PWS VASEES RFI.pdf

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Office of Information & Technology Infrastructure Operations

VA Server Enterprise Endpoint Security (VASEES)

Date: March 4, 2025

VA-25-00011736

PWS Version Number: 1.1

Contents

1.0 BACKGROUND

2.0 APPLICABLE DOCUMENTS

3.0 SCOPE OF WORK

4.0 PERFORMANCE DETAILS

5.0 SPECIFIC TASKS AND DELIVERABLES

5.1 VASEES Solution Deployment

5.2 PROJECT MANAGEMENT

5.3 CONTRACTOR STAFFING PLAN AND STAFFING MANAGEMENT

5.4 STATUS UPDATES

5.5 OVERARCHING TECHNICAL REQUIREMENTS

5.6 VASEES HELP DESK SCRIPTS

5.7 VASEES TRAINING

5.8 OPERATIONS AND MAINTENANCE (O&M)

5.9 OPTIONAL TASKS

5.10 OPTION PERIODS

6.0 GENERAL REQUIREMENTS

6.1 ENTERPRISE AND IT FRAMEWORK

6.2 SECURITY AND PRIVACY REQUIREMENTS

6.3 METHOD AND DISTRIBUTION OF DELIVERABLES

6.4 PERFORMANCE METRICS

6.5 FACILITY/RESOURCE PROVISIONS

6.6 GOVERNMENT FURNISHED PROPERTY

6.7 SHIPMENT OF HARDWARE OR EQUIPMENT

ADDENDUM A – ADDITIONAL VA REQUIREMENTS, CONSOLIDATED

ADDENDUM B – VA INFORMATION AND INFORMATION SYSTEM SECURITY

AND PRIVACY LANGUAGE

1.0 BACKGROUND

The Department of Veterans Affairs (VA), Office of Information & Technology (OIT), Infrastructure Operations (IO) strives to provide high quality, effective, and efficient Information Technology (IT) services to those responsible for providing care to the Veterans at the point-of-care as well as throughout all the points of the Veterans’ health care in an effective, timely and compassionate manner. VA depends on Information Management/Information Technology (IM/IT) systems to meet mission goals.

The Department of Veterans Affairs is required to protect all endpoints with industry standard level host-based cybersecurity protection. This solution will be required to support VA’s critical server infrastructure.

2.0 APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. 44 U.S.C. § 3541-3549, “Federal Information Security Management Act (FISMA) of 2002”

2. “Federal Information Security Modernization Act of 2014”

3. Federal Information Processing Standards (FIPS) Publication 140-2, “Security

Requirements for Cryptographic Modules”

4. FIPS Pub 199. “Standards for Security Categorization of Federal Information and

Information Systems,” February 2004

5. FIPS Pub 200, “Minimum Security Requirements for Federal Information and

Information Systems,” March 2006

6. FIPS Pub 201-2, “Personal Identity Verification of Federal Employees and

Contractors,” August 2013

7. 10 U.S.C. § 2224, "Defense Information Assurance Program"

8. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

9. Public Law 109-461, Veterans Benefits, Health Care, and Information Technology

Act of 2006, Title IX, Information Security Matters

10. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”

11. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, https://www.va.gov/vapubs/index.cfm

12. VA Handbook 0710, “Personnel Security and Suitability Program,” May 2, 2016, https://www.va.gov/vapubs/index.cfm

13. VA Directive and Handbook 6102, “Internet/Intranet Services,” August 5, 2019

14. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and

Guidelines,” January 18, 2017

15. Office of Management and Budget (OMB) Circular A-130, “Managing Federal

Information as a Strategic Resource,” July 28, 2016

16. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed

Services (CHAMPUS)”

17. NIST SP 800-66 Rev. 1, “An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule,” October 2008

18. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended, January 18, 2017

19. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

20. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021

21. VA Handbook 6500, “Risk Management Framework for VA Information Systems

VA Information Security Program,” February 24, 2021

22. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI),” March 12, 2019

23. VA Handbook 6500.5, “Incorporating Security and Privacy into the System Development Lifecycle,” March 22, 2010

24. VA Handbook 6500.6, “Contract Security,” March 12, 2010 (Appendix C updated April 22, 2024, VA Notice 24-12)

25. VA Handbook 6500.8, “Information System Contingency Planning,” April 6, 2011

26. VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018

27. VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017

28. OIT Process Asset Library (PAL), https://www.va.gov/process/ . Reference Process

Maps at https://www.va.gov/process/maps.asp and Artifact templates at https://www.va.gov/process/artifacts.asp

29. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

30. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014

31. VA Handbook 6508.1, “Procedures for Privacy Threshold Analysis and Privacy Impact Assessment,” July 30, 2015

32. VA Handbook 6510, “VA Identity and Access Management,” January 15, 2016

33. VA Directive and Handbook 6513, “Secure External Connections,” October 12,

34. VA Directive 6300, “Records and Information Management,” September 21, 2018

35. VA Handbook, 6300.1, “Records Management Procedures,“ March 24, 2010

36. NIST SP 800-37 Rev 2, “Risk Management Framework for Information Systems and

Organizations: A System Life Cycle Approach for Security and Privacy,” December

37. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020)

38. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015

39. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” March 24, 2014

40. OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005

41. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019

42. OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008

43. Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance, December 2, 2011, (NOTE: Part A of the FICAM Roadmap and Implementation Guidance, v2.0, was replaced in 2015 with an updated Architecture (https://arch.idmanagement.gov/#what-is-the-ficam-architecture)

44. NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access,“ June 2018

45. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, “Digital Identity Guidelines,” updated March 02, 2020

46. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014

47. NIST SP 800-164, “Guidelines on Hardware-Rooted Security in Mobile Devices

(Draft),” October 2012

48. Draft National Institute of Standards and Technology Interagency Report (NISTIR)

7981, “Mobile, PIV, and Authentication,” March 2014

49. VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland

Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

50. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

51. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

52. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

53. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019

54. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008

55. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (Public Law 110–140), December 19, 2007

56. Section 104 of the Energy Policy Act of 2005, (Public Law 109–58), August 8, 2005

57. Executive Order 13834, “Efficient Federal Operations,” dated May 17, 2018

58. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 2, 2001

59. VA Directive 0058, “VA Green Purchasing Program,” July 19, 2013

60. VA Handbook 0058, “VA Green Purchasing Program,” July 19, 2013

61. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote

Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

62. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

63. “Veteran Focused Integration Process (VIP) Guide 4.0,” January 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

64. VA Memorandum “Proper Use of Email and Other Messaging Services,” January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

65. “DevSecOps Product Line Management Playbook” version 2.0, May 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

66. NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020

67. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol

Version 6 (IPv6),” November 19, 2020

68. Social Security Number (SSN) Fraud Prevention Act of 2017

69. Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23, 2018

70. Appendix A, “VASEES Service Level Agreements”

71. Appendix B,” VASEES Solution Requirements”

72. VA Enterprise Cloud Technical Reference Guide, version 2.0 November 2022, VAEC Technical Reference Guide 2022 v2.0.pdf

73. VA Directive 6066, “Protected Health Information (PHI) and Business Associate

Agreements Management”, September 2, 2014

3.0 SCOPE OF WORK

The Contractor shall provide all resources necessary to accomplish the tasks and deliverables described within this PWS to include solution deployment, project management, contractor staffing plan and staffing management, status updates, overarching technical requirements, help desk scripts, training, operations and maintenance, and optional tasks, if exercised, for additional enterprise server licenses, additional enterprise workstation licenses, training, and transition.

The Contractor shall deploy and maintain a cybersecurity host-based solution capable of supporting up to 750,000 physical, virtual, and cloud-hosted clients throughout the VA enterprise identified as the VA Server Enterprise Endpoint Security (VASEES) system. This system shall be provided as a Software as a Service (SaaS) solution. The initial quantity of assets the solution shall support in the base period will be limited to 75,000 assets; with the remaining number being introduced through optional task execution outlined in section 5.9.

Under this Performance Work Statement (PWS), the base period shall consist of program and project management, licensing for 75,000 servers as well as the establishment of the required solution, identified as VA Server Enterprise Endpoint Security (VASEES), as defined in Section

5.5 this document and all attachments therein. These devices will include on-premises physical, virtual, and cloud hosted server assets. The Authority to Operate (ATO) shall be obtained within the base period.

The base quantity is expected to grow 3% year over year in option periods one through four and is expected to be reflected as an updated base quantity throughout the life cycle of the contract in each corresponding option period. Additional quantities will be acquired, as needed, in accordance with the Optional Tasks under PWS section 5.9 and all subsections therein. These devices will include on-premises physical, virtual, and cloud hosted server assets.

Server assets include Windows 2003, 2008, 2008 R2, 2012, 2012 R2, 2016, 2019, 2022, CentOS Linux, IBM Linux, Red Hat Linux 4.0 – 9.x, Sun Unix, SUSE Linux 11 – 15, Ubuntu Linux, VMWare Proton, and Macintosh servers. Coverage will also be expected to include all current released versions and new versions of operating systems throughout the life cycle of this effort.

Assets are distributed across multiple physical locations as well as Amazon Web Services (AWS) and Microsoft Azure environments.

The contractor shall be responsible for obtaining and maintaining a VA system approval to operate (ATO) throughout the lifecycle of this effort. Due to the sensitivity of the data that will be handled by this system, a FEDRAMP High rating is required.

The contractor shall be responsible for responding to and resolving all issues resulting from the use and/or operation of the VASEES solution. The contractor shall respond to the issues within the detailed service level agreements (SLAs) defined within Appendix A.

4.0 PERFORMANCE DETAILS

4.1 PERFORMANCE PERIOD

The base period of performance shall be twelve months from date of award, with four twelve-month option periods and five optional tasks. All optional tasks, if exercised, shall be co-termed to the period of performance for which they are executed. The overall PoP shall not exceed Sixty months.

Any work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO).

There are eleven (11) Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, four are set by date:

New Year's Day January 1 Juneteenth June 19 Independence Day July 4 Veterans Day November 11 Christmas Day December 25

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

Martin Luther King's Birthday Third Monday in January Washington's Birthday Third Monday in February

Memorial Day Last Monday in May Labor Day First Monday in September Columbus Day Second Monday in October Thanksgiving Fourth Thursday in November

4.2 PLACE OF PERFORMANCE

Tasks under this PWS shall be performed at remote locations identified, maintained, and communicated to the Government by the contractor.

Changes to work locations and/or time zone coverages made by the Contractor shall be provided no later than 30 days in advanced of the change by email delivery to and confirmation from the VA PM, COR and VA Stakeholders with notice provided to the VA Contracting Officer.

4.3 TRAVEL

The Government anticipates minimal travel under this effort to perform the tasks associated with the effort, as well as to attend program-related meetings or conferences throughout the PoP. Include all estimated travel costs in your firm-fixed price line items. These costs will not be directly reimbursed by the Government.

The total estimated number of trips in support of the program related meetings for this effort is fifteen. Anticipated locations include the following, estimated at three individuals for five days in duration:

1. Washington, DC

2. Atlanta, GA

3. Hines, IL

4. Martinsburg, WV

5. Austin, TX

6. Denver, CO

7. Pittsburg, PA

8. Santa Clara, CA

Prior to traveling, the contractor shall communicate and receive approval no less than 10 days in advance from the VA COR and stakeholders to include the location, purpose of the travel, and staff list that will be traveling.

5.0 SPECIFIC TASKS AND DELIVERABLES

The contractor shall be responsible for providing a Commercial Off The Shelf (COTS) solution for VASEES that meets the defined requirements within Appendix B and perform all associated actions defined within section 5.0 and all sub-sections within this PWS. The solution shall meet VA’s operational requirements; including but not limited to; an approved ATO, and adherence to the SLAs defined within Appendix A.

The Contractor shall perform the following:

5.1 VASEES SOLUTION DEPLOYMENT

The contractor shall provide VA with a VASEES solution that fulfills the technical requirements outlined in Appendix B and must adhere to the defined requirements within this PWS in section

5.1.1 and all subsections, and Appendix A. The proposed solution must be deployed within the contractor’s SaaS environment and all assets shall be fully migrated to the solution no later than 12 months from award. The Contractor shall disclose the status of the FedRAMP package associated with the VASEES solution and must adhere to the following criteria based on the appropriate architectural requirements.

5.1.1 SaaS Solution

5.1.1.1 If the solution is FedRAMP Authorized but not VA Authorized:

1. The information system solution selected by the Contractor shall comply with the Federal Information Security Management Act (FISMA)

2. The Contractor shall comply with FedRAMP requirements as mandated by Federal laws and policies, including making available any documentation, physical access, and logical access needed to support this requirement

3. The system must be FedRAMP Authorized at no less than the High.

4. The Contractor shall, where applicable, assist with the VA ATO Process to help achieve agency authorization of the cloud service or migrated application.

5. The Contractor shall develop a VA specific system boundary diagram including any integration and connectivity components that will be known as a VA Implementation Diagram (VAID) demonstrating the proposed implementation of this system at VA. The Contractor shall provide the VAID within 10 calendar days of contract award.

6. The Contractor shall provide confirmation of their FedRAMP System Security Plan (SSP) and supporting documentation completion via their repository ID number and a link for VA to download the SSP and all required artifacts within 5 calendar days of contract award.

7. The Contractor shall provide the results of their most recent Third-Party Assessment Organization (3PAO) Security Assessment Plan (SAP) within 10 calendar days of contract award.

8. The Contractor shall complete a 3PAO Security Assessment Report (SAR) within 10 calendar days after the SSP is accepted by VA.

9. The Contractor shall provide VA with the most recent monthly scans for the production environment within the authorization boundary and their scan upload schedule for FedRAMP within 30 calendar days of contract award.

10. The Contractor shall provide their availability to participate in monthly continuous monitoring meetings to be scheduled following successful VA ATO within 30 calendar days of contract award.

11. Contractor shall work with assigned VA SME to develop a VA specific Incident Response Plan (IRP) and perform an IRP Table Top Exercise with VA Stakeholders. This should be completed within 30 calendar days of the SAR being delivered.

12. If new or unanticipated vulnerabilities are discovered by either VA or the Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party in accordance with Addendum B, VA Information and Information System Security/Privacy Language

13. The Contractor shall comply with data management requirements.

14. Successful issuance of a VA ATO will be required before live VA data can be used in the system.

Deliverables:

A. VA Implementation Diagram B. FedRAMP System Security Plan (SSP) and supporting documentation C. 3PAO Security Assessment Plan (SAP) D. 3PAO Security Assessment Report (SAR) E. IRP Scenario

5.1.1.2 If the solution is FedRAMP Authorized and VA Authorized:

1. The information system solution selected by the Contractor shall comply with the Federal Information Security Management Act (FISMA) and have a current VA authorization.

2. The Contractor shall comply with FedRAMP requirements as mandated by Federal laws and policies, including making available any documentation, physical access, and logical access needed to support this requirement.

3. The FedRAMP Authorization level and existing VA ATO should be no less than the level required for this use case which has been defined as HIGH.

4. The Contractor shall, where applicable, assist with the VA ATO Sustainment Process to help maintain health and quality of agency authorization of the cloud service or migrated application.

5. The Contractor shall exclusively provide licenses and/or accounts to FedRAMP authorized and VA authorized environments.

6. The Contractor shall afford VA access to the Contractor’s and Cloud Service Provider’s (CSP) facilities, installations, technical capabilities, operations, documentation, records, and databases.

7. If new or unanticipated vulnerabilities are discovered by either VA or the Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party in accordance with Addendum B, VA Information and Information System Security/Privacy Language

8. The Contractor shall comply with data management requirements.

9. Successful issuance of a VA ATO will be required before live VA data can be used in the system.

10. The Contractor shall participate in monthly Agency and FedRAMP Sustainment meetings following the granting of a VA ATO.

11. The Contractor shall provide continuous monitoring activities including scans, security artifacts, and monthly Plan of Action and Milestones (POAM) reports as outlined by FedRAMP requirements.

A. Continuous monitoring security artifacts B. Continuous monitoring scans C. Plan of Action and Milestones reports

5.2 PROJECT MANAGEMENT

5.2.1 CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Project Management Plan (CPMP) within 30 days of receipt of award that lays out the Contractor’s approach, timeline, and tools to be used in execution of the contract. The CPMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks, and resource support. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPMP shall be concurred upon and updated in accordance with Section B of the contract. The Contractor shall update and maintain the VA PM approved CPMP throughout the PoP and reviewed monthly by the VA COR and stakeholders.

Deliverable:

A. Contractor Project Management Plan

5.2.2 REPORTING REQUIREMENTS

The Contractor shall provide the COR and VA stakeholders with weekly Progress Reports in electronic form in Microsoft Word and Project formats. The report shall include detailed instructions/explanations for each required data element, to ensure that data is accurate and consistent. These reports shall reflect data as of the last day of the preceding week.

The weekly Progress Reports shall cover all work completed during the reporting period and work planned for the subsequent reporting period. The report shall also identify any problems that arose and a description of how the problems were resolved. If problems have not been completely resolved, the Contractor shall provide an explanation including their plan and timeframe for resolving the issue. The report shall also include an itemized list of all Information and Communication Technology (ICT) deliverables and their current Section 508 conformance status. The Contractor shall monitor performance against the CPMP and report any deviations. The report shall include support vacancies and recruitment updates to fill vacancies if any exist at the time of delivery. The Contractor shall also include staff loss/gains, as well as a staffing schedule for the upcoming week, along with a point of contact(s) for after hours support for that same period. During the last report of each month, the report shall include a summary of the monthly actions and highlight any trends or historically relevant data in support of the effort that would allow improvements for the remaining PoP or enhancements to VA’s security posture. It is expected that the Contractor will keep in communication with VA accordingly so that issues that arise are transparent to both parties to prevent escalation of outstanding issues.

A. Weekly Progress Report

5.2.3 TECHNICAL KICKOFF MEETING

A technical kickoff meeting shall be held within 10 days after contract award. The Contractor shall coordinate the date, time, and location (can be virtual) with the Contracting Officer (CO), as the Post-Award Conference Chairperson, the VA PM, as the Co-Chairperson, the Contract Specialist (CS), and the COR. The Contractor shall provide a draft agenda to the CO and VA PM at least five (5) calendar days prior to the meeting. Upon Government approval of a final agenda, the Contractor shall distribute to all meeting attendees. During the kickoff-meeting, the Contractor shall present, for review and approval by the Government, the details of the intended approach, work plan, and project schedule for each effort via a Microsoft Office PowerPoint presentation.

At the conclusion of the meeting, the Contractor shall update the presentation with a final slide entitled “Summary Report” which shall include notes on any major issues, agreements, or disagreements discussed during the kickoff meeting and the following statement “As the Post- Award Conference Chairperson, I have reviewed the entirety of this presentation and assert that it is an accurate representation and summary of the discussions held during the Technical Kickoff Meeting for the VASEES. The Contractor shall submit the final updated presentation to the CO for review and signature within three (3) calendar days after the meeting. The Contractor shall also work with the CS, the Government’s designated note taker, to prepare and distribute the meeting minutes of the kickoff meeting to the CO, COR and all attendees within three (3) calendar days after the meeting. The Contractor shall obtain concurrence from the CS on the content of the meeting minutes prior to distribution of the document.

Deliverables:

A. Summary Report Presentation B. Meeting Minutes

5.3 CONTRACTOR STAFFING PLAN AND STAFFING MANAGEMENT

The Contractor shall provide project and operational management support for day-to-day operations of VASEES.

The Contractor shall be responsible for the entire proposed VASEES solution; excluding endpoint asset management beyond the solution component behavior but will assist in the troubleshooting of endpoint issues attributed to or potentially caused by the deployed solution and all software therein. The Contractor shall provide a Staffing Plan that ensures its successful management of and business continuity of the solution.

The Contractor Staffing Plan shall ensure established staffing levels are maintained on each task, solution performance monitoring, and shall report any vacancies which will impact the Contractor’s ability to meet the specific tasks for that effort as it relates to this contract. The Contractor staffing plan shall include project organization chart, project team roles, project responsibilities, number of staff required per assignment, estimated start dates, breakdown in terms of staff’s Full Time Equivalent (FTE) for each role, contact information for all contract participants, and identification of key risk points and mitigation plans.

The Contractor’s staffing approach shall comply with VA 6500 guidelines around separation of duties and least privilege. The Contractor shall ensure adequate coverage for implementation and O&M to support the VASEES solution environments. The Contractor shall ensure consistent coverage for all support requirements including backup staffing that is readily available. The Contractor shall ensure that all staffing levels provide full time, non-interrupted support during 24x7x365 business operations, emergencies, or staffing issues.

The Contractor shall:

1. Ensure staffing levels provide support during 24x7x365 business operations.

2. Ensure staffing levels provide non-interrupted support during 24x7x365 emergencies.

3. Ensure access to “premier level support.” Premier support will include access to developers, engineers, and direct Tier 4 support. The Contractor staff shall be certified by the Original Equipment Manufacturer (OEM) vendor to ensure the highest level of expertise and support is accessible to VA.

4. Ensure Contractor staff is trained and oriented on VASEES Support Service processes and the VA operations.

5. Ensure Contractor staff has expertise in Federal Government, including OMB mandates, Federal Information Security Management Act (FISMA) requirements, NIST controls, TIC requirements and applicable federal law, for implementations of the OEM solution.

6. Ensure Contractor staff certifications and skill sets are maintained to current technology platforms supported at VA within VASEES.

7. Notify the COR and VA stakeholders in writing by email of any staffing changes on work associated with this contract 10 business days in advance of any staff changes. The written notification shall outline the reason for the change, the impact expected by the change and mitigation strategy to reduce the impact by the staff change. In the event of an unforeseeable staff change due to termination or a contract staff member resigning without proper notice being provided to the Contractor, the Contractor is obligated to notify the COR and VA stakeholders within 2 business days from the action occurring.

A. Contractor Staffing Plan

5.4 STATUS UPDATES

The Contractor shall support meetings, as detailed below, to discuss status, issues, proposed resolutions, plan moves/add/changes, plan upgrades, provide updates, and resolve tickets. These meetings can be conducted via teleconference. Separate meetings shall be held as required.

Operations (daily meetings) o Shall outline the overall solution status, challenges, and anticipated needs and/or changes from the previous week/month/quarter; as well as future needs.

o Shall outline the major incidents from the past week to include resolved, active, and anticipated cases which will impact system performance or end user experience as it relates to the provided solution and supporting software o Shall provide schedules and details as made available by the OEM vendor of upcoming software releases, patches, and potential risks reported by other customers of the OEM associated with the software included within VASEES and architectural components

Policy and Configuration (weekly meetings) o Shall outline and discuss the requested policy and software behavioral changes requested over the past week to identify areas of concern relating to the approach, structure, and intent of said change o Shall review existing policies for areas of improvement o Shall provide regular “clean-up” of legacy or outdated entries in the configuration and policy settings for all VASEES software o Shall discuss incidents or issues caused by change through policy and configuration updates and provide solutions to mitigate future occurrences o Create and maintain a searchable database of known policy requests, their submitters, description/reason for the request, and timeframe for the request to be active aligned to the ticket request numbers

Management (weekly meetings between Contractor and Stakeholders) o Shall discuss any contractor issues or requests being made of the contractor by the direct customer base within VA o Shall identify and propose solutions for problem areas in staffing, support delivery services, architectural issues, and product issues o Shall discuss and maintain an open line of communication with the VA and

Contractor for upcoming feature releases or changes to the VASEES system throughout the lifecycle of the solution

Based on discussions in the above meetings, the Contractor shall provide Policy and Configuration Reports, and Management Status Reports weekly, and a monthly summary to identify trends relative to the solution.

Deliverables:

A. Policy and Configuration Report B. Management Status Report

C. Weekly Summary Report D. Monthly Summary Report

5.5 OVERARCHING TECHNICAL REQUIREMENTS

The Contractor shall provide, install, and support a COTS VASEES solution that functions as a managed service system (see Appendix B for required functionalities) without interruption to the VA’s enterprise protection posture. The COTS VASEES solution will require VA specific configuration setting to accommodate VA’s enterprise and VA customer needs.

5.5.1 CUSTOMIZE VASEES COTS PRODUCT

The Contractor shall:

1. Achieve 99.9% availability of the VASEES solution as defined within Appendix A defined SLAs, with the underlying cloud service provider (CSP) building blocks (that have the lower SLA’s) and submit to Enterprise Cloud Solution Office (ECSO) and the VA Enterprise Security Architecture (ESA) for evaluation and approval to ensure the VASEES solution is compatible with the VAEC architecture.

2. Develop or update relevant standard operating procedures, production procedures, system documentation, and standard application practices and procedures.

3. Ensure all software is Section 508 compliant and is maintained through periodic VA review process and documents.

4. Create and maintain the Production Operations Manual (POM). This POM shall outline all actions necessary to maintain and operate the VASEES solution should the responsibility fall on VA for such efforts. This includes but is not limited to: standard operating procedures (SOPs), scripts, configuration settings, architectural diagrams, maintenance schedule details

A. Production Operations Manual

5.5.2 VASEES TEST AND VALIDATION

1. Monitor and track deployment testing, including integration testing in the VA environment.

2. Provide operational acceptance testing support, involving key vendor and support personnel until the deployment is complete.

A. Develop, maintain, and execute the VASEES Test Plan(s) that defines objectives, test events, test cases and automated scripts (where possible), dependencies, timelines to test and validate that the solution in the VA environments satisfies requirements and acceptance criteria. The Contractor shall provide test scripts (automated where possible), and test data.

3. Provide a Test Summary Report with a summary of test results and data sets captured during the Operational Acceptance Testing.

This solution or its components shall not be used in an operational mode until successful completion of Operational Acceptance Testing and written acceptance by the VA PM/COR and stakeholders.

Deliverables:

A. VASEES Test Plans B. Test Summary Report

5.5.3 DEPLOYMENT OF VASEES

A. Develop and create an ATO accreditation package as detailed in section 5.5.5.4.

B. Work with the VA to provide inputs for establishing VA capacity requirements for

VASEES, accounts, and privileges. This includes monitoring and tracking the creation, update, and deletion of application user (e.g., developer, systems administrator) accounts, and ensuring cloud capacity requirements are satisfied.

C. Create, review, analyze, and distribute relevant, deployment information to stakeholder groups, such as policy and configuration changes which shall be documented in the weekly reporting under section 5.4.

D. Contractor shall create and deliver a Standard Operating Procedures for Tiers 2, 3, and 4 document which details updating operational policies and procedures such as service creation/deletion, and helpdesk escalation (Tier 2, 3, 4) as defined in section 5.6.

E. Create and maintain a System Design Document (SDD) outlining system components, dependencies, connections, data flows, ports, protocols, and detailing all aspects of the system and its related interactions within the VA and backend systems.

F. Provide updates to the SDD to match the current infrastructure as well as maintaining the SDD in the event of changes during the period of performance.

G. Train and work alongside government FTEs to prepare for the day-to-day operations actions defined within the operation policy and procedures for tier 3 and 4 support.

H. Create and maintain all change requests in accordance with the VA change management processes to enable deployment windows and transition schedules for the migration actions from VA’s current solution to VASEES.

A. The contractor shall be responsible for migrating the assets from the existing endpoint protection solution to the newly deployed solution outlined within section 5.5 and all subtasks and applicable attachments within this order. .

I. The Contractor shall be responsible for implementing like configuration from the current solution to the new solution adjusted for the operational behavior of the VASEES solution, replication of policies, permissions, role actions, reporting dashboards, and logging connections to VA’s enterprise logging solution.

J. Coordinate and prepare software packages for deployment with VA.

K. Hold stakeholder meetings to address any system owner concerns and adjust scheduled activities accordingly to minimalize operational impact and system downtime.

L. Establish and define service desk support documentation for Tier 2 troubleshooting.

M. Establish and integrate processes to account for support ticket submissions from the field staff for tier 3 and 4 support on transition and system usage actions N. Create and maintain a Back-Out plan for the VASEES system and its components in support of the ATO package allowing the endpoint to return to the original configuration pointing to VA’s current solution in the event of an outage or issues during deployment.

O. Provide post-deployment services such as updating application documentation, transferring knowledge and support responsibilities to operations, and obtaining application sign-offs. System operation requirements are detailed in section 5.8.

P. Provide weekly activity updates in the weekly activity report outlined in section 5.2.2 highlighting trend analysis of threats, recommended actions for policy or configuration changes, and optimization recommendations for system usage.

Q. Create, test, and document software changes required within the system in accordance with the VA change management processes defined in 5.8.4.

R. Conduct weekly meetings with government FTE support staff to discuss system usage, policy change requests, and upcoming system actions to include but not limited to:

software version changes, known product issues, storage behavior and recommendations, and administrative actions relating to the day-to-day operation of the VASEES system.

S. Create and maintain dashboard reports and data tracking capability within the system based on government FTE and stakeholder feedback

T. Provide regular maintenance tasks within the system and supporting components such as monthly security patching, optimization based on system utilization, performance modifications based on load and capacity, and others as required to maintain operation requirements within Appendix A SLA uptime requirements.

U. Maintain and make available to VA Stakeholders a policy and change register of requested policy and configuration changes which tracks the date of request, individual performing the change, submitter or requester of the change, policy or policies impacted by the change, change configuration details, business justification for the change, and ticket numbers associated with the change request. The Change Register should be searchable and/or quarriable and be maintained in a standard database format.

V. The contractor shall establish no less than 6 full administrator accounts to the system for use of identified and pre-authorized by VA stakeholder assignments for system administration and oversight in the operational capacity of the VASEES system.

Deliverable(s):

A. Standard Operating Procedures for Tier 2, Tier 3, and Tier 4 B. System Design Document (SDD) C. Back-Out Plan D. Change Register

5.5.4 VASEES CLIENT SOFTWARE LICENSES FOR SERVERS

The Contractor shall provide an enterprise-wide COTS software license solution that meets or exceeds the performance and capability requirements described within Appendix B – VASEES Solution Requirements.

As part of the managed service system, the Contractor shall manage (as the base requirement) licenses for 75,000 servers with a 3% year-over-year increase to the base amount during option periods one through four as described in section 3.0. The licenses shall be for a combination of physical and virtual machines, the division of which will be at the Government’s discretion. See Appendix B for all technical capability requirements.

5.5.4.1 Endpoint Security Capabilities and Licenses

The Contractor shall provide a COTS software license solution for 75,000 servers with a 3% year-over-year increase to base amount during option periods one through four (77,250 in Option Year One, 79,568 Option Year Two, 81,955 Option Year Three, 84,413 Option Year Four) as described in section 3.0 that conforms to the following capabilities in addition to the requirements defined within Appendix B:

Must be able to observe standard behavior patterns of a specific network and/or endpoint assets and alert to significant deviations.

Must be scalable to support a large enterprise network in excess of 750,000 assets.

Must install on an unlimited number of endpoints and must provide multiple simultaneous connections to each endpoint.

Must be deployable to the majority of OS platforms used in the VA, including but not limited to: Windows 2003, 2008, 2008 R2, 2012, 2012 R2, 2016, 2019, 2022, CentOS Linux, IBM Linux, Red Hat Linux 4.0 – 9.x, Sun Unix, SUSE Linux 11 – 15, Ubuntu Linux, VMWare Proton, and Macintosh servers.

Must be deployable to Amazon Web Services (AWS) and Microsoft Azure assets with support for other industry standard cloud service providers from a single management interface.

The solution must maintain an audit log that records individual analyst activity and connection information.

The solution must utilize a non-intrusive agent with a small footprint that does not cause a performance impact to the end-user and require no reboot of systems for increased security coverage and software upgrades or feature enhancements.

The endpoint agent shall require no drivers for installation, install seamlessly without endpoint interruption, as well as not require a system reboot when deployed, installed, or additional features or modules are added.

The endpoint agent licensing should be unlimited instead of per endpoint and able to scale without additional on-premises hardware.

Data in transit from the endpoint to the analyst must be encrypted using a validated FIPS 140-2 cryptographic module.

Solution must provide and consume from industry standard threat intelligence and analytical capabilities within its product feature set.

5.5.5 VA ENTERPRISE MONITORING

The Contractor shall monitor, govern, and enforce VA monitoring requirements and reporting to ensure operational uptime is met as defined in Appendix A. Additional monitoring requirements are defined in the following subsections.

5.5.5.1 MONITORING

The continuous monitoring program is based on the continuous monitoring process described in NIST SP 800-137, Information Security Continuous Monitoring for Federal Information Systems and Organization. The goal is to provide: (i) operational visibility; (ii) managed change control;

and (iii) attendance to incident response duties.

The Contractor shall generate a Continuous Monitoring and Operations Support Concept of Operations Plan to outline its processes, procedures and tools used for monitoring and operations support. This Plan shall outline its procedures, schedule, and method/type of data/log capture for audit and review by Contractor’s information assurance team. The Plan and supporting tools shall be updated as necessary to capture new security alerts, configuration changes to support security concerns, and applicable reports to allow for trending related to security events. The Contractor shall monitor all such resources through automated tools to ensure availability and to guarantee that all systems are operating within the expected parameters as defined by Appendix A. In the event of a service disruption, the Contractor shall notify the COR, VA Project Manager (PM) and VA Stakeholders within 15 minutes of detecting the event. Tools employed in the monitoring of resources should have no less than five (5) minute resolution to ensure there is minimal time between event occurrence and detection. Such notifications shall be disseminated according to the severity and impact according to Appendix A.

If an event occurs that impacts the availability of the VASEES environment, the Contractor shall provide event updates every hour until the issue is resolved. At the conclusion of the event, the Contractor shall provide an After Action Report (AAR) with a detailed summary of the identified problem, how the attack or outage occurred and if it succeeded, what data was accessed, what resolution steps have been exercised, chronology of events, impact analysis, remediation actions, and lessons learned for preventing future events within three (3) business days after the conclusion of the event. The downtime and the impact to the SLA, shall be included in the report. Within three (3) business days of resolution, the Contractor shall provide an initial Root Cause Analysis (RCA) Report, to which the Government may request clarification or greater detail. A final version shall be supplied within (5) business days of receiving Government’s feedback.

The Contractor shall provide technical expertise support during evidence collection and maintenance procedures that may be required to support forensic analysis in the case of an emergency incident. The Contractor shall participate in weekly meetings with the VASEES Operations Team and Security Working Group to provide input regarding the security posture of the hosted computing environments upon request.

The Contractor shall capture, FIPS 140-2 encrypt, and maintain a Read Only log event information of system and network logs. Access to this data shall be strictly limited and tracked in accordance with a VA-approved access control list provided by VA. The Contractor shall send output logs of log analysis tools to the COR and VA Stakeholders for category 1-3 security events, which shall be subject to inspection. VASEES systems shall be configured in accordance with (IAW) NIST Special Publication 800-94; Section 3.2.2 that provides details relating to log configuration. The mechanism for log transference shall be FIPS 140-2 encrypted e-mail, when possible; for instances where encrypted e-mail is not possible, password-protected FIPS 140-2 encrypted .zip files shall be utilized. The Contractor shall retain log output for a minimum period of one (1) year in accordance with VA policy.

The Contractor shall detect, identify, react to and report security events on all supported VA environments on behalf of VA. The Contractor shall be responsible for reporting incidents within 15 minutes of event detection to the VA Security Operations Center (vasoc@va.gov or 1-866- 407-1566), in accordance with the VASEES SLA outlined in Appendix A. Security events include, but not limited to, network intrusions, scans, denial of service attacks, worms and unauthorized access to Contractor-managed devices.

The Contractor shall manage incident response and mitigation. The Contractor shall use US CERT or equal to monitor current security threats in an effort to protect the integrity of the federal cloud environment and private cloud environment and any data contained in the systems.

The Contractor shall actively investigate any attempted or successful intrusion and take steps to halt the attack and isolate the affected systems. Efforts shall be taken to preserve evidence so forensic analysis can be attempted. The Contractor shall conduct a post-incident briefing with the COR and VA Stakeholders to assess the response to the incident. The Contractor shall make appropriate adjustments to Contractor VASEES policies, procedures, and thresholds as identified during the post-incident briefing.

A. Continuous Monitoring and Operations Support Concept of Operations Plan

(CMOSCOP)

B. After Action Report (AAR) C. Root Cause Analysis (RCA) Report

5.5.5.2 IDENTITY AND ACCESS MANAGEMENT FUNCTIONS

The Contractor shall provide the following:

1) Ability for VA to authenticate and perform centralized management for each VA authorized user and administrator by fully integrating with a VA Active Directory (AD) system and/or Identity Platform. The Contractor shall update or replace and maintain VA approved certificates for the VASEES system as required to meet AD and Identity Platform integration requirements, as well as individual project and application requirements. All AD and certificate work must be coordinated with the appropriate VA teams to ensure minimum downtime.

2) Full capability to integrate with current and future releases of the VA Identity and Access Management (IAM) systems.

3) Maintain an AD environment that provides centralized management of all system accounts for VASEES in regard to access control and continuous monitoring. The Contractor shall provide multifactor authentication for all system accounts and all elevated privileges as well as achieve NIST SP 800-63A, B, C, and SP 800-63-3 and VA Handbook 6500 compliance for Access Control and Identity Management functions.

5.5.5.3 OPERATIONAL ACCEPTANCE TESTING

The Contractor shall provide an VASEES Operational Acceptance Test Plan. The Contractor shall conduct Operational Acceptance Testing of the VASEES solution, components, and supported software. These tests shall comply with the Government approved VASEES Operational Acceptance Test Plan. The Contractor shall provide at least three (3) business days’ notice to the VA COR and Stakeholders before the start of testing. Testing shall demonstrate all security thresholds are met to allow connectivity between the VASEES solution, and VA network, and validation of any supported software and upgrades therein.