S02 36C10X25R0009 4.14.2025.docx

36C10X25R0009 - VA Police Cameras and Evidence Management System

PAGE 1 OF

1. REQUISITION NO.

2. CONTRACT NO.

3. AWARD/EFFECTIVE DATE

4. ORDER NO.

5. SOLICITATION NUMBER

6. SOLICITATION ISSUE DATE

a. NAME

b. TELEPHONE NO. (No Collect Calls)

8. OFFER DUE DATE/LOCAL

TIME

9. ISSUED BY

CODE

10. THIS ACQUISITION IS

UNRESTRICTED OR

SET ASIDE:

% FOR:

SMALL BUSINESS

HUBZONE SMALL

BUSINESS

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

WOMEN-OWNED SMALL BUSINESS

(WOSB) ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

EDWOSB

8(A)

NAICS:

SIZE STANDARD:

11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

SEE SCHEDULE

12. DISCOUNT TERMS

13a. THIS CONTRACT IS A

RATED ORDER UNDER

DPAS (15 CFR 700)

13b. RATING

14. METHOD OF SOLICITATION

RFQ

IFB

RFP

15. DELIVER TO

CODE

16. ADMINISTERED BY

CODE

17a. CONTRACTOR/OFFEROR

CODE

FACILITY CODE

18a. PAYMENT WILL BE MADE BY

CODE

TELEPHONE NO.

UEI:

EFT:

PHONE:

FAX:

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN OFFER 18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK BELOW IS CHECKED

SEE ADDENDUM

19.

20.

21.

22.

23.

24.

ITEM NO.

SCHEDULE OF SUPPLIES/SERVICES

QUANTITY

UNIT

UNIT PRICE

AMOUNT

(Use Reverse and/or Attach Additional Sheets as Necessary)

25. ACCOUNTING AND APPROPRIATION DATA

26. TOTAL AWARD AMOUNT (For Govt. Use Only) 27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1, 52.212-4. FAR 52.212-3 AND 52.212-5 ARE ATTACHED. ADDENDA

ARE

ARE NOT ATTACHED.

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA

ARE

ARE NOT ATTACHED

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN _______________

29. AWARD OF CONTRACT: REF. ___________________________________ OFFER

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND

DATED ________________________________. YOUR OFFER ON SOLICITATION

DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY

(BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE

ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED

SET FORTH HEREIN IS ACCEPTED AS TO ITEMS:

30a. SIGNATURE OF OFFEROR/CONTRACTOR 31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER) 30b. NAME AND TITLE OF SIGNER (TYPE OR PRINT) 30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER (TYPE OR PRINT) 31c. DATE SIGNED

AUTHORIZED FOR LOCAL REPRODUCTION

(REV. NOV 2021)

PREVIOUS EDITION IS NOT USABLE

Prescribed by GSA - FAR (48 CFR) 53.212

7. FOR SOLICITATION

INFORMATION CALL:

STANDARD FORM 1449

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL PRODUCTS AND COMMERCIAL SERVICES

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 30

36C10X25R0009 4/14/2025 Brian N. Ballard 205-926-8388 5/15/2025 16:00

ET

36C10X Strategic Acquisition Center - Frederick Department of Veterans Affairs

5202 Presidents Court, Suite 103 Frederick MD 21703

X

518210 $40 Million

N/A

See B.5 PWS

36C10X Strategic Acquisition Center - Frederick Department of Veterans Affairs

5202 Presidents Court, Suite 103 Frederick MD 21703

VAFSC

U.S. Department of Veterans Affairs Financial Services Center

PO BOX 149971

(see Section B.3 Invoicing Instructions) Austin TX 78714-8917 1-(877)-489-6135

See CONTINUATION Page VA Police Cameras and Evidence Management System

*This is an on-ramp to an existing contract, increasing the current ceiling from $60 million to $125 million, offering potential offerors the opportunity to compete for subsequent orders and changing the current contract from single award to multiple award. *This statement will be removed upon award*

Questions due by 4/24/2025 4PM EDT – Ref ATTACHMENT A

See CONTINUATION Page

Carey M. Kauzlarich Contracting Officer

Table of Contents

SECTION B - CONTINUATION OF SF 1449 BLOCKS

B.1 CONTRACT ADMINISTRATION DATA

1. Contract Administration: All contract administration matters will be handled by the following individuals:

a. Contractor: [TBD]

5202 Presidents Court, Suite 103 Frederick, MD 21703

The IDIQ Contracting Officer is responsible for providing overall scope oversight, maintaining communication between the contractor and VA, ensuring contract compliance, administering base contract and modifications, and ensuring that annual performance evaluations are completed as necessary.

Each task order (TO) will have an identified Contracting Officer who will be responsible for ensuring that all task orders are within the scope of the IDIQ base contract, administering the task order award, overseeing payment or rejection of invoices, and ensuring that annual performance evaluations are completed at the TO level as necessary.

The CO reserves the right to designate a Contracting Officer’s Representative (COR) at the IDIQ contract or individual task order level. The CO will issue a designation letter to the COR and the contractor to ensure that all parties understand the limited authority of the COR.

IDIQ COR: [To be determined at the time of award]

B.2 TASK ORDER PROCEDURES

The Contractor under this Indefinite Delivery Indefinite Quantity (IDIQ) contract shall provide supplies and services as requirements are identified throughout the ordering period. Requirements will specify details as they relate to deliverables, performance, and other technical items.

(1) The IDIQ will follow ordering procedures as outlined in FAR 16.505.

As requirements are identified, the task order contracting officer will submit a Task Order Proposal Request (TOPR) to the contractor that will include the following details:

0. The due date and instructions for proposal submission;

0. A description of the requirements, including deliverables, and all other applicable information;

0. The period of performance; and

0. Any additional information deemed necessary by the CO.

(2) The minimum guaranteed amount for this contract is $100.00, which will be obligated at the time of IDIQ award. Orders beyond the minimum will be determined by department needs. The Government has no obligation to award Task Orders beyond the minimum guaranteed amount.

(3) The maximum aggregate value of all awards and task orders under this IDIQ is $125,000,000.00.

(4) In accordance with FAR 17.2, task orders may contemplate the use of options. Inclusion of options at the task order level will be properly documented and approved in accordance with the FAR and agency procedures and will be clearly stated in the TOPR.

B.3 INVOICING INSTRUCTIONS

1. Submission - In accordance with VAAR Clause 852.232-72 Electronic Submission of Payment Requests, all invoices shall be submitted electronically.

TUNGSTEN ELECTRONIC INVOICE SUBMISSION

FSC e-INVOICE PROGRAM THRU AUSTIN PORTAL

FSC MANDATORY ELECTRONIC INVOICE SUBMISSION FOR AUSTIN PAYMENTS

Vendor Electronic Invoice Submission Methods:

Fax, email, and scanned documents are not acceptable forms of submission for payment requests. Electronic form means an automated system transmitting information electronically according to the accepted data transmissions below.

· VA’s Electronic Invoice Presentment and Payment System – The Financial Services Center (FSC) in Austin, TX uses a third-party contractor, Tungsten, to transition vendors from paper to electronic invoice submission. Please go to this website: http://www.tungsten-network.com/US/en/veterans-affairs/ to begin submitting electronic invoices, free of charge.

· A system that conforms to the X12 electronic data interchange (EDI) formats established by the Accredited Standards Center (ASC) chartered by the American National Standards Institute (ANSI). The X12 EDI Web site is http://www.x12.org

Vendor e-invoice Set-up information:

Please contact Tungsten at the phone number or email address listed below to begin submitting your electronic invoices to the VA Financial Services Center in Austin, TX for payment processing. If you have questions about the payment status of a properly submitted invoice, the e-invoicing program, or Tungsten, please contact the FSC at the phone number or email address listed below.

• Tungsten e-Invoice setup information: 1-877-489-6135

• Tungsten e-Invoice email: VA.Registration@tungsten-network.com

• FSC e-Invoice contact information: 1-877-353-9791

• FSC e-Invoice email: vafsccshd@va.gov

• http://www.fsc.va.gov/einvoice.asp

COMMUNICATIONS:

• https://www.federalregister.gov/articles/2012/11/27/2012-28612/vaacquisition-regulation-electronic-submission-of-payment-requests

• http://fcw.com/articles/2012/11/27/va-epayments.aspx?s=fcwdaily

2.Submission of Proper Invoice - The following data must be included in an invoice for it to constitute a proper invoice:

a. Name and address of the contractor

b. Invoice date and number

c. IFCAP Purchase Order No.:

d. Contract No.: TBD

e. Item number, description, quantity, unit of measure, price, extended price, and a total of supplies delivered, or services performed.

f. Cumulative billing (per line item and total)

g. Final invoices must be marked ‘FINAL INVOICE’

h. Proof of supplies delivered, or services performed MUST also be provided. Signature, printed name, and title of Government receiving official, and date of delivery or performance period must be included.

INVOICES THAT DO NOT COMPLY WITH THESE REQUIREMENTS SHALL BE REJECTED.

3.Contractor Remittance Address All payments by the Government to the contractor will be made in accordance with:

[X] 52.232-33, Payment by Electronic Funds Transfer - System for Award Management, or [ ] 52.232-36, Payment by Third Party

4.Invoice shall be submitted in the arrears

a. Quarterly [ ]

b. Semi-Annually [ ]

c. Other [X] Monthly, in accordance with FAR 52.212-4.

3. Vendorization Process Contractors that have never done business with the VA before are encouraged to complete vendorization using the instructions provided in ATTACHMENT E VA-CEP-Vendorization WebForm UserGuide.

Becoming “vendorized” is required to receive electronic payments from the VA. The process of becoming vendorized can be delayed, which can negatively impact award timeframe. Completing this process as soon as possible will help ensure that the process will run smoothly IF successful in the evaluation process.

Please submit questions regarding the vendorization process to the POCs listed on the bottom of page 1 of ATT E.

B.4 PRICE COST SCHEDULE:

[This section will be completed at the time of the award based on the successful offeror’s price schedule. Reference ATTACHMENT B Price Schedule 36C10X25R0009]

B.5 PERFORMANCE WORK STATEMENT:

1.0 BACKGROUND

The VA Police is a federal law enforcement organization within the U.S. Department of Veterans Affairs (VA) with unique responsibilities dedicated to reducing crime and protecting those assets under the charge and control of the Veterans Health Administration. In accordance with H.R. 2429, dated June 16, 2021, Subsection (a) of Section 902, “the Secretary shall require Department police officers to use cameras worn on the individual police officer’s person that record and store audio and video (commonly known as ‘body worn cameras’).” Body Worn Cameras will be provided to VA Police Officers in the performance of their duties at all VA Medical Facilities within the United States. The use of Body Worn Cameras ensures the continued compliance and oversight of security objectives at VA Medical Centers and leased facilities to include: (i) Arrests made by and tickets issued by Department police officers; (ii) Prosecutions, ticketing, and other actions relating to such arrests; (iii) The use of force and weapons discharge, and (iv) Complaints, investigations, and disciplinary actions. The body worn cameras and dashcams in vehicle will be used throughout the duty day. Upon completion of the duty day, VA Police Officers will return their camera devices to a Digital Evidence Management System for data storage and retrieval.

The Digital Evidence Management System (DEMS) and Report Management System (RMS) also function as a network providing the capability to share data across jurisdictional lines and discover links between crimes in different localities and states.

2.0 APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. 44 U.S.C. § 3541-3549, “Federal Information Security Management Act (FISMA) of 2002”

2. “Federal Information Security Modernization Act of 2014”

3. Federal Information Processing Standards (FIPS) Publication 140-2, “Security Requirements for Cryptographic Modules”

4. FIPS Pub 199. “Standards for Security Categorization of Federal Information and Information Systems,” February 2004

5. FIPS Pub 200, “Minimum Security Requirements for Federal Information and Information Systems,” March 2006

6. 10 U.S.C. § 2224, "Defense Information Assurance Program"

7. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

8. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”

9. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, https://www.va.gov/vapubs/index.cfm

10. VA Handbook 0710, “Personnel Security and Suitability Program,” May 2, 2016, https://www.va.gov/vapubs/index.cfm

11. VA Directive and Handbook 6102, “Internet/Intranet Services,” August 5, 2019

12. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and Guidelines,” January 18, 2017

13. Office of Management and Budget (OMB) Circular A-130, “Managing Federal Information as a Strategic Resource,” July 28, 2016

14. FedRAMP Authorization Act of 2022

15. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended, January 18, 2017

16. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

17. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021

18. VA Handbook 6500, “Risk Management Framework for VA Information Systems VA Information Security Program,” February 24, 2021

19. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI),” March 12, 2019

20. VA Handbook 6500.5, “Incorporating Security and Privacy into the System Development Lifecycle,” March 22, 2010

21. VA Handbook 6500.6, “Contract Security,” March 12, 2010

22. VA Handbook 6500.8, “Information System Contingency Planning,” April 6, 2011

23. VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018

24. VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017

25. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014

26. VA Handbook 6508.1, “Procedures for Privacy Threshold Analysis and Privacy Impact Assessment,” July 30, 2015

27. VA Directive and Handbook 6510, “VA Identity and Access Management,” January 15, 2016

28. VA Directive and Handbook 6513, “Secure External Connections,” October 12, 2017

29. VA Directive 6300, “Records and Information Management,” September 21, 2018

30. VA Handbook, 6300.1, “Records Management Procedures,“ March 24, 2010

31. NIST SP 800-37 Rev 2, “Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy,” December 2018

32. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020)

33. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015

34. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” March 24, 2014

35. OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005

36. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019

37. OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008

38. NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access,“ June 2018

39. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, “Digital Identity Guidelines,” updated March 02, 2020

40. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014

41. NIST SP 800-164, “Guidelines on Hardware-Rooted Security in Mobile Devices (Draft),” October 2012

42. VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

43. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

44. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

45. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

46. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019

47. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008

48. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (Public Law 110–140), December 19, 2007

49. Section 104 of the Energy Policy Act of 2005, (Public Law 109–58), August 8, 2005

50. Executive Order 13834, “Efficient Federal Operations,” dated May 17, 2018

51. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 2, 2001

52. VA Directive 0058, “VA Green Purchasing Program,” July 19, 2013

53. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

54. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

55. “Veteran Focused Integration Process (VIP) Guide 4.0,” January 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

56. VA Memorandum “Proper Use of Email and Other Messaging Services,” January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

57. “DevSecOps Product Line Management Playbook” version 2.0, May 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

58. NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020

59. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol Version 6 (IPv6),” November 19, 2020

60. Social Security Number (SSN) Fraud Prevention Act of 2017

61. Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23, 2018

62. H.R. 2429, VA Police Improvement and Accountability Act. June 16, 2021.

63. Office of Management and Budget (OMB) Memorandum 10-28, “Clarifying Cybersecurity Responsibilities and Activites of the Executive Office of the President and the Department of Homeland Security”

64. NIST 800-88, “Guidelines for Media Sanitization,” December 2014

65. VA Directive 6008, “Acquisition and Management of VA Information Technology Resources,” November 2, 2017

66. VA Directive 6512, “Secure Wireless Technology,” October 12, 2017

67. VA Directive/Handbook 6517, “Risk Management for Cloud Computing Services,” November 15, 2016

68. VA Directive 6609, “Mailing of Sensitive Personal Information,” May 20, 2011

3.0 SCOPE OF WORK

The scope of this contract is for the Contractor to provide all supervision, management, and labor required for the services outlined in this PWS. This activity supports the use of Body Worn Cameras (BWCs), dash vehicle cameras, all of which shall be integrated with the DEMS and RMS. Ancillary products may include batteries, power cords, charging and data platform stations, kits, maintenance, software upgrades, signal activation devices and mounting hardware for BWCs and In-Car Camera systems and warranty of products.

The scope of this contract is to obtain a DEMS and RMS that is a one-turnkey solution with the ability functions and features capable of supporting the ongoing operations and activities of the DEMS and RMS. These Software as a Service (SaaS) licenses shall be utilized nationally by VA Police personnel to support the capture, ingest, management, and secure sharing of digital evidence, to include but not limited to body worn camera video and dashcam captured from VA Police Officers authorized for use on federal property.

The objective of this procurement to provide VA Police with a system of record and a continuation of that system of record without break in service or break in operations and maintenance of an integrated car and body-worn camera video and audio platform that includes a DEMS and RMS which maintains the evidentiary value of the audio/video while providing a process to manage, redact, and release the data efficiently.

4.0 PERFORMANCE DETAILS

4.1 PERFORMANCE PERIOD

This is a Multiple Award Indefinite Delivery Indefinite Quantity (IDIQ) type contract. The PoP shall be date of award through September 25, 2027.

Any work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO).

There are 11 Federal holidays set by law (USC Title 5 Section 6103) that VA follows. If any fall on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

4.2 PLACE OF PERFORMANCE

Tasks under this PWS shall be performed at VA facilities located nation-wide. The Government anticipates shipment of product to be ordered and sent to VA Facilities within the United States, followed by teleconference calls for customer engagement to support operations of equipment. Work may be performed at remote locations with prior concurrence from the Contracting Officer’s Representative (COR). The Contractor staff shall be available to coordinate with VA Office Chief of Police and the Director of Operations and Administration on normal Federal Government workdays and be responsive between the core hours of 9:00 a.m. and 5:00 p.m. Eastern Standard Time.

4.3 TRAVEL

The Government does not anticipate travel to perform the tasks associated with the effort.

5.0 SPECIFIC TASKS AND DELIVERABLES

Tasks performed shall be of a non-personal nature. VA organization will not provide supervision of Contractor personnel. Contractor personnel shall at no time allow an employer-employee relationship to develop with VA organization or their staff. VA organizations will refrain from any activity that creates the appearance of such a relationship.

Contractors shall not perform inherently government functions including decision making, supervision of Government employees, supervision of other contractors on other contracts, and activities that create the appearance of performing such functions.

Contractor personnel shall have the level of experience necessary to accomplish the requirement of this PWS with reference to personal and professional conduct, and in technical knowledge. Furthermore, Contractor personnel are expected to be proficient in using office automation equipment and software and sufficient written and verbal communication skills to support VA program offices, their customers, and any other VA organization. Should any Contractor personnel be determined to be unacceptable in terms of technical competency or unacceptable conduct or behavior while on-site working on contract activities, the Contractor shall immediately remove and replace the unacceptable on-site personnel at no additional cost to the Government. Contractor personnel are to serve in a support role; therefore, final decisions regarding inherently governmental functions will always be made by Government personnel. The Contractor shall perform the following:

5.1 TECHNICAL KICK OFF MEETING

A technical kickoff meeting shall be held within 10 business days after contract award. The Contractor shall coordinate the date, time, and location (can be virtual) with the COR, as the Post-Award Conference Chairperson, the VA Project Manager (PM), as the Co-Chairperson, the CO, and the Contract Specialist (CS). The Contractor shall provide a draft agenda to the CO and COR at least five (5) calendar days prior to the meeting. Upon Government approval of a final agenda, the Contractor shall distribute to all meeting attendees. At the conclusion of the meeting, the Contractor shall update the presentation with a final slide entitled “Summary Report” which shall include notes on Action Items and, any major issues, agreements, or disagreements discussed during the kickoff meeting, attendance roster, Strategic Vision & Approach Plan, and the following statement “As the Post-Award Conference Chairperson, I have reviewed the entirety of this presentation and assert that it is an accurate representation and summary of the discussions held during the Technical Kickoff Meeting for the VA Body Worn Cameras and Data Evidence Management System and in-car vehicle cameras. The Contractor shall submit the final updated presentation to the COR for review and signature within three (3) calendar days after the meeting. The Contractor shall work with the Government Task Leads, to ensure the contractor has accurately captured the salient points from the kickoff meeting. Once collaboration with Government Task Leads is complete, the contractor shall prepare the meeting minutes for acceptance by the COR/PM. prior to distribution of the meeting minutes to the COR, PM, and all attendees within three (3) calendar days after the meeting.

Deliverable:

A. Final Kickoff Presentation

6.0 REQUIREMENTS

1. The solution shall provide sufficient safeguards to ensure evidentiary integrity of the captured video and confirm valid receipt by the repository of the entire video before deleting original from the in-vehicle and body-worn system.

2. The system shall have a role-based security model to control user access to features and data throughout the system.

3. The systems security model shall provide a method to easily limit access to sensitive case information and people related to confidential cases.

4. The contractors cameras shall support a minimum quality of 720p for body-worn cameras, 720p for front and rear in-vehicle cameras and 480p for the backseat camera. The contractors solution shall include body-worn cameras that are integrated with the in-vehicle camera solution.

5. The contractors solution shall capture audio within the vehicle and the body-worn camera shall have a remote microphone to record audio interaction outside of vehicle.

6. The contractors solution shall host and maintain the Data Evidence Management System in a secure cloud hosting environment providing all necessary hardware, software, system and database administration to manage the application including all test, training and production environments of the system.

7. The contractor shall provide documentation of FedRAMP approval for all applicable requirements.

6.1 REQUIREMENT FOR VIDEO CAMERA SYTEMS:

1. High-definition Dual-View Camera with panoramic field of view, 12x zoom, and AI processing for automatic license plate reader (ALPR)

2. High-definition Interior Camera with infrared illumination for back seat view in complete darkness

3. Wireless Mic and Charging Base for capturing audio when outside of vehicle

4. Fleet Hub with connectivity, global navigation satellite system (GNSS), secure solid- state storage, and Signal inputs

5. Automatic transition from Buffering to Event mode with configurable Signals

6. Video Recall records last 24 hours of each camera in case camera not activated for an event

7. Mobile data terminal app, for controlling system, reviewing video, quick tagging, and more

8. Efficiently categorize, play back and share all video and audio alongside other digital files on management system database

9. Multi-cam playback, for reviewing up to four videos, including body-worn and in-car footage, at the same time

10. Fully integrated with management system and other recording devices

11. Automatic time synchronization with all Fleet and other on-officer cameras allowing for multi-camera playback on management database system.

12. Prioritized upload to management system of critical event videos via 4G/LTE

13. Support install times, wireless updates, and quick remote troubleshooting

14. Live stream, alerts, and location updates for situational awareness

15. Mobile gateway or mobile service device for video upload for all vehicle camera solutions with an activated MiFi or Data Plan service

16. ALPR hotlist alerts, plate read retention, and investigative search

6.2 REQUIREMENT FOR POLICE OFFICER BODY WORN CAMERAS

1. Video quality with reduced motion blur and better low-light performance

2. Multi-mic audio—four built-in microphones

3. Wireless upload option

4. Gunshot detection and alerts

5. Streaming audio and video capability

6. “Find my camera” feature

7. Verbal transcription and translation

8. End-to-end encryption

9. Minimum Twelve-hour battery

10. Up to 120-second buffering period to record footage before pressing record button

11. Integrate with a holster device that will automatically turn on a camera once a weapon is unholstered

6.3 REQUIREMENT FOR CLOUD SERVICE OF DIGITAL EVIDENCE MANAGEMENT SYSTEM

1. The System shall be a current Criminal Justice Information Services (CJIS)/FedRAMP JAB Provisional product.

2. The system shall be an Authority to Operate (P-ATO) Authorized SaaS solution with an Authority to Operate.

3. The system shall be (ATO) rated for impact level high certified and an authorized product for federal use.

4. The system shall be a turnkey solution that allows for secure management, access, and sharing of digital evidence.

5. The system shall provide VA wide enterprise licensing and permit unlimited usage.

6. The system shall accept and provide media in all forms (.jpeg, .pdf, etc.).

7. The contractor shall provide a secure method for requesting and receiving digital content from U.S. Citizens.

8. The system shall provide redaction capabilities powered by Artificial Intelligence (AI).

9. The system shall store and support various forms of third-party data evidence collected from mobile phone applications.

10. The system shall allow secure case sharing with current partner agencies as well as the Executive Office of United States Attorneys (EOUSA) or States Attorney.

11. The system shall provide a minimum of 2.5 petabytes of storage (10GB per 250,000).

12. The system shall be a SaaS model that reduces security and administration efforts by local IT staff (i.e., no local installation required).

13. The contractor shall provide automatic, timely security upgrades and enhancements deployed to application without the need for any local IT staff involvement.

14. The system shall have the ability to Control access to evidence based on pre-defined roles and permissions and predefined individuals.

15. The system shall have a password authentication system.

16. The system shall have the required levels of password complexity, IP-based access restrictions, single sign-on, and multi-factor authentication support.

17. The contractor shall have an automated category-based evidence retention policy with efficient database management in accordance with Federal Records rules of retention.

18. The contractor shall have the ability to recover deleted evidence within seven days of deletion to ensure retention of evidence.

19. The contractor shall not require proprietary file formats, thus avoiding additional costs to the federal government.

20. The system shall provide the user the ability to upload files directly from the computer to DEMS via an Internet Browser or the Evidence Sync desktop-based application.

21. The system shall be reliable: Fault- and disaster-tolerant infrastructure in at least 4 redundant data centers in both the East and West regions of the United States.

22. The system shall have chain-of custody capabilities: Audit logs automatically track all system and user activity. These logs cannot be edited or deleted, even by account administrators and IT staff to assist in chain of custody for case prosecution.

23. The Contractor shall have a dedicated information security department that protects the DEMS and data with security monitoring, centralized event log analysis and correlation, advanced threat and intrusion protection, and incident response capabilities.

24. The contractor shall provide enterprise licensing capable of supporting up to 9500 users.

25. The contractor shall provide initial training in-person and as required technical support in conjunction with system upgrades and changes.

6.4 REQUIREMENTS of ADVANCED ENCRYPTION STANDARD (AES) ENCRYPTION FOR DATA STORAGE

1. Security Testing: Independent security firms perform in-depth security and penetration testing that will occur in a test environment allowing the VA Police the ability to also test the products in a timely manner.

2. Reliability: Fault- and disaster-tolerant infrastructure in at least four redundant data centers in both the East and West regions of the United States.

3. Chain-of-Custody: Audit logs automatically track all system and user activity. These logs cannot be edited or deleted, even by account administrators and IT staff.

4. Protection: With no on-site application, critical evidence stored in Evidence is protected from local malware that may penetrate agency infrastructure security program.

5. Application and data protected by a CJIS and ISO 27001 compliant information security program.

6. Dedicated information security department that protects evidence management system and data with security monitoring, centralized event log analysis and correlation, advanced threat, and intrusion protection, and incident response capabilities.

7. Redact videos easily within the system, create tags, markers, and clips, search seven fields in addition to five category-based fields, create cases for multiple evidence files.

7.0 FEDERAL RISK AND AUTHOTIZATION MANAGEMENT PROGRAM

The Federal Risk and Authorization Management Program (FedRAMP) is an innovative policy approach to develop trusted relationships between Executive departments and agencies and cloud service providers (CSPs). FedRAMP reduces duplicative efforts, inconsistencies and cost inefficiencies associated with current security authorization process. FedRAMP establishes a public-private partnership to promote innovative and the advancement of more secure information technologies. FedRAMP will enable the Federal Government to accelerate the adoption of cloud computing by creating transparent standards and processes for security authorizations and allowing agencies to leverage security authorizations on a government-wide scale.

The Contractor shall be compliant with FedRAMP. The Contract shall be FedRAMP compliant category High.

8.0 SAAS FEDRAMP REQUIREMENTS

8.1 FEDRAMP AUTHORIZED AND VA AUTHORIZED AT A HIGH RISK ATO

Deliverables:

A. Security Assessment Report (SAR) – delivered no later than 12 months from the previous SAR.

B. Continuous monitoring scans to be reviewed at monthly meetings.

C. Plan of Action and Milestones monthly reports.

D. Additional deliverables as outlined by FedRAMP’s continuous monitoring strategy.

E. VA Privacy and Security deliverables as directed by the VA System Owner.

8.2 No VA Data:

1. Software-as-a-Service (SaaS) Solution The contractor shall provide a SaaS solution that does not have direct connections or interfaces to VA systems or networks. VA providers shall access the solution in a view-only mode or with limited functionality. The contractor shall ensure that no data is created, collected, processed, maintained, disseminated, or disposed of on behalf of the VA. The contractor shall comply with OMB Circular A-130, which defines federal-owned data as information owned or managed by the federal government, including information collected, maintained, and shared for government functions.

a. Data Handling for Veterans Using Devices

· User Consent: Veteran users who use the product shall consent to share their data, which may include Personally Identifiable Information (PII) and Protected Health Information (PHI), directly with the SaaS provider.

· Published Terms: The SaaS provider shall have published terms and conditions for user consent.

· Data Ownership: All data processed by the SaaS provider shall be owned by the SaaS provider or the Veteran user.

· Revocation: Veteran users shall have the ability to revoke data sharing with the SaaS provider at any point.

b. Data Sharing Revocation

· For systems classified as "No VA Data," the veteran is entering directly into a relationship with the SaaS provider and has granted their VA medical team one-way, view-only access to read the data.

· The medical team may then pull information into the veteran's/patient’s medical record.

· The veteran/patient may at any time revoke sharing with the SaaS provider and/or their medical care team.

· In the event that data sharing is revoked, the medical provider will retain data already shared but will immediately stop collecting additional data from the SaaS provider and veteran.

· VA shall make the Veteran, Caregiver or Veteran Representative aware of the disclosure of data to the third party and their ownership of the data.

9.0 GENERAL REQUIREMENTS - ENTERPRISE AND IT FRAMEWORK

VA TECHNICAL REFERENCE MODEL

The Contractor shall support the VA enterprise management framework. In association with the framework, the Contractor shall comply with OIT Technical Reference Model (VA TRM). The VA TRM is one component within the overall Enterprise Architecture (EA) that establishes a common vocabulary and structure for describing the information technology used to develop, operate, and maintain enterprise applications. Moreover, the VA TRM, which includes the Standards Profile and Product List, serves as a technology roadmap and tool for supporting OIT. Architecture & Engineering Services (AES) has overall responsibility for the VA TRM.

INTERNET PROTOCOL VERSION 6 (IPV6)

The Contractor shall support Internet Protocol Version 6 (IPv6) based upon the memo issued by the Office of Management and Budget (OMB) on November 19, 2020 (https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-07.pdf). IPv6 technology, in accordance with the USGv6 Program (https://www.nist.gov/programs-projects/usgv6-program/usgv6-revision-1), NIST Special Publication (SP) 500-267B Revision 1 “USGv6 Profile” (https://doi.org/10.6028/NIST.SP.500-267Br1), and NIST SP 800-119 “Guidelines for the Secure Deployment of IPv6” (https://doi.org/10.6028/NIST.SP.800-119), compliance shall be included in all IT infrastructures, application designs, application development, operational systems and sub-systems, and their integration. In addition to the above requirements, all devices shall support native IPv6 and dual stack (IPv6 / IPv4) connectivity without additional memory or other resources being provided by the Government, so that they can function in a mixed environment. All public/external facing servers and services (e.g. web, email, DNS, ISP services, etc.) shall support native IPv6 and dual stack (IPv6 / IPv4) users and all internal infrastructure and applications shall communicate using native IPv6 and dual stack (IPv6 / IPv4) operations.

TRUSTED INTERNET CONNECTION (TIC)

The Contractor solution shall meet the requirements outlined in Office of Management and Budget Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative“ (https://www.whitehouse.gov/wp-content/uploads/2019/09/M-19-26.pdf), VA Directive 6513 “Secure External Connections”, and shall comply with the TIC 3.0 Core Guidance Documents, including all Volumes and TIC Use Cases, found at the Cybersecurity & Infrastructure Security Agency (CISA) (https://www.cisa.gov/publication/tic-30-core-guidance-documents). Any deviations must be approved by the VA TIC 3.0 Working Group at vaoisesatic30team@va.gov.

STANDARD COMPUTER CONFIGURATION

The Contractor IT end user solution that is developed for use on standard VA computers shall be compatible with and be supported on the standard VA operating system, currently Windows 10 (64bit), Edge (Chromium based), and 365 Apps for enterprise. Applications delivered to VA and intended to be deployed to Windows 10 workstations shall be delivered as a signed .msi package with switches for silent and unattended installation and updates shall be delivered in signed .msp file formats for easy deployment using Microsoft Endpoint Configuration Manager (CM) VA’s current desktop application deployment tool. Signing of the software code shall be through a vendor provided certificate that is trusted by VA using a code signing authority such as Verizon/Cybertrust or Symantec/VeriSign. The Contractor shall also ensure and certify that their solution functions as expected when used from a standard VA computer, with non-admin, standard user rights that have been configured using the United States Government Configuration Baseline (USGCB) and Defense Information Systems Agency (DISA) Secure Technical Implementation Guide (STIG) specific to the particular client operating system being used.

VETERAN FOCUSED INTEGRATION PROCESS (VIP) AND PRODUCT LINE MANAGEMENT (PLM)

The Contractor shall support VA efforts IAW the updated Veteran Focused Integration Process (VIP) and Product Line Management (PLM). The major focus of the new VIP is on Governance and Reporting and is less prescriptive, with a focus on outcomes and continuous delivery of value. Product Line Management (PLM) is a framework that focuses on delivering functional products that provide the highest priority work to customers while delivering simplified, reliable, and practical solutions to the business, medical staff, and our Veterans. The VIP Guide is a companion guide to the PLM Playbook and can be found at: https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371 and the PLM Playbook can be found at https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946. The PLM Playbook pivots from project-centric to product-centric delivery and contains descriptive practices that focuses on outcomes. The PLM Playbook contains a set of “plays” that implement Development, Security, and Operations (DevSecOps) principles and processes such as automated development, continuous integration/continuous delivery, and release on demand. The PLM Playbook details how product lines implement Lean-Agile principles, methods, practices, and techniques through levels of maturity. VIP and PLM are the authoritative processes that IT projects must follow to ensure development and delivery of IT products.

PROCESS ASSET LIBRARY (PAL)

The Contractor shall perform their duties consistent with the processes defined in the OIT Process Asset Library (PAL). The PAL scope includes the full spectrum of OIT functions and activities, such as VIP project management, operations, service delivery, communications, acquisition, and resource management. PAL serves as an authoritative and informative repository of searchable processes, activities or tasks, roles, artifacts, tools and applicable standards and guides to assist the OIT workforce, Government and Contractor personnel. The Contractor shall follow the PAL processes to ensure compliance with policies and regulations and to meet VA quality standards. The PAL includes the contractor onboarding process consistent with Section 6.2.2 and can be found at https://www.va.gov/PROCESS/artifacts/maps/process_CONB_ext.pdf. The main PAL can be accessed at www.va.gov/process.

AUTHORITATIVE DATA SOURCES

The VA Enterprise Architecture Repository (VEAR) is one component within the overall EA that establishes the common framework for data taxonomy for describing the data architecture used to develop, operate, and maintain enterprise applications. The Contractor shall comply with the department’s Authoritative Data Source (ADS) requirement that VA systems, services, and processes throughout the enterprise shall access VA data solely through official VA ADSs where applicable, see below. The Information Classes which compose each ADS are located in the VEAR, in the Data & Information domain. The Contractor shall ensure that all delivered applications and system solutions support:

1. Interfacing with VA’s Master Person Index (MPI) (formerly the Master Veteran Index (MVI)) to provision identity attributes, if the…