Performance Work Statement Biometrics Proof of Concept_ DRAFT.docx

Biometric Authentication Proof of Concept

VA-25-00068423

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Office of Information & Technology Office of Information Security

Biometric Authentication Proof of Concept

Date: May 2025

VA-25-00068423

PWS Version Number: 10.0

Contents

BACKGROUND

Department of Veterans Affairs (VA) is dedicated to delivering world-class healthcare and benefits services to Veterans, leveraging automation and innovative solutions to continually enhance efficiency and improve the Veteran experience. The Office of Information Security (OIS) prioritizes safeguarding VA Information Technology (IT) assets while streamlining processes and integrating advanced technologies to provide Veterans secure, timely, and high-quality services. To further this commitment, VA is exploring face and iris recognition biometric solutions for access management processes in clinical environments. VA aims to:

· Increase efficiency and reduce friction for clinical staff accessing the resources they need for Veteran care by introducing a fast and contactless technology that can also help maintain sterile environments.

· Enhance security by using authentication factors that are intrinsic to each individual and cannot be shared – which can strengthen phishing-resistant multifactor authentication (MFA) and reduce security risks (e.g., credential sharing).

· Strengthen accountability by enhancing VA’s visibility into authentication events, creating a centralized audit trail, and accelerating adoption of processes such as Role Based Access Control.

The Biometric Authentication Proof of Concept aims to enhance VA’s understanding of current biometric solutions for physical access authentication. VA will test the solution at a healthcare training facility or an active healthcare facility and will evaluate the feasibility of applying a commercial off the shelf (COTS) (i.e., ready to deploy) solution within VA’s operational environment. It will also assess the effectiveness, efficiency, reliability, security, and user satisfaction with the Biometric Authentication Solution. VA will identify trends and challenges related to people, processes, or technology and inform VA decision-makers on scaling the technology.

APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. “Federal Information Security Modernization Act of 2014”

2. Federal Information Processing Standards (FIPS) Publication 140-3, “Security Requirements for Cryptographic Modules”, March 22, 2019

3. FIPS Pub 199. “Standards for Security Categorization of Federal Information and Information Systems,” February 2004

4. FIPS Pub 200, “Minimum Security Requirements for Federal Information and Information Systems,” March 2006

5. FIPS Pub 201-3, “Personal Identity Verification of Federal Employees and Contractors,” January 2022

6. 10 U.S.C. § 2224, "Defense Information Assurance Program", as amended

7. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

8. Public Law 109-461, Veterans Benefits, Health Care, and Information Technology Act of 2006, as amended, Title IX, Information Security Matters

9. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”, as amended

10. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, https://www.va.gov/vapubs/index.cfm

11. VA Handbook 0710, “Personnel Security and Suitability Program,” May 2, 2016, https://www.va.gov/vapubs/index.cfm

12. VA Directive 6102, “Internet/Intranet Services,” August 5, 2019

13. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and Guidelines,” as amended

14. Office of Management and Budget (OMB) Circular A-130, “Managing Federal Information as a Strategic Resource,” July 28, 2016

15. NIST SP 800-66 Rev. 2, “Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule: A Cybersecurity Resource Guide,” February 2024

16. 45 C.F.R Parts 160 and 164, Subparts A and E, the Standards for Privacy of Individually Identifiable Health Information (“Privacy Rule”); and 45 C.F.R. Parts 160 and 164, Subparts A and C, the Security Standard (“Security Rule”); as amended

17. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended, as amended

18. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

19. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021 (see VA NOTICE 24-18, dated September 27, 2024 for updates)

20. VA Handbook 6500, “Risk Management Framework for VA Information Systems VA Information Security Program,” February 24, 2021 (see VA Notice 25-01, dated October 15, 2024 for updates) VA 6500 Directive and Handbooks

21. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI),” June 30, 2023

22. VA Handbook 6500.6, “Contract Security,” March 12, 2010 (see VA Notice 24-12, dated April 22, 2024 for updates to Appendix C)

23. VA Handbook 6500.8, “Information System Contingency Planning,” April 6, 2011

24. VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018

25. VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017

26. OIT Process Asset Library (PAL), OIT Process Asset Library

27. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014

28. VA Directive 6510, “VA Identity, Credential and Access Management,” September 3, 2024

29. VA Handbook 6510, “VA Identity, Credential and Access Management,” September 27, 2024

30. VA Directive and Handbook 6513, “Secure External Connections,” October 12, 2017

31. VA Directive 6300, “Records and Information Management,” September 21, 2018

32. VA Handbook, 6300.1, “Records Management Procedures,“ March 24, 2010

33. NIST SP 800-37 Rev 2, “Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy,” December 2018

34. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020)

35. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015

36. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” March 24, 2014

37. OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005

38. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019

39. OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008

40. Federal Identity, Credential, and Access Management (FICAM) Architecture, June 30, 2023 (FICAM Architecture (idmanagement.gov))

41. NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access,“ June 2018

42. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, “Digital Identity Guidelines,” updated March 02, 2020

43. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014

44. VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

45. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

46. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

47. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

48. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019

49. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008

50. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (P.L. 110–140), December 19, 2007

51. Section 104 of the Energy Policy Act of 2005, (P.L. 109–58), August 8, 2005

52. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 2, 2001

53. VA Directive 0057, “VA Environmental Management Program,” October 25, 2022

54. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

55. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

56. “Veteran Focused Integration Process (VIP) Guide 4.0,” March 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

57. VA Memorandum “Proper Use of Email and Other Messaging Services,” January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

58. “Product Line Management Transformation Playbook” version 3.1, August 2023, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

59. NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020

60. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol Version 6 (IPv6),” November 19, 2020

61. Social Security Number (SSN) Fraud Prevention Act of 2017

62. Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23, 2018

63. C.F.R Title 15 Part 7, “Securing the Information and Communications Technology and Services (ICTS) Supply Chain”, as amended

64. Executive Order 14028, “Executive Order on Improving the Nation's Cybersecurity,” May 12, 2021, https://www.whitehouse.gov/briefing-room/presidential-actions/2021/05/12/executive-order-on-improving-the-nations-cybersecurity/

65. OMB Memorandum M-22-09, “Moving the U.S. Government Toward Zero Trust Cybersecurity Principles”, January 26, 2022, https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf.

66. NIST SP 800-52 Revision 2, “Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations

67. OMB M-22-18, “Enhancing the Security of the Software Supply Chain through Secure Software Development Practices,” September 14, 2022

68. OMB M-23-16, “Update to Memorandum M-22-18,” June 9, 2023

69. OMB M-21-31, “Improving the Federal Government’s Investigative and Remediation Capabilities Related to Cybersecurity Incidents,” August 27, 2021

70. CISA Binding Operational Directive (BOD) 19-02: “Vulnerability Remediation Requirements of Internet-Accessible Systems,” April 29, 2019, BOD 19-02: Vulnerability Remediation Requirements for Internet-Accessible Systems | CISA

71. CISA BOD 22-01: “Reducing the Significant Risk of Known Exploited Vulnerabilities,” November 3, 2021, BOD 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities | CISA

72. CISA BOD 23-01: Improving Asset Visibility and Vulnerability Detection on Federal Networks.” Cybersecurity & Infrastructure Security Agency (CISA), BOD 23-01: Improving Asset Visibility and Vulnerability Detection on Federal Networks | CISA

73. VA Memorandum, “VA Security Controls,” January 17, 2025, https://www.voa.va.gov/DocumentView.aspx?DocumentID=5010

74. National Institute of Standards and Technology (NIST) Special Publication (SP) 800-76-2, “Biometric Specifications for Personal Identity Verification,” July 2013, https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-76-2.pdf

75. NIST SP 800-88, “Guidelines for Media Sanitization,” December 2014, https://csrc.nist.gov/pubs/sp/800/88/r1/final

76. “NIST PRIVACY FRAMEWORK: A TOOL FOR IMPROVING PRIVACY THROUGH ENTERPRISE RISK MANAGEMENT, VERSION 1.0,” January 16, 2020, https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.01162020.pdf

77. NIST SP 800-218, “Secure Software Development Framework (SSDF) Version 1.1: Recommendations for Mitigating the Risk of Software Vulnerabilities,” February 2022, https://csrc.nist.gov/pubs/sp/800/218/final

78. “GENERAL RECORDS SCHEDULE 3.2: Information Systems Security Records,” January 2023, https://www.archives.gov/files/records-mgmt/grs/grs03-2.pdf

79. “VA Technical Reference Model v 25.2,” February 1, 2025, https://www.oit.va.gov/Services/TRM/TRMHomePage.aspx

80. NIST SP 800-131A Revision 2, “Transitioning the Use of Cryptographic Algorithms and Key Lengths,” March 6, 2025, Transitioning the Use of Cryptographic Algorithms and Key Lengths

81. Public Law 113-283, “Public Law 113 – 283 – Federal Information Security Modernization Act of 2014,” December 18, 2014, Public Law 113 - 283 - Federal Information Security Modernization Act of 2014 - Content Details –

82. VA Directive 6500, “VA CYBERSECURITY PROGRAM,” February 24, 2021, VA Publications

83. Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance, December 2, 2011, https://arch.idmanagement.gov/#what-is-the-ficam-architecture

84. VA Enterprise Cloud (VAEC) Technical Reference Guide, Version 2.0 November 2022

85. VA Cloud-First Policy – Use of VAEC to Host Applications, January 16, 2018 https://www.vendorportal.ecms.va.gov/FBODocumentServer/DocumentServer.aspx?DocumentId=4683493&FileName=36C10B19Q0072-006.docx

86. VAEC First Policy – Use of VAEC for New Development, January 7, 2019

87. VA Cloud Native Technology Policy – Use of Software-as-a-Service (SaaS), Managed Services, and Cloud-Based Native Technologies and Approaches, April 10, 2018 Department of Veterans Affairs Memorandum – “VA Critical Security Controls,” January 17, 2025

SCOPE OF WORK

For the initial phase, the Contractor shall plan (e.g., meet architectural requirements, survey the site, and set milestones), deploy (e.g., install, integrate, and test systems), operate (e.g., enrollment, training, monitoring, and maintaining), and support the analysis of a Biometric Authentication Solution, based on face and / or iris recognition, to control access to restricted physical spaces for VA staff. The Contractor shall provide a COTS (i.e., ready to deploy) solution that requires minimal customization to deploy and operate within VA. The Contractor shall provide software, hardware, and implementation services. The solution shall integrate with Physical Access Control Systems (PACS) at VA facilities (see Appendix – PACS) and be scalable for enterprise-wide physical and / or logical access. The Contractor shall be responsible for project management, planning, solution deployment, specific operational support tasks, and analytical support for monitoring the solution’s performance. At the completion of the evaluation, the Contractor shall support the removal of the Biometric Authentication Solution and restoration of VA-owned infrastructure to its previous state.

The Contractor shall deploy to a Test Site, which may be a VA healthcare training facility or an active VA healthcare facility. The Contractor’s solution shall provide physical access control based on biometric authentication for restricted physical spaces identified by the Test Site with an operational period of up to 90 days.

The Biometric Authentication Solution shall be installed in parallel with existing access methods and shall:

· Provide enrolled VA staff with a hands-free method of accessing restricted physical spaces.

· Conduct a one-to-many (1:N) match of enrolled user’s face or iris against a database of biometric templates, hosted on-premise at the Test Site, without any additional knowledge or physical authentication factors.

· Verify each enrolled VA staff member’s identity, role, and access permissions, allowing access to restricted physical spaces only if an enrolled VA staff members identify, role, and access permissions permit access as part of their assigned duties.

· Integrate with existing infrastructure and PACS (see Appendix - PACS), enabling continued use of existing PACS by non-enrolled VA staff as a fallback mechanism.

· Meet or exceed all hardware, software, and data requirements outlined in Appendix - Solution Requirements.

· Include hardware installation and removal, site engineering assessment for infrastructure requirements, burn-in and initial operator instruction, and user feedback collection.

A Biometric Authentication Solution shall not:

· Impede emergency access to healthcare resources or otherwise negatively impact VA operations.

· Collect, process, transmit, or store data for any persons other than enrolled VA staff, including but not limited to Veterans and non-enrolled VA staff.

· Collect, process, transmit, or store any Protected Health Information (PHI).

· Collect, process, transmit, or store data for any other purpose than to execute the scope of work.

Based on evaluation results, VA may choose to exercise optional task to further assess, scale, or decommission the Biometric Authentication Solution, including:

· Integrate biometric authentication as an option for logical access authentication at the enterprise-level for VA-owned and operated IT assets, including laptops, desktops, other mobile IT assets (e.g., clinical workstations), and software applications. Logical access control shall not include medical devices.

· Migrate deployment to within the VA Enterprise Cloud (VAEC) network and centralization of applicable functions (e.g., provisioning / deprovisioning, log aggregation).

· Scale the Biometric Authentication Solution to support physical and / or logical access control at multiple VA facilities.

PERFORMANCE DETAILS

PERFORMANCE PERIOD (POP)

The PoP shall be twelve (12) months from the date of award, with one (1) option year of twelve 12 months that contains three (3) Optional Tasks. The overall PoP shall not exceed twenty four (24) months.

Any work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO).

There are eleven (11) Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, four are set by date:

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

PLACE OF PERFORMANCE

Tasks under this PWS shall be performed in VA facilities, including but not limited to VA healthcare training facilities and / or VA healthcare facilities. Work may be performed at remote locations and / or Contractor facilities with prior concurrence from the Contracting Officer’s Representative (COR). The Contractor shall identify the Contractor’s place of performance in their proposal submission.

TRAVEL

The Government anticipates travel under this effort to perform the tasks associated with the effort, as well as to attend program-related meetings or conferences throughout the PoP. Include all estimated travel costs in your firm-fixed price line items. These costs will not be directly reimbursed by the Government.

The total estimated number of trips in support of the program related meetings for this effort is up to ten (10). Anticipated locations include the following, estimated at one (1) to five (5) days in duration:

1. POC Test Site (to be determined) site survey: 1-2 days

2. POC Test Site (to be determined) deployment: 1-5 days

3. POC Test Site (to be determined) transition out: 1-5 days

SPECIFIC TASKS AND DELIVERABLES

PROJECT MANAGEMENT

CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, timeline, and tools to be used in execution of the contract. The CPMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks, and resource supports. The CPMP shall also include how the Contractor shall coordinate and execute the planned, routine, and ad hoc data collection reporting request as identified within the PWS. The initial baseline CPMP shall be concurred upon and updated in accordance with Section B of the contract. The Contractor shall update and maintain the VA PM approved CPMP throughout the Period of Performance.

Deliverable:

A. Contractor Project Management Plan

REPORTING REQUIREMENTS

The Contractor shall provide the Contracting Officer’s Representative (COR) with Weekly Progress Reports in electronic form in Microsoft Word and Project formats. The report shall include detailed instructions / explanations for each required data element, to confirm that data is accurate and consistent. These reports shall reflect data as of the last day of the preceding week.

The weekly progress reports shall cover all work completed during the reporting period and work planned for the subsequent reporting period. The report shall also identify any problems that arose and a description of how the problems were resolved. If problems have not been completely resolved, the Contractor shall provide an explanation including their plan and timeframe for resolving the issue. The report shall also include an itemized list of all Information and Communication Technology (ICT) deliverables and their current Section 508 compliance status. The contractor shall monitor performance against the CPMP and report any deviations. It is expected that the Contractor will keep communication with VA accordingly so that issues that arise are transparent to both parties, preventing escalation of outstanding issues.

The Contractor shall facilitate a weekly Integrated Project Team (IPT) meeting to review progress towards development, deployment, and operational milestones, discuss any risks, challenges, or barriers to achieving milestones, and coordinate POC activities between the vendor, Test Site, OIS, and the government Program Manager.

Deliverable:

A. Weekly Progress Report Physical Access Authentication Test Plan The Contractor shall plan an approach for deploying a Biometric Authentication Solution, based on face or iris recognition, to authenticate physical access. The solution shall provide a phishing-resistant option, in parallel with existing methods, for VA staff to authenticate access restricted physical spaces.

Solution Architecture Diagram The Contractor shall provide a clear visual representation to verify that work done is repeatable and expandable for future enterprise-wide development. In one or more Solution Architecture Diagram(s), the Contractor shall:

1. Identify all major system components, their role(s), function(s), and relevant technical specifications, including but not limited to hardware, software, and any other required IT assets.

2. Describe how required software, hardware, data, infrastructure, or networking functions, align to VA requirements.

3. Document any additional architectural elements or considerations required for the solution.

4. Confirm all security configurations within these device components are compliant with the VA critical security controls memo.

5. Identify hardware and software settings that can be configurable and recommend settings / configurations to achieve VA’s outcomes (e.g., match speed, match accuracy).

6. Detail the steps required to scale the solution from test to production.

7. Illustrate data flows between components, describing what data elements will be collected and transmitted throughout the system.

8. Identify all network connections, integration points, and dependencies with the system.

9. Demonstrate how users and system components interact to achieve VA’s use case.

Deliverable:

A. Solution Architecture Diagram Site Survey Report The Contractor shall conduct a site survey, in coordination with representatives of the Test Site, to recommend suitable deployment locations and operational considerations. In a Site Survey Report, the Contractor shall:

1. Recommend installation locations (i.e., access points to restricted physical spaces) and associated infrastructure requirements (e.g., power, data, physical space).

2. Validate with the Test Site that installation locations will not impair or negatively impact VA’s operations.

3. Validate installation locations will facilitate a sufficient volume of user traffic to successfully measure Biometric Authentication Solution statistically significant performance and impacts on clinical operations.

4. Identify and document environmental variables that could impact performance (e.g., lighting conditions).

5. Document any additional risks, challenges, decision points, and recommendations not included above.

Deliverable:

A. Site Survey Report Deployment Plan The Contractor shall develop a detailed plan, informed by the Site Survey report, to deploy the Biometric Authentication Solution at the Test Site, which will include milestones, timelines, risks, and dependencies. In a Deployment Plan, the Contractor shall:

1. Recommend an approach to integrate the Biometric Authentication Solution at each deployment location, including any physical infrastructure additions or retrofits to existing infrastructure, coordination steps with the Test Site PACS administrator, and method of validating user identities, roles, and access permissions.

2. Detail an approach for log generation, collection, storage, and analysis.

3. Define all functional testing workflows, processes, and assessment criteria to validate functionality and user acceptance. Alternatively, the Government may choose to accept independent third-party assessments submitted by the Contractor that demonstrate similar outcomes to functional / user acceptance testing of the Contractor’s solution.

4. Define clear phases, milestones, and deliverables for development, as well as success criteria and deadlines for each phase, milestone, and deliverable.

5. Confirm approval by OIS of phases, milestones, deliverables, success criteria, and timelines.

6. Develop, in coordination with OIS and the Test Site, a Responsible, Accountable, Consulted, and Informed (RACI) matrix to align milestones, decision points, and approval authority to specific stakeholders, such as OIS or the Test Site.

7. Identify dependencies / actions required by other stakeholders, risks, and mitigation strategies to overcome dependencies / risks.

8. Document and escalate to OIS any additional challenges / risks identified during development that may impact requirements, milestones, timelines, etc. and recommend mitigation strategies to overcome challenges / risks.

9. Document any requirement, milestone, timeline, or scope changes approved by OIS in a change log.

The Contractor shall coordinate review of the Deployment Plan by the Test Site, OIS, and any other stakeholders designated by OIS – and revise the document based on their feedback. The Contractor must receive written approval from all organizations that review the Deployment Plan.

The Contractor shall execute the finalized Deployment Plan at the Test Site and integrate in parallel with existing infrastructure, including installation of all hardware, software, and data components in coordination with the Test Site and OIS. In executing the Deployment Plan, the Contractor shall:

10. Deliver and coordinate installation with the Test Site of any Contractor-provided hardware required to implement the Biometric Authentication Solution.

11. Coordinate the installation of any other required hardware and mitigating controls for environmental variables with the Test Site.

12. Coordinate the installation of any required software on VA-operated on-premise IT assets with the Test Site and / or Office of Information Technology (OIT).

13. Coordinate configuration of all hardware, software, and network assets to meet the solution’s hardware, software, and data requirements with the Test Site and / or OIT.

14. Validate hardware installation and functionality, including but not limited to power connections and backups, mitigating controls for environmental factors, fallback mechanism(s) and emergency override, and network connectivity.

15. Notify OIS of any findings from the execution of the Deployment Plan in a timely manner, including any risks or barriers to achieving the plan timeline, decision points for OIS, and recommendations to overcome risks or barriers.

16. Document the successful deployment and integration of the Biometric Authentication Solution, including all actions taken to resolve risks or barriers, and provide them in writing to OIS.

Deliverable:

A. Deployment Plan Physical Access Authentication Test Operational Support The Contractor shall support the successful operation of the Biometric Authentication Solution for up to 90 days. This will include participant enrollment, operator training, troubleshooting and user support. The Contractor shall support restoring deployment locations back to their previous state after the conclusion of the operational period.

Enrollment The Contractor shall plan and implement, in coordination with the Test Site, a process to enroll participants successfully and accurately into the biometric solution. In an Enrollment Standard Operating Procedure (SOP) Approach, the Contractor shall detail processes to:

1. Identify, recruit, and notify enrolled participants.

2. Identify any Contractor-provided hardware or software required for the enrollment process.

3. Obtain and record in writing informed participant consent for enrollment, and store participant consent in a VA centralized repository (i.e., SharePoint).

4. Verify participant identities, capture high-quality images, and enroll biometric templates containing extracted features.

5. Guide users through successful image capture (e.g., distancing from the camera, removing accessories obstructing image capture, proper facial expressions) within the defined parameters.

6. Track enrollment status and intake requests for enrollment / unenrollment.

7. Unenroll participants who choose to stop participation, including purging data from the biometric solution.

In cooperation with OIS and the Test Site, the Contractor shall execute the Enrollment SOP to successfully onboard VA staff who volunteer to participate.

Deliverable:

A. Enrollment SOP Approach Operator Training The Contractor will develop Operator Training Material(s) for Test Site IT staff outlining how to complete basic troubleshooting and maintenance tasks for hardware and software. The Contractor shall:

1. Author detailed procedures for powering the on / off system components, performing a basic reboot, calibrating hardware / software components, and cleaning recommendations and schedules.

2. Recommend any additional troubleshooting and maintenance tasks for inclusion in the Operator Training Package and author detailed procedures for accomplishing additional tasks.

3. Produce digital training artifacts compatible with common office productivity software / conference equipment and providable to participants as offline copies viewable on VA issued equipment.

4. Modify training materials, as needed, to include additional procedures requested by Test Site staff.

Deliverable:

A. Operator Training Material(s) Troubleshooting and User Support The Contractor shall plan and provide end-user and troubleshooting support to triage functional / operational challenges, resolve functional / operational challenges in a timely manner, and promote a positive experience for participants. In a User Support SOP, the Contractor shall:

1. Detail methods for end users to report functional / operational challenges with the Biometric Authentication Solution and for the Contractor to communicate with end users.

2. Describe the approach for the Contractor to provide technical and troubleshooting support for end users.

3. Provide troubleshooting guides for diagnosing and resolving common functional / operational challenges reported by end users.

4. Author and coordinate with the Test Site to display informational resources for:

a. End users to self-resolve common functional / operational challenges.

b. End users to understand the purpose of the POC, the data collected by the POC, security and privacy measures in place to protect user data, and contact method(s) for end user questions.

c. VA staff administering the Biometric Authentication Solution to help self-resolve any additional functional / operational challenges identified during operation.

The Contractor shall implement the User Support SOP during the operational phase of the POC and catalog and record all issues and responses that arise on a weekly basis. In a weekly Troubleshooting and Resolution Report, the Contractor shall:

5. Catalogue all user support requests for system failures / inconsistencies.

6. Document challenges, risks, resolutions, time to resolution, and recommended changes to the POC process or biometric solution to prevent repeat incidents.

Deliverable:

A. User Support SOP B. Troubleshooting and Resolution Report Stand Down Following the conclusion of the test, the Contractor shall coordinate with OIS and the Test Site to plan and execute the restoration of all infrastructure to its previous state at each deployment location. The Contractor will coordinate with the Test Site to remove all Contractor supplied hardware and software from the Test Site and / or VA-owned IT Assets.

Physical Access Authentication Test Analysis and Reporting The Contractor shall support OIS and the Test Site to conduct an Impact Analysis, including an assessment methodology to baseline the effectiveness, efficiency, reliability, security, and user satisfaction of current authentication systems (before deployment) in comparison to the Biometric Authentication Solution at the Test Site.

The Contractor shall collect data for and monitor key performance indicators (KPIs) as described in Appendix - Key Performance Indicators. The Contractor shall measure the accuracy, efficiency, reliability, and security, and user satisfaction of the Biometric Authentication Solution against the Impact Analysis baseline – and identify areas for system performance, identity security, and customer experience improvements. The Contractor shall:

1. Recommend any additional KPIs or modifications to KPIs to measure the accuracy, efficiency, reliability, security, and user satisfaction of authentication systems, including at least the metrics outlined in Appendix - Key Performance Indicators.

2. Recommend benchmarks for each KPI that aligns with industry standards.

3. Record KPI data in a VA centralized repository (i.e., SharePoint) to collect, store, and support analysis of performance data by VA staff.

4. Support a regular analytics process that gathers qualitative feedback from users to assess the user satisfaction of the Biometric Authentication Solution, including ease of use, effectiveness, trust, and satisfaction.

Deliverable:

A. Impact Analysis Option Year One If this Optional Year is exercised by VA, the Contractor shall develop an approach for deploying the Biometric Authentication Solution for enterprise-wide for logical access and integrating with VA’s existing Single Sign On solutions. The solution shall provide a phishing-resistant MFA option, in parallel with existing methods, for VA staff to authenticate access to:

· VA owned and operated IT devices, including laptops, desktops, other IT assets (e.g., mobile clinical workstations) and software applications, with the exception that no medical devices shall be included.

· VA applications and software that utilize VA-approved identity broker(s) / identity provider(s) for authentication.

The Contractor shall plan, deploy, and operate a limited scope test of the logical access solution at up to five (5) test locations. The Contractor shall repeat all applicable requirements outlined in the base year, including Task - Physical Access Authentication Test Plan, Task - Physical Access Authentication Test Operational Support, Task - Physical Access Test Analysis and Reporting, and Task - Stand Down.

Logical Access Authentication Solution Plan The Contractor shall document an approach to meet VA’s requirements for using face and /or iris recognition to authenticate logical access. In a Logical Access Solution Plan, the Contractor shall detail plans to:

1. Integrate with VA-approved identity broker(s) / identity provider(s), directly or via Application Programming Interface (API), to provide an authentication assertion for each user session.

2. Integrate with Active Directory, directly or via API, to validate user identify, role, and access permissions.

3. Provide VA methods to centrally manage the logical access solution, such as centralized control over provisioning / deprovisioning users.

4. Support OpenID Connect (OIDC), Security Access Markup Language (SAML), and or Web Authentication API (WebAuthn) standards.

5. Enable interfacing with a PIV card provided by the user and pull a stored image of the user from the card.

6. Capture a visual photo of the user using on-device hardware and conduct a 1:1 match of an image stored on the user’s PIV card against an image captured by the device hardware / camera.

7. Work with commercial-off-the-shelf (COTS) camera equipment from variety of manufacturers.

8. Comply with all other applicable VA requirements outlined in Appendix - Solution Requirements.

Deliverable:

A. Logical Access Solution Plan Optional Task 1 – Scale Physical Access If this Optional Task is exercised by VA, the Contractor shall scale the Biometric Authentication Solution for physical access to additional VA facilities, in parallel with existing methods, and host the solution within VAEC.

The Contractor shall coordinate with VA stakeholders to refine the Biometric Authentication Solution based on findings and recommendations from VA’s evaluation of the solution during the base task. The Contractor shall migrate the solution to deploy within the VAE and support deployment of the Biometric Authentication Solution to up to five (5) VA facilities for physical access control. The Biometric Authentication Solution will provide authentication for physical access control at designated deployment locations at each VA facility, validate user identify, role, and access permissions, and provide VA methods to centrally manage physical access, such as centralized control over provisioning / deprovisioning users and log aggregation.

The Contractor shall not be responsible for providing or acquiring cloud capacity or server hosting infrastructure for this Contract. VA will furnish VAEC capacity as Government Furnished Equipment (GFE). The Contractor will support scaling in accordance with VAEC deployment, operations, and maintenance requirements. In scaling, the Contractor shall execute all applicable requirements detailed in Task - Physical Access Authentication Test Plan, Task - Physical Access Authentication Test Operational Support, Task - Physical Access Test Analysis and Reporting, and Task - Stand Down at each additional VA facility.

VAEC Architecture Diagram The Contractor shall provide a clear visual representation of the solution architecture, VA system integrations, and alignment with the VAEC Technical References Architecture as well as the One-VA Enterprise Architecture. The Contractor shall support integration with existing PACSs at VA facilities, including but not limited to systems from vendors outlined in Appendix – Physical Access Control Systems. In the VAEC Architecture Diagram(s), the Contractor shall:

1. Identify all major system components, their role(s), function(s), and relevant technical specifications, including but not limited to hardware, software, and any other required IT assets.

2. Detail the steps required to scale the solution from test environment to production to meet VA requirements and policies.

3. Illustrate data flows between components, describing what data elements will be collected and transmitted throughout the system.

4. Identify all network connections, integration points, and dependencies with the system.

5. Address VA identified cloud-readiness gaps.

6. Demonstrate how users and system components interact to achieve VA’s use case.

7. Document any additional architectural elements or considerations required for the solution.

Deliverable:

A. VAEC Architecture Diagram(s) VAEC Implementation Plan The Contractor shall develop and deliver a comprehensive plan for migrating systems to the VAEC and scaling the solution at an enterprise-level across VA. In the VAEC Implementation Plan, the Contractor shall:

1. Define the implementation approach, processes, and activities (prior to, during, and after), test strategy, setup and configuration procedure, inventory of IT assets, implementation checklists, risk assessments, key dependencies, and schedule.

2. Recommend implementation on one of VAEC’s Cloud Service Providers (i.e., Microsoft Azure or Amazon Web Services GovCloud).

3. Define a VAEC Transition Plan that defines the approach and action plans to prepare VA stakeholders to receive and operate the solution.

4. Prepare an approach for stakeholder engagement, outreach, and communication.

5. Define processes to maintain quality assurance and adhere to VA's security and compliance requirements.

6. Define the solution’s VIP Deployment and Installation, Back-out, and Rollback Plan that describes the installation, back-out, and rollback approach, processes, and activities, dependencies, and schedule – as well as provisioning and installation procedures for VAEC resources.

7. Determine cloud capacity and workload requirements for VA to review and approve cloud capacity requirements and provide the VAEC cloud capacity for the solution as GFE.

The Contractor shall execute the VAEC Implementation Plan. The Contractor shall:

8. Support setup, configuration, and provisioning of the solution in the VAEC environments.

9. Work with VA to provide inputs for establishing VAEC capacity, accounts, and privileges.

10. Monitor and track the creation, update, and deletion of application users (e.g., developer, system administrator) accounts.

11. Confirm that cloud capacity requirements are satisfied.

12. Develop necessary artifacts to obtain a VA authority to operate (ATO) for the solution and complete the VA Assessment and Authorization (A&A) process.

13. Update and maintain the A&A documentation as required for compliance after the ATO is achieved.

14. Monitor, track, and respond to Plans of Action and Milestones (POAMs)

15. Provide input to update the VAEC ATO, as needed.

16. Provide information and documentation to support operational and production readiness reviews and go-no-go decisions.

17. Execute corrective actions to address gaps, provide all required data, and prepare supporting documents / artifacts for reviews.

18. Deploy the solution in the VAEC, including all actions defined in the VIP Deployment and Installation, Back-out, and Rollback Plan.

19. Provide inputs and documentation for the Post-Implementation Review, within 5 days of implementation completion, to review lessons learned and identify improvement opportunities.

20. Describe implementation results, lessons learned, open issues, corrective actions, and improvement opportunities.

Deliverable:

A. VAEC Implementation Plan VAEC Operations and Maintenance The Contractor shall support the operation and maintenance of the solution in the VAEC, including coordinating service level agreements, utilizing VAEC General Support Services when appliable to minimize cloud service costs, and using native tools / capabilities. The Contractor shall author VAEC monitoring performance and reporting documentation.

The Contractor shall author VAEC monitoring performance and reporting documentation, including:

1. Quarterly Solution Performance Report that summarizes solution availability, usage, events and incidents, improvement opportunities, risks and issues, status, action plans, and planned and actual resolution timelines.

2. Quarterly Resource Utilization Optimization Plans to review all usage of cloud computing services and recommend actions to optimize the environment to reduce costs / resource utilization.

3. Monthly Utilization Report to provide a breakdown of all costs by solution, environment, and utilization, including the utilization of each class of resource as a percentage of provisioned capacity, total infrastructure expenditure, and total number of request services for Cloud Resource Optimization.

Deliverable:

A. Quarterly Solution Performance Report B. Quarterly Resource Utilization Optimization Plan C. Monthly Utilization Report

Physical Access Authentication Facility Scaling The Contractor shall support scaling the Biometric Authentication Solution to multiple VA facilities. The Contractor shall:

1. Assess and identify the necessary VA identity management systems that the solution will require integration to and obtain appropriate access.

2. Develop modular, franchise-style deployment modules that can be easily replicated and tailored across multiple VA facilities in accordance with the Task - Physical Access Authentication Test Plan.

3. Conduct site assessments of each facility to determine specific deployment requirements.

4. Provide documentation to support consistency in implementation across facilities and develop plans for each facility including timelines, resource allocation, and coordination with facility management.

5. Provide operational support at various locations in accordance with the Task - Physical Access Authentication Test Operational Support including enrollment, operator training, troubleshooting and user support.

6. Provide enterprise-level visibility into logging and auditing for data transmission, data storage, and data disposal in accordance with Appendix - Solution Requirements

7. Repeat execution of Task - Physical Access Authentication Test Plan and Task -Physical Access Authentication Test Operational Support to scale the solution to 10 VA facilities at a time with up to 500 deployment locations each.

8. If applicable, provide facility-wide physical access provisioning in accordance with Role Based Access Control.

Optional Task 2 – Scale Logical Access If this Optional Task is exercised by VA, the Contractor shall develop a plan for scaling the Biometric Authentication Solution for logical access to additional VA facilities / user populations, in parallel with existing methods, and host the solution within the VAEC.

The Contractor shall coordinate with VA stakeholders to refine the Biometric Authentication Solution based on findings and recommendations from VA’s evaluation of the solution during the base task. The Biometric Authentication Solution will continue to operate within the VAEC and support logical access control for users at to up to five (5) VA facilities. The Biometric Authentication Solution will provide authentication for logical access control at the enterprise-level for VA-owned and operated IT assets, including laptops, desktops, other mobile IT assets (e.g., clinical workstations), and / or software applications. Logical access control shall not include medical devices.

The Contractor will support scaling in accordance with VAEC deployment, operations, and maintenance requirements. In scaling, the Contractor shall execute all applicable tasks detailed in Task - Physical Access Authentication Test Plan, Task - Physical Access Authentication Test Operational Support, Task - Physical Access Test Analysis and Reporting, and Task - Stand Down.

Logical Access Authentication Scaling The Contractor shall support scaling the Biometric Authentication Solution to multiple VA facilities. The Contractor shall:

1. Repeat execution of applicable requirements from Task - Physical Access Authentication Test Plan and Task -Physical Access Authentication Test Operational Support to scale the solution to support logical access for enrolled VA staff at up to five (5) VA facilities at a time.

2. Assess and identify the necessary VA identity management systems that the solution…