S04 Pre-Sol - eInvoicing PWS.pdf

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Office of Information & Technology Financial Services Center

Electronic Invoicing

Date: June 16, 2021

TAC-20-57243

PWS Version Number: 1.0 https://vaww.admin.voa.va.gov/CustomerPortal/CustomerDetails.aspx?AcqRequestID=59252

DRAFT RFP 36C10A21Q0060

Contents

1.0 BACKGROUND

2.0 APPLICABLE DOCUMENTS

3.0 SCOPE OF WORK

4.0 PERFORMANCE DETAILS

4.1 PERFORMANCE PERIOD

4.2 PLACE OF PERFORMANCE

4.3 TRAVEL

5.0 SPECIFIC TASKS AND DELIVERABLES

5.1 PROJECT MANAGEMENT

5.1.1 CONTRACTOR PROJECT MANAGEMENT PLAN

5.1.2 REPORTING REQUIREMENTS

5.1.3 TECHNICAL KICKOFF MEETING

5.2.1 E-INVOICING SOLUTION AND SERVICES

5.2.2 E-INVOICING VENDOR ENROLLMENT

5.2.3 E-INVOICING CUSTOMER SUPPORT

5.6.1 BEGINNING OF TRANSITION:

5.6.2 END OF TERM:

6. GENERAL REQUIREMENTS

6.1 ENTERPRISE AND IT FRAMEWORK

6.2 VA TECHNICAL REFERENCE MODEL

6.3 FEDERAL IDENTITY, CREDENTIAL, AND ACCESS MANAGEMENT (FICAM)

6.4 INTERNET PROTOCOL VERSION 6 (IPV6)

6.5 TRUSTED INTERNET CONNECTION (TIC)

6.6 STANDARD COMPUTER CONFIGURATION

6.7 VETERAN FOCUSED INTEGRATION PROCESS (VIP)

6.8 PROCESS ASSETT LIBRARY (PAL)

6.9 AUTHORITATIVE DATA SOURCES

6.10 SECURITY AND PRIVACY REQUIREMENTS

6.10.1 POSITION/TASK RISK DESIGNATION LEVEL(S)

6.10.2 CONTRACTOR PERSONNEL SECURITY REQUIREMENTS

6.11 METHOD AND DISTRIBUTION OF DELIVERABLES

6.12 PERFORMANCE METRICS

6.13 FACILITY/RESOURCE PROVISIONS

1.0 BACKGROUND

The mission of the Department of Veterans Affairs (VA) Financial Services Center (FSC) is to provide benefits and services to Veterans of the United States. In meeting these goals, FSC strives to provide high quality, effective, and efficient Information Technology (IT) services for common financial administrative support. VA depends on Information Management/Information Technology (IM/IT) systems to meet mission goals. FSC currently offers electronic invoicing (e-Invoicing) through electronic data interchange (EDI), or a third-party electronic invoicing company. Approximately 95 percent of the 2.0 million invoices processed by the FSC annually are via e‐Invoicing.

The current e-Invoicing solution includes 450 automated integrations with high volume vendors and 45,000 web form accounts with lower volume vendors. The FSC objective is to reach a 98 percent automation rate by 2025. FSC requires services to continue as well as improve e‐Invoicing to improve quality, streamline business processes and reduce operating costs associated with the processing and paying of invoices. VA is currently undergoing a multi-year deployment to replace the existing financial system, and requires an e-Invoicing solution that supports both systems including future integration and enhancements.

2.0 APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1) 44 U.S.C. § 3541, “Federal Information Security Management Act (FISMA) of 2002”

2) Federal Information Processing Standards (FIPS) Publication 140-2, “Security Requirements For Cryptographic Modules”

3) 10 U.S.C. § 2224, "Defense Information Assurance Program"

4) Carnegie Mellon

5) 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

6) 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”

7) VA Directive 0710, “Personnel Suitability and Security Program,” June 4, 2010, http://www.va.gov/vapubs/

8) VA Handbook 0710, Personnel Suitability and Security Program, September

10, 2004, http://www.va.gov/vapubs

9) VA Directive and Handbook 6102, “Internet/Intranet Services,” July 15, 2008

10) 36 C.F.R. Part 1194 “Electronic and Information Technology Accessibility

Standards,” July 1, 2003

11) Office of Management and Budget (OMB) Circular A-130, “Management of

Federal Information Resources,” November 28, 2000

12) Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended by the Workforce Investment Act of 1998 (P.L. 105-220), August 7,

13) Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

14) VA Directive 6500, “Managing Information Security Risk: VA Information Security Program,” September 20, 2012

15) VA Handbook 6500, “Risk Management Framework for VA Information Systems – Tier 3: VA Information Security Program,” March 10, 2015

16) VA Handbook 6500.1, “Electronic Media Sanitization,” November 03, 2008

17) VA Handbook 6500.2, “Management of Data Breaches Involving Sensitive

Personal Information (SPI)”, January 6, 2012

18) VA Handbook 6500.3, “Assessment, Authorization, And Continuous

Monitoring of VA Information Systems,” February 3, 2014

19) VA Handbook 6500.6, “Contract Security,” March 12, 2010

20) VA Handbook 6500.8, “Information System Contingency Planning”, April 6,

21) National Institute Standards and Technology (NIST) Special Publications

(SP)

22) VA Directive 6508, VA Privacy Impact Assessment, October 3, 2008

23) VA Directive 6300, Records and Information Management, February 26,

24) VA Handbook, 6300.1, Records Management Procedures, March 24, 2010

25) OMB Memorandum, “Transition to IPv6”, September 28, 2010

26) VA Directive 0735, Homeland Security Presidential Directive 12 (HSPD-12)

Program, February 17, 2011

27) VA Handbook 0735, Homeland Security Presidential Directive 12 (HSPD-12)

Program, March 20, 2014

28) OMB Memorandum M-06-18, Acquisition of Products and Services for

Implementation of HSPD-12, June 30, 2006

29) OMB Memorandum 05-24, Implementation of Homeland Security

Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors, August 5, 2005

30) OMB memorandum M-11-11, “Continued Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors, February 3, 2011

31) OMB Memorandum, Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation, May 23, 2008

32) Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance, December 2, 2011

33) NIST SP 800-116, A Recommendation for the Use of Personal Identity Verification (PIV) Credentials in Physical Access Control Systems, November 20, 2008

34) OMB Memorandum M-07-16, Safeguarding Against and Responding to the Breach of Personally Identifiable Information, May 22, 2007

35) Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote Access”, January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

36) Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

37) Prompt Payment Act

38) National Institute of Standards and Technology (NIST) Special Publication

(SP) 800-37,"Guide for the Security Certification and Accreditation of Federal Information Systems": http://csrc.nist.gov/publications/nistpubs/800-37-rev1/sp800-37-rev1-final.pdf

3.0 SCOPE OF WORK

The Contractor shall provide an e-Invoicing service to support VA FSC vendor/contractor invoice processing based on a VA provided obligation number. In addition, the contractor shall provide e-Invoicing services for VA’s execution of Veterans Benefits Administration (VBA) payments based on an Authorization. Vendor/Contractor invoices as well as VBA Veterans Readiness and Employment (VR&E) payment requests shall be sent to the e-Invoicing solution and data shall be automatically exported from the e-Invoicing solution to the existing VA FSC invoice processing system. The Contractor shall provide an e-Invoicing solution that supports FSC internal and external users. Internal customers are VA users creating obligations and Authorization Numbers. External customers are vendors/contractors that invoice against obligations and Authorization Numbers. The contractor shall provide an e- Invoicing solution that allows vendors/contractors to access VA created obligations and Authorizations Numbers unique to the vendor/contractor and contract number. The Contractor shall provide commercial invoice processing in VA’s two financial systems:

Financial Management System (FMS) and the Integrated Financial and Acquisition Management System (IFAMS). The Contractor shall provide access to a wide network of vendors in order to streamline commercial invoice processing, as well as the ability to export, import, and integrate. The Contractor shall provide help desk services to both internal and external users.

4.0 PERFORMANCE DETAILS

4.1 PERFORMANCE PERIOD

The period of performance (PoP) shall be as follows:

Base: 12-months beginning date of award.

Option 1: 12-months following the base period.

Option 2: 12-months following option 1.

Option 3: 12-months following option 2.

Option 4: 12-months following option 3.

Option 5: 12-months following option 4.

Option 6: 12-months following option 5.

Option 7: 12-months following option 6.

Option 8: 12-months following option 7.

Option 9: 12-months following option 8.

Optional tasks shall have a PoP as follows:

Spend Analysis Tool (Section 5.4 below): 12-months beginning from the date of exercise.

Hyper Support (Section 5.5 below): 12-months beginning from the date of exercise.

Transition and Consulting Services (Section 5.5.1): 3-months beginning from the date of exercise.

Transition and Consulting Services (Section 5.5.2): 3-months beginning from the date of exercise.

Any work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO).

There are ten (10) Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, four are set by date:

New Year's Day January 1 Independence Day July 4 Veterans Day November 11 Christmas Day December 25

If any of the above falls on a Saturday, then Friday shall be observed as a holiday.

Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

Martin Luther King's Birthday Third Monday in January

Washington's Birthday Third Monday in February

Memorial Day Last Monday in May

Labor Day First Monday in September

Columbus Day Second Monday in October

Thanksgiving Fourth Thursday in November

4.2 PLACE OF PERFORMANCE

Tasks under this PWS shall be performed at Contractor facilities.

4.3 TRAVEL

The Government does not anticipate travel under this effort.

5.0 SPECIFIC TASKS AND DELIVERABLES

The Contractor shall perform the following:

5.1 PROJECT MANAGEMENT

5.1.1 CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, timeline, and tools to be used in execution of the contract. The CPMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks and resource support. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPMP shall be concurred upon and updated in accordance with Section B of the contract. The Contractor shall update and maintain the VA PM approved CPMP throughout the POP.

Deliverable: Contractor Project Management Plan

5.1.2 REPORTING REQUIREMENTS

The Contractor shall provide the Contracting Officer Representative (COR) with Monthly Progress Reports (MPR) in electronic form in Microsoft Word and Project formats. The report shall include detailed instructions/explanations for each required data element, to ensure that data is accurate and consistent. These reports shall reflect data as of the last day of the preceding month.

The MPR shall cover all work completed during the reporting period and work planned for the subsequent reporting period. The report shall also identify any problems that arose and a description of how the problems were resolved. If problems have not been completely resolved, the Contractor shall provide an explanation including their plan and timeframe for resolving the issue. The report shall also include an itemized list of all Information and Communication Technology (ICT) deliverables and the current Section 508 conformance status. The Contractor shall monitor performance against the CPMP and report any deviations. The Contractor shall keep in communication with VA accordingly so that issues that arise are transparent to both parties to prevent escalation of outstanding issues.

In addition to the information above, the Contractor shall include the following data in the monthly report:

a. Number of invoices delivered

b. Number of failed invoices with reason for failure

c. New vendors brought into the network with status:

i. Registered

ii. Implemented

iii. Ready for initial transactions

d. Log of customer issues including status and resolution

e. Log of upcoming and completed maintenance activities

f. For any Labor Hour work, a spend/rates/LCATs report that tracks the Contractor’s use of LH funding. This report shall include an explanation of why the work was not covered under the FFP tasks in this contract.

Deliverable: Monthly Progress Report

5.1.3 TECHNICAL KICKOFF MEETING

The Contractor shall hold a technical kickoff meeting within 10 days after contract award. The Contractor shall present, for review and approval by the Government, the details of the intended approach, work plan, and project schedule for each effort. The Contractor shall specify dates, locations (can be virtual), agenda (shall be provided to all attendees at least 5 calendar days prior to the meeting), and meeting minutes (shall be provided to all attendees within 3 calendar days after the meeting). The Contractor shall invite the Contracting Officer (CO), Contract Specialist (CS), COR, and the VA PM.

Deliverable: Technical Kick-off meeting presentation and minutes

5.2 E-INVOICING SOLUTION AND VENDOR EXPANSION

5.2.1 E-INVOICING SOLUTION AND SERVICES

The Contractor shall provide access to an e-Invoicing network and collaborate with VA FSC Financial Operations and IT Services to properly configure and implement the Electronic Invoicing solution so that it meets the business area requirements. The Contractor shall conduct a business requirements development phase in order to identify all business areas’ needs as new Government agencies and other VA organizations transition to use the contractor’s e-Invoicing solution. Implementation shall require multiple system integrations within each Government agency for which one or more initial set up efforts may be required. The contractor shall ensure the e-Invoicing solutions processes approximately 830,400 annual transactions with five percent growth expected each year throughout the PoP.

The Contractor shall provide an e-Invoicing solution to VA FSC’s commercial vendors with the following capabilities:

a. Ability to integrate directly with any accounting system for automatic transmittal of vendor invoices and ability to ensure secured file transmittals to the VA FSC of only valid and complete invoice data as identified by the Prompt Payment Act.

Any invalid, missing, or inaccurate invoice information shall be corrected prior to submission to the FSC. Currently 400 vendors/contractors have secure file transmission capability representing 75 percent of the annual transactions processed.

b. Provide invoice files to the FSC with the required invoice data fields with an accuracy rate of 99.9 percent.

c. Be capable of hourly transmission (if a payload is present) to the FSC with the required invoice data in an ANSI X-12810 format to be specified by VA. VA will specify format annually, and the contractor shall ensure update to the format is made within a mutually agreeable timeframe no more than 45 days.

d. Ensure transmission accuracy rate and on-time transmit rate of Electronic Invoicing data submitted exceeds 99.9 percent rate.

e. Acknowledge transmitted data to ensure that all records sent are received.

f. Ability to provide a minimum of two web forms with online edit checks for less complicated invoice information/data to accept invoice data and export the data to the FSC.

g. Ability to map information/data from all commercial accounting systems and export the required invoice data to VA FSC’s invoicing payment processing system.

h. Ability to accept and deliver to the VA FSC, VBA VR&E invoices for benefit payments.

i. Ability to detect and prevent duplicate invoices. The Contractor shall have in place a process to eliminate duplicate invoice submissions. FSC currently uses a combination of the purchase order/authorization number, invoice number, invoice date, and invoice amount fields to determine if an invoice is a duplicate submission. Duplicate invoices can be separated by significant time periods.

Contractor's solution shall eliminate the duplicates regardless of when the original or duplicate was submitted.

j. Provide an existing nationwide vendor/supplier network and the ability to support a minimum of 65,000 active vendors.

k. Ability to process a minimum of three (3) million invoices per year initially with the ability to scale up to approximately 35 million invoices per year.

l. Ability to receive Purchase Orders or VBA VR&E Authorizations from the VA and to provide the capability for the supplier to convert the PO or VR&E Authorization into an invoice (i.e., “PO Flip”).

m. Ability to ensure that invoices are validated against the appropriate Purchase Order/Authorization Number prior to delivering electronic invoices to VA FSC.

n. Ability to receive and then deliver a Purchase Order to the vendor in accordance with the required data elements, captured during the mapping process, to the vendor’s accounting system and populating the data elements.

o. Compliance with Section 508 web-based access requirements.

p. Compliance with Prompt Payment Act requirements.

q. Provide an audit trail, which FSC can use to review the entire e‐Invoicing system process from receipt of invoice through the file transmittal to the FSC. The Contractor shall provide a daily audit file which includes a history of the invoice data submitted. The history shall include the date and time of the invoice data file submission, file size (bytes), the invoice count, and any missing invoices based on comparison of Contractor files transmitted to FSC files received.

r. All client-facing resources shall be U.S. based.

s. VA data shall not be co-mingled with other e-Invoicing customer’s data.

t. The solution shall not require software or hardware purchase for use by the commercial vendor community.

u. All VA data shall be protected in a Tier-3 secure U.S. facility for the life of the contract.

v. Ability to accept VA upload of invoice status data.

w. Ability to provide invoice status to suppliers. The Contractor shall provide the capability for suppliers to obtain easy access and full visibility to relevant information relating to the processing and payment status of invoices.

x. The Contractor shall provide initial live interactive webinars (to be recorded), tutorials, and on-line training to a vendor community of approximately 38,000 within 30 days after implementation. The training shall be kept updated upon any system changes. The training material shall be delivered and ownership transferred to the Government upon execution of training, and when training material is updated by the contractor.

y. The Contractor is responsible for all VA invoice data until it is successfully received by the FSC.

The Contractor shall support the new Integrated Financial and Acquisition Management System (iFAMS) Enterprise Resource Planning (ERP) at VA FSC for commercial invoice processing. Contractor shall support both FMS and ERP iFAMS.

Note: e-Invoice data is imported into the FSC Invoice Payment Processing System (IPPS). After applying the business rules, IPPS will determine the appropriate routing of the invoice data. After invoice acceptance occurs, the invoice data shall be exported to the Financial Management System (FMS) or the VA system of record for financial management for payments and VA shall prepare an invoice status upload to the e- Invoicing system.

The Contractor shall include in the CPMP all documentation and support required for maintenance of the existing Accreditation and Authorization (A&A) for the e-Invoicing solution. A&A documentation and process requirements are found in National Institute of Standards and Technology (NIST) Special Publication (SP) 800-37, "Guide for the Security Certification and Accreditation of Federal Information Systems."

During the base period, the contractor shall provide a status of the system implementation monthly until the system is completely operational.

Deliverable:

A. Training Material B. System Implementation Status

5.2.2 E-INVOICING VENDOR ENROLLMENT

The Contractor’s e-Invoice solution shall include all tasks necessary to enroll additional VA FSC vendors in the electronic invoicing solution. The Contractor shall conduct ongoing efforts to expand and maintain vendor community integration with the e‐ Invoicing solution. The Contractor shall:

a. Provide a marketing and enrollment program to ensure the participation of the FSC vendor community that includes direct oral communication with the vendors, when appropriate, to assist them with the electronic invoicing process.

b. Perform all tasks necessary to enroll FSC vendors in the electronic invoicing solution.

c. Integrate approximately 25 new vendors per month.

d. Implement approximately 25 existing vendors per month with integration changes as required.

e. Provide approximately 2,000 web form modifications.

f. Provide a process to ensure that the vendor includes the correct VA vendor identification number on invoices submitted to the FSC for payment. Vendors are established in FMS with the federal tax identification number (TIN) as the FMS vendor code. The legal name for the vendor is placed on the Vendor Name line.

If there is a "doing business as" (dba) name for the location, that name is placed on Address Line 1 and on the "Vendor Name Xref" line in the FMS vendor file. If there are multiple locations for a vendor, each file is given a two‐digit alternate address indicator in the Vendor Code.

The Contractor shall provide a summary of vendor integration activity in the Monthly Progress Report.

5.2.3 E-INVOICING CUSTOMER SUPPORT

The Contractor shall:

a. Provide telephone support to customers/vendors Monday through Friday from 8AM EST to 7PM EST.

b. Maintain a log of issues reported by customers with status and resolution for inclusion in the Monthly Progress Report.

c. Provide development and implementation support to review and correct test files to ensure invoice data is uniform and can be processed for 450 Integrated Solution vendors within the base period.

d. Provide tracking and prioritization procedures to ensure customer issues are resolved in a timely manner.

e. Provide a Customer Support Request response time of one business day and resolution in five business days except for Integrated Solution vendors where a longer resolution period has been accepted by the COR.

f. Track and provide, monthly, a Customer Help Desk abandoned call rate metric of 3 percent or less.

The Contractor shall provide a summary of customer support activity in the Monthly Progress Report.

5.3 E-INVOICING MAINTENANCE AND REPORTING

The Contractor shall maintain the e‐Invoice solution. The Contractor shall provide:

a. Software updates approximately every quarter, or as required.

b. Security patches approximately every quarter, or as required.

c. System administration support.

d. File backup, and disaster recovery support.

e. Recurring maintenance notification two business days before scheduling

f. Recurring maintenance scheduled outside normal business hours.

g. Notification to COR within one hour if any network interruptions occur.

h. Network interruptions shall be restored within eight (8) hours from occurrence.

i. Root cause analysis and mitigation steps shall be provided within two (2) business days after network interruption.

The Contractor shall notify the VA PM/COR of changes to the VA account for review and approval before implementation. The Contractor shall provide a summary of maintenance activity in the Monthly Progress Report.

5.4 REPORTING & INVOICE SPEND ANALYSIS TOOL (OPTIONAL TASK)

– FFP (CLIN 10001)

The Contractor shall provide access to an enterprise reporting and spend analysis tool for FSC to self-evaluate data relating to electronic purchase orders and the payment of electronic invoices. The Contractor shall provide training to any FSC customer on tool functionalities and usage instructions and support analysis tool bug fixes and patches.

The training shall be conducted Live-Virtual, tutorial, and web-based recorded. The Contractor shall retain historical data for the life of this PWS, enough to support spend analysis throughout the PoP of this contract. This optional task can be exercised any time during the PoP; however, the optional task performance will not exceed the entirety of the contract PoP.

5.5 HYPERCARE SUPPORT SERVICES (OPTIONAL TASK) – LH (CLIN

10002)

The Contractor shall provide additional dedicated FTE resources for Hypercare support services. The anticipated, additional support is primarily needed for the implementation of internal and external issues associated with missing data, improper routing of data, and post project requirement changes which could lead to a potential degradation of overall service. Enhanced support shall address critical failure or when unexpected circumstances impact seamless post project alignment between all parties (VA, and Vendors, and the contractor). The additional support shall be provided on an as needed basis as directed by VA CO. As a requirement arises for additional support, the

Contractor shall provide a Technical Approach that includes the hours/rates/LCATs needed to meet the requirement. Following any negotiation, on approval by the CO, the Contractor may commence work. The Contractor shall not exceed the ceiling set in the Technical Approach without approval from the CO.

5.6 TRANSITION SERVICES (OPTIONAL TASK)

5.6.1 BEGINNING OF TRANSITION:

The Contractor shall provide on a weekly basis to the vendor community of approximately 35,000, interactive webinars, tutorials, and on-line training during vendor onboarding and transition, as defined and updated in the CPMP. As the transition period progresses and as new vendors become trained, the training shall then be offered on a monthly basis.

5.6.2 END OF TERM:

The Contractor shall support transition of all e-Invoicing data and processing from their e-Invoicing solution to an internal VA solution or another Contractor solution. The Contractor shall develop and deliver a Transition Plan 15 calendar days after exercise.

Transition support shall include at a minimum:

a. Migration/delivery of historical invoice data

b. Migration/delivery of historical customer information data

c. Delivery of Information on automated integrations

d. Migration/delivery of webform accounts

e. Delivery of custom built applications and software code.

Delivery of the above shall be in a format identified by VA at the time the option is exercised.

The Contractor shall implement the transition plan and conduct parallel operations for customer accounts until successful migration to the new solution has been validated.

The Contractor shall discontinue invoicing for each customer account as each migration is completed with a gradual phase-out.

Deliverable: Transition Plan, Data, Information and Webform Accounts.

6. GENERAL REQUIREMENTS

6.1 ENTERPRISE AND IT FRAMEWORK

6.2 VA TECHNICAL REFERENCE MODEL

The Contractor shall support the VA enterprise management framework. In association with the framework, the Contractor shall comply with OI&T Technical Reference Model (VA TRM). The VA TRM is one component within the overall Enterprise Architecture

(EA) that establishes a common vocabulary and structure for describing the information technology used to develop, operate, and maintain enterprise applications. Moreover, the VA TRM, which includes the Standards Profile and Product List, serves as a technology roadmap and tool for supporting OI&T. Architecture & Engineering Services (AES) has overall responsibility for the VA TRM.

6.3 FEDERAL IDENTITY, CREDENTIAL, AND ACCESS MANAGEMENT

(FICAM)

The Contractor shall ensure Commercial Off-The-Shelf (COTS) product(s), software configuration and customization, and/or new software are Personal Identity Verification (PIV) card-enabled by accepting HSPD-12 PIV credentials using VA Enterprise Technical Architecture (ETA), https://www.ea.oit.va.gov/EAOIT/VA_EA/Enterprise_Technical_Architecture.asp, and VA Identity and Access Management (IAM) approved enterprise design and integration patterns, http://www.techstrategies.oit.va.gov/enterprise_dp.asp. The Contractor shall ensure all Contractor delivered applications and systems comply with the VA Identity, Credential, and Access Management policies and guidelines set forth in the VA Handbook 6510 and align with the Federal Identity, Credential, and Access Management Roadmap and Implementation Guidance v2.0.

The Contractor shall ensure all Contractor delivered applications and systems provide user authentication services compliant with the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-63-3, VA Handbook 6500 Appendix F, “VA System Security Controls”, and VA IAM enterprise requirements for direct, assertion based authentication, and/or trust based authentication, as determined by the design and integration patterns. Direct authentication at a minimum must include Public Key Infrastructure (PKI) based authentication supportive of PIV card and/or Common Access Card (CAC), as determined by the business need.

The Contractor shall ensure all Contractor delivered applications and systems conform to the specific Identity and Access Management PIV requirements set forth in the Office of Management and Budget (OMB) Memoranda M-04-04, M-05-24, M-11-11, and NIST Federal Information Processing Standard (FIPS) 201-2. OMB Memoranda M-04-04, M- 05-24, and M-11-11 can be found at:

https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/omb/memoranda/fy 04/m04-04.pdf, https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/omb/memoranda/fy 2005/m05-24.pdf, and https://obamawhitehouse.archives.gov/sites/default/files/omb/memoranda/2011/m11- 11.pdf respectively. Contractor delivered applications and systems shall be on the FIPS 201-2 Approved Product List (APL). If the Contractor delivered application and system is not on the APL, the Contractor shall be responsible for taking the application and system through the FIPS 201 Evaluation Program.

https://www.ea.oit.va.gov/EAOIT/VA_EA/Enterprise_Technical_Architecture.asp http://www.techstrategies.oit.va.gov/enterprise_dp.asp https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/omb/memoranda/fy04/m04-04.pdf https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/omb/memoranda/fy04/m04-04.pdf https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/omb/memoranda/fy2005/m05-24.pdf https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/omb/memoranda/fy2005/m05-24.pdf https://obamawhitehouse.archives.gov/sites/default/files/omb/memoranda/2011/m11-11.pdf https://obamawhitehouse.archives.gov/sites/default/files/omb/memoranda/2011/m11-11.pdf

The Contractor shall ensure all Contractor delivered applications and systems support:

Automated provisioning and can use enterprise provisioning service.

Interfacing with VA’s Master Veteran Index (MVI) to provision identity attributes, if the solution relies on VA user identities. MVI is the authoritative source for VA user identity data.

The VA defined unique identity (Secure Identifier [SEC ID] / Integrated Control Number [ICN]).

Multiple authenticators for a given identity and authenticators at every Authenticator Assurance Level (AAL) appropriate for the solution.

Identity proofing for each Identity Assurance Level (IAL) appropriate for the solution.

Federation for each Federation Assurance Level (FAL) appropriate for the solution, if applicable.

Two-factor authentication (2FA) through an applicable design pattern as outlined in VA Enterprise Design Patterns.

A Security Assertion Markup Language (SAML) implementation if the solution relies on assertion based authentication. Additional assertion implementations, besides the required SAML assertion, may be provided as long as they are compliant with NIST SP 800-63-3 guidelines.

Authentication/account binding based on trusted Hypertext Transfer Protocol (HTTP) headers if the solution relies on Trust based authentication.

Role Based Access Control.

Auditing and reporting capabilities.

Compliance with VAIQ# 7712300 Mandate to meet PIV requirements for new and existing systems.

https://www.voa.va.gov/DocumentView.aspx?DocumentID=4846

The required Assurance Levels for this specific effort are Identity Assurance Level 3, Authenticator Assurance Level 3, and Federation Assurance Level 3.

6.4 INTERNET PROTOCOL VERSION 6 (IPV6)

The Contractor solution shall support the latest Internet Protocol Version 6 (IPv6) based upon the directives issued by the Office of Management and Budget (OMB) on August 2, 2005 (https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/omb/memoranda/f y2005/m05-22.pdf) and September 28, 2010 (https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/egov_docs/transiti on-to-ipv6.pdf). IPv6 technology, in accordance with the USGv6 Profile, NIST Special Publication (SP) 500-267 (https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication500-267.pdf), the Technical Infrastructure for USGv6 Adoption (https://www.nist.gov/programs-https://www.voa.va.gov/DocumentView.aspx?DocumentID=4846 https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/omb/memoranda/fy2005/m05-22.pdf https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/omb/memoranda/fy2005/m05-22.pdf https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/egov_docs/transition-to-ipv6.pdf https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/egov_docs/transition-to-ipv6.pdf https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication500-267.pdf https://www.nist.gov/programs-projects/usgv6-program projects/usgv6-program), and the NIST SP 800 series applicable compliance (https://csrc.nist.gov/publications/sp) shall be included in all IT infrastructures, application designs, application development, operational systems and sub-systems, and their integration. In addition to the above requirements, all devices shall support native IPv6 and/or dual stack (IPv6 / IPv4) connectivity without additional memory or other resources being provided by the Government, so that they can function in a mixed environment. All public/external facing servers and services (e.g. web, email, DNS, ISP services, etc.) shall support native IPv6 and/or dual stack (IPv6/ IPv4) users and all internal infrastructure and applications shall communicate using native IPv6 and/or dual stack (IPv6/ IPv4) operations. Guidance and support of improved methodologies which ensure interoperability with legacy protocol and services in dual stack solutions, in addition to OMB/VA memoranda, can be found at:

https://www.voa.va.gov/documentlistpublic.aspx?NodeID=282.

6.5 TRUSTED INTERNET CONNECTION (TIC)

The Contractor solution shall meet the requirements outlined in Office of Management and Budget Memorandum M08-05 mandating Trusted Internet Connections (TIC) (https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/omb/memoranda/f y2008/m08-05.pdf), M08-23 mandating Domain Name System Security (NSSEC) (https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/omb/memoranda/f y2008/m08-23.pdf), and shall comply with the Trusted Internet Connections (TIC) Reference Architecture Document, Version 2.0 https://www.dhs.gov/sites/default/files/publications/TIC_Ref_Arch_v2.2_2017.pdf.

6.6 STANDARD COMPUTER CONFIGURATION

The Contractor IT end user solution that is developed for use on standard VA computers shall be compatible with and be supported on the standard VA operating system, currently Windows 7 (64bit), Internet Explorer 11 and Office 365 ProPlus. In preparation for the future VA standard configuration update, end user solutions shall also be compatible with Windows 10. However, Windows 10 is not the VA standard yet and is currently approved for limited use during its rollout. We are in-process of this rollout and making Windows 10 the standard for OI&T. Upon the release approval of Windows 10 as the VA standard, Windows 10 will supersede Windows 7 respectively. Applications delivered to the VA and intended to be deployed to Windows 7 workstations shall be delivered as a signed .msi package with switches for silent and unattended installation and updates shall be delivered in signed .msp file formats for easy deployment using System Center Configuration Manager (SCCM) VA’s current desktop application deployment tool. Signing of the software code shall be through a vendor provided certificate that is trusted by the VA using a code signing authority such as Verizon/Cybertrust or Symantec/VeriSign. The Contractor shall also ensure and certify that their solution functions as expected when used from a standard VA computer, with non-admin, standard user rights that have been configured using the United States Government Configuration Baseline (USGCB) and Defense Information https://www.nist.gov/programs-projects/usgv6-program https://csrc.nist.gov/publications/sp https://www.voa.va.gov/documentlistpublic.aspx?NodeID=282 https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/omb/memoranda/fy2008/m08-05.pdf https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/omb/memoranda/fy2008/m08-05.pdf https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/omb/memoranda/fy2008/m08-23.pdf https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/omb/memoranda/fy2008/m08-23.pdf https://www.dhs.gov/sites/default/files/publications/TIC_Ref_Arch_v2.2_2017.pdf

Systems Agency (DISA) Secure Technical Implementation Guide (STIG) specific to the particular client operating system being used.

6.7 VETERAN FOCUSED INTEGRATION PROCESS (VIP)

The Contractor shall support VA efforts IAW the Veteran Focused Integration Process (VIP). VIP is a Lean-Agile framework that services the interest of Veterans through the efficient streamlining of activities that occur within the enterprise. The VIP Guide can be found at https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371. The VIP framework creates an environment delivering more frequent releases through a deeper application of Agile practices. In parallel with a single integrated release process, VIP will increase cross-organizational and business stakeholder engagement, provide greater visibility into projects, increase Agile adoption and institute a predictive delivery cadence. VIP is now the single authoritative process that IT projects must follow to ensure development and delivery of IT products

6.8 PROCESS ASSETT LIBRARY (PAL)

The Contractor shall perform their duties consistent with the processes defined in the OIT Process Asset Library (PAL). The PAL scope includes the full spectrum of OIT functions and activities, such as VIP project management, operations, service delivery, communications, acquisition, and resource management. PAL serves as an authoritative and informative repository of searchable processes, activities or tasks, roles, artifacts, tools and applicable standards and guides to assist the OIT workforce, Government and Contractor personnel. The Contractor shall follow the PAL processes to ensure compliance with policies and regulations and to meet VA quality standards. The PAL includes the contractor onboarding process consistent with Section

6.2.2 and can be found at https://www.va.gov/PROCESS/artifacts/maps/process_CONB_ext.pdf. The main PAL can be accessed at www.va.gov/process.

6.9 AUTHORITATIVE DATA SOURCES

The VA Enterprise Architecture Repository (VEAR) is one component within the overall Enterprise Architecture (EA) that establishes the common framework for data taxonomy for describing the data architecture used to develop, operate, and maintain enterprise applications. The Contractor shall comply with the department’s Authoritative Data Source (ADS) requirement that VA systems, services, and processes throughout the enterprise shall access VA data solely through official VA ADSs where applicable, see below. The Information Classes which compose each ADS are located in the VEAR, in the Data & Information domain. The Contractor shall ensure that all delivered applications and system solutions support:

Interfacing with VA’s Master Veteran Index (MVI) to provision identity attributes, if the solution relies on VA user identities. MVI is the authoritative source for VA user identity data.

https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371 https://www.va.gov/PROCESS/artifacts/maps/process_CONB_ext.pdf http://www.va.gov/process

Interfacing with Capital Asset Inventory (CAI) to conduct real property record management actions, if the solution relies on real property records data. CAI is the authoritative source for VA real property record management data.

Interfacing with electronic Contract Management System (eCMS) for access to contract, contract line item, purchase requisition, offering vendor and vendor, and solicitation information above the micro-purchase threshold, if the solution relies on procurement data. ECMS is the authoritative source for VA procurement actions data.

Interfacing with HRSmart Human Resources Information System to conduct personnel action processing, on-boarding, benefits management, and compensation management, if the solution relies on personnel data.

HRSmart is the authoritative source for VA personnel information data.

Interfacing with Vet360 to access personal contact information, if the solution relies on VA Veteran personal contact information data. Vet360 is the authoritative source for VA Veteran Personal Contact Data.

Interfacing with VA/Department of Defense (DoD) Identity Repository (VADIR) for determining eligibility for VA benefits under Title 38, if the solution relies on qualifying active duty military service data. VADIR is the authoritative source for Qualifying Active Duty military service in the VA.

6.10 SECURITY AND PRIVACY REQUIREMENTS

6.10.1 POSITION/TASK RISK DESIGNATION LEVEL(S)

In accordance with VA Handbook 0710, Personnel Security and Suitability Program, the position sensitivity and the level of background investigation commensurate with the required level of access for the following tasks within the PWS are:

Position Sensitivity and Background Investigation Requirements by Task

Task Number Tier1 / Low Risk Tier 2 / Moderate Risk Tier 4 / High Risk

6.1

6.2

6.3

7.1

7.2

7.3

The Tasks identified above and the resulting Position Sensitivity and Background Investigation requirements identify, in effect, the Background Investigation requirements for Contractor individuals, based upon the tasks the particular Contractor individual will be working. The submitted Contractor Staff Roster must indicate the required

Background Investigation Level for each Contractor individual based upon the tasks the Contractor individual will be working, in accordance with their submitted proposal.

6.10.2 CONTRACTOR PERSONNEL SECURITY REQUIREMENTS

Contractor Responsibilities:

a. The Contractor shall prescreen all personnel requiring access to the computer systems to ensure they maintain the appropriate Background Investigation, and are able to read, write, speak and understand the English language.

b. Within 3 business days after award, the Contractor shall provide a roster of Contractor and Subcontractor employees to the COR to begin their background investigations in accordance with the PAL template artifact.

The Contractor Staff Roster shall contain the Contractor’s Full Name, Date of Birth, Place of Birth, individual background investigation level requirement (based upon Section 6.2 Tasks), etc. The Contractor shall submit full Social Security Numbers either within the Contractor Staff Roster or under separate cover to the COR. The Contractor Staff Roster shall be updated and provided to VA within 1 day of any changes in employee status, training certification completion status, Background Investigation level status, additions/removal of employees, etc. throughout the Period of Performance. The Contractor Staff Roster shall remain a historical document indicating all past information and the Contractor shall indicate in the Comment field, employees no longer supporting this contract. The preferred method to send the Contractor Staff Roster or Social Security Number is by encrypted e-mail. If unable to send encrypted e-mail, other methods which comply with FIPS 140-2 are to encrypt the file, use a secure fax, or use a traceable mail service.

c. The Contractor should coordinate with the location of the nearest VA fingerprinting office through the COR. Only electronic fingerprints are authorized. The Contractor shall bring their completed Security and Investigations Center (SIC) Fingerprint request form with them (see paragraph d.4. below) when getting fingerprints taken.

d. The Contractor shall ensure the following required forms are submitted to the COR within 5 days after contract award:

1. Optional Form 306

2. Self-Certification of Continuous Service

3. VA Form 0710

4. Completed SIC Fingerprint Request Form

e. The Contractor personnel shall submit all required information related to their background investigations (completion of the investigation documents (SF85, SF85P, or SF 86) utilizing the Office of Personnel

Management’s (OPM) Electronic Questionnaire for Investigations Processing (e-QIP) after receiving an email notification from the Security and Investigation Center (SIC).

f. The Contractor employee shall certify and release the e-QIP document, print and sign the signature pages, and send them encrypted to the COR for electronic submission to the SIC. These documents shall be submitted to the COR within 3 business days of receipt of the e-QIP notification email.

(Note: OPM is moving towards a “click to sign” process. If click to sign is used, the Contractor employee should notify the COR within 3 business days that documents were signed via e-QIP).

g. The Contractor shall be responsible for the actions of all personnel provided to work for VA under this contract. In the event that damages arise from work performed by Contractor provided personnel, under the auspices of this contract, the Contractor shall be responsible for all resources necessary to remedy the incident.

h. A Contractor may be granted unescorted access to VA facilities and/or access to VA Information Technology resources (network and/or protected data) with a favorably adjudicated Special Agreement Check (SAC), completed training delineated in VA Handbook 6500.6 (Appendix C, Section 9), signed “Contractor Rules of Behavior”, and with a valid, operational PIV credential for PIV-only logical access to VA’s network. A PIV card credential can be issued once your SAC has been favorably adjudicated and your background investigation has been scheduled by OPM. However, the Contractor will be responsible for the actions of the Contractor personnel they provide to perform work for VA. The investigative history for Contractor personnel working under this contract must be maintained in the database of OPM.

i. The Contractor, when notified of an unfavorably adjudicated background investigation on a Contractor employee as determined by the Government, shall withdraw the employee from consideration in working under the contract.

j. Failure to comply with the Contractor personnel security investigative requirements may result in loss of physical and/or logical access to VA facilities and systems by Contractor and Subcontractor employees and/or termination of the contract for default.

k. Identity Credential Holders must follow all HSPD-12 policies and procedures as well as use and protect their assigned identity credentials in accordance with VA policies and procedures, displaying their badges at all times, and returning the identity credentials upon termination of their relationship with VA.

Deliverable: Contractor Staff Roster

6.11 METHOD AND DISTRIBUTION OF DELIVERABLES

The Contractor shall deliver documentation in electronic format, unless otherwise directed in Section B of the solicitation/contract. Acceptable electronic media include:

MS Word 2000/2003/2007/2010, MS Excel 2000/2003/2007/2010, MS PowerPoint 2000/2003/2007/2010, MS Project 2000/2003/2007/2010, MS Access 2000/2003/2007/2010, MS Visio 2000/2002/2003/2007/2010, AutoCAD 2002/2004/2007/2010, and Adobe Postscript Data Format (PDF).

6.12 PERFORMANCE METRICS

The table below defines the Performance Standards and Acceptable Levels of Performance associated with this effort.

Performance Objective

Performance Standard Acceptable Levels of Performance

Technical / Quality of Product or Service

Demonstrates understanding of requirements Efficient and effective in meeting requirements Meets technical needs and mission requirements Provides quality services/products

Satisfactory or higher

Project Milestones and Schedule

Established milestones and project dates are met Products completed, reviewed, delivered in accordance with the established schedule Notifies customer in advance of potential problems

Satisfactory or higher

Staffing Currency of expertise and staffing levels appropriate Personnel possess necessary knowledge, skills and abilities to perform tasks

Satisfactory or higher

Management Integration and coordination of all activities to execute effort

Satisfactory or higher

The COR will utilize a Quality Assurance Surveillance Plan (QASP) throughout the life of the contract to ensure that the Contractor is performing the services required by this PWS in an acceptable level of performance. The Government reserves the right to alter or change the surveillance methods in the QASP at its own discretion.

6.13 FACILITY/RESOURCE PROVISIONS

The Government…