Readiness _ Employment System (RES) Draft SOO v2.pdf

Draft RES Statement of Objectives (SOO)

Readiness & Employment System (RES)

Statement of Objectives (SOO)

Department of Veterans Affairs

Veteran Readiness & Employment (VR&E)

Veterans Benefits Administration (VBA)

Date: 13 May 2022

SOO Version Number: v2.0

TABLE OF CONTENTS

1 INTRODUCTION

2 BACKGROUND

3 PURPOSE

4 SCOPE OF WORK

4.1 Order Type

5 PERFORMANCE DETAILS

5.1 Period of Performance

5.2 Place of Performance

5.3 Travel or Special Requirements

5.4 Inclement Weather

5.5 Hours of Operations

5.6 Contract Management

5.7 Government Furnished Property

5.8 Security and Privacy

5.8.1 Position/Task Risk Designation Level(s)

6 REQUIRED TASKS

6.1 Case Management Services

6.1.1 Application

6.1.2 Eligibility Determination

6.1.3 Entitlement Management

6.1.4 Case Notes

6.1.5 Build Plan

6.1.6 Integration

6.1.7 Reports

6.2 Award Calculation

6.3 Workload Management

6.3.1 Case Management

6.3.2 Work Queues

6.3.3 Case Status

6.3.4 Role-Based Permissions

6.3.5 Audit Trail

6.4 Forms & Letters

6.5 Service Provider Record

7 OPTIONAL TASKS

7.1 Recurring Optional Tasks

8 ASSUMPTIONS & CONSTRAINTS

8.1 Authentication

8.2 Personnel Security Clearances

8.3 Other Assumptions and Constraints

9 GENERAL REQUIREMENTS

9.1 Section 508 – Electronic and Information Technology (EIT) Standards

9.1.1 Equivalent Facilitation

9.1.2 Compatibility with Assistive Technology

9.1.3 Additional Accessibility Requirements

9.2 Service Level Agreement

9.2.1 Acceptance Criteria and User Testing

9.2.2 Enterprise and IT Framework

9.3 Solution Outage

9.4 Information and Information Technology Security Requirements

9.4.1 General

9.4.2 Access To VA Information And VA Information Systems

9.4.3 VA Information Custodial Language

9.4.4 Information System Design and Development

9.4.5 Information System Hosting, Operation, Maintenance, Or Use

9.4.6 Security Incident Investigation

9.4.7 Liquidated Damages for Data Breach

9.4.8 Security Controls Compliance Testing

9.4.9 VA Privacy and System Security Training

9.5 VA Data (Already FedRAMP and VA Authorized)

9.6 Zero Trust Architecture

9.7 Key Personnel

9.7.1 Key Personnel Substitutes

9.7.2 Vocational Rehabilitation Program Subject Matter Expert (Program SME)

9.7.3 Program Manager (PgM)

9.7.4 Senior Project Manager (SPM)

9.8 VR&E Personnel Training

APPENDIX A – ACRONYMS AND ABBREVIATIONS

APPENDIX B – APPLICABLE REGULATORY CRITERIA

APPENDIX C – BACKGROUND INFORMATION ABOUT EXISTING PROCESSES

APPENDIX D – CURRENT VR&E SYSTEMS DESCRIPTION

D1 – VR&E Systems D2 – Education Related Systems D3 – Payment Systems D4 – Document Repository/Workload Management D5 – Veteran and Public Facing D6 – Identity Management Systems D7 – Other Systems

APPENDIX E – VR&E CURRENT PROCESS FLOW CHARTS WITH SYSTEM

INTEGRATIONS

E1 – Administer VR&E Benefits E2 – Manage VR&E Customer Communication E3 – Perform Agent Assisted Interaction E4 – Receive Benefit Request E5 – Establish VR&E Claim E6 – Manage Claimant Record E7 – Create Benefit Claim E8 – Develop Rehabilitation Plan E9 – Determine Entitlement and Feasibility E10 – Provide Rehabilitation and Employment Services E11 – Provide Employment Through Long Term Services E12 – Provide Independent Living Services E13 – Provide Rapid Access to Employment Services E14 – Provide Re-Employment Services

APPENDIX F – REQUIREMENTS

Case Management (Chapter 31) Awards to Program Participants Forms & Letters Workload Management Service Provider Relationship Management Overarching Objectives Optional Objectives

APPENDIX G – USE CASES

G1 – Business Processes Use Cases (Non-Financial) G2 – Financial Transactions To Beneficiaries Use Cases – Awards To Program Participants G3 – System Integrations Use Cases

APPENDIX H – DATA EXTRACTION

APPENDIX I – PERFORMANCE AND QUALITY GOALS

APPENDIX J – VR&E PROGRAM CHAPTERS

APPENDIX K – VR&E OFFICES AND ALTERNATE OFFICES

APPENDIX L – CHAPTER 31 REASON CODE AND DETAILED REASON CODE

APPENDIX M – VR&E FORMS

APPENDIX N – VR&E LETTERS

APPENDIX O – RATE TABLE FOR AWARDS

APPENDIX P - STEP-BY-STEP PAYMENTS

APPENDIX Q – VR&E GLOSSARY OF TERMS

1 INTRODUCTION

The Department of Veterans Affairs (VA) through its three administrations, Veterans Benefits Administration (VBA), National Cemetery Administration (NCA), and Veterans Health Administration (VHA), provides benefits and services to United States Veterans, their dependents, and their survivors.

The fundamental mission of the Veterans Benefits Administration (VBA) is to provide Veterans, Service Members, and their families their military service benefits. VBA accomplishes its mission by delivering client-centered, personalized services that help program participants readjust to civilian life and enhance their well-being.

VBA Veteran Readiness and Employment (VR&E) is responsible for providing eligible program participants with compensable service-connected disabilities, all services and assistance necessary to enable them to the maximum extent possible, to become employable and to obtain and maintain suitable employment and achieve maximum independence in daily living.

NOTE: For the purposes of this RFI, “RES” and “Readiness & Employment System” encompasses the services provided by VR&E and a case management system is a part of that system.

2 BACKGROUND

VR&E administers services to eligible program participants in accordance with Title 38 applicable chapters (See Appendix J – VA Program Chapters). The comprehensive services provided by VR&E include vocational assessment, rehabilitation planning, and employment services. For Veterans with service-connected disabilities (SCDs) so severe they cannot immediately consider work, the VR&E program offers services to improve their ability to live as independently as possible within their families and communities. Eligible program participants obtain these services and assistance through the submittal, processing, and approval of a claim to the VBA VR&E. Claims are currently processed throughout VA’s 56 Regional Offices across the nation, comprised of ~2,500 concurrent users, including ~900 Vocational Rehabilitation Counselors (VRCs).

The ability to address and respond to Veterans needs and maintain an appropriate Veteran to VRC ratio is critical for ensuring program participants receive services and assistance in a timely responsive manner.

The current processes are predominantly manual in nature, impacting VR&E’s ability to efficiently serve program participants. VR&E seeks to significantly improve the processes by leveraging technology and implementing automation for a lifecycle case management approach to better enable the VRCs to serve program participants in a more timely and accurate manner. Leveraging automation for repeatable processes and financial calculations will further provide the VRCs a more robust capability to support program participants. To that end, VR&E requires changes to the existing case management capabilities within VBA systems.

Implementing the new solution will be challenging due to the current technical limitations in VBA’s application and infrastructure. However, VBA envisions improved customer service and mission accomplishment through digitizing processing, automating functions, and reducing the administrative responsibilities for the VRCs. VBA seeks a Managed Service Provider (MSP) to meet these objectives, while preserving government oversight and accountability of the case management processes.

Figure 1 Depicts the future state of RES

3 PURPOSE

This Statement of Objectives (SOO) seeks to obtain an MSP solution that shall provide program services, along with development and operations of a modern case management solution that leverages automation that will enable VR&E to deliver comprehensive VR&E benefits and allow program participants to successfully prepare, find, and maintain gainful employment. The MSP solution shall streamline functionality, integrating existing VA and VBA corporate systems into a centralized application. The MSP solution shall be deployed to production as a managed services solution hosted within the FedRAMP-certified cloud environment. The MSP shall develop a solution inclusive of associated program services for the lifecycle management of VR&E cases and to:

Provide world-class case management services to enable development of effective vocational rehabilitation and independent living plans, timely and accurate generation of awards, real-time eligibility, and benefit information

Improve business processes with automation while streamlining administrative, financial processing and reporting capabilities to allow the VRCs more time to engage with program participants

Determine eligibility, calculate entitlement benefits, and calculate award amounts based on established and prospective business rules

Manage workload to ensure proper compliance and oversight of the VR&E program, and the use of data to monitor business processes and measure program participant outcomes, costs of rehabilitation, and other key performance indicators

Update VBA records to reflect the required data elements and to document the status of each program participant’s case

Support existing legislative and policy requirements and adapt to any new legislative and policy changes

Throughout this SOO the case management system will be referred to as the Readiness & Employment System (RES).

4 SCOPE OF WORK

The intent of this SOO is to obtain a fully functional and operational solution that implements VR&E capabilities, including case management, award processing and other related transactions.

The MSP shall produce and deploy a requirements-compliant Readiness & Employment System (RES) to deliver required processes in administering VBA’s VR&E program (Appendix C - Background Information About Existing Processes). There are numerous stakeholders involved in this process, and as such; the MSP will be required to work across VA and VBA offices to deliver the required services.

These stakeholders and their roles are described in the Use Cases.

The details of the processes involving the identified stakeholders are reflected in Appendix G - Use Cases.

These provide scenario-based examples detailing an overview of the use case, primary roles, supporting roles, inputs, outputs, and outcomes.

Appendix J - (VR&E Program Chapters) outlines the program provisions which the MSP shall include under this contract.

In addition to the Required Tasks listed within this SOO, the MSP shall incorporate all terms and conditions into their proposed Performance Work Statement and Performance Measures designed to be executable and satisfy Government objectives.

This SOO includes critical information in Appendices A through Q, describing terminology, use cases, roles, workflows, regulations, and processes associated with RES case processing activities. The appendices are integral in this SOO and are identified below as:

Appendix A – Acronyms and Abbreviations

Appendix B – Applicable Regulatory Criteria

Appendix C – Background Information About Existing Processes

Appendix D – Current VR&E Systems Description

Appendix E – VR&E Current Process Flow Charts with System Integrations

Appendix F – Requirements

Appendix G – Use Cases

Appendix H – Data Extraction

Appendix I – Performance and Quality Goals

Appendix J – VR&E Program Chapters

Appendix K – VR&E Offices and Alternate Offices

Appendix L – Chapter 31 Reason Code and Detailed Reason Codes

Appendix M – VR&E Forms

Appendix N – VR&E Letters

Appendix O – Rate Table for Awards

Appendix P – Step-by-Step Payments

Appendix Q – VR&E Terms Glossary

4.1 Order Type

A Firm Fixed Price (FFP) contract vehicle is being considered.

5 PERFORMANCE DETAILS

5.1 Period of Performance

The Period of Performance (PoP) shall be one (1) base period not to exceed 12-months and nine (9) option periods of 12-months each. Exercise of options will be made at the sole discretion of the Government. If VBA chooses not to exercise an option, that shall not be deemed a termination of contract. Following are the periods of performance:

Base Year: March 27, 2023 – March 26, 2024 Option Year 1: March 27, 2024 – March 26, 2025 Option Year 2: March 27, 2025 – March 26, 2026 Option Year 3: March 27, 2026 – March 26, 2027 Option Year 4: March 27, 2027 – March 26, 2028 Option Year 5: March 27, 2028 – March 26, 2029 Option Year 6: March 27, 2029 – March 26, 2030 Option Year 7: March 27, 2030 – March 26, 2031 Option Year 8: March 27, 2031 – March 26, 2032 Option Year 9: March 27, 2032 – March 26, 2033

5.2 Place of Performance

Efforts under this SOO are expected to be performed at MSP and Government facilities. No work by the Prime or subcontractor shall be performed under the resultant contract Outside Continental United States (OCONUS). The MSP shall identify the MSP’s place of performance in their submission.

5.3 Travel or Special Requirements

The Government anticipates travel to perform the tasks associated with the effort, as well to attend program related meetings or conferences throughout the periods(s) of performance. Travel shall be conducted in accordance with FAR 31.205-46 and requires concurrence in advance by the Contracting Officer Representative (COR). Include all estimated travel costs in your firm-fixed price line items. These costs will not be directly reimbursed by the Government.

Travel and per diem shall be reimbursed in accordance with the Federal Travel Regulation (FTR) 31.205-

46. Travel, subsistence, and associated labor charges for travel time for travel beyond a 50-mile radius of the MSP's facility identified as place of performance are authorized for reimbursement on a case-by-case basis and must be pre-approved by the COR in direct support of this requirement. Each MSP invoice must include copies of all receipts that support the travel costs claimed in the invoice. Local travel within a 50-mile radius from the facility will not be reimbursed. This includes travel, subsistence, and associated labor charges for travel time. Travel performed for personal convenience and daily travel to and from work will not be reimbursed. General and Administrative expenses will not be reimbursed.

Travel is for the base period and the option periods, if exercised. Locations and frequency of travel will vary within the Continental United States (CONUS), current possible travel locations at the time of solicitation include but are not limited to those listed in Appendix K – VR&E Offices and Alternate Offices.

5.4 Inclement Weather

In each instance when the site is closed to MSP personnel as a result of inclement weather, potentially hazardous conditions, explosions, or other special circumstances, the MSP will direct its staff as necessary to take actions such as reporting to its own site(s) or taking appropriate leave consistent with its policies.

The MSP shall adhere to guidance from the US Office of Personnel Management (OPM) as posted on www.opm.gov and through their app, OPM Alert, which –provides a real time look at the current operating status for Federal Government offices in the Washington, DC area.

5.5 Hours of Operations

Hours of operation are defined as Monday through Friday, 7:30 AM EST - 5:30 PM EST. Any work to be performed at a Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO) or Contracting Officer Representative (COR).

There are 11 Federal holidays set by law (USC Title 5 Section 6103) that VA follows.

Under current definitions, five (5) are set by date:

New Year's Day January 1 Juneteenth June 19 Independence Day July 4 Veterans Day November 11 Christmas Day December 25

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six (6) are set by a day of the week and month:

Martin Luther King's Birthday Third Monday in January Washington's Birthday Third Monday in February Memorial Day Last Monday in May Labor Day First Monday in September Columbus Day Second Monday in October Thanksgiving Fourth Thursday in November

Observance of such days by Government personnel shall not be cause for an extension to the delivery schedule or period of performance or adjustment to the price, estimated cost, or fee(s), if any, except as set forth in the contract.

5.6 Contract Management

To be finalized prior the release of the final solicitation

5.7 Government Furnished Property

The Government has multiple remote access solutions available to include Citrix Access Gateway (CAG), Site-to-Site Virtual Private Network (VPN), and RESCUE VPN.

Government Furnished Equipment (GFE) laptops will be provided where required for the MSP’s solution upon MSP requests. The MSP shall make such requests as soon as possible following task order award to allow the Government sufficient time to acquire the laptops. The Government will provide VA network access, email addresses, and access to specific applications necessary to perform the tasks in this SOO.

The MSP shall initiate requests for initial resources immediately following receipt of notification of initiation of a background check for any resource requiring such access.

The MSP will be provided access to, and training on, VBA’s policies and guidance impacting work requested in this SOO. Training and orientation as appropriate, will also be provided for the various systems and software required for the performance of the tasks including the systems identified in Appendix D – Current VR&E Systems Description.

The Status of Government Furnished Equipment Report under the requirements is applicable to this SOO and shall be delivered to the COR/VA PM as required.

5.8 Security and Privacy

The description of Security and Privacy needs will be finalized prior the release of the final solicitation

A. The MSP shall notify VA within 24 hours of the discovery or disclosure of successful exploits of the vulnerability which can compromise the security of the Systems (including the confidentiality or integrity of its data and operations, or the availability of the system).

Such issues shall be remediated as quickly as follows:

Critical – Must be remediated immediately.

High – Must be remediated within 60 days.

Medium – Must be remediated within 90 days.

Low – Must be remediated according to the timeframe established by the system owner. Typical in the next release or no longer than 120 days.

B. When the Security Fixes involve installing third party patches (such as Microsoft OS patches or Adobe Acrobat), the MSP will provide written notice to VA that the patch has been validated as not affecting the Systems within 10 working days. When the MSP is responsible for operations or maintenance of the Systems, they shall apply the Security Fixes within 90 days.

It has been determined that protected health information may be disclosed or accessed, and a signed Business Associate Agreement (BAA) shall be required. The MSP shall adhere to the requirements set forth within the BAA, referenced in Section D of the Request for Task Execution Plan (RTEP) and shall comply with VA Directive 6066.

5.8.1 Position/Task Risk Designation Level(s)

Table 1: Position Sensitivity Definitions

Position Sensitivity

Background Investigation (in accordance with Department of Veterans Affairs 0710 Handbook, “Personnel Suitability and Security Program,” Appendix A)

Low/Tier 1

Tier 1/National Agency Check with Written Inquiries (NACI) A Tier 1/NACI is conducted by OPM and covers a five-year period. It consists of a review of records contained in the OPM Security Investigations Index (SII) and the DOD Defense Central Investigations Index (DCII), FBI name check, FBI fingerprint check, and written inquiries to previous employers and references listed on the application for employment. In VA it is used for Non-sensitive or Low Risk positions.

Moderate/Tier 2

Tier 2/Moderate Background Investigation (MBI) A Tier 2/MBI is conducted by OPM and covers a five-year period. It consists of a review of National Agency Check (NAC) records [OPM Security Investigations Index (SII), DOD Defense Central Investigations Index (DCII), FBI name check, and an FBI fingerprint check]; a credit report covering a period of five (5) years; written inquiries to previous employers and references listed on the application for employment; an interview with the subject; law enforcement check; and a verification of the educational degree.

High/Tier 4

Tier 4/Background Investigation (BI) A Tier 4/BI is conducted by OPM and covers a ten-year period. It consists of a review of National Agency Check (NAC) records [OPM Security Investigations Index (SII), DOD Defense Central Investigations Index (DCII), FBI name check, and a FBI fingerprint check report]; a credit report covering a period of 10 years;

written inquiries to previous employers and references listed on the application for employment; an interview with the subject, spouse, neighbors, supervisor, co-workers; court records, law enforcement check, and a verification of the educational degree.

In accordance with VA Handbook 0710, Personnel Security and Suitability Program, the position sensitivity, and the level of background investigation commensurate with the required level of access for the following tasks within the SOO are in Table 2.

Table 2: Position Sensitivity and Background Investigation Requirements.

To be finalized prior the release of the final solicitation

Objective Position Sensitivity and Background Investigation Requirements

Tier1 / Low Risk Tier 2 / Moderate Risk Tier 4 / High Risk

5.1.1

Objective Position Sensitivity and Background Investigation Requirements

Tier1 / Low Risk Tier 2 / Moderate Risk Tier 4 / High Risk

5.1.2

5.1.3

5.1.4

5.1.5

5.1.6

5.1.7

5.2

5.3.1

5.3.2

5.3.3

5.3.4

5.3.5

5.4

5.5

6.1

The Tasks identified above, and the resulting Position Sensitivity and Background Investigation requirements identify, in effect, the Background Investigation requirements for MSP individuals, based upon the tasks the MSP will be working. The submitted MSP Staff Roster must indicate the required Background Investigation Level for each MSP individual based upon the tasks the MSP individual will be working, in accordance with their submitted proposal.

6 REQUIRED TASKS

The following tasks describe the objectives that shall be achieved as a part of the solution. Details are identified in Appendix F – Requirements and Appendix G – Use Cases.

For successful performance, the set of objectives identifies functionalities to be embedded in the solution.

For example, the MSP solution shall be able to perform solution-wide functions such as capture and display local date and time based on the user’s geographical time zone, spelling, grammar correction, use keyword search options as described in the business rules, and the system shall be compatible with approved web browsers described in the current VA Technical Reference Model to ensure seamless operations.

The MSP solution shall map the migrated data from the integration points to the applicable program participant record. For data storage, the solution shall utilize scalable storage to hold all necessary data.

To maintain quick issue resolution, 24/7 support shall be available to provide Level 1, 2 and 3 help desk support with clear escalation protocol. The system shall allow 2,500 concurrent users with the ability to add additional users to meet Agency requirements. A 99.9% uptime is required, and planned outages must be communicated to the COR as identified in Section 9.2 – Service Level Agreement.

6.1 Case Management Services

Provide Chapter 31 Case Management Services within the base period of performance in production/operational/test environments for the MSP provided solution.

Provide Chapter 36, 35, and 18 Case Management Services as optional tasks. See Section 6 Optional Task for more information.

6.1.1 Application

The solution shall provide reliable, and resilient application processing and management capabilities. The solution must be capable of ingesting data from electronic submissions at the time of application or when new data becomes available.

6.1.2 Eligibility Determination

The solution shall provide efficient Chapter 31 and Chapter 36 eligibility determination through automation. The solution shall offer flexibility to accommodate different eligibility scenarios, as well as process and rule-based requirements.

6.1.3 Entitlement Management

The solution shall provide the ability to allow the documentation of entitlement and feasibility determinations. Metadata shall be used and made available in the management of the process. The solution shall offer efficient computing of remaining entitlement based on benefits usage with flexibility for manual adjustments.

6.1.4 Case Notes

The solution shall support VR&E staff to manually enter case notes and addendums based on predefined selections that can be captured and stored electronically. Ability to display case notes from e-VA must be made available.

6.1.5 Build Plan

The solution shall support VR&E staff to generate an electronic outline of services to be provided to the program participants. The solution must be capable of supporting a diverse set of related capabilities as stated in the Use Cases and Objectives.

6.1.6 Integration

The solution shall be able to integrate with identified systems to share data bidirectionally. Systems identified can be found in Appendix F – Requirements and Appendix G – Use Cases.

6.1.6.1 Data Display and Integration

The solution shall be capable of displaying data from external systems.

6.1.7 Reports

The solution shall be able to generate administrative, workload, management, and ad-hoc operational reports. The solution shall ensure all data contained within the solution is readily available for reporting purposes.

6.2 Award Calculation

The solution shall be able to calculate the award amounts based on business rules with complete accuracy.

Award calculation shall provide an off-ramping solution for exception processing. Other functions outlined in the Use Cases, Objectives and Appendix O – Rate Tables for Awards and Appendix P – Step-by-Step Payments shall be made available.

6.3 Workload Management

The solution shall be capable of effectively and efficiently manage work via dynamic routing and tracking capabilities throughout the entire case management lifecycle.

6.3.1 Case Management

The solution shall be able to implement existing case management rules and allow for updated rule sets to manage the flow of a case throughout the system.

6.3.2 Work Queues

The solution shall be able to effectively and efficiently manage work queue to display notification and manage alerts. The solution shall be capable of supporting a diverse set of display capabilities as stated in the Use Cases and Objectives.

6.3.3 Case Status

The solution shall be able to change case status both automatically and manually based on the current regulations. Case status progression is not linear, but dynamic. Related capabilities such as viewable, searchable, sortable, reason-codes and related functionalities shall be made available.

6.3.4 Role-Based Permissions

The solution shall have the ability to manage role-based permissions to perform case management functions in the system. The solution shall be capable of supporting a complimentary set of related capabilities as stated in the Use Cases and Objectives.

6.3.5 Audit Trail

The solution shall be able to provide an audit trail of information within the system, including automation, workflow, and other related details. The solution shall be capable of supporting a complimentary set of related capabilities as stated in the Use Cases and Objectives.

6.4 Forms & Letters

The solution shall be able to merge or populate collected and available data to generate forms and letters.

Forms and letters generated shall be stored in the eFolder. Forms and letters shall be processed based on the Use Cases and Objectives.

6.5 Service Provider Record

The solution shall have the ability to manage the service provider list and details, which includes service providers, employers, and facility information. The solution shall be capable of supporting a complimentary set of related capabilities as stated in the Use Cases and Objectives.

7 OPTIONAL TASKS

The MSP shall take into consideration the dynamic nature of VR&E case management needs and provide a solution that is flexible and support seamless and effective implementations of possible optional tasks.

Optional tasks are identified in Section 7.1 below. The VBA reserves the unilateral right to request the performance of optional tasks based on the contract terms and conditions. All criteria described herein shall apply, and the Use Cases, business rules, and workflows.

7.1 Recurring Optional Tasks

The MSP shall support improvements of the VR&E Readiness & Employment System in a flexible, agile, and scalable approach to achieve the goals specified in the SOO Objectives and Appendix G – Use Cases.

The set of optional tasks are support functionalities that are planned to improve solution accuracy and the experience of program participants.

The system shall have the capability to integrate with QA Web The system shall allow VRC to procure discrete services for the program participant when needed

(e.g., tutoring services, evaluations/assessments) The system shall support initiate medical/dental referrals to VHA facilities, and the viewing of updates.

In addition to Chapter 31 case management needs, the following chapters are included as optional tasks.

The system shall have the ability to integrate workflows and business rules for Chapter 18 The system shall have the ability to integrate workflows and business rules for Chapter 35 The system shall have the ability to integrate workflows and business rules for Chapter 36

8 ASSUMPTIONS & CONSTRAINTS

This section defines the assumptions and constraints underlying this contract, which the MSP shall consider in developing their technical solution. The MSP shall address the following constraints at a minimum as well as their own assumptions and constraints.

This section lists laws, rules, regulations, standards, technology limitations and other constraints that the service and/or service provider must adhere to or work under.

It is important to recognize that VA’s current environment rests on ownership of both the code base and control of the production environment. While portions of the current system may exist in external cloud solutions and development of many of these systems is contracted out, the overarching control and direction of these systems is still retained by the government. Under the VR&E Readiness & Employment System described within this SOO, the entire solution (or portions described below) will be the responsibility of the provider including the infrastructure, code updates, general management, change management and all other necessary practices - except for the data and business rules.

VA will make available to the service provider partner all IT systems (or copies thereof) that currently deliver capabilities that would transition to a service. The service provider will either use, modify or replace and decommission these IT systems these IT systems so long as the integrity of business capability and VA ownership and governance of data and enactment of business rules are maintained.

8.1 Authentication

The MSP shall ensure the solution configuration and customization are Personal Identity Verification (PIV) card enabled. The MSP shall ensure delivered solution provide user authentication services compliant with the National Institute of Standards and Technology (NIST) Special Publication (SP) 800- 63-3, VA Handbook 6500 Appendix F, “VA System Security Controls”, and VA Identify and Access Management (IAM) enterprise requirements for direct, assertion-based authentication, and/or trust-based authentication, as determined by the design and integration patterns. Direct authentication at a minimum must include Public Key Infrastructure (PKI) based authentication supportive of PIV card and/or Common Access Card (CAC), as determined by the business need. Additionally, VA Memorandum, VAIQ #7613595, “Mandatory Use of PIV Multifactor Authentication to VA Information System and VA Memorandum, VAIQ #7613597, “Mandatory Use of PIV Multifactor Authentication for Users with Elevated Privileges shall be followed.

The MSP shall ensure delivered solution conform to the specific Identity and Access Management PIV requirements set forth in the Office of Management and Budget (OMB) Memoranda M-04-04, M-05-24, M-11-11, and NIST Federal Information Processing Standard (FIPS) 201-2.

8.2 Personnel Security Clearances

To be finalized prior the release of the final solicitation

8.3 Other Assumptions and Constraints

The following is a list of assumptions and constraints that apply to this requirement, the Government standards and guidelines that shall be applied to the work, regulations that may guide or constrain task performance.

Specifically, VA requires:

All data and business rules remain the property of the VA, and that processes be in place for VA to access / maintain copies of this data and business rules as required by the Department

Adherence to all applicable Federal and VA policy regarding information security, privacy, and IT standards outlined in Section 9.4 Information and Information Technology Security Requirements

Any solution would ensure interoperability with core VA IT assets, ensuring the integrity and synchronization of common program participant data. These systems include, but not limited to:

o Master Person Index (MPI) for claimant/beneficiary identification and contact information.

o VBMS eFolder for storage and retention of all claims related documents o VBMS for Service-Connected Disability information and Dependent verification o Centralized Mail and Mail Automation capabilities for digitizing physical paper submitted by program participants o Identity and Access Management (IAM) for user provisioning/credentialing o eMPWR-VA for finance and accounting functionality o CAATS or its successor (iFAMS) for obtaining data/information on purchase card and procurement of discrete services o IPPS for obtaining facility authorization and invoice information o IPPS and iFAMS for obtaining information on referrals and invoices related to national contracted services o CWINRS for performing data migration o e-VA for communication between case managers and program participants, data collection and provide updates in the systems o VA.gov for receiving web-based applications o VA Profile for updating VA databases across the network o Enterprise Data Warehouse for obtaining data from VBA transactional systems to generate intelligence reports o VA-ONCE or its successor for educational facilities and training facilities certifying officials to submit electronic enrollment certification forms to VA o WEAMS or its successor for use as data repository of all programs and educational facilities (EF)/Training Facilities (TF) approved to deliver training under VA educational programs o LTS or its successor for processing Chapter 31 benefits and letters, both via automation and manual intervention. LTS integrates with a VA payment system to provide awards o BDN is a Common Business Oriented Language (COBOL) suite mainframe application that contains legacy, education, and VR&E related data o CSS for controlling authorization to the data within the VBA Corporate Database (CorpDB). No access is granted to the VBA Corporate Database without use of CSS o BGS for accessing corporate data and is designed to deliver a service-oriented architecture o EHRM for connecting VA’s medical centers and clinics with the Department of Defense

(DoD) and the U.S. Coast Guard o VTA for tracking Service member through the Integrated Disability Evaluation System

(IDES) and monitors benefits applications and administrative details

9 GENERAL REQUIREMENTS

9.1 Section 508 – Electronic and Information Technology (EIT) Standards

On August 7, 1998, Section 508 of the Rehabilitation Act of 1973 was amended to require that when Federal departments or agencies develop, procure, maintain, or use Electronic and Information Technology, that they shall ensure it allows Federal employees with disabilities to have access to and use of information and data that is comparable to the access to and use of information and data by other Federal employees. Section 508 required the Architectural and Transportation Barriers Compliance Board (Access Board) to publish standards setting forth a definition of electronic and information technology and the technical and functional criteria for such technology to comply with Section 508. These standards have been developed are published with an effective date of December 21, 2000. Federal departments and agencies shall develop all Electronic and Information Technology requirements to comply with the standards found in 36 CFR 1194. The VA 508 Office will scan all materials created by and for the VA, provide some training and guidance, and monitors overall Section 508 compliance. Coordinate with the VA 508 Office throughout the period of performance.

The Section 508 standards established by the Architectural and Transportation Barriers Compliance Board (Access Board) are incorporated into, and made part of all VA orders, solicitations and purchase orders developed to procure Electronic and Information Technology (EIT). These standards are found in their entirety at: https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-section-508-standards/section-508-standards. A printed copy of the standards will be supplied upon request. The MSP shall comply with the technical standards as marked:

§ 1194.21 Software applications and operating systems § 1194.22 Web-based intranet and internet information and applications § 1194.23 Telecommunications products § 1194.24 Video and multimedia products § 1194.25 Self-contained, closed products § 1194.26 Desktop and portable computers § 1194.31 Functional Performance Criteria § 1194.41 Information, Documentation, and Support

9.1.1 Equivalent Facilitation

Alternatively, offerors may propose products and services that provide equivalent facilitation, pursuant to Section 508, subpart A, §1194.5. Such offerors will be considered to have provided equivalent facilitation when the proposed deliverables result in substantially equivalent or greater access to and use of information for those with disabilities.

9.1.2 Compatibility with Assistive Technology

The Section 508 standards do not require the installation of specific accessibility-related software or the attachment of an assistive technology device. Section 508 requires that the EIT be compatible with such software and devices so that EIT can be accessible to and usable by individuals using assistive technology, including but not limited to screen readers, screen magnifiers, and speech recognition software. For legacy systems, the MSP is not responsible for obtaining compliance for systems that are not currently in compliance.

9.1.3 Additional Accessibility Requirements

In addition to Section 508, adherence to the 21st Century Communications and Video Accessibility Act (CVAA) is also required. The CVAA updates federal communications law to increase the access of persons with disabilities to modern communications. The CVAA makes sure that accessibility laws enacted in the 1980s and 1990s are brought up to date with 21st century technologies, including new digital, broadband, and mobile innovations.

In 2019, the VA Website Accessibility Act of 2019 was made law. The VA is currently reviewing all websites and services for accessibility and providing a report to Congress paired with a “Make Well” strategy. All PDFs, services, and outputs of this initiative must meet accessibility compliance, which can be assessed by running an accessibility scan using Adobe Acrobat Pro, CommonLook, Deque axe extension, or a comparable tool.

9.2 Service Level Agreement

The MSP shall define, for VBA approval, a Service Level Agreement (SLA) for the VR&E Case Management Services and provide for solution availability and reliability as well solution response time within the terms of the SLA

The SLA shall include the following predefined requirements:

o The VR&E Case Management Services shall be operational and have all external interfaces available for access to all services and reporting functions and access to all images and associated metadata 99.9% of the time during any reporting period, exclusive of planned, approved downtime for maintenance. Any planned service periods of unavailability due to routine service updates shall be approved by the COR at least 10 calendar days in advance.

Any service periods of unavailability due to emergency service updates shall be approved by the COR at least three (3) calendar days in advance o For the purposes of this SLA, the Government considers a reporting period to be monthly with 31 days as the average number of days per calendar year. A reporting month is comprised of 44,640 minutes. This SLA requires VR&E Case Management Services availability 99.9% (or 44,416.8 minutes) of any reporting month

The VR&E Readiness & Employment System shall authenticate all personnel authorized to view and update images and associated metadata in accordance with VA Common Security Services guidelines 100% of the time

9.2.1 Acceptance Criteria and User Testing

A set of functional tests shall be performed to verify correct outcomes for all Use Cases, according to acceptance criteria set forth by the business, including, but not limited to exercise expected performance in rejecting incomplete claims, off-ramp operations, as well as all logging and reporting functions. Tests shall ideally be run against non-production instances of the system using only test cases to minimize inadvertent sending of document requests, payments, or other external operation for these tests.

Deliverables resulting from this solicitation will be accepted based in part on satisfaction of the identified Section 508 standards’ requirements for accessibility and must include final test results demonstrating Section 508 compliance.

Deliverables shall meet applicable accessibility requirements and shall not adversely affect accessibility features of existing EIT technologies. The Government reserves the right to independently test for Section 508 Compliance before delivery. The MSP shall be able to demonstrate Section 508 Compliance upon delivery. Automated test tools and manual techniques are used in the VA Section 508 compliance assessment.

9.2.2 Enterprise and IT Framework

To be finalized prior the release of the final solicitation

The MSP shall provide support to VA in obtaining and maintaining an Authority to Operate (ATO), or if acceptable to the Government an IATO for the MSP managed system. Specific information and activities include but are not limited to: security certifications; implementation and contingency plans;

comprehensive management, operational, and technical security controls; code scans, reviews, and technical documentation are required for the ATO compliance and approval. Detailed security requirements will be provided consistent with VA security criteria.

9.3 Solution Outage

The MSP shall notify the COR of any planned/unplanned outages or periods of degraded services supporting this TO as soon as they are identified. For the purposes of this SOO, an outage is defined as any period of complete disruption or interruption of a provided service preventing its usage. Degradation is defined as a decline in the performance of a provided service leading to a negative impact to the normal/intended usage of the service over an established period. The MSP is expected to implement continuous monitoring to ensure the system is operating to support the RES requirements and provide disaster recovery (DR) mechanisms and procedures.

Unless otherwise directed, the MSP shall submit After Action Reports (AAR) to the COR within two (2) calendar days following resolution of any unplanned outages or periods of degraded service. The Government and the MSP will agree on a specified duration of an outage or degraded service requiring an AAR and the reports’ required contents. Based on the severity and potential impacts an outage or period of degraded service may have on users of the impacted service, the MSP will occasionally be required to provide regular (as often as hourly) updates to the Government as to resolution progress.

9.4 Information and Information Technology Security Requirements

To be finalized prior the release of the final solicitation

9.4.1 General

MSP personnel and subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security.

9.4.2 Access To VA Information and VA Information Systems

1. An MSP/subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, subcontractor, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order.

2. All MSP, subcontractor, and third-party servicers and associates working with VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for MSP must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures.

3. Contract personnel who require access to national security programs must have a valid security clearance. National Industrial Security Program (NISP) was established by Executive Order 12829 to ensure that cleared U.S. defense industry contract personnel safeguard the classified information in their possession while performing work on contracts, programs, bids, or research and development efforts. The Department of Veterans Affairs does not have a Memorandum of Agreement with Defense Security Service (DSS). Verification of a Security Clearance must be processed through the Special Security Officer located in the Planning and National Security Service within the Office of Operations, Security, and Preparedness.

4. Custom software development and outsourced operations must be located in the U.S. to the maximum extent practical. If such services are proposed to be performed abroad and are not disallowed by other VA policy or mandates, the MSP/ subcontractor must state where all non- U.S. services are provided and detail a security plan, deemed to be acceptable by VA, specifically to address mitigation of the resulting problems of communication, control, data protection, and so forth. Location within the U.S. may be an evaluation factor.

5. The MSP or subcontractor must notify the Contracting Officer immediately when an employee working on a VA system or with access to VA information is reassigned or leaves the MSP or subcontractor’s employment. The Contracting Officer must also be notified immediately by the MSP or subcontractor prior to an unfriendly termination.

9.4.3 VA Information Custodial Language

1. Information made available to the MSP or subcontractor by VA for the performance or administration of this contract or information developed by the MSP/ subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the MSP/ subcontractor’s rights to use data as described in Rights in Data - General, FAR 52.227-14(d) (1).

2. VA information shall not be co-mingled, if possible, with any other data on the MSPs/ subcontractors information systems or media storage systems in order to ensure VA requirements related to data protection and media sanitization can be met. If co-mingling must be allowed to meet the requirements of the business need, the MSP must ensure that VA's information is returned to the VA or destroyed in accordance with VA's sanitization requirements. VA reserves the right to conduct on-site inspections of MSP and subcontractor IT resources to ensure data security controls, separation of data and job duties, and destruction/media sanitization procedures are in compliance with VA directive requirements.

3. Prior to termination or completion of this contract, MSP/ subcontractor must not destroy information received from VA, or gathered/ created by the MSP in the course of performing this contract without prior written approval by the VA. Any data destruction done on behalf of VA by an MSP/ subcontractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self-certification by the MSP that the data destruction requirements above have been met must be sent to the VA Contracting Officer within 30 days of termination of the contract.

4. The MSP/ subcontractor must receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with the terms of the contract and applicable Federal and VA information confidentiality and security laws, regulations, and policies. If Federal or VA information confidentiality and security laws, regulations and policies become applicable to the VA information or information systems after execution of the contract, or if NIST issues or updates applicable FIPS or Special Publications (SP) after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations, and policies in this contract.

5. The MSP/subcontractor shall not make copies of VA information except as authorized and necessary to perform the terms of the agreement or to preserve electronic information stored on…