminders of work in queue. Documents may include daily logs, schedules, submittals, designs, specifications, LEED submittals, supplemental instructions, changes, photos, test reports, meeting minutes and other planning, design or construction documentation. System shall include logs that track user activities such as upload dates, revisions, etc. these should be downloadable and viewable by system administrators.

4. System must provide construction management lifecycle transparency between multiple stakeholders by allowing all team members to view and monitor project activities, access project information at any time, and provide for complete version history.

5. System must be able to read the following document types at a minimum

– PDF/PDF/A, BMP, BIM, DOC/DOCX, XLS/XLSX, JPEG/JPG/GIF, PNG,

TIFF/TIF, HTML/HTM, TXT, RTF, MP4/MP3/WAV, AVI, FLV, PPT/PPTX,

ZIP.

6. System shall have configurable administrative and security settings.

7. The SaaS provider shall provide real-time data backup and the VA can request data dumps at any time. Data can be requested by the VA in its native form or in the SaaS provider’s program files. VA administrative staff should be able to create periodic archives.

TABLE 1 - SALIENT CHARACTERISTICS

Item No. Description

1 Approved at FedRAMP Moderate FISMA impact.

Product shall manage a central contact database to track Contacts and related contact information, track the type of contact (e.g., VA Project Engineer/Manager, Contracting Officer, Medical Center Staff, A/E, Contractor, etc.) with a Contract, shall associate a contact with a particular Contract(s) or Project(s). Product shall provide the ability to seamlessly change projects/contracts in users’ profile or remove access as needed, shall be able to add a contact to the database directly from Project or Contract setup, shall allow for import of existing contacts into the contact database without any custom programming and shall allow for the selection from individual/group contacts for multiple notification based on contact data (type, project, etc.), shall be able to create a report that identifies contacts that have not logged into the PMIS within a specified amount of time to allow for VA to actively manage license usage and remove users from the system who are not actively engaged in VA design and construction work.

The system shall provide a secure mechanism to organize and classify all documents related to a Project or Contract. Content assets and meta data shall be stored in an accessible centralized repository with access and unlimited Government rights to the data.

The system shall provide the capability to associate documents stored in the repository with Programs, Subprograms, Projects, Contracts, Forms, Workflows, archives, locations, and other objects in the PMIS.

The documents database should be searchable using any criteria stored about the document including the attributes of document that can be used for classification and search. The system should provide the capability to search for content that is stored inside the documents. The content should be stored and indexed to facilitate rapid searches. A mechanism that allows a user to enter simple search criteria like a Google search is required. One model for access should be a simple folder structure that can be established by the systems administrator.

The system shall include pre-built templates/forms (or utilize VA provided templates/forms) to support common project management processes as documented in this PD and allow for configuration and development of all templates/forms by copying and using existing templates as a starting point.

System shall incorporate business rules that determine the way in which the templates/forms respond to user input and be able to link them to workflows and notifications. System must control visibility to portions of a template/form.

System shall automatically and accurately notify other project team members based on their role in the project or other business rules via dashboard alerts or emails. Have the ability to route to multiple people, roles at the same time, process steps without delaying the process.

System will identify ball in court ownership of workflow tasks, determine the status of any workflow in the system, be capable of calculating a completion time threshold for any given step in a workflow. System shall provide the capability to automatically route documents to 'exception workflows' if a workflow has exceeded the defined thresholds. System shall be capable of developing concurrent workflow steps - split workflow.

9 System shall allow for the VA to define an escalation process for any step in a workflow.

System shall include an approval or rejection capability at many levels in a single workflow. System shall provide for easy mark-ups of documents. System shall include automatic flattening of PDF/Bluebeam annotations so that there can be no unauthorized changes and have the ability to sign documents which integrates with VA’s document signing software. (Note: The Government holds the appropriate licenses).

11 System shall include standard configurable out of the box workflows for industry standard Architect Engineering Construction (AEC) business processes.

System shall utilize email as a mechanism for communicating workflow state transitions and enable an end user to email a document directly from within the application, and mass e-mail project information to one or multiple contacts based on type, project or program.

System shall provide the capability to retain an audit trail of the ‘sent history’ of all documents that were e-mailed out of the system in accordance with VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021.

14 The system shall allow VA to define as many roles as needed with different permission settings including create, read, update, and delete.

System shall enable administrative users to amalgamate system privileges into roles, to combine users into groups, to grant individual privileges and/or roles to users and/or groups. System shall be able to produce a report on system privileges in the database based on role or user to pulled by the Government at any time.

16 System shall restrict access to create, retrieve, update, delete and archive data based upon the privileges of the authenticated user.

17 System shall assign roles to a workflow at each state of its lifecycle, for example, allow only certain staff roles to process a request to the approved status.

18 System shall control navigation and access to all features based upon the privileges of an authenticated user.

19 System shall be able to produce a report on system privileges in the database based on role or user to pulled by the Government at any time.

20 System shall restrict access to system functions (print, reports, manage workflow, etc.) Based upon the privileges of the authenticated user.

21 The Contractor provided PMIS shall have a help system that displays different help messages depending on where a user is in the program.

22 The system shall include an online, context sensitive, help structure.

23 The system shall include appropriate rollover tips that display when a user passes over and object with a cursor.

24 The system shall include appropriate documentation and illustrations to assist the user as required.

25 The system shall be able to modify the help messages as part of configuration to meet the needs of VA users.

26 Ability to use the help button in the system based on user portal. Example -contractor should be able to access help only for contractors.

27 PMIS uptime and availability shall be 99% uptime.

28 The Contractor provided PMIS shall have an audit trail that documents all transactions that are made in the system.

The system shall capture the Login ID of the individual making the change, the data element being changed, the changed information (wording), what it was changed to (wording), a date stamp including time documenting the time of change, and any descriptive notes that the data element may require/allow to document the change. The system shall provide a function or utility to configure the data captured in an audit log.

30 The PMIS shall provide a robust development / configuration environment that will allow configurations of the PMIS.

31 The PMIS shall modify existing or new workflows, new portals, new forms and new queries.

32 The PMIS shall be able to modify existing or develop new and comprehensive reports for status and history of all documentation, reviews, approvals, etc.

33 The PMIS shall support integration between the PMIS and other VA systems.

The PMIS shall use an Application Programming Interface (API) or other tools to facilitate automatic upload of data from the current VA PMIS. The product shall include open API's to support data exchange with other common AEC technologies/tools, should VA choose to leverage it.

35 The PMIS shall be capable of making changes to look and feel or functionality of the out of the box system.

PMIS shall generate and manage daily reports which capture the official record of job site status and activities on a daily basis. Each daily report is a single shared document that is initiated by one person via dashboard alert and then routed via workflow to others for input and review. Security rights of contract roles determine authority to make changes to data.

37 PMIS shall manage the construction and/or design meeting minute process.

PMIS shall generate submittals verifying that the correct products and quantities will be installed on VA projects. Submittals include shop/fabrication/manufacturer drawings, material data, samples, and product data. This process also provides the opportunity to clarify product selections within the quality level indicated in the specification and quantities shown on plans. The PMIS shall provide out-of-the-box capability to manage submittals based on construction industry best practices.

PMIS shall be used in the generation of Requests for Information (RFIs). The goal of the RFI is to address and resolve questions that may arise during the construction delivery process of a project. The RFI component of the PMIS shall rely upon an automated workflow, based on construction industry best practices for RFIs. To the fullest extent possible, that workflow shall embed business rules that invoke auto-population, list selection, or formatted entry (whichever is most expedient for the user) to make the RFI process predictable and easy to use for VA staff and those who collaborate on projects with the VA staff.

PMIS shall be used in posting and tracking the construction contractor Quality Control processes. The goal of the Quality Control Management is to formally identify definable features of work (DFOW) that are an integral part of the construction contract and to track the quality control process through the life of the project.

PMIS shall be used in posting of a completed/executed Change Order. The goal of the Change Order is to formally identify that a change order has been executed and post it to a single location to manage changes to the construction contract during the delivery process of a VA project. The Change Order component of the PMIS shall rely upon an automated workflow, based on construction industry best practices for posting completed Change Orders. To the fullest extent possible, that workflow shall embed business rules that invoke auto-population, list selection, or formatted entry (whichever is most expedient for the user) to make the Change Order process predictable and easy to use for VA staff and those who collaborate on projects with VA.

PMIS shall be used for Schedule Management. The Schedule Management features of the PMIS shall provide information that mirrors industry leading practices.

PMIS system shall have a Cost Management feature. The Cost Management features of the PMIS shall provide information that mirrors industry leading practices.

PMIS shall be used in the generation of a punch list. VA staff documents all work not conforming to contract specifications that the Construction Contractor must complete prior to final payment. The work may include incomplete or incorrect installations or incidental damage to existing finishes, material, and structures.

PMIS shall be used to provide completely integrated design review process that includes integrated design review comments, drawing markups, and comment tracking, all within the PMIS. All workflows related to this element shall be automated as best as practicable.

PMIS shall allow for bulk or singular project data uploads from the VA to the PMIS to allow for certain project information to be updated in a VA database and then manually imported into SaaS PMIS.

PMIS shall provide a system to create, send, and track bid invitations to potential bidders on your project. All invitees shall receive a free PMIS license to manage the receipt of the bid invitation and all associated content.

PMIS shall enable import of Microsoft Project and Primavera P6 files into the PMIS so there can be schedule transparency, reconciliation of the schedule with the IMS schedules and the ability to analyze and report milestones from schedules effectively. Kahua rSchedule (or equal)

PMIS shall provide the ability to manage different color of money funds, authorizations, appropriations and obligations per CFM’s policies and procedures. The system should enable VA to compare this information against planned, published budgets commitments and actuals. Kahua Sources of Funds (or equal)

PMIS shall provide the ability to create a life cycle map for projects and programs into a structured, collaborative logic-driven process to manage tasks and workflows resulting in a streamlined and controlled approach with an added level of transparency and accountability. Kahua PhaseGate (or equal)

PMIS shall provide the ability to create punch lists, assign items to various stakeholders, have approval workflows towards successful project closeout.

Kahua Closeout (or equal)

PMIS shall provide pre-developed, Healthcare applications that can be added to the PMIS. The Healthcare application shall include, at a minimum; Checklists & Inspections, Compliance Documents, Daily Wellness, EHS Employee Profile, Fire Watch Log, Hot Permit, Infection Control Risk Assessment, Interim Life Safety Measures, Penetration Permit, Utility Shutdown, JCAHO compliance tools and Vendor Performance. Kahua Healthcare Package (or equal)

PMIS shall provide the ability to schedule and assign checklists as tasks. Ability to provide the option to identify exceptions and to auto assign each for verification that corrective action is taken. Optional approvals can be set for each checklist and or exception. All activity is logged with retrieval, status, and reporting functionality. Kahua Checklist (or equal)

PMIS shall allow users to view various aspects of the portfolio of projects being managed at different levels in the hierarchy established in the system. Attributes must be changeable at different levels without having to change them one by one for the entire portfolio. Kahua Portfolio Management (or equal)

PMIS shall allow the VA to create a 5- or 10-year capital plan that supports the VA’s goals of leveraging VA’S capital, forecasting, prioritizing and analyzing scenarios for best use of funds. Kahua Capital Planning (or equal)

PMIS shall integrate analytics powered by Microsoft PowerBI. The system should be able to analyze data, run reports, dashboards. The system should be able to combine data from other sources with the PMIS. The PMIS shall enable tracking, updating, and reporting on industry standard key performance indicators (KPIs) associated with a project.

Kahua Analytics (or equal) , Kahua DataStore (or equal)

PMIS shall allow users to generate various scenarios of detailed cash flow projections aligned with VA’s specified parameters. Kahua Cash Flow Forecasting (or equal)

PMIS shall allow users to download data at the contract, project, regional or program levels. The data should be organized according to the organizing structure used by the VA within the PMIS. Kahua Snapshot (or equal)

1.2 IMPLEMENTATION AND PLANNING

1. VA Process adaptation

PMIS configurability is required so that it may be adjusted as part of deployment and ongoing management to meet the specific needs of VA. VA intends to use the Contractor provided PMIS as an out of the box capability. However, the Contractor shall be capable of adjusting the PMIS business process to leverage industry best practices embedded in the PMIS Solution workflow via a SaaS first policy. The PMIS system should provide a “Mature platform” ecosystem that can be modularly extended using open APIs that can be leverage with relatively limited effort, time and risk and integrate with VA systems such as IFAMS (Integrated Financial Management System), G Invoicing, CAI (Capital Asset Inventory), VA TIL (Technical Information Library), ARC GIS as requested by VA CFM Project Manager. System should be capable of providing 3rd party add-ins, such as customization of applications developed for other federal clients that are FedRAMP compliant such as Lease Management, Client project agreements that were developed for GSA and the like. The out of the box system must adapt to VA’s needs. The Contractor must provide assistance in business process discovery, mapping, and streamlining using Agile and Lean Six Sigma techniques in the form of meetings, flow charts, prior to configuring new processes and workflows into the system.

2. Testing and configuring The Contractor shall conduct testing with sample user groups, revise as needed to prepare for final configuration and release. During the configurations stage select end users and Domain and Regional administrators should have access to a training sandbox environment to test drive the new configurations. All configurations will require VA CFM Project Manager approval before release.

1.3 TRAINING AND CHANGE MANAGEMENT

1. Manuals & User guides

After configurations are finalized, contractor will create manuals that will be signed off by the Project manager (PM) and Contracting officer’s (COR) representative prior to any training provided. User Reference Manuals to include quick reference guides and FAQ’s (video, printable and electronic version) specific to the go-live processes that have been configured to be utilized by VA. Manuals and training materials shall be kept up to date with all configurations and additional training within 1 week of update. Materials need to be updated with new configurations/upgrades throughout the life of the contract.

2. Training The Contractor shall provide a testing and training environment separate from the production environment. Training details – agendas, materials (manuals, job aids etc.), dates/times will be approved by the VA CFM Project Manager prior to actual training. The Contractor shall provide training documentation and train users prior to release and provide videos of the training sessions.

The training will be virtual/on-line role-based Domain, Regional or end user training. The Contractor shall provide a production environment to support the proposed number of system users. Recommend and implement training program improvements to drive adoption and efficient usage of the system.

3. Change Management Support The contractor is responsible for assisting the Project manager in developing the change management policy and it’s implementation.

The Contractor shall develop and provide presentations and role-based training for use by VA’s trainers that are specific to the go-live, system updates or new process trainings. Contractor will also assist in weekly messaging to end users to include as requested by the PM or COR.

a. System news flashes (configuration updates and other information)

b. Videos & learning aids library updates

c. System advisories

d. Training & deployment updates etc.

Deliverables:

A. Manuals and user guides per 1.3.1 B. Training agendas and aids per 1.3.2

C. Videos and learning aids per 1.3.3

1.4 PRODUCT SUPPORT & MAINTENANCE

The Contractor shall provide full technical support for VA’s use of the PMIS. VA will designate a list of Lead (and Backup) Administrative Users who will be the primary point of contact for the PMIS provider for technical support issues.

The Service provider shall be responsible for complete technical support and maintenance of the system in the following manner -

1. Corrective Maintenance

Maintain the system and ensure it is free of errors and faults within the software application, it’s parts, design, logic and code. Keep Bug reports.

2. Adaptive Maintenance

Software must be malleable to adapt to VA’s environment, such as changes to operating system, hardware, software dependencies, VA’s organizational policies and rules etc. Conduct lessons learned as required following release of customer-specific features, in order to consistently improve process and communication with client.

3. Preventative Maintenance

Proactively keep the system running smoothly by ensuring that no system deterioration is occurring, and system is able to continually adapt and change, optimize code and update documentation as needed.

4. Perfective Maintenance

The system must be able to adapt to VA’s requirements as it pertains to enhancements, integrations, configurations and customization. The Contractor should be able to provide technical support & UI consultation (wireframes) to help adapt to VA’s requirements.

In the case of any additional configuration pursued, provide support for the implementation – schedule, scope, and User Acceptance Testing.

a. A log of features with client’s top priorities and timelines for consideration and approval for configuration to VA processes must be maintained.

b. Configure PMIS applications to most efficiently support specific project requirements by populating default values, changing labels / hiding fields, where and if appropriate.

5. Technical Support Technical Support shall include the following:

a. Onboarding / Domain Administrator activities, including setting up new contacts and assigning licenses.

b. Troubleshoot any onboarding/registration challenges.

c. Provide client-specific release notes detailing implications of the upcoming releases – including both client-specific enhancements and overarching platform changes.

d. Detail upcoming changes in collateral or tips/tricks documentation to be distributed as part of a user communication plan.

6. Help Desk Support The Contractor shall provide Tier 1, Tier 2, and Tier 3 Help Desk and defect repair support to VA from 7AM EST to 7PM EST Monday through Friday, excluding Federal holidays, to respond to inquiries from VA employees. The 11 Federal holidays that VA follows are: New Year’s Day (January1), Juneteenth (June 19), Independence Day (July 4), Veterans Day (November 11), Christmas Day (December 25), Martin Luther King’s Birthday (third Monday in January), Washington’s Birthday (Third Monday in February), Memorial Day (Last Monday in May), Labor Day (First Monday in September), Columbus Day (Second Monday in October), and Thanksgiving (Fourth Thursday in November). For each defect identified, the Contractor shall triage the defect in accordance with Table 2 and Table 3 below, identify a resolution for the defect, and execute the resolution.

The Tier 1, Tier 2, and Tier 3 Help Desk support shall include:

a. The Contractor shall provide a detailed Help Desk Support Plan, that includes Standard Operating Procedures (SOPs) for the support provided.

b. Providing help to authorized users via email, online portal chat, or telephone.

c. Managing and tracking all environment outages.

d. Managing Help Desk request fulfillment, access management, and planned and preventive maintenance.

e. Providing problem management tracking for three severity (SEV) levels of problem requests and timely resolutions for infrastructure problems in accordance with the Service Level Agreement (SLA):

i. A SEV A Incident shall be defined as system down or capacity diminished by greater that 10%.

ii. A SEV B Incident shall be defined as system down or capacity diminished by less than 10% or change order not requiring additional resources.

iii. A SEV C Incident shall be defined as routine maintenance or schedulable activity.

f. Notifying the VA PM of scheduled maintenance windows per the SLA.

g. Coordinating with VA for network outage, reconfiguration, and network troubleshooting issues.

The Contractor shall provide a Help Desk Report to include the number of tickets opened, number of tickets closed, status of remaining open tickets, and outages.

TABLE 2 - RESPONSE TIMES FOR TIERS 1, 2 AND 3

Severity Code

Tier 1 Initial Response to Customer

Tier 1 escalate to Tier 2

Tier 2 Initial Response to Tier 1

Tier 2 escalate to Tier 3 for initial contact

Tier 3 response to Tier 2

Tier 2 requests updates from Tier 3 based on

SLA

resolution

Resolution Time based on SLA from time incident initially reported

1 – Critical 15 minutes 0-15 minutes minutes

0-15 minutes minutes

On call until issue resolved or hourly status check

0-2 business hours

2 – Serious 1 hour 30 minutes

1 hour 30 minutes

1 hour On call until issue resolved or hourly status check

1 business day

3 – Moderate

4 hours 1 hour 4 hours 1 hour 4 hours Daily 2 business days

Table 3 - Severity Code Level Definitions for Defects

Level 1 Severity

– Critical Defect

The defect results in the failure of the complete software system, of a subsystem, or of a software unit (program or module) within the system.

Level 2 Severity

- Serious Defect

The defect results in the failure of the complete software system, of a subsystem, or of a software unit (program or module) within the system. There is no way to make the failed component(s) function. However, there are acceptable processing alternatives which will yield the desired result.

Level 3 Severity

– Moderate Defect

The defect does not result in a failure, but causes the system to produce incorrect, incomplete, or inconsistent results, or the defect impairs the systems usability.

A. Priority and Activity log per 1.4.4.a B. Help Desk Support Plan 1.4.6 C. Help Desk Report 1.4.6

1.5 ASSESSMENT, AUTHORIZATION, AND CONTINUOUS MONITORING

1.5.1 If the solution is FedRAMP Authorized but not VA Authorized:

1. The information system solution selected by the Contractor shall comply with the Federal Information Security Management Act (FISMA)

2. The Contractor shall comply with FedRAMP requirements as mandated by Federal laws and policies, including making available any documentation, physical access, and logical access needed to support this requirement

3. The system must be FedRAMP Authorized at no less than the Moderate

4. The Contractor shall, where applicable, assist with the VA ATO Process to help achieve agency authorization of the cloud service or migrated application.

5. The Contractor shall develop a VA specific system boundary diagram including any integration and connectivity components that will be known as a VA Implementation Diagram (VAID) demonstrating the proposed implementation of this system at VA. The Contractor shall provide the VAID within 10 calendar days of contract award.

6. The Contractor shall provide confirmation of their FedRAMP System Security Plan (SSP) and supporting documentation completion via their repository ID number and a link for VA to download the SSP and all required artifacts within 5 calendar days of contract award.

https://www.fedramp.gov/agency-authorization/

7. The Contractor shall provide the results of their most recent Third-Party Assessment Organization (3PAO) Security Assessment Plan (SAP) within 10 calendar days of contract award.

8. The Contractor shall complete a 3PAO Security Assessment Report (SAR) within 10 calendar days after the SSP is accepted by VA.

9. The Contractor shall provide VA with the most recent monthly scans for the production environment within the authorization boundary and their scan upload schedule for FedRAMP within 30 calendar days of contract award.

10. The Contractor shall provide their availability to participate in monthly continuous monitoring meetings to be scheduled following successful VA ATO within 30 calendar days of contract award.

11. Contractor shall work with assigned VA SME to develop a VA specific Incident Response Plan (IRP) and perform an IRP Table Top Exercise with VA Stakeholders. This should be completed within 30 calendar days of the SAR being delivered.

12. If new or unanticipated vulnerabilities are discovered by either VA or the Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party in accordance with Addendum B, VA Information and Information System Security/Privacy Language

13. The Contractor shall comply with data management requirements.

14. Successful issuance of a VA ATO will be required before live VA data can be used in the system.

A. VA Implementation Diagram B. FedRAMP System Security Plan (SSP) and supporting documentation C. 3PAO Security Assessment Plan (SAP) D. 3PAO Security Assessment Report (SAR) E. IRP Scenario

1.5.2 If the solution is FedRAMP Authorized and VA Authorized:

1. The information system solution selected by the Contractor shall comply with the

Federal Information Security Management Act (FISMA) and have a current VA authorization.

2. The Contractor shall comply with FedRAMP requirements as mandated by Federal laws and policies, including making available any documentation, physical access, and logical access needed to support this requirement.

3. The FedRAMP Authorization level and existing VA ATO should be no less than the level required for this use case which has been defined as Moderate

4. The Contractor shall, where applicable, assist with the VA ATO Sustainment Process to help maintain health and quality of agency authorization of the cloud service or migrated application.

5. The Contractor shall exclusively provide licenses and/or accounts to FedRAMP authorized and VA authorized environments.

6. The Contractor shall afford VA access to the Contractor’s and Cloud Service Provider’s (CSP) facilities, installations, technical capabilities, operations, documentation, records, and databases.

7. If new or unanticipated vulnerabilities are discovered by either VA or the Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party in accordance with Addendum B, VA Information and Information System Security/Privacy Language

8. The Contractor shall comply with data management requirements.

9. Successful issuance of a VA ATO will be required before live VA data can be used in the system.

10. The Contractor shall participate in monthly Agency and FedRAMP Sustainment meetings following the granting of a VA ATO.

11. The Contractor shall provide continuous monitoring activities including scans, security artifacts, and monthly Plan of Action and Milestones (POAM) reports as outlined by FedRAMP requirements.

A. Continuous monitoring security artifacts B. Continuous monitoring scans C. Plan of Action and Milestones reports

1.6 OUTGOING TRANSITION MANAGEMENT (OPTIONAL TASK 1)

1. Upon notification from the VA that there is going to be a transition from the awarded PMIS to a different contracted PMIS system. The Contractor shall deliver feedback on how the Government can execute a smooth transition to a successor Contractor.

The Contractor shall allow for transition of the required data without interruption to the Government.

2. VA data shall be accessible both during and after data migration through the end of the contract. All existing metadata shall remain intact and unaltered throughout migration. This shall include, at a minimum, the creation date and last modified date. Share and file permissions shall match the originating location.

3. The Contractor shall also transfer any data migration-specific knowledge to the VA PM and COR via a Data migration plan.

4. The Contractor shall also document the progress status and results of the data migration throughout the VA specified timeline and provide updates upon request from the COR.

5. Work shall be completed within 90-days of execution of the optional task.

A. Data migration plan per 1.6.3

2.0 NOTICE OF THE FEDERAL ACCESSIBILITY LAW AFFECTING ALL

INFORMATION AND COMMUNICATION TECHNOLOGY (ICT)

PROCUREMENTS (SECTION 508)

On January 18, 2017, the Architectural and Transportation Barriers Compliance Board (Access Board) revised and updated, in a single rulemaking, standards for electronic and information technology developed, procured, maintained, or used by Federal agencies covered by Section 508 of the Rehabilitation Act of 1973, as well as our guidelines for telecommunications equipment and customer premises equipment covered by Section 255 of the Communications Act of 1934. The revisions and updates to the Section 508-based standards and Section 255-based guidelines are intended to ensure that information and communication technology (ICT) covered by the respective statutes is accessible to and usable by individuals with disabilities.

2.1 SECTION 508 – INFORMATION AND COMMUNICATION TECHNOLOGY (ICT)

STANDARDS

The Section 508 standards established by the Access Board are incorporated into, and made part of all VA orders, solicitations and purchase orders developed to procure ICT.

These standards are found in their entirety at: https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines. A printed copy of the standards will be supplied upon request.

Federal agencies must comply with the updated Section 508 Standards beginning on January 18, 2018. The Final Rule as published in the Federal Register is available from the Access Board: https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule.

The Contractor shall comply with “508 Chapter 2: Scoping Requirements” for all electronic ICT and content delivered under this contract. Specifically, as appropriate for the technology and its functionality, the Contractor shall comply with the technical standards marked here:

E205 Electronic Content – (Accessibility Standard -WCAG 2.0 Level A and AA Guidelines)

E204 Functional Performance Criteria https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule

E206 Hardware Requirements E207 Software Requirements E208 Support Documentation and Services Requirements

2.2 COMPATABILITY WITH ASSISTIVE TECHNOLOGY

The standards do not require installation of specific accessibility-related software or attachment of an assistive technology device. Section 508 requires that ICT be compatible with such software and devices so that ICT can be accessible to and usable by individuals using assistive technology, including but not limited to screen readers, screen magnifiers, and speech recognition software.

2.3 ACCEPTANCE AND ACCEPTANCE TESTING

Deliverables resulting from this solicitation will be accepted based in part on satisfaction of the Section 508 Chapter 2: Scoping Requirements standards identified above.

The Government reserves the right to test for Section 508 Compliance before delivery.

The Contractor shall be able to demonstrate Section 508 Compliance upon delivery.

3.0 INFORMATION TECHNOLOGY USING ENERGY-EFFICIENT PRODUCTS

Not applicable

4.0 SHIPMENT OF SOFTWARE OR RELATED ITEMS

Electronic Delivery:

Ship To and Mark For:

Primary Alternate Name: Name:

Address: TBD Address:

Voice: Voice:

Email: Email:

5.0 GENERAL REQUIREMENTS

5.1 VA TECHNICAL REFERENCE MODEL (TRM)

The Contractor shall support the VA enterprise management framework. In association with the framework, the Contractor shall comply with OIT Technical Reference Model (VA TRM). The VA TRM is one component within the overall Enterprise Architecture (EA) that establishes a common vocabulary and structure for describing the information technology used to develop, operate, and maintain enterprise applications. Moreover, the VA TRM, which includes the Standards Profile and Product List, serves as a technology roadmap and tool for supporting OIT. Architecture & Engineering Services (AES) has overall responsibility for the VA TRM.

5.2 SOCIAL SECURITY NUMBER (SSN) REDUCTION

The Contractor solution shall support the SSN Fraud Prevention Act (FPA) of 2017 which prohibits the inclusion of SSNs on any document sent by mail. The Contractor support shall also be performed in accordance with Section 240 of the Consolidated Appropriations Act (CAA) 2018, enacted March 23, 2018, which mandates VA to discontinue using SSNs to identify individuals in all VA information systems as the Primary Identifier. The Contractor shall ensure that any new IT solution discontinues the use of SSN as the Primary Identifier to replace the SSN with the Integrated Control Number (ICN) in all VA information systems for all individuals. The Contractor shall ensure that all Contractor delivered applications and systems integrate with the VA Master Person Index (MPI) for identity traits to include the use of the ICN as the Primary Identifier. The Contractor solution may only use a Social Security Number to identify an individual in an information system if and only if the use of such number is required to obtain information VA requires from an information system that is not under the jurisdiction of VA.

5.3 INTERNET PROTOCOL VERSION 6 (IPV6)

The Contractor solution shall support Internet Protocol Version 6 (IPv6) based upon the memo issued by the Office of Management and Budget (OMB) on November 19, 2020 (https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-07.pdf). IPv6 technology, in accordance with the USGv6 Program (https://www.nist.gov/programs-projects/usgv6-program/usgv6-revision-1), NIST Special Publication (SP) 500-267B Revision 1 “USGv6 Profile” (https://doi.org/10.6028/NIST.SP.500-267Br1), and NIST SP 800-119 “Guidelines for the Secure Deployment of IPv6” (https://doi.org/10.6028/NIST.SP.800-119), compliance shall be included in all IT infrastructures, application designs, application development, operational systems and sub-systems, and their integration. In addition to the above requirements, all devices shall support native IPv6 and dual stack (IPv6 / IPv4) connectivity without additional memory or other resources being provided by the Government, so that they can https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-07.pdf file://R04.med.va.gov/V03/EAS/Users/vhaeasWymbsk/TEMPLATES--NEW%20TAC%20PROCESS/PWS%20TEMPLATE%20(DO%20NOT%20TOUCH)%20-%20In%20Process%20Revisions/DO%20NOT%20TOUCH%20(next%20version/IPv6/(https:/www.nist.gov/programs-projects/usgv6-program/usgv6-revision-1 file://R04.med.va.gov/V03/EAS/Users/vhaeasWymbsk/TEMPLATES--NEW%20TAC%20PROCESS/PWS%20TEMPLATE%20(DO%20NOT%20TOUCH)%20-%20In%20Process%20Revisions/DO%20NOT%20TOUCH%20(next%20version/IPv6/(https:/www.nist.gov/programs-projects/usgv6-program/usgv6-revision-1 https://doi.org/10.6028/NIST.SP.500-267Br1 https://doi.org/10.6028/NIST.SP.800-119 function in a mixed environment. All public/external facing servers and services (e.g.

web, email, DNS, ISP services, etc.) shall support native IPv6 and dual stack (IPv6 / IPv4) users and all internal infrastructure and applications shall communicate using native IPv6 and dual stack (IPv6 / IPv4) operations.

5.4 SOFTWARE AND LICENSING REQUIREMENTS

The Contractor shall be responsible for the provision of all software licenses and any associated licensing maintenance required for any development, delivery, integration, operation, and/or maintenance associated with its proposed application(s), software products, software solution, and/or system including, but not limited to, any and all application(s), software and/or software products that comprise, are a part of, or integrate with the Contractor’s proposed application(s), software products, software solution, and/or system for the life of any resulting contract.

5.5 POSITION/TASK RISK DESIGNATION LEVEL(S)

Position Sensitivity and Background Investigation Requirements by Service Task/Item Number

Service Task/ Item Number

Tier1 / Low Risk Tier 2 / Moderate Risk

Tier 4 / High Risk

1.1 1.2 1.3 1.4 1.5 1.6

The Tasks identified above and the resulting Position Sensitivity and Background Investigation requirements identify, in effect, the Background Investigation requirements for Contractor individuals, based upon the tasks the particular Contractor individual will be working. The submitted Contractor Staff Roster must indicate the required Background Investigation Level for each Contractor individual based upon the tasks the Contractor individual will be working, in accordance with their submitted proposal

POINTS OF CONTACT

VA Program Manager:

Name:

Address:

Voice:

Email:

Contracting Officer’s Representative:

Name:

Address:

Voice:

Email:

Contracting Officer:

Name:

Address:

Voice:

Email:

Contract Specialist:

Name:

Address:

Voice:

Email:

INFORMATION SECURITY CONSIDERATIONS:

All VA sensitive information shall be protected at all times in accordance with local security field office System Security Plans (SSP’s) and Authority to Operate (ATO)’s for all systems/LAN’s accessed while performing the tasks detailed in this Product Description.

A prohibition on unauthorized disclosure: “Information made available to the Contractor or Subcontractor by VA for the performance or administration of this contract or information developed by the Contractor/Subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA.” This clause expressly limits the Contractor/Subcontractor’s rights to use data as described in Rights in Data – General, FAR 52.227-14(d).(1).

A requirement for data breach notification: Upon discovery of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the Contractor/Subcontractor has access, the Contractor/Subcontractor shall immediately notify the COR and simultaneously, the designated ISO, and Privacy Officer for the contract. The term “security incident” means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. See VA Handbook 6500.6, Appendix C, paragraph 6.a.

A requirement to pay liquidated damages in the event of a data breach: “In the event of a data breach or privacy incident involving SPI the contractor processes or maintains under this contract, the contractor shall be liable to VA for liquidated damages for a specified amount per affected individual to cover the cost of providing credit protection services to those individuals.” However, it is the policy of VA to forgo collection of liquidated damages in the event the Contractor provides payment of actual damages in an amount determined to be adequate by the agency.

Based on the determinations of the independent risk analysis, the Contractor shall be responsible for paying to VA liquidated damages in the amount of $37.50 per affected individual to cover the cost of providing credit protection services to affected individuals consisting of the following:

1) Notification;

2) One year of credit monitoring services consisting of automatic daily monitoring of at least 3 relevant credit bureau reports;

3) Data breach analysis;

4) Fraud resolution services, including writing dispute letters, initiating fraud alerts and credit freezes, to assist affected individuals to bring matters to resolution;

5) One year of identity theft insurance with $20,000.00 coverage at $0 deductible; and

6) Necessary legal expenses the subjects may incur to repair falsified or damaged…