Saas IAM_Product_Description_draft_2024-05-11 - RFI.docx

Saas IAM Product TAC Number: VA-24-XXXXXXXX >

PRODUCT DESCRIPTION (PD) DRAFT

DEPARTMENT OF VETERANS AFFAIRS

Office of Information & Technology Product Engineering Services

VA Enterprise Software as a Service (SaaS) Identity Access Management (IAM) product

Date: April 24, 2024

<VA-FY-XXXXXXXX>

PD Version Number: <0.1>

Contents

DESCRIPTION

The Department of Veterans Affairs (VA), Office of Information and Technology (OIT) requires a Software-as-a-Service (SaaS) Identity and Access Management (IAM) product for both internal (workforce) and external users (Veterans, caregivers, etc.) that provides the required capabilities as part of a single product. The solution will provide a single cloud-native, Federal Risk and Authorization Management Program (FedRAMP) High authorized, SaaS IAM product that will meet current and future requirements for a department-wide enterprise Identity Provider (IdP), including authentication, access management, automated administration, and reporting. The product must adhere to federal cybersecurity standards and guidance, ensuring robust authentication protocols, encryption mechanisms, and adherence to security frameworks such as National Institute of Standards and Technology (NIST) Special Publication (SP) 800-63 and Federal Information Processing Standards (FIPS) 140-2. A single integrated SaaS IAM product is required to maximize interoperability across capabilities and features, such as custom workflows and the access management features, and provide a more consistent user experience. VA requires the ability to automate complex workforce and customer identity workflows using a no-code/low-code GUI-based automation platform to streamline administration of the identity solution, eliminate time-consuming tasks and reducing errors due to manual entry. VA also maintains a complex suite of modern and legacy digital products and services, some of which require the capability to support legacy authentication protocols and technologies.

The solution shall include:

Workforce IAM capabilities to support identity management, authentication, and access management for employees and other internal users accessing internal VA applications and services, including VA-managed computers. This includes provisioning and managing workforce identities in a central user directory, Single Sign-On (SSO) capabilities supporting adaptive Multi-Factor Authentication (MFA), including Personal Identity Verification (PIV)/Common Access Card (CAC) cards and other alternative methods, Application Programming Interface (API) access management, and adaptive “real-time” cybersecurity threat monitoring and reporting.

Customer IAM capabilities to support identity management, authentication, and access management for Veterans, their delegates, and other external users accessing public-facing VA applications and services. This includes inbound federation with third-party Credential Service Providers, API Access management, Adaptive MFA, self-service account management, integration with VA identity data repositories, support for patient access to healthcare-related data following the Fast Healthcare Interoperability Resources (FHIR) standard, and adaptive “real-time” cybersecurity threat monitoring and reporting.

Custom automation capabilities to automate recurring administrative tasks and workflows as well as customize workforce and external user authentication flows using a no-code/low-code GUI-based automation platform, allowing workflows to be created and managed by authorized users across the VA.

Legacy application support to allow the SaaS IAM product to integrate with the numerous legacy systems that the VA uses to support its critical operations, including healthcare services, benefits administration, burial, and veteran support programs. While many VA systems support direct integration with a cloud IAM solution over standard protocols, some critical systems are deployed in “on-premises” environments and/or don’t support modern authentication protocols. Until such systems are modernized or replaced, the SaaS IAM product will need to provide a bridge/connector between those legacy systems and the cloud-hosted product.

General platform capabilities including high (99.99% or greater) availability, conformance to security standards such as NIST SP 800-63 and FIPS 140-2, FedRAMP High authorization, support for multiple deployment environments, including sandbox environments, API-based product configuration and management, custom reporting and alerting.

Product support to include dedicated support staff available to address complex technical issues and support incident response and remediation 24x7.

Professional services to provide technical support and subject matter expertise to support the initial setup, configuration, deployment, and expansion of the SaaS IAM product within the VA as well as the transition from existing VA IAM solutions to the SaaS IAM product, advisory and project support to facilitate the integration of VA systems with the SaaS IAM product, guidance and support enabling and leveraging advanced features and capabilities, and support with security and compliance activities to mitigate risks and maintain the VA Authority to Operate (ATO) for the SaaS IAM product.

Training materials to provide accessible and comprehensive training materials, including documentation, tutorials, and video guides, to empower users (both end-users and administrators) to understand how to use the SaaS IAM product effectively, as well as interactive training sessions, certification tracks, and periodic refresher courses should be provided to ensure users remain informed about security best practices and the latest features of the SaaS IAM product.

The Period of Performance (PoP) shall be: August 1, 2024 – July 31, 2027.

Specific requirements include the following:

PRODUCT REQUIREMENTS

The SaaS IAM solution shall be a single SaaS product that provides:

· General Capabilities – capabilities to provide users with secure, seamless access to applications and services while simplifying identity management and administration while meeting security and compliance guidelines.

· Identity Management Capabilities – capabilities to allow the VA to manage a collection of internal workforce/enterprise and external customer/Veteran identities that are able to access VA systems and services.

· Authentication Capabilities – capabilities to allow users to sign in to digital services and systems using multi-factor authentication and federated access through Credential Service Providers.

· Access Management Capabilities – capabilities to allow the VA to grant access to only those users authorized to access a given systems based on their role and/or other factors.

· Single-Sign On (SSO) Federation with IDPs – capabilities to support SSO federation with agency IDP’s, allowing transparent authentications and access to applications across multiple platforms while maintaining centralized control over user identities and access policies.

· Legacy System Support Capabilities – capabilities to support the integration of legacy systems with the SaaS IAM solution in cases where those legacy systems do not support modern authentication protocols.

· Automation Capabilities – capabilities to automate recurring administrative tasks and workflows as well as customize workforce and external user authentication flows using a no-code/low-code GUI-based automation platform, allowing workflows to be created and managed by authorized users across the VA.

· Compliance and Reporting – capabilities to enable agency to effortlessly adhere to regulatory standards and reporting requirements through robust compliance features and detailed reporting capabilities.

· Availability and Support – capabilities to ensure high availability through redundant cloud infrastructure and offer thorough support services to promptly address any issues or downtime, minimizing disruption to users and business operations.

· User Training and Certification – provide comprehensive user training materials and resources to ensure users understand authentication processes, security best practices, and how to effectively utilize the SSO product solution inclusive of certified training where applicable.

· Professional Services – provide Subject Matter Experts (SMEs) to assist operational teams implementing and operating the SaaS IAM solution with product setup, initial configuration, and application onboarding.

Salient Characteristics The SaaS IAM solution must include all of the following capabilities and characteristics:

2. Universal Directory - Integration and management of identities and groups to/from Active Directory, and other authoritative identity sources. Identity sourcing and account/attribute provisioning for connected applications.

3. Adaptive Multi-Factor Authentication AAL2/AAL3 compliant authentication of users accessing applications and systems. Step-up authentication policies for sessions based on user risk/behavior/context.

4. Lifecycle Management (LCM) - Automate the control of user identity from creation to deletion, ensuring the right people have access to the right resources, and that accounts are automatically deleted or modified when the user leaves the VA or moves to a new role. Lifecycle Management covers the full workforce, from employees to contractors.

5. API Management Platform - Cloud-based Sandbox and Production environments and a developer portal and API gateway that are publicly accessible and external to the VA’s internal network, used by third-party applications, and their developers, to create digital products on behalf of VA, utilizing APIs available through the gateway.

6. API Access Management (e.g. Lighthouse) - Control access and authorization to all of the VA’s APIs and microservices based on OAuth2.0.

7. Workflow Engine - Automate complex and repeatable administrative tasks and customize customer and workforce identity workflows, using a GUI-based low-code and no-code platform and pre-built connectors to other VA systems.

8. Inbound Federation: Ability for the SaaS IAM solution to accept authentication from an external SAML or OIDC IDP which is critical for the VA’s public facing services.

9. FedRAMP High authorization

10. Ability to receive a SaaS Authority to Operate (ATO) within the VA

11. Ability to migrate and operationalize 100's of applications from legacy IAM systems to new solution for both workforce and customer identity use cases.

2. Support External Users - Veterans, Beneficiaries Caregivers, Business Partners

2. Users can authenticate with their Active Directory username, password, and an additional authentication factor.

3. Integrated Windows Authentication capabilities such that a user can use the SaaS IAM solution to sign into Windows 10 with multiple authentication factors, i.e. the user must present two separate factors of something they know, e.g. a password, something they have in addition to the Windows machine, e.g. a mobile phone running a one-time passcode generator, or something they are, e.g. a fingerprint. This must support shared workstations with more than 10 users, machines that do not include any biometric sensors, and machines that are both portable and located onsite. Similar integrated macOS authentication capabilities supporting macOS 13 (Ventura).

4. Users can authenticate with an External Credential Service Provider including Login.gov and ID.me.

5. Allow users to authenticate into remote desktop services including Citrix Access Gateway and Azure Virtual Desktop.

6. Allow users to access the VA’s Virtual Private Network (VPN) by authenticating into Cisco AnyConnect and other VPN systems.

7. Allow users to authenticate into cloud-hosted and SaaS applications.

8. Allow users to authenticate into on-premises hosted applications.

9. Allow users to access healthcare information following the FHIR standard.

10. Support the Security Assertion Markup Language (SAML) 2.0, OAuth 2.0, and OpenID Connection (OIDC) authentication protocols for integrating with applications and systems.

11. Support the Web Services (WS) Federation protocol.

2. Microsoft Active Directory

3. LDAP

2. Automation capability for IAM processes inclusive of user account provisioning and de-provisioning within the SaaS IAM product.

3. Automated audit logging of automation events and security reporting of events

4. Visual GUI interface supporting no-code / low-code creation of automated workflows for both the automation of administrative tasks within the SaaS IAM product as well as customization of the authentication process.

2. Audit logging and integration with third parties for compliance activities

3. Available out of box reports including authentication requests, access events, and error reports.

4. Ability to connect logs to the SIEM

5. Perform vulnerability assessments

6. Perform regular penetration tests

7. Perform regular network scans

8. Perform consistent vulnerability patching

2. Dedicated support personnel and support manager

3. 24/7 Support for any maintenance and operational issue response

4. Priority handling of support cases

5. Continuous monitoring of SaaS deployed resources with real-time dashboards

6. Access to training resources and educational materials

7. 24/7 online and phone support with 30-minute P1 response time SLAs in place

8. Solution provides high availability - four "9s" (99.99%) or greater

9. Solution can demonstrate historical availability of 99.99%

10. Solution can demonstrate trending of four "9s" or greater over the last 12 months

11. Uses and can demonstrate replication and redundancy

LICENSES

The Contractor shall provide both Workforce Identity and Customer Identity licenses for the base and additional licenses for optional tasks in the respective base periods, if exercised. Additionally, the Government is including option years. For Workforce Identity, option years one and two provide 1,000 licenses with option tasks up to 750,000 licenses. For Customer Identity, option years one and two provide 1,100,000 licenses with option tasks up to a total of 28,000,000 licenses. The Contractor shall provide monthly subscription usage data for VA administrators to generate reports, including new and ongoing user license utilization.

The Contractor shall provide monthly subscription usage data for VA administrators to generate reports, including new and ongoing user license utilization.

TABLE 1 – Workforce Identity Base Period

Optional Task One:

Optional Task Two:

Optional Task Three:

Optional Task Four:

TABLE 2 – Customer Identity Base Period

Optional Task One:

Optional Task Two:

TABLE 3 – Workforce Identity Option Period One

Optional Task One:

Optional Task Two:

(40,000 additional)

Optional Task Three:

Optional Task Four:

(100,000 additional)

Optional Task Five:

Optional Task Six:

Optional Task Seven:

TABLE 4 – Workforce Identity Option Period Two

Optional Task One

Optional Task Two

Optional Task Three

Optional Task Four

Optional Task Five

Optional Task Six

Optional Task Seven

Optional Task Eight

TABLE 5 – Customer Identity Option Period 1

Optional Task One:

Optional Task Two:

Optional Task Three:

TABLE 6 – Customer Identity Option Period 2

Optional Task One:

Optional Task Two:

Optional Task Three:

TABLE 7 – Professional Services

Optional Task Base Year

Optional Task Option Year 1

Optional Task Option Year 2

The period of performance shall be a 12-month base period with 2 (two) 12-month option periods and optional tasks.

1.0 ASSESSMENT, AUTHORIZATION, AND CONTINUOUS MONITORING

If the solution is not FedRAMP authorized:

1. The information system solution selected by the Contractor shall comply with the Federal Information Security Management Act (FISMA).

2. The Contractor shall comply with FedRAMP requirements Moderate-level as mandated by Federal laws and policies, including making available any documentation, physical access, and logical access needed to support this requirement.

3. The Contractor shall provide a SaaS product as defined by the following criteria: Software as a Service (SaaS) is an application delivery model in which the application is hosted on a cloud infrastructure outside the security boundary of VA and is provided to the Cloud Service Customer (CSC) over the internet. The CSC uses the SaaS offering via a thin-client interface, such as a web-browser or a program interface. The CSC subscribes to the SaaS offering and is only responsible for minor in-app customizations. The Cloud Service Provider (CSP) offering the application is responsible for management of the application, safeguarding of data stored or processed by the application, and all elements of the underlying infrastructure. Additionally, the CSP is responsible for all on-going compliance.

In order to qualify as SaaS for use at VA, and to align with Federal Risk and Authorization Management Program (FedRAMP) requirements, the hosting for the offering must conform to the NIST 800-145 definition of Cloud Computing and thus contain following key characteristics:

· On-Demand Self-Service: The CSP fully automates the provisioning of both the customer interface and the underlying cloud components of the SaaS offering. In some cases, to the CSP may provision internal resources manually, while providing the CSC an automated interface to request and track the service.

· Broad Network Access: The SaaS capabilities are available over the internet or over a network that is available from all access points the CSC requires. The SaaS offering is accessible through common platforms (e.g., mobile phones, tablets, laptops, and workstations).

· Resource Pooling: The computing infrastructure supporting the SaaS offering is shared among more than one CSC using a multi-tenant model, and resources are dynamically assigned depending on customer demand.

· Rapid Elasticity: Computing capabilities are automatically provisioned and released in a manner that scales with customer demand. In some cases, the scaling of resources may not be fully automated, but it should be fast enough to support the needs of the CSC, which the CSC would have to define.

· Measured Service: Resource usage, such as storage, processing, bandwidth, and user activity are measured and reported on in a manner that is relevant to the SaaS offering.

The SaaS offering must comply with FedRAMP requirements surrounding data location within the Continental United States. FedRAMP specifies data location requirements in the High baseline as part of control SA-9 (5); however, FedRAMP does not provide or specify data location requirements for other baselines. CSPs should be aware of FedRAMP and ready to partner with VA through the SaaS FedRAMP Authorization Process.

4. Following guidance from the Federal CIO, VA will utilize existing JAB ATO or agency ATO issued by another agency as a starting point for FedRAMP requirements. If neither of those exist, VA will sponsor The Cloud Service Provider for a FedRAMP Authorization. VA will be using the FedRAMP baselines as a starting point, since they are specifically tailored for cloud services.

5. The Contractor shall, where applicable, assist with the VA ATO Process to help achieve agency authorization of the cloud service or migrated application at the impact level required by VA to utilize the product. For this solution the required impact level is: Moderate.

6. The Contractor shall complete a FedRAMP System Security Plan (SSP) and supporting documentation including required attachments within 75 calendar days after contract award.

7. The Contractor shall develop a VA specific system boundary diagram including any integration and connectivity components that will be known as a VA Implementation Diagram (VAID) demonstrating the proposed implementation of this system at VA. The Contractor shall provide the VAID within 10 calendar days of contract award.

8. The Contractor shall complete a Third-Party Assessment Organization (3PAO) Security Assessment Plan (SAP) within 90 calendar days after contract award.

9. The Contractor shall complete a 3PAO Security Assessment Report (SAR) within 90 calendar days after the SSP is accepted by VA.

10. Contractor shall work with assigned VA SME to develop a VA specific Incident Response Plan (IRP) and perform an IRP Tabletop Exercise with VA Stakeholders. This should be completed within 30 calendar days of the SSP being delivered.

11. The Contractor shall afford VA access to the Contractor’s and Cloud Service Provider’s (CSP) facilities, installations, technical capabilities, operations, documentation, records, and databases.

12. If new or unanticipated vulnerabilities are discovered by either VA or the Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party in accordance with Addendum B, VA Information and Information System Security/Privacy Language.

13. The Contractor shall comply with data management requirements.

14. Successful issuance of a VA ATO will be required before live VA data can be used in the system.

Deliverables:

A. FedRAMP System Security Plan (SSP) and supporting documentation.

B. VA Implementation Diagram: This is a VA specific architecture diagram demonstrating the proposed implementation of this system at VA (VAID) C. 3PAO Security Assessment Plan (SAP) D. 3PAO Security Assessment Report (SAR) E. IRP Scenario

If the solution is FedRAMP Authorized but not VA Authorized:

1. The information system solution selected by the Contractor shall comply with the Federal Information Security Management Act (FISMA)

2. The Contractor shall comply with FedRAMP requirements as mandated by Federal laws and policies, including making available any documentation, physical access, and logical access needed to support this requirement

3. The system must be FedRAMP Authorized at no less than the Moderate Level.

4. The Contractor shall, where applicable, assist with the VA ATO Process to help achieve agency authorization of the cloud service or migrated application.

5. The Contractor shall develop a VA specific system boundary diagram including any integration and connectivity components that will be known as a VA Implementation Diagram (VAID) demonstrating the proposed implementation of this system at VA. The Contractor shall provide the VAID within 10 calendar days of contract award.

6. The Contractor shall provide confirmation of their FedRAMP System Security Plan (SSP) and supporting documentation completion via their repository ID number and a link for VA to download the SSP and all required artifacts within 5 calendar days of contract award.

7. The Contractor shall provide the results of their most recent Third-Party Assessment Organization (3PAO) Security Assessment Plan (SAP) within 10 calendar days of contract award.

8. The Contractor shall complete a 3PAO Security Assessment Report (SAR) within 10 calendar days after the SSP is accepted by VA.

9. The Contractor shall provide VA with the most recent monthly scans for the production environment within the authorization boundary and their scan upload schedule for FedRAMP within 30 calendar days of contract award.

10. The Contractor shall provide their availability to participate in monthly continuous monitoring meetings to be scheduled following successful VA ATO within 30 calendar days of contract award.

11. Contractor shall work with assigned VA SME to develop a VA specific Incident Response Plan (IRP) and perform an IRP Tabletop Exercise with VA Stakeholders. This should be completed within 30 calendar days of VA gaining access to the SSP.

12. If new or unanticipated vulnerabilities are discovered by either VA or the Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party in accordance with Addendum B, VA Information and Information System Security/Privacy Language

13. The Contractor shall comply with data management requirements.

14. Successful issuance of a VA ATO will be required before live VA data can be used in the system.

Deliverables:

A. VA Implementation Diagram B. FedRAMP System Security Plan (SSP) and supporting documentation.

C. 3PAO Security Assessment Plan (SAP) D. 3PAO Security Assessment Report (SAR) E. IRP Scenario

If the solution is FedRAMP Authorized and VA Authorized:

1. The information system solution selected by the Contractor shall comply with the Federal Information Security Management Act (FISMA) and have a current VA authorization.

2. The Contractor shall comply with FedRAMP requirements as mandated by Federal laws and policies, including making available any documentation, physical access, and logical access needed to support this requirement.

3. The FedRAMP Authorization level and existing VA ATO should be no less than the level required for this use case which has been defined as Moderate.

4. The Contractor shall, where applicable, assist with the VA ATO Sustainment Process to help maintain health and quality of agency authorization of the cloud service or migrated application.

5. The Contractor shall exclusively provide licenses and/or accounts to FedRAMP authorized and VA authorized environments.

6. The Contractor shall afford VA access to the Contractor’s and Cloud Service Provider’s (CSP) facilities, installations, technical capabilities, operations, documentation, records, and databases.

7. If new or unanticipated vulnerabilities are discovered by either VA or the Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party in accordance with Addendum B, VA Information and Information System Security/Privacy Language

8. The Contractor shall comply with data management requirements.

9. Successful issuance of a VA ATO will be required before live VA data can be used in the system.

10. The Contractor shall participate in monthly Agency and FedRAMP Sustainment meetings following the granting of a VA ATO.

11. The Contractor shall provide continuous monitoring activities including scans, security artifacts, and monthly Plan of Action and Milestones (POAM) reports as outlined by FedRAMP requirements.

Deliverables:

· Continuous monitoring security artifacts

· Continuous monitoring scans

· Plan of Action and Milestones reports.

PRICE SCHEDULE EXAMPLE

*This is an example only and the Cloud Service Customer (CSC) should work with their CO/COR directly to complete the Price Schedule.

Vendors are instructed to complete Section B.4: Price Schedule and submit with their quote. Vendors are cautioned that alterations to the line items as specified below may render quotes unacceptable. All questions shall be directed to the Contract Specialist and Contracting Officer prior to the closing date and time specified in the Request for Quote (RFQ).

Any resulting contract will be awarded on a firm-fixed-price basis as defined by Federal Acquisition Regulation Subpart 16.202. Accordingly, the Contractor shall ensure that any and all costs associated with the Contractor’s proposed application(s), software products, software solution, and/or system, shall be included in the Contractor’s proposed firm-fixed price, and shall serve as the Contractor’s firm-fixed price for the life of any resulting contract. No additional costs or fees relative to the Contractor’s proposed application(s), software products, software solution, and/or system including, but not limited to, licensing costs and any associated licensing maintenance required for the development, delivery, integration, operation, and/or maintenance of the Contractor’s proposed solution will be allowed, accepted, and/or paid by the Government.

All deliverables will be destination inspection, acceptance, and F.O.B.

Days used below refer to calendar days unless otherwise stated. Deliverables with due dates falling on a weekend or holiday shall be submitted the following Government workday after the weekend or holiday.

Electronic submission to: VA Project Manager, Contracting Officer, and Contracting Officer’s Representative

Base Period – FedRAMP Authorization and VA Authorization The period of performance for this effort shall be up to 12 months in accordance with (IAW) Section 4.1 of the Product Description.

*If a vendor’s solution is not FedRAMP Authorized or VA FedRAMP Authorized the vendor shall complete CLIN 0001 and SLINS 0001AA-0001AD.

CLINs 0002 and 0003 (and associated SLINs) shall be $0.00.

Due 75 calendar days after contract award. (If Data Security Categorization is High Impact, this will be due 94 calendar days after contract award.)

*10% of the FedRAMP Approved Solution value. VA does not pay for FedRAMP Authorization fees and/or vendor acquired costs.

VA specific architecture diagram demonstrating proposed implementation of the system at VA.

Due 10 calendar days after contract award.

0001AC

Third Party Assessment Organization (3PAO) Security Assessment Plan (SAP)

Due 90 calendar days after the SSP is accepted by VA. (If Data Security Categorization is High Impact, this will be due 113 calendar days after the SSP is accepted by VA.)

*10% of the FedRAMP Approved Solution value. VA does not pay for FedRAMP Authorization fees and/or vendor acquired costs.

Due 90 calendar days after contract award. (If Data Security Categorization is High Impact, this will be due 113 calendar days after contract award.)

*10% of the FedRAMP (add FISMA impact) Approved Solution value. VA does not pay for FedRAMP Authorization fees and/or vendor acquired costs.

* If a vendor’s solution is FedRAMP Authorized but not VA FedRAMP Authorized, the vendor shall complete CLIN 0002 and SLINS 0002AA-0002AD.

CLINs 0001 and 0003 (and associated SLINs) shall be $0.00.

Contractor shall work with assigned VA SME to develop a VA specific Incident Response Plan (IRP) and perform an IRP Tabletop Exercise with VA Stakeholders. This should be completed within 30 calendar days of the SAR being delivered.

The Contractor shall develop a VA specific system boundary diagram including any integration and connectivity components that will be known as a VA Implementation Diagram (VAID) demonstrating the proposed implementation of this system at VA. The Contractor shall provide the VAID within 10 calendar days of contract award.

The Contractor shall provide confirmation of their FedRAMP System Security Plan (SSP) and supporting documentation completion via their repository ID number and a link for VA to download the SSP and all required artifacts within 5 calendar days of contract award.

The Contractor shall provide the results of their most recent Third-Party Assessment Organization (3PAO) Security Assessment Plan (SAP) within 10 calendar days of contract award.

The Contractor shall complete a 3PAO Security Assessment Report (SAR) within 10 calendar days after the SSP is accepted by VA.

* In the event that the proposed product is already FedRamp Authorized and VA FedRamp Authorized and proposed pricing is not required, please list $0.00 for CLIN 0001, 0002 and 0003 (and associated SLINs).

Due at time of award.

Due at time of award.

Base Period Optional Task In accordance with FAR 52.217-7, “Option for Increased Quantity-Separately Priced Line Item,” this Optional Task may be exercised one time during the base period of performance once solution is FedRAMP Authorized and VA FedRAMP Authorized. If exercised, the Period of Performance shall be up to 12 months. Work shall not commence until, and unless, a formal modification is issued by the Contracting Officer.

*70% of FedRAMP Moderate Approved Solution

*100% if Solution is already FedRAMP Authorized and VA FedRAMP Authorized.

Service Level Agreement

2.2.1 Service Availability

The Contractor shall ensure all deployed services will be available and functional to serve user requests at no less than 99.99% availability for the production environment, and 99.0% availability for the sandbox, development, and staging environments.

The Contractor shall provide a mechanism to determine performance anomalies.

using methodologies and metrics best suited to the SIAM tool’s service and support capabilities.

Anomalies outside the definition of acceptable performance, as defined in the Service Level Agreement (SLA) Monitoring Plan, and as delivered by the SIAM tool, shall be included in the unavailable time documented in the SLA.

Services that are faulted due to a third-party dependency shall have trouble tickets.

logged with the responsible party, with all outage time attributable to the Contractor.

tracked until a ticket is logged with the responsible entity. An automated test, In Accordance With (IAW) the approved SLA Monitoring Plan, with an execution frequency of no more than 300 seconds, and the logged reports of execution, including timing details, of that test shall be provided in the SLA Report. Any faulted services attributed to an external entity shall include a record of the trouble ticket.

that was issued to the responsible party. This record shall include the time that it was filed, and if resolved, the time of resolution. Any maintenance window outages associated with external entities shall include a record of the notification that was distributed to VA Stakeholders, and the time which the record was distributed.

2.2.2 Service Reachability

During Operating Hours, services shall be reachable by internal and external VA users no less than 99.99% of the time for the production environment, 99.0% for the sandbox environment, 99.0% for development environment, and 99.0% for staging environment.

Services that are faulted due to a third-party dependency shall have trouble tickets logged with the responsible party, with all outage time attributable to the Contractor tracked until the ticket is logged with the responsible entity. An automated test, IAW the approved SLA Monitoring Plan, with an execution frequency of no more than 300 seconds, and the logged reports of execution, including timing details, of that test shall be provided in the SLA Report. Any faulted services attributed to an external entity shall include a record of the trouble ticket that was issued to the responsible party.

This record shall include the time that it was filed, and if resolved, the time of resolution. Any maintenance window outages due to upstream or downstream maintenance shall include a record of the notification that was distributed to VA program office, and the time which the record was distributed.

2.2.3 Issue Resolution

Should the Contractor be made aware of functional and performance issues either by VA or through internal monitoring systems, the Contractor will respond to and resolve all identified issues in accordance with the timeframes set forth below. The Contractor shall be responsible for determining the Severity Level of Issues with its components using the definitions provided above. Business Hours below shall be defined as 7:00am to 9:00pm ET, Monday-Friday, excluding holidays. On-Call Hours shall be defined to be those times that fall outside of Business Hours.

Table 1: Issue Resolution Requirements

Resolution Time On-Call Hours Initial Response Time

On-Call Hours Resolution Time

Start of the next business Day Within 1 Business Day (by 5 p.m. of next Business Day)

release By end of business the next Business Day

Next available software release or as otherwise agreed to by VA and the Contractor

NOTICE OF THE FEDERAL ACCESSIBILITY LAW AFFECTING ALL INFORMATION AND COMMUNICATION TECHNOLOGY (ICT) PROCUREMENTS (SECTION 508)

(Three standards listed in Section 2.1 below [E205 Electronic Content – (Accessibility Standard -WCAG 2.0 Level A and AA Guidelines), E204 Functional Performance Criteria, and E208 Support Documentation and Services] always apply to the evaluation of ICT, and should remain marked as “x”. The requiring activity should un-mark any of the other remaining standards below [E206 and/or E207] that do not apply to this effort. The Accessibility Requirements Tool (ART) is a web-based application that will help the requiring activity determine the Section 508 standards that apply to their specific acquisition. The ART tool is located at https://app.buyaccessible.gov/home.)

On January 18, 2017, the Architectural and Transportation Barriers Compliance Board (Access Board) revised and updated, in a single rulemaking, standards for electronic and information technology developed, procured, maintained, or used by Federal agencies covered by Section 508 of the Rehabilitation Act of 1973, as well as our guidelines for telecommunications equipment and customer premises equipment covered by Section 255 of the Communications Act of 1934. The revisions and updates to the Section 508-based standards and Section 255-based guidelines are intended to ensure that information and communication technology (ICT) covered by the respective statutes is accessible to and usable by individuals with disabilities.

SECTION 508 – INFORMATION AND COMMUNICATION TECHNOLOGY (ICT) STANDARDS

The Section 508 standards established by the Access Board are incorporated into, and made part of all VA orders, solicitations and purchase orders developed to procure ICT. These standards are found in their entirety at: https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines. A printed copy of the standards will be supplied upon request.

Federal agencies must comply with the updated Section 508 Standards beginning on January 18, 2018. The Final Rule as published in the Federal Register is available from the Access Board: https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule.

The Contractor shall comply with “508 Chapter 2: Scoping Requirements” for all electronic ICT and content delivered under this contract. Specifically, as appropriate for the technology and its functionality, the Contractor shall comply with the technical standards marked here:

COMPATABILITY WITH ASSISTIVE TECHNOLOGY

The standards do not require installation of specific accessibility-related software or attachment of an assistive technology device. Section 508 requires that ICT be compatible with such software and devices so that ICT can be accessible to and usable by individuals using assistive technology, including but not limited to screen readers, screen magnifiers, and speech recognition software.

ACCEPTANCE AND ACCEPTANCE TESTING

Deliverables resulting from this solicitation will be accepted based in part on satisfaction of the Section 508 Chapter 2: Scoping Requirements standards identified above.

The Government reserves the right to test for Section 508 Compliance before delivery. The Contractor shall be able to demonstrate Section 508 Compliance upon delivery.

INFORMATION TECHNOLOGY USING ENERGY-EFFICIENT PRODUCTS

The Contractor shall comply with Sections 524 and Sections 525 of the Energy Independence and Security Act of 2007; Section 104 of the Energy Policy Act of 2005; Executive Order 13834, “Efficient Federal Operations”, dated May 17, 2018; Executive Order 13221, “Energy-Efficient Standby Power Devices,” dated August 2, 2001; and the Federal Acquisition Regulation (FAR) to provide ENERGY STAR®, Federal Energy Management Program (FEMP) designated, low standby power, and Electronic Product Environmental Assessment Tool (EPEAT) registered products in providing information technology products and/or services.

EPEAT

EPEAT product compliance is not required in this acquisition.

ENERGY STAR

Energy Star compliance is not required in this acquisition.

FEMP

(The following is a subset of information technology product categories for which FEMP designated Low Standby Power products are available:

1. Computers: Workstation and Thin Client – (Workstation, Thin Client, Desktop, Integrated, and Notebook)

(The complete listing of FEMP product categories can be found at https://www.energy.gov/eere/femp/search-energy-efficient-products (Note: filter by “Product Type” and “Efficiency Program” to FEMP). For FEMP Low Standby Power product listing, see https://www.energy.gov/eere/femp/low-standby-power-product-list)

If the requiring activity has determined that FEMP Low Standby Power designated products are required, the Contracting Officer will insert contract clause 52.223-15 into the contract. If FEMP, Low Standby Power designated products are being acquired in the above FEMP category, the requiring activity must insert the following paragraph within this section of the PWS by changing the text to black and convert to “No Spacing” style:)

As required in clause 52.223-15 Energy Efficiency in Energy-Consuming Products, the contractor shall only provide products that meet Federal Energy Management Program (FEMP) and/or FEMP Low Standby Power purchasing specifications for energy efficiency under this contract, as applicable. Covered product categories and the applicable energy efficiency requirements can be found at http://energy.gov/eere/femp/covered-product-categories and low standby power product list can be found at https://www.energy.gov/eere/femp/low-standby-power-product-list.

(If, after consulting with the Contracting Officer and Contract Specialist, the requiring activity determines that no FEMP designated products will be acquired, the requiring activity must obtain a waiver from the Head of the Contracting Activity (HCA) IAW FAR 23.204

a) No FEMP-designated product is reasonably available that meets the functional requirements of the agency; or

b) No FEMP-designated product is cost effective over the life of the product taking energy cost savings into account

If a waiver is obtained, the requiring activity must insert the following paragraph within this section of the PWS and change the text to black and convert to “No Spacing” style:)

FEMP or FEMP low standby power product compliance is not required in this acquisition.

SHIPMENT OF SOFTWARE

Inspection: Destination Acceptance: Destination Free on Board (FOB): Destination

Ship To and Mark For: All Deliverables are to be delivered electronically to the various VA Program Managers (PM) and COR.

VA Lead:

Name: Oren Kanner Address: Remote Voice:

Email: oren.kanner@va.gov

GENERAL REQUIREMENTS

VA TECHNICAL REFERENCE MODEL

The Contractor shall support the VA enterprise management framework. In association with the framework, the Contractor shall comply with OIT Technical Reference Model (VA TRM). The VA TRM is one component within the overall Enterprise Architecture (EA) that establishes a common vocabulary and structure for describing the information technology used to develop, operate, and maintain enterprise applications.