Enterprise Server Endpoint Management

VA-26-00012805

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Office of Information & Technology Infrastructure Operations

Enterprise Server Endpoint Management

Date: 20 January 2026

VA-26-00012805

PWS Version Number: 1.0

Contents

BACKGROUND

The Department of Veterans Affairs (VA), Office of Information & Technology (OIT), Infrastructure Operations (IO) strives to provide high quality, effective, and efficient Information Technology (IT) services to those responsible for providing care to the Veterans at the point-of-care as well as throughout all the points of the Veteran healthcare in an effective, timely and compassionate manner. VA depends on Information Management/Information Technology (IM/IT) systems to meet mission goals.

The mission of VA OIT IO is to ensure that the IM/IT systems are secure, and that the most sensitive Veteran information housed on those systems are safeguarded. VA employs over 400,000 people worldwide, including those located in Guam, Puerto Rico, and the Philippines. The mission of IO is to maintain the overall cybersecurity posture of managed systems through enhanced visibility, with leading edge guidance, support, and tools, while simultaneously ensuring VA information systems, practices, policies, processes, and procedures comply with Federal mandates.

IO is responsible for enterprise-wide server endpoint security, compliance monitoring, reporting, authorization, and accreditation support for defined Federal Information Security Modernization Act (FISMA) system boundaries, and software assurance and source code review for VA applications. At present, IO is using the enterprise endpoint monitoring application BigFix as its Enterprise Server Endpoint Management (ESEM) tool to accomplish these tasks. BigFix is a critical VA resource for Independent Verification and Validation (IV&V) of VA Endpoints and their Security Configurations.

· Provides real-time agent-based visibility to over 150,000 VA Managed Endpoints (Windows, Linux, Unix, and MacOS). Including Remote Systems not on Virtual Private Network (VPN), FedRamp Cloud, Microsoft Azure, Amazon Web Services (AWS), VA Enterprise Cloud (VAEC), External Service Providers (Veteran Service Applications).

· Provides unbiased continuous monitoring of endpoint security configuration compliance (e.g., Defense Information Systems Agency (DISA) Security Technical Implementation Guides (STIG), Government Risk and Compliance (GRC) Artifacts, etc.), security tool configuration compliance and vulnerabilities (e.g., Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV), Common Vulnerability Enumerator (CVE)).

BigFix also provides endpoint data and functionality to many key VA and External Systems (e.g., Department of Homeland Security (DHS) Continuous Diagnostics and Mitigation (CDM), ServiceNow (SNOW), Information Central Analytics and Metrics Platform (ICAMP), VA Remote VPN Services (RESCUE) Network Admission Control (NAC, Cisco ISE/Forescout), Consolidated Enterprise Database (CEAD), etc.

VA maintains multiple Trusted Internet Connection (TIC) Gateways. The VA has established a datacenter cage connected to at least two TIC gateways specifically designed for hosting equipment that is used to support the services and capabilities outlined above.

It is VA’s requirement to transition this ESEM capability currently provided by BigFix to a modern Software as a Service (SaaS) or Hybrid SaaS solution installed, integrated, and optionally managed by a third-party solution provider.

APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. “Federal Information Security Modernization Act of 2014”

2. Federal Information Processing Standards (FIPS) Publication 140-3, “Security Requirements for Cryptographic Modules”, March 22, 2019

3. FIPS Pub 199. “Standards for Security Categorization of Federal Information and Information Systems,” February 2004

4. FIPS Pub 200, “Minimum Security Requirements for Federal Information and Information Systems,” March 2006

5. FIPS Pub 201-3, “Personal Identity Verification of Federal Employees and Contractors,” January 2022

6. 10 U.S.C. § 2224, "Defense Information Assurance Program", as amended

7. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

8. Public Law 109-461 (P.L. 109-461), Veterans Benefits, Health Care, and Information Technology Act of 2006, as amended, Title IX, Information Security Matters

9. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”, as amended

10. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, https://www.va.gov/vapubs/index.cfm

11. VA Handbook 0710, “Personnel Security and Suitability Program,” May 2, 2016, https://www.va.gov/vapubs/index.cfm

12. VA Directive 6102, “Internet/Intranet Services,” August 5, 2019

13. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and Guidelines,” as amended

14. Office of Management and Budget (OMB) Circular A-130, “Managing Federal Information as a Strategic Resource,” July 28, 2016

15. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed Services (CHAMPUS)”, as amended

16. NIST SP 800-66 Rev. 2, “Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule: A Cybersecurity Resource Guide,” February 2024

17. 45 C.F.R Parts 160 and 164, Subparts A and E, the Standards for Privacy of Individually Identifiable Health Information (“Privacy Rule”); and 45 C.F.R. Parts 160 and 164, Subparts A and C, the Security Standard (“Security Rule”); as amended

18. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended

19. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

20. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021 (see VA NOTICE 24-18, dated September 27, 2024, “Update to VA Directive 6500 Cybersecurity Program”, and VA Notice 25-07, dated 3/18/25, “Amending VA Directive 6500 to incorporate M-24-15”)

21. VA Handbook 6500, “Risk Management Framework for VA Information Systems VA Information Security Program,” February 24, 2021 (see VA Notice 25-01, dated October 15, 2024, “Update to VA Handbook 6500 Risk Management Framework for VA Information Systems VA Information Security Program”, and VA Notice 25-06, dated 3/18/25, “Amending VA Directive 6500 to incorporate M-24-15”)

22. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI),” June 30, 2023

23. VA Handbook 6500.6, “Contract Security,” March 12, 2010 (see VA Notice 24-12, dated April 22, 2024, “Update to VA Handbook 6500.6, Contract Security, Appendix C VA Information and Information System Security/Privacy Language For Inclusion Into Contracts, As Appropriate”)

24. VA Handbook 6500.8, “Information System Contingency Planning,” March 25, 2025

25. VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018

26. VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017

27. OIT Process Asset Library (PAL), OIT Process Asset Library.

28. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

29. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014

30. VA Directive 6510, “VA Identity, Credential and Access Management,” September 3, 2024

31. VA Handbook 6510, “VA Identity, Credential and Access Management,” September 27, 2024

32. VA Directive and Handbook 6513, “Secure External Connections,” October 12, 2017

33. VA Directive 6300, “Records and Information Management,” September 21, 2018

34. VA Handbook, 6300.1, “Records Management Procedures,“ March 24, 2010

35. NIST SP 800-37 Rev 2, “Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy,” December 2018

36. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020)

37. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015

38. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” March 24, 2014

39. OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005

40. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019

41. OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008

42. Federal Identity, Credential, and Access Management (FICAM) Architecture, June 30, 2023 (FICAM Architecture (idmanagement.gov))

43. NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access,“ June 2018

44. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, “Digital Identity Guidelines,” updated March 02, 2020

45. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014

46. VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

47. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

48. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

49. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

50. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019

51. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008

52. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (P.L. 110–140), December 19, 2007

53. Section 104 of the Energy Policy Act of 2005, (P.L. 109–58), August 8, 2005

54. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 2, 2001

55. VA Directive 0057, “VA Environmental Management Program,” October 25, 2022

56. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

57. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

58. “Veteran Focused Integration Process (VIP) Guide 4.0,” March 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

59. VA Memorandum “Proper Use of Email and Other Messaging Services,” January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

60. “Product Line Management Transformation Playbook” version 3.1, August 2023, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

61. NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020

62. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol Version 6 (IPv6),” November 19, 2020

63. Social Security Number (SSN) Fraud Prevention Act of 2017

64. Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23, 2018

65. C.F.R Title 15 Part 7, “Securing the Information and Communications Technology and Services (ICTS) Supply Chain”, as amended

66. Executive Order 14028, “Executive Order on Improving the Nation's Cybersecurity,” May 12, 2021, https://bidenwhitehouse.archives.gov/briefing-room/presidential-actions/2025/01/16/executive-order-on-strengthening-and-promoting-innovation-in-the-nations-cybersecurity/

67. OMB Memorandum M-22-09, “Moving the U.S. Government Toward Zero Trust Cybersecurity Principles”, January 26, 2022, https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf.

68. NIST SP 800-52 Revision 2, “Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations

69. OMB M-22-18, “Enhancing the Security of the Software Supply Chain through Secure Software Development Practices,” September 14, 2022

70. OMB M-23-16, “Update to Memorandum M-22-18,” June 9, 2023

71. OMB M-21-31, “Improving the Federal Government’s Investigative and Remediation Capabilities Related to Cybersecurity Incidents,” August 27, 2021

72. NIST SP 800-88 Revision 1 “Guidelines for Media Sanitization,” December 2014

73. CISA Binding Operational Directive (BOD) 19-02: “Vulnerability Remediation Requirements of Internet-Accessible Systems,” April 29, 2019, BOD 19-02: Vulnerability Remediation Requirements for Internet-Accessible Systems | CISA

74. CISA BOD 22-01: “Reducing the Significant Risk of Known Exploited Vulnerabilities,” November 3, 2021, BOD 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities | CISA

75. CISA BOD 23-01: Improving Asset Visibility and Vulnerability Detection on Federal Networks.” Cybersecurity & Infrastructure Security Agency (CISA), BOD 23-01: Improving Asset Visibility and Vulnerability Detection on Federal Networks | CISA

76. VA Directive 6550, Pre-Procurement Assessment and Implementation of Medical Devices/Systems, June 03, 2019

77. VA Memorandum, “VA Security Controls,” January 17, 2025, https://www.voa.va.gov/DocumentView.aspx?DocumentID=5010

SCOPE OF WORK

The Contractor shall provide an ESEM SaaS tool, integration support, and optionally ongoing technical sustainment services to include development, maintenance, and reporting of applicable information security compliance and associated vulnerability data as well as associated software and hardware asset management data. The Contractor shall ensure the confidentiality, availability, and integrity of this data in support of the VA Cybersecurity Operation Center (CSOC) Cyber Threat Intelligence (CTI) Program, VA OIT Assessment and Authorization (A&A) Program, the Department of Homeland Security’s (DHS) Continuous Diagnostics and Mitigation (CDM) Program, and many functions within VA Office of Information and Technology (OIT). The Contractor shall ensure device, system and accreditation boundary visibility into all assets is available to individual information system owners as well as appropriate security personnel and auditors to ensure appropriate technical security is deployed and maintains current, required security compliance. The Contractor shall provide the capability to report exceptions to information security requirements and strategies to identify non-compliant assets and systems that could expose VA to unnecessary or unauthorized risk.

PERFORMANCE DETAILS

PERFORMANCE PERIOD

The PoP shall consist of a 12-month base year plus five (5), 12-month option periods and two (2) optional tasks. The PoP for the optional tasks shall not exceed the period of performance for the base or option period for which it was exercised. The overall Task Order PoP shall not exceed 72 months, inclusive of options and optional tasks.

Any work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO).

There are 11 Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, five are set by date:

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

PLACE OF PERFORMANCE

Tasks under this PWS shall be performed at Contractor facilities. The Contractor shall identify the Contractor’s place of performance in their proposal submission.

TRAVEL

The Government does not anticipate travel under this effort.

SPECIFIC TASKS AND DELIVERABLES

The Contractor shall perform the following:

PROJECT MANAGEMENT

CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, timeline, and tools to be used in execution of the contract. The CPMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks, and resource support. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPMP shall be concurred upon and updated in accordance with Section B of the contract. The Contractor shall update and maintain the VA PM approved CPMP throughout the PoP.

Deliverable:

A. Contractor Project Management Plan

REPORTING REQUIREMENTS

The Contractor shall provide the COR with Monthly Activity Reports in electronic form in Microsoft Word and Project formats. The report shall include detailed instructions/explanations for each required data element, to ensure that data is accurate and consistent. These reports shall reflect data as of the last day of the preceding Month.

The Monthly Activity Reports shall cover all work completed during the reporting period and work planned for the subsequent reporting period broken down by each task described in Section 5 of this PWS. The report shall also identify any problems that arose and a description of how the problems were resolved. If problems have not been completely resolved, the Contractor shall provide an explanation including their plan and timeframe for resolving the issue. The report shall also include an itemized list of all Information and Communication Technology (ICT) deliverables and their current Section 508 conformance status. The Contractor shall monitor performance against the CPMP and report any deviations. It is expected that the Contractor will keep in communication with VA accordingly so that issues that arise are transparent to both parties to prevent escalation of outstanding issues.

In addition, the Contractor shall attend teleconference meetings with the VA Task Leads to discuss and document any issues, pending deliverables, or other pertinent topics concerning the task areas on a cadence matching the individual Task Lead requirements, no less than weekly, but no more than twice daily

Deliverable:

A. Monthly Activity Report

TECHNICAL KICKOFF MEETING

A technical kickoff meeting shall be held within 10 days after TO award. The Contractor shall coordinate the date, time, virtual meeting with the Contracting Officer (CO), as the Post-Award Conference Chairperson, the VA PM, as the Co-Chairperson, the Contract Specialist (CS), and the Contracting Officer’s Representative (COR). The Contractor shall provide a draft agenda to the CO and VA PM at least five (5) calendar days prior to the meeting. Upon Government approval of a final agenda, the Contractor shall distribute to all meeting invitees.

During the kickoff-meeting, the Contractor shall present, for review and approval by the Government, the details of the intended approach, work plan, and project schedule for each effort via a Kick-Off Meeting presentation delivered in advance using Microsoft PowerPoint. The Contractor shall submit the final updated presentation to the CO for review within three (3) calendar days after the meeting. The Contractor shall also work with the CS, the Government’s designated note taker, to prepare and distribute the meeting minutes of the kickoff meeting to the CO, COR, and all attendees within three (3) calendar days after the meeting.

Deliverable:

A. Kick-Off Meeting Presentation

TRANSITION-IN SUPPORT

The incoming Contractor staff shall participate in phase-in, onboarding transition knowledge sharing and scheduling activities with the outgoing contractor. The Contractor shall participate in any Phase-In Transition Plan meetings scheduled by the outgoing contractor or with the VA PM, COR or VA groups identified by the VA PM or COR. The Contractor shall obtain any required credentials, knowledge, training, and experience of specific technologies referenced as well as VA specific processes (standard operating procedure development) that the Contractor will need to understand/follow. For example, a deep understanding of the provided ESEM tool, CDM and FISMA is required. Should the Contractor bring on staff that do not have sufficient experience to perform necessary tasks, the Government shall not incur the cost of sending Contractor staff to training. The Government shall not bear the expense of any training, nor incur cost for time and travel.

The incoming Contractor shall perform the following activities:

a. Participate in reviews of program documentation.

b. Participate, as an observer, in desk side knowledge sharing in the day-to-day tasks performed by the outgoing contractor, understanding all standard operating procedures, VA stakeholders, and business workflows and processes.

c. Acquire knowledge of all details on accessing and assessment of applicable tools and repositories.

d. Provide VA PM with ongoing status of Government-required (on-boarding) training, clearances, access, and certification processes

e. Complete any necessary transition services, reporting, automation or similar transition to replacement solution(s).

f. Complete any standard operating procedures or other documentation necessary to complete this transition in contractor operational support.

TRANSITION-OUT PLAN

The Contractor shall create and periodically update a Transition-Out Plan for VA PM/COR review and approval. The plan shall detail a complete transition from this TO covering three possible scenarios: either to a follow-on TO the incumbent has been awarded, to a new Contractor, or to otherwise end the TO at the discretion of the Government. The plan shall outline the formal coordination the Contractor will perform, if the optional task is exercised under PWS 5.2 (as well as 5.3 and 5.4 if the respective optional tasks are executed), with Government staff, and successor staff and management. This Transition-Out Plan, at a minimum, shall include how the Contractor will perform the following: resource staffing, tasks to be executed, and timelines for performing the tasks to cover all activities outlined in PWS section 5.2 (as well as 5.3 and 5.4 if the respective optional tasks are executed). The plan shall also include coexistence period and parallel-run outcomes, migration of inventory/history/evidence, decommission criteria for legacy capabilities, training/role transition outcomes, and enterprise communications/standard operating procedures.

Deliverable:

A. Transition Out Plan

ENTERPRISE SERVER ENDPOINT MANAGEMENT TOOL

VA requires an enterprise-wide server endpoint management capability that delivers measurable cybersecurity and availability outcomes across all VA organizations, hosting locations, and operating environments (Development, Pre-Production, Disaster Recovery, and Production). The capability shall enable time-bound remediation of vulnerabilities and patches, continuous visibility into security configuration compliance, and standardized, traceable exception governance aligned to VA 6500 and related baselines. The enterprise solution shall produce a single authoritative compliance posture and audit-ready evidence view for VA leadership and oversight, with defined data-quality controls that ensure metrics are accurate, current, and defensible. The solution shall also support operations in segmented, intermittently connected, or constrained network zones and integrate with enterprise service management, asset inventory, and security operations workflows so that remediation actions, approvals, and evidence are consistently linked and reportable at the system boundary and enterprise levels.

The ESEM Tool shall have the capabilities as follows:

SaaS or Hybrid SaaS application. Reference PWS A1.0 for required FedRAMP certification. The VA will accept FedRAMP Moderate authorization at the time of the initial award. However, it is expected that the product either currently holds FedRAMP High authorization or will achieve FedRAMP High authorization within [specified time frame, e.g., 12 months] from the date of the contract award.

a. The SaaS offering shall be fully managed service that does not require customer-initiated upgrades, vulnerability remediation, or manual modifications to maintain functionality. If any processes, changes or user-initiated modifications are needed, they shall be completed by contractor. All disaster recovery, high availability, or other changes to meet availability requirements shall be a responsibility of the contractor.

b. The ESEM tool shall be maintained to sustain four nines (99.99%) application availability for all application components; excluding a monthly maintenance window not exceeding a total duration of 4 hours.

c. Entitlement for 150,000 endpoints to include physical or virtual, cloud, network devices and other agent-based systems shall be all inclusive and cover all services, software or hardware components of each endpoint. Unlimited Internet of Things (IoT) or non-agent-based systems, including individual services, containers, or other application management, shall also be covered. Additional endpoint entitlements may be purchased in increments of one, up to an additional 650,000 endpoints.

d. Ninety (90) days before expected end of option period, the contractor shall provide VA with the projected/required entitlement requirements for the next option period. Entitlements shall include only active, reporting endpoints and exclude aged, offline or otherwise unused endpoints.

The tool shall be fully functional on existing platforms and ensure forward compatibility with any future platforms or technologies implemented during the contract period. The tool shall coexist with other management tools such as Microsoft Endpoint Configuration Manager (MECM) and System Center Configuration Manager (SCCM). VA Currently used platforms are listed in PWS appendix A9.

For Cross-OS Patching capability, the provided tool shall be able to manage and deploy patches to over 150,000 endpoints, with the ability to expand to at least 800,000 across different operating systems including Windows, Linux, Solaris, and MacOS, ensuring all endpoints, regardless of their OS, are up-to-date and secure. Content must be available within 24 hours of release. The tool shall include support for customization of patch content detection and installation. The tool shall:

e. Be capable of custom script or equivalent that allows inventorying of software & hardware information using WMI, registry, file search, etc. Must include support for custom packages/content and custom detection logic. Including native support for PowerShell and Bash.

f. Allow deployments to be pre-staged prior to execution.

g. Support disallowing or optioning out of content/packages on select subsets of endpoints.

h. Allow execution of deployments to be scheduled according to endpoint specific maintenance windows by date/time/day of month.

i. Ensure all functions support automation, scheduling and policy-based exceptions of above path installations.

For content distribution infrastructure requirements, the tool shall accommodate payloads exceeding 5GB to endpoints in datacenters, cloud (e.g., AWS and Azure), and remote sites. Content distribution appliances/nodes must be able to be virtualized on OpenShift Virt/VMWare/Azure/AWS. Content distribution must not require Peer to Peer to function; dedicated distribution endpoints per subnet/location shall be used. These dedicated distribution endpoints shall be fully managed by the tool/contractor at no additional cost to VA (e.g., virtual appliances with OS fully managed, patched, configured and updated by contractor).

For Real-Time Compliance/Enforcement, the tool shall continuously monitor, report and enforce compliance policies in real-time based upon industry standards such as Security Technical Implementation Guides (STIG) and Center for Internet Security (CIS) benchmarks, each able to be customized to VA requirements, ensuring endpoints adhere to regulatory and internal standards. Continuous Diagnostic Monitoring (CDM). All Common Configuration Enumeration (CCE) and Common Vulnerabilities and Exposures Enumeration (CVE) detection, remediation, and compliance monitoring must be real time. The deployed tool shall generate detailed compliance in accordance with the STIG Enumeration provided in appendix 8.0. The tool shall provide:

Integration ability with CrowdStrike (XDR/EDR tool)

j. Reporting shall be integrated with FISMA boundary data of endpoints from ServiceNow API.

k. Reporting must provide must be “weighted” per baseline, provide overall compliance percentage, flag high category noncompliance and be drillable to provide detailed information for remediation.

l. Compliance monitoring, auditing and reporting in accordance with OMB Memorandum M-21-31.

m. Web portal for real-time reporting that provides custom report creation and saving of VA internal public (accessible to all VA staff) and private (credentialed, limited access) reports.

n. Exportable reports to allow ‘dashboard’ creation via PowerBI.

o. Aggregate compliance data across custom groupings such as business units, geographic regions, or other organizational constructs.

p. New content/baseline data shall be ingested automatically.

For Offline/Air-Gapped/Internet Disconnected Support the tool shall provide all capabilities, including patching and compliance capabilities for endpoints that are not always connected to the network, such as those in secure or isolated environments.

The tool shall provide automatic mitigation and remediation through quarantine, patching, and process control.

For Third-Party Patch Catalog Depth, the tool shall offer an extensive library of patches for third-party applications, browsers, middleware, and database, ensuring comprehensive coverage and security for various software programs. Examples include Java, Chrome, Firefox, Adobe, MySQL, Tomcat, Apache, VMware Tools, Splunk, Trellix, CrowdStrike.

For Role-Based Control / Least Privilege, the tool shall implement role-based access controls, granting users the minimum necessary privileges to reduce security risks and enhance operational efficiency.

For integration with existing tools, the tool shall seamlessly integrate with Microsoft Active Directory, EntraID, Satellite, Configuration Management Databases (CMDB), Security Information and Event Management (SIEM) systems (Splunk), Security Orchestration Automation and Response (SOAR) (Sentinel) tools, Azure, AWS and ServiceNow, enhancing overall IT operations and security. Solution must support API integration. Must allow for the visibility and management of resources within cloud environments (AWS & Azure).

q. VA operates enterprise cloud implementations in AWS and Azure, collectively forming the VA Enterprise Cloud, as well as commercial cloud environments in both AWS and Azure. VA reserves the right to extend this visibility requirement to other cloud providers without incurring additional costs.

The tool shall provide a mature, fully documented Application Programming Interface (API) enabling data extraction via RESTful services or other industry-standard protocols for seamless integration with enterprise systems. The API shall have the capability to extract any collected data captured by the tool.

For Asset Discovery / Asset Management, the tool shall identify and catalog all hardware and software assets on the network, providing comprehensive asset management and inventory capabilities. It must include customization of software and configuration discovery and detection. Collection capabilities must include the following:

r. Collect detailed inventory across Microsoft (desktop and server OS) and Unix/Linux variants (Oracle, Sun, RHEL, Amazon Linux, SUSE, etc.). Complete list contained within AWS Appendix 9.

s. Software Inventory includes: Software name, edition, detailed version/build, installation path, and usage metering (e.g., last used date/time and last used by user). Detection of database management systems (DBMS) with version, edition (e.g., Express, Development, Enterprise), inventory, and licensing status.

t. Hardware Inventory includes: System name, manufacturer, model, CPU count and model, RAM, HDD details (manufacturer, model, partition, size), number of cores, MAC & IP addresses. System inventory information to include serial numbers, service identifier(s) and unique system ID. Virtual machine product information and processor cores for licensing support. System configuration information to include TPM, cryptographic suites, disk configuration, etc.

u. Endpoint Contextualization - Identify server location and business unit assignment using endpoint IP address or other system identifiers (e.g., Austin Enterprise Datacenter, AWS, Azure, VA Medical Center facilities), and/or system tag identifiers that may identify environment (dev vs prod), or program (Benefits, Corporate, etc).

For Vulnerability Correlation, the tool shall correlate identified vulnerabilities (CVE IDs) with patch availability and other mitigations, prioritizing actions to improve security posture.

For Federal Compliance Posture (FISMA/CDM), the tool shall ensure compliance with federal mandates such as the Federal Information Security Management Act (FISMA) and Continuous Diagnostics and Mitigation (CDM) program, supporting a robust security framework for government organization.

For System Data Retention, the tool shall have the capability to store all collected data metrics for a minimum of 6 months and retain all vulnerability, software usage and remediation data for 3.5 years. This data must be available via API for the purpose of creating VA custom dashboards and reporting of historical data. Data may be ‘live’ or archived, available to support contractor provided reporting services. CDM/FISMA compliance data to exceed 3.5 years shall be a product of the CDM program and any logging in excess of 3.5 years is not in scope.

For Audit Log Retention, the tool shall produce audit logs of all logon and user activities within the tool and retain such data for a minimum of one year.

The tool shall support a lab environment for testing between production versions and beta versions of content.

v. Contractor shall support a separate pre-production instance to validate configuration changes, upgrades, VA integration changes (authentication, certs, SSO, tools, automation development) at no additional cost to VA.

w. The lab environment(s) shall be used to support all product testing, implementation and backout plans. No lab/pre-production environment(s) shall be at additional cost to VA.

Deliverable:

A. Enterprise Server Endpoint Management Tool entitlement for 150,000 endpoints

ESEM TOOL IMPLEMENTATION

The Contractor shall provide end-to-end implementation services for the new enterprise endpoint management system to replace the currently used HCL BigFix. These services include but are not limited to the setup of the SaaS or hybrid SaaS solution, integration into the network security stack, installation and maintenance of agents on all endpoints, and establishment of distributed data distribution points for rolling out content, patches and updates. The Contractor shall provide:

1. Pre-Installation Planning:

a. Conduct a comprehensive assessment of the existing infrastructure and identify all endpoints requiring integration.

b. Develop a detailed installation and integration plan outlining key milestones, timelines, and resource requirements.

c. Coordinate with the VA’s IT team to understand network architecture and security requirements.

d. Planning shall include migration and coexistence plan that defines:

· Parallel-run duration,

· Data/history/evidence migration approach,

· Maintain continuous endpoint management coverage (patching, compliance, inventory, reporting) throughout coexistence such that no in-scope endpoints lose management capability during transition.

· Cutover sequencing by environment (Dev/Pre-Prod/DR/Prod), program or location.

· Provide objective cutover acceptance criteria (e.g., endpoint coverage %, policy parity %, reporting parity %, evidence export parity %) and produce an acceptance report per cutover wave.

· Custom reporting to include dashboard functionality, content management and lifecycle, automation for security, path, inventory.

· Decommission criteria for legacy capabilities,

· Rollback criteria, with measurable acceptance gates for each phase.

a. May require automated reinstallation trying, configuration changes (scripts for automation) to fix installation of agents and any attempted reinstallation.

2. Network Security Integration:

a. Ensure that the new endpoint management system is seamlessly integrated into the existing network security stack.

b. Configure security settings to comply with VA's security policies and standards.

c. Implement necessary VPNs or secure communication tunnels for secure data transmission between endpoints and the management system.

d. Tool shall implement VA provided certificates/chain as needed, adapting to support SSL/TLS inspection between endpoints and the management system. This SSL/TLS inspection may replace any certificates in chain and management system shall adapt to support this modification, as needed.

3. Agent Installation:

a. Deploy agents on all identified endpoints, ensuring minimal disruption to ongoing operations.

b. Verify compatibility of agents with various operating systems used within the VA’s infrastructure.

c. Perform necessary configurations on agents to ensure they communicate effectively with the central management system.

d. Maintain the lifecycle of any agent(s); e.g., upgrade, patch, configuration changes, and/or removal.

4. Establishment of Data Distribution Points (DDPs):

a. Set up distributed DDPs to facilitate efficient patch management and software updates.

b. Configure DDPs to ensure they can handle the expected load and distribute data efficiently across all endpoints.

c. Ensure that DDPs are securely integrated with the central management system and comply with all VA data handling policies.

d. Manage DDPs and their lifecycle.

5. System Configuration and Testing:

a. Configure the management system as per requirements laid out during the pre-installation planning phase.

b. Conduct thorough testing of the system, including agent communication, patch distribution, and security compliance.

c. Address any issues identified during the testing phase to ensure a fully functional system.

6. Documentation and Training:

a. Provide detailed installation and configuration documentation, including network diagrams, security settings, and operational procedures.

b. Conduct training sessions for VA IT staff on system operation, troubleshooting, and maintenance.

7. Post-Installation Support:

a. Provide initial post-installation support to address any immediate issues or concerns.

b. Ensure the system is fully operational and meeting all defined objectives before transitioning to the integration and sustainment phases.

ESEM INTEGRATION WITH EXISTING TOOLS

VA uses various required third-party commercial tools or customized tools that require data exchange with ESEM tool(s). The ESEM tool shall integrate with these tools to facilitate the required data exchange and the contractor shall provide support for this integration, as needed to ensure continued functionality. The tools requiring integration include:

1. ServiceNOW (SNOW) – ESEM Inventory / CI Data The contractor shall integrate the ESEM tool with ServiceNow’s Configuration Management Database (CMDB) which is the system of record for infrastructure and endpoint configuration items (CIs). The “Endpoint Inventory / CI Data” capability is typically fed via API, MID Server, Discovery, and/or IntegrationHub ETL. This will be direct, bi-directional, API calls.

2. VA Information Central Analytics and Metrics Platform (ICAMP) – enterprise Tagging Information – custom attributes The contractor shall integrate the ESEM tool with Information Central Analytics and Metrics Platform (ICAMP). ICAMP is an authoritative data smart tool organizing security and operational data sources across the enterprise, centralizing reporting and metrics for operational processes, technologies, and services with a focus on enterprise-level reporting.

This is a VA custom developed implementation; primary integration is completed via ODBC. Data is bi-directional.

3. VA Enterprise Logging Warehouse Integration

VA's Enterprise Logging Warehouse is composed of a software platform to search, analyze and visualize the machine-generated logs and data gathered from the websites, applications, sensors, devices etc. which make up organizational IT infrastructure and business. The contractor shall integrate the ESEM tool with the VA Enterprise Logging Warehouse (Currently Splunk).

The tool shall comply with Executive order 14028 and NIST 800-53 Rev 5 and VA Handbook 6500 by sending all logging data from ESEM to an established logging platform within the VA Enterprise Logging Warehouse.

This is completed via standardized syslog protocols over internet, to include any method available for ingestion by Splunk in a FISMA managed environment (intention is logs travel back to VA managed address space).

4. Government Risk and Compliance (GRC) integration (ServiceNOW CAM module) VA uses a Government Risk and Compliance (GRC) tool to manage governance, risk management, and compliance processes within the organization. The GRC tool helps the VA streamline the management of IT risk, regulatory compliance, and policy adherence. This GRC tool is the authoritative source for FISMA boundary data. The contractor shall integrate the ESEM to retrieve this boundary data in order to facilitate compliance reporting within the ESEM tool.

ESEM shall also provide vulnerability data, system inventory and/or software usage and metering to GRC.

This shall be completed via API, bi-directional.

OPTIONAL TASK ONE - ESEM TOOL SUSTAINMENT

The contractor shall provide services necessary to operationalize and maintain the ESEM tool provided to VA. The intention is to leverage out of the box capabilities included with the contractor provided tool/toolset, within minimal services overhead to support this endeavor. The requirements are specified to require functionality, while supporting flexibility in tool capabilities and features. The intention is to increase efficiency through automation and decrease contractor and manual staff maintenance overhead of maintaining the ESEM tool. If the ESEM tool requires additional customization, third-party products or services to perform these functions, all components and services shall be provided by contractor.

ESEM SUITE SUPPORT

The Contractor shall provide overarching support for all components of the ESEM Suite. Support tasks the Contractor shall perform include:

a. Initial installation, configuration, upgrades, and patching for all application components.

b. Maintain the application ESEM Change Control Process SOP utilizing the VA Change Request solution (currently ServiceNow (SNOW)) for these tasks and adjust for changes to VA Change Control policies.

c. Perform any necessary operating system and database server installation, configuration, upgrade, and patching activities as required for proper operation ESEM tool.

d. Monitor the daily health status to ensure functional operation of all components of the ESEM tool. Monitor the ESEM tool application infrastructure to ensure the usability and availability of the tool for end users and that all automated jobs scheduled activities run successfully. The results of the daily health checks shall be included in a daily morning report.

e. Attend daily (Monday through Thursday) Status calls and provide Daily Meeting Minutes to Government personnel and other attendees.

f. Manage and monitor daily administrative jobs supporting the ESEM tool for performance and successful completion.

g. The Contractor shall develop necessary artifacts to obtain a VA ATO for the ESEM solution and complete the VA Assessment and Authorization (A&A) process. All artifacts shall be delivered within 90 calendar days of award. The Contractor shall update and maintain the A&A documentation as required to ensure continued compliance. The Contractor shall monitor, track, and respond to Plans of Action and Milestones. The Contractor shall provide input to update the VAEC ATO as needed; this includes continuous monitoring, ISCP/DRP and any testing or remediation needed to comply with ATO findings.

h. Maintain the processes and procedures necessary to ensure minimal data loss for the ESEM tool in the event of system failure. The information will be included in the comprehensive ESEM Disaster Recovery Plan as part of the ATO support deliverable and encompasses all systems in the Government Risk Compliance (GRC) ESEM FISMA System Boundary. The Contractor shall be responsible for the ESEM application specific high availability and disaster recovery activities.

i. Provide support for full Disaster Recovery tests of the ESEM tool components. These tests will include failover from the designated primary site to the failover site. Disaster Recovery tests are to be performed at least annually. This work is generally planned and performed during an approved maintenance window scheduled during weekend hours.

j. Provide support for any emergency Disaster Recovery event that may occur. This may require after-hours, holiday or weekend work until such time as production capabilities are fully restored.

k. Prepare and deliver weekly status updates to Government personnel via a Weekly Tracker Report, detailing all planned and completed tasks supporting the ESEM tool suite.

l. Manage ESEM tool suite access requests via the VA standard ticketing system, currently ServiceNOW (SNOW), and the ESEM Access Request Form (to be developed but expected to be a ServiceNOW process).

m. Install, maintain, and troubleshoot ESEM tool single sign on capabilities across the suite to include certificate based smart card and token authentications, e.g., VA Active Directory and/or Entra ID. VA shall not provide any physical tokens or two-factor devices to support this requirement.

n. Collaborate directly with the OEM vendor personnel to provide recommendations to enhance the functionality and performance of the ESEM tool suite.

o. Contractor shall apply security remediation to all ESEM environments and related infrastructure based on Nessus scans, Remediation Effort Entry Form (REEF), and Information Central Analytics Metrics Platform (ICAMP) results; perform Disaster Recovery testing; troubleshoot performance issues with ESEM tool related applications (generally application deficiencies); and restore the ESEM tool lab environment between production versions and beta versions of the ESEM tool.

p. Maintain the formal system for intake, assessment of mission alignment, impact assessment, level of effort evaluation, and prioritization of requests which shall be included in the ESEM Request Intake Process Standard Operating Procedures (SOP).

q. Provide an ESEM Summary of Changes Report inclusive of version upgrades, database schema changes, and patches affecting the ESEM tool.

Deliverables:

A. ESEM Change Control Process SOP B. ESEM Disaster Recovery Plan C. ESEM Weekly Tracker Report C. ESEM Request Intake Process SOP D. ESEM Summary of Changes Report

ESEM COMPONENT SUPPORT

The Contractor shall provide support for the ESEM Platform application components. The Contractor shall:

a. Create and maintain any necessary console and web report user accounts with appropriate authorization roles for system access supporting the VA Zero Trust First Cybersecurity Strategy.