PWS FY24 Enterprise Security Architecture Support_RFI Draft.docx

Enterprise Security Architecture (ESA) Support

VA-24-00011633

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Office of Information & Technology Office of Information Security

Enterprise Security Architecture (ESA) Support

Date: March 13, 2024

VA-24-0001163

PWS Version Number: 6.0

Contents

BACKGROUND

The mission of the Department of Veterans Affairs (VA) is to provide benefits and services to Veterans of the United States. In meeting these goals, the Office of Information & Technology (OI&T) strives to provide high quality, effective, efficient, and secure Information Technology (IT) services to those responsible for providing care to the Veterans at the point-of-care as well as throughout all the points of the Veterans’ health care in an effective, timely and compassionate manner. VA Health, Benefits, Memorial, and Corporate business functions provide services that our Veterans depend on for VA’s information systems and data. Protecting these information systems and data is critical to execute VA’s mission. VA depends on Information Management (IM) / IT systems to meet these mission goals. The VA OI&T, Office of Information Security (OIS) mission is to ensure VA information systems and infrastructures for managing Veterans information are cybersecurity ready.

OIS seeks to ensure the resiliency of VA’s cybersecurity infrastructure through proactive monitoring, adaptive responses, adherence to Federal requirements and best practices, and the recruitment, retention, and development of a world-class cybersecurity workforce. Because of the expanding cybersecurity threats, and dynamic IT landscape, OIS must continue to modernize its information security program to not only address existing deficiencies, but posture to mitigate and minimize the risks from the use of new technologies and achieve alignment with Federal cybersecurity strategies and direction. OIS manages, oversees, and directs VA’s Information Security Program and provides expert products and services in Information Security Strategy, Information Security Policy & Compliance, Cybersecurity Architecture, Cybersecurity Technology and Metrics, Cybersecurity Operations Center (CSOC), Information Security Risk Management, and Cybersecurity Workforce Development.

OIS has developed a strategic plan to protect Veterans’ and VA information. As part of this strategic direction and, in accordance with the Presidential Executive Order on Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure, the VA seeks to strengthen the cybersecurity of its IT infrastructure and provide solutions to support and enhance the Department’s mission. The VA is also responsive to Office of Management and Budget (OMB) and National Institute of Standards and Technology (NIST) direction and VA Office of Inspector General (OIG) Findings concerning network threats. To ensure compliance and mission success, OIS stood up an Enterprise Security Architecture (ESA) Department which focuses on information security throughout the VA Enterprise and is an overarching effort to implement a cohesive security architecture that utilizes national security standards, guidelines, and policies, an ESA Framework (i.e., Cybersecurity Framework), Enterprise Architecture Design Patterns, Reference Architectures, considers privacy implications, and enables industry standards. The support provided helps the VA create, discover, and architect (emphasizing the importance of aligning enterprise architecture requirements to the reference security architecture), document, and analyze cybersecurity solutions that will ensure Veteran and VA information is not subjected to unacceptable risk when new technologies and solutions are employed.

The ESA Task Order (TO) helps accomplish the OIS Cybersecurity Strategy and helps ensure the resiliency of VA’s cybersecurity infrastructure through proactive monitoring, adaptive responses, adherence to Federal requirements, best practices, and by defining, developing, and implementing the various aspects of ESA required to maintain the confidentiality, integrity, and availability of Veteran and VA information. ESA also leverages Contractor support to provide artifacts that link the organizational and business levels to lower technical, logical-structure and systems levels to enable the deployment of new and secure technologies with consistency through implementation guidance and the establishment of an analytic library. The expertise needed to satisfy this requirement spans a broad range of technologies, technical challenges and user experience to include but not limited to: mobile and medical devices, cloud ecosystems, Internet of Things (IoT), zero trust, software defined networks, enterprise architecture, artificial intelligence (AI), virtual reality/extended reality (VR/XR), 5G, Transport Layer Security, block chain, Post Quantum Cryptography (PQC); application testing and deployment, analysis, defining business processes, and systems design, Enterprise Architecture Tools, Microsoft (MS) Project and VISIO.

APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. 44 U.S.C. § 3541-3549, “Federal Information Security Management Act (FISMA) of 2002”

2. “Federal Information Security Modernization Act of 2014”

3. Federal Information Processing Standards (FIPS) Publication 140-2, “Security Requirements for Cryptographic Modules”

4. FIPS Pub 199. “Standards for Security Categorization of Federal Information and Information Systems,” February 2004

5. FIPS Pub 200, “Minimum Security Requirements for Federal Information and Information Systems,” March 2006

6. FIPS Pub 201-2, “Personal Identity Verification of Federal Employees and Contractors,” August 2013

7. 10 U.S.C. § 2224, "Defense Information Assurance Program"

8. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

9. Public Law 109-461, Veterans Benefits, Health Care, and Information Technology Act of 2006, Title IX, Information Security Matters

10. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”

11. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, https://www.va.gov/vapubs/index.cfm

12. VA Handbook 0710, “Personnel Security and Suitability Program,” May 2, 2016, https://www.va.gov/vapubs/index.cfm

13. VA Directive and Handbook 6102, “Internet/Intranet Services,” August 5, 2019

14. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and Guidelines,” January 18, 2017

15. Office of Management and Budget (OMB) Circular A-130, “Managing Federal Information as a Strategic Resource,” July 28, 2016

16. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed Services (CHAMPUS)”

17. NIST SP 800-66 Rev. 1, “An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule,” October 2008

18. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended, January 18, 2017

19. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

20. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021

21. VA Handbook 6500, “Risk Management Framework for VA Information Systems VA Information Security Program,” February 24, 2021

22. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI),” March 12, 2019

23. VA Handbook 6500.5, “Incorporating Security and Privacy into the System Development Lifecycle,” March 22, 2010

24. VA Handbook 6500.6, “Contract Security,” March 12, 2010

25. VA Handbook 6500.8, “Information System Contingency Planning,” April 6, 2011

26. VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018

27. VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017

28. OIT Process Asset Library (PAL), https://www.va.gov/process/ . Reference Process Maps at https://www.va.gov/process/maps.asp and Artifact templates at https://www.va.gov/process/artifacts.asp

29. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

30. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014

31. VA Handbook 6508.1, “Procedures for Privacy Threshold Analysis and Privacy Impact Assessment,” July 30, 2015

32. VA Handbook 6510, “VA Identity and Access Management,” January 15, 2016

33. VA Directive and Handbook 6513, “Secure External Connections,” October 12, 2017

34. VA Directive 6300, “Records and Information Management,” September 21, 2018

35. VA Handbook, 6300.1, “Records Management Procedures,“ March 24, 2010

36. NIST SP 800-37 Rev 2, “Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy,” December 2018

37. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020)

38. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015

39. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” March 24, 2014

40. OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005

41. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019

42. OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008

43. Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance, December 2, 2011, (NOTE: Part A of the FICAM Roadmap and Implementation Guidance, v2.0, was replaced in 2015 with an updated Architecture (https://arch.idmanagement.gov/#what-is-the-ficam-architecture)

44. NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access,“ June 2018

45. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, “Digital Identity Guidelines,” updated March 02, 2020

46. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014

47. NIST SP 800-164, “Guidelines on Hardware-Rooted Security in Mobile Devices (Draft),” October 2012

48. Draft National Institute of Standards and Technology Interagency Report (NISTIR) 7981, “Mobile, PIV, and Authentication,” March 2014

49. VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

50. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

51. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

52. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

53. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019

54. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008

55. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (Public Law 110–140), December 19, 2007

56. Section 104 of the Energy Policy Act of 2005, (Public Law 109–58), August 8, 2005

57. Executive Order 13834, “Efficient Federal Operations,” dated May 17, 2018

58. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 2, 2001

59. VA Directive 0058, “VA Green Purchasing Program,” July 19, 2013

60. VA Handbook 0058, “VA Green Purchasing Program,” July 19, 2013

61. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

62. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

63. “Veteran Focused Integration Process (VIP) Guide 4.0,” January 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

64. VA Memorandum “Proper Use of Email and Other Messaging Services,” January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

65. “DevSecOps Product Line Management Playbook” version 2.0, May 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

66. NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020

67. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol Version 6 (IPv6),” November 19, 2020

68. Social Security Number (SSN) Fraud Prevention Act of 2017

69. Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23, 2018

70. Cloud Security Architecture Security Patterns (Attachment A)

71. Cloud Security Architecture Strategy (Attachment B)

72. Cloud Security Architecture and Privacy Requirements Framework (Attachment C)

73. VA Affairs Office of Inspector General Audit and Evaluation (Attachment D)

74. VA Veteran-Focused Integration Process Guide 3.2 (Attachment E)

75. National Institute of Standards and Technology (NIST) Special Publication 800-207 Zero Trust Architecture (Attachment F)

76. VA ESA Framework v1 (Attachment G)

77. Executive Order 14028: Improving the Nation's Cybersecurity | GSA

SCOPE OF WORK

The Contractor shall provide technical and programmatic support services to include the development, maintenance of the ESA artifacts, administrative engineering support, and the facilitation of the enterprise-wide use of the VA ESA. The VA ESA shall support an integrated VA-wide risk management program in accordance with NIST SP 800-39, Managing Information Security Risk, Organization (High Level), Mission (Business), and the Information System View (System views may include but would not be limited to logical, data, and tactical). The VA ESA shall be comprehensive and consist of artifacts that support the VA risk management process at the: (i) organization level (VA-level); (ii) mission/business process level (Veterans Health Administration, Veterans Benefits Administration, National Cemetery Administration, and Veterans Affairs Central Office); and (iii) information system level.

The VA ESA has an approved VA ESA Strategy and shall adhere to the strategy to address the evolving threat landscape, support VA Business and IT Modernization initiatives, and take advantage of new and emerging security approaches and technologies. The Contractor shall provide multi-domain support to address VA’s scope, size and complexity, which includes but is not limited to enterprise architecture, emerging technologies, networks, mobile, specialized domain areas (healthcare, medical devices, cybersecurity, IT Modernization, large-scale architecture, risk management, etc.). The Contractor shall have the specialized technical and cybersecurity expertise needed to advance the new technologies that VA introduces such as: the merging of Electronic Health Records, cloud computing, Application Programming Interfaces (APIs), specialized networks (i.e., software and security perimeter and defined networks), IoT, analytic ecosystems, 5G, medical devices, IP V6, PQC, Transport Layer Security (TLS) and VR/XR, block chain, etc.

ORDER TYPE

The effort shall be proposed on a Firm Fixed Price (FFP) basis, including optional tasks.

PERFORMANCE DETAILS

PERFORMANCE PERIOD

The Period of Performance (PoP) shall be 12 months from date of award, with four 12-month option periods and three optional tasks, if exercised. Optional Task One is for ESA PQC and may be exercised one time during each POP with a period up to 12 months per exercise. Optional Task Two is for ESA Needs Analysis and Training and may be exercised one time during each POP with a period up to 12 months per exercise. Optional Task Three is for Transition Support and may be exercised a single time at any time during the base or option periods for a period of 30 days. The overall PoP shall not exceed 61 months, inclusive of all options.

Any work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO).

There are eleven (11) Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, five are set by date:

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

PLACE OF PERFORMANCE

Efforts under this TO shall be performed at Contractor facilities. The Contractor shall identify the Contractor’s place of performance in their proposal submission. The Contractor staff shall be available to coordinate with VA staff on normal Federal Government workdays and shall be responsive between the core hours of 8:00am and 5:00pm Eastern Time.

TRAVEL

The Government anticipates travel under this effort to perform the tasks associated with the effort, as well as to attend program-related meetings or conferences throughout the PoP. Include all estimated travel costs in your firm-fixed price line items. These costs will not be directly reimbursed by the Government.

The total estimated number of trips in support of the program related meetings for this effort is two trips to Washington, D.C., one trip to Martinsburg, WV, and one trip to Austin, TX in the base period. The estimated number of trips in the remaining option periods is one trip to Washington, D.C, one trip to Martinsburg, WV, and one trip to Austin, TX. Anticipated locations include the following, estimated at four days in duration for Martinsburg, WV and Austin, TX and two days in duration for Washington, D.C.:

1. Washington, D.C.

2. Martinsburg, WV

3. Austin, TX

SPECIFIC TASKS AND DELIVERABLES

The Contractor shall perform the following tasks in the Base Period and PWS Sections 5.1-5.4, including all subparagraphs (except 5.1.4) in each Option Period, if exercised:

PROJECT MANAGEMENT

The Contractor shall ensure management of IT projects both large and small and shall be able to manage a portfolio of diverse projects. The Contractor shall provide support in the full range of systems’ development life cycle phases, enterprise-wide network engineering, strategic information planning, business process reengineering, structure, and management practices. The Contractor shall identify and mitigate risks to the program and assist in the management of cost, schedule, and performance.

The Contractor shall assist VA in managing projects (of all sizes) through intake, initiation, planning, managing, and monitoring, execution and closing while assisting VA in managing the constraints of cost, time, resources, scope, and quality with administrative, project management, graphic artist, and engineering expertise.

Additionally, the Contractor shall utilize and support the Program Management Office’s Agile methodology for initiating, managing, and deploying projects and assist in the creation of working groups and project charters to assist project sponsors in business case creation, including scoping, technical tradeoff justifications, and governance for determining scope of technical working groups within ESA. These items as a minimum shall be captured in the Contractor Project Management Plan (CPMP) that provides insights to how the Contractor plans to structure for work products, manage constraints, and reporting aspects needed to accomplish the various ESA Support contract requirements. (See deliverables in Section 5.1.2).

KEY PERSONNEL

The Contractor shall provide resources that have the requisite skills and experience required to perform the tasks within the PWS. The Contractor agrees that the personnel identified below, as key to supporting this effort, shall not be removed, replaced or added to this effort without a compelling reason and without written notification to the COR.

It is the responsibility of the Contractor to provide Contractor support personnel and subcontractors who have the required educational background, experience, security clearance, and access authorization or thereof to meet the labor category descriptions under this TO for the required PWS tasks.

If any change to the Key Personnel assigned to the labor categories identified below becomes necessary (initial staffing, substitutions or additions), the Contractor shall immediately notify the CO, COR, and Program Manager (PM) in writing, accompanied by the resume, if applicable, of the proposed replacement personnel who shall be of at least substantially equal ability and qualifications as the individual(s) currently performing in that category and that the proposed replacement meets or exceeds the qualifications designated for that Key Personnel position. It is expected that substitution or replacement of the personnel will not occur within the first 12 months after date of TO award.

The Contractor shall mitigate the consequences of the loss of Key Personnel and shall promptly secure any necessary replacements in accordance with (IAW) this PWS section. Failure to replace a Key Personnel pursuant to this paragraph and without a break in performance of the labor category at issue shall be considered a condition endangering contract performance and may provide grounds for default termination.

If at any time the assigned key personnel is unavailable, the Contractor shall notify the VA PM and COR in writing and provide an alternate point of contact no later than 48 hours from first notice of unavailability.

The labor categories below have been identified as Key Personnel positions by the Government. However, the Contractor may make modifications or put forward different labor categories than the proposed labor categories. The requirements and stated functions of ESA Support may be achieved by leveraging the following labor categories:

A. IT Program Manager B. Lead/Chief Enterprise Security Architect C. Senior Enterprise Security Analyst D. Project Analyst E. Cybersecurity Analyst, Expert F. Enterprise Security Architect, Intermediate

The Contractor shall have a subject matter expert (SME) resource as Lead/Chief Enterprise Security Architect who will coordinate and guide, technical efforts to ensure there is a consistent approach and quality of products and services (use of standards to minimize rework and mitigate quality concerns of Contractor products delivered). The Contractor shall have SME leads for the identified and executed task/subsections identified herein. However, only one resource shall be designated Lead/Chief Enterprise Security Architect.

· Demonstrated project management experience with both small and large IT projects, preferably supporting government agencies.

· Demonstrated ability managing a portfolio of projects.

· Expertise with full systems development life cycle, enterprise-wide network engineering, strategic information planning, business process reengineering, structure, and management practices.

· Expertise identifying and mitigating risks.

· Expertise tracking and managing costs, schedule, and performance progress.

· Demonstrated success as a PM for security projects.

· Demonstrated success in agile development, specifically Lean and/or Kanban.

· Possession of Project Management Professional certification, including all continuing education credits, is desired.

Minimum Education Level:

· Masters Degree In:

· Engineering, Computer Science, Math, or related scientific/technical discipline.

Minimum Experience:

· 15 years Substitutions:

· A minimum of 10 years of additional relevant experience may be substituted for education.

· Expertise with the design and development of IT architecture, expertise must include a wide range of work in creating diagrams and documentation with all components that comprise IT systems including network topology.

· Demonstrated knowledge and success with guiding structures to advance the development of legacy and new health IT digital architectures including cloud, mobile, IoT, APIs, VR/XR, 5G, PQC, and AI technologies.

· Demonstrated success performing all aspects of risk management.

· Demonstrated knowledge and use of Enterprise Architecture tools.

· Expertise guiding architecture tool processes and products (e.g., Sherwood Applied Business Security Architecture (SABSA)).

· Expertise performing analysis and research of complex problems and processes relating to the subject matter.

· Expertise coordinating with program and project leaders to analyze system architectures during design reviews and throughout the conceptual design lifecycle.

· Expertise in thoroughly identifying strategies for addressing requirements, risks, and issues.

· Expertise with conducting detailed trade-off analysis of requirements against fiscal, schedule, and performance issues.

· Demonstrated success with quickly resolving issues and creating architectural visions.

· Expertise in a wide range of work in creating diagrams and documentation with all components that comprise IT systems including network topology.

Minimum Education Level:

· Masters Degree In:

· Cybersecurity, Math, Engineering, Computer Science, Information Technology, Information Systems Architecture, Telecommunications Systems Design, Architecture Implementation, Information Systems Integration, Software Development Methodologies, Security Engineering, or Network Systems Communications Management.

Minimum Experience:

· 10 years (15 years desired) Substitutions:

· 10 years of additional experience in IT security may be substituted for education.

· Demonstrated knowledge of security principles, concepts, policy and regulations.

· Demonstrated ability identifying risks in security systems and working with technical experts to resolve security issues.

· Demonstrated ability identifying key concepts, factors and risks based on conversations and the ability to document these in a clear and concise narrative or graphic reports.

· Expertise with legacy and new health IT digital architectures including cloud, mobile, IoT, APIs, and AI technologies.

Minimum Education Level:

· Masters Degree In:

· Related scientific or technical discipline (e.g., Information Technology, Information Systems Architecture, Telecommunications Systems Design, Architecture, Implementation, Information Systems Integration, Software Development Methodologies, Security Engineering, Communications and Network Systems Management).

Minimum Experience:

· 10 years Substitutions:

· A minimum of 5 years of enterprise architecture experience may be substituted for education.

· Demonstrated knowledge and use of graphic and office automation tools and producing documents without errors.

· Expertise in using Microsoft Suite Tools (MS Project, Excel, Word, SharePoint, MS Teams, and PowerPoint).

· Demonstrated knowledge in proofreading and editing documents that are highly technical in nature that were created by others to ensure proper format, grammar and style.

· Demonstrated strong communication skills (mastery of English language, both written and verbal).

· Demonstrated performance as a communications officer (collaborating with ESA team members and other communications officers to respond to action items in an action tracking tool).

· Expertise with planning, maintaining and managing schedules for senior leadership.

· Demonstrated ability to create templates for quarterly reports, memos and other correspondence.

Minimum Education Level:

· Bachelors Degree In:

· Business or IT discipline.

Minimum Experience

· 5 years Substitutions

· A minimum of 8 years of additional relevant experience may be substituted for education.

· Expertise in IT with Cyber Security Policy and threat mitigation.

· Demonstrated knowledge and use of Cyber Security tools, network topologies, intrusion detection, Public Key Infrastructure and secured networks.

· Expertise in developing long term strategies.

· Demonstrated knowledge about various cyber threats and their mitigation.

Minimum Education Level:

· Masters Degree In:

· Computer Science, Electronics Engineering or other relevant technical discipline (such as Information Technology, Information Systems Architecture, Telecommunications Systems Design, Architecture, Implementation, Information Systems Integration, Software Development Methodologies, Security Engineering, Communications and Network Systems Management).

Minimum Experience:

· 15 years Substitutions:

· A minimum of 12 years of additional relevant experience may be substituted for education.

· Expertise in IT architecture and creating diagrams, white papers, frameworks, and documentation with all components that comprise IT systems including network topology, etc.

· Expertise with the design and development of IT architectures.

· Expertise performing all aspects of risk management.

· Demonstrated knowledge and use of Enterprise Architecture tools.

· Demonstrated knowledge and ability to perform the analysis and research of problems and processes relating to the architecture subject matter.

· Expertise in conducting trade-off analysis of requirements against the scope, schedule, and performance issues.

Minimum Education Level:

· Bachelors Degree In:

· Engineering, Math, Cybersecurity, or other relevant discipline (e.g., Information Technology, Information Systems Architecture, Telecommunications Systems Design, Architecture Implementation, Information Systems Integration, Software Development Methodologies, Security Engineering, Computer Science, and Network Systems Communications Management).

Minimum Experience:

· 5 years

Substitutions:

· A minimum of 5 years of work experience in relevant areas of Information Technology (e.g. the ability to support legacy and new health IT digital architectures including cloud, mobile, IoT, APIs, VR/XR, 5G, PQC, or AI technologies) may be substituted for education.

CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver a CPMP that lays out the Contractor’s approach, timeline, and tools to be used in execution of the contract. The CPMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks, and resource support. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPMP shall be concurred upon and updated in accordance with Section B of the contract. The Contractor shall update and maintain the VA PM approved CPMP throughout the PoP.

Deliverable:

A. Contractor Project Management Plan

REPORTING REQUIREMENTS

The Reporting Requirements section identifies various work products and deliverables to be provided by, or coordinated with, the VA’s ESA PM to meet contract requirements and ensure the Customer has insights needed to support effective contract management. The Contractor shall provide a Weekly Activity Report (WAR) to the COR and/or PM. The WAR shall include all work completed during the preceding reporting period/week and shall present the work to be accomplished during the subsequent period(s)/week(s) for each task/requirement in Section 5.0. The Contractor shall consolidate and facilitate the briefing of project status weekly and archive the presentations. The status reporting in the WAR shall highlight performance of activities and accomplishments towards the various requirements addressed within this contract and relevant actions items, inquiries, and technical exchanges/consultations. The Contractor shall attend weekly teleconference meetings with the Government PM or represent the PM, as required. The Contractor shall discuss and document risk mitigation considerations and any issues with pending deliverables and other pertinent topics concerning the task areas in weekly, monthly, Program Management Reviews (PMR) and planning documents/reports. Each report shall include the work schedule by name for each person assigned to this contract (e.g.: John Doe is working requirement 5.x). Each report shall identify resolved and unresolved issues with an explanation for each issue. There is the expectation that changes to Contractor alignments to requirements will be in coordination with the Government in advance of the change to add or remove resources.

The Contractor shall submit Status Reports in electronic form in Microsoft Word and Project formats. The report shall include detailed instructions/explanations for each required data element, to ensure that data is accurate and consistent. These reports shall reflect data as of the last day of the preceding. Status Reports shall cover all work completed during the reporting period and work planned for the subsequent reporting period. The report shall also identify any problems that arose and a description of how the problems were resolved. If problems have not been completely resolved, the Contractor shall provide an explanation including their plan and timeframe for resolving the issue. The report shall also include an itemized list of all Information and Communication Technology deliverables and their current Section 508 conformance status. The Contractor shall monitor performance against the CPMP and report any deviations. It is expected that the Contractor will keep in communication with VA accordingly so that issues that arise are transparent to both parties to prevent escalation of outstanding issues.

Additionally, the Contractor shall capture lessons learned along with any best practices that have not been implemented and present them for inclusion in the annual coordination of ESA Implementation Plans for 5.0 requirements. The Contractor shall support collaboration with Government Technical Leads to update the annual ESA Implementation Plans. The Government requires the Contractor products to be 508 compliant to the greatest extent possible and that reports will not have bias or perception of conflict of interest. The Contractor shall document and post minutes of ESA technical meeting forums to afford a consistent approach and timely facilitation of ESA work. The Contractor shall support weekly postings of ESA Technical Forum Data (status, metrics, minutes, document versions, architecture artifacts, deliverables, etc.) to the ESA SharePoint site and via email. The Contractor shall provide a summary Monthly Manpower Report of an execution period of performance. The Contractor shall account for Government furnished equipment (GFE) in a Monthly GFE Inventory Report. The report should include, minimally, information on GFE requested, in their inventory, projections of need, issue encountered with GFE, and items recovered upon the loss of a resource on this contract. The Contractor shall provide the Government with a Contractor’s Quality Assurance Plan that explains their process to ensure products received meet the customer’s expectation of proper English, scope match (appropriate level of depth and content) and reading cohesion (no cut and paste disjoint sections), graphics are conflict free, the appropriate template(s) are used, etc.

Frequently, the Government is required to provide status of high visibility requirements, high risk efforts, and overall, ESA program status at PMR, town halls, and quarterly data call requests. The Contractor shall support preparation and delivery of PMR Status which could take the form of a briefing or presentation and could be monthly to quarterly depending on the profile of requirements within 5.0 and the other data calls mentioned. The Contractor shall coordinate with the ESA Director to facilitate these status formats. The Government is also concerned about the flow of requirements and communications to and between Contractor and subcontractor team members. The Contractor shall provide a Communication Plan that articulates how the prime will convey, share, and ensure accurate and timely information exchanges between the prime and its subcontractors as well as with other ESA Support contractors and/or Federally Funded Research and Development Center contractors. These are some of the products that will help the Government have the insights and the appropriate level of oversight for the successful management of the contract.

Deliverables:

A. Weekly Activity Report B. Status Reports C. Monthly Manpower Report D. Monthly GFE Inventory Report E. Contractor’s Quality Assurance Plan F. PMR Status G. Communication Plan

TECHNICAL KICKOFF MEETING

A technical kickoff meeting shall be held within 10 days after TO award. The Contractor shall coordinate the date, time, and location (can be virtual) with the CO, as the Post-Award Conference Chairperson, the VA ESA PM, as the Co-Chairperson, the Contract Specialist (CS), and the COR. The Contractor shall provide a draft agenda to the Contracting Officer and VA ESA PM at least five calendar days prior to the meeting. Upon Government approval of a final agenda, the Contractor shall distribute to all meeting attendees. During the kick-off meeting, the Contractor shall present, for review and approval by the Government, the details of the intended approach, work plan, and project schedule for each effort via a Microsoft Office PowerPoint. At the conclusion of the meeting, the Contractor shall update the presentation with a final slide entitled “Summary Report” which shall include notes on any major issues, agreements, or disagreements discussed during the kickoff meeting and the following statement, “As the Post-Award Conference Chairperson, I have reviewed the entirety of this presentation and assert that it is an accurate representation and summary of the discussions held during the Technical Kickoff Meeting for the ESA Support.” The Contractor shall submit the final updated presentation to the CO for review and signature within three (3) calendar days after the meeting. The Contractor shall also work with the CS, the Government’s designated note taker, to prepare and distribute the meeting minutes of the kickoff meeting to the CO, COR, and all attendees within three calendar days after the meeting. The Contractor shall request concurrence from the CO/COR on the content of the meeting minutes prior to distribution of the document.

VA MANDATORY TRAINING

The Contractor and ESA PM shall determine which team members require access to the VA network and Rational/GitHub. All Contractors that require access shall complete all the required VA Talent Management System (TMS) training courses within 14 days of the identification of the access need. The Contractor shall work with its respective point of contact, to obtain access to TMS to complete the mandatory training courses.

As an action under the Continuous Readiness in Information Security Program, VA's Assistant Secretary for Information and Technology issued a memorandum requiring all VA government and contract staff to complete information security awareness and applicable role-based training. The Contractor shall submit TMS Training Certificates of completion for VA Privacy and Information Security Awareness, Rules of Behavior, Health Insurance Portability and Accountability Act, and Role-Based trainings. The Contractor shall provide signed copies of the Contractor Rules of Behavior in accordance with Section 9, Training, from Appendix C of the VA Handbook 6500.6, “Contract Security”.

Contractors who have completed these VA training courses within the past 12 or 24 months, depending on the training requirements, and have furnished training certificates to VA, will not be required to re-take the training courses.

Deliverables:

A. TMS Training Certificates B. Signed Contractor Rules of Behavior

ONBOARDING

The Contractor shall manage the onboarding of its staff. Onboarding includes steps to obtain a VA PIV card, network and email account, complete training, initiate background investigations, and gain physical and logical access. In addition, the Contractor shall identify individuals which may require elevated privileges to the necessary development and test environments for the various systems to be enhanced. After review between the Contractor and VA COR, a decision will be made as to the necessity of obtaining GFE for the onboarding staff. If approved, Contractor shall follow the appropriate steps to obtain the equipment.

A single Contractor Onboarding point of contact (POC) shall be designated by the Contractor that tracks the onboarding status of all Contractor personnel. The Contractor Onboarding POC shall be responsible for accurate and timely submission of all required VA onboarding paperwork to the VA COR. The Contractor shall be responsible for tracking the status of all its staff’s onboarding activities to include the names of all personnel engaged on the task, their initial training date for VA Privacy and Information Security training, and their next required training date. The Contractor Onboarding POC shall also report the status at the staff level during onboarding status meetings. The Contractor shall provide an Onboarding Status Report weekly for any staff with outstanding onboarding requests for review by the COR, ESA PM and PM.

Deliverable:

A. Weekly Onboarding Status Report

ESA GOVERNANCE, PROCESS, ORGANIZATION AND INTEGRATION

The Contractor shall support the implementation of best practices for data access, content management, technical process facilitation, and measure effectiveness implementation. This section provides the repository of administrative documents that govern how ESA directorate has structured itself to perform the ESA program objectives. It is where lessons learned, best practices, standards, templates, and policy considerations are filtered for incorporation into ESA products and processes that will then be socialized for integration throughout ESA for a consistent look and feel and throughout the VA enterprise though our external engagements to achieve further mitigation of risk exposure in IT onboarding and positively impact the ability to gain consistent outcomes and predictable results. The Government Technical Lead is responsible for the development and management of the ESA Implementation Plan. The Contractor shall collaborate on the planning for maturing and implementing appropriate risk mitigation activities in the annual ESA Implementation Plan for ESA Governance, Process, Organization and Integration. The Implementation Plan includes the priorities, activities, and schedules for the upcoming PoP. The Contractor shall work collaboratively with the Government lead(s), providing recommendations in the development of the VA ESA Strategic Plan.

ESA STRUCTURE AND INTEGRATION

The Contractor shall update and maintain ESA Artifacts/Technical Documents. The Contractor shall work with other Contractor leads and Government leads to collocate and structure for easy access and reference these artifacts. The ESA Concept of Operations (ConOps) artifact provides the governing vision, drivers, services, and products of ESA. The ConOps details the role of ESA, its functions, its mission, strategic goals, objectives, structure, and products and/or services. It also serves to influence and establish a procedural integration baseline for implementing ESA services and products across the Department. The ESA ConOps is an overarching document that has placeholders for all subsection ConOps. As subsection ConOps are updated, the section of the overarching ESA ConOps is to be update accordingly. In support of this artifact, the Contractor shall support governance impactful forums as determined by the Government through participation, facilitation, and capturing information for ESA consumption. The Contractor shall analyze current and new processes to identify integration points at the business and lower (technical information) system level. The Contractor shall review, compare, check for consistency, alignment, etc. and advise their Government counterpart on suggested improvements as well as offer drafted recommendations.

Although workflows and processes are ways to explain how work gets done in an organization, because these terms are not synonymous and are aspects of this component of the contract, the terms workflow and process have been defined for ESA purposes. Processes need efficient and interconnected workflows to be able to function well. A process can exist without a workflow, but a workflow is always a part of a larger process. Processes involve sequences of tasks that workflows can improve upon. Workflows are more detailed and are usually planned and analyzed because there are risk areas where failures might be introduced (supply chain issues, logistical problems, technical issues with tools, human interface mistakes, etc.). ESA seeks to mature and develop processes to facilitate specific business decision making and analytics and build workflows with enterprise applicability.

ESA will need to define how stakeholders can engage and leverage ESA services more effectively within an Agile construct. The Contractor shall work with ESA leadership to mature the ESA Organizational Playbook which provides ESA structures, workflows, engagements, services, activities, and guidance needed to enhance the VA’s IT security posture. The ESA Organizational Playbook encompasses how ESA performs its work products, the methodology and prescribed operating procedures. It includes the eight main elements that have been identified to solve for within the design structure; 1. organizing principles, 2. framing, 3. overall size and team size, 4. layers and span of control, 5. reporting structure for roles and competencies also solve for 6. team, 7. individual, and 8. cross functional. The workflows and diagrams in the ESA Organizational Playbook are to depict interactions with stakeholders (boards, processes, organizations, higher level directives, etc.), how progress is measured and how success is defined. The overarching goal is to integrate ESA workflows into the Process Access Library (PAL) and transition from PAL to ServiceNow process. Working groups may need to be chartered and stood up to provide the governance structure to accomplish this work as well as work in Section 5.3 (Reference 5.1 Project Management).

The Contractor shall ensure the ESA Framework (ESAF) is updated to remain consistent with and supports the NIST Cybersecurity Framework. As cybersecurity considerations are incorporated, that are to be tied back to the ESA and Cybersecurity Frameworks, the Contractor shall ensure there is a feedback loop created using the results from the risk analysis and Enterprise Security Risk Assessment Model to improve the standards and requirements. The Contractor shall leverage the various design patterns, frameworks, and threat models to determine where efficiencies can be achieved through consolidation around consistent approaches and/or standards to address cybersecurity risks, effective templates for ESA security enabling products (understanding that there may be a need for some portions that can be nuanced for unique aspects). The Contractor shall identify, analyze, facilitate, and incorporate mappings to cybersecurity processes, policies, and standards to create architecture reference models, architecture flows and diagrams by using the selected VA Security Architecture tool to the fullest extent possible. When warranted, the Contractor shall develop working groups and project Charters that scope the purpose and objectives of the working group.