VA Enterprise Mobility Management PWS Draft.pdf

PERFORMANCE WORK STATEMENT

DEPARTMENT OF VETERANS AFFAIRS

Office of Information & Technology Mobile Technology and Endpoint Security Engineering

VA Enterprise Mobility Management

Date: May 9, 2025

VA-25-00018711

PWS Version Number: 1.0 https://btt.dva.va.gov/ppsServlet/spring/listing/processListing?templateId=50&filter_planningUID=VA-25-00018711&noCache=noCache https://btt.dva.va.gov/ppsServlet/spring/listing/processListing?templateId=50&filter_planningUID=VA-25-00018711&noCache=noCache

1.0 BACKGROUND

The Department of Veterans Affairs (VA), Mobile Technology and Endpoint Security Engineering has a requirement for an operations, maintenance and Engineering (OM&E) solution for the existing Enterprise Mobility Management (EMM) environment within the VA Enterprise Cloud (VAEC). The Contractor shall provide support for mobile devices, threat prevention, and certificate-based authentication.

The EMM solution and its subcomponents under this Performance Work Statement (PWS) will satisfy the requirement of having a fully managed EMM solution in the VAEC that meets VA Baseline security requirements, as well as adhere to security controls for Bring Your Own Devices (BYOD) as well as Government Furnished Devices (GFE) devices.

VA currently runs VMware Workspace One EMM system for management of mobile devices hosted at VAEC’s Amazon Web Service (AWS) enclave in a Federal Risk and Authorization Management Program (FedRAMP) Moderate environment. The current EMM implementation consists of two separate environments. One is a User Acceptance Testing (UAT) environment, where software patches, changes and code review occur, and the second is the Production environment. The current EMM environment also includes the on-premise (VA Data Center) version of VMware Workspace One software to manage devices as well as an internal Application (App) Store. to support an extended functionality or an existing configuration. In the event, this becomes necessary, the contractor shall provide operation and management support for the on-premises environment. The environment contains 210,000 Workspace One licenses with approximately 210,000 iPhones, iPads, Mac Operating System (OS), Android, Extended Reality (XR)/ Virtual Reality (VR) Quest, Pico 4, Vision Pro, BYOD and Zebra devices currently enrolled.

The VAEC is currently supported by two FedRAMP High Certified and VA Authority To Operate (ATO) approved Cloud Service Providers (CSP). Both VAEC environments provide access to all Amazon Cloud Service Provider FedRAMP Authorized Services in their respective cloud to support the current solution. In addition, each VAEC CSP provides a set of common shared services such as security scanning, Active Directory, Entra ID and single sign-on (SSO); Personal Identity Verification (PIV) integration, and performance monitoring to facilitate solution implementation. Specifications for each VAEC CSP, including access requirements, will be provided in Attachment 3 – Cloud Service Providers and at the project kick off meeting.

The current environment consists of 72 Virtual Servers with a mix of Windows Server 2019 and Red Hat Enterprise Linux (RHEL) 7. Total capacity is 388 virtual central processing units (vCPU) with 1,840 Gigabytes (GB) of memory and 160 TB of total storage. The environment has redundant servers and is spread across two Availability Zones (AZ) to maximize system resilience. VA has implemented a certificate-based authentication (CBA), based on National Institute of Standards and Technology (NIST) Special Publication (SP) 800-157 and Workspace One Derived PIV (PIV-D) for e-mail, Virtual Private Network (VPN) and SSO application authentication. In addition, VA has implemented Lookout as a mobile device end point protection solution across its base of approximately 210,000 mobile devices. Additionally, the EMM system includes subcomponents of Mobile Threat Prevention (MTP) using Lookout and Derived Credentials using Brand Name Entrust or equivalent.

VA has procured the Enterprise License Agreement (ELA) for all devices operating in the environment including OM&E, Tier IV support.

Additionally, VA currently owns Microsoft Intune Mobile Device Management (MDM), Microsoft Mobile Threat Detection (MTD) Defender. The possibility exists for a transition from the current EMM solution to Microsoft Intune MDM or a VA approved MDM solution.

2.0 APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. 44 U.S.C. § 3541-3549, “Federal Information Security Management Act (FISMA) of 2002”

2. “Federal Information Security Modernization Act of 2014”

3. Federal Information Processing Standards (FIPS) Publication 140-2, “Security Requirements for Cryptographic Modules”

4. FIPS Pub 199. “Standards for Security Categorization of Federal Information and Information Systems,” February 2004

5. FIPS Pub 200, “Minimum Security Requirements for Federal Information and

Information Systems,” March 2006

6. FIPS Pub 201-2, “Personal Identity Verification of Federal Employees and

Contractors,” August 2013

7. 10 U.S.C. § 2224, "Defense Information Assurance Program"

8. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

9. Public Law 109-461, Veterans Benefits, Health Care, and Information

Technology Act of 2006, Title IX, Information Security Matters

10. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”

11. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, https://www.va.gov/vapubs/index.cfm

12. VA Handbook 0710, “Personnel Security and Suitability Program,” May 2, 2016, https://www.va.gov/vapubs/index.cfm

13. VA Directive and Handbook 6102, “Internet/Intranet Services,” August 5,

14. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and Guidelines,” January 18, 2017

15. Office of Management and Budget (OMB) Circular A-130, “Managing Federal

Information as a Strategic Resource,” July 28, 2016 https://www.va.gov/vapubs/index.cfm https://www.va.gov/vapubs/index.cfm http://www.va.gov/vapubs http://www.va.gov/vapubs

16. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed Services (CHAMPUS)”

17. NIST SP 800-66 Rev. 1, “An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule,” October 2008

18. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended, January 18, 2017

19. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

20. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021

21. VA Handbook 6500, “Risk Management Framework for VA Information

Systems VA Information Security Program,” February 24, 2021

22. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI),” March 12, 2019

23. VA Handbook 6500.5, “Incorporating Security and Privacy into the System Development Lifecycle,” March 22, 2010

24. VA Handbook 6500.6, “Contract Security,” March 12, 2010(Appendix C updated April 22, 2024, VA Notice 24-12)

25. VA Handbook 6500.8, “Information System Contingency Planning,” April 6,

26. VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018

27. VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017

28. OIT Process Asset Library (PAL), https://www.va.gov/process/ . Reference

Process Maps at https://www.va.gov/process/maps.asp and Artifact templates at https://www.va.gov/process/artifacts.asp

29. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

30. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014

31. VA Handbook 6508.1, “Procedures for Privacy Threshold Analysis and Privacy Impact Assessment,” July 30, 2015

32. VA Handbook 6510, “VA Identity and Access Management,” January 15,

33. VA Directive and Handbook 6513, “Secure External Connections,” October 12, 2017

34. VA Directive 6300, “Records and Information Management,” September 21,

35. VA Handbook, 6300.1, “Records Management Procedures, “ March 24, 2010

36. NIST SP 800-37 Rev 2, “Risk Management Framework for Information

Systems and Organizations: A System Life Cycle Approach for Security and Privacy,” December 2018

37. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020)

38. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015 https://www.va.gov/process/ https://www.va.gov/process/maps.asp https://www.va.gov/process/artifacts.asp https://www.va.gov/trm/TRMHomePage.aspx

39. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-

12) Program,” March 24, 2014

40. OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005

41. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019

42. OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008

43. Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance, December 2, 2011, (NOTE: Part A of the FICAM Roadmap and Implementation Guidance, v2.0, was replaced in 2015 with an updated Architecture (https://arch.idmanagement.gov/#what-is-the-ficam-architecture)

44. NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access,“ June 2018

45. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, “Digital Identity Guidelines,” updated March 02, 2020

46. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014

47. NIST SP 800-164, “Guidelines on Hardware-Rooted Security in Mobile

Devices (Draft),” October 2012

48. Draft National Institute of Standards and Technology Interagency Report

(NISTIR) 7981, “Mobile, PIV, and Authentication,” March 2014

49. VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland

Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

50. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

51. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

52. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

53. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019

54. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008

55. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (Public Law 110–140), December 19, 2007

56. Section 104 of the Energy Policy Act of 2005, (Public Law 109–58), August 8, 2005

57. Executive Order 13834, “Efficient Federal Operations,” dated May 17, 2018

58. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August

2, 2001

59. VA Directive 0058, “VA Green Purchasing Program,” July 19, 2013 https://arch.idmanagement.gov/#what-is-the-ficam-architecture https://arch.idmanagement.gov/#what-is-the-ficam-architecture https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514 https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896 https://www.cisa.gov/publication/tic-30-core-guidance-documents

60. VA Handbook 0058, “VA Green Purchasing Program,” July 19, 2013

61. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote

Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

62. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

63. “Veteran Focused Integration Process (VIP) Guide 4.0,” January 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

64. VA Memorandum “Proper Use of Email and Other Messaging Services,”

January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

65. “DevSecOps Product Line Management Playbook” version 2.0, May 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

66. NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020

67. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol

Version 6 (IPv6),” November 19, 2020

68. Social Security Number (SSN) Fraud Prevention Act of 2017

69. Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23,

3.0 SCOPE OF WORK

The Contractor shall provide OM&E for current MDM, VMware Workspace One. In addition, the Contractor will provide licenses for brand name Entrust or an equivalent system with similar capabilities of derived credentials.

The Government shall provide the Contractor with access to existing VAEC and SaaS solution which are currently in VA (VMware Workspace One (pre-prod, Production) Microsoft Intune MDM and EntraID). The Contractor shall have a test environment for VA testing of applications and devices. The Contractor shall not be responsible for buying cloud credits for this Task Order (TO). The Contractor shall provide support of Workspace One.

The Contractor shall assume OM&E of the current VA Workspace One EMM solution for all VA-issued mobile devices including all mobile OS types (for example: iPhones, iPads, MacOS, Androids, XR/VR, Quest, Pico4, Vision Pro, and Androids, Zebra etc).

The current EMM solution is hosted in a FedRAMP Moderate instance within the VAEC supporting mobile device management software initially for 210,000 devices, potentially scaling up to approximately 500,000 devices.

The Contractor shall provide support to existing certificate-based authentication (Derived Credentials) currently provided by Brand Name Entrust or equivalent, a working EMM based email solution which is connected to VA’s Office 365 instance, a working application threat monitoring solution, and a working application vetting solution as part of the total EMM solution.

https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371 https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

It may be necessary for the Contractor to transition the current VMware Workspace One EMM solution to a SaaS Base Solution. In the event VA decides to move forward with this transition, the Contractor shall be responsible for the transition to Microsoft Intune MDM SaaS environment or VA approved MDM solution, while providing OM&E services for the current MDM VMware Workspace One.

4.0 PERFORMANCE DETAILS

4.1 PERFORMANCE PERIOD

The PoP shall be 12 months from date of award, with four 12-month option periods inclusive of optional tasks described below.

Any work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO). (If required, the CO may designate the Contractor to work during holidays and weekends). The core and primary duty hours of operation for each location shall be Monday through Friday, 0630 – 1900 Local Time.

Work hours shall be a standard five-day – eight-hour structure. The Contractor may be required to support meetings with Government personnel between the hours of 9 am to 5 pm EST.

For any task that requires support during specific timeframes or require 24/7/365 coverage, it will be noted within the individual task sections.

There are 11 Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, four are set by date:

New Year's Day January 1 Juneteenth June 19 Independence Day July 4 Veterans Day November 11 Christmas Day December 25

If any of the above falls on a Saturday, then Friday shall be observed as a holiday.

Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

Martin Luther King's Birthday Third Monday in January Washington's Birthday Third Monday in February Memorial Day Last Monday in May Labor Day First Monday in September Columbus Day Second Monday in October Thanksgiving Fourth Thursday in November

4.2 PLACE OF PERFORMANCE

Efforts under this TO shall be performed at Contractor facilities within the continental United States. The Contractor shall identify the Contractor’s place of performance in their proposal submission.

4.3 TRAVEL

The Government anticipates travel to perform the tasks associated with the effort such as onsite testing and development, team trainings or meetings, as well as to attend program-related conferences throughout the PoP by up to three team members. Include all estimated travel costs in your FFP line items. These costs will not be directly reimbursed by the Government.

The total estimated number of trips in support of the program-related meetings for this effort is four per year. Anticipated locations include the following, estimated at three days in duration:

1. Hines, IL

2. Saint Louis, MO

3. Washington, DC

In the performance of routine troubleshooting, development, testing and equipment issuance, the Contractor may be required to travel to the nearest facility.

Travel shall be in accordance with the Federal Travel Regulations and requires advanced concurrence by the Contracting Officers Representative (COR). Contractor travel within the local commuting area will not be reimbursed by the Government. Also, not reimbursable are travel performed for personal convenience or daily travel to and from work at the Contractor’s facility.

5.0 SPECIFIC TASKS AND DELIVERABLES

The Contractor shall perform the following:

5.1 PROJECT MANAGEMENT

The Contractor shall provide project management support for day-to-day operations and activities for the scope of this entire TO. This project management support shall provide a sole point of contact on all tasks related to EMM, utilization of VAEC resources supporting hardware, operating system and software infrastructure. Project management support shall identify and respond to issues relating to EMM operations on a daily basis.

5.1.1 CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Project Management Plan (CPMP) within 30 days of award that lays out the Contractor’s approach, timeline and tools to be used in execution of this TO. The CPMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks and resource support. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPMP shall be concurred upon and updated in accordance with Section B of the TO. The Contractor shall update and maintain the VA PM approved CPMP throughout the PoP.

Deliverable:

A. Contractor Project Management Plan

5.1.2 TECHNICAL KICKOFF MEETING

A technical kickoff meeting shall be held within 10-days after TO award. The Contractor shall coordinate the date, time, and location (may be virtual) with the CO, as the Post- Award Conference Chairperson, the VA PM, as the Co-Chairperson, the Contract Specialist (CS), and the COR. The Contractor shall provide a draft agenda to the CO and VA PM at least five calendar days prior to the meeting. Upon Government approval of a final agenda, the Contractor shall distribute to all meeting attendees. During the kickoff-meeting, the Contractor shall present, for review and approval by the Government, the details of the intended approach, work plan, and project schedule for each effort via a Microsoft Office PowerPoint presentation. At the conclusion of the meeting, the Contractor shall update the presentation with a final slide entitled “Summary Report” which shall include notes on any major issues, agreements, or disagreements discussed during the kickoff meeting and the following statement “As the Post-Award Conference Chairperson, I have reviewed the entirety of this presentation and assert that it is an accurate representation and summary of the discussions held during the Technical Kickoff Meeting for the VA Enterprise Mobility Management.” The Contractor shall submit the final updated presentation to the CO for review and signature within three calendar days after the meeting. The Contractor shall also work with the CS, the Government’s designated note taker, to prepare and distribute the meeting minutes of the kickoff meeting to the CO, COR and all attendees within three calendar days after the meeting. The Contractor shall obtain concurrence from the CS on the content of the meeting minutes prior to distribution of the document.

Deliverables:

A. Draft Agenda B. Summary Report C. Final Presentation D. Meeting Minutes

5.1.3 CONTRACTOR STAFFING PLAN AND STAFFING MANAGEMENT

The Contractor shall be responsible for the entire VA EMM cloud-based solution and integration. The Contractor shall provide a Staffing Plan that ensures its successful management of any subcontractors and utilization of the VAEC, including all software, hardware and network components comprising the solution within 30 days of award.

The Contractor shall provide a Staffing Plan to ensure established staffing levels are maintained on each task, monitor performance, and report any deviations. The Contractor shall also include staff loss/gains in the Staffing Plan, as well as a staffing schedule for the upcoming month. The Contractor shall provide a Staffing Plan, to include project organization chart, project team roles, project responsibilities, number of staff required per assignment, estimated start dates, breakdown in terms of staff’s Full Time Equivalent (FTE) for each role, contact information for all TO participants, and identification of key risk points and mitigation plans.

The Contractor’s staffing approach shall comply with VA 6500 guidelines around separation of duties and least privileges. The Contractor shall ensure adequate coverage for implementation, operation and management (O&M) to support all environments in compliance with VA 6500’s guidelines around separation of duties and least privilege. The Contractor shall ensure consistent coverage for all support requirements including backup staffing that is readily available. The Contractor shall use VA’s implementation of Service Now for all server interruptions, user support, information technology (IT) support, and any other service type tickets.

The Contractor shall:

1. Ensure staffing levels provide non-interrupted support 24 hours a day, seven days a week, and 365 days a year.

2. Ensure Contractor staff is trained and oriented on EMM Support Service processes within two weeks of being assigned.

3. Ensure Contractor skill sets are maintained as required to support current technology platforms included in the EMM solution.

4. Notify the COR in writing by email of any staff changes on work associated with this TO 10 business days in advance of any staff change. The written notification shall outline the impact expected by the change and if necessary, the mitigation strategy to reduce the impact by the staff change.

Deliverables:

A. Staffing Plan

5.1.4 ONBOARDING

The Contractor shall manage the onboarding of its staff. Onboarding shall include steps to obtain a VA network and email account, complete training, initiate background investigations, and gain physical and logical access, which may include elevated privileges to the necessary development and test environments for the various systems to be enhanced.

A single Contractor Onboarding Point of Contact (POC) shall be designated by the Contractor who tracks the onboarding status of all Contractor personnel. The Contractor

Onboarding POC shall be responsible for accurate and timely submission of all required VA onboarding paperwork to the COR or his/her onboarding designee. The Contractor shall be responsible for tracking the status of all their staff’s onboarding activities. This shall include VA Privacy and Information Security Awareness training, Rules of Behavior, fingerprints, background investigation submission and status, Government Furnished Equipment (GFE) request, signature for GFE, PIV card, Active Directory account, Remote Access Request, Elevated Privileges Request per environment, VA Tools training, and any other information deemed necessary for tracking by the Contractor, VA OIT PM or COR.

5.1.5 WEEKLY STATUS UPDATE

The Contractor shall support weekly status meetings as required to discuss status, issues, proposed resolutions, plan moves/add/changes, plan upgrades, migration status and resolve tickets. These meetings can be conducted via teleconference.

5.2 EMM MANAGED SOLUTION

The Contractor shall provide full turnkey O&M for the VA cloud-based VMware Workspace One EMM solution in the VAEC and on premises including all EMM hardware/software, certificates, installation services, operations, maintenance, and full system documentation along with resources and staff to run and administer the system including Tier IVhelp desk support.

Utilizing the VAEC, the Contractor shall provide any software licenses, certificates, and associated maintenance required to support the EMM requirements outlined below.

With the exception of Workspace One licenses described in PWS paragraph 1.0 and 3.0, all licenses proposed in support of the EMM requirements shall require procurement, installation, renewal and maintenance during the PoP to ensure uninterrupted service. Workspace One licenses will be provided by VA via the ELA; the Contractor shall install and maintain ELA licenses required in support of the EMM solution.

The EMM solution is and will continue to be hosted in a FedRAMP Moderate private cloud instance within the VAEC where there shall be full interconnectivity back and forth to VA systems for an EMM solution. Connectivity to the VA Network is provided by the

VAEC.

The Contractor shall support an internal App Store, using Workspace One, for mobile applications to be used by enrolled devices, which is internal to VA only. This internal App Store is currently hosted by VA’s current EMM provider Workspace One.

Currently, VA is on a hybrid Exchange 2010/Office 365 infrastructure. The current email system is Office 365, and the Contractor shall provide the resources and staff required to maintain the EMM to function correctly with Office 365. The Email system shall support VA’s PIV-only authentication requirement. User accounts are locked down to require certificate-based authentication. Username and password are not available for authorization of any accounts. The Contractor shall ensure that the EMM environment continues to function correctly under these parameters. The VA is currently using Entrust to generate credentials to meet certificate-based authentication. This solution meets the NIST 800-157 standards. The system shall meet all existing VA Trusted Internet Connection (TIC) requirements. All traffic shall traverse through the TIC and cannot be directly accessible from the internet without first passing through the TIC.

5.2.1 EMM FUNCTIONALITY

Utilizing the VAEC, the Contractor shall provide O&M for a VMware Workspace One/Workspace One EMM solution. The EMM shall continue to provide functionality to support VA’s mobile environment and shall include enterprise mobility management, internal mobile app catalog, email functionality, a secure content solution, secure browsing, and a secure workplace (dual persona) environment. Additionally, the EMM shall fully support a Mobile Threat Defense. The EMM also provides full certificate-based authentication functionality as detailed in section 5.12 of this PWS.

The Contractor’s turnkey O&M shall continue to support the required high-level functionality listed below throughout the PWS:

1. Provisioning: ability to enroll a device in EMM and initially secure that device.

2. Security: ability to secure the mobile environment.

3. Profile: ability to create, edit, push and manage profiles.

4. Management: ability to search devices, review histories, track device changes.

5. Compliance: ability to set up compliance rules as well as activate/deactivate rules and wipe compromised devices.

6. Alerts: to let users know they are out of compliance or have a compromised device.

7. Reporting: to enable administrators to check device compliance with VA policies and profiles.

8. Mobile App Deployment: a mechanism for VA to distribute internal custom applications.

9. Operational Efficiency: features and functions to further secure the devices and help VA effectively manage the environment.

10. Email Integration: to provide email filtering and routing to provide secure email communication to VA devices.

11. Integration with the Contractor-provided mobile application threat system

12. Full integration with the Contractor-provided certificate-based authentication system.

13. User and admin log on using VA Active Directory, including two factor authentication.

14. Deploy VMware’s Access Management for single sign on capabilities.

The Contractor shall maintain the following environments within the EMM solution:

1. UAT: This is the EMM’s VAEC UAT environment which is used as a production copied test environment for the entire VAEC environment testing, as well as device and product testing. This environment is used by VA to contain only those development/testing resources needed to verify proper functioning software within this environment. This environment mirrors the Production environment exactly and is used to test potential changes to the Production environment. The UAT environment is solely for the Contractor and engineering staff to test out functionality and compatibility of features and patches.

2. Production (Prod): This is the production EMM VAEC environment currently running Workspace One 24.6.0.5.7.0.12 (1907) which is currently managing approximately 210,000 devices with the possibility of upscaling to 500,000 devices.

5.2.2 EMM TECHNICAL ENVIRONMENT

The EMM turnkey O&M shall, support 210,000 mobile devices concurrently, with capabilities of supporting up to 500,000 devices, while maintaining compliance with all technical and functional requirements and maintaining 99.99% availability.

The Contractor shall ensure the EMM turnkey O&M provides capacity, software, hardware, licenses (except GF VMware licenses), certificates and all other infrastructure required to support the usage, technical and functional requirements for an initial load of 210,000 EMM licenses and approximately 290,000 devices with anticipated growth over the Four year period to support up to 500,000 devices in total. By utilizing the CSP and General Support System (GSS) services provided through the VAEC, any solution provided by the Contractor shall meet the Service Level Agreement (SLA) parameters as defined in Attachment 1-SLA.

The Contractor shall maintain the following functionality:

1. The ability to provide adequate flexibility for increasing resources to support a growing number of mobile devices and administrators.

2. The ability to take advantage of the tiered backup and recovery provided by VAEC to meet the related SLA in Attachment 1.

3. The ability to provide all retrieved data in the original or other VA agreed-upon format, including all original meta-data.

5.2.2.1 Cloud Hosting:

The EMM shall continue to be hosted in the VAEC environment. The Government will provide the Contractor with access to the VAEC to include the credits required.

The EMM solution shall be fully managed by the Contractor as a turnkey operation, utilizing the services provided through the VAEC, and provide uptime required by the SLAs

In order to minimize cloud services costs and optimize operations the Contractor shall utilize VAEC GSS services when available and applicable.

The Contractor shall use cloud native approaches in accordance with VA’s Use of Cloud-Based Native Technologies and Approaches Policy, see Attachment 4 - OIT Cloud Native Technology Policy Update.

5.2.2.2 Certificates:

The Contractor shall supply and install VA-approved and compatible certificates for the entire EMM solution in the VAEC environments. The Contractor shall provide either individual or wildcard certificates to meet VA requirements, as needed. The certificates must be backwards and forwards compatible with all systems and devices required by

VA.

5.2.3 EMM CONNECTIVITY TO VA NETWORK

Communication between the cloud hosted EMM solution and VA is currently done through a firewall port opening with the VA Business Partner Extranet (BPE) connection. The EMM VAEC environment contains Personally Identifiable Information (PII), but no Protected Health Information (PHI) is permitted. All network traffic shall meet the current and future VA TIC requirement.

The Contractor shall coordinate with VA Service Delivery and the VA Cyber Security Operations Center (CSOC) to maintain connectivity via the dedicated connectivity provided by the VAEC and shall be responsible for maintaining and monitoring connectivity. The Contractor shall communicate to the VA PM/COR all necessary ports, protocols and Internet Protocol (IP) addresses required for successful EMM operation to ensure that the necessary ports and protocols will be opened after an internal security review. The EMM shall connect to the Internal Business Partner Extranet (iBPE) at the VA TIC gateways. VAEC will retain responsibility for all Wide Area Network (WAN) activity capacity and management. The Contractor shall be responsible for providing support in transitioning and testing the circuit transition, as well as troubleshooting connectivity issues. Furthermore, the Contractor shall provide the following capabilities:

1. The ability to support IP version 6 (IPv6) as well as IP version 4 (IPv4). The Contractor’s solution shall support the latest IPv6 based upon the directive issued by the OMB on September 28, 2010 (https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/assets/egov_docs/tr ansition-to-ipv6.pdf ). NIST SP 800 series applicable compliance shall be included in all IT infrastructures, application designs, application development, operational systems and sub-systems, and their integration.

2. The ability to provide Network Configuration Diagrams for both primary and secondary sites for the EMM cloud environment within the VAEC which detail all aspects of the Network Configuration.

3. The EMM VAEC environment shall connect only to the VA network.

https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/assets/egov_docs/transition-to-ipv6.pdf https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/assets/egov_docs/transition-to-ipv6.pdf

4. Provide support to VA for additional software/dashboards (i.e. connectivity to ServiceNow and VA command center dashboards). The Contractor shall work with VA entities to support the data interaction between the EMM product and VA tools.

VA will provide public, private and VA private IP addresses reserved and assigned to enable interaction between internal and external VA systems (e.g., National Archives and Records Administration (NARA) and other VA applications). VAEC will be responsible for coordinating the routing of all traffic.

The Contractor shall be responsible for maintenance and follow-up of all VA change control process(s) for the management of network ports and IP ranges through VA’s CSOC and BPE teams. The tickets shall have accurate and up-to-date information. The Contractor shall also be responsible for updating tickets in a timely fashion if more information is required. The Contractor shall attend all calls required for VA change control process(s)with the appropriate network teams.

5.3 MONITORING

The Contractor shall maintain and support automated monitoring, collection of pertinent data for trending information, and reporting to ensure all aspects of the EMM solution are operating within the SLA parameters outlined in Attachment 1, using the VAEC supported monitoring tools and processes as they exist and evolve over time.

Monitoring tools will include native CSP monitoring tools (See Attachment 3 – Cloud Service Providers for additional details). Additionally, the Contractor shall maintain all logs with appropriate monitoring tools such as but not limited to Grafana, Prometheus, Splunk, and/or ElasticSearch. The Contractor shall create queries to support dashboards, reporting, and proactive alert generation based on system, operations, security and business needs.

The Contractor shall ensure automated monitoring provides the following:

1. Security Content Automation Protocol (SCAP) automation capabilities (see NIST SP 800-126, “The Technical Specification for the SCAP”, Version 1.2 September 2011.)

2. Performance, resource (network, VMs, VM storage, and shared storage), status and utilization, and events within the provider’s boundary (failure of service, degraded service, availability of the network, storage, and operating systems).

VA may opt to have the Contractor deploy VA’s Command Center Enterprise monitoring tool in addition to Contractor provided tools. The Contractor shall be responsible for maintenance of the monitoring tool as well as maintenance of the monitoring dashboard.

3. Use Email, Short Message Service (SMS), and other methods, such as PagerDuty or VictorOps, for alerting schedules, escalation policies and services that escalate system, infrastructure, or security issues to an EMM on-call engineer. The Contractor shall acknowledge all alerts and remediate all issues in accordance with VA requirements.

4. Provide the above real-time monitoring to a Dashboard that is available 24 hours a day, seven days per week in accordance with the SLA in Attachment 1. The dashboard currently:

a. Presents automated alerts and present metrics for the most recent 24-hour period. In addition, a rolling average are maintained for each metric and retained for an additional 90 days. Logs are retained for 90 days.

b. Provides an interface that allows the configuration of alerts and setting of alert thresholds at a VA-defined user group level.

c. Presents and organizes information only for and relevant to the user’s assignments for monetary credit back to VA for the Contractor’s inability to meet the SLA.

d. Supports user defined alerts that trigger on metrics and thresholds specified by the user and send an e-mail to the users with the alert information (Contractor Format).

In addition to the above monitoring, the Contractor shall install, configure, and manage any VA provided monitoring agents. The agents shall report to enterprise level visibility and monitoring to the existing Dashboard.

5.4 COST AND COMPUTE OPTIMIZATION AND REPORTING FOR MOBILE

CLOUD SYSTEMS

The Contractor shall review all usage of cloud computing services provided by VA.

Resource Utilization Optimization Plans shall be submitted and implemented quarterly on how to best optimize the environment to reduce the costs associated with resource utilization. The Contractor shall provide a breakdown of all costs by application, environment, and utilization and shall report on utilization of each class of resource as a percentage of provisioned capacity in a Monthly Utilization Report.

The Contractor shall, as part of its Monthly Utilization Report, include the total infrastructure expenditure and total number of request services for Cloud Resource Optimization.

Deliverables:

A. Quarterly Resource Utilization Optimization Plan B. Monthly Utilization Report

5.4.1 APPLICATION IDENTITY AND ACCESS MANAGEMENT FUNCTIONS

Within the Cloud itself and the EMM, the Contractor shall maintain the following:

1. The ability to authenticate and perform centralized management for each user and administrator by fully integrating with a VA Active Directory system.

2. Update or replace and maintain some or all of the existing VA approved certificates in the EMM solution as required to meet Active Directory integration requirements, as well as individual project and application requirements. All Active Directory and certificate work must be coordinated with the appropriate VA teams to ensure minimum downtime.

3. An EMM solution that has full capability to integrate with current and future releases of the VA Identity and Access Management (IAM) systems.

4. VA’s two factor authentication for all system accounts and all elevated privileges.

The two factor authentication solution must either integrate with VA’s existing solution for USB etoken or one-time password six-digit Personal Identification Number (PIN) tokens (currently provided by Safenet).

5.4.2 DATA SECURITY

The Contractor’s facilities shall have management, operation, and technical controls in place (NIST SP 800-53, FedRAMP Moderate, and Statement on Auditing Standards (SAS) 70 Type II) for the protection of data.

5.4.3 DISASTER RECOVERY AND CONTINUITY OF OPERATIONS

The Contractor shall work with the EMM and VAEC teams to support Disaster Recovery of all EMM VAEC environments and apps in the EMM solution and shall maintain and enact all procedures to support continuity of operations in accordance with all applicable VA handbooks and rules.

The Contractor shall:

1. Implement within 30 days of award and refine the Disaster Recovery and Backup Plan (part of the current ATO package) for the EMM solution, its environments, and hosted apps supplied using industry best practices which ensures no more than 15 minutes of service disruption and is fully compatible with and leverages the VAEC CSP Environment capabilities. The Disaster Recovery and Backup Plan shall include at a minimum:

a. Organizational preparedness including roles, responsibilities, and contact information.

b. Disaster Recovery management and escalation processes including notification, declaration and testing guidelines, and notifications.

c. Disaster Recovery Test Schedule.

2. Participate in disaster recovery test/exercises (scheduled and unscheduled simulations as well as real situations) and report the results in an After Action Report within 30 days of award.

3. Utilize VAEC GSS services when available and applicable in order to minimize cloud services costs and optimize operations.

4. Provide system details that include a detailed representation of key infrastructure and networking configurations and requirements.

5. Provide failover and failback procedures that include a step-by-step recovery and restoration process.

6. Collaborate in the implementation and update of a data backup solution and include the analytics and identification of data sizes of all systems such as databases and hots, data retention, backup window/scheduling and archiving needs using results to create/update a design of a backup solution.

7. Maintain and update a Continuity of Operations Plan (part of the current ATO package) within 30 days of award.

The Contractor shall provide for the backup and recovery of information stored by the EMM solution to meet the related SLAs in Attachment 1 using native tools and capabilities of the VAEC environment.

The Contractor shall meet the uptime of 99.99% for the EMM solution and all EMM Disaster Recovery models shall meet all of VA’s requirements as detailed in Attachment The Contractor shall provide for the backup and recovery of information stored by the EMM solution in the VAEC environment to meet the related SLAs in Attachment 1.

Deliverables:

A. Updated Disaster Recovery and Backup Plan B. After Action Report C. Updated Continuity of Operation Plan

5.5 AUDIT COOPERATION

The Contractor shall cooperate with all VA audits, including Office of the Inspector General (OIG), Continuous Readiness in Information Security Program (CRISP), Office of Information Security (OIS), and others in the areas of facilities access, audits, and security incident notification. These audits could be yearly or impromptu audits at VA’s request. The Contractor will be expected to provide support on demand, including after hours.

Specifically, the Contractor (and any Subcontractors) shall:

1. Provide the CO, COR, VA Project Manager, and representatives of the agency's auditors, full and free access to the Contractor's (and Subcontractors') facilities, installations, operations documentation, and databases. This access shall be provided to the extent required to carry out audits, inspections, investigations, or other reviews to ensure compliance with contractual requirements for IT and information security, and to safeguard against threats and hazards to the integrity, availability, and confidentiality of agency information in the possession or under the control of the Contractor (or Subcontractor).

2. Fully cooperate with all audits, inspections, investigations, or other reviews conducted by or on behalf of the CO or the agency auditors as described in subparagraph 1 above. Full cooperation includes, but is not limited to, prompt disclosure (within two business days) to authorized requests of data, information, and records requested in connection with any audit, inspection, investigation, or review, making employees of the Contractor and Subcontractors available for interview by auditors, inspectors, and investigators upon request, and providing prompt access (within two business days) to Contractor and Subcontractor facilities, systems, data and personnel to the extent the auditors, inspectors, and investigators reasonably believe necessary to complete the audit, inspection, investigation, or other review.

5.6 ATO DOCUMENTATION AND SUPPORT

The EMM system shall be hosted in the VAEC environment.

The Contractor shall provide Assessment and Authorization (A&A) support required to achieve and maintain full A&A certification in compliance with the most current versions of VA Handbook 6500, VA Handbook 6500.6 (Section 3), and VA Handbook 6500.3.

The Contractor shall be responsible for obtaining and maintaining ATO(s) for EMM and supporting applications (including mobile threat prevention and certificate based authentication) for the life of the TO inheriting security controls from the VAEC and on-premises VA data resources, as applicable. In addition, the contractor shall be responsible for supporting the Electronic Health Record Modernization’s (EHRM) Authority to Connect (ATC) which is within the boundaries of the EMM ATO The contractor will also be responsible for supporting all mobile devices, Apple and Android, models and versions, and MAC laptops, as required for VA use within the boundaries of the EMM ATO. The A&A process is the end-to-end process for ensuring new VA information systems adhere to and follow VA security guidelines (e.g. FISMA, FedRAMP, etc).

Throughout the A&A process, the Contractor shall work with its assigned Information System Security Officer (ISSO) to obtain an ATO. The process entails gaining access to the Governance, Risk and Compliance (GRC) tool,(e.g. RiskVision, eMASS, etc) to serve as the management tool for the A&A process. The GRC tool is used to document accreditation requirements including technical testing/scans, security documentation, and actions identified during the Security Control Assessment. Contractor shall maintain the ATO within the GRC tool regardless of migration/changes. VA currently uses eMASS.

The Contractor shall ensure all security assessments are completed using VA-provided tools to include GRC. GRC Control Questions shall be answered, and evidence documents uploaded no later than 90 days after delivery of the proposed EMM solution.

The Contractor shall perform the tasks and sub-tasks designated as the “system steward” and Information System Owner (ISO) or “delegate” in the most recent version of the Authorization Requirements Standard Operating Procedures (refer to Attachment 2 – Authorization Requirements). The Contractor shall enable VA vulnerability scanning and prioritize corrective actions to mitigate identified weaknesses and vulnerabilities. The Contractor shall perform risk assessments and risk handling to include mitigating discovered vulnerabilities. The Contractor shall perform continuous monitoring per VA’s CRISP. The Contractor shall develop and submit all required Security Document Artifacts as part of the ATO package.

The Contractor shall ensure any findings produced as a result of the security assessments are remediated in order to support A&A. The Contractor shall ensure all other security requirements are met specific to the FIPS 199 categorization documented as a result of the Risk Assessment and applicable VA policy. The Contractor shall ensure all requirements of the Authorization Requirements Standard Operating Procedures (most current version) are met throughout the project lifecycle.

The Contractor shall support audits regarding the implementation of these policies and assist in the collection and preparation of related compliance evidence. The Contractor shall retain and maintain referenced, applicable documents and deliverable documentation and make it available for review.

The Contractor shall provide requested security requirements including:

1. The Contractor shall be available for an interview and provide documentation or allow an onsite inspection for an A&A audit.

2. For any items that failed or demonstrated other than stratified controls identified by any auditing activity, the Contractor shall provide a Plan of Action and Milestones (POA&M) addressing each issue noted in accordance with the failure classification levels: Critical, High, Medium, and Low. Contractor remediation shall follow the following schedule:

a. Critical = 30 calendar days

b. High = 60 calendar days

c. Medium/Moderate = 90 calendar days

d. Low = 120 calendar days

The Contractor shall perform bi-weekly reviews of the POA&M with the VA PM/COR to ensure backlog is scheduled and prioritized for remediation, and to verify that defined milestones will be achieved.