Performance Work Statement SCGUI - V1.7.pdf

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Office of Information & Technology Supply Chain Systems Directorate (10NA2)

Supply Chain GUI Overlay

Date: February 10, 2025

VA-26-00023382

PWS Version Number: 1.17

Contents

1.0 BACKGROUND

2.0 APPLICABLE DOCUMENTS

3.0 SCOPE OF WORK

4.0 PERFORMANCE DETAILS

4.1 PERFORMANCE PERIOD

4.2 PLACE OF PERFORMANCE

4.3 TRAVEL

5.0 SPECIFIC TASKS AND DELIVERABLES

5.1 PROJECT MANAGEMENT

5.1.1 CONTRACTOR PROJECT MANAGEMENT PLAN

5.1.2 TECHNICAL KICKOFF MEETING

5.2 HUMAN CENTERED DESIGN (HCD) AND APPLICATION PERFORMANCE

MONITORING

5.2.1 HUMAN CENTERED DESIGN

5.2.2 USER RESEARCH

5.2.3 CONTENT AND DESIGN

5.2.4 PRODUCT LIFECYCLE ACTIVITIES

5.2.5 APPLICATION PERFORMANCE MONITORING

5.3 SUPPLY CHAIN GUI OVERLAY REQUIREMENTS

5.3.1 SOFTWARE REQUIREMENT

5.3.2 SERVICES

5.3.2.1 MAINTENANCE SUPPORT SERVICES

5.4 APAR/APAT TEST INSTANCES AND SUPPORT (OPTIONAL TASK 1)

5.4.1.1 TEST ENVIRONMENT MAINTENANCE SUPPORT SERVICES

(OPTIONAL TASK 2)

5.5 OPTION PERIOD ONE

5.6 OPTION PERIOD TWO

6.0 GENERAL REQUIREMENTS

6.1 ENTERPRISE AND IT FRAMEWORK

6.1.1 VA TECHNICAL REFERENCE MODEL

6.1.2 ZERO TRUST – VA CRITICAL SECURITY CONTROLS

6.1.3 FEDERAL IDENTITY, CREDENTIAL, AND ACCESS MANAGEMENT

(FICAM)

6.1.4 INTERNET PROTOCOL VERSION 6 (IPv6)

6.1.5 TRUSTED INTERNET CONNECTION (TIC)

6.1.6 STANDARD COMPUTER CONFIGURATION

6.1.7 VETERAN FOCUSED INTEGRATION PROCESS (VIP) AND PRODUCT

LINE MANAGEMENT (PLM)

6.1.8 PROCESS ASSET LIBRARY (PAL)

6.1.9 AUTHORITATIVE DATA SOURCES

6.1.10 SOCIAL SECURITY NUMBER (SSN) REDUCTION

6.1.11 SOFTWARE AND LICENSING REQUIREMENTS

6.2 SECURITY AND PRIVACY REQUIREMENTS

6.2.1 POSITION/TASK RISK DESIGNATION LEVEL(S)

6.2.2 CONTRACTOR PERSONNEL SECURITY REQUIREMENTS

6.3 METHOD AND DISTRIBUTION OF DELIVERABLES

6.4 PERFORMANCE METRICS

6.5 FACILITY/RESOURCE PROVISIONS

6.6 GOVERNMENT FURNISHED PROPERTY

ADDENDUM A – ADDITIONAL VA REQUIREMENTS, CONSOLIDATED

ADDENDUM B – VA INFORMATION AND INFORMATION SYSTEM SECURITY/

PRIVACY LANGUAGE

1.0 BACKGROUND

The Department of Veterans Affairs (VA), Office of Information & Technology (OIT), Product Delivery Services (PDS) strives to provide high quality, effective, and efficient Information Technology (IT) services to those responsible for providing care to the Veterans at the point-of-care as well as throughout all the points of the Veterans’ health care in an effective, timely and compassionate manner. VA depends on Information Management/Information Technology (IM/IT) systems to meet mission goals.

The VA, Veterans Health Administration (VHA) deployed a Supply Chain Graphical User Interface (GUI) Overlay to Veterans Information Systems and Technology Architecture (VistA) for users at 141 VA Medical Centers (VAMCs), the Employee Education Services (EES), and the Consolidated Mail Order Pharmacy (CMOP), and a training instance at the Veterans Affairs Acquisition Academy (VAAA). The deployed software package provides a tiered control and implementation of standardized national, Veteran Integrated Service Network (VISN), and VAMC business rules, controls, data management and standardization required to perform the functions relating to VistA’s Integrated Funds Distribution, Control Point Activity, Accounting and Procurement (IFCAP); General Inventory Package (GIP); Automated Engineering Management System/Medical Equipment Reporting System (AEMS/MERS); Prosthetics Inventory Package (PIP); Equipment Turn-in (EQUIP); VistA Integration, Revenue and Reporting (VIRR); and Prosthetics and Sensory Aids Services (PSAS). It also provides enterprise reporting and data integration services.

The Contractor shall support installation of an Above Participating ProviderR (APAR)/Above Advanced Prosthetics Acquisition Tool (APAT) test instance connected to a VistA test account to support the integration and testing of enhancements to the IFCAP/GIP to determine any impact to the Supply Chain GUI Overlay. The test instance shall be a non-production instance connected to a VistA test instance within the Compliance Risk and Remediation (CRR) Test Center (Bay Pines), enabling end-to-end validation of IFCAP/GIP modifications to maintain operational continuity across VistA’s logistics functions. Further, the test instance of the GUI shall be accessible to remote VA staff distributed around the US. Licensing fees for test environment instances shall be discounted waived, with the Contractor providing maintenance support as defined in PWS 5.3 without help desk services, as help desk services are not required. The test environment shall comply with VA Handbook 6500.5 (2021), VA Handbook 6500.6 (2019), VA Directive 0057 (2020), and NIST SP 800-53 Rev. 5 for security, privacy, and environmental sustainability requirements. For clarification, electronic delivery will be accomplished at installation of the instance and acceptance shortly thereafter, as appropriate.

2.0 APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. 44 U.S.C. § 3541-3549, “Federal Information Security Management Act (FISMA) of

2002”

2. “Federal Information Security Modernization Act of 2014”

3. Federal Information Processing Standards (FIPS) Publication 140-2, “Security

Requirements for Cryptographic Modules”

4. FIPS Pub 199. “Standards for Security Categorization of Federal Information and

Information Systems,” February 2004

5. FIPS Pub 200, “Minimum Security Requirements for Federal Information and

Information Systems,” March 2006

6. FIPS Pub 201-2, “Personal Identity Verification of Federal Employees and

Contractors,” August 2013

7. 10 U.S.C. § 2224, "Defense Information Assurance Program"

8. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

9. Public Law 109-461, Veterans Benefits, Health Care, and Information Technology

Act of 2006, Title IX, Information Security Matters

10. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”

11. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, https://www.va.gov/vapubs/index.cfm

12. VA Handbook 0710, “Personnel Security and Suitability Program,” May 2, 2016, https://www.va.gov/vapubs/index.cfm

13. VA Directive and Handbook 6102, “Internet/Intranet Services,” August 5, 2019

14. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and

Guidelines,” January 18, 2017

15. Office of Management and Budget (OMB) Circular A-130, “Managing Federal

Information as a Strategic Resource,” July 28, 2016

16. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed Services

(CHAMPUS)”

17. NIST SP 800-66 Rev. 1, “An Introductory Resource Guide for Implementing the

Health Insurance Portability and Accountability Act (HIPAA) Security Rule,”

October 2008

18. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended, January 18, 2017

19. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

20. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021

21. VA Handbook 6500, “Risk Management Framework for VA Information Systems

VA Information Security Program,” February 24, 2021 https://www.va.gov/vapubs/index.cfm https://www.va.gov/vapubs/index.cfm http://www.va.gov/vapubs http://www.va.gov/vapubs

22. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal

Information (SPI),” March 12, 2019

23. VA Handbook 6500.5, “Incorporating Security and Privacy into the System

Development Lifecycle,” March 22, 2010

24. VA Handbook 6500.6, “Contract Security,” March 12, 2010

25. VA Handbook 6500.8, “Information System Contingency Planning,” April 6, 2011

26. VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018

27. VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017

28. OIT Process Asset Library (PAL), https://www.va.gov/process/ . Reference Process

Maps at https://www.va.gov/process/maps.asp and Artifact templates at https://www.va.gov/process/artifacts.asp

29. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

30. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy

Impact Assessment,” October 15, 2014

31. VA Handbook 6508.1, “Procedures for Privacy Threshold Analysis and Privacy

Impact Assessment,” July 30, 2015

32. VA Handbook 6510, “VA Identity and Access Management,” January 15, 2016

33. VA Directive and Handbook 6513, “Secure External Connections,” October 12, 2017

34. VA Directive 6300, “Records and Information Management,” September 21, 2018

35. VA Handbook, 6300.1, “Records Management Procedures,“ March 24, 2010

36. NIST SP 800-37 Rev 2, “Risk Management Framework for Information Systems and

Organizations: A System Life Cycle Approach for Security and Privacy,” December

37. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information

Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020)

38. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12)

Program,” October 26, 2015

39. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-12)

Program,” March 24, 2014

40. OMB Memorandum 05-24, “Implementation of Homeland Security Presidential

Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal

Employees and Contractors,” August 5, 2005

41. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved

Identity, Credential, and Access Management,” May 21, 2019

42. OMB Memorandum, “Guidance for Homeland Security Presidential Directive

(HSPD) 12 Implementation,” May 23, 2008

43. Federal Identity, Credential, and Access Management (FICAM) Roadmap and

Implementation Guidance, December 2, 2011, (NOTE: Part A of the FICAM https://www.va.gov/process/ https://www.va.gov/process/maps.asp https://www.va.gov/process/artifacts.asp https://www.va.gov/trm/TRMHomePage.aspx

Roadmap and Implementation Guidance, v2.0, was replaced in 2015 with an updated

Architecture (https://arch.idmanagement.gov/#what-is-the-ficam-architecture)

44. NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity Verification

(PIV) Credentials in Facility Access,“ June 2018

45. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, “Digital Identity Guidelines,” updated March 02, 2020

46. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014

47. NIST SP 800-164, “Guidelines on Hardware-Rooted Security in Mobile Devices

(Draft),” October 2012

48. Draft National Institute of Standards and Technology Interagency Report (NISTIR)

7981, “Mobile, PIV, and Authentication,” March 2014

49. VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland

Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

50. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

51. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy

Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

52. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

53. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC)

Initiative,” September 12, 2019

54. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name

System Infrastructure,” August 22, 2008

55. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (Public

Law 110–140), December 19, 2007

56. Section 104 of the Energy Policy Act of 2005, (Public Law 109–58), August 8, 2005

57. Executive Order 13834, “Efficient Federal Operations,” dated May 17, 2018

58. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 2, 2001

59. VA Directive 0058, “VA Green Purchasing Program,” July 19, 2013

60. VA Handbook 0058, “VA Green Purchasing Program,” July 19, 2013

61. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote

Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

62. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

63. “Veteran Focused Integration Process (VIP) Guide 4.0,” January 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371 https://arch.idmanagement.gov/#what-is-the-ficam-architecture https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514 https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896 https://www.cisa.gov/publication/tic-30-core-guidance-documents https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

64. VA Memorandum “Proper Use of Email and Other Messaging Services,” January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

65. “DevSecOps Product Line Management Playbook” version 2.0, May 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

66. NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020

67. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol

Version 6 (IPv6),” November 19, 2020

68. Social Security Number (SSN) Fraud Prevention Act of 2017

69. Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23, 2018

70. Attachment A – Service Delivery Point (SDP) List

71. Human Centered Design - https://digital.gov/topics/human-centered-design/

3.0 SCOPE OF WORK

The Contractor shall provide a renewal of the annual operations and maintenance support for the Supply Chain GUI Overlay enterprise reporting, dashboards, and data integration software packages. 141 VHA facilities and the VAAA, CMOP and EES (sum total quantity of 144 sites) are currently utilizing the solution, with the potential for additional sites/groups to be added through optional tasks.

The operations and maintenance support shall include labor, travel, and expenses for continuation training, operations and maintenance, required system fixes, and software enhancements. The Contractor shall provide both remote and on-site support as required for the GUI and all updates and upgrades during the contract period.

The operations and maintenance support shall cover all the sites nationally and be based upon the VA facility size. The current site size usage is 84 Large, 26 Medium, and 33 Small facility sizes and 1 VAAA (a total of 144 sites) utilizing the GUI product.

Optional tasks: if exercised by the Government, the Contractor shall provide renewed licenses for test accounts for APAR and APAT. These test accounts will be used to test potential VistA changes due to other VA programs, such as, but not limited to the Electronic Health Record Modernization effort, any newly approved VA modernized Medical Records solution, and/or Financial Management Business Transformation (FMBT) Integrated Financial and Acquisition Management System (iFAMS) program.

These test instances will be used to identify how potential VistA changes may impact APAR and APAT usage, and includes code review of MUMPS code.

https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946 https://digital.gov/topics/human-centered-design/

4.0 PERFORMANCE DETAILS

4.1 PERFORMANCE PERIOD

The proposed Period of Performance shall be 12 months with two subsequent 12-month option periods and two optional tasks, if exercised. Any Optional Tasks, if exercised, shall coincide with the period of performance in which they are exercised and will be prorated to not extend past the completion date of the period in which it is potentially exercised. In no event shall the period of performance extend past 36 months.

Except for critical coverage maintenance support services required in section 5.3.2.1, any work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO).

There are 11 Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, five are set by date:

New Year's Day January 1 Juneteenth June 19 Independence Day July 4 Veterans Day November 11 Christmas Day December 25

If any of the above falls on a Saturday, then Friday shall be observed as a holiday.

Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

Martin Luther King's Birthday Third Monday in January Washington's Birthday Third Monday in February Memorial Day Last Monday in May Labor Day First Monday in September Columbus Day Second Monday in October Thanksgiving Fourth Thursday in November

4.2 PLACE OF PERFORMANCE

Tasks under this PWS shall be performed at Contractor facilities. The Contractor shall identify the Contractor’s place of performance in their proposal submission.

Performance shall not be permitted outside the United States or its territories.

4.3 TRAVEL

The Government anticipates travel under this effort to perform the tasks associated with the effort, as well as to attend program-related meetings or conferences throughout the PoP. Include all estimated travel costs in your firm-fixed price line items. These costs will not be directly reimbursed by the Government.

The total estimated number of trips in support of the program related meetings for this effort is 3 estimated trips. Anticipated locations include the following, estimated at 3 days including travel to the facility in duration:

Period Site Location # Trips # People Duration

Base VA Headquarters

Washington, D.C. or West Palm, FL

Up to 1 4 3 days

Option Period 1

VA

Headquarters

Washington, D.C. or West Palm, FL

Up to 1 4 3 days

Option Period 2

VA

Headquarters

Washington, D.C. or West Palm, FL

Up to 1 4 3 days

Travel shall be in accordance with the Federal Travel Regulations (FTR) (https://www.gsa.gov/policy-regulations/regulations/federal-travel-regulation) and requires advanced concurrence by the COR. Contractor travel within the local commuting area will not be reimbursed.

5.0 SPECIFIC TASKS AND DELIVERABLES

The Contractor shall perform the following:

5.1 PROJECT MANAGEMENT

5.1.1 CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, timeline, and tools to be used in execution of the contract. The CPMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks, and resource support. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPMP shall be concurred upon and updated in accordance with Section B/Price

Schedule of the resultant contract. The Contractor shall update and maintain the VA PM approved CPMP throughout the PoP.

Deliverable:

A. Contractor Project Management Plan

5.1.2 TECHNICAL KICKOFF MEETING

A technical kickoff meeting shall be scheduled within 10 days after TO award and held within 330 days of award. The Contractor shall coordinate the date, time, and location (can be virtual) with the Contracting Officer (CO), as the Post-Award Conference Chairperson, the VA Program Manager (PM), as the Co-Chairperson, the Contract Specialist (CS), and the Contracting Officer’s Representative (COR). The Contractor shall provide a draft agenda to the CO and VA PM at least five (5) days prior to the meeting. Upon Government approval of the final agenda, the Contractor shall distribute to all meeting attendees. During the kickoff-meeting, the Contractor shall present, for review and approval by the Government, the details of the intended approach, work plan, and project schedule for each effort via a Microsoft Office PowerPoint presentation. At the conclusion of the meeting, the Contractor shall update the presentation with a final slide entitled “Summary Report” which shall include notes on any major issues, agreements, or disagreements discussed during the kickoff meeting and the following statement “As the Post-Award Conference Chairperson, I have reviewed the entirety of this presentation and assert that it is an accurate representation and summary of the discussions held during the Technical Kickoff Meeting for the Supply Chain GUI Overlay.” The Contractor shall submit the final updated presentation to the CO for review and signature within three (3) days after the meeting. The Contractor shall also work with the CS, the Government’s designated note taker, to prepare and distribute the meeting minutes of the kickoff meeting to the CO, COR and all attendees within three (3) days after the meeting. The Contractor shall obtain concurrence from the CS on the content of the meeting minutes prior to distribution of the document.

Deliverable:

A. Agenda

B. Kickoff Meeting Minutes

C. Kickoff Meeting PowerPoint Presentation

5.2 HUMAN CENTERED DESIGN (HCD) AND APPLICATION

PERFORMANCE MONITORING

5.2.1 HUMAN CENTERED DESIGN

The Contractor shall utilize Human Centered Design (HCD) principles as part of all product development and operations efforts. While engaging in the following HCD activities, the Contractor shall:

1. Follow the United States Digital Service value: “Design with users, not for them.”;

2. Provide expert guidance on user experience (UX) design direction and strategy; and

3. Create and maintain documentation for all activities, recommendations, and decisions.

At the start of work on Supply Chain GUI Overlay enhancements, the Contractor shall conduct a product development review with government Product Owner and designated stakeholders to establish desired outcomes.

5.2.2 USER RESEARCH

As part of the user research, the Contractor shall:

A. Facilitate discovery activities, to include generative research with users and business stakeholders, an assessment of current related features, a content review, an information architecture review, an accessibility review, a business process review, and collection of any available data and analytics.

B. Partner with other VA Product Teams to ensure that updates and functionality enhancements fit into the existing structure

C. Conduct formative and contextual user research studies to understand users’ goals, needs, journeys, and pain points with respect to the Supply Chain GUI

Overlay. Apply insights from user research studies to define minimum viable product (MVP) functionality, including epics and user stories, as well as operational, business, functional, technical, data, and integration requirements.

D. As part of the overall product test strategy, conduct routine, iterative usability testing to continually improve the user experience and to inform content, information architecture, design, functionality, and accessibility. Iteratively apply insights gathered to inform design and development.

E. Before releasing to production, conduct user acceptance testing on new features, content reviews of existing content, Information Architecture reviews for global navigation and design reviews of existing patterns and User Interface elements to identify and make modifications while maintaining a positive user experience.

5.2.3 CONTENT AND DESIGN

A. Employ design process management by breaking designs into small, bite-sized implementations and collecting data from each deployment to inform priorities and decisions in the next iteration.

B. Ensure consistency and continuity in Supply Chain GUI Overlay information architecture, including URL schema, page layout, menus and navigation, user flows, and search engine optimization. Work with all VA Product Teams to incorporate updates and functionality enhancements, both authenticated and unauthenticated content and tools, into the Information Architecture Document of

Supply Chain GUI Overlay.

C. Support and comply with all UX guidelines and standards as defined by the VA, currently at https://department-of-veterans-affairs.github.io/va-digital-service-handbook/

5.2.4 PRODUCT LIFECYCLE ACTIVITIES

The Contractor shall support HCD activities for the Supply Chain GUI Overlay through its lifecycle by engaging in the following activities:

A. Conduct discovery activities on existing Supply Chain GUI Overlay as well as internal and external business process flows and functions. Work closely with VA customers to understand their needs and how those needs map to VA capabilities. Collect available data, user feedback, and VA stakeholder feedback and capture in a Discovery Report to be delivered within 15 days of a change event/review.

B. Participate in VA stakeholder meetings, some of which will be in-person at VA facilities, to plan building and integrating the services and change management activities.

A. Discovery Report

5.2.5 APPLICATION PERFORMANCE MONITORING

As part of Supply Chain GUI Overlay, the Contractor shall assist VA with Application Performance Monitoring strategies for application health and performance.

The Contractor shall provide input on the Application Monitoring Plan that defines how metrics will be monitored throughout the performance of the requirements, including the automated testing tools and automated Service Level Agreement (SLA) testing scripts that shall be used. All Performance Monitoring Strategies and the Application Monitoring Plan must be approved by the Program Manager and Contracting Officer.

5.3 SUPPLY CHAIN GUI OVERLAY REQUIREMENTS

5.3.1 SOFTWARE REQUIREMENT

The Contractor shall continue to support its commercially available off-the-shelf (COTS) Supply Chain GUI Overlay, reporting, dashboards, and data integration software solution for immediate use. The Contractor’s solution must continue to demonstrate the https://department-of-veterans-affairs.github.io/va-digital-service-handbook/ https://department-of-veterans-affairs.github.io/va-digital-service-handbook/ capability to interface with VistA’s application modules. The licensing and maintenance must continue to support the following functions at a minimum:

A. Work Order Entry, Audit, Tracking, & Reporting

1. Enter work order

2. Assign work order

3. Document a work order, including attachment of files

4. Close a work order

5. Edit a work order, open or closed

6. Audit work order fields

7. Limit access to certain work order fields based on system user role

8. Require certain fields

9. View purchase orders

B. Equipment Inventory Entry, Audit, Tracking, & Reporting

1. Enter a new equipment record

2. Edit equipment records

3. Audit equipment fields

4. Limit access to fields based on user role

5. Require certain fields

6. Generate incoming inspection work order from equipment record

7. Generate turn-in requests

8. Approve turn-in requests and disposition equipment

9. View purchase orders

10. Generate Fixed Asset Package (FAP) documents for equipment

11. Enter multiple equipment items

C. Inventory Package Entry, Audit, Tracking, & Reporting

1. View inventory point information

2. Provide stock status information

3. Receive supplies into an inventory point

4. View purchase order information

D. Prosthetic Software Package

1. Create request for quotes for Prosthetic devices and/or services.

(referred to as VA Form FL 10-90; with fax cover sheets)

2. Multiple quotes for an item can be created at the same time to different vendors providing time savings.

3. Quotes are retained in the system for easy retrieval if they need to be re-sent to vendors.

4. Consult information can be easily copied/pasted into the Fax cover sheet, reducing manual data entry.

5. All 10-90 information is displayed and saved with VistA.

6. Create new Purchase Order and integrate with historic purchase orders in VistA.

7. Allows PO to be easily re-sent to vendor if needed.

8. Consult information can be easily copied/pasted into the purchase order if needed (i.e., optometry orders)

9. VistA integration to all appropriate packages (VistA Prosthetics

Package to include posting to the Record of Prosthetic Appliance and

Repair (VAF-2319), Computerized Patient Record System (CPRS)

Consult/Request Tracking, IFCAP, and National Prosthetic Patient

Database (NPPD)).

10. Enforce/Alert to mandatory data fields when creating purchase orders or stock issues.

11. Scan, index, and upload all other paperwork collected by the purchasing agents. All documentation is stored in a document library within VA infrastructure for future document retrieval. VA documentation storage location will be identified by the PM and COR after award. This includes electronic images, such as pictures required for Home Improvement and Structural Alteration Program (HISA). The solution shall allow each individual VA facility the ability to define what types of documents they want to store such as paperwork for Clothing

Allowances, HISA documents (including pictures), Automobile

Adaptive Equipment (AAE) documents, Packing Slips, invoices and quotes.

12. Index documents based on Patient, Vendor, or Purchase Order and allow easy retrieval of data

13. Retains all images in the document library IAW VA record management. This provides savings on storage space and potential off-site costs.

14. Bid and purchase order information can be sent to a fax server program utilized by VA, Enterprise Cloud Fax (currently ECFax.Gov).

Create, assign, and edit the Orthotic Laboratory Work orders (OWL).

The proposed solution shall allow users to manage these functions all in one location/ place.

15. Provide a feature that allows the user to view VAF-2319 information from multiple VA medical centers within the current business workflow to prevent fraud, waste and abuse. The centralized data is then accessible by the local applications and will eventually be available for national reporting.

16. All VistA Prosthetics GUI functions as listed in PWS section 5.3.1 can be performed including VistA GUI reports.

17. Create Detailed PO to order Prosthetics Stock inventory (that will be managed in GIP)

18. Create Stock Issue to Veteran patient of Prosthetics item

19. Extract feature to permit the export of Prosthetics encounter information used by the VA Health Information Management Systems

(HIMS) and Chief Business Office (CBO) for coding and billing. This will help all encounters are appropriately entered into revenue cycle stream.

20. PSAS Reporting to include:

a. Provides standardized and Ad Hoc reports.

b. All fields in the purchase order are catalogued for reporting. For example, serial number can be queried in an ad hoc report for recalls if needed.

c. Reporting on number of quotes and purchase orders generated

d. Ad hoc reporting capabilities allow users to define the type of data needed (i.e. any field that exists on the purchase order)

e. All reports can be exported to Excel

5.3.2 SERVICES

The Contractor shall provide the below services for this effort:

5.3.2.1 MAINTENANCE SUPPORT SERVICES

The Contractor’s maintenance support services provided under this effort shall meet the following:

A. Hours of Coverage at each VAMC as identified in Attachment A:

1. Routine Coverage: Monday through Friday, 8:00 AM to 8:00 PM ET.

2. Critical Coverage: 7-days per week; 24 hours per day, 365 days per year. Critical issues are urgent incidents or a catastrophic incident of an operating environment where production systems are severely impacted, down, or not functioning or an issue which may impact patient care or patient safety. Response time shall align with VA/OIT

‘Major Incident Management Process’ criteria for priority 1 and/or priority 2 outages.

B. The Contractor shall provide the following:

1. Web-enabled Help Desk support & services to report, track, remedy, and escalate (if necessary) work ticket requests shall be included.

2. Maintenance and software fixes/repair of the system shall be included.

3. Updates, upgrades, and functionality enhancements shall be included.

This task is also subject to the requirements under PWS 5.3.1 and

5.3.2.

4. Deployment and installation support and training shall be included to ensure software is installed, tested, and operational.

C. Guaranteed Uptime: The Contractor shall guarantee 98% uptime of the installed GUI Overlay applications, 24 hours a day, seven days a week, 365 days per year, excluding downtime caused by VA system or hardware failures.

D. Updates And Functionality Enhancements: The Contractor shall provide system engineering changes, updates, and functionality enhancements coordinated through the Office of Information Technology for review, test and approval to release. This shall include any changes/patches/bug fixes and deliverables to include (Deployment Guide, Release Notes, Test Site Preparation Checklist, and User Acceptance Test (UAT) Test cases and scripts.

E. Qualifications: The COR will authenticate the training requirements, request training certificates or credentials from the contractor at any time for any personnel who are servicing or installing any software or conducting training. All service personnel will be aware of and compliant with Hospital policy and procedures pertaining to safety, fire, severe weather, and emergency procedures.

The Contractor shall have an approved National Business Associates Agreement (BAA). (Refer to Section 6.2)

The Contractor shall adhere to all Information Security requirements as outline in VA Directive 6500. All servicing personnel shall be required to get background investigations. (Refer to Sections 6.2.1 and 6.2.2)

F. National Coordination, Tracking, And Approval: The Contractor shall coordinate with the COR/OIT for recording and tracking of all GUI Overlay requirements, software changes and enhancements. The Contractor shall ensure that all software patches shall be released in accordance with VA’s SDLC process. The Contractor shall remove code from any patches that is deemed harmful, untested or unapproved by VA (specifically VHA Logistics and Prosthetics SMEs) within 12 hours of notification.

H. Documentation Requirements: The Contractor shall provide the COR with a Technical Services Monthly Report in electronic form in Microsoft Word or Adobe PDF formats. The report shall include detailed information on the work completed by the technical services support team (help desk) each month. That support includes calls made directly to the vendor or work that was transferred by the VA Enterprise Service Desk. The report shall also include metrics on the number of help desk tickets and the disposition/status of the tickets in each reporting month.

I. Training: Training shall be included to ensure that users are trained in the capabilities and operation of the software. The Contractor shall at a minimum:

a. Develop training materials to include manuals and videos based on the roles and functionality in the GUI product.

b. Create the artifacts for every patch version/release.

A. Technical Services Monthly Report

B. Role and functionality-based training materials (including manuals and videos) for each patch version/release

C. Deployment Plan

D. Release Notes

E. Test Site Preparation Checklist

F. User Acceptance Test (UAT) Test Cases and Scripts

5.4 APAR/APAT TEST INSTANCES AND SUPPORT (OPTIONAL TASK 1)

The Contractor shall support licensing of APAR/APAT test instance(s) connected to a VistA test account to support the integration and testing of enhancements to the IFCAP/GIP to determine any impact to the Supply Chain GUI Overlay. The test instances (Quantity of 1 for each application)shall be a non-production instance connected to a VistA test instance within the Compliance Risk and Remediation (CRR) Test Center (Bay Pines), enabling end-to-end validation of IFCAP/GIP modifications to maintain operational continuity across VistA’s logistics functions. Further, the test instance of the GUI shall be accessible to remote VA staff distributed around the US.

The Contractor providing maintenance support as defined in PWS 5.3 without help desk services, as help desk services are not required. The test environment shall comply with VA Handbook 6500.5 (2021), VA Handbook 6500.6 (2019), VA Directive 0057 (2020), and NIST SP 800-53 Rev. 5 for security, privacy, and environmental sustainability requirements. For clarification, electronic delivery will be accomplished at installation of the instance and acceptance shortly thereafter, as appropriate.

Deliverable:

A. Test Instance of APAR B. Test Instance of APAT

5.4.1.1 TEST ENVIRONMENT MAINTENANCE SUPPORT SERVICES (OPTIONAL

TASK 2)

If exercised, the Contractor shall provide maintenance support services for test instances provided under this effort which shall meet the following criteria:

1. Hours of Coverage for the Test Environment is expected to be routine coverage of Monday through Friday, 8:00 AM ET to 8:00 PM ET.

1. Guaranteed 98% uptime of the Above PAR and APAT software during testing events.

Uptime of 98% during scheduled test events.

2. The Contractor shall provide technical support to address installation issues.

3. The Contractor shall support configuration of the test environment to mirror the production environment’s functionality, ensuring seamless integration with VISTA’s logistics modules.

4. The Contractor shall collaborate with the VA Project Manager (PM) and Contracting Officer’s Representative (COR) to ensure the test environment supports testing activities and can be used to evaluate IFCAP/GIP impacts on the GUI 5. The Contractor shall collaborate with VA on the creation of the Test Data Artifact. provide new test system supply chain/patient data sets for testing.

6. The Contractor shall provide monthly reviews of IFCAP/GIP MUMPS code changes due to implementation of the iGIVE or iFAMS modernization/integration efforts and provide a Code Review Analysis Report including what code (i.e., IFCAP/GIM, iFIVE, iFAMS, etc.) was analyzed, method for analysis and findings indicating if there are no impacts or containing a list of corresponding requirements for Supply Chain GUI Overlay updates needed to ensure operational integrity. The Contractor shall also provide a Level of Effort (LOE) if a list of requirements is provided in the report. NO

PRODUCTION ENHANCEMENTS WILL BE REQUESTED AS PART OF THIS

REQUIREMENT.

Deliverables:

A. Code Review Analysis Report

The Contractor shall perform all tasks outlined in the PWS Sections 5.3.2.1. All deliverables produced under 5.3.2.1 shall be updated as a result of the Optional Task being exercised.

5.5 OPTION PERIOD ONE

If exercised, the Contractor shall perform tasks 5.1 through 5.3 including all subtasks.

5.6 OPTION PERIOD TWO

If exercised, the Contractor shall perform tasks 5.1 through 5.3 including all subtasks.

6.0 GENERAL REQUIREMENTS

6.1 ENTERPRISE AND IT FRAMEWORK

6.1.1 VA TECHNICAL REFERENCE MODEL

The Contractor shall comply with the VA OIT Technical Reference Model (VA TRM).

Compliance with the VA TRM is achieved by using only technologies and standards that are listed as approved for use in the VA TRM. The Contractor shall provide all necessary information requested by VA to ensure TRM approval is obtained prior to use on VA’s network.

6.1.2 ZERO TRUST – VA CRITICAL SECURITY CONTROLS

VA has established minimum mandatory security requirements and requires that any network connected software system or service must meet the VA Critical Security Controls as outlined in the VA Memorandum, “VA Security Controls”, https://www.voa.va.gov/DocumentView.aspx?DocumentID=5010. VA Critical Security Controls identify the minimum mandatory requirements that must be implemented across all VA enterprise infrastructure, cloud computing environments, information systems, networks, and specialized devices (medical devices/systems, special-purpose systems, and research scientific computing devices) that process, store, and/or transmit VA data. Effective July 1, 2025, the Contractor shall implement these VA Critical Security Controls, within any network connected software system or service prior to being authorized for use in the VA. This functional requirement is not negotiable, and Plan of Action & Milestones (POAM) will not be accepted in the event these controls cannot be implemented for new systems. Critical Security Controls are intended to increase VA’s security posture and provide security and privacy risk visibility into the VA network and is not a new requirement. The Contractor’s failure to maintain these VA Critical Controls after implementation will result in VA discontinuing the use of the system.

6.1.3 FEDERAL IDENTITY, CREDENTIAL, AND ACCESS MANAGEMENT (FICAM)

The Contractor shall ensure Commercial Off-The-Shelf (COTS) product(s), software configuration and customization, and/or new software are Personal Identity Verification (PIV) card-enabled by accepting HSPD-12 PIV credentials using VA Enterprise Architecture (EA), and VA Identity and Access Management (IAM) approved Enterprise Technology Guidelines (ETG). The Contractor shall ensure all Contractor delivered applications and systems comply with the VA Identity, Credential, and Access Management policies and guidelines set forth in Executive Order 14028, VA Handbook 6510 VA Identity and Access Management, VA Handbook 0735 Homeland Security Presidential Directive 12 (HSPD-12) Program, CISA Binding Operational Directive 23-https://www.voa.va.gov/DocumentView.aspx?DocumentID=5010 https://www.ea.oit.va.gov/ https://www.ea.oit.va.gov/ https://digital.va.gov/office-of-information-and-technology/reference-library/enterprise-technology-guidelines/ https://digital.va.gov/office-of-information-and-technology/reference-library/enterprise-technology-guidelines/

01, and align with the Federal Identity, Credential, and Access Management Roadmap and Implementation Guidance v2.0.

The Contractor shall ensure all Contractor delivered applications and systems provide user authentication services compliant with the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-63-3, VA Handbook 6500, and VA IAM enterprise requirements for direct, assertion-based authentication, and/or trust based authentication, as determined by the ETGs. Direct authentication at a minimum must include Public Key Infrastructure (PKI) based authentication supportive of PIV card and/or Common Access Card (CAC), as determined by the business need.

The Contractor shall ensure all Contractor delivered applications and systems conform to the specific Identity and Access Management PIV requirements set forth in the Office of Management and Budget (OMB) Memoranda M-05-24, M-19-17, M-22-09, and NIST Federal Information Processing Standard (FIPS) 201-3. Contractor delivered applications and systems shall be on the FIPS 201 Approved Product List (APL). If the Contractor delivered application and system is not on the APL, the Contractor shall be responsible for taking the application and system through the FIPS 201 Evaluation Program.

The Contractor shall ensure all Contractor delivered applications and systems support:

1. Automated provisioning and are able to use enterprise provisioning service.

2. Interfacing with VA’s Master Person Index (MPI) to provision identity attributes, if the solution relies on VA user identities. MPI is the authoritative source for VA user identity data.

3. The VA defined unique identity (Secure Identifier [SEC ID] / Integrated Control Number [ICN]).

4. Multiple authenticators for a given identity and authenticators at every Authenticator Assurance Level (AAL) appropriate for the solution.

5. Identity proofing for each Identity Assurance Level (IAL) appropriate for the solution.

6. Federation for each Federation Assurance Level (FAL) appropriate for the solution, if applicable.

7. Two-factor authentication (2FA) through an applicable Technology Guideline as outlined in VA ETG.

8. A Security Assertion Markup Language (SAML) implementation if the solution relies on assertion-based authentication. Additional assertion implementations, besides the required SAML assertion, may be provided as long as they are compliant with NIST SP 800-63-3 guidelines.

9. Authentication/account binding based on trusted Hypertext Transfer Protocol (HTTP) headers if the solution relies on Trust based authentication.

10. Role Based Access Control.

11. Auditing and reporting capabilities.

12. Compliance with VIEWS 00155984, PIV Logical Access Policy Clarification https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896.

https://bidenwhitehouse.archives.gov/wp-content/uploads/legacy_drupal_files/omb/memoranda/2005/m05-24.pdf https://bidenwhitehouse.archives.gov/wp-content/uploads/2019/05/M-19-17.pdf https://bidenwhitehouse.archives.gov/wp-content/uploads/2022/01/M-22-09.pdf https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

The required Assurance Levels for this specific effort are Identity Assurance Level 3, Authenticator Assurance Level 3, and Federation Assurance Level 3.

6.1.4 INTERNET PROTOCOL VERSION 6 (IPv6)

The Contractor solution shall support IPv6-Only based upon the memo issued by the Office of Management and Budget (OMB) on November 19, 2020 (https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-07.pdf). Which defines IPv6-only as the state of an operational system or service when IPv4 protocol functions (addressing, packet forwarding) are not in use. The NIST USGv6 profile defines technical requirements for a product to be capable of operating in IPv6-Only environments. IPv6-Only technology, in accordance with the USGv6 Program (https://www.nist.gov/programs-projects/usgv6-program/usgv6-revision-1), NIST Special Publication (SP) 500-267B Revision 1 “USGv6 Profile” (https://doi.org/10.6028/NIST.SP.500-267Br1), and NIST SP 800-119 “Guidelines for the Secure Deployment of IPv6” (https://doi.org/10.6028/NIST.SP.800-119), compliance shall be included in all IT infrastructures, application designs, application development, operational systems and sub-systems, and their integration. In addition to the above requirements, all devices, applications, and systems shall support all applicable functionality on native IPv6-Only as well as dual stack (IPv6 / IPv4) connectivity without additional memory or other resources being provided by the Government, so that they can function in a mixed environment. All public/external facing servers and services (e.g., web, email, DNS, ISP services, etc.) shall support native IPv6-Only and dual stack (IPv6 / IPv4) users and all internal infrastructure and applications shall support using native IPv6-Only and dual stack (IPv6 / IPv4) for all functionality and operations.

6.1.5 TRUSTED INTERNET CONNECTION (TIC)

The Contractor solution shall meet the requirements outlined in Office of Management and Budget Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative“ (https://www.whitehouse.gov/wp-content/uploads/2019/09/M-19-26.pdf), VA Directive 6513 “Secure External Connections”, and shall comply with the TIC 3.0 Core Guidance Documents, including all Volumes and TIC Use Cases, found at the Cybersecurity & Infrastructure Security Agency (CISA) (https://www.cisa.gov/publication/tic-30-core-guidance-documents).

6.1.6 STANDARD COMPUTER CONFIGURATION

The Contractor IT end user solution that is developed for use on standard VA computers shall be compatible with and be supported on the standard VA operating system, Windows 10 (64bit) and Windows 11, Edge (Chromium based), and 365 Apps for enterprise. Applications delivered to VA and intended to be deployed to Windows 10 https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-07.pdf https://www.nist.gov/programs-projects/usgv6-program/usgv6-revision-1 https://doi.org/10.6028/NIST.SP.500-267Br1 https://doi.org/10.6028/NIST.SP.800-119 https://www.whitehouse.gov/wp-content/uploads/2019/09/M-19-26.pdf https://www.cisa.gov/publication/tic-30-core-guidance-documents and or Windows 11 workstations shall be delivered as a signed .msi package with switches for silent and unattended installation and updates shall be delivered in signed .msp file formats for easy deployment using Microsoft Endpoint Configuration Manager (CM) VA’s current desktop application deployment tool. Signing of the software code shall be through a vendor provided certificate that is trusted by VA using a code signing authority such as Verizon/Cybertrust or Symantec/VeriSign. The Contractor shall also ensure and certify that their solution functions as expected when used from a standard VA computer, with non-admin, standard user rights that have been configured using the Defense Information Systems Agency (DISA) Secure Technical Implementation Guide (STIG) specific to the particular client operating system being used.

6.1.7 VETERAN FOCUSED INTEGRATION PROCESS (VIP) AND PRODUCT LINE

MANAGEMENT (PLM)

The Contractor shall support VA efforts IAW the Veteran-Focused Integration Process (VIP) Guide and Product Line Management (PLM) Playbook. The major focus of VIP is on Enterprise Oversight, Governance, reporting, and establishing practices that focus on outcomes and continuously delivering sustainable IT capabilities to benefit the Veteran. PLM is a framework that focuses on delivering functional products that provide the highest priority work to customers while delivering simplified, reliable, and practical solutions to the business, medical staff, and our Veterans. The VIP Guide is a companion guide to the PLM Transformation Playbook and can be found at:

https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371 and the PLM Transformation Playbook can be found at https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946. VIP and PLM are the authoritative processes that IT projects must follow to ensure development and delivery of IT products.

The VIP Guide provides guidance for transitioning from project-centric to product-centric delivery. The VIP guide applies to all OIT Office of Management and Budget (OMB) reportable products that are required to collect and report costs, schedules, risks, and other valuable information in VA PARS (whether products are procured or developed by VA) and any VA Information Technology project effort in Software Product Management (SPM) and Infrastructure Operations (IO), or their successors, that touch the VA network regardless of IT organizational alignment (whether it spends government funding from VA's Congressional IT Appropriation or any other appropriation).

The PLM Transformation Playbook details…