PWS RTLS EM Sustainment.docx

VA NEW ENGLAND HEALTHCARE SYSTEM

VA NEW ENGLAND HEALTHCARE SYSTEM

Performance Work Statement Environmental Monitoring Real Time Location System (RTLS) Maintenance and Sustainment

Veterans Integrated Service Network (VISN) 1 VA New England HealthCare System

Contents

Background The mission of the Department of Veterans Affairs (VA), Veterans Health Administration (VHA) is to provide benefits and services to Veterans of the United States. In meeting these goals, VA strives to provide high quality, effective, and efficient services to those responsible for providing care to the Veterans at the point-of-care as well as throughout all the points of the Veterans’ health care in an effective, timely and compassionate manner.

Veterans Integrated Services Network (VISN) 1 is responsible for providing health care to Veterans in the New England area. The eight (8) Health Care Systems within VISN 1 are comprised of 11 different medical campuses and Community Based Outreach Clinics (CBOCs) that work together to provide efficient, accessible health care to Veterans in their areas.

VISN 1 implemented a Real Time Location System (RTLS) Environmental Monitoring Solution for temperature and humidity monitoring of various items including – blood products, pharmaceuticals and vaccines, food, sterile supplies, and more that needs compliance monitoring. The support services requested are necessary to make sure the application and hardware are maintained fully functional since this is a critical 24/7 system.

Objective This document highlights the requirements, technical specifications, and services being requested by the Department of Veterans Affairs (VA) medical centers listed below for consideration towards purchase of maintenance and support services.

· VA Maine Healthcare System (1 VA Center Augusta, ME 04330)

· White River Junction VA Medical Center (215 North Main Street White River Junction, VT 05009)

· Bedford VA Medical Center (200 Springs Road Bedford, MA 01730)

· VA Boston Healthcare System

· Jamaica Plain Campus (150 South Huntington Ave Jamaica Plain, MA 01230)

· West Roxbury Campus (1400 VFW Parkway West Roxbury, MA 02132)

· Brockton Campus (940 Belmont Street Brockton, MA 02301)

· Manchester VA Medical Center (718 Smyth Road Manchester, NH 03104)

· Providence VA Medical Center (830 Chalkstone Ave Providence, RI 02908)

· VA Connecticut Healthcare System

· West Haven Campus (950 Campbell Ave West Haven, CT 06516)

· Newington Campus (555 Willard Ave Newington, CT 06111)

· VA Central Western Massachusetts (421 North Main Street Leeds, MA 01053)

Applicable documents In the performance of the tasks associated with this Statement of Work, the Contractor shall comply with the following:

1. 44 U.S.C. § 3541-3549, “Federal Information Security Management Act (FISMA) of 2002”

2. “Federal Information Security Modernization Act of 2014”

3. Federal Information Processing Standards (FIPS) Publication 140-2, “Security Requirements For Cryptographic Modules”

4. FIPS Pub 199. Standards for Security Categorization of Federal Information and Information Systems, February 2004

5. FIPS Pub 200, Minimum Security Requirements for Federal Information and Information Systems, March 2016

6. FIPS Pub 201-2, “Personal Identity Verification of Federal Employees and Contractors,” August 2013

7. 10 U.S.C. § 2224, "Defense Information Assurance Program"

8. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

9. Public Law 109-461, Veterans Benefits, Health Care, and Information Technology Act of 2006, Title IX, Information Security Matters

10. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”

11. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, http://www.va.gov/vapubs/

12. VA Handbook 0710, Personnel Security and Suitability Security Program, May 2, 2016, http://www.va.gov/vapubs

13. VA Directive and Handbook 6102, “Internet/Intranet Services,” July 15, 2008

14. 36 C.F.R. Part 1194 “Electronic and Information Technology Accessibility Standards,” July 1, 2003

15. Office of Management and Budget (OMB) Circular A-130, “Managing Federal Information as a Strategic Resource,” July 28, 2016

16. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed Services (CHAMPUS)”

17. An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule, October 2008

18. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended by the Workforce Investment Act of 1998 (P.L. 105-220), August 7, 1998

19. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

20. VA Directive 6500, “Managing Information Security Risk: VA Information Security Program,” September 20, 2012

21. VA Handbook 6500, “Risk Management Framework for VA Information Systems – Tier 3: VA Information Security Program,” March 10, 2015

22. VA Handbook 6500.1, “Electronic Media Sanitization,” November 03, 2008

23. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI)”, July 28, 2016

24. VA Handbook 6500.3, “Assessment, Authorization, And Continuous Monitoring Of VA Information Systems,” February 3, 2014

25. VA Handbook 6500.5, “Incorporating Security and Privacy in System Development Lifecycle”, March 22, 2010

26. VA Handbook 6500.6, “Contract Security,” March 12, 2010

27. VA Handbook 6500.8, “Information System Contingency Planning”, April 6, 2011

28. OI&T Process Asset Library (PAL), https://www.va.gov/process/ . Reference Process Maps at https://www.va.gov/process/maps.asp and Artifact templates at https://www.va.gov/process/artifacts.asp

29. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

30. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014

31. VA Handbook 6508.1, “Procedures for Privacy Threshold Analysis and Privacy Impact Assessment,” July 30, 2015

32. VA Handbook 6510, “VA Identity and Access Management”, January 15, 2016

33. VA Directive 6300, Records and Information Management, February 26, 2009

34. VA Handbook, 6300.1, Records Management Procedures, March 24, 2010

35. NIST SP 800-37, Guide for Applying the Risk Management Framework to Federal Information Systems: a Security Life Cycle Approach, June 10, 2014

36. NIST SP 800-53 Rev. 4, Security and Privacy Controls for Federal Information Systems and Organizations, January 22, 2015

37. OMB Memorandum, “Transition to IPv6”, September 28, 2010

38. VA Directive 0735, Homeland Security Presidential Directive 12 (HSPD-12) Program, October 26, 2015

39. VA Handbook 0735, Homeland Security Presidential Directive 12 (HSPD-12) Program, March 24, 2014

40. OMB Memorandum M-06-18, Acquisition of Products and Services for Implementation of HSPD-12, June 30, 2006

41. OMB Memorandum 04-04, E-Authentication Guidance for Federal Agencies, December 16, 2003

42. OMB Memorandum 05-24, Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors, August 5, 2005

43. OMB memorandum M-11-11, “Continued Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors, February 3, 2011

44. OMB Memorandum, Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation, May 23, 2008

45. Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance, December 2, 2011

46. NIST SP 800-116, A Recommendation for the Use of Personal Identity Verification (PIV) Credentials in Physical Access Control Systems, November 20, 2008

47. OMB Memorandum M-07-16, Safeguarding Against and Responding to the Breach of Personally Identifiable Information, May 22, 2007

48. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, Digital Identity Guidelines, June 2017

49. NIST SP 800-157, Guidelines for Derived PIV Credentials, December 2014

50. NIST SP 800-164, Guidelines on Hardware-Rooted Security in Mobile Devices (Draft), October 2012

51. Draft National Institute of Standards and Technology Interagency Report (NISTIR) 7981 Mobile, PIV, and Authentication, March 2014

52. VA Memorandum, VAIQ #7100147, Continued Implementation of Homeland Security Presidential Directive 12 (HSPD-12), April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

53. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

54. VA Memorandum “Mandate to meet PIV Requirements for New and Existing Systems” (VAIQ# 7712300), June 30, 2015, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4846

55. Trusted Internet Connections (TIC) Reference Architecture Document, Version 2.0, Federal Interagency Technical Reference Architectures, Department of Homeland Security, October 1, 2013, https://s3.amazonaws.com/sitesusa/wp-content/uploads/sites/482/2015/04/TIC_Ref_Arch_v2-0_2013.pdf

56. OMB Memorandum M-08-05, “Implementation of Trusted Internet Connections (TIC), November 20, 2007

57. OMB Memorandum M-08-23, Securing the Federal Government’s Domain Name System Infrastructure, August 22, 2008

58. VA Memorandum, VAIQ #7497987, Compliance – Electronic Product Environmental Assessment Tool (EPEAT) – IT Electronic Equipment, August 11, 2014 (reference Document Libraries, EPEAT/Green Purchasing Section, https://www.voa.va.gov/documentlistpublic.aspx?NodeID=552)

59. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (Public Law 110–140), December 19, 2007

60. Section 104 of the Energy Policy Act of 2005, (Public Law 109–58), August 8, 2005

61. Executive Order 13693, “Planning for Federal Sustainability in the Next Decade”, dated March 19, 2015

62. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 2, 2001

63. VA Directive 0058, “VA Green Purchasing Program”, July 19, 2013

64. VA Handbook 0058, “VA Green Purchasing Program”, July 19, 2013

65. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote Access”, January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

66. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

67. VA Memorandum, “Implementation of Federal Personal Identity Verification (PIV) Credentials for Federal and Contractor Access to VA IT Systems”, (VAIQ# 7614373) July 9, 2015, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

68. VA Memorandum “Mandatory Use of PIV Multifactor Authentication to VA Information System” (VAIQ# 7613595), June 30, 2015, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

69. VA Memorandum “Mandatory Use of PIV Multifactor Authentication for Users with Elevated Privileges” (VAIQ# 7613597), June 30, 2015; https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

70. “Veteran Focused Integration Process (VIP) Guide 2.0”, May 2017, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

71. “VIP Release Process Guide”, Version 1.4, May 2016, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4411

72. “POLARIS User Guide”, Version 1.2, February 2016, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4412

73. VA Memorandum “Use of Personal Email (VAIQ #7581492)”, April 24, 2015, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

74. VA Memorandum “Updated VA Information Security Rules of Behavior (VAIQ #7823189)”, September, 15, 2017, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

75. National Fire Protection Association (NFPA) 70 – National Electric Code

76. National Fire Protection Association (NFPA) 99 – Standard for Healthcare Facilities

77. VA Handbook 6550, “Pre-procurement Assessment for Medical Devices “, (https://www1.va.gov/vapubs/index.cfm)

78. National Institute Standards and Technology (NIST) Special Publications

79. An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule, March 2005

80. VA Handbook 7002, Logistics Management Procedures, July 10, 2009 (https://www1.va.gov/vapubs/index.cfm)

81. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended by the Workforce Investment Act of 1998 (P.L. 105-220), August 7, 1998

82. Veterans Health Administration Records control Schedule (RCS 10-1). Nov 2017 (https://www.va.gov/vhapublications/rcs10/rcs10-1.pdf)

83. Veterans Health Administration Directive 1116 – Sterile Processing Services. https://www.va.gov/vhapublications/publications.cfm?Pub=1

84. College of American Pathologists Accreditation Program.

https://www.cap.org/laboratory-improvement/accreditation

85. Attachment A. VA DIRECTIVE 6550 PRE_PROCURMENT ASSESSMENT

86. Attachment B. Estimated Order Quantities

87. Attachment C. Facility Access Point Design Report

Performance Details Performance Period The Period of Performance (PoP) for this contract is 12 months plus three option years. Any work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO).

There are eleven (11) Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, five are set by date:

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

Place of Performance The scope of this requirement includes RTLS components located at the main VAMC listed in section 2.0 as well as their associated Community Based Oupatient Centers (CBOCs) and VISN level servers located at the Austin Information Technology Center. Efforts under this requirement will be performed both on site at the VAMC facilities and remotely.

Travel The Government anticipates travel under this effort to perform the tasks associated with the effort, as well as to attend program-related meetings or conferences throughout the PoP. Include all estimated travel costs in your firm-fixed price line items. These costs will not be directly reimbursed by the Government.

The total estimated number of trips in support of the tasks associated for this effort is 2 for each of the 11 medical centers. Anticipated locations and durations include the following:

Scope of Work The Contractor shall provide software and hardware support and maintenance services for the CenTrak Environmental Monitoring RTLS system by CenTrak as deployed to the VISN 1 sites listed in section 2.0.

The coverage includes:

Software Maintenance:

· Annual Software License and version updates, patches and bug fixes

· CenTrak Connect Stream - EM Driver to Prism

· CenTrak Connect Pulse Connector

· Infrastructure to support EM backhaul: Stars, Timing Stars, etc.

· EM Sensors: Temperature, Humidity, Differential Air Pressure

Hardware Maintenance:

· Extended Hardware Warranty: Infrastructure and Sensors

Support Services - Software and Hardware

· Pulse remote monitoring for EM system health and performance

· Updating Pulse for Sensor and Star additions or modifications

· Level 1, 2 and 3 support for onsite resources (VA or partner), e.g. Troubleshooting, performance enhancement, backhaul infrastructure adjustments/recommendations, etc.

· Technical Assistance Center (TAC), Level 3, 9 hr. X 5 day, Eastern Time (phone, email)

· Warnings, Bulletins, Alerts

· Technical Tips and FAQs

· CenTrak Knowledge Center Access

· Engineering Assistance (via TAC)

The Contractor shall work to resolve issues identified by the COR or a VA Clinical Engineering POC from one of the medical centers. Local staff from Clinical engineering will perform initial review of all issues and if unable to resolve, contact the contractor who shall work with Centrak to resolve the issue. The source of these issues may be Tier level 1, 2, or 3 trouble tickets and will follow, at a minimum, the below response times. The Contractor shall provide addition response plan information as needed if it deviates from the below.

• Complete loss of functionality/system

• Functionality severely degraded

• Loss of those features or functionality that may compromise: i) medical decisions, (ii) delivery of patient care, (iii) disclosure of confidential information

• Acknowledgement within 30 minutes upon receipt/notification

• Immediate action is taken to resolve reported incident

• Communication plan is put in place to keep Customer informed with updates at hourly intervals.

• Issue is worked on until it is resolved regardless of time of day or day of the week.

• A plan of action is put in place that defines the response time

• Communication plan is put in place

• Issue is addressed during business hours 8am – 4pm EST, Monday through Friday.

• Appropriate resources are assigned within 48 hours, and issue resolved within 1 work week.

• Issue is addressed during business hours 8am – 4pm EST, Monday through Friday.

In addition, the contractor shall provide NIST recalibration hardware and services for the temperature and humidity sensors and probes across VISN 1. This is to be done for every sensor/probe as they come due every 2 years as indicated in Centrak Pulse. VA will require the NIST recalibration kits and onsite services to recalibrate or swap sensors as applicable, and then certificates of calibration provided to the VA electronically via email as well as uploaded to Centrak Pulse within a week after completion of onsite work. The Contractor shall provide a plan for NIST Recalibration services to be received and shall make sure that any onsite work is completed by VA PIV Badged individuals.

Order Type This effort shall be proposed an Indefinite Delivery Indefinite Quantity (IDIQ) Contract.

Remote Access Requirements The vendor shall have remote access (VPN) to the VISN 1 Facilities listed in section 2.0. Remote access can be accomplished through Citrix Access Gateway (CAG), Site-to-Site Virtual Private Network (VPN), and RESCUE VPN, the vendor is responsible for managing all CAG accounts including but not limited to:

· Providing an updated list of all contractor employees who have accessed to through CAG every 12 months.

· Pay for the cost of background clearance for new contractor employee

· Ensure all contract employees have up to date TMS training as required.

Based on the Government assessment of remote access solutions and the requirements of this order, the Government estimates that no GFE will be required. Currently all possible contract employees for this work are sponsored through other RTLS contracts with the CORs having this understanding of the work.

General Requirements Enterprise and IT Framework One-VA Technical Reference Model The Contractor shall support the VA enterprise management framework. In aPIVciation with the framework, the Contractor shall comply with OI&T Technical Reference Model (One-VA TRM). One-VA TRM is one component within the overall Enterprise Architecture (EA) that establishes a common vocabulary and structure for describing the information technology used to develop, operate, and maintain enterprise applications. One-VA TRM includes the Standards Profile and Product List that collectively serves as a VA technology roadmap. Architecture, Strategy, and Design (ASD) has overall responsibility for the One-VA TRM.

Federal Identity, Credential, and Access Management (FICAM) The Contractor shall ensure Commercial Off-The-Shelf (COTS) product(s), software configuration and customization, and/or new software are Personal Identity Verification (PIV) card-enabled by accepting HSPD-12 PIV credentials using VA Enterprise Technical Architecture (ETA), http://www.ea.oit.va.gov/VA_EA/VAEA_TechnicalArchitecture.asp, and VA Identity and Access Management (IAM) approved enterprise design and integration patterns, http://www.techstrategies.oit.va.gov/enterprise_dp.asp. The Contractor shall ensure all Contractor delivered applications and systems comply with the VA Identity, Credential, and Access Management policies and guidelines set forth in the VA Handbook 6510 and align with the Federal Identity, Credential, and Access Management Roadmap and Implementation Guidance v2.0.

The Contractor shall ensure all Contractor delivered applications and systems provide user authentication services compliant with the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-63-3, VA Handbook 6500 Appendix F, “VA System Security Controls”, and VA IAM enterprise requirements for direct, assertion based authentication, and/or trust based authentication, as determined by the design and integration patterns. Direct authentication at a minimum must include Public Key Infrastructure (PKI) based authentication supportive of PIV card and/or Common Access Card (CAC), as determined by the business need.

The Contractor shall ensure all Contractor delivered applications and systems conform to the specific Identity and Access Management PIV requirements set forth in the Office of Management and Budget (OMB) Memoranda M-04-04, M-05-24, M-11-11, and NIST Federal Information Processing Standard (FIPS) 201-2. OMB Memoranda M-04-04, M-05-24, and M-11-11 can be found at: https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/omb/memoranda/fy04/m04-04.pdf, https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/omb/memoranda/fy2005/m05-24.pdf, and https://obamawhitehouse.archives.gov/sites/default/files/omb/memoranda/2011/m11-11.pdf respectively. Contractor delivered applications and systems shall be on the FIPS 201-2 Approved Product List (APL). If the Contractor delivered application and system is not on the APL, the Contractor shall be responsible for taking the application and system through the FIPS 201 Evaluation Program.

The Contractor shall ensure all Contractor delivered applications and systems support:

1. Automated provisioning and are able to use enterprise provisioning service.

2. Interfacing with VA’s Master Veteran Index (MVI) to provision identity attributes, if the solution relies on VA user identities. MVI is the authoritative source for VA user identity data.

3. The VA defined unique identity (Secure Identifier [SEC ID] / Integrated Control Number [ICN]).

4. Multiple authenticators for a given identity and authenticators at every Authenticator Assurance Level (AAL) appropriate for the solution.

5. Identity proofing for each Identity Assurance Level (IAL) appropriate for the solution.

6. Federation for each Federation Assurance Level (FAL) appropriate for the solution, if applicable.

7. Two-factor authentication (2FA) through an applicable design pattern as outlined in VA Enterprise Design Patterns.

8. A Security Assertion Markup Language (SAML) implementation if the solution relies on assertion based authentication. Additional assertion implementations, besides the required SAML assertion, may be provided as long as they are compliant with NIST SP 800-63-3 guidelines.

9. Authentication/account binding based on trusted Hypertext Transfer Protocol (HTTP) headers if the solution relies on Trust based authentication.

10. Role Based Access Control.

11. Auditing and reporting capabilities.

12. Compliance with VAIQ# 7712300 Mandate to meet PIV requirements for new and existing systems. https://www.voa.va.gov/DocumentView.aspx?DocumentID=4846

The required Assurance Levels for this specific effort are Identity Assurance Level 3, Authenticator Assurance Level 3, and Federation Assurance Level 3.

Internet Protocol Version 6 (IPV6) The Contractor solution shall support the latest Internet Protocol Version 6 (IPv6) based upon the directives issued by the Office of Management and Budget (OMB) on August 2, 2005 (https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/omb/memoranda/fy2005/m05-22.pdf) and September 28, 2010 (https://cio.gov/wp-content/uploads/downloads/2012/09/Transition-to-IPv6.pdf). IPv6 technology, in accordance with the USGv6 Profile, NIST Special Publication (SP) 500-267 (https://www.nist.gov/programs-projects/usgv6-technical-basis-next-generation-internet), the Technical Infrastructure for USGv6 Adoption (http://www-x.antd.nist.gov/usgv6/index.html), and the NIST SP 800 series applicable compliance (http://csrc.nist.gov/publications/PubsSPs.html) shall be included in all IT infrastructures, application designs, application development, operational systems and sub-systems, and their integration. In addition to the above requirements, all devices shall support native IPv6 and/or dual stack (IPv6 / IPv4) connectivity without additional memory or other resources being provided by the Government, so that they can function in a mixed environment. All public/external facing servers and services (e.g. web, email, DNS, ISP services, etc.) shall support native IPv6 and/or dual stack (IPv6/ IPv4) users and all internal infrastructure and applications shall communicate using native IPv6 and/or dual stack (IPv6/ IPv4) operations. Guidance and support of improved methodologies which ensure interoperability with legacy protocol and services in dual stack solutions, in addition to OMB/VA memoranda, can be found at: https://www.voa.va.gov/documentlistpublic.aspx?NodeID=282.

Trusted Internet Connection (TIC) The Contractor solution shall meet the requirements outlined in Office of Management and Budget Memorandum M08-05 mandating Trusted Internet Connections (TIC) (https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/omb/memoranda/fy2008/m08-05.pdf), M08-23 mandating Domain Name System Security (NSSEC) (https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/omb/memoranda/fy2008/m08-23.pdf), and shall comply with the Trusted Internet Connections (TIC) Reference Architecture Document, Version 2.0 https://s3.amazonaws.com/sitesusa/wp-content/uploads/sites/482/2015/04/TIC_Ref_Arch_v2-0_2013.pdf.

Standard Computer Configuration The Contractor IT end user solution that is developed for use on standard VA computers shall be compatible with and be supported on the standard VA operating system, currently Windows 10 (64bit) and Microsoft EDGE. The Contractor shall also ensure and certify that their solution functions as expected when used from a standard VA computer, with non-admin, standard user rights that have been configured using the United States Government Configuration Baseline (USGCB) and Defense Information Systems Agency (DISA) Secure Technical Implementation Guide (STIG) specific to the particular client operating system being used.

Security and Privacy Requirements

Position/Task Risk Designation Level(s) In accordance with VA Handbook 0710, Personnel Security and Suitability Program, the position sensitivity, and the level of background investigation commensurate with the required level of access for the following tasks within the PWS are:

Position Sensitivity and Background Investigation Requirements by Task

The Tasks identified above, and the resulting Position Sensitivity and Background Investigation requirements identify, in effect, the Background Investigation requirements for Contractor individuals, based upon the tasks the Contractor individual will be working. The submitted Contractor Staff Roster must indicate the required Background Investigation Level for each Contractor individual based upon the tasks the Contractor individual will be working, in accordance with their submitted proposal.

Contractor Personnel Security Requirements

Contractor Responsibilities:

1. The Contractor shall prescreen all personnel requiring access to the computer systems to ensure they maintain the appropriate Background Investigation, and are able to read, write, speak, and understand the English language.

Within 3 business days after award, the Contractor shall provide a roster of Contractor and Subcontractor employees to the COR to begin their background investigations. The Contractor Staff Roster shall contain the Contractor’s Full Name, Date of Birth, Place of Birth, individual background investigation level requirement. The Contractor shall submit full Social Security Numbers either within the Contractor Staff Roster or under separate cover to the COR. The Contractor Staff Roster shall be updated and provided to VA within 1 day of any changes in employee status, training certification completion status, Background Investigation level status, additions/removal of employees, etc. throughout the Period of Performance. The Contractor Staff Roster shall remain a historical document indicating all past information and the Contractor shall indicate in the Comment field, employees no longer supporting this contract. The preferred method to send the Contractor Staff Roster or Social Security Number is by encrypted e-mail. If unable to send encrypted e-mail, other methods which comply with FIPS 140-2 are to encrypt the file, use a secure fax, or use a traceable mail service.

1. The Contractor should coordinate with the location of the nearest VA fingerprinting office through the COR. Only electronic fingerprints are authorized. The Contractor shall bring their completed Security and Investigations Center (SIC) Fingerprint request form with them (see paragraph d.4. below) when getting fingerprints taken.

b. The Contractor shall ensure the following required forms are submitted to the COR within 5 days after contract award:

1. Optional Form 306

2. Self-Certification of Continuous Service

3. VA Form 0710

4. Completed SIC Fingerprint Request Form

The Contractor personnel shall submit all required information related to their background investigations (completion of the investigation documents (SF85, SF85P, or SF 86) utilizing the Office of Personnel Management’s (OPM) Electronic Questionnaire for Investigations Processing (e-QIP) after receiving an email notification from the Security and Investigation Center (SIC).

The Contractor employee shall certify and release the e-QIP document, print and sign the signature pages, and send them encrypted to the COR for electronic submission to the SIC. These documents shall be submitted to the COR within 3 business days of receipt of the e-QIP notification email. (Note: OPM is moving towards a “click to sign” process. If click to sign is used, the Contractor employee should notify the COR within 3 business days that documents were signed via e-QIP).

1. The Contractor shall be responsible for the actions of all personnel provided to work for VA under this contract. In the event that damages arise from work performed by Contractor provided personnel, under the auspices of this contract, the Contractor shall be responsible for all resources necessary to remedy the incident.

1. A Contractor may be granted unescorted access to VA facilities and/or access to VA Information Technology resources (network and/or protected data) with a favorably adjudicated Special Agreement Check (SAC), completed training delineated in VA Handbook 6500.6 (Appendix C, Section 9), signed “Contractor Rules of Behavior”, and with a valid, operational PIV credential for PIV-only logical access to VA’s network. A PIV card credential can be issued once your SAC has been favorably adjudicated and your background investigation has been scheduled by OPM. However, the Contractor will be responsible for the actions of the Contractor personnel they provide to perform work for VA. The investigative history for Contractor personnel working under this contract must be maintained in the database of OPM.

1. The Contractor shall follow all Government rules and regulations regarding information security to prevent disclosure of sensitive information to unauthorized individuals or organizations, and shall adhere to all VA Privacy & Security, the Privacy Act and HIPAA requirements.

1. The Contractor, when notified of an unfavorably adjudicated background investigation on a Contractor employee as determined by the Government, shall withdraw the employee from consideration in working under the contract.

Failure to comply with the Contractor personnel security investigative requirements may result in loss of physical and/or logical access to VA facilities and systems by Contractor and Subcontractor employees and/or termination of the contract for default.

Identity Credential Holders must follow all HSPD-12 policies and procedures as well as use and protect their assigned identity credentials in accordance with VA policies and procedures, always displaying their badges, and returning the identity credentials upon termination of their relationship with VA.

Records management requirements

a. Citations to pertinent laws, codes and regulations such as 44 U.S.C chapters 21, 29, 31 and 33; Freedom of Information Act (5 U.S.C. 552); Privacy Act (5 U.S.C. 552a); 36 CFR Part 1222 and Part 1228.

b. Contractor shall treat all deliverables under the contract as the property of the U.S. Government for which the Government Agency shall have unlimited rights to use, dispose of, or disclose such data contained therein as it determines to be in the public interest.

c. Contractor shall not create or maintain any records that are not specifically tied to or authorized by the contract using Government IT equipment and/or Government records.

d. Contractor shall not retain, use, sell, or disseminate copies of any deliverable that contains information covered by the Privacy Act of 1974 or that which is generally protected by the Freedom of Information Act.

e. Contractor shall not create or maintain any records containing any Government Agency records that are not specifically tied to or authorized by the contract.

f. The Government Agency owns the rights to all data/records produced as part of this contract.

g. The Government Agency owns the rights to all electronic information (electronic data, electronic information systems, electronic databases, etc.) and all supporting documentation created as part of this contract. Contractor must deliver sufficient technical documentation with all data deliverables to permit the agency to use the data.

h. Contractor agrees to comply with Federal and Agency records management policies, including those policies associated with the safeguarding of records covered by the Privacy Act of 1974. These policies include the preservation of all records created or received regardless of format [paper, electronic, etc.] or mode of transmission [e-mail, fax, etc.] or state of completion [draft, final, etc.].

i. No disposition of documents will be allowed without the prior written consent of the Contracting Officer. The Agency and its contractors are responsible for preventing the alienation or unauthorized destruction of records, including all forms of mutilation. Willful and unlawful destruction, damage or alienation of Federal records is subject to the fines and penalties imposed by 18 U.S.C. 2701. Records may not be removed from the legal custody of the Agency or destroyed without regard to the provisions of the agency records schedules.

j. Contractor is required to obtain the Contracting Officer's approval prior to engaging in any contractual relationship (sub-contractor) in support of this contract requiring the disclosure of information, documentary material and/or records generated under, or relating to, this contract. The Contractor (and any sub-contractor) is required to abide by Government and Agency guidance for protecting sensitive and proprietary information.

Performance Metrics The table below defines the Performance Standards and Acceptable Levels of Performance associated with this effort.

2. Efficient and effective in meeting requirements

3. Meets technical needs and mission requirements

4. Meets response times and plan in requirements

5. Provides quality services/products Satisfactory or higher

2. Products completed, reviewed, delivered in accordance with the established schedule

3. Notifies customer in advance of potential problems Satisfactory or higher

2. Personnel possess necessary knowledge, skills and abilities to perform tasks Satisfactory or higher

The COR will utilize a Quality Assurance Surveillance Plan (QASP) throughout the life of the contract to ensure that the Contractor is performing the services required by this SOW in an acceptable level of performance. The Government reserves the right to alter or change the surveillance methods in the QASP at its own discretion.

Evaluation Criteria Offerors will be evaluated on the following factors:

· General Support Offering (Functional Capabilities and Technical Performance as Outlined Above)

· Anticipated Reliability and Serviceability

· Past Performance

· Response Plan for Issues

· NIST Recalibration Plan

· Price

It is understood that every Offeror’s product(s) may differ from the specifications outlined in this document. As such, Offerors are encouraged to propose these variances. It is required that each Offeror clearly identify how they meet the specifications listed above. It is also required that, whenever a variance from these specifications occurs, the proposed item meets or exceeds the specified characteristics or level of performance. The Offeror shall also identify each product line item that differs from the specifications and list its associated cost.

Further Consideration Offeror’s are provided the opportunity to obtain further details from the VA New England Healthcare System to better tailor the product quote(s). All requests for information derived from any Offeror will be shared with each Contracted vendor per the standardized contracting rule set.

Points of Contact VISN 1 Program Manager & Contracting Officer’s Representative:

950 Campbell Ave West Haven, CT 06516

Contracting Officer:

Name:

Address:

Voice:

Email:

image1.png