PWS RTLS Sustainment - 2025.pdf

VA NEW ENGLAND HEALTHCARE SYSTEM

Performance Work Statement Real Time Location System (RTLS)

February 2025 Veterans Integrated Service Network (VISN) 1

VA New England HealthCare System Planning UID:

PWS Version 1.0

Contents Background

Objective

Applicable documents

Performance Details

4.1 Performance Period

4.2 Place of Performance

4.3 Travel

Scope of Work

5.1 Order Type

System Architechture Overview

6.1 RTLS Sustainment Effort

6.2 Technical Expertise

Specific Tasks and Deliverables

7.1 Project Management

7.1.1 Reporting Requirements

7.1.2 Technical Kickoff Meeting

7.1.3 Weekly Status Meeting

7.2 Preventative Maintenance

7.2.1 Software Updates, Upgrades, and Administration

7.2.2 Hardware Updates and Upgrades

7.3 Corrective Maintenance

7.4 Adaptive Maintenance

7.5 Customer Support

Government Furnished Equipment

General Requirements

9.1 Enterprise and IT Framework

9.1.1 One-VA Technical Reference Model

9.1.2 Federal Identity, Credential, and Access Management (FICAM)

9.1.3 Internet Protocol Version 6 (IPV6)

9.1.4 Trusted Internet Connection (TIC)

9.1.5 Standard Computer Configuration

9.2 Security and Privacy Requirements

9.2.1 Position/Task Risk Designation Level(s)

9.2.2 Contractor Personnel Security Requirements

9.3 Method and Distribution of Deliverables

Records management requirements

Performance Metrics

Evaluation Criteria

Further Consideration

Government Furnished Information (GFI)

Points of Contact

Schedule for Deliverables

Attachment A – VA DIRECTIVE 6550 PRE_PROCURMENT ASSESSMENT

BACKGROUND

The mission of the Department of Veterans Affairs (VA), Veterans Health Administration (VHA) is to provide benefits and services to Veterans of the United States. In meeting these goals, VA strives to provide high quality, effective, and efficient services to those responsible for providing care to the Veterans at the point-of-care as well as throughout all the points of the Veterans’ health care in an effective, timely, and compassionate manner.

Veterans Integrated Services Network (VISN) 1 is responsible for providing health care to Veterans in the New England area. The eight (8) Health Care Systems within VISN 1 are comprised of 11 different medical campuses and Community Based Outreach Clinics (CBOCs) that work together to provide efficient and accessible health care to Veterans in their areas.

VISN 1 implemented a Real Time Location System (RTLS) under the National RTLS Contract. Hardware and multiple software applications are integrated to the core RTLS infrastructure to achieve benefits in locating assets and improving workflow. The use of Infor (Asset Tracking Application) and CenTrak (Location Services Technology) are essential to the Government’s requirements, and these systems require RTLS Sustainment Services. The Services are necessary to make RTLS application configuration changes due to minor construction projects, such as a floor or wing renovation, or major construction projects, such as a new building or floor. In addition, RTLS sustainment, such as server system administration, is required to ensure that the RTLS enterprise solution and servers deployed at the VA Medical Centers (VAMCs) in VISN 1 conform to VA policies.

OBJECTIVE

This document highlights the requirements, technical specifications, and services being requested by the Department of Veterans Affairs (VA) medical centers listed below for consideration towards purchase of a RTLS Sustainment contract. Offerors under this proposal shall provide all labor, material, parts, tools, software, project management, services, and equipment necessary to furnish, install, and test a fully functional RTLS system. The enterprise solution will operate on the VA IT Network using the existing Infor and CenTrak RTLS platforms at each of the following medical centers. The contractor shall also provide system user and technical training when needed for new installs.

• VA Maine Healthcare System (1 VA Center Augusta, ME 04330)

• White River Junction VA Medical Center (215 North Main Street White River Junction, VT 05009)

• Bedford VA Medical Center (200 Springs Road Bedford, MA 01730)

• VA Boston Healthcare System o Jamaica Plain Campus (150 South Huntington Ave Jamaica Plain, MA 01230) o West Roxbury Campus (1400 VFW Parkway West Roxbury, MA 02132) o Brockton Campus (940 Belmont Street Brockton, MA 02301)

• Manchester VA Medical Center (718 Smyth Road Manchester, NH 03104)

• Providence VA Medical Center (830 Chalkstone Ave Providence, RI 02908)

• VA Connecticut Healthcare System o West Haven Campus (950 Campbell Ave West Haven, CT 06516) o Newington Campus (555 Willard Ave Newington, CT 06111)

• VA Central Western Massachusetts (421 North Main Street Leeds, MA 01053)

APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Statement of Work, the Contractor shall comply with the following:

1. 44 U.S.C. § 3541-3549, “Federal Information Security Management Act (FISMA) of 2002”

2. “Federal Information Security Modernization Act of 2014”

3. Federal Information Processing Standards (FIPS) Publication 140-2, “Security Requirements

For Cryptographic Modules”

4. FIPS Pub 199. Standards for Security Categorization of Federal Information and Information

Systems, February 2004

5. FIPS Pub 200, Minimum Security Requirements for Federal Information and Information

Systems, March 2016

6. FIPS Pub 201-2, “Personal Identity Verification of Federal Employees and Contractors,”

August 2013

7. 10 U.S.C. § 2224, "Defense Information Assurance Program"

8. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

9. Public Law 109-461, Veterans Benefits, Health Care, and Information Technology Act of

2006, Title IX, Information Security Matters

10. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”

11. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, http://www.va.gov/vapubs/

12. VA Handbook 0710, Personnel Security and Suitability Security Program, May 2, 2016, http://www.va.gov/vapubs

13. VA Directive and Handbook 6102, “Internet/Intranet Services,” July 15, 2008

14. 36 C.F.R. Part 1194 “Electronic and Information Technology Accessibility Standards,” July 1,

15. Office of Management and Budget (OMB) Circular A-130, “Managing Federal Information as a Strategic Resource,” July 28, 2016

16. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed Services

(CHAMPUS)”

17. An Introductory Resource Guide for Implementing the Health Insurance Portability and

Accountability Act (HIPAA) Security Rule, October 2008

18. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended by the

Workforce Investment Act of 1998 (P.L. 105-220), August 7, 1998

19. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

20. VA Directive 6500, “Managing Information Security Risk: VA Information Security Program,”

September 20, 2012

21. VA Handbook 6500, “Risk Management Framework for VA Information Systems – Tier 3: VA

Information Security Program,” March 10, 2015

22. VA Handbook 6500.1, “Electronic Media Sanitization,” November 03, 2008

23. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information

(SPI)”, July 28, 2016

24. VA Handbook 6500.3, “Assessment, Authorization, And Continuous Monitoring Of VA

Information Systems,” February 3, 2014

25. VA Handbook 6500.5, “Incorporating Security and Privacy in System Development

Lifecycle”, March 22, 2010

26. VA Handbook 6500.6, “Contract Security,” March 12, 2010

27. VA Handbook 6500.8, “Information System Contingency Planning”, April 6, 2011 http://www.va.gov/vapubs/ http://www.va.gov/vapubs http://www.va.gov/vapubs

28. OI&T Process Asset Library (PAL), https://www.va.gov/process/ . Reference Process Maps at https://www.va.gov/process/maps.asp and Artifact templates at https://www.va.gov/process/artifacts.asp

29. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

30. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014

31. VA Handbook 6508.1, “Procedures for Privacy Threshold Analysis and Privacy Impact Assessment,” July 30, 2015

32. VA Handbook 6510, “VA Identity and Access Management”, January 15, 2016

33. VA Directive 6300, Records and Information Management, February 26, 2009

34. VA Handbook, 6300.1, Records Management Procedures, March 24, 2010

35. NIST SP 800-37, Guide for Applying the Risk Management Framework to Federal

Information Systems: a Security Life Cycle Approach, June 10, 2014

36. NIST SP 800-53 Rev. 4, Security and Privacy Controls for Federal Information Systems and

Organizations, January 22, 2015

37. OMB Memorandum, “Transition to IPv6”, September 28, 2010

38. VA Directive 0735, Homeland Security Presidential Directive 12 (HSPD-12) Program, October 26, 2015

39. VA Handbook 0735, Homeland Security Presidential Directive 12 (HSPD-12) Program, March 24, 2014

40. OMB Memorandum M-06-18, Acquisition of Products and Services for Implementation of

HSPD-12, June 30, 2006

41. OMB Memorandum 04-04, E-Authentication Guidance for Federal Agencies, December 16,

42. OMB Memorandum 05-24, Implementation of Homeland Security Presidential Directive

(HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors, August 5, 2005

43. OMB memorandum M-11-11, “Continued Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors, February 3, 2011

44. OMB Memorandum, Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation, May 23, 2008

45. Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance, December 2, 2011

46. NIST SP 800-116, A Recommendation for the Use of Personal Identity Verification (PIV) Credentials in Physical Access Control Systems, November 20, 2008

47. OMB Memorandum M-07-16, Safeguarding Against and Responding to the Breach of Personally Identifiable Information, May 22, 2007

48. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, Digital Identity Guidelines, June 2017

49. NIST SP 800-157, Guidelines for Derived PIV Credentials, December 2014

50. NIST SP 800-164, Guidelines on Hardware-Rooted Security in Mobile Devices (Draft), October 2012

51. Draft National Institute of Standards and Technology Interagency Report (NISTIR) 7981

Mobile, PIV, and Authentication, March 2014

52. VA Memorandum, VAIQ #7100147, Continued Implementation of Homeland Security

Presidential Directive 12 (HSPD-12), April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514) https://www.va.gov/process/ https://www.va.gov/process/maps.asp https://www.va.gov/process/artifacts.asp https://www.va.gov/trm/TRMHomePage.aspx https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514

53. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

54. VA Memorandum “Mandate to meet PIV Requirements for New and Existing Systems” (VAIQ# 7712300), June 30, 2015, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4846

55. Trusted Internet Connections (TIC) Reference Architecture Document, Version 2.0, Federal Interagency Technical Reference Architectures, Department of Homeland Security, October 1, 2013, https://s3.amazonaws.com/sitesusa/wp-content/uploads/sites/482/2015/04/TIC_Ref_Arch_v2-0_2013.pdf

56. OMB Memorandum M-08-05, “Implementation of Trusted Internet Connections (TIC), November 20, 2007

57. OMB Memorandum M-08-23, Securing the Federal Government’s Domain Name System Infrastructure, August 22, 2008

58. VA Memorandum, VAIQ #7497987, Compliance – Electronic Product Environmental Assessment Tool (EPEAT) – IT Electronic Equipment, August 11, 2014 (reference Document Libraries, EPEAT/Green Purchasing Section, https://www.voa.va.gov/documentlistpublic.aspx?NodeID=552)

59. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (Public Law 110–140), December 19, 2007

60. Section 104 of the Energy Policy Act of 2005, (Public Law 109–58), August 8, 2005

61. Executive Order 13693, “Planning for Federal Sustainability in the Next Decade”, dated

March 19, 2015

62. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 2, 2001

63. VA Directive 0058, “VA Green Purchasing Program”, July 19, 2013

64. VA Handbook 0058, “VA Green Purchasing Program”, July 19, 2013

65. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote Access”, January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

66. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

67. VA Memorandum, “Implementation of Federal Personal Identity Verification (PIV)

Credentials for Federal and Contractor Access to VA IT Systems”, (VAIQ# 7614373) July 9, 2015, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

68. VA Memorandum “Mandatory Use of PIV Multifactor Authentication to VA Information System” (VAIQ# 7613595), June 30, 2015, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

69. VA Memorandum “Mandatory Use of PIV Multifactor Authentication for Users with Elevated Privileges” (VAIQ# 7613597), June 30, 2015;

https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

70. “Veteran Focused Integration Process (VIP) Guide 2.0”, May 2017, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

71. “VIP Release Process Guide”, Version 1.4, May 2016, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4411

72. “POLARIS User Guide”, Version 1.2, February 2016, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4412

73. VA Memorandum “Use of Personal Email (VAIQ #7581492)”, April 24, 2015, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

74. VA Memorandum “Updated VA Information Security Rules of Behavior (VAIQ #7823189)”, September, 15, 2017, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4846 https://s3.amazonaws.com/sitesusa/wp-content/uploads/sites/482/2015/04/TIC_Ref_Arch_v2-0_2013.pdf https://s3.amazonaws.com/sitesusa/wp-content/uploads/sites/482/2015/04/TIC_Ref_Arch_v2-0_2013.pdf https://www.voa.va.gov/documentlistpublic.aspx?NodeID=552 https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4411 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4412 https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

75. National Fire Protection Association (NFPA) 70 – National Electric Code

76. National Fire Protection Association (NFPA) 99 – Standard for Healthcare Facilities

77. VA Handbook 6550, “Pre-procurement Assessment for Medical Devices “, (https://www1.va.gov/vapubs/index.cfm)

78. National Institute Standards and Technology (NIST) Special Publications

79. An Introductory Resource Guide for Implementing the Health Insurance Portability and

Accountability Act (HIPAA) Security Rule, March 2005

80. VA Handbook 7002, Logistics Management Procedures, July 10, 2009

(https://www1.va.gov/vapubs/index.cfm)

81. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended by the

Workforce Investment Act of 1998 (P.L. 105-220), August 7, 1998

82. Veterans Health Administration Records control Schedule (RCS 10-1). Nov 2017

(https://www.va.gov/vhapublications/rcs10/rcs10-1.pdf)

83. Veterans Health Administration Directive 1116 – Sterile Processing Services.

https://www.va.gov/vhapublications/publications.cfm?Pub=1

84. College of American Pathologists Accreditation Program.

https://www.cap.org/laboratory-improvement/accreditation

85. Attachment A. VA DIRECTIVE 6550 PRE_PROCURMENT ASSESSMENT

86. Attachment B. Estimated Order Quantities

87. Attachment C. Facility Access Point Design Report

PERFORMANCE DETAILS

4.1 PERFORMANCE PERIOD

The Period of Performance (PoP) for this contract is 12 months + three option years. Any work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO).

There are eleven (11) Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, five are set by date:

New Year's Day January 1 Juneteenth National Independence Day June 19 Independence Day July 4 Veterans Day November 11 Christmas Day December 25

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

Martin Luther King's Birthday Third Monday in January Washington's Birthday Third Monday in February Memorial Day Last Monday in May https://www1.va.gov/vapubs/index.cfm https://www.va.gov/vhapublications/rcs10/rcs10-1.pdf https://www.va.gov/vhapublications/publications.cfm?Pub=1 https://www.cap.org/laboratory-improvement/accreditation

Labor Day First Monday in September Columbus Day Second Monday in October Thanksgiving Fourth Thursday in November

4.2 PLACE OF PERFORMANCE

The scope of this requirement includes RTLS components located at the main VAMCs listed below as well as their associated Community Based Oupatient Centers (CBOCs) and VISN level servers located at the Austin Information Technology Center (AITC). Efforts under this Indefinite Delivery Indefinite Quantity (IDIQ) may be performed on-site as well as remotely.

o VA Maine Healthcare System (1 VA Center Augusta, ME 04330) o White River Junction VA Medical Center (215 North Main Street White River Junction, VT 05009) o Bedford VA Medical Center (200 Springs Road Bedford, MA 01730) o VA Boston Healthcare System

Jamaica Plain Campus (150 South Huntington Ave Jamaica Plain, MA 02130) West Roxbury Campus (1400 VFW Parkway West Roxbury, MA 02132) Brockton Campus (940 Belmont Street Brockton, MA 02301) o Manchester VA Medical Center (718 Smyth Road Manchester, NH 03104) o Providence VA Medical Center (830 Chalkstone Ave Providence, RI 02908) o VA Connecticut Healthcare System

West Haven Campus (950 Campbell Ave West Haven, CT 06516) Newington Campus (555 Willard Ave Newington, CT 06111) o VA Central Western Massachusetts (421 North Main Street Leeds, MA 01053)

4.3 TRAVEL

The Government anticipates travel under this effort to perform the tasks associated with the effort, as well as to attend program-related meetings or conferences throughout the PoP. Include all estimated travel costs in your firm-fixed price line items. These costs will not be directly reimbursed by the Government.

SCOPE OF WORK

The Contractor shall provide RTLS Operation and Maintenance (O&M) services, inclusive of RTLS application client and server software, operating system maintenance, operational support services and RTLS hardware. The Contractor shall provide these services for the RTLS production and pre-production environments deployed the VA Medical Centers (VAMCs) listed in Table 1, Section 4.2. The Contractor shall operate, repair, and maintain systems, applications, and Information Technology (IT) environments in support of RTLS applications and system components. The RTLS sustainment services shall include the following functions:

• Preventive Maintenance: The proactive modification of RTLS products to detect and correct latent operating defects or conditions before they become effective faults.

• Corrective Maintenance: The reactive maintenance performed to identify, isolate, and rectify RTLS operating faults.

• Adaptive Maintenance: Adaptive Maintenance: The proactive or reactive modifications performed to keep RTLS operations viable and products usable in a changing environment.

The tasks within this PWS are within scope and inclusive of Section 7.1 through Section 7.5

5.1 ORDER TYPE

This effort shall be proposed as an Indefinite Delivery Indefinite Quantity (IDIQ)

SYSTEM ARCHITECHTURE OVERVIEW

The VISN 1 RTLS architecture (see Figure 1) is divided into two groupings: components in VA Medical Centers (VAMC) and components in the Austin Information Technology Center (VISN level servers at AITC). Additionally, there are external interfaces that touch other VA systems.

Figure 1. VISN 1 RTLS Architecture

RTLS interfaces to external systems are software solutions orchestrated by a series of Enterprise Service Bus (ESB) flows. To support RTLS interfaces, VA uses the MuleSoft, a lightweight, open source ESB and integration framework that implements a communication messaging system between mutually interacting software applications. It is a Java-based ESB and integration platform to facilitate message routing and data transformation.

The RTLS component groupings at the VAMC and at the AITC are interdependent. Sustainment of Asset Tracking (AT) RTLS interfaces and System Administration duties for virtual servers, Databases, and components located at the Austin Information Technology Center (AITC) are outside the scope of this requirement. However, sustainment of Environmental Monitoring (EM) RTLS System Administration duties for virtual servers and components located at the AITC are within scope of this requirement, as well as the local servers at the VAMCs. Because of the interdependencies, operations and maintenance efforts are coordinated with the Contracting Officer’s Representative (COR) and other sustainment/support entities as specified by the COR to assist with isolating issues whose full resolution may span the component groupings. Table 2 provides a high-level overview of responsibilities between the different sustainment entities.

Table 1. High Level Overview of Support for VISN 1 RTLS

Asset Tracking Responsibility Matrix for VISN 1 RTLS System

SUPPORT

Task

AITC

Sustainment

ESE

Interfaces

Sustainment

VISN 1 RTLS

Sustainment Notes

MuleESB Server R VistA Services/VistALink (Oracle/Linux) R Interface Code and Upgrades R Patches for Linux (Interfaces/PIV SSOi) R

Patches for Windows CenTrak Servers R R

VISN 1 Sustainment responsible for servers at VAMCs. And the 3 EM servers at AITC. AITC Sustainment responsible for AT servers at AITC

Patches for Windows Infor Servers R R

VISN 1 Sustainment responsible for servers at VAMCs. And the 3 EM servers at AITC. AITC Sustainment responsible for AT servers at AITC

Patches for RTLS Applications R

VISN 1 Sustainment responsible for Software Maintenance Agreements

Application (SQL) Level Database Administration - Centrak/Infor R Load Balancing R PIV/SSOi R Vulnerability Remediation Management OS Level - CenTrak R R

VISN 1 Sustainment responsible for servers at VAMCs. And the 3 EM servers at AITC. AITC Sustainment responsible for AT servers at AITC

Vulnerability Remediation Management OS Level - Infor R

VISN 1 Sustainment responsible for servers at VAMCs. And the 3 EM servers at AITC. AITC Sustainment responsible for AT servers at AITC

Vulnerability Remediation Management - Databases R

VISN 1 Sustainment responsible for servers at VAMCs. And the 3 EM servers at AITC. AITC Sustainment responsible for AT servers at AITC

Help Desk R

Project Management R R

VISN 1 Sustainment responsible for PM at VAMCs. AITC Sustainment responsible PM at

AITC

System Monitoring R R

VISN 1 Sustainment responsible for servers at VAMCs. And the 3 EM servers at AITC. AITC Sustainment responsible for AT servers at AITC

6.1 RTLS SUSTAINMENT EFFORT

RTLS servers are highly virtualized and hosted on VA OIT virtual infrastructure, with software components spread across multiple virtual machines.

The Contractor shall provide O&M sustainment services for the RTLS production and pre-production environments.

O&M sustainment services shall be provided for the software components identified in Table 3 as applicable on the servers described in Table 2. These services are detailed in Section 6.0 to include operating system patches/upgrades, RTLS software component patches/upgrades, software license installation, system configuration changes, and virtual machine reboots on each of the RTLS VA Medical Center Virtual Servers. Since some of these products are deployed at the AITC, it will require a coordinated effort through the COR with other sustainment vendors.

Table 2. Software Components Covered Under this Task Order

Products CenTrak Application Server CenTrak Connect and Fingerprinting CenTrak Pulse (formerly GMS) and Prism Infor LBI (Connector, Platform, BI, NSSM) Java JDK Java SE Keepalive PostgreSQL Microsoft Internet Information Services (IIS) Microsoft .NET Framework RabbitMQ WildFly – JBoss: App Server (IAM) Windows Server 2012 R2, 2016, 2019, 2022 WinRAR Internet Information Services (IIS)

6.2 TECHNICAL EXPERTISE

In performance of the tasks in this PWS, the Contractor shall use and have expertise or certification as necessary in the following software and technologies:

Table 3. RTLS Technology

Technology Technology Microsoft SharePoint 2010, 2013 or later SharePoint versions, and related technologies

XML, XSL, XSLT

Infor CenTrak Oracle databases MySQL

Technology Technology SQL Server 2016, 2019, 2022 or later Reporting tools including SQL Server Reporting Services (SSRS) SQL Server Analysis Services (SSAS) SQL Server Integration Services (SSIS) Splunk Nagios Monitoring

Java JDK/SE RabbitMQ VA Technical Reference Model (TRM) VMWare Windows System Administration 2016, 2019, 2022 and later Red Hat Linux system administration

Contractor shall provide a Certified Partnership letter with CenTrak and Infor.

SPECIFIC TASKS AND DELIVERABLES

The Contractor shall perform the following:

7.1 PROJECT MANAGEMENT

The Contractor shall provide a single point of contact (POC) to oversee the O&M tasking for the RTLS sustainment in VISN 1. The Contractor POC shall be responsible for:

• Effectively communicating and providing timely project progress to VHA and Contractor team members

• Ensuring proper documentation is delivered to VHA

• Coordinating, escalating, and resolving Contractor-related project issues

• Representing the Contractor in status meetings and providing timely status reports

• Complying with VHA’s change management process

7.1.1 Reporting Requirements

The Contractor shall manage the RTLS Sustainment work effort and provide a Monthly Activity Report. These reports shall convey the status of Contract performance. A standard format will be provided by VA and shall be utilized for submission of required information.

Required information includes:

1. All planned or scheduled maintenance that will occur in the next reporting period, including patches, OS upgrades and hardware replacements

2. Maintenance activity log showing all patches, upgrades, and licenses installed, failures and faults detected, system performance deviations, including security vulnerabilities identified by VA from the monthly Nessus and on demand Oracle and SQL Server database scans, and the operational time to restore.

3. Customer support log which shall include a description of all support issues identified, severity level, and how the issues were resolved.

4. Corrective actions taken and status, whether closed/resolved or still open.

5. Anticipated closure date and roadblocks (if any) for open items.

6. All known significant issues or risks.

7. A summary of all closed and completed items.

Deliverable:

A. Monthly Activity Report

7.1.2 Technical Kickoff Meeting

The Contractor shall hold a technical kickoff meeting within 10 days after TO award. The Contractor shall present, for review and approval by the Government, the details of the intended approach, work plan, and project schedule for each effort. The Contractor shall specify dates, locations (can be virtual), agenda (shall be provided to all attendees at least five (5) calendar days prior to the meeting), and meeting minutes (shall be provided to all attendees within three (3) calendar days after the meeting). The Contractor shall invite the Contracting Officer (CO), Contract Specialist (CS), COR, and the VA PM.

7.1.3 Weekly Status Meeting

The Contractor shall hold a weekly status meeting with the COR and technical Point of Contacts (POC) as specified by the COR to discuss all the items identified in Monthly Activity Report (section 7.1.1), and other issues as identified by the COR. The Contractor shall provide weekly status meeting minutes to all attendees within three (3) calendar days after the meeting.

7.2 PREVENTATIVE MAINTENANCE

The Contractor shall deploy software updates and upgrades in the execution of RTLS preventive maintenance tasks. Additionally, the Contractor shall maintain and modify infrastructure system configurations to address functionality, security, and connectivity issues. Most RTLS application minor updates are released once or twice a year, while major updates are done annually. Updates to any individual application may vary in a given period of performance but will collectively average out over time.

For RTLS preventive maintenance, the Contractor shall:

1. Perform modifications to RTLS software installations and operational configurations to maintain and improve system performance, and to detect and correct latent faults in software and hardware products before they become operative faults. A latent defect or condition is one that is present but hidden from regular means of detection or yet to have an operational impact. An operative or effective fault is a fault activity impacting nominal system operations or business functionality.

2. Monitor the performance of the RTLS system, including system resources such as processor, memory and disk utilization and verify that performance thresholds are within nominal operating range, and take corrective action necessary to mitigate or relieve RTLS performance deviations and respond proactively to actionable alert and threshold notifications. The Contractor shall log and notify VA of any performance deviation, and any known or suspected rationale for the deviation in the Maintenance Activity Log as part of the Monthly Activity Report (Section 6.1.1).

3. Engage in an ongoing inspection of RTLS to identify operative and latent defects in RTLS functions, software scripts, and software and hardware configuration. The Contractor shall make actionable recommendations that address any defects detected. Recommendations shall be verbally relayed to the COR and documented in the Maintenance Activity Log as part of the Monthly Activity Report (Section 6.1.1).

4. Coordinate with COR to determine timing windows for patch and upgrade installations. This may take place outside of regular business hours.

5. Identify, download, and install or manage the installation of RTLS application software patches and upgrades.

6. Coordinate with VA POCs identified by the COR to shut down, reboot or restart RTLS systems (e.g., Infor, CenTrak) and RTLS supporting Systems (e.g., SSOi), following VA or RTLS IT maintenance, recovery, or software patching.

7. Verify correct operation of RTLS after every patch installation.

8. If operating system patches are shown to interfere with RTLS operation, coordinate with VA

POCs identified by the COR before backing out any operating system patch(es).

7.2.1 Software Updates, Upgrades, and Administration

The application components of RTLS are hosted on platforms that contain VA standard operating systems, virtual machines, and ancillary software. The Contractor shall be responsible for identifying and downloading updates. Some of the software listed in Table 3 are sub-components of the RTLS application software. The maintenance updates and upgrades to VA standard environments are the responsibility of VA Office of Information & Technology (OIT). For RTLS software updates or upgrades, the Contractor shall:

1. Proactively monitor One-VA Technical Reference Model to ensure RTLS Software components are approved to run on VA environment. If not, develop a plan to upgrade and perform installation and configuration of RTLS Software so that RTLS environment remains compliant with approved VA Baseline. This may include Operating System upgrades and software component upgrades.

2. Perform the installation, configuration, update (patching operational software) and/or upgrade (replacing or supplementing the software baseline) of RTLS software to mitigate the development of future faults, correct latent faults (present but hidden from routine (i.e., non-extraordinary) means of detection), rectify operative faults, restore nominal operations, or enhance component and system performance/capacity. For RTLS application software, the Contractor may expect approximately one major update and 2-3 minor updates a year. Linux patches are issued by VA monthly. The Contractor shall coordinate with VA COR to schedule installation before the next set of patches becomes available (less than 30 days). For RTLS application patches, the Contractor shall coordinate with VA COR to schedule installation within 30 days from when the software update is available. If issues are encountered, this timeframe may be extended with agreement from the COR.

3. Notify COR three (3) weeks in advance of installing new RTLS application releases or upgrades or any other disruptive maintenance activity in any environment. The Contractor shall delay or terminate any planned update or upgrade, at the direction of the COR.

4. Perform the installation of software patches, new releases, and software updates in the pre-production environment. New releases and upgrades may provide new functionality as well as any needed system corrections.

5. Ensure that the installation, operation, maintenance, updating, and patching of software shall not alter prior configuration settings or those from the VA approved configuration.

6. Verify the function and stability of upgrades in all environments (subject to the connectivity limits of those environments) prior to advancing to operational deployment into the production environment. This will include regression testing sufficient to verify basic functionality (e.g., login, search, asset tracking, reporting, accurate monitoring, and synchronization of inventory).

7. Perform routine RTLS system administration functions and serve as system administrator for all RTLS applications. In addition to system patches and updates, the Contractor shall monitor system logs and resource utilization, capture logs for submittal to Centrak and Infor, and archive system data and audit logs as needed.

8. Provide written notice to VA that each patch has been validated as not affecting the Systems within 10 working days when security fixes involve installing third party patches in pre-production (such as Linux Red Hat). Notification can come in the form of an email to the

COR.

9. Provide VA any necessary information to update the One-VA TRM entry for any software components updated.

10. Contractor shall provide supporting data as requested by the COR to complete VA IT requests such as Authority to Operate (ATO) and TRM waivers.

7.2.2 Hardware Updates and Upgrades

The VA wireless infrastructure upon which RTLS depends, is updated, upgraded, and maintained by VA OI&T, including wireless access points, as well as the Cisco Mobility Services Engine (MSE). For RTLS Hardware (HW) updates or upgrades, the Contractor shall:

1. Perform the provisioning, installation, configuration, update, or upgrade of RTLS hardware to (a) mitigate the development of future faults and maintain nominal system performance or capacity. The term provisioning refers to the planned allocation and distribution of available or acquired hard assets.

2. Develop recommendations for the replacement or substitution of RTLS hardware components in the RTLS System, as necessary to prevent faults or sustain performance thresholds.

3. Develop requisition requests and documentation for the procurement of additional RTLS software and hardware necessary to sustain RTLS functional capabilities at nominal levels. The VISN PM shall provide for the procurement of all RTLS hardware.

4. Execute the provisioning and installation of substitute RTLS components into the operational RTLS system, upon the authorization of the VISN RTLS PM.

7.3 CORRECTIVE MAINTENANCE

Corrective Maintenance is the reactive maintenance performed to identify, isolate, and rectify RTLS operating faults. Corrective Maintenance is applicable to both RTLS software and hardware. For RTLS corrective maintenance, the Contractor shall:

1. Perform troubleshooting to identify and isolate faults causing any failure or degradation of service in RTLS software and hardware components and systems.

2. Execute RTLS backup procedures in the event of RTLS primary software and hardware component service failures.

3. Execute the appropriate RTLS recovery procedures following the restoration of RTLS primary services from a partial or full system failure. Restoration shall include resumption with all data and capabilities available prior to the backup inducing event, and restoration to nominal operational state of RTLS hardware devices, including hard drives, component boards and processing units.

4. VA will perform Federal Information Security Management Act (FISMA) compliance audits and Nessus scans monthly, and the Contractor shall address and resolve all security remediation and vulnerabilities identified within the timeframe specified below, starting from notification of findings. VA maintains a tracking database for all security scan findings and compliance audits.

The Contractor shall update that database to indicate the status of issue resolution and/or the plan to resolve issues that will take longer to resolve, in case of delays beyond the Contractor’s control (e.g., a VA delay or vendor dependency for software patches). Based on historical data, the Contractor may expect approximately 10 new findings per month (1/8 critical priority, 1/2 high priority, 3/8 medium priority).

a. Critical – patches shall be tested and applied within 30 days

b. High – patches shall be tested and applied within 60 days

c. Moderate – patches shall be tested and applied within 90 days

d. Low – the System owner will determine the patching timeframe

e. Emergent – patches shall be tested and applied as soon as possible

5. Respond to and resolve notifications that RTLS servers, software, and hardware are down or inoperable.

6. Troubleshoot, isolate and repair connectivity and communication issues for data presented to, or received from, the Mule ESB. Resolution of these issues may require coordination with other POCs as identified by the COR.

7. Coordinate with VA OIT to obtain the status of the VA wide area network (WAN) and wireless infrastructure upon which RTLS depends, to determine the operational impact on RTLS. The Contractor shall obtain information on WAN and wireless updates, upgrades, and maintenance performed by VA OI&T. OIT maintenance includes wireless access points and Cisco Mobility Services Engine (MSE).

8. Perform the provisioning, installation, configuration, update, or upgrade of RTLS hardware to correct latent faults, rectify operative faults, and restore nominal operations. The term provisioning refers to the planned allocation and distribution of available or acquired hard assets.

9. Execute the provisioning and installation of substitute RTLS components into the operational RTLS system, upon the authorization of the VISN RTLS PM.

7.4 ADAPTIVE MAINTENANCE

VISN 1 procured and installed an RTLS Solution including Infor Asset Tracking Application and Centrak Location Technology. For RTLS adaptive maintenance, the Contractor shall:

1. Execute modifications or supplementation of RTLS software maps and software/hardware configurations that adjust RTLS functions and operations to a new or modified deployment environment. The deployment environment may be modified due to new construction, changes to facility floorplans, or changes to the business use of facilities, rooms and other assets using RTLS. The VA will provide new drawings. The contractor shall verify that modifications or supplementations are following VA RTLS Deployment Standards (Attachment E). Contractor shall provide Infor software configuration, such as regioning of map, map rendering, and preparation work for locations. Contractor shall provide CenTrak software configuration, hardware installation, and verification. The contractor shall implement CenTrak approved fingerprinting technology. The Contractor shall coordinate all activities such as software configuration in each system and the integration of data between systems.

2. The Contractor shall obtain VISN PM authorization prior to implementing any RTLS modification or supplementation steps. The contractor shall update the Facility Hardware Deployment Design Document Attachment A and Certified Space File (CSF) (Attachment A).

A. Facility Hardware Design Document and Configuration Space File

7.5 CUSTOMER SUPPORT

The Contractor shall work to resolve issues identified by the COR or a VA Clinical Engineering POC from one of the medical centers. Local staff from Clinical Engineering will perform initial review of all issues and if unable to resolve, will submit a help desk support ticket for escalation. The source of these issues may be Tier 2 or 3 trouble tickets. During regular business hours (7AM to 7PM Eastern), the Contractor shall:

1. Respond to service requests from COR or designee (via telephone or email) to resolve or support the troubleshooting, identification, and resolution of RTLS technical requests which involve RTLS components at the Regional Data Center (RDC). The Contractor shall log all requests that are received in the Maintenance Activity Log as part of the Monthly Activity Report (Section 6.1.1).

2. Classify all service request received by assigning a severity level, in accordance with Table 3 below. The Contractor may anticipate 2-3 service requests per month, typically of the Non- Critical and Important severity.

3. Coordinate with the COR if access to resources at a VAMC are required to fully diagnose or resolve an issue and work collaboratively with the POC(s) identified by the COR to resolve issues within RDC boundaries as depicted in Figure 1. RTLS malfunctions may originate within RDC boundaries, outside RDC boundaries, or both, if the RDC components have a dependency on external RTLS components (i.e., RTLS components at a VAMC).

4. Collaborate with any identified POCs to cooperatively troubleshoot and resolve issues.

5. Provide issue resolution response to resolve faults and requests, in accordance with the response timeline provided in Table 3 below. Issues, status, and resolution notification shall be communicated to the COR.

6. Document all customer support issues in the Customer service log, a component of the Monthly Activity Report (section 6.1.1)

7. Develop and submit service requests to COR-identified VA POCs to request OIT support services to resolve RTLS faults and other operating problems caused by components outside the maintenance responsibility of this TO.

Table 4: Event Response Time Intervals

Severity Code Impact Initial Response to Customer

Resolution Time

1 - Critical Complete work stoppage. Critical Service Request

30 minutes 8 hours

2 - Important Inability to perform a job function.

Important Service Request

1 hour 12 hours

3 - Non-critical Low/No Impact (Able to perform work functions) Non-critical Service Request

16 hours 80 hours

GOVERNMENT FURNISHED EQUIPMENT

The Government has multiple remote access solutions available to include Citrix Access Gateway (CAG), Site-to-Site Virtual Private Network (VPN), and RESCUE VPN.

The Government’s issuance of Government Furnished Equipment (GFE) is limited to Contractor personnel requiring direct access to the network to: development environments; install, configure and run Technical Reference Model (TRM) approved software and tools (e.g., Oracle, Fortify, Eclipse, SoapUI, WebLogic, LoadRunner); upload/download/manipulate code, run scripts, and apply patches; configure and change system settings; check logs, troubleshoot/debug, and test/QA.

When necessary, the Government will furnish desktops or laptops, for use by the Contractor to access VA networks, systems, or applications to meet the requirements of this PWS. The overarching goal is to determine the most cost-effective approach to providing needed access to the VA environment coupled with the need to ensure proper Change Management principles are followed. Contractor personnel shall adhere to all VA system access requirements for on-site and remote users in accordance with VA standards, local security regulations, policies, and rules of behavior. GFE shall be approved by the COR and Program Manager on a case-by-case basis prior to issuance.

Based on the Government assessment of remote access solutions and the requirements of this TO, the Government estimates that the following GFE will be required by this TO:

1. Two (2) standard laptops

The Government will not provide IT accessories including but not limited to Mobile Wi-Fi hotspots/wireless access points, additional or specialized keyboards or mice, laptop bags, extra charging cables, extra PIV readers, peripheral devices, additional RAM, etc. The Contractor is responsible for providing these types of IT accessories in support of the TO as necessary and any VA installation required for these IT accessories shall be coordinated with the COR.

GENERAL REQUIREMENTS

9.1 ENTERPRISE AND IT FRAMEWORK

9.1.1 One-VA Technical Reference Model

The Contractor shall support the VA enterprise management framework. In association with the framework, the Contractor shall comply with OI&T Technical Reference Model (One-VA TRM). One-VA TRM is one component within the overall Enterprise Architecture (EA) that establishes a common vocabulary and structure for describing the information technology used to develop, operate, and maintain enterprise applications. One-VA TRM includes the Standards Profile and Product List that collectively serves as a VA technology roadmap.

Architecture, Strategy, and Design (ASD) has overall responsibility for the One-VA TRM.

9.1.2 Federal Identity, Credential, and Access Management (FICAM)

The Contractor shall ensure Commercial Off-The-Shelf (COTS) product(s), software configuration and customization, and/or new software are Personal Identity Verification (PIV) card-enabled by accepting HSPD-12 PIV credentials using VA Enterprise Technical Architecture (ETA), http://www.ea.oit.va.gov/VA_EA/VAEA_TechnicalArchitecture.asp, and VA Identity and Access Management (IAM) approved enterprise design and integration patterns, http://www.techstrategies.oit.va.gov/enterprise_dp.asp. The Contractor shall ensure all Contractor delivered applications and systems comply with the VA Identity, Credential, and Access Management policies and guidelines set forth in the VA Handbook http://www.ea.oit.va.gov/VA_EA/VAEA_TechnicalArchitecture.asp http://www.techstrategies.oit.va.gov/enterprise_dp.asp

6510 and align with the Federal Identity, Credential, and Access Management Roadmap and Implementation Guidance v2.0.

The Contractor shall ensure all Contractor delivered applications and systems provide user authentication services compliant with the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-63-3, VA Handbook 6500 Appendix F, “VA System Security Controls”, and VA IAM enterprise requirements for direct, assertion based authentication, and/or trust based authentication, as determined by the design and integration patterns. Direct authentication at a minimum must include Public Key Infrastructure (PKI) based authentication supportive of PIV card and/or Common Access Card (CAC), as determined by the business need.

The Contractor shall ensure all Contractor delivered applications and systems conform to the specific Identity and Access Management PIV requirements set forth in the Office of Management and Budget (OMB) Memoranda M-04-04, M-05-24, M-11-11, and NIST Federal Information Processing Standard (FIPS) 201-2. OMB Memoranda M-04-04, M-05-24, and M- 11-11 can be found at:

https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/omb/memoranda/fy0 4/m04-04.pdf, https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/omb/memoranda/fy2 005/m05-24.pdf, and https://obamawhitehouse.archives.gov/sites/default/files/omb/memoranda/2011/m11- 11.pdf respectively. Contractor delivered applications and systems shall be on the FIPS 201-2 Approved Product List (APL). If the Contractor delivered application and system is not on the APL, the Contractor shall be responsible for taking the application and system through the FIPS 201 Evaluation Program.

The Contractor shall ensure all Contractor delivered applications and systems support:

1. Automated provisioning and are able to use enterprise provisioning service.

2. Interfacing with VA’s Master Veteran Index (MVI) to provision identity attributes, if the solution relies on VA user identities. MVI is the authoritative source for VA user identity data.

3. The VA defined unique identity (Secure Identifier [SEC ID] / Integrated Control Number [ICN]).

4. Multiple authenticators for a given identity and authenticators at every Authenticator Assurance Level (AAL) appropriate for the solution.

5. Identity proofing for each Identity Assurance Level (IAL) appropriate for the solution.

6. Federation for each Federation Assurance Level (FAL) appropriate for the solution, if applicable.

7. Two-factor authentication (2FA) through an applicable design pattern as outlined in VA Enterprise Design Patterns.

8. A Security Assertion Markup Language (SAML) implementation if the solution relies on assertion based authentication. Additional assertion implementations, besides the required SAML assertion, may be provided as long as they are compliant with NIST SP 800-63-3 guidelines.

https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/omb/memoranda/fy04/m04-04.pdf https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/omb/memoranda/fy04/m04-04.pdf…