T4NG TO PWS piplanning April 2024.docx

Scaled Agile, Inc’s ® piplanning.io or equivalent PI Planning Software and Support

VA-24-00073347

TRANSFORMATION TWENTY-ONE TOTAL TECHNOLOGY NEXT GENERATION (T4NG)

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Office of Information and Technology (OIT) Compliance, Risk and Remediation (CRR)

Scaled Agile, Inc’s ® piplanning.io or equivalent PI Planning Software and Support Date: April 26, 2024

VA-24-00073347

Task Order PWS Version Number: 1.0

Disclaimer: The TAC accepts no liability for the completeness or correctness concerning the Information Technology content of this template. This template is a means to simply assist the requiring activity in developing their requirements. It is the Requiring Activity’s responsibility to ensure the correctness of all requirements within their final Performance Work Statement

Version History

2. Notes to the CO Section, added associated requirements for solicitation related to new added Section 6.4.2 Internal Release, October 31, 2022

2. Pre-Background Section, updated 3rd paragraph to include systems “currently hosted in a VAEC” for migrations, updated links within VAEC Instructional Text, and added new VAEC memo for New Development reference.

3. Section 6.4, removed waiver instructional text, no waivers (IPv6 Project Team- Derrick Evans, Robert Green, Phillip Fasone)

4. Section 6.5, added new Section, IT Using Energy Efficient Products, section that followed was renumbered to account for the change

5. Notes to the CO, added instructions regarding EPEAT, Energy Star, FEMP, and added solicitation instructions

6. Notes to the CO, revised and added Gray Market Goods Solicitation Response Instructions back in

7. Notes to the CO-Special Clauses (BAA), VHA Handbook 1605.05 is now VHA Directive 1605.05, the embedded BAA Template documents updated, and instructions updated October 19, 2021

2. Section 2.0, removed VIP Guide reference (part of T4NG Basic PWS) and revised instructional text

3. Section 4.1, updated instructional text for Period of Performance

4. Section 5.0, added instructional text for including User Centered Design and Application Monitoring (Bill James)

5. Section 5.1.2, updated Instructional Text to reflect the T4NG “Quarterly” Reporting instead of “Monthly”

6. Section 6.1, in chart, added “Software ease of use” to Performance Standard A5, and clarified Performance Standard C1

7. Section “Notes to the Contracting Officer”, revised #6 in “Additional Notes to Preparer” for clarity April 15, 2020

2. Section 2.0, added new version of VIP Guide, now version 3.2, to serve as an update to the version referenced in the Basic T4NG PWS

3. Section 4.5, GFP, updated entire section (Jupe Fowkes)

4. Section 5.1.3, updated entire Technical Kickoff Meeting section

5. Section 6.2 and all subsections. Updated Section 508 to the new “Refresh” standards and removed Final Section 508 Compliance Test Results deliverable

6. Deliverables Table, removed Final Section 508 Compliance Test Results deliverable April 10, 2019

Contents

BACKGROUND

The Department of Veterans Affairs (VA), Office of Information & Technology (OIT), Technical Solutions strives to provide high quality, effective, and efficient Information Technology (IT) services to those responsible for providing care to the Veterans at the point-of-care as well as throughout all the points of the Veterans’ health care in an effective, timely and compassionate manner. VA depends on Information Management/Information Technology (IM/IT) systems to meet mission goals.

The VA Office of Compliance, Risk and Remediation (CRR), has a requirement for Scaled Agile, Inc’s ® piplanning.io or equivalent Planning Interval (PI) planning application for use in Scaled Agile Framework (SAFe). PI Planning is a cadence-based event that aligns all the teams on the Agile Release Train (ART) to a shared mission and vision. PI Planning has a standard agenda that includes a presentation of business context and vision, followed by team planning breakouts – where the teams create their Iteration plans and objectives for the upcoming PI. A successful PI Planning event delivers two primary outputs – committed PI objectives and a program board.

APPLICABLE DOCUMENTS

The Contractor shall comply with the following documents, in addition to the documents in Paragraph 2.0 in the T4NG Basic Performance Work Statement (PWS), in the performance of this effort:

· Implementation Plan

· Change Enablement SOP

· Configuration Management Plan

· VA Enterprise Cloud AWS Technical Reference Architecture Guide,

· VA Directive 6004, Configuration, Change and Release Management Programs (https://www.va.gov/vapubs/search_action.cfm?dType=1)

· VA Directive and Handbook 6500, Information Security Program (https://www.va.gov/vapubs/search_action.cfm?dType=1)

· Authorization Requirements for eMASS SOP (https://www.va.gov/vapubs/search_action.cfm?dtype=1)

· OIT Brand System (va.gov)

SCOPE OF WORK

The Contractor shall provide technical application support services, installation, configuration, troubleshooting, and user administration to the OIT Technical Solutions team. The Contractor shall provide virtual system/server support for containerized applications and their virtual environments in test, development, sandbox, and production platform environments. The Contractor shall provide vulnerability remediation in the virtual environment, and all other support services provided in this PWS within the PoP.

The solution within this TO is hosted in the VA Enterprise Cloud (VAEC) VA Platform One (VAPO) environment and shall be maintained in the current state of operations.

All documentation created by the Contractor shall use OIT approved templates.

APPLICABILITY

This Task Order (TO) effort PWS is within the scope of paragraph(s)

4.1 Program Management, Strategy, Enterprise Architecture and Planning Support (Excluding 4.1.3.1 Requirements Packages, 4.1.5 Studies and Analyses and 4.1.9 Development Toolkits);

4.2 Systems/Software Engineering (Excluding 4.2.7 Mobile Application Design and Development, 4.2.10 Modeling and Simulation and 4.2.14 Development Toolkit Support);

4.6 Enterprise Network (Excluding 4.6.2.1 Data Communications Systems, 4.6.2.2 Voice Systems, 4.6.2.3 Video Systems, 4.6.2.4 Local Area Network (LAN)/Wide Area Network (WAN) Systems, and 4.6.2.6 Other Transmission Systems);

4.8 Operations and Maintenance (O&M) (Excluding 4.8.3 Hardware Support, 4.8.8 Asset Management, and 4.8.11 Data Center Administration);

4.9 Cyber Security; and

ORDER TYPE

The effort shall be proposed on a Firm Fixed Price (FFP) basis.

PERFORMANCE DETAILS

PERFORMANCE PERIOD

The PoP shall be 12 months from date of award, with one 12-month option period. The overall Period of Performance shall not exceed 24 months.

PLACE OF PERFORMANCE

Efforts under this TO shall be performed at Contractor facilities. The Contractor shall identify the Contractor’s place of performance, including all remote employees, in their Task Execution Plan submission.

TRAVEL OR SPECIAL REQUIREMENTS

There is no expected travel with this effort.

CONTRACT MANAGEMENT

All requirements of Sections 7.0 (Contract Management) and 8.0 (Reporting and Meeting Requirements) of the T4NG Basic PWS apply to this effort. This TO shall be addressed in the Contractor’s Progress, Status and Management Report as set forth in the T4NG Basic contract.

GOVERNMENT FURNISHED PROPERTY

The Government shall furnish the below GFE:

· Personal Identification Verification (PIV) cards

· Cloud capacity in and connectivity to the VA Enterprise Cloud (VAEC) environments.

· VA Enterprise Cloud Operational Tools (VAECOT) comprised of a suite of COTS cloud management tools as identified in the VAEC Technical Reference Guide.

· Enterprise Development Environment (EDE) and Tools as identified in the VAEC Technical Reference Guide.

SECURITY AND PRIVACY

All requirements in Section 6.0 (Security and Privacy) of the T4NG Basic PWS apply to this effort. Specific TO requirements relating to Addendum B, Section B4.0 paragraphs j and k supersede the corresponding T4NG Basic PWS paragraphs, and are as follows,

j. The vendor shall notify VA within 24 hours of the discovery or disclosure of successful exploits of the vulnerability which can compromise the security of the Systems (including the confidentiality or integrity of its data and operations, or the availability of the system). Such issues shall be remediated as quickly as is practical, but in no event longer than ___2__days from the date the exploitation is discovered. The vendor shall prioritize the remediation based on the severity of the exploitation.

k. When the Security Fixes involve installing third party patches (such as Microsoft OS patches or Adobe Acrobat), the vendor shall provide written notice to VA that the patch has been validated as not affecting the Systems within 10 working days. When the vendor is responsible for operations or maintenance of the Systems, they shall apply the Security Fixes within __5___ days or the next available planned outage.

POSITION/TASK RISK DESIGNATION LEVEL(S)

The PDT Tool is located at the following US Office of Personnel Management Website: https://www.opm.gov/investigations/suitability-executive-agent/position-designation-tool/)

In accordance with VA Handbook 0710, Personnel Security and Suitability Program, the position sensitivity, and the level of background investigation commensurate with the required level of access for the following tasks within the PWS are:

Position Sensitivity and Background Investigation Requirements by Task

The Tasks identified above, and the resulting Position Sensitivity and Background Investigation requirements identify, in effect, the Background Investigation requirements for Contractor individuals, based upon the tasks the particular Contractor individual will be working. The submitted Contractor Staff Roster must indicate the required Background Investigation Level for each Contractor individual based upon the tasks the Contractor individual will be working, in accordance with their submitted proposal.

SPECIFIC TASKS AND DELIVERABLES

VA requires the purchase of Scaled Agile Inc.’s (SAI) piplanning.io or equivalent. This application includes 150 licenses, premium level on-premises support, installation services and end user support services. Installation services include configuration and installation of Scaled Agile, Inc’s ® piplanning.io or equivalent PI Planning application to a production level. To a production level refers to the best practice of test, development, sandbox, and production environments located in the VAEC. These services also include integration with an Application Lifecycle Management (ALM) tool (e.g., Jira®). End user support services consists of live support available during business hours to all users of the product. The Contractor shall provide dedicated premium level on-premises support with coverage available between 6:00am – 7:00pm Eastern Time.

PROJECT MANAGEMENT

CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, timeline, and tools to be used in execution of this TO effort. The CPMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks, and resource support. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPMP shall be concurred upon and updated in accordance with Section B of the TO. The Contractor shall update and maintain the VA Program Manager (PM) approved CPMP throughout the PoP.

Deliverable:

A. Contractor Project Management Plan

REPORTING REQUIREMENTS

The Contractor shall produce an electronic Product Status Reports available real-time. These reports will be auto generated to a dashboard from existing data sources, including:

· From the VA customer service request system (e.g., ServiceNow®)

· Server monitoring tools (e.g., Dynatrace®).

The Product Status Report shall, at a minimum, include the following data elements, which shall be retrieved from multiple different data sources and aggregated to produce the reports:

a. Status of all customer service, problem, user support and incident reporting (ServiceNow data).

b. Status of all user accounts requests (ServiceNow data).

c. Status of all approved change orders to the hardware and application platform (ServiceNow change management data).

d. Status of all issues and risks (Product risk registry).

The Contractor shall use the VA-authorized tools (e.g., Jira, GitHub, or similar) and products in scope of this TO and server reports to collect and report the data to be reported in this PWS. This report will not be the only means of communication between the Contractor, COR, and the VA PM. The Contractor shall continuously monitor performance and report any deviation from the CPMP or previous Product Status Reports to the COR and VA PM during routine, regular communications.

Deliverable:

A. Product Status Report

TECHNICAL KICKOFF MEETING

A technical kickoff meeting shall be held within 10 days after TO award. The Contractor shall coordinate the date, time, and location (can be virtual) with the Contracting Officer (CO), as the Post-Award Conference Chairperson, the VA PM, as the Co-Chairperson, the Contract Specialist (CS), and the COR. The Contractor shall provide a draft agenda to the CO and VA PM at least five (5) calendar days prior to the meeting. Upon Government approval of a final agenda, the Contractor shall distribute to all meeting attendees.

During the kickoff-meeting, the Contractor shall present, for review and approval by the Government, the details of the intended approach, work plan, and project schedule for each effort via a Microsoft Office PowerPoint presentation. At the conclusion of the meeting, the Contractor shall update the presentation with a final slide entitled “Summary Report” which shall include notes on any major issues, agreements, or disagreements discussed during the kickoff meeting and the following statement “As the Post-Award Conference Chairperson, I have reviewed the entirety of this presentation and assert that it is an accurate representation and summary of the discussions held during the Technical Kickoff Meeting for Scaled Agile, Inc’s ® piplanning.io or equivalent PI Planning application support contract.

The Contractor shall submit the final updated presentation to the CO for review and signature within three (3) calendar days after the meeting. The Contractor shall also work with the CS, the Government’s designated note taker, to prepare and distribute the meeting minutes of the kickoff meeting to the CO, COR, and all attendees within three (3) calendar days after the meeting. The Contractor shall obtain concurrence from the CS on the content of the meeting minutes prior to distribution of the document.

CHANGE ENABLEMENT, RELEASE AND MANAGEMENT

The Contractor shall be responsible for compliance with VA Directive 6004, Configuration, Change, and Release Management Programs, which provides department-wide standards established in accordance with Federal Information Security Management Act (FISMA) (P.L. 107-347, Title III of the E-Government Act), December 2002, related VA Directive and Handbook 6500, Information Security Program, and Office of Information Technology (OIT) Authorization Requirements Standard Operating Procedures (SOP).

The Contractor shall work with Information System Owner (ISO) to meet ATO requirements which includes completion of a System Configuration Management Plan (SCMP). In addition to complying with VA Directive 6004, the Contractor shall comply with Configuration Management System (CMS) Discovery and Service Mapping requirements, which includes, but is not limited to; providing associated system design documents or appropriate contacts for system design and technical information necessary to conduct discovery and mapping activities. Provisions must be made between the responsible vendor and VA Product team on coordination of all system changes. Release Change Requests are required to be submitted in the VA authorized Change Control system, ServiceNow.

References:

VA Directive 6004, Configuration, Change and Release Management Programs VA Directive and Handbook 6500, Information Security Program

Deliverables:

A. System Configuration Management Plan B. Release Change Requests

APPLICATION SUPPort The Contractor shall provide installation, configuration, communications, application, and technical support for Scaled Agile, Inc’s ® piplanning.io or equivalent PI Planning application. A dedicated contractor Account Manager shall respond to urgent inquiries within four hours from the time of notification. All other inquiries shall be addressed the next business day. The methods of communication shall include Slack®, phone, and Teams®.

The Contractor shall provide technical product support and if unable to resolve the contractor is responsible for escalation to the vendor for remediation. During PI events issues must be resolved within two hours; issues that cannot be resolved by the contractor within this timeframe shall be escalated to the vendor. Upon successful resolution the contractor shall provide root cause analysis of issues escalated to the vendor within three business days of event.

The Contractor shall provide the equivalent to senior level DevSecOps Engineer, with a minimum of nine years’ experience, to meet the required level of effort in support of version upgrades, integrations, and deployments within the VA ecosystem.

The Contractor shall provide full application lifecycle support, including continuous sustainment (patching) and technical support (patching, upgrades) for VA’s implementation of Scaled Agile, Inc’s ® piplanning.io or equivalent PI Planning application.

The Contractor shall provide project updates in VA approved tools (e.g., ServiceNow, Jira). The resources shall provide support including, but not limited to remediation of scan results, custom script deployments, and/or any technical change within the vendor’s control that will enable successful Scaled Agile, Inc’s ® piplanning.io or equivalent PI Planning application implementation.

The Contractor shall perform product integration and testing for the application. Testing shall include 508-compliance, connectivity, load, functional, and integration following industry best practices. The Contractor shall create test plans, test scripts, and test reports.

The Contractor shall perform data migration as required.

Deliverables:

A. Root Cause Analysis Report

LICENSES

The Contractor shall provide 150 Scaled Agile, Inc’s ® piplanning.io or equivalent PI Planning software application licenses.

SALIENT CHARACTERISTICS

• whiteboard capability with colored sticky notes for different teams.

• Graphical User Interface (GUI) must be intuitive.

• able to handle up to 600 concurrent users either onsite or in distributed teams.

• must support a “big picture” Kanban board to virtually “walk the walls.”

• must have backup/recovery features.

• must have an enterprise licensing model.

• must support several iterations of varying durations.

• must be able to support identification of the team to attend the event.

• must have the ability to create breakout room sessions.

• must have the ability to read other team boards without additional permissions.

• must allow for role-based permissions.

• must offer an integrated program risk board.

• must provide visual representation of tasks to meet feature delivery.

• must allow for creation of milestones.

• must be able to map out dependencies between teams.

• must be able to synchronize in real-time.

• must be able to be agnostic when connecting to Application Lifecycle Management (ALM)/Software-as-a-Service (SaaS) tools.

• must offer bi-directional communication with ALM and desktop applications.

• must have the ability to schedule timed breakout sessions and breaks.

• must offer both anonymous and name capture for voting/polling features.

• must allow touch screen functionality.

• must allow mobile app functionality.

• must support online availability of all documents and material for PI planning events.

• must take into consideration user bandwidth required to run the application.

Deliverable:

A. Licenses

TECHNICAL DOCUMENTATION

The Contractor shall coordinate with VA to identify needs for creation, editing, review, and promulgation of Physical/Logical Diagrams, Administrative Account Records, Deployment, and Installation, Back-out, and Rollback Plan, Test Plan, Test Scripts, Test Reports, end user communications and technical documentation, as needed. All new versions of products may require the Contractor to create/update documentation.

Deliverables:

A. Physical/logical diagrams B. Administrative account records C. Deployment and Installation, Back-out, and Rollback Plan D. Test Plan E. Test Scripts F. Test Reports

TRANSITION SUPPORT (OPTIONAL TASK ONE)

If exercised, the Contractor shall provide a Transition Plan for 60 days of outgoing transition support for transitioning work from the current TO to a follow-on TO or Government entity. This transition may be to a Government entity or to another Contractor. In accordance with the Government-approved Transition Plan, the Contractor shall execute the Transition Plan and assist the Government in implementing a complete transition from this TO to a new support provider. This shall include formal coordination with Government staff and successor staff and management. It shall also include delivery of copies of all artifacts delivered under this TO, as well as existing policies and procedures, and delivery of baseline metrics and statistics. This Transition Plan shall, at a minimum, include the following:

1. Coordination with Government representatives.

2. Review, evaluation, and transition of current support services.

3. Transition of historic data to new Contractor system.

4. Transition of application accounts.

5. Transfer of hardware and software warranties, maintenance agreements and licenses.

6. Update and transfer of all necessary business and/or technical documentation.

7. Orientation phase and program to introduce Government and Contractor personnel, programs, and users to the Contractor's team, tools, methodologies, and business processes.

8. Disposition of Contractor purchased Government owned assets,

9. Transfer of Government Furnished Equipment (GFE) and Government Furnished Information, and GFE inventory management assistance.

10. Turn-in of all Government keys, ID/access cards, and security codes.

If exercised, the PoP for the optional task may extend 60 days beyond the PoP in which it is exercised. During this period, the Contractor shall provide for continuity of services to include technical resources required to provide continued help desk functionality, database management and virtual system/server support for the series of application servers, database servers, web servers, virtual environments in the testing, training, staging and production platform environments. The Contractor shall work collaboratively with the incoming Contractor staff or Government personnel to minimize interruption to on-going program operations.

Deliverable:

A. Transition Plan

CYBER SECURITY (OPTIONAL TASK TWO)

SECURITY ASSESSMENT AND ACCREDITATION

All systems and applications supporting Federal government agencies shall follow National Institute of Standards and Technology (NIST) Risk Management Framework (RMF) Special Publication (SP) 800-37 as the standard for Assessment and Authorization (A&A) process before being put into production, and every five (5) years thereafter. Risk assessments must be performed in accordance with NIST SP 800-30, NIST SP 800-53 and as described in the VA Information Security Knowledge Service. The risk factors described in NIST SP 800-30 and NIST SP 800-53 will be used across VA Administrations and Staff Offices to ensure ease of sharing risk information.

If exercised in Option period one, the Contractor shall maintain VA ATO authorization for the Scaled Agile, Inc’s ® piplanning.io or equivalent PI Planning application. This includes supporting any of the associated environments prior to the expiration of any current ATO periods in effect for these products. Specific activities are to include, at a minimum, security certifications, or comprehensive assessments of the management, operational, and technical security controls in an information system to determine the extent to which the controls are implemented correctly. This effort includes all activities associated with obtaining a new ATO period for these applications and environments.

The Contractor shall develop and maintain all A&A documentation and requirements for upload, registration, and execution within the VA-approved Governance Risk and Compliance (GRC) tool for Scaled Agile, Inc’s ® piplanning.io or equivalent PI Planning application.

Custom developed and Government Off the Shelf (GOTS)/Commercial Off the Shelf (COTS) VA applications are required to obtain an ATO. For any ATO effort, the Contractor shall follow the Risk Management Framework (RMF) Lifecycle. The Contractor shall initiate the ATO process within 30 calendar days of the exercising of this TO. Products in the VAEC require a continuous ATO process.

The Contractor shall provide applicable documentation and coordinate with data center partners to ensure consistency with ATO requirements for certification authorization to ensure the supported applications/systems meet VA information security policies and standards to facilitate the successful completion of the A&A process and maintain its ATO.

The Contractor shall:

Support VA Information Security Officers and the Office of Cyber Security Control Assessment team as detailed in VA Directive and Handbook 6500 Information Security Program, VA Handbook 6500.3 Certification and Accreditation of VA Information Systems.

2. Conduct cybersecurity software code quality testing and validation of all software code and provide certified scan reports validating the required code quality.

3. Conduct and participate in vulnerability scans and tests as detailed in National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53 Rev 5 or the latest published version. Recommend Security Controls for Federal Information Systems.

4. Security scanning shall be performed by multiple methods and is done multiple times throughout the course of a project with methods such as infiltration testing, code analysis tools (Fortify), etc.

5. Remediate critical and high vulnerabilities identified in government scans or quality checks or reviews (Secure Code Review/Quality Code Review require remediation of all findings.) for approval by appropriate VA governing group.

Critical vulnerabilities shall be remediated within 30 calendar days after receiving findings report.

High vulnerabilities shall be remediated within 60 calendar days after receiving findings report.

Medium vulnerabilities shall be remediated within 90 calendar days after receiving findings report.

6. Provide vulnerability scanning reports and assessments as detailed in NIST SP 800-30 Rev 1 Guide for Conducting Risk Assessments.

7. Support each product by identifying, documenting, reviewing, and maintaining the A&A Artifacts as needed to support an ATO request in accordance with VA policy and Federal Law and guidelines, as detailed in NIST SP 800-37 Rev 2 Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach. Additionally, the Contractor shall update any aspect (e.g., documentation, code, etc.) of the effort based on comments from the A&A review process conducted.

The A&A Package may consist of the following documents:

a. System Security Plan

1. Guidance is found in NIST SP 800-18

2. SSP is authored locally, but may contain inserts that are National or Common in nature

b. Risk Assessment (coordinate with Office of Risk Management and Incident Reporting)

1. Guidance is found in NIST SP 800-30 and by using the

2. VA Risk Assessment Review Checklist

c. Signatory Authority

1. Guidance is found in NIST SP 800-18 and the

2. Signatory Authority Template available on the Security Website 36C10B21D1035

3. All package submissions shall include this document signed and dated by the appropriate parties

d. Privacy Impact Assessment (coordinate with Office of Privacy)

1. Authority is found in OMB Circular 03-22

2. Authored locally, but may contain inserts that are National or Common in nature

e. Information System Contingency Plan (coordinate with Office of Business Continuity)

1. Guidance is found in NIST SP 800-34 and VA Handbook 6500

2. Authored locally, but may contain inserts that are National or Common in nature

f. Incident Response Plan

1. Guidance is found in NIST SP 800-61 and VA Handbook 6500

2. CSOC is responsible for National level tasks associated with incident response. Each site is responsible for developing local level procedures incorporating Cyber Security Operations Center (CSOC) areas or responsibility

3. See VA Handbook 6500.04

g. Security Configuration Checklists

1. Guidance is found in NIST SP 800-70

2. Contact Technical Security for Specific Operating System (OS) Hardening Guidelines

h. System Interconnection Agreements (Memorandum of Understanding [MOU] and Interconnection)

1. Guidance is found in NIST SP 800-47 and VA Handbook 6500

2. Templates are available on the Security Website

i. Security Configuration Plan (SCP)

j. Interconnection Security Agreement (ISA) as necessary

k. Disaster Recovery Plan (DRP)

The Contractor shall also provide continued security Plan of Action and Milestones (POAM) support. Any VA directed vulnerability scans, remediation and reports shall be completed prior to the conduct of the VA acceptance testing.

Deliverable:

A. Assessment and Authorization Package

Licensing (Optional Task Three) 150 Licenses 150 Licenses

GENERAL REQUIREMENTS

PERFORMANCE METRICS

The table below defines the Performance Standards and Acceptable Levels of Performance associated with this effort.

2. Efficient and effective in meeting requirements

3. Meets technical needs and mission requirements

4. Provides quality services/products

5. Incorporates “ease of use” Human Centered Design principles in any software developed.

Satisfactory or higher

2. Products completed, reviewed, delivered in accordance with the established schedule

3. Notifies customer in advance of potential problems Satisfactory or higher

2. Personnel possess necessary knowledge, skills and abilities to perform tasks

Satisfactory or higher

The COR will utilize a Quality Assurance Surveillance Plan (QASP) throughout the life of the TO to ensure that the Contractor is performing the services required by this PWS in an acceptable level of performance. The Government reserves the right to alter or change the QASP at its own discretion. A Performance Based Service Assessment will be used by the COR in accordance with the QASP to assess Contractor performance.

SECTION 508 – INFORMATION AND COMMUNICATION TECHNOLOGY (ICT) STANDARDS

On January 18, 2017, the Architectural and Transportation Barriers Compliance Board (Access Board) revised and updated, in a single rulemaking, standards for electronic and information technology developed, procured, maintained, or used by Federal agencies covered by Section 508 of the Rehabilitation Act of 1973, as well as our guidelines for telecommunications equipment and customer premises equipment covered by Section 255 of the Communications Act of 1934. The revisions and updates to the Section 508-based standards and Section 255-based guidelines are intended to ensure that information and communication technology (ICT) covered by the respective statutes is accessible to and usable by individuals with disabilities.

The following Section 508 Requirements supersede Addendum A, Section A3 from the T4NG Basic PWS.

The Section 508 standards established by the Access Board are incorporated into, and made part of all VA orders, solicitations and purchase orders developed to procure ICT. These standards are found in their entirety at: https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines. A printed copy of the standards will be supplied upon request.

Federal agencies must comply with the updated Section 508 Standards beginning on January 18, 2018. The Final Rule as published in the Federal Register is available from the Access Board: https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule.

The Contractor shall comply with “508 Chapter 2: Scoping Requirements” for all electronic ICT and content delivered under this contract. Specifically, as appropriate for the technology and its functionality, the Contractor shall comply with the technical standards marked here:

COMPATIBILITY WITH ASSISTIVE TECHNOLOGY

The standards do not require installation of specific accessibility-related software or attachment of an assistive technology device. Section 508 requires that ICT be compatible with such software and devices so that ICT can be accessible to and usable by individuals using assistive technology, including but not limited to screen readers, screen magnifiers, and speech recognition software.

ACCEPTANCE AND ACCEPTANCE TESTING

Deliverables resulting from this solicitation will be accepted based in part on satisfaction of the Section 508 Chapter 2: Scoping Requirements standards identified above.

The Government reserves the right to test for Section 508 Compliance before delivery. The Contractor shall be able to demonstrate Section 508 Compliance upon delivery.

ENTERPRISE AND IT FRAMEWORK

FEDERAL IDENTITY, CREDENTIAL, AND ACCESS MANAGEMENT (FICAM)

The required Assurance Levels, in reference to the Federal Identity, Credential, and Access Management (FICAM) requirements set forth in Section 3.8.2 of the T4NG Basic PWS, are Identity Assurance Level (IAL) 1, Authenticator Assurance Level (AAL) 1, and Federation Assurance Level (FAL) 1 for this specific TO.

SOFTWARE AND LICENSING REQUIREMENTS

The Contractor shall be responsible for the provision of all software licenses and any associated licensing maintenance required for any development, delivery, integration, operation, and/or maintenance associated with its proposed application(s), software products, software solution, and/or system including, but not limited to, any and all application(s), software and/or software products that comprise, are a part of, or integrate with the Contractor’s proposed application(s), software products, software solution, and/or system for the life of any resulting contract.

INFORMATION TECHNOLOGY USING ENERGY-EFFICIENT PRODUCTS

Not Applicable

EPEAT

EPEAT compliance is not required in this application.

ENERGY STAR

Energy Star product compliance is not required in this acquisition.

FEMP

FEMP or FEMP low standby power product compliance is not required in this acquisition.

ORGANIZATIONAL CONFLICT of INTEREST All functions related to Acquisition Support shall be on an advisory basis only. Please be advised that since the awardee of this Task Order will provide systems engineering, technical direction, specifications, work statements, and evaluation services, some restrictions on future activities of the awardee may be required in accordance with FAR 9.5 and the clause entitled, Organizational Conflict of Interest, found in Section H of the T4NG basic contract. The Contractor and its employees, as appropriate, shall be required to sign Non-Disclosure Agreements (Appendix A).

APPENDIX A

CONTRACTOR NON-DISCLOSURE AGREEMENT

This Agreement refers to Contract/Order _________________ entered into between the Department of Veterans Affairs and _________________________ (Contractor).

As an officer of <fill in name of Contractor>, authorized to bind the company, I understand that in connection with our participation in the <fill in program> acquisition under the subject Contract/Order, Contractor’s employees may acquire or have access to procurement sensitive or source selection information relating to any aspect of <fill in program> acquisition. Company <fill in name> hereby agrees that it will obtain Contractor - Employee Personal Financial Interest/Protection of Sensitive Information Agreements from any and all employees who will be tasked to perform work under the subject Contract/Order prior to their assignment to that Contract/Order. The Company shall provide a copy of each signed agreement to the Contracting Officer. Company <fill in name> acknowledges that the Contractor - Employee Personal Financial Interest/Protection of Sensitive Information Agreements require Contractor’s employee(s) to promptly notify Company management in the event that the employee releases any of the information covered by that agreement and/or whether during the course of their participation, the employee, his or her spouse, minor children or any member of the employee’s immediate family/household has/or acquires any holdings or interest whatsoever in any other private organization (e.g., contractors, offerors, their subcontractors, joint venture partners, or team members), identified to the employee during the course of the employee’s participation, which may have an interest in the matter the Company is supporting pursuant to the above stated Contract/Order. The Company agrees to educate its employees in regard to their conflict of interest responsibilities.

Company <fill in name> further agrees that it will notify the Contracting Officer within 24 hours, or the next working day, whichever is later, of any employee violation. The notification will identify the business organization or other entity, or individual person, to whom the information in question was divulged and the content of that information. Company <fill in name> agrees, in the event of such notification, that, unless authorized otherwise by the Contracting Officer, it will immediately withdraw that employee from further participation in the acquisition until the Organizational Conflict of Interest issue is resolved.

This agreement shall be interpreted under and in conformance with the laws of the United States.

Signature and Date Company

Printed Name Phone Number

CONTRACTOR EMPLOYEE

PERSONAL FINANCIAL INTEREST/PROTECTION OF SENSITIVE INFORMATION AGREEMENT

This Agreement refers to Contract/Order _____________________ entered into between the Department of Veterans Affairs and ____________________ (Contractor).

As an employee of the aforementioned Contractor, I understand that in connection with my involvement in the support of the above-referenced Contract/Order, I may receive or have access to certain “sensitive information” relating to said Contract/Order, and/or may be called upon to perform services which could have a potential impact on the financial interests of other companies, businesses or corporate entities. I hereby agree that I will not discuss or otherwise disclose (except as may be legally or contractually required) any such “sensitive information” maintained by the Department of Veterans Affairs or by others on behalf of the Department of Veterans Affairs, to any person, including personnel in my own organization, not authorized to receive such information.

“Sensitive information” includes:

(a) Information provided to the Contractor or the Government that would be competitively useful on current or future related procurements; or

(b) Is considered source selection information or bid and proposal information as defined in FAR 2.101, and FAR 3.104-4; or

(c) Contains (1) information about a Contractor’s pricing, rates, costs, schedule, or contract performance; or (2) the Government’s analysis of that information; or

(d) Program information relating to current or estimated budgets, schedules or other financial information relating to the program office; or

(e) Is properly marked as source selection information or any similar markings.

Should “sensitive information” be provided to me under this Contract/Order, I agree not to discuss or disclose such information with/to any individual not authorized to receive such information. If there is any uncertainty as to whether the disclosed information comprises “sensitive information”, I will request my employer to request a determination in writing from the Department of Veterans Affairs Contracting Officer as to the need to protect this information from disclosure.

I will promptly notify my employer if, during my participation in the subject Contract/Order, I am assigned any duties that could affect the interests of a company, business or corporate entity in which either I, my spouse or minor children, or any member of my immediate family/household has a personal financial interest. “Financial interest” is defined as compensation for employment in the form of wages, salaries, commissions, professional fees, or fees for business referrals, or any financial investments in the business in the form of direct stocks or bond ownership, or partnership interest (excluding non-directed retirement or other mutual fund investments). In the event that, at a later date, I acquire actual knowledge of such an interest or my employer becomes involved in proposing for a solicitation resulting from the work under this Contract/Order, as either an offeror, an advisor to an offeror, or as a Subcontractor to an offeror, I will promptly notify my employer. I understand this may disqualify me from any further involvement with this Contract/Order, as agreed upon between the Department of Veterans Affairs and my company.

Among the possible consequences, I understand that violation of any of the above conditions/requirements may result in my immediate disqualification or termination from working on this Contract/Order pending legal and contractual review.

I further understand and agree that all Confidential, Proprietary and/or Sensitive Information shall be retained, disseminated, released, and destroyed in accordance with the requirements of law and applicable Federal or Department of Veterans Affairs directives, regulations, instructions, policies and guidance.

This Agreement shall be interpreted under and in conformance with the laws of the United States.

I agree to the Terms of this Agreement and certify that I have read and understand the above Agreement. I further certify that the statements made herein are true and correct.

Signature and Date Company

Printed Name Phone Number

Notes to the Contracting Officer

TYPE OF CONTRACT(S)

|X| Firm Fixed Price |_| Cost Reimbursement |_| Time-and-Materials |_| Labor-Hour

SCHEDULE FOR DELIVERABLES

Note: Days used in the table below refer to calendar days unless otherwise stated. Deliverables with due dates falling on a weekend or holiday shall be submitted the following Government work day after the weekend or holiday.

Contractor Project Management Plan Due thirty (30) days after receipt of order (ARO) and updated monthly thereafter.

Electronic submission to: VA PM, COR, CO.

Inspection: destination Acceptance: destination

Due: provided via dashboard, accessible real-time.

Electronic submission to: VA PM, COR, CO.

Inspection: destination Acceptance: destination

Due thirty (30) days after receipt of order (ARO) and updated monthly thereafter.

Electronic submission to: VA PM, COR, CO.

Inspection: destination Acceptance: destination

Due within 5 business days following a reported issue.

Electronic submission to: VA PM, COR, CO.

Inspection: destination Acceptance: destination

Due within 5 business days following a reported issue.

Electronic submission to: VA PM, COR, CO.

Inspection: destination Acceptance: destination

Due: Due at contract award Electronic submission to: VA PM, COR, CO.

Inspection: destination Acceptance: destination

Due thirty (30) days after receipt of order (ARO) and updated as per environment changes, thereafter.

Electronic submission to: VA PM, COR, CO.

Inspection: destination Acceptance: destination

Due thirty (30) days within a change to the system.

Electronic submission to: VA PM, COR, CO.

Inspection: destination Acceptance: destination

Due every 180 days after receipt of order (ARO) or within 30 days of a change.

Electronic submission to: VA PM, COR, CO.

Inspection: destination Acceptance: destination

Due 14 days after a change to Production which requires an update to the Test Plan.

Electronic submission to: VA PM, COR, CO.

Inspection: destination Acceptance: destination

Due one week prior to Production release Electronic submission to: VA PM, COR, CO.

Inspection: destination Acceptance: destination

Due the day of release to Production.

Electronic submission to: VA PM, COR, CO.

Inspection: destination Acceptance: destination

POINTS OF CONTACT

VA PROGRAM MANAGER

The VA Program Manager for this effort is:

Big Pool, MD 21711 __________________________

CONTRACTING OFFICER’S REPRESENTATIVE (COR)

The COR for this effort is:

BUDGET POINT OF CONTACT

The Budget Point of Contact for this effort is:

ADDITIONAL ITEMS

SPECIAL INSTRUCTIONS/REMARKS

· IF REQUIRING ACTIVITY HAS NOT COMPLETED THE MARKET RESEARCH FORM, PLEASE ANSWER THE FOLLOWING:

|X| Does Customer have current contract, is there an incumbent?

Please provide the Incumbent Name and Contract Number: PCI Strategic Management LLC 47QTCA20D0035/36C10B22F0202

|_| Is this TO a logical Follow-on to a TO previously competed on the T4NG program (fair opportunity)

|_| A&A Services- If Checked, a Memo is required

SPECIAL CLAUSES, ETC TO BE INCLUDED IN THE SOLICITATION.

|_| Intellectual Property/Technical Data Rights Clause required?

|_| Government Furnished Material/Equipment: CO should add a special clause to the contract citing the Title of the material/equipment, Identifier (Serial Number),…