S02 Presol Notice_36C10X25R0009_BWC On-Ramp_Final.docx

SUBJECT*

VA Police Body Worn Cameras ON-RAMP (VA-25-00036643)

GENERAL INFORMATION

SET-ASIDE

POSTAL CODE

COUNTRY

CONTACT INFORMATION

Department of Veterans Affairs

5202 Presidents Court, Suite 103 Frederick MD 21703

POINT OF CONTACT*

Brian Ballard brian.ballard@va.gov Carey Kauzlarich carey.kauzlarich@va.gov

ADDITIONAL INFORMATION

AGENCY CONTACT’S EMAIL ADDRESS

EMAIL DESCRIPTION

Presolicitation Notice Presolicitation Notice

DESCRIPTION

Presolicitation Notice

THIS IS A PRESOLICITATION NOTICE ONLY.

VA is seeking to increase the current IDIQ ceiling and consider on-ramp of any new contractors that can meet VA’s requirements.

This presolicitation notice is issued solely for information and planning purposes – it does not constitute a Request for Proposal (RFP) or a promise to issue an RFP in the future. This request does not commit the Government to contract for any supply or service whatsoever. In addition, the Department of Veterans Affairs is not seeking proposals at this time and will not accept unsolicited proposals.

Offerors are advised that the U.S. Government will not pay for any information or administrative costs incurred in response to this notice; all costs associated with responding to this notice will be solely at the interested party’s expense. Not responding to this notice does not preclude participation in any future solicitation.

VA POLICE CAMERAS / DATA EVIDENCE MANAGEMENT SYSTEM

DRAFT* PERFORMANCE WORK STATEMENT (PWS)

*The following is a draft of the PWS, and is subject to change

1.0 BACKGROUND

The VA Police is a federal law enforcement organization within the U.S. Department of Veterans Affairs with unique responsibilities dedicated to reducing crime and protecting those assets under the charge and control of the Veterans Health Administration. In accordance with H.R. 2429, dated June 16, 2021, Subsection (a) of Section 902, the Secretary shall require Department police officers to use cameras worn on the individual police officer’s person that record and store audio and video (commonly known as ‘body worn cameras’).” Body Worn Cameras will be provided to VA Police Officers in the performance of their duties at all VA Medical Facilities within the United States. The use of Body Worn Cameras ensures the continued compliance and oversight of security objectives at VA Medical Centers and leased facilities to include: (i) Arrests made by and tickets issued by Department police officers; (ii) Prosecutions, ticketing, and other actions relating to such arrests; (iii) The use of force and weapons discharge, and (iv) Complaints, investigations, and disciplinary actions. The body worn cameras and dashcams in vehicle will be used throughout the duty day. Upon completion of the duty day, VA Police Officers will return their camera devices to a Digital Evidence Management Program for data storage and retrieval. While keeping the system in compliance with FISMA, NIST, OMB and Federal Regulations/Laws that tie the Government to securing systems of records with the compliance of Law, Regulations, Standard Operating Procedures and Risk Compliance.

The Digital Evidence Management System (DEMS) and Report Management System (RMS) also function as a network providing the capability to share data across jurisdictional lines and discover links between crimes in different localities and states.

2.0 APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. 44 U.S.C. § 3541-3549, “Federal Information Security Management Act (FISMA) of 2002”

2. “Federal Information Security Modernization Act of 2014”

3. Federal Information Processing Standards (FIPS) Publication 140-2, “Security Requirements for Cryptographic Modules”

4. FIPS Pub 199. “Standards for Security Categorization of Federal Information and Information Systems,” February 2004

5. FIPS Pub 200, “Minimum Security Requirements for Federal Information and Information Systems,” March 2006

6. 10 U.S.C. § 2224, "Defense Information Assurance Program"

7. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

8. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”

9. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, https://www.va.gov/vapubs/index.cfm

10. VA Handbook 0710, “Personnel Security and Suitability Program,” May 2, 2016, https://www.va.gov/vapubs/index.cfm

11. VA Directive and Handbook 6102, “Internet/Intranet Services,” August 5, 2019

12. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and Guidelines,” January 18, 2017

13. Office of Management and Budget (OMB) Circular A-130, “Managing Federal Information as a Strategic Resource,” July 28, 2016

14. FedRAMP Authorization Act of 2022

15. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended, January 18, 2017

16. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

17. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021

18. VA Handbook 6500, “Risk Management Framework for VA Information Systems VA Information Security Program,” February 24, 2021

19. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI),” March 12, 2019

20. VA Handbook 6500.5, “Incorporating Security and Privacy into the System Development Lifecycle,” March 22, 2010

21. VA Handbook 6500.6, “Contract Security,” March 12, 2010

22. VA Handbook 6500.8, “Information System Contingency Planning,” April 6, 2011

23. VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018

24. VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017

25. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014

26. VA Handbook 6508.1, “Procedures for Privacy Threshold Analysis and Privacy Impact Assessment,” July 30, 2015

27. VA Directive and Handbook 6510, “VA Identity and Access Management,” January 15, 2016

28. VA Directive and Handbook 6513, “Secure External Connections,” October 12, 2017

29. VA Directive 6300, “Records and Information Management,” September 21, 2018

30. VA Handbook, 6300.1, “Records Management Procedures,” March 24, 2010

31. NIST SP 800-37 Rev 2, “Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy,” December 2018

32. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020)

33. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015

34. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” March 24, 2014

35. OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005

36. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019

37. OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008

38. NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access,“ June 2018

39. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, “Digital Identity Guidelines,” updated March 02, 2020

40. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014

41. NIST SP 800-164, “Guidelines on Hardware-Rooted Security in Mobile Devices (Draft),” October 2012

42. VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

43. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

44. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

45. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

46. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019

47. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008

48. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (Public Law 110–140), December 19, 2007

49. Section 104 of the Energy Policy Act of 2005, (Public Law 109–58), August 8, 2005

50. Executive Order 13834, “Efficient Federal Operations,” dated May 17, 2018

51. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 2, 2001

52. VA Directive 0058, “VA Green Purchasing Program,” July 19, 2013

53. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

54. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

55. “Veteran Focused Integration Process (VIP) Guide 4.0,” January 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

56. VA Memorandum “Proper Use of Email and Other Messaging Services,” January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

57. “DevSecOps Product Line Management Playbook” version 2.0, May 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

58. NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020

59. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol Version 6 (IPv6),” November 19, 2020

60. Social Security Number (SSN) Fraud Prevention Act of 2017

61. Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23, 2018

62. H.R. 2429, VA Police Improvement and Accountability Act. June 16, 2021.

63. Office of Management and Budget (OMB) Memorandum 10-28, “Clarifying Cybersecurity Responsibilities and Activites of the Executive Office of the President and the Department of Homeland Security”

64. NIST 800-88, “Guidelines for Media Sanitization,” December 2014

65. VA Directive 6008, “Acquisition and Management of VA Information Technology Resources,” November 2, 2017

66. VA Directive 6512, “Secure Wireless Technology,” October 12, 2017

67. VA Directive/Handbook 6517, “Risk Management for Cloud Computing Services,” November 15, 2016

68. VA Directive 6609, “Mailing of Sensitive Personal Information,” May 20, 2011

3.0 SCOPE OF WORK

The scope of this contract is for the Contractor to provide all supervision, management, and labor required for the services outlined in this PWS. This activity supports the use of approximately 6000 Body Worn Cameras, 800 in dash vehicle cameras, and shall be integrated with the Digital Evidence Management System (DEMS) and Report Management System (RMS). Ancillary products include batteries, power cords, charging and data platform stations, kits, maintenance, software upgrades, signal activation devices and mounting hardware for BWC’s and In-Car Camera systems and warranty of products.

The scope of this contract is to obtain a Digital Evidence Management System (DEMS) and Report Management System (RMS) that is a one-turnkey solution with the ability functions and features capable of supporting the ongoing operations and activities of the Digital Evidence Management System (DEMS) and Report Management System (RMS). These Software as a Service (SaaS) licenses shall be utilized nationally by VA Police personnel to support the capture, ingest, management, and secure sharing of digital evidence, to include but not limited to body worn camera video and dashcam captured from VA Police Officers authorized for use on federal property.

The objective of this procurement to provide the Veterans Affairs Police with a system of record and a continuation of that system of record without break in service or break in operations and maintenance of an integrated car and body-worn camera video and audio platform that includes a DEMS and RMS which maintains the evidentiary value of the audio/video while providing a process to manage, redact, and release the data efficiently.

4.0 PERFORMANCE DETAILS

4.1 PERFORMANCE PERIOD

The Government intends to award a single Indefinite Delivery Indefinite Quantity (IDIQ) type contract.

Base Period: Date of Award through September 25, 2025 Option Period One: September 26, 2025 – September 25, 2026 Option Period Two: September 26, 2026 – September 25, 2027

Any work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO).

PLACE OF PERFORMANCE

Tasks under this PWS shall be performed at VA facilities located nation-wide. The Government anticipates shipment of product to be ordered and sent to VA Facilities within the United States, followed by teleconference calls for customer engagement to support operations of equipment. Work may be performed at remote locations with prior concurrence from the Contracting Officer’s Representative (COR). The Contractor staff shall be available to coordinate with VA Office Chief of Police and the Director of Operations and Administration on normal Federal Government workdays and be responsive between the core hours of 9:00 a.m. and 5:00 p.m. Eastern Standard Time.

4.2 TRAVEL

The Government does not anticipate travel under this effort to perform the tasks associated with the effort.

5.0 SPECIFIC TASKS AND DELIVERABLES

Tasks performed shall be of a non-personal nature. VA organization will not provide supervision of Contractor personnel. Contractor personnel shall at no time allow an employer-employee relationship to develop with VA organization or their staff. VA organizations will refrain from any activity that creates the appearance of such a relationship.

Contractors shall not perform inherently government functions including decision making, supervision of Government employees, supervision of other contractors on other contracts, and activities that create the appearance of performing such functions.

Contractor personnel shall have the level of experience necessary to accomplish the requirement of this PWS with reference to personal and professional conduct, and in technical knowledge. Furthermore, Contractor personnel are expected to be proficient in using office automation equipment and software and sufficient written and verbal communication skills to support VA program offices, their customers, and any other VA organization. Should any Contractor personnel be determined to be unacceptable in terms of technical competency or unacceptable conduct or behavior while on-site working on contract activities, the Contractor shall immediately remove and replace the unacceptable on-site personnel at no additional cost to the Government. Contractor personnel are to serve in a support role; therefore, final decisions regarding inherently governmental functions will always be made by Government personnel. The Contractor shall perform the following:

6.0 TECHNICAL KICK OFF MEETING

A technical kickoff meeting shall be held within 10 days after contract award. The Contractor shall coordinate the date, time, and location (can be virtual) with the Contracting Officer’s Representative (COR), as the Post-Award Conference Chairperson, the VA PM, as the Co-Chairperson, the Contract Specialist (CS), and the COR. The Contractor shall provide a draft agenda to the CO and COR at least five (5) calendar days prior to the meeting. Upon Government approval of a final agenda, the Contractor shall distribute to all meeting attendees. At the conclusion of the meeting, the Contractor shall update the presentation with a final slide entitled “Summary Report” which shall include notes on Action Items and, any major issues, agreements, or disagreements discussed during the kickoff meeting, attendance roster, Strategic Vision & Approach Plan, and the following statement “As the Post-Award Conference Chairperson, I have reviewed the entirety of this presentation and assert that it is an accurate representation and summary of the discussions held during the Technical Kickoff Meeting for the VA Body Worn Cameras and Data Evidence Management System and in-car vehicle cameras. The Contractor shall submit the final updated presentation to the COR for review and signature within three (3) calendar days after the meeting. The Contractor shall work with the government Task Leads, to ensure the contractor has accurately captured the salient points from the kickoff meeting. Once collaboration with Government Task Leads is complete, the contractor shall prepare the meeting minutes for acceptance by the COR/PM. prior to distribution of the meeting minutes to the COR, PM, and all attendees within three (3) calendar days after the meeting.

Deliverable:

A. Final Kickoff Presentation

7.0 REQUIREMENTS

1. The solution shall provide sufficient safeguards to ensure evidentiary integrity of the captured video and confirm valid receipt by the repository of the entire video before deleting original from the in-vehicle and body-worn system.

2. The system must have a role-based security model to control user access to features and data throughout the system.

3. The systems security model must provide a method to easily limit access to sensitive case information and people related to confidential cases.

4. The Vendors cameras must support a minimum quality of 720p for body-worn cameras, 720p for front and rear in-vehicle cameras and 480p for the backseat camera. The Vendors solution must include body-worn cameras that are integrated with the in-vehicle camera solution.

5. The Vendors solution must capture audio within the vehicle and the body-worn camera must have a remote microphone to record audio interaction outside of vehicle. 6. The Vendor must host and maintain the Data Evidence Management System in a secure cloud hosting environment providing all necessary hardware, software, system and database administration to manage the application including all test, training and production environments of the system.

7. Vendor shall provide documentation of FedRAMP compliance approval by solicitation due date.

7.1.1.1 REQUIREMENT FOR POLICE OFFICER BODY WORN CAMERA AND/OR IN-VEHICLE CAMERA SYTEMS:

1. High-definition Dual-View Camera with panoramic field of view, 12x zoom, and AI processing for automatic license plate reader (ALPR)

2. High-definition Interior Camera with infrared illumination for back seat view in complete darkness

3. Wireless Mic and Charging Base for capturing audio when outside of vehicle

4. Fleet Hub with connectivity, global navigation satellite system (GNSS), secure solid- state storage, and Signal inputs

5. Automatic transition from Buffering to Event mode with configurable Signals

6. Video Recall records last 24 hours of each camera in case camera not activated for an event

7. Mobile data terminal app, for controlling system, reviewing video, quick tagging, and more

8. Efficiently categorize, play back and share all video and audio alongside other digital files on management system database

9. Multi-cam playback, for reviewing up to four videos, including body-worn and in-car footage, at the same time

10. Fully integrated with management system and other recording devices

11. Automatic time synchronization with all Fleet and other on-officer cameras allows for multi-camera playback on management database system.

12. Prioritized upload to management system of critical event videos via 4G/LTE

13. Support install times, wireless updates, and quick remote troubleshooting

14. live stream, alerts, and location updates for situational awareness

15. The Vendors solution will provide a mobile gateway or mobile service device for video upload for all vehicle camera solutions with an activated MiFi or Data Plan service

16. ALPR hotlist alerts, plate read retention, and investigative search

7.1.1.2 REQUIRMENT FOR VIDEO CAMERAS

1. Video quality with reduced motion blur and better low-light performance

2. Multi-mic audio—four built-in microphones

3. Wireless upload option

4. Gunshot detection and alerts

5. Streaming audio and video capability

6. “Find my camera” feature

7. Verbal transcription and translation

8. End-to-end encryption

9. Minimum Twelve-hour battery

10. Up to 120-second buffering period to record footage before pressing record button

11. Integrate with a holster device that will automatically turn on a camera once a weapon is unholstered

7.1.1.3 REQUIRMENT FOR CLOUD SERVICE OF DIGITAL EVIDENCE MANAGEMENT SYSTEM

1. Is a current Criminal Justice Information Services (CJIS)/FedRAMP JAB Provisional

2. Authority to Operate (P-ATO) Authorized SaaS solution with an Authority to Operate

3. (ATO) rated for impact level high certified and authorized product

4. Is a turnkey solution that allows for secure management, access, and sharing of digital evidence

5. Provides VA wide enterprise licensing permitting unlimited usage

6. Can accept and provide media in all forms (.jpeg, .pdf, etc.)

7. Provides a secure method for requesting and receiving digital content from U.S.

Citizens

8. Shall provide redaction capabilities powered by Artificial Intelligence (AI).

9. Stores and supports various forms of third-party data ingests evidence collected from mobile phone application,

10. Allows secure case sharing with current partner agencies as well as the Executive Office of United States Attorneys (EOUSA) or States Attorney

11. Provides a minimum of 2.5 petabytes of storage (10GB per 250,000)

12. Is a SaaS model that reduces security and administration by local IT staff: no local installation required

13. Contractor shall provide automatic, timely security upgrades and enhancements deployed to application without the need for any local IT staff involvement

14. Controls access to evidence based on pre-defined roles and permissions and predefined individuals

15. Will have a password authentication system:

16. Password complexity, IP-based access restrictions, single sign-on, and multi-factor authentication support

17. Contractor shall have an automated category-based evidence retention policies assists with efficient database management in accordance with Federal Records rules of retention

18. Able to recover deleted evidence within seven days of deletion to ensure retention of evidence

19. Requires NO proprietary file formats avoiding additional cost

20. Able to upload files directly from the computer to DEMS via an Internet

21. Browser or the Evidence Sync desktop-based application

22. Is reliable: Fault- and disaster-tolerant infrastructure in at least 4 redundant data enters in both the East and West regions of the United States

23. Has chain-of custody capabilities: Audit logs automatically track all system and user activity. These logs cannot be edited or deleted, even by account administrators and IT staff to assist in chain of custody for case prosecution

24. Contractor shall have a dedicated information security department that protects the DEMS and data with security monitoring, centralized event log analysis and correlation, advanced threat and intrusion protection, and incident response capabilities

25. Provide enterprise licensing capable of supporting up to 9000 users

26. Training: provide initial training in-person and as required technical support in system upgrades.

7.1.1.4 REQUIRMENTS of AES ENCRYPTION FOR DATA STORAGE

Security Testing: Independent security firms perform in-depth security and penetration testing that will occur in a test environment allowing the VA Police the ability to also test the products in a timely manner

1. Reliability: Fault- and disaster-tolerant infrastructure in at least 4 redundant data centers in both the East and West regions of the United States

2. Chain-of-Custody: Audit logs automatically track all system and user activity. These logs cannot be edited or deleted, even by account administrators and IT staff

3. Protection: With no on-site application, critical evidence stored in Evidence is protected from local malware that may penetrate agency infrastructure security program

4. Application and data protected by a CJIS and ISO 27001 compliant information security program

5. Dedicated information security department that protects evidence management system and data with security monitoring, centralized event log analysis and correlation, advanced threat, and intrusion protection, and incident response capabilities

6. Redact videos easily within the system, create tags, markers, and clips, search 7 fields in addition to 5 category-based fields, create cases for multiple evidence files.

8.0 FEDERAL RISK AND AUTHOTIZATION MANAGEMENT PROGRAM

The Federal Risk and Authorization Management Program (FedRAMP) is an innovate policy approach to develop trusted relationships between Executive departments and agencies and cloud service providers (CSPs). FedRAMP reduces duplicative efforts, inconsistencies and cost efficiencies associated with current security authorization process. FedRAMP establishes a public-private partnership to promote innovative and the advancement of more secure information technologies. FedRAMP will enable the Federal Government to accelerate the adoption of cloud computing by creating transparent standards and processes for security authorizations and allowing agencies to leverage security authorizations on a government-wide scale.

The Contractor shall be compliant. The Contract shall be FedRamp compliant category High.

9.0 SAAS FEDRAMP REQUIREMENTS

9.1 FEDRAMP AUTHORIZED AND VA AUTHORIZED AT A HIGH RISK ATO

Deliverables:

A. SAR – delivered no later than 12 months from the previous SAR.

B. Continuous monitoring scans to be reviewed at monthly meetings.

C. Plan of Action and Milestones monthly reports.

D. Additional deliverables as outlined by FedRAMP’s continuous monitoring strategy.

E. VA Privacy and Security deliverables as directed by the VA System Owner.

9.2 NO VA Data:

1. Software-as-a-Service (SaaS) Solution The contractor shall provide a SaaS solution that does not have direct connections or interfaces to VA systems or networks. VA providers shall access the solution in a view-only mode or with limited functionality. The contractor shall ensure that no data is created, collected, processed, maintained, disseminated, or disposed of on behalf of the VA. The contractor shall comply with OMB Circular A-130, which defines federal-owned data as information owned or managed by the federal government, including information collected, maintained, and shared for government functions.

a. Data Handling for Veterans Using Devices

· User Consent: Veteran users who use the product shall consent to share their data, which may include Personally Identifiable Information (PII) and Protected Health Information (PHI), directly with the SaaS provider.

· Published Terms: The SaaS provider shall have published terms and conditions for user consent.

· Data Ownership: All data processed by the SaaS provider shall be owned by the SaaS provider or the Veteran user.

· Revocation: Veteran users shall have the ability to revoke data sharing with the SaaS provider at any point.

b. Data Sharing Revocation

· For systems classified as "No VA Data," the veteran is entering directly into a relationship with the SaaS provider and has granted their VA medical team one-way, view-only access to read the data.

· The medical team may then pull information into the veteran's/patient’s medical record.

· The veteran/patient may at any time revoke sharing with the SaaS provider and/or their medical care team.

· In the event that data sharing is revoked, the medical provider will retain data already shared but will immediately stop collecting additional data from the SaaS provider and veteran.

· VA shall make the Veteran, Caregiver or Veteran Representative aware of the disclosure of data to the third party and their ownership of the data.

10.0 GENERAL REQUIREMENTS

10.1 ENTERPRISE AND IT FRAMEWORK

10.1.1 VA TECHNICAL REFERENCE MODEL

The Contractor shall support the VA enterprise management framework. In association with the framework, the Contractor shall comply with OIT Technical Reference Model (VA TRM). The VA TRM is one component within the overall Enterprise Architecture (EA) that establishes a common vocabulary and structure for describing the information technology used to develop, operate, and maintain enterprise applications. Moreover, the VA TRM, which includes the Standards Profile and Product List, serves as a technology roadmap and tool for supporting OIT. Architecture & Engineering Services (AES) has overall responsibility for the VA TRM.

11.0 INTERNET PROTOCOL VERSION 6 (IPV6)

The Contractor shall support Internet Protocol Version 6 (IPv6) based upon the memo issued by the Office of Management and Budget (OMB) on November 19, 2020 (https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-07.pdf). IPv6 technology, in accordance with the USGv6 Program (https://www.nist.gov/programs-projects/usgv6-program/usgv6-revision-1), NIST Special Publication (SP) 500-267B Revision 1 “USGv6 Profile” (https://doi.org/10.6028/NIST.SP.500-267Br1), and NIST SP 800-119 “Guidelines for the Secure Deployment of IPv6” (https://doi.org/10.6028/NIST.SP.800-119), compliance shall be included in all IT infrastructures, application designs, application development, operational systems and sub-systems, and their integration. In addition to the above requirements, all devices shall support native IPv6 and dual stack (IPv6 / IPv4) connectivity without additional memory or other resources being provided by the Government, so that they can function in a mixed environment. All public/external facing servers and services (e.g. web, email, DNS, ISP services, etc.) shall support native IPv6 and dual stack (IPv6 / IPv4) users and all internal infrastructure and applications shall communicate using native IPv6 and dual stack (IPv6 / IPv4) operations.

11.1.1 TRUSTED INTERNET CONNECTION (TIC)

The Contractor solution shall meet the requirements outlined in Office of Management and Budget Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative“ (https://www.whitehouse.gov/wp-content/uploads/2019/09/M-19-26.pdf), VA Directive 6513 “Secure External Connections”, and shall comply with the TIC 3.0 Core Guidance Documents, including all Volumes and TIC Use Cases, found at the Cybersecurity & Infrastructure Security Agency (CISA) (https://www.cisa.gov/publication/tic-30-core-guidance-documents). Any deviations must be approved by the VA TIC 3.0 Working Group at vaoisesatic30team@va.gov.

11.1.2 STANDARD COMPUTER CONFIGURATION

The Contractor IT end user solution that is developed for use on standard VA computers shall be compatible with and be supported on the standard VA operating system, currently Windows 10 (64bit), Edge (Chromium based), and 365 Apps for enterprise. Applications delivered to VA and intended to be deployed to Windows 10 workstations shall be delivered as a signed .msi package with switches for silent and unattended installation and updates shall be delivered in signed .msp file formats for easy deployment using Microsoft Endpoint Configuration Manager (CM) VA’s current desktop application deployment tool. Signing of the software code shall be through a vendor provided certificate that is trusted by VA using a code signing authority such as Verizon/Cybertrust or Symantec/VeriSign. The Contractor shall also ensure and certify that their solution functions as expected when used from a standard VA computer, with non-admin, standard user rights that have been configured using the United States Government Configuration Baseline (USGCB) and Defense Information Systems Agency (DISA) Secure Technical Implementation Guide (STIG) specific to the particular client operating system being used.

11.1.3 VETERAN FOCUSED INTEGRATION PROCESS (VIP) AND PRODUCT LINE MANAGEMENT (PLM) The Contractor shall support VA efforts IAW the updated Veteran Focused Integration Process (VIP) and Product Line Management (PLM). The major focus of the new VIP is on Governance and Reporting and is less prescriptive, with a focus on outcomes and continuous delivery of value. Product Line Management (PLM) is a framework that focuses on delivering functional products that provide the highest priority work to customers while delivering simplified, reliable, and practical solutions to the business, medical staff, and our Veterans. The VIP Guide is a companion guide to the PLM Playbook and can be found at: https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371 and the PLM Playbook can be found at https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946. The PLM Playbook pivots from project-centric to product-centric delivery and contains descriptive practices that focuses on outcomes. The PLM Playbook contains a set of “plays” that implement Development, Security, and Operations (DevSecOps) principles and processes such as automated development, continuous integration/continuous delivery, and release on demand. The PLM Playbook details how product lines implement Lean-Agile principles, methods, practices, and techniques through levels of maturity. VIP and PLM are the authoritative processes that IT projects must follow to ensure development and delivery of IT products.

11.1.4 PROCESS ASSET LIBRARY (PAL)

The Contractor shall perform their duties consistent with the processes defined in the OIT Process Asset Library (PAL). The PAL scope includes the full spectrum of OIT functions and activities, such as VIP project management, operations, service delivery, communications, acquisition, and resource management. PAL serves as an authoritative and informative repository of searchable processes, activities or tasks, roles, artifacts, tools and applicable standards and guides to assist the OIT workforce, Government and Contractor personnel. The Contractor shall follow the PAL processes to ensure compliance with policies and regulations and to meet VA quality standards. The PAL includes the contractor onboarding process consistent with Section 6.2.2 and can be found at https://www.va.gov/PROCESS/artifacts/maps/process_CONB_ext.pdf. The main PAL can be accessed at www.va.gov/process.

11.1.5 AUTHORITATIVE DATA SOURCES

The VA Enterprise Architecture Repository (VEAR) is one component within the overall EA that establishes the common framework for data taxonomy for describing the data architecture used to develop, operate, and maintain enterprise applications. The Contractor shall comply with the department’s Authoritative Data Source (ADS) requirement that VA systems, services, and processes throughout the enterprise shall access VA data solely through official VA ADSs where applicable, see below. The Information Classes which compose each ADS are located in the VEAR, in the Data & Information domain. The Contractor shall ensure that all delivered applications and system solutions support:

1. Interfacing with VA’s Master Person Index (MPI) (formerly the Master Veteran Index (MVI)) to provision identity attributes, if the solution relies on VA user identities. MPI is the authoritative source for VA user identity data.

2. Interfacing with Capital Asset Inventory (CAI) to conduct real property record management actions, if the solution relies on real property records data. CAI is the authoritative source for VA real property record management data.

3. Interfacing with electronic Contract Management System (eCMS) for access to contract, contract line item, purchase requisition, offering vendor and vendor, and solicitation information above the micro-purchase threshold, if the solution relies on procurement data. ECMS is the authoritative source for VA procurement actions data.

4. Interfacing with HRSmart Human Resources Information System to conduct personnel action processing, on-boarding, benefits management, and compensation management, if the solution relies on personnel data. HRSmart is the authoritative source for VA personnel information data.

5. Interfacing with Vet360 to access personal contact information, if the solution relies on VA Veteran personal contact information data. Vet360 is the authoritative source for VA Veteran Personal Contact Data.

6. Interfacing with VA/Department of Defense (DoD) Identity Repository (VADIR) for determining eligibility for VA benefits under Title 38, if the solution relies on qualifying Active-Duty military service data. VADIR is the authoritative source for Qualifying Active-Duty military service in VA.

11.1.6 SOCIAL SECURITY NUMBER (SSN) REDUCTION

The Contractor solution shall support the Social Security Number (SSN) Fraud Prevention Act (FPA) of 2017 which prohibits the inclusion of SSNs on any document sent by mail. The Contractor support shall also be performed in accordance with Section 240 of the Consolidated Appropriations Act (CAA) 2018, enacted March 23, 2018, which mandates VA to discontinue using SSNs to identify individuals in all VA information systems as the Primary Identifier. The Contractor shall ensure that any new IT solution discontinues the use of SSN as the Primary Identifier to replace the SSN with the ICN in all VA information systems for all individuals. The Contractor shall ensure that all Contractor delivered applications and systems integrate with the VA Master Person Index (MPI) for identity traits to include the use of the ICN as the Primary Identifier. The Contractor solution may only use a Social Security Number to identify an individual in an information system if and only if the use of such number is required to obtain information VA requires from an information system that is not under the jurisdiction of VA.

11.2 METHOD AND DISTRIBUTION OF DELIVERABLES

The Contractor shall deliver documentation in electronic format, unless otherwise directed in Section B of the solicitation/contract. Acceptable electronic media include: Microsoft 365, MS Word 2000/2003/2007/2010/2019, MS Excel 2000/2003/2007/2010/2019, MS PowerPoint 2000/2003/2007/2010/2019, MS Project 2000/2003/2007/2010/2019, MS Access 2000/2003/2007/2010, MS Visio 2000/2002/2003/2007/2010/2019, AutoCAD 2002/2004/2007/2010, and Adobe Postscript Data Format (PDF).

11.3 PERFORMANCE METRICS

The table below defines the Performance Standards and Acceptable Levels of Performance associated with this effort.

A. Technical / Quality of Product

1. Meets technical needs and mission requirements

2. Provides quality services/products

Product is operable 99% of the workday

2. Products completed, reviewed, delivered in accordance with the established schedule

3. Notifies customer in advance of potential problems Product deliveries are provided with an on-time delivery rate of 95%

The COR will utilize a Quality Assurance Surveillance Plan (QASP) throughout the life of the contract to ensure that the Contractor is performing the services required by this PWS in an acceptable level of performance. The Government reserves the right to alter or change the surveillance methods in the QASP at its own discretion. A Performance Based Service Assessment will be used by the COR in accordance with the QASP to assess Contractor performance.

11.4 FACILITY/RESOURCE PROVISIONS

The Government will provide office space, telephone service, and system access when authorized contract staff work at a government location as required in order to accomplish the Tasks associated with this PWS. All procedural guides, reference materials, and program documentation for the project and other Government applications will also be provided on an as-needed basis.

The Contractor shall request other Government documentation deemed pertinent to the work accomplishment directly from the Government officials with whom the Contractor has contact. The Contractor shall consider the COR as the final source for needed Government documentation when the Contractor fails to secure the documents by other means. The Contractor is expected to use common knowledge and resourcefulness in securing all other reference materials, standard industry publications, and related materials that are pertinent to the work.

VA may provide remote access to VA specific systems/network in accordance with VA Handbook 6500, which requires the use of a VA approved method to connect external equipment/systems to VA’s network. Citrix Access Gateway (CAG) is the current and only VA approved method for remote access users when using or manipulating VA information for official VA Business. VA permits CAG remote access through approved Personally Owned Equipment (POE) and Other Equipment (OE) provided the equipment meets all applicable 6500 Handbook requirements for POE/OE. All of the security controls required for Government furnished equipment (GFE) must be utilized in approved POE or OE. The Contractor shall provide proof to the COR for review and approval that their POE or OE meets the VA Handbook 6500 requirements and VA Handbook 6500.6 Appendix C, herein incorporated as Addendum B, before use. CAG authorized users shall not be permitted to copy, print, or save any VA information accessed via CAG at any time. VA prohibits remote access to VA’s network from non-North Atlantic Treaty Organization (NATO) countries. The exception to this are countries where VA has approved operations established (e.g. Philippines and South Korea). Exceptions are determined by the COR in coordination with the Information Security Officer (ISO) and Privacy Officer (PO).

The Contractor shall not transmit, store, or otherwise maintain sensitive data or products in Contractor systems (or media) within the VA firewall IAW VA Handbook 6500.6 dated April 22, 2024. All VA sensitive information shall be protected at all times in accordance with VA Handbook 6500, local security field office System Security Plans (SSP’s) and Authority to Operate (ATO)’s for all systems/LAN’s accessed while performing the tasks detailed in this PWS. The Contractor shall ensure all work is performed in countries deemed not to pose a significant security risk. For detailed Security and Privacy Requirements (additional requirements of the contract consolidated into an addendum for easy reference) refer to ADDENDUM A – ADDITIONAL VA REQUIREMENTS, CONSOLIDATED and ADDENDUM B - VA INFORMATION AND INFORMATION SYSTEM SECURITY/PRIVACY LANGUAGE.

11.5 GOVERNMENT FURNISHED PROPERTY

Not Applicable

11.6 SHIPMENT OF HARDWARE OR EQUIPMENT

National Acquisitions

In accordance with the IT Asset Management (ITAM) PAL Process ITAM-02.01.01 Notify Logistics of Pending Shipment, for National Acquisitions, the “Master Delivery Schedule” must be completed by the VA PM (the Government portion as indicated within the Master Delivery Schedule Instructions) as it will become an attachment within the PWS. The PM must also add the contract deliverables specified in the below text to the Schedule for Deliverables table in the PWS. This Master Delivery Schedule will be updated by the Contractor and provided at delivery. See the Master Delivery Schedule Template within the PAL ITAM Process at http://vaww.oed.wss.va.gov/process/Library/master_delivery_schedule_template.xlsx.

All questions related to these instructions and the Master Delivery Schedule template/process shall be directed to the VA ITAAG and VA ITAAG RILOS distribution list in the Global Address List (GAL). For all equipment buys, ensure that this group is consulted to ensure proper cataloging of equipment early on in the planning stages of the procurement.

The Contractor shall complete the Master Delivery Schedule in accordance with the Instructions and shall coordinate with the COR for specifics. The Master Delivery Schedule shall be provided after award and updated prior to and after each delivery timeframe.

Shipment/Delivery Kick-off Meeting

The Contractor shall conduct a Shipment/Delivery Kick-off Meeting with the VA PM, COR, Delivery Date Coordinator, Implementation Manager, and Facility CIOs (or designee) to discuss delivery schedule requirements and facilitate delivery of equipment. This meeting may be held in conjunction with the post award conference or identified technical kickoff meeting. The Contractor shall also present the Shipment/Delivery Progress Report format for review and approval by the Government. This meeting, if held independently, shall be conducted telephonically within ten days after award and shall incorporate any delivery schedule changes to the draft Delivery Schedule identified by the Government.

The Contractor shall provide a Shipment/Delivery Progress Report which shall identify the items shipped, the serial number associated with each piece of equipment; the date of each shipment; the status of each shipment, tracking information, and information relative to Government-receipt of the equipment items at each delivery site. In addition, the Shipment/Delivery Progress Report shall identify any problems and provide a description of how the problems were resolved/addressed. If problems have not been completely resolved, the Contractor shall provide an explanation and status of resolution. Shipment/Delivery y Progress Reports shall be submitted in Microsoft Excel Format and shall clearly identify each serial number of the equipment being delivered with one (1) serial number per cell.

Inspection: Destination Acceptance: Destination Free on Board (FOB): Destination

Packing Slips/Labels and Lists shall also include the following:

IFCAP PO #: ____________ (e.g., 166-E11234 (the IFCAP PO number is located in block #20 of the SF 1449)) Project Description: (e.g. Tier 1 Lifecycle Refresh)

Total number of Containers: Package ___ of ___. (e.g., Package 1 of 3)

Deliverables:

A. Master Delivery Schedule

WARRANTIES

The contractor shall provide the standard manufacturer warranty for all installation of equipment and accessories. The warranty period shall begin when the item(s) is received by the Government if it passes the subsequent inspection by the VA Police personnel - not when the product is manufactured. The contractor shall notify the COR within ten (10) calendar days of any recall notices, warranty replacements, safety notices or other issues regarding the equipment and accessories.

Recall Notices. The contractor shall notify the Contracting Officer and the COR, in writing, within ten (10) calendar days of any recall notices, warranty replacements, or other safety issues regarding the equipment and accessories furnished under this contract. Failure to notify the Contracting Officer and the COR may result in the termination of this contract.

ADDENDUM A – ADDITIONAL VA REQUIREMENTS, CONSOLIDATED

A1.0 Cyber and Information Security Requirements for VA IT Services The Contractor shall ensure adequate LAN/Internet, data, information, and system security in accordance with VA standard operating procedures and standard PWS language, conditions, laws, and regulations. The Contractor’s firewall and web server shall meet or exceed VA minimum requirements for security. All VA data shall be protected behind an approved firewall. Any security violations or attempted violations shall be reported to the VA Program Manager and VA Information Security Officer as soon as possible. The Contractor shall follow all applicable VA policies and procedures governing information security, especially those that pertain to assessment and authorization and continuous monitoring

Contractor supplied equipment, PCs of all types, equipment with hard drives, etc.