PWS_Broadcom ELA_RFIDraft.pdf

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Office of Information & Technology Infrastructure Operations

Broadcom Enterprise Licensing Agreement (ELA)

Date: May 13,2025

VA-26-00001185

PWS Version Number: 1.0

Broadcom Enterprise License Agreement (ELA)

1.0 BACKGROUND

The Department of Veterans Affairs (VA), Office of Information & Technology (OIT), Infrastructure Operations (IO) strives to provide high quality, effective, and efficient Information Technology (IT) services to those responsible for providing care to the Veterans at the point-of-care as well as throughout all the points of the Veterans’ health care in an effective, timely and compassionate manner. VA depends on Information Management/Information Technology (IM/IT) systems to meet mission goals.

VA has utilized core information technology management components with multiple companies that were acquired by Broadcom, to include VMware, Symantec, CA Technologies, and various hardware component manufacturers to include Brocade, Emulex, Avago, LSI Corp, Javelin Semiconductor. These acquisitions typically result in decreased options for procurement and consolidation into vendor consolidated software ‘bundles’ which increase cost to government.

Broadcom products provide underlying core functionality crucial for the development and deployment of many new VA applications as well as applications already relying on Broadcom products. VA is currently in option year three of a one-year base and four option year VMware Enterprise Licensing Agreement (ELA) with several single-product Broadcom product licensing agreement. VA established this single ELA contract vehicle for all existing Broadcom software programs, while at the same time providing a means for VA to acquire additional software to augment and expand existing Broadcom infrastructure already in place at VA.

While the previous ELA has met the goals of consolidation, expansion and visibility at an enterprise level for VMware products, the licensing model lacks the agility for other Broadcom products, cloud services and assumes full cost on software licenses that may never be used. To mitigate this issue VA is deciding to migrate to a hybrid Broadcom ELA and a Broadcom (to include VMware by Broadcom and acquired company products) Cloud Service Provider, hereby termed ‘BCSP’ model.

The intent of migrating to a consumption model will allow VA to be agile with on-premises, internal cloud licensing, support models and external cloud intercompatibility.

This will allow VA to adapt with changing internal and external requirements. The second objective of migrating to a consumption model is relieving VA of burden on underutilized and inefficient licensing and reinvest in technology advancements selectively across the Department.

2.0 APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. 44 U.S.C. § 3541-3549, “Federal Information Security Management Act (FISMA) of 2002”

2. “Federal Information Security Modernization Act of 2014”

3. Federal Information Processing Standards (FIPS) Publication 140-2, “Security Requirements for Cryptographic Modules”

4. FIPS Pub 199. “Standards for Security Categorization of Federal Information and Information Systems,” February 2004

5. FIPS Pub 200, “Minimum Security Requirements for Federal Information and Information Systems,” March 2006

6. FIPS Pub 201-2, “Personal Identity Verification of Federal Employees and Contractors,” August 2013

7. 10 U.S.C. § 2224, "Defense Information Assurance Program"

8. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

9. Public Law 109-461, Veterans Benefits, Health Care, and Information

Technology Act of 2006, Title IX, Information Security Matters

10. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”

11. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, https://www.va.gov/vapubs/index.cfm

12. VA Handbook 0710, “Personnel Security and Suitability Program,” May 2, 2016, https://www.va.gov/vapubs/index.cfm

13. VA Directive and Handbook 6102, “Internet/Intranet Services,” August 5,

14. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and Guidelines,” January 18, 2017

15. Office of Management and Budget (OMB) Circular A-130, “Managing Federal

Information as a Strategic Resource,” July 28, 2016

16. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed

Services (CHAMPUS)”

17. NIST SP 800-66 Rev. 1, “An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule,” October 2008

18. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended, January 18, 2017

19. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

20. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021

VA Handbook 6500, “Risk Management Framework for VA Information Systems VA Information Security Program,” February 24, 2021

21. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI),” March 12, 2019

22. VA Handbook 6500.5, “Incorporating Security and Privacy into the System Development Lifecycle,” March 22, 2010

23. VA Handbook 6500.6, “Contract Security,” March 12, 2010

24. VA Handbook 6500.8, “Information System Contingency Planning,” April 6,

25. VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018

26. VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017

27. OIT Process Asset Library (PAL), https://www.va.gov/process/ . Reference

Process Maps at https://www.va.gov/process/maps.asp and Artifact templates at https://www.va.gov/process/artifacts.asp https://www.va.gov/vapubs/index.cfm https://www.va.gov/vapubs/index.cfm http://www.va.gov/vapubs http://www.va.gov/vapubs https://www.va.gov/process/ https://www.va.gov/process/maps.asp https://www.va.gov/process/artifacts.asp

28. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

29. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014

30. VA Handbook 6508.1, “Procedures for Privacy Threshold Analysis and Privacy Impact Assessment,” July 30, 2015

31. VA Handbook 6510, “VA Identity and Access Management,” January 15,

32. VA Directive and Handbook 6513, “Secure External Connections,” October 12, 2017

33. VA Directive 6300, “Records and Information Management,” September 21,

34. VA Handbook, 6300.1, “Records Management Procedures,“ March 24, 2010

35. NIST SP 800-37 Rev 2, “Risk Management Framework for Information

Systems and Organizations: A System Life Cycle Approach for Security and Privacy,” December 2018

36. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020)

37. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015

38. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-

12) Program,” March 24, 2014

39. OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005

40. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019

41. OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008

42. Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance, December 2, 2011, (NOTE: Part A of the FICAM Roadmap and Implementation Guidance, v2.0, was replaced in 2015 with an updated Architecture (https://arch.idmanagement.gov/#what-is-the-ficam-architecture)

43. NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access,“ June 2018

44. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, “Digital Identity Guidelines,” updated March 02, 2020

45. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014

46. NIST SP 800-164, “Guidelines on Hardware-Rooted Security in Mobile

Devices (Draft),” October 2012

47. Draft National Institute of Standards and Technology Interagency Report

(NISTIR) 7981, “Mobile, PIV, and Authentication,” March 2014 https://www.va.gov/trm/TRMHomePage.aspx https://arch.idmanagement.gov/#what-is-the-ficam-architecture https://arch.idmanagement.gov/#what-is-the-ficam-architecture

48. VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

49. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

50. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

51. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

52. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019

53. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008

54. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (Public Law 110–140), December 19, 2007

55. Section 104 of the Energy Policy Act of 2005, (Public Law 109–58), August 8, 2005

56. Executive Order 13834, “Efficient Federal Operations,” dated May 17, 2018

57. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August

2, 2001

58. VA Directive 0058, “VA Green Purchasing Program,” July 19, 2013

59. VA Handbook 0058, “VA Green Purchasing Program,” July 19, 2013

60. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote

Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

61. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

62. “Veteran Focused Integration Process (VIP) Guide 4.0,” January 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

63. VA Memorandum “Proper Use of Email and Other Messaging Services,”

January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

64. “DevSecOps Product Line Management Playbook” version 2.0, May 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

65. NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020

66. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol

Version 6 (IPv6),” November 19, 2020

67. Social Security Number (SSN) Fraud Prevention Act of 2017

68. Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23,

3.0 SCOPE OF WORK

3.1 PRODUCT REQUIREMENTS

https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514 https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896 https://www.cisa.gov/publication/tic-30-core-guidance-documents https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371 https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

The table below identifies the products and quantities of ‘VMware by Broadcom’ licenses owned by VA as of September 30, 2021, before VA entered the previous ‘VMware Cloud Services Provider’ (VCPP) agreement:

Table 1 – VA VMware Perpetual Install Base Products

Description Part Number Qty

U.S. Federal vRealize Operations Advanced (25 OSI Pack)

VR8-OADO25-F 748

U.S. Federal vRealize Operations Enterprise (25 OSI Pack)

VR8-OENO25-P-

SSS-F

U.S. Federal VMware vSphere Standard for 1 processor

VS7-STD-P-SSS-F 1317

U.S. Federal VMware vSphere Enterprise Plus for 1 processor

VS7-EPL-P-SSS-F 8265

U.S. Federal VMware vCenter Server 7 Standard for vSphere 7

VCS7-STD-P-SSS-F 50

U.S. Federal VMware vSAN Standard for 1 processor

ST7-STD-P-SSS-F 12

U.S. Federal VMware vSAN Advanced for 1 processor

ST7-ADV-FST7-

ADV-P-SSS-F

U.S. Federal VMware vSAN Enterprise for 1 processor

ST7-ENT-FST7-ENT-

P-SSS-F

U.S. Federal VMware vRealize Suite Enterprise (Per PLU)

VR19-ENT-P-SSS-F 158

U.S. Federal VMware vRealize Suite Advanced (Per PLU)

VR19-ADV-P-SSS-F 4790

U.S. Federal VMware NSX Data Center Enterprise Plus for 1 processor

NX-DC-EPL-P-SSS-F 1377

U.S. Federal Fusion Professional Edition (single license)

FUS12-PRO-FFUS-

PRO-P-SSS-F

U.S. Federal Workstation Professional (single license)

WS16-PRO-FWS-

PRO-P-SSS-F

U.S. Federal VMware Horizon View Standard (100 Pack, CCU)

VU5-PR-100-P-SSS-

F

U.S. Federal VMware Horizon View Enterprise (10 Pack, CCU)

HZ8-ENC-10-FHZ8-

ENC-10-P-SSS-F

U.S. Federal vCloud Suite Advanced (1-socket option)

CL19-ADV-F 3317

U.S. Federal VMware Site Recovery Manager (VM) VC-SRM8-25E-FVC-

SRM8-25E-P-SSS-F

U.S. Federal VMware Site Recovery Manager for 1 processor

VC-SRM8-ENT-P-

SSS-F

U.S. Federal VMware vRealize Automation Advanced OSI

VR7-ATAD25-P-

SSS-F

Description Part Number Qty

U.S. Federal vCloud Director (VM) N/A 3630

U.S. Federal SDDC Manager (Per CPU) CF4-B1-VDI-10-F 38

U.S. Federal Cloud Foundation Enterprise (CPU) CF4-ENT-FCF4-NT-

P-SSS-F

VA Perpetual License Install Base - Mobile Device Licensing Only

U.S. Federal Workspace ONE Advanced Perpetual: 1 Device

VA-WOA-A-D-P-

SSS-F

218,000

3.2 BROADCOM CLOUD SERVICES PROVIDER (BCSP)

The Contractor shall enable usage of any eligible software products as identified on the then-current commercial Broadcom and Broadcom by VMware schedule (Attachment A), under Contract Line-Item Number (CLIN) 0001 – BCSP Base. Access to software licenses shall begin on the first day following the end date of the ongoing support term, with a 12-month Period of Performance (PoP), and annually for exercised option periods.

The Contractor shall provide access to the latest Broadcom technology to any new software products added to the then-current commercial BCSP schedule (Attachment A). Broadcom may update from time to time the BCSP schedule and posted on Partner Connect Portal, any changes to the BCSP guide shall not change the terms of this contract.

3.2.1 MINIMUM ANNUAL COMMITMENT

VA will commit to purchase no less than 80,000 processor cores for Broadcom VMware Cloud foundations (VCF) annually. VA will not commit to an annual commitment or multi-year commitment to exceed this minimum annual commitment. VA reserves the right to optionally purchase up to 81,000 additional processor cores for Broadcom VCF annually. The VA may purchase zero, one, or any other quantity in any year of the contract up to the established optional annual ceiling quantity.

3.2.2 BCSP SOFTWARE BASELINE

The Contractor shall provide software entitlement, maintenance, and support for the products listed and the quantities identified in Attachment A, CLIN 0001 – BCSP Base.

Licensing shall begin on the first day following the end date of the current support term and shall be co-terminus with the PoP end date 12 months from contract award and annually thereafter, if option periods are exercised.

3.2.3 PROFESSIONAL SERVICES

VA will procure professional services to provide training, resident engineering services, or ad-hoc consulting services engagements. Monthly reporting on the usage of the BCSP Points shall be provided to the Contracting Officer’s Representative (COR).

The Contractor shall help VA to be operationally ready and running quickly, minimize risk, and deliver the agency’s mission from VA’s investments. The Contractor shall provide in-depth expertise to facilitate the continuous evolution of VA systems by leveraging emerging technology solutions – giving the agency an edge in today's complex digital world. Professional Services that are available through the BCSP include Technical Account Managers (TAM), technology engagements, and data center design and optimization.

The Contractor shall not engage in VA professional services engagements to include billing or obligation to utilize professional services without agreement from VA Program Manager. This includes traditional and BCSP professional services for Broadcom SaaS offerings and/or third-party engagements to include Blue Medora, OnApp and Caveonix.

3.2.3.1 TECHNICAL ACCOUNT MANAGER

The Contractor shall provide a Broadcom TAM “CLIN 0001 – BCSP Base” or “CLIN 0002 – BCSP Optional Qty” of Attachment A. The TAM shall provide operations and support case management access, for all applications, to VA technical and support staff. The TAM shall also perform the following tasks:

a. Provide strategic access to business units and advocate VA’s business and technical needs throughout Broadcom.

b. Provide analysis of VA business requirements and their alignment to VA’s investment in Broadcom products.

c. Communicate Broadcom Best Practices in relation to VA’s Broadcom operating environment.

d. Perform daily prioritization of open support cases.

e. Provide daily coordination of support organizations and VA resources for support cases.

f. Shall serve as the single point of contact for operations and process issues, and will provide back-up, if unavailable.

g. Provide an Operations Management Monthly Status Report (TAM Status Report).

The report shall detail the number and type (e.g., severity level and technical issue) of support cases opened and shall provide a listing of any open support cases at the time of the report, as well as the current status of projects the TAM is tracking.

h. Track the daily progress of open support cases and expedite outstanding issues to ensure the shortest Mean Time to Resolve.

i. Recommend specific training modules to VA PMs which may improve operational efficiency and can reduce support cases, when open support cases indicate that additional personnel training in Broadcom products is warranted.

j. Work closely with Success 360 Support as described in Section 2.1.10 to ensure all VA support needs are met.

k. Conduct Quarterly TAM Business review to provide VA with awareness of all activities.

l. Provide TAM Capability Review

Deliverable:

A. Operations Management Monthly Status Report (TAM Status Report)

3.2.4 TECHNICAL SUPPORT

The Contractor shall provide Broadcom Success 360 Support as described by the Broadcom Success 360 Support for Federal offering and summarized below. The Contractor shall provide this coverage for both perpetual and BCSP licensed components and shall not be priced separately to include all VA facilities and users.

Success 360 Support shall provide VA with unlimited, direct access to United States-based Broadcom senior-level support staff to help keep VA infrastructure up and running 24x7x365.

The Contractor shall provide a designated Broadcom Support Account Manager, familiar with VA team and environment, who shall work with VA to:

1. Provide support request and critical situation management

2. Facilitate recurring team meetings to review support requests, status updates, and upcoming projects

3. Assist in coordinating Broadcom resources for multi-vendor troubleshooting efforts

4. Provide Support Business Reviews with trend analysis and feedback based on

VA support activity Coordinate onsite and proactive support services

5. Coordinate root cause analysis efforts for VA’s critical support requests

Broadcom Success 360 Support for Federal Agencies shall provide support coverage 24 hours x 7 days x 365 days per year (24x7x365) via telephone, a web-based portal, and e-mail, for all software technical issues, including direct routing to Senior Support Engineers for Success 360 Support, in accordance with Broadcom Target Response Times, as defined in the table below:

Broadcom Target Response Times for Success 360 Support

Severity Levels Response Times

Critical (Severity 1)

Major (Severity 2)

Minor (Severity 3)

Cosmetic (Severity 4)

Within 30 minutes, 24 hrs./day, 7 days/week

Within 2 hours, 10 hrs./day, 7 days/week

Within 4 hours, 10 hrs./day, 5 days/week

Within 8 hours, 10 hrs./day, 5 days/week

The designated Broadcom Success Support Manager shall provide tracking and progress of the technical support being provided, and the Contractor shall include the information as part of the Operations Management Monthly Status Report as identified in Section 3.2.3.1. Success 360 Support shall be provided for all VA staff members and VA contractor support staff needing assistance with Broadcom products to include unlimited support to infrastructure administrators. A weekly Success 360 Support review meeting shall occur between VA staff members and the Contractors shall participate to discuss any open status tickets.

Deliverable:

A. Weekly Success 360 Support Report

3.2.5 KNOWLEDGE BASE AND TOOLS

The Contractor shall provide, on a 24x7x365 basis, direct customer access to Broadcom’s knowledge base and internal tools via https://broadcom.com or https://partnerportal.broadcom.com/.

3.2.6 SOFTWARE UPDATES

The Contractor shall provide, on a 24x7x365 basis, direct access to all Broadcom software updates and upgrades including major releases and minor updates/patches for all products and applications deployed throughout VA. Software updates shall be downloadable by approved VA personnel. The Contractor shall maintain a list of approved VA personnel and shall provide the software personnel access list to VA semi-annually for review and revision. In addition, the COR may request personnel be added or removed from the list at any time during the performance period.

3.3 WORKSPACE ONE PERPETUAL LICENSING

VA uses Workspace ONE Advanced for Enterprise Mobility Management that was recently increased to support over 218,000 mobile devices actively. VA will not be required to move to BCSP licensing for Workspace ONE existing or new licensing, if it is offered during the contract period of execution.

3.3.1 LICENSE MAINTENANCE

The Contractor shall provide software entitlement, maintenance and support for the products listed and the quantities identified in tab “CLIN 0001--BCSP Base” of Attachment A. Execution of CLIN 0001 - Licensing shall begin on the first day following the end date of the current support term and shall be co-terminus with the PoP end date 12 months from contract award and annually thereafter if option periods are exercised.

4.0 PERFORMANCE DETAILS

4.1 PERFORMANCE PERIOD

The PoP shall be 12 months from date of award with six 12-month option periods and two optional tasks.

Any work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO).

There are eleven (11) Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, five are set by date:

New Year’s Day January 1 Juneteenth June 19 Independence Day July 4 Veterans Day November 11 Christmas Day December 25

If any of the above falls on a Saturday, then Friday shall be observed as a holiday.

Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

Martin Luther King’s Birthday Third Monday in January Washington’s Birthday Third Monday in February Memorial Day Last Monday in May Labor Day First Monday in September Columbus Day Second Monday in October Thanksgiving Fourth Thursday in November

4.2 PLACE OF PERFORMANCE

Services provided under this PWS may be performed virtually by Contractor staff.

Broadcom-based systems are located at most VA facilities thus virtual based support is the most efficient delivery method. If onsite work is deemed necessary at VA facilities as determined by the individual Professional Service engagement, the work must be approved by the COR in advance and shall be performed at no additional cost to the Government. Any work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO) or COR.

5.0 SPECIFIC TASKS AND DELIVERABLES

5.1 PROJECT MANAGEMENT

5.1.1 KICK-OFF MEETING

The Contractor shall hold a Technical Kick-Off Meeting within 10 days after contract award. The Contractor shall present, for review and approval by the Government, the details of the intended approach, work plan, and project schedule for each effort. The Contractor shall specify dates coordinated with the VA and provide a Kick-Off Meeting Agenda three business days prior to the meeting.

The Contractor shall provide Kick-Off Meeting Minutes to all attendees three days after the meeting. The Contractor shall invite the CO, Contract Specialist (CS), COR and the VA Program Managers. The Technical Kick-Off Meeting will be held virtually.

Deliverable:

A. Kick-Off Meeting Agenda and Minutes

5.1.2 QUARTERLY STEERING COMMITTEE MEETINGS

The Contractor shall host four Quarterly Steering Committee Meetings during each performance period (annually) of the effort. These meetings may or may not require Contractor travel. Travel expenses will not be directly reimbursed to the Contractor.

The VA may choose to cancel these meetings; however, the Contractor must have a reasonable cause approved by the COR for cancellation.

The Contractor shall provide a Quarterly Steering Committee Meeting Agenda 10 business days prior to the meeting. The Contractor shall provide the Quarterly Steering Committee Meeting Minutes within one week after the meeting. The meeting minutes shall include topics covered, key issues/discussion points, actions and copies of all presentations.

Deliverable:

A. Quarterly Steering Committee Meeting Agenda and Minutes

5.1.3 BI-WEEKLY STATUS MEETINGS

The Contractor shall host bi-weekly (once every two weeks) Program Management virtual meetings between OIT Managers, Broadcom Representatives and the Contractor. The Contractor shall provide an update on progress that was made the prior week, identify any issues that are impacting work activities, determine a mitigation strategy, and discuss planned activities for the coming week.

Each month, at least 1 (one) of the bi-weekly meetings must include consumption licensing reporting (BCSP) and review of projected licensing usage or major changes to consumption and/or tracking of the consumption. These reports shall be included at least one (1) day prior to the meeting, the Contractor shall provide a Bi-Weekly Status Report, including an updated Work Breakdown Structure, showing what each VA consultant is working on, planned start and end dates, any technology refreshment discussion and the current percent completion.

VA may choose to cancel these meetings; however, the contractor must have a reasonable cause approved by the COR for cancellation and must still provide the bi-weekly status report.

Deliverable:

A. Bi-Weekly Status Report

5.1.4 INVENTORY RECONCILIATION

5.1.4.1 ENTITLEMENT REPORT

The Contractor shall provide and deliver Quarterly Install Base (IB) Inventory Report for VA concurrence throughout the PoP. The Quarterly IB Inventory Report shall include the following: item nomenclature, part number, location, support expiration date, software category, software support Service Levels, software applications and associated device license keys. The report shall include its current Software support expiration date. The IB inventory database shall track licenses by VA organization to which they are assigned. The IB inventory database shall have a separate category for unassigned licenses. VA understands this is a BCSP contract, however it is expected that license usage will still be monitored.

Deliverable:

A. Quarterly Install Base Inventory Report

5.1.4.2 MONTHLY USAGE REPORT

The Contractor shall maintain a running account of the pool of Points purchased by VA.

The Contractor shall create Monthly Usage Meter Reports based on the previous month's usage and present the results at the Quarterly Steering Committee Meeting.

The report shall consist of the following: VA usage for the previous month, significant changes to usage, and an estimate for the following month’s usage. The report shall include the Points purchased by Task Order, monthly points consumed from the pool, and the available Point balance. Monthly point consumption shall be calculated from the amount of physical cores allocated to virtual machines by Broadcom products along with the number of hours the infrastructure was used and the product(s) in use in support of the virtual machine(s). The Contractor shall follow the specific calculation methods for each product, as described in the then-current commercial BCSP schedule (Attachment A).

The Monthly Usage Meter Reports shall be due no later than the fifth business day of each month to VA and the Contractor shall include use data from the end of the preceding calendar month. VA shall approve point consumption debits before being applied to VA point pool.

Deliverable:

A. Monthly Usage Meter Reports

5.1.4.3 MONTHLY USAGE SUBMISSION

The Contractor shall perform monthly usage submission on behalf of VA through the Broadcom Commerce Portal by the 15th of each month. The Contractor shall obtain consumption information from all participating departments, build a detailed analysis per department for their monthly usage, and submit usage on behalf of VA each month to meet the reporting requirements of the program.

VA will intend to automate point usage monitoring and reporting utilizing “vCloud Usage Insight”. VA will utilize Broadcom Usage Meter appliances in compliance with BCSP.

If VA is unable to provide reporting due to outage or unavailability of Usage Meter, manual report aggregation will be completed. If a period of monitoring is unavailable, contractor will determine average utilization over previous two-month periods to determine VA utilization during period without monitoring.

VA will be able to maintain a ‘Cloud Test Demonstration Environment’ of not to exceed 2% of VA point utilization. This environment will be maintained on separate pre-production instances and VA will not be charged utilization for this instance.

The environment is primarily in the Cleveland VA Medical Center campus (Core Data Center) and will be identified as such for manual reporting events. All communications between the Contractor and Broadcom, on behalf of VA, will include at minimum COR and VA Program Manager.

VA will also be allotted ‘Not for Resale’ licensing for use in pre-production testing, proof of concept environments and long-term demonstration environments that exceed 30 days. Although VA data may be represented in these environments, they will not be considered production and conform to ‘Not for Resale’ licensing limitations further defined by Broadcom.

Deliverable:

A. Monthly Usage Submission Report

5.1.4.4 RECONCILIATION

Under this effort, the Contractor shall perform an annual inventory reconciliation, conducted within 120 days prior to the end of the current base and each contract option period, if exercised.

The reconciliation shall include the following:

1. Updates to the IB resulting from additions of inventory caused by procurements of software licenses outside of this contract.

2. Subtractions of inventory caused by the expiration of licenses, reductions in software products and/or removal of Broadcom products owned within VA. If software is to be retired, VA will notify the Contractor.

The Contractor shall co-term new inventory (add to the IB), whose support is expiring, at the warranty renewal date. The result of this reconciliation shall determine the IB inventory for the next exercised period. Any additional inventory added during this 60-day period shall be included in the next exercised period Install Base Inventory Report.

The Contractor shall reconcile and document any/all inventory changes with VA concurrence in each option period, if exercised. The COR may also request that software the Government is abandoning be removed permanently from the IB inventory.

VA understands this is a BCSP contract, however it is expected that license usage will still be monitored.

5.1.4.4.1 CAPACITY PLANNING & USAGE ANALYSIS

The Contractor shall perform a Capacity Planning & Usage Analysis for new initiatives and existing environments as requested. The Contractor shall collect, analyze, and validate usage reports to forecast and provide accurate point consumption estimates.

The analysis shall detail projected increases or decreases for new or existing deployments to verify that adequate points remain to cover anticipated usage.

Under this effort, the Contractor shall conduct an annual Capacity Planning & Usage Analysis, within 120 days before the end of the current base and each option period, if exercised. The result of this analysis shall determine the capacity plan and anticipated usage for the next exercised period. The Contractor shall propose custom bundles or product 0substitutions with VA based on utilization analysis for optimization, this information shall be included in the Capacity Planning & Usage Analysis deliverable.

Deliverable:

A. Capacity Planning & Usage Analysis Report

5.1.5 TECHNOLOGY REFRESHMENT

The Contractor shall monitor all Broadcom software products listed on Monthly Usage Reports and notify the CO if any products are required to be changed or updated to accommodate the latest technology. Reasons for notifications include updated/revised standards, as well as commercial non-availability, or obsolescence. If any software products are no longer supported, the Contractor shall provide notice to the COR and CO within thirty (30) days before the support ends. Any Technical Refreshment Proposals shall address:

1. Desirability. The Contractor shall submit sufficient information regarding the addition or substitution of new software for the Government and Contractor to jointly assess the value of including the proposed product. Such information should consist of the technical capabilities, and any efficiencies gained its applicability to current VA architecture standards and limitations of the recommended product. The Point value proposed shall not exceed the Point value of the refreshed product. The VA will expect the proposed product to be of equal or greater capabilities of refreshed product.

2. Feasibility. The Contractor shall submit sufficient information regarding the addition or substitution of new software for the Government and Contractor to jointly assess the possibility of including the proposed product. Such information should consist of supporting rationale for why the addition or substitution would be within the scope of the contract, its backward compatibility with the product it replaces, and any integration or other technical problems that might be encountered.

The Government is under no obligation to consumed points from the pool of purchased Points or purchases additional Points for any proposed software substitution presented by the Contractor’s Technical Refreshment proposal.

The review of upgradeable Products and License reports shall be provided as needed during Bi-Weekly Status Meetings.

Deliverable:

A. Upgradeable Products and License Report

5.1.6 VA PROVISIONS FOR BCSP

In support of migrating to a consumption model, the Contractor shall provide comprehensive integrated virtualization software solutions that can support a workforce of more than 600,000 users (including employees, volunteers, and contactors) and millions of Veterans and family members who utilize VA information technology (IT) solutions for medical care and benefits processing. This effort also requires support for a true multi-tenant, network segregated solution.

The Contractor shall provide support function siloing to include, but not limited to, virtual machine provisioning, virtualization infrastructure support, virtual machine manager, network provisioning, security monitoring, and storage provisioning. VA also requires an aggregate view of infrastructure across multiple organizations to include availability, performance and configuration monitoring and management. Approximately 3,400 existing Broadcom hosts do not use traditional local disks and instead leverage stateless or boot from flash (such as: Secure Digital (SD) Card/ Universal Serial Bus (USB)) technology.

Any future solution must provide Information Assurance (IA) and data security that meets National Institute of Standards and Technology (NIST), Federal Information Processing Standards (FIPS) 140-2/140-3 requirements and be fully compliant with Section 508 of the Americans with Disabilities Act. The future solution must also provide technical capabilities equal to or greater than those provided by the current Broadcom suite of products for server, network, and storage virtualization, to include all management and administrative capabilities.

5.1.7 VA PROVISIONS FOR END OF SUPPORT OR UNSUPPORTED SOFTWARE

In the event that the VA possesses products that have surpassed their end-of-support date, the VA will not require Broadcom to provide support for these products. Any incompatible infrastructure will default to the perpetual licensing terms outlined in Table 1 and Table 2. Should Broadcom decide to discontinue the general availability or support of a product offering, the VA will not incur any charges related to this infrastructure or application usage.

Furthermore, if the VA opts to limit the usage of a product, such as through network isolation of an older or 'self-supported' instance, Broadcom will not bill, invoice, or otherwise charge the VA for this software or its usage. In such cases, the VA will adhere to the perpetual licensing limits specified in Table 1.

5.2 NOTICE OF THE FEDERAL ACCESSIBILITY LAW AFFECTING ALL

INFORMATION AND COMMUNICATION TECHNOLOGY (ICT)

PROCUREMENTS (SECTION 508)

On January 18, 2017, the Architectural and Transportation Barriers Compliance Board (Access Board) revised and updated, in a single rulemaking, standards for electronic and information technology developed, procured, maintained, or used by Federal agencies covered by Section 508 of the Rehabilitation Act of 1973, as well as our guidelines for telecommunications equipment and customer premises equipment covered by Section 255 of the Communications Act of 1934. The revisions and updates to the Section 508-based standards and Section 255-based guidelines are intended to ensure that information and communication technology (ICT) covered by the respective statutes is accessible to and usable by individuals with disabilities.

5.3 COMPATABILITY WITH ASSISTIVE TECHNOLOGY

The standards do not require installation of specific accessibility-related software or attachment of an assistive technology device. Section 508 requires that ICT be compatible with such software and devices so that ICT can be accessible to and usable by individuals using assistive technology, including but not limited to screen readers, screen magnifiers, and speech recognition software.

5.4 ACCEPTANCE AND ACCEPTANCE TESTING

Deliverables resulting from this solicitation will be accepted based in part on satisfaction of the Section 508 Chapter 2: Scoping Requirements standards identified above.

The Government reserves the right to test for Section 508 Compliance before delivery.

The Contractor shall be able to demonstrate Section 508 Compliance upon Deliverables resulting from this solicitation will be accepted based in part on satisfaction of the Section 508 Chapter 2: Scoping Requirements standards identified above.

The Government reserves the right to test for Section 508 Compliance before delivery.

The Contractor shall be able to demonstrate Section 508 Compliance upon delivery.

6.0 GENERAL REQUIREMENTS

6.1 ENTERPRISE AND IT FRAMEWORK

6.1.1 VA TECHNICAL REFERENCE MODEL

The Contractor shall support the VA enterprise management framework. In association with the framework, the Contractor shall comply with OIT Technical Reference Model (VA TRM). The VA TRM is one component within the overall Enterprise Architecture (EA) that establishes a common vocabulary and structure for describing the information technology used to develop, operate, and maintain enterprise applications. Moreover, the VA TRM, which includes the Standards Profile and Product List, serves as a technology roadmap and tool for supporting OIT. Architecture & Engineering Services (AES) has overall responsibility for the VA TRM.

6.1.2 INTERNET PROTOCOL VERSION 6 (IPV6)

The Contractor solution shall support Internet Protocol Version 6 (IPv6) based upon the memo issued by the Office of Management and Budget (OMB) on November 19, 2020 (https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-07.pdf). IPv6 technology, in accordance with the USGv6 Program (https://www.nist.gov/programs-projects/usgv6-program/usgv6-revision-1), NIST Special Publication (SP) 500-267B Revision 1 “USGv6 Profile” (https://doi.org/10.6028/NIST.SP.500-267Br1), and NIST SP 800-119 “Guidelines for the Secure Deployment of IPv6” (https://doi.org/10.6028/NIST.SP.800-119), compliance shall be included in all IT infrastructures, application designs, application development, operational systems and sub-systems, and their integration. In addition to the above requirements, all devices shall support native IPv6 and dual stack (IPv6 / IPv4) connectivity without additional memory or other resources being provided by the Government, so that they can function in a mixed environment. All public/external facing servers and services (e.g.

web, email, DNS, ISP services, etc.) shall support native IPv6 and dual stack (IPv6 / IPv4) users and all internal infrastructure and applications shall communicate using native IPv6 and dual stack (IPv6 / IPv4) operations.

6.1.3 TRUSTED INTERNET CONNECTION (TIC)

The Contractor solution shall meet the requirements outlined in Office of Management and Budget Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative“ (https://www.whitehouse.gov/wp-content/uploads/2019/09/M-19-26.pdf), VA Directive 6513 “Secure External Connections”, and shall comply with the TIC 3.0 Core Guidance Documents, including all Volumes and TIC Use Cases, found at the https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-07.pdf file://///R04.med.va.gov/V03/EAS/Users/vhaeasWymbsk/TEMPLATES--NEW%20TAC%20PROCESS/PWS%20TEMPLATE%20(DO%20NOT%20TOUCH)%20-%20In%20Process%20Revisions/DO%20NOT%20TOUCH%20(next%20version/IPv6/(https:/www.nist.gov/programs-projects/usgv6-program/usgv6-revision-1 file://///R04.med.va.gov/V03/EAS/Users/vhaeasWymbsk/TEMPLATES--NEW%20TAC%20PROCESS/PWS%20TEMPLATE%20(DO%20NOT%20TOUCH)%20-%20In%20Process%20Revisions/DO%20NOT%20TOUCH%20(next%20version/IPv6/(https:/www.nist.gov/programs-projects/usgv6-program/usgv6-revision-1 https://doi.org/10.6028/NIST.SP.500-267Br1 https://doi.org/10.6028/NIST.SP.800-119 https://www.whitehouse.gov/wp-content/uploads/2019/09/M-19-26.pdf

Cybersecurity & Infrastructure Security Agency (CISA) (https://www.cisa.gov/publication/tic-30-core-guidance-documents). Any deviations must be approved by the VA TIC 3.0 Working Group at vaoisesatic30team@va.gov.

6.1.4 STANDARD COMPUTER CONFIGURATION

The Contractor IT end user solution that is developed for use on standard VA computers shall be compatible with and be supported on the standard VA operating system, currently Windows 10 (64bit), Edge (Chromium based), and 365 Apps for enterprise. Applications delivered to VA and intended to be deployed to Windows 10 workstations shall be delivered as a signed .msi package with switches for silent and unattended installation and updates shall be delivered in signed .msp file formats for easy deployment using Microsoft Endpoint Configuration Manager (CM) VA’s current desktop application deployment tool. Signing of the software code shall be through a vendor provided certificate that is trusted by VA using a code signing authority such as Verizon/Cybertrust or Symantec/VeriSign. The Contractor shall also ensure and certify that their solution functions as expected when used from a standard VA computer, with non-admin, standard user rights that have been configured using the United States Government Configuration Baseline (USGCB) and Defense Information Systems Agency (DISA) Secure Technical Implementation Guide (STIG) specific to the particular client operating system being used.

6.1.5 VETERAN FOCUSED INTEGRATION PROCESS (VIP) AND PRODUCT LINE

MANAGEMENT (PLM)

The Contractor shall support VA efforts IAW the updated Veteran Focused Integration Process (VIP) and Product Line Management (PLM). The major focus of the new VIP is on Governance and Reporting and is less prescriptive, with a focus on outcomes and continuous delivery of value. Product Line Management (PLM) is a framework that focuses on delivering functional products that provide the highest priority work to customers while delivering simplified, reliable, and practical solutions to the business, medical staff, and our Veterans. The VIP Guide is a companion guide to the PLM Playbook and can be found at:

https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371 and the PLM Playbook can be found at https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946. The PLM Playbook pivots from project-centric to product-centric delivery and contains descriptive practices that focuses on outcomes. The PLM Playbook contains a set of “plays” that implement Development, Security, and Operations (DevSecOps) principles and processes such as automated development, continuous integration/continuous delivery, and release on demand. The PLM Playbook details how product lines implement Lean-Agile principles, methods, practices, and techniques through levels of maturity. VIP and PLM are the authoritative processes that IT projects must follow to ensure development and delivery of IT products.

6.1.6 PROCESS ASSET LIBRARY (PAL)

https://www.cisa.gov/publication/tic-30-core-guidance-documents mailto:vaoisesatic30team@va.gov https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

The Contractor shall perform their duties consistent with the processes defined in the OIT Process Asset Library (PAL). The PAL scope includes the full spectrum of OIT functions and activities, such as VIP project management, operations, service delivery, communications, acquisition, and resource management. PAL serves as an authoritative and informative repository of searchable processes, activities or tasks, roles, artifacts, tools and applicable standards and guides to assist the OIT workforce, Government and Contractor personnel. The Contractor shall follow the PAL processes to ensure compliance with policies and regulations and to meet VA quality standards. The PAL includes the contractor onboarding process consistent with Section

6.2.2 and can be found at https://www.va.gov/PROCESS/artifacts/maps/process_CONB_ext.pdf. The main PAL can be accessed at www.va.gov/process.

6.1.7 AUTHORITATIVE DATA SOURCES

The VA Enterprise Architecture Repository (VEAR) is one component within the overall EA that establishes the common framework for data taxonomy for describing the data architecture used to develop, operate, and maintain enterprise applications. The Contractor shall comply with the department’s Authoritative Data Source (ADS) requirement that VA systems, services, and processes throughout the enterprise shall access VA data solely through official VA ADSs where applicable, see below. The Information Classes which compose each ADS are located in the VEAR, in the Data & Information domain. The Contractor shall ensure that all delivered applications and system solutions support:

1. Interfacing with VA’s Master Person Index (MPI) (formerly the Master Veteran Index (MVI)) to provision identity attributes, if the solution relies on VA user identities. MPI is the authoritative source for VA user identity data.

2. Interfacing with Capital Asset Inventory (CAI) to conduct real property record management actions, if the solution relies on real property records data. CAI is the authoritative source for VA real property record management data.

3. Interfacing with electronic Contract Management System (eCMS) for access to contract, contract line item, purchase requisition, offering vendor and vendor, and solicitation information above the micro-purchase threshold, if the solution relies on procurement data. ECMS is the authoritative source for VA procurement actions data.

4. Interfacing with HRSmart Human Resources Information System to conduct personnel action processing, on-boarding, benefits management, and compensation management, if the solution relies on personnel data. HRSmart is the authoritative source for VA personnel information data.

5. Interfacing with Vet360 to access personal contact information, if the solution relies on VA Veteran personal contact information data. Vet360 is the authoritative source for VA Veteran Personal Contact Data.

6. Interfacing with VA/Department of Defense (DoD) Identity Repository (VADIR) for determining eligibility for VA benefits under Title 38, if the solution relies on qualifying active duty military service data. VADIR is the authoritative source for Qualifying Active Duty military service in VA.

https://www.va.gov/PROCESS/artifacts/maps/process_CONB_ext.pdf http://www.va.gov/process

6.1.8 SOCIAL SECURITY NUMBER (SSN) REDUCTION

The Contractor solution shall support the Social Security Number (SSN) Fraud Prevention Act (FPA) of 2017 which prohibits the inclusion of SSNs on any document sent by mail. The Contractor support shall also be performed in accordance with Section 240 of the Consolidated Appropriations Act (CAA) 2018, enacted March 23, 2018, which mandates VA to discontinue using SSNs to identify individuals in all VA information systems as the Primary Identifier. The Contractor shall ensure that any new IT solution discontinues the use of SSN as the Primary Identifier to replace the SSN with the ICN in all VA information systems for all individuals. The Contractor shall ensure that all Contractor delivered applications and systems integrate with the VA Master Person Index (MPI) for identity traits to include the use of the ICN as the Primary Identifier.