RFI -36C10A24Q0066 - Draft PWS 4.17.24.pdf

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Office of Information & Technology Financial Service Center

Permanent Change of Station (PCS) Relocation

Software as a Service (SaaS) Solution

Date: 04/17/2024

VA-25-00000406

PWS Version Number: 1.0

PCS Relocation SaaS Solution

1.0 BACKGROUND

The Department of Veterans Affairs (VA), Office of Information & Technology (OIT), Financial Service Center (FSC) strives to provide high quality, effective, and efficient Information Technology (IT) services to those responsible for providing care to the Veterans at the point-of-care as well as throughout all the points of the Veterans’ health care in an effective, timely and compassionate manner. VA depends on Information Management/Information Technology (IM/IT) systems to meet mission goals.

VA FSC requires a SaaS product to automate the expense management related to the relocation of federal employees. This SaaS solution will be needed to handle all relocations created by any PCS action. FCS requires the SaaS product to be comprehensive, fully compliant, and complete functional solution designed expressly for federal government civilian and military agencies, and contractors to manage employee relocation expenses.

2.0 APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. 44 U.S.C. § 3541-3549, “Federal Information Security Management Act (FISMA) of 2002”

2. “Federal Information Security Modernization Act of 2014”

3. Federal Information Processing Standards (FIPS) Publication 140-2, “Security Requirements for Cryptographic Modules”

4. FIPS Pub 199. “Standards for Security Categorization of Federal Information and Information Systems,” February 2004

5. FIPS Pub 200, “Minimum Security Requirements for Federal Information and

Information Systems,” March 2006

6. FIPS Pub 201-2, “Personal Identity Verification of Federal Employees and

Contractors,” August 2013

7. 10 U.S.C. § 2224, "Defense Information Assurance Program"

8. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

9. Public Law 109-461, Veterans Benefits, Health Care, and Information

Technology Act of 2006, Title IX, Information Security Matters

10. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”

11. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, https://www.va.gov/vapubs/index.cfm

12. VA Handbook 0710, “Personnel Security and Suitability Program,” May 2, 2016, https://www.va.gov/vapubs/index.cfm

13. VA Directive and Handbook 6102, “Internet/Intranet Services,” August 5,

14. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and Guidelines,” January 18, 2017

15. Office of Management and Budget (OMB) Circular A-130, “Managing Federal

Information as a Strategic Resource,” July 28, 2016 https://www.va.gov/vapubs/index.cfm https://www.va.gov/vapubs/index.cfm http://www.va.gov/vapubs http://www.va.gov/vapubs

16. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended, January 18, 2017

17. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

18. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021

19. VA Handbook 6500, “Risk Management Framework for VA Information

Systems VA Information Security Program,” February 24, 2021

20. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI),” March 12, 2019

21. VA Handbook 6500.5, “Incorporating Security and Privacy into the System Development Lifecycle,” March 22, 2010

22. VA Handbook 6500.6, “Contract Security,” March 12, 2010

23. VA Handbook 6500.8, “Information System Contingency Planning,” April 6,

24. VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018

25. VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017

26. OIT Process Asset Library (PAL), https://www.va.gov/process/ . Reference

Process Maps at https://www.va.gov/process/maps.asp and Artifact templates at https://www.va.gov/process/artifacts.asp

27. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

28. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014

29. VA Handbook 6508.1, “Procedures for Privacy Threshold Analysis and Privacy Impact Assessment,” July 30, 2015

30. VA Handbook 6510, “VA Identity and Access Management,” January 15,

31. VA Directive and Handbook 6513, “Secure External Connections,” October 12, 2017

32. VA Directive 6300, “Records and Information Management,” September 21,

33. VA Handbook, 6300.1, “Records Management Procedures,“ March 24, 2010

34. NIST SP 800-37 Rev 2, “Risk Management Framework for Information

Systems and Organizations: A System Life Cycle Approach for Security and Privacy,” December 2018

35. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020)

36. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015

37. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-

12) Program,” March 24, 2014

38. OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005 https://www.va.gov/process/ https://www.va.gov/process/maps.asp https://www.va.gov/process/artifacts.asp https://www.va.gov/trm/TRMHomePage.aspx

39. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019

40. OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008

41. Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance, December 2, 2011, (NOTE: Part A of the FICAM Roadmap and Implementation Guidance, v2.0, was replaced in 2015 with an updated Architecture (https://arch.idmanagement.gov/#what-is-the-ficam-architecture)

42. NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access,“ June 2018

43. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, “Digital Identity Guidelines,” updated March 02, 2020

44. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014

45. NIST SP 800-164, “Guidelines on Hardware-Rooted Security in Mobile

Devices (Draft),” October 2012

46. Draft National Institute of Standards and Technology Interagency Report

(NISTIR) 7981, “Mobile, PIV, and Authentication,” March 2014

47. VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland

Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

48. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

49. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

50. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

51. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019

52. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008

53. VA Directive 0058, “VA Green Purchasing Program,” July 19, 2013

54. VA Handbook 0058, “VA Green Purchasing Program,” July 19, 2013

55. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote

Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

56. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

57. “Veteran Focused Integration Process (VIP) Guide 4.0,” January 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

58. VA Memorandum “Proper Use of Email and Other Messaging Services,”

January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

59. “DevSecOps Product Line Management Playbook” version 2.0, May 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946 https://arch.idmanagement.gov/#what-is-the-ficam-architecture https://arch.idmanagement.gov/#what-is-the-ficam-architecture https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514 https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896 https://www.cisa.gov/publication/tic-30-core-guidance-documents https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371 https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

60. NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020

61. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol

Version 6 (IPv6),” November 19, 2020

62. Social Security Number (SSN) Fraud Prevention Act of 2017

63. Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23,

3.0 SCOPE OF WORK

The Contractor shall provide a SaaS solution consisting of a product with modern-day technology to process relocation moves faster and eliminate manual work for current staff. The SaaS product shall fully support FSC PCS relocation needs to increase capacity and comply with Federal regulations and VA requirements. The SaaS PCS product shall receive automated updates of per diem rates and Federal Travel Regulation changes without manual system enhancements, improve timeliness by reducing the number of steps involved to publish orders which results in enhanced customer satisfaction, comply with Chief Information Office (CIO) Cloud initiative for security monitoring, utilize built in enhanced reporting features, business user capability to modify the system based on entitlements, taxation, and user access changes.

The PCS SaaS solution shall provide the following functions and capabilities to the FSC PCS Travel Division needs:

• The SaaS solution shall be authorized at the FedRAMP MODERATE level and meet Federal Information Security Management Act (FISMA) Moderate requirements, 508 compliant, and Defense Finance and Accounting Service (DFAS) Tax File Processing Automation.

• Integration with VA financial system Integrated Financial and Acquisition Management System (iFAMS), Financial Management System (FMS), and Single sign-on (SSO).

• Implementation of the system, including software installation, data migration, testing, and deployment support.

• Change and configuration management.

• Training support shall be available through the duration of the contract period of performance.

• 24/7 on-call technical support.

• Product service and support including technical support and Service.

• Cloud Service

• Obtain Memorandum of Understanding/Interconnection Security

Agreement (MOU/ISA).

• Installation of software upgrades, patches, and releases.

• System shall be able to push and pull PII data.

4.0 PERFORMANCE DETAILS

4.1 PERFORMANCE PERIOD

The PoP shall be consist of a 12-month base period from date of award and four 12-month option periods and optional tasks. The overall PoP shall not exceed 60 months.

Any work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO).

There are eleven (11) Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, five are set by date:

New Year's Day January 1 Juneteenth June 19 Independence Day July 4 Veterans Day November 11 Christmas Day December 25

If any of the above falls on a Saturday, then Friday shall be observed as a holiday.

Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

Martin Luther King's Birthday Third Monday in January Washington's Birthday Third Monday in February Memorial Day Last Monday in May Labor Day First Monday in September Columbus Day Second Monday in October Thanksgiving Fourth Thursday in November

4.2 PLACE OF PERFORMANCE

Tasks under this PWS shall be performed at Contractor facilities. The Contractor shall identify the Contractor’s place of performance in their proposal submission.

4.3 TRAVEL

The Government anticipates travel under this effort to perform the tasks associated with the effort, as well as to attend program-related meetings or conferences throughout the PoP. Include all estimated travel costs in your firm-fixed price line items. These costs will not be directly reimbursed by the Government.

The total estimated number of trips in support of the program related meetings for this effort is one. Anticipated locations include the following, estimated at one days in duration at Financial Services Center, Austin, Texas.

5.0 SPECIFIC TASKS AND DELIVERABLES

The Contractor shall perform the following:

5.1 PROJECT MANAGEMENT

5.1.1 CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, timeline, and tools to be used in execution of the contract. The CPMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks, and resource support. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPMP shall be concurred upon and updated in accordance with Section B of the contract. The Contractor shall update and maintain the VA PM approved CPMP throughout the PoP.

Deliverable:

A. Contractor Project Management Plan

5.1.2 REPORTING REQUIREMENTS

The Contractor shall provide the COR with Monthly Progress Reports in electronic form in Microsoft Word and Project formats. The report shall include detailed instructions/explanations for each required data element, to ensure that data is accurate and consistent. These reports shall reflect data as of the last day of the preceding Month.

The Monthly Progress Reports shall cover all work completed during the reporting period and work planned for the subsequent reporting period. The report shall also identify any problems that arose and a description of how the problems were resolved. If problems have not been completely resolved, the Contractor shall provide an explanation including their plan and timeframe for resolving the issue. The report shall also include an itemized list of all Information and Communication Technology (ICT) deliverables and their current Section 508 conformance status. The Contractor shall monitor performance against the CPMP and report any deviations. It is expected that the Contractor will keep in communication with VA accordingly so that issues that arise are transparent to both parties to prevent escalation of outstanding issues.

Deliverable:

A. Monthly Progress Report

5.1.3 TECHNICAL KICKOFF MEETING

A technical kickoff meeting shall be held within 10 days after TO award. The Contractor shall coordinate the date and time of a virtual meeting with the Contracting Officer (CO), the VA PM, the Contract Specialist, and the Contracting Officer Representative (COR). The Contractor shall provide a draft agenda to the CO and VA PM at least five (5) calendar days prior to the meeting. Upon Government approval of a final agenda, the Contractor shall distribute to all meeting attendees. The Contractor shall prepare and distribute the meeting minutes of the kickoff meeting to the CO, COR, and all attendees within three (3) calendar days after the meeting. The Contractor shall obtain concurrence from the COR on the content of the meeting minutes prior to distribution of the document.

Deliverables:

A. Kickoff Meeting Agenda B. Kickoff Meeting Minutes

5.2 PERMANENT CHANGE OF STATION (PCS) RELOCATION SOFTWARE

AS A SERVICE (SAAS) PRODUCT

The Contractor shall provide a SaaS solution to manage employee relocation expenses across the VA and capable of remaining current with updates. The PCS SaaS solution shall provide the following business capabilities that are required to comply with all Federal Regulations, FCS customer needs, and user experience:

A. This solution is Cloud-based and FedRAMP compliant making it compatible with OIT Cloud-First Initiative.

B. This solution offers multiple communications channels and is accessible via a laptop, tablet, or phone with no degradation in user experience.

C. The software solution provides end-to-end automated processes to slash timelines and workloads.

D. Improve accounting of obligated and de-obligated funds as expenses occur and are closed out.

E. Support faster payment of vendors and transferees and reduce/eliminate prompt payment interest.

F. Increase auditability to identify any fraud/abuse.

G. Centralized database that stores detailed record level expense data for all relocation allowances (i.e. house hunting trips, household goods, en route travel, temporary quarters, real estate, miscellaneous expenses, taxes, etc.);

H. Solution is adaptive and is personalized to the user with analytics (i.e. report date, authorization number, duty station information, accounting codes, name, addresses, dependents, salary, etc.) to optimize performance and storage of information.

I. Automates Federal Travel Regulations, Joint Travel Regulations, Department of State Standardized Regulations, and Foreign Affairs Manual Continental United States/Outside the Continental United States relocation policies.

J. Adheres to E-Gov Travel, General Services Administration/Office of Management and Budget reporting, and Section 508 standards, as well as holds FedRAMP/Defense Information Systems Agency IL-4 authorization.

K. Compliance with SSO and two factor authentication requirements.

L. Integration with VA financial system Integrated and Financial and Acquisition Management System, Financial Management System and Defense Finance and Accounting Service (DFAS) Tax File Processing Automation.

M. Process relocation expense documents through the entire lifecycle, including authorizations, vouchers, Relocation Income Tax Allowance (RITA) payments, and amendment documents. Also, generates year end W2 forms, stores document history and presents all documents as printable forms.

N. Workflow and receipt management for completely paperless processing.

O. Replace manual survey process with the ability to allow employees to electronically submit key relocation data necessary for authorizations.

P. Support of Applicability Statement 2 (AS2) instead of Secure File Transfer

Protocol (SFTP).

Q. Automation of SSO User Account Provisioning.

R. automation functionality (workflow report, assigning claims to claims processors, sending automated emails for Travel Authorization expiration notifications.

S. Provide an Activity Log on the relocation screen.

T. Fillable PDF documents.

U. The ability to make relocation notes for internal use only.

V. Make relocation attachments viewable in some portals.

W. Make attachments viewable in some portals.

X. Provide a Help Guide drop-down menu.

Y. Remove date of birth and vendor code on print previews.

Z. Allowing for vendor code interface with Integrated Financial and Acquisition

Management System.

AA. Update to IFAMS agreement number and line interface.

BB. Integration with Integrated Personnel and Pay System (IPPS) for auto creation of vouchers.

CC. Custom email notification generation based on relocation assigned to field selection.

DD. Integration maintenance to support interface functions.

EE. The Contractor shall

1. Support and provide a secure automated SaaS online platform to process employee relocation expenses.

2. Maintain and host data in an environment authorized for use at the FedRAMP Moderate impact level. The FedRAMP framework includes continuous monitoring of baseline controls for security and encryption. Therefore, when the data is entered on the form, e.g. Date Of Birth, Social Security Number, address, etc., that data is secure in the FedRAMP environment when in process and when at rest.

3. Archive forms (3918,3036, RITA, etc.) processed via workflow and sent as a

PDF via encrypted Digital Rights Email for storage on vendor secured site.

The VA retains the data for auditing and historical access.

4. Ensure the security protocol of the data during the transmission is Secure

Sockets Layer (SSL). There are certain project-level controls such as user authentication which the customer (VA stakeholders) must implement later during the VA Authority To Operate (ATO) process.

5. Allow capability to create the new relocations customized forms in the system.

6. Allow capability for Users and Groups to be added.

7. Allow capability for data to be saved to a Hosting Service Microsoft Azure

Government Cloud Database so the reporting team can create reports on relocation move data. The information is collected via a Web Form based on the customer requirements. The form data resides on the: Hosting Service Cloud Server. VA personnel will access the A Hosting Service Cloud Server to retrieve any relocation move forms for review and approval. The Hosting Service Cloud Server Web Based system will be SSL based.

8. Ensure online relocation forms will provide capability to perform analytics on application data fields.

9. Ensure web-based relocation move process must comply with VA Handbooks and Directives.

10. Ensure web-based relocation move process must be 508 compliant.

11. Conduct load testing to ensure optimal performance measures as per potential demand.

12. Conduct end to end testing to ensure the entire process integrates and performs as required given the varied scenarios of end user environments.

13. Provide “Train the Trainer” documentation, facilitation, and support.

14. Ensure technical support for users will be available post-implementation.

15. Maintain web-based relocation move process availability for users 24 hours per day/7 days per week.

16. Provide Consulting Services and Project Management support.

Deliverables:

A. Archive forms (3918,3036, RITA, etc.) processed via workflow and sent as a PDF via encrypted Digital Rights Email for storage on vendor secured site

B. Train-the-trainer documentation.

5.3 CONFIGURATION & IMPLEMENTATION

5.3.1 REQUIREMENTS

During the implementation, the Contractor shall complete requirements sessions with the VA FSC customer, users, and OI&T staff (hereinafter “VA Team”) to properly understand and refine PCS requirements for implementation. The outcome shall be a detailed understanding of VA customer needs which shall be documented in Requirements Session Meeting Notes

A. Requirements Sessions Meeting Notes

5.3.2 CONFIGURATION AND IMPLEMENTATION

The Contractor shall provide PCS application configuration services that are consistent with its standard implementation and deployment methodology. The Contractor shall configure the application to meet all VA’s requirements as stipulated in this PWS. The Contractor shall provide guidance on alternative approaches to minimize future customizations of the application. The Contractor shall perform all configuration of the systems prior to deployment. The Contractor shall prepare a Change and Configuration Management Plan in accordance with all applicable regulatory policy and guidance. The Change and Configuration Management Plan shall contain all information relevant to defining and modifying the application from the initial baseline configuration and subsequent re-baselining activities.

A. Change and Configuration Management Plan

5.3.3 TEST & EVALUATION (T & E)

The Contractor shall support the testing by the VA (e.g., unit, functional, accessibility, system, reliability, usability, interoperability, regression, security, performance) throughout the implementation cycle using industry best practices.

The Contractor shall correct or mitigate any deficiencies discovered during such testing, at no additional cost.

5.4 SUPPORT

The Contractor shall provide operations support and systems maintenance support of the application for the life of the task order to include each Option Period as follows:

1. The Contractor shall ensure the application is maintained to the most recent approved baseline.

2. The Contractor shall perform software maintenance activities that may include version and release upgrades, security updates or patches, performance enhancements, data cleansing/archiving, and application modifications. The Contractor shall provide notifications or access to release documentation.

3. The Contractor shall provide proactive operation health monitoring of the application. The Contractor shall provide either notification or access to information about the application availability.

4. The Contractor shall provide a 24/7 toll-free monitored Help Desk number to provide application support services for users of the application. Any telephone support provided by the Contractor shall be at no additional cost.

Unresolved support issues will be elevated to the VA Enterprise Service Desk for submission of a service ticket. The Contractor shall provide input and technical support to VA help/service desks on all layers until resolution.

A. Toll-Free Help Desk Phone Number B. Notifications or access to release documentation C. Notification or access to information about the application availability

5.5 ASSESSMENT, AUTHORIZATION, AND CONTINUOUS MONITORING

If the solution is not FedRAMP authorized:

1. The information system solution selected by the Contractor shall comply with the

Federal Information Security Management Act (FISMA).

2. The Contractor shall comply with FedRAMP requirements within 30 days after award as mandated by Federal laws and policies, including making available any documentation, physical access, and logical access needed to support this requirement.

3. The Contractor shall provide a SaaS product as defined by the following criteria:

Software as a Service (SaaS) is an application delivery model in which the application is hosted on a cloud infrastructure outside the security boundary of VA and is provided to the Cloud Service Customer (CSC) over the internet. The CSC uses the SaaS offering via a thin-client interface, such as a web-browser or a program interface. The CSC subscribes to the SaaS offering and is only responsible https://www.fedramp.gov/agency-authorization/ for minor in-app customizations. The Cloud Service Provider (CSP) offering the application is responsible for management of the application, safeguarding of data stored or processed by the application, and all elements of the underlying infrastructure. Additionally, the CSP is responsible for all on-going compliance.

In order to qualify as SaaS for use at VA, and to align with Federal Risk and Authorization Management Program (FedRAMP) requirements, the hosting for the offering must conform to the NIST 800-145 definition of Cloud Computing and thus contain following key characteristics:

• On-Demand Self-Service: The CSP fully automates the provisioning of both the customer interface and the underlying cloud components of the SaaS offering. In some cases, to the CSP may provision internal resources manually, while providing the CSC an automated interface to request and track the service.

• Broad Network Access: The SaaS capabilities are available over the internet or over a network that is available from all access points the CSC requires. The SaaS offering is accessible through common platforms (e.g., mobile phones, tablets, laptops, and workstations).

• Resource Pooling: The computing infrastructure supporting the SaaS offering is shared among more than one CSC using a multi-tenant model, and resources are dynamically assigned depending on customer demand.

• Rapid Elasticity: Computing capabilities are automatically provisioned and released in a manner that scales with customer demand. In some cases, the scaling of resources may not be fully automated, but it should be fast enough to support the needs of the CSC, which the CSC would have to define.

• Measured Service: Resource usage, such as storage, processing, bandwidth, and user activity are measured and reported on in a manner that is relevant to the SaaS offering.

The SaaS offering must be hosted within the United States and data stored/processed/transmitted within the offering must remain within the United States. CSPs should be aware of FedRAMP and ready to partner with VA through the SaaS FedRAMP Authorization process.

4. Following guidance from the Federal CIO, VA will utilize existing JAB ATO or agency ATO issued by another agency as a starting point for FedRAMP requirements. If neither of those exist, VA will sponsor The Cloud Service Provider for a FedRAMP Authorization. VA will be using the FedRAMP baselines as a starting point, since they are specifically tailored for cloud services.

5. The Contractor shall, where applicable, assist with the VA ATO Process to help achieve agency authorization of the cloud service or migrated application at the impact level required by VA to utilize the product. For this solution the required impact level is: Moderate.

6. The Contractor shall complete a FedRAMP System Security Plan (SSP) and supporting documentation including required attachments within 75 calendar days after contract award.

7. The Contractor shall develop a VA specific system boundary diagram including any integration and connectivity components that will be known as a VA Implementation Diagram (VAID) demonstrating the proposed implementation of this system at VA.

The Contractor shall provide the VAID within 10 calendar days of contract award.

8. The Contractor shall complete a Third-Party Assessment Organization (3PAO) Security Assessment Plan (SAP) within 90 calendar days after contract award.

9. The Contractor shall complete a 3PAO Security Assessment Report (SAR) within 90 calendar days after the SSP is accepted by VA. Contractor shall work with assigned VA SME to develop a VA specific Incident Response Plan (IRP) and perform an IRP Table Top Exercise with VA Stakeholders. This should be completed within 30 calendar days of the SSP being delivered.

10. The Contractor shall afford VA access to the Contractor’s and Cloud Service Provider’s (CSP) facilities, installations, technical capabilities, operations, documentation, records, and databases.

11. If new or unanticipated vulnerabilities are discovered by either VA or the Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party in accordance with Addendum B, VA Information and Information System Security/Privacy Language.

12. The Contractor shall comply with data management requirements.

13. Successful issuance of a VA ATO will be required before live VA data can be used in the system.

A. FedRAMP System Security Plan (SSP) and supporting documentation B. VA Implementation Diagram: This is a VA specific architecture diagram demonstrating the proposed implementation of this system at VA (VAID) C. 3PAO Security Assessment Plan (SAP) D. 3PAO Security Assessment Report (SAR) E. IRP Scenario

If the solution is FedRAMP Authorized but not VA Authorized:

1. The information system solution selected by the Contractor shall comply with the

Federal Information Security Management Act (FISMA)

2. The Contractor shall comply with FedRAMP requirements as mandated by

Federal laws and policies, including making available any documentation, physical access, and logical access needed to support this requirement

3. The system must be FedRAMP Authorized at no less than the 30 days after contract award.

4. The Contractor shall, where applicable, assist with the VA ATO Process to help achieve agency authorization of the cloud service or migrated application.

5. The Contractor shall develop a VA specific system boundary diagram including any integration and connectivity components that will be known as a VA Implementation Diagram (VAID) demonstrating the proposed implementation of this system at VA. The Contractor shall provide the VAID within 10 calendar days of contract award.

6. The Contractor shall provide confirmation of their FedRAMP System Security Plan (SSP) and supporting documentation completion via their repository ID number and a link for VA to download the SSP and all required artifacts within 5 calendar days of contract award.

7. The Contractor shall provide the results of their most recent Third-Party Assessment Organization (3PAO) Security Assessment Plan (SAP) within 10 calendar days of contract award.

8. The Contractor shall complete a 3PAO Security Assessment Report (SAR) within 10 calendar days after the SSP is accepted by VA.

9. The Contractor shall provide VA with the most recent monthly scans for the production environment within the authorization boundary and their scan upload schedule for FedRAMP within 30 calendar days of contract award.

10. The Contractor shall provide their availability to participate in monthly continuous monitoring meetings to be scheduled following successful VA ATO within 30 calendar days of contract award.

11. Contractor shall work with assigned VA SME to develop a VA specific Incident Response Plan (IRP) and perform an IRP Table Top Exercise with VA Stakeholders. This should be completed within 30 calendar days of the SAR being delivered.

12. If new or unanticipated vulnerabilities are discovered by either VA or the Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party in accordance with Addendum B, VA Information and Information System Security/Privacy Language

13. The Contractor shall comply with data management requirements.

14. Successful issuance of a VA ATO will be required before live VA data can be used in the system.

A. VA Implementation Diagram B. FedRAMP System Security Plan (SSP) and supporting documentation C. 3PAO Security Assessment Plan (SAP) D. 3PAO Security Assessment Report (SAR) E. IRP Scenario

If the solution is FedRAMP Authorized and VA Authorized:

1. The information system solution selected by the Contractor shall comply with the

Federal Information Security Management Act (FISMA) and have a current VA authorization.

2. The Contractor shall comply with FedRAMP requirements as mandated by Federal laws and policies, including making available any documentation, physical access, and logical access needed to support this requirement.

3. The FedRAMP Authorization level and existing VA ATO should be no less than the level required for this use case which has been defined as moderate.

4. The Contractor shall, where applicable, assist with the VA ATO Sustainment Process to help maintain health and quality of agency authorization of the cloud service or migrated application.

5. The Contractor shall exclusively provide licenses and/or accounts to FedRAMP authorized and VA authorized environments.

6. The Contractor shall afford VA access to the Contractor’s and Cloud Service Provider’s (CSP) facilities, installations, technical capabilities, operations, documentation, records, and databases.

7. If new or unanticipated vulnerabilities are discovered by either VA or the Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party in accordance with Addendum B, VA Information and Information System Security/Privacy Language

8. The Contractor shall comply with data management requirements.

9. Successful issuance of a VA ATO will be required before live VA data can be used in the system.

10. The Contractor shall participate in monthly Agency and FedRAMP Sustainment meetings following the granting of a VA ATO.

11. The Contractor shall provide continuous monitoring activities including scans, security artifacts, and monthly Plan of Action and Milestones (POAM) reports as outlined by FedRAMP requirements.

A. Continuous monitoring security artifacts B. Continuous monitoring scans C. Plan of Action and Milestones reports.

6.0 GENERAL REQUIREMENTS

6.1 ENTERPRISE AND IT FRAMEWORK

6.1.1 VA TECHNICAL REFERENCE MODEL

Not Applicable.

6.1.2 FEDERAL IDENTITY, CREDENTIAL, AND ACCESS MANAGEMENT (FICAM)

The Contractor shall ensure Commercial Off-The-Shelf (COTS) product(s), software configuration and customization, and/or new software are Personal Identity Verification (PIV) card-enabled by accepting HSPD-12 PIV credentials using VA Enterprise Technical Architecture (ETA), https://www.ea.oit.va.gov/EAOIT/VA_EA/Enterprise_Technical_Architecture.asp, and VA Identity and Access Management (IAM) approved enterprise design and integration patterns, https://www.oit.va.gov/library/recurring/edp/index.cfm. The Contractor shall ensure all Contractor delivered applications and systems comply with the VA Identity, Credential, and Access Management policies and guidelines set forth in VA Handbook 6510 VA Identity and Access Management, VA Handbook 0735 Homeland Security Presidential Directive 12 (HSPD-12) Program, and align with the Federal Identity, Credential, and Access Management Roadmap and Implementation Guidance v2.0.

The Contractor shall ensure all Contractor delivered applications and systems provide user authentication services compliant with the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-63-3, VA Handbook 6500 Appendix F, “VA System Security Controls”, and VA IAM enterprise requirements for direct, assertion based authentication, and/or trust based authentication, as determined by the design and integration patterns. Direct authentication at a minimum must include Public Key Infrastructure (PKI) based authentication supportive of PIV card and/or Common Access Card (CAC), as determined by the business need.

The Contractor shall ensure all Contractor delivered applications and systems conform to the specific Identity and Access Management PIV requirements set forth in the Office of Management and Budget (OMB) Memoranda M-05-24, M-19-17, and NIST Federal Information Processing Standard (FIPS) 201-2. OMB Memoranda M-05-24 and M-19- 17 can be found at:

https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2005/m05- 24.pdf, and https://www.whitehouse.gov/wp-content/uploads/2019/05/M-19-17.pdf respectively. Contractor delivered applications and systems shall be on the FIPS 201-2 Approved Product List (APL). If the Contractor delivered application and system is not on the APL, the Contractor shall be responsible for taking the application and system through the FIPS 201 Evaluation Program.

The Contractor shall ensure all Contractor delivered applications and systems support:

1. Automated provisioning and are able to use enterprise provisioning service.

2. Interfacing with VA’s Master Person Index (MPI) to provision identity attributes, if the solution relies on VA user identities. MPI is the authoritative source for VA user identity data.

3. The VA defined unique identity (Secure Identifier [SEC ID] / Integrated Control Number [ICN]).

4. Multiple authenticators for a given identity and authenticators at every Authenticator Assurance Level (AAL) appropriate for the solution.

5. Identity proofing for each Identity Assurance Level (IAL) appropriate for the solution.

6. Federation for each Federation Assurance Level (FAL) appropriate for the solution, if applicable.

7. Two-factor authentication (2FA) through an applicable design pattern as outlined in VA Enterprise Design Patterns.

https://www.ea.oit.va.gov/EAOIT/VA_EA/Enterprise_Technical_Architecture.asp https://www.oit.va.gov/library/recurring/edp/index.cfm https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2005/m05-24.pdf https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2005/m05-24.pdf https://www.whitehouse.gov/wp-content/uploads/2019/05/M-19-17.pdf

8. A Security Assertion Markup Language (SAML) implementation if the solution relies on assertion-based authentication. Additional assertion implementations, besides the required SAML assertion, may be provided as long as they are compliant with NIST SP 800-63-3 guidelines.

9. Authentication/account binding based on trusted Hypertext Transfer Protocol (HTTP) headers if the solution relies on Trust based authentication.

10. Role Based Access Control.

11. Auditing and reporting capabilities.

12. Compliance with VIEWS 00155984, PIV Logical Access Policy Clarification https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896.

The required Assurance Levels for this specific effort are Identity Assurance Level 3, Authenticator Assurance Level 3, and Federation Assurance Level 3.

6.1.3 INTERNET PROTOCOL VERSION 6 (IPV6)

The Contractor solution shall support Internet Protocol Version 6 (IPv6) based upon the memo issued by the Office of Management and Budget (OMB) on November 19, 2020 (https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-07.pdf). IPv6 technology, in accordance with the USGv6 Program (https://www.nist.gov/programs-projects/usgv6-program/usgv6-revision-1), NIST Special Publication (SP) 500-267B Revision 1 “USGv6 Profile” (https://doi.org/10.6028/NIST.SP.500-267Br1), and NIST SP 800-119 “Guidelines for the Secure Deployment of IPv6” (https://doi.org/10.6028/NIST.SP.800-119), compliance shall be included in all IT infrastructures, application designs, application development, operational systems and sub-systems, and their integration. In addition to the above requirements, all devices shall support native IPv6 and dual stack (IPv6 / IPv4) connectivity without additional memory or other resources being provided by the Government, so that they can function in a mixed environment. All public/external facing servers and services (e.g.

web, email, DNS, ISP services, etc.) shall support native IPv6 and dual stack (IPv6 / IPv4) users and all internal infrastructure and applications shall communicate using native IPv6 and dual stack (IPv6 / IPv4) operations.

6.1.4 TRUSTED INTERNET CONNECTION (TIC)

The Contractor solution shall meet the requirements outlined in Office of Management and Budget Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative“ (https://www.whitehouse.gov/wp-content/uploads/2019/09/M-19-26.pdf), VA Directive 6513 “Secure External Connections”, and shall comply with the TIC 3.0 Core Guidance Documents, including all Volumes and TIC Use Cases, found at the Cybersecurity & Infrastructure Security Agency (CISA) (https://www.cisa.gov/publication/tic-30-core-guidance-documents). Any deviations must be approved by the VA TIC 3.0 Working Group at vaoisesatic30team@va.gov.

https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896 https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-07.pdf file://R04.med.va.gov/V03/EAS/Users/vhaeasWymbsk/TEMPLATES--NEW%20TAC%20PROCESS/PWS%20TEMPLATE%20(DO%20NOT%20TOUCH)%20-%20In%20Process%20Revisions/DO%20NOT%20TOUCH%20(next%20version/IPv6/(https:/www.nist.gov/programs-projects/usgv6-program/usgv6-revision-1 file://R04.med.va.gov/V03/EAS/Users/vhaeasWymbsk/TEMPLATES--NEW%20TAC%20PROCESS/PWS%20TEMPLATE%20(DO%20NOT%20TOUCH)%20-%20In%20Process%20Revisions/DO%20NOT%20TOUCH%20(next%20version/IPv6/(https:/www.nist.gov/programs-projects/usgv6-program/usgv6-revision-1 https://doi.org/10.6028/NIST.SP.500-267Br1 https://doi.org/10.6028/NIST.SP.800-119 https://www.whitehouse.gov/wp-content/uploads/2019/09/M-19-26.pdf https://www.cisa.gov/publication/tic-30-core-guidance-documents mailto:vaoisesatic30team@va.gov

6.1.5 STANDARD COMPUTER CONFIGURATION

The Contractor IT end user solution that is developed for use on standard VA computers shall be compatible with and be supported on the standard VA operating system, currently Windows 10 (64bit), Edge (Chromium based), and 365 Apps for enterprise. Applications delivered to VA and intended to be deployed to Windows 10 workstations shall be delivered as a signed .msi package with switches for silent and unattended installation and updates shall be delivered in signed .msp file formats for easy deployment using Microsoft Endpoint Configuration Manager (CM) VA’s current desktop application deployment tool. Signing of the software code shall be through a vendor provided certificate that is trusted by VA using a code signing authority such as Verizon/Cybertrust or Symantec/VeriSign. The Contractor shall also ensure and certify that their solution functions as expected when used from a standard VA computer, with non-admin, standard user rights that have been configured using the United States Government Configuration Baseline (USGCB) and Defense Information Systems Agency (DISA) Secure Technical Implementation Guide (STIG) specific to the particular client operating system being used.

6.1.6 VETERAN FOCUSED INTEGRATION PROCESS (VIP) AND PRODUCT LINE

MANAGEMENT (PLM)

The Contractor shall support VA efforts IAW the updated Veteran Focused Integration Process (VIP) and Product Line Management (PLM). The major focus of the new VIP is on Governance and Reporting and is less prescriptive, with a focus on outcomes and continuous delivery of value. Product Line Management (PLM) is a framework that focuses on delivering functional products that provide the highest priority work to customers while delivering simplified, reliable, and practical solutions to the business, medical staff, and our Veterans. The VIP Guide is a companion guide to the PLM Playbook and can be found at:

https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371 and the PLM Playbook can be found at https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946. The PLM Playbook pivots from project-centric to product-centric delivery and contains descriptive practices that focuses on outcomes. The PLM Playbook contains a set of “plays” that implement Development, Security, and Operations (DevSecOps) principles and processes such as automated development, continuous integration/continuous delivery, and release on demand. The PLM Playbook details how product lines implement Lean-Agile principles, methods, practices, and techniques through levels of maturity. VIP and PLM are the authoritative processes that IT projects must follow to ensure development and delivery of IT products.

6.1.7 PROCESS ASSET LIBRARY (PAL)

The Contractor shall perform their duties consistent with the processes defined in the OIT Process Asset Library (PAL). The PAL scope includes the full spectrum of OIT https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946 functions and activities, such as VIP project management, operations, service delivery, communications, acquisition, and resource management. PAL serves as an authoritative and informative repository of searchable processes, activities or tasks, roles, artifacts, tools and applicable standards and guides to assist the OIT workforce, Government and Contractor personnel. The Contractor shall follow the PAL processes to ensure compliance with policies and regulations and to meet VA quality standards. The PAL includes the contractor onboarding process consistent with Section

6.2.2 and can be found at https://www.va.gov/PROCESS/artifacts/maps/process_CONB_ext.pdf. The main PAL can be accessed at www.va.gov/process.

6.1.8 AUTHORITATIVE DATA SOURCES

The VA Enterprise Architecture Repository (VEAR) is one component within the overall EA that establishes the common framework for data taxonomy for describing the data architecture used to develop, operate, and maintain enterprise applications. The Contractor shall comply with the department’s Authoritative Data Source (ADS) requirement that VA systems, services, and processes throughout the enterprise shall access VA data solely through official VA ADSs where applicable, see below. The Information Classes which compose each ADS are located in the VEAR, in the Data & Information domain. The Contractor shall ensure that all delivered applications and system solutions support:

1. Interfacing with VA’s Master Person Index (MPI) (formerly the Master Veteran Index (MVI)) to provision identity attributes, if the solution relies on VA user identities. MPI is the authoritative source for VA user identity data.

2. Interfacing with Capital Asset Inventory (CAI) to conduct real property record management actions, if the solution relies on real property records data. CAI is the authoritative source for VA real property record management data.

3. Interfacing with electronic Contract Management System (eCMS) for access to contract, contract line item, purchase requisition, offering vendor and vendor, and solicitation information above the micro-purchase threshold, if the solution relies on procurement data. ECMS is the authoritative source for VA procurement actions data.

4. Interfacing with Vet360 to access personal contact information, if the solution relies on VA Veteran personal contact information data. Vet360 is the authoritative source for VA Veteran Personal Contact Data.

5. Interfacing with VA/Department of Defense (DoD) Identity Repository (VADIR) for determining eligibility for VA benefits under Title 38, if the solution relies on qualifying active duty military service data. VADIR is the authoritative source for Qualifying Active Duty military service in VA.

6.1.9 SOCIAL SECURITY NUMBER (SSN) REDUCTION

https://www.va.gov/PROCESS/artifacts/maps/process_CONB_ext.pdf http://www.va.gov/process

The Contractor solution shall support the Social Security Number (SSN) Fraud Prevention Act (FPA) of 2017 which prohibits the inclusion of SSNs on any document sent by mail. The Contractor support shall also be performed in accordance with Section 240 of the Consolidated Appropriations Act (CAA) 2018, enacted March 23, 2018, which mandates VA to discontinue using SSNs to identify individuals in all VA information systems as the Primary Identifier. The Contractor shall ensure that any new IT solution discontinues the use of SSN as the Primary Identifier to replace the SSN with the ICN in all VA information systems for all individuals.