VPAS IDIQ PWS 12.20.23 v1.pdf

Performance Work Statement (PWS) for the

Veterans Affairs (VA) Processing and Automation Services (VPAS)

Date: December 20, 2023 Version 1.5

Department of Veterans Affairs

Office of Administration and Facilities

Acquisition Division

VPAS PWS

Version History

Version # Version Description Release Date

0.5 Initial Draft 04/28/2023

0.6 Draft 05/18/2023

0.7 Draft 05/23/2023

0.8 Draft 06/06/2023

0.9 Draft 06/29/2023

0.95 Draft 07/14/2023

1.4 Draft 12/18/2023

1.5 Draft 12/20/2023

TABLE OF CONTENTS

1.0 Scope

2.0 Applicable Documents

3.0 General Requirements

3.1 Contract Type

3.2 Ordering Period

3.3 Hours of Work

3.4 Place of Performance

3.5 Travel

3.6 Safety and Environmental

3.7 Materials, Equipment, and Locations

3.7.1 Government-Furnished

3.7.2 Contractor-Acquired

3.7.3 Connectivity

3.7.4 Facilities

3.7.4.1 Government Facilities

3.7.4.2 Non-Government Facilities

3.7.5 Warranty

3.7.6 Marking, Handling, Storage, Preservation, Packaging, Tracking & Shipping

3.7.7 Export Control

3.8 Government Inspection and Oversight

3.9 Communicating with the Government

3.10 508 Compliance

3.11 Authentication Methods and Requirements

3.12 Enterprise and IT Framework Constraints

3.12.1 Federal Identity, Credential, and Access Management (FICAM)

3.12.2 Authority to Operate (ATO)/Interim Authority to Operate (IATO)

3.12.3 Browser/Mobile Standards

3.12.4 Zero Trust Architecture

3.12.5 Internet Protocol Version 6 (Ipv6)

3.12.6 Trusted Internet Connection (TIC)

3.12.7 Standard Computer Configuration

3.12.8 Enterprise Management Framework

3.12.9 Authoritative Data Sources

3.12.10 VA Data (Already FedRAMP and VA Authorized) Assessment, Authorization, and Continuous Monitoring

3.12.11 Social Security Number (SSN) Reduction

3.13 VAEC Cloud

3.14 Quality Assurance

3.14.1 Quality Assurance Surveillance Plan

3.14.2 Performance Based Service Assessment (PBSA)

3.14.3 Contractor Performance

3.15 Independent Quality Assurance and Monitoring (QA&M)

3.16 Disaster Recovery (DR) and Continuity of Operations (COOP)

4.0 Service Categories

4.1 Program Management, Strategy, and Planning Support Services

4.2 Source Material Processing Services

4.2.1 Intake Services

4.2.2 Source Material Tracking Services

4.2.3 Source Material Management Services

4.2.4 Conversion Services

4.2.5 Upload and Routing

4.2.6 Inbound Mail Management Support Services

4.2.7 Rules-Based Processing Service (RBPS)

4.3 Centralized Outbound Services

4.4 Data Transfer Services

4.5 Graphical Self-Service Report Generation Capability (VA-Accessible) Services

4.6 Inbound Call Services

4.7 Outbound Call Services

4.8 Automation Development and Operations

4.8.1 Business Process Automation

4.8.2 Exception Handling and Deduplication

4.8.3 Automation Services Efficiency and Effectiveness

4.9 Records Processing Services

4.10 Veteran Transition Support Services

4.11 Freedom of Information Act (FOIA) / Privacy Act (PA) Services

4.12 Operations and Maintenance (O&M) Services

4.12.1 Operations and Maintenance (O&M)

4.12.2 Monitoring and Operational Support

4.13 Integration Services

4.13.1 Organizational Integration Services

4.13.2 Connectivity, Access, and Security

4.13.3 Data Integration Services

4.13.4 Automation Integration Services

4.13.5 Integration Library Services

4.14 Data Storage, Sharing, and Analysis Services

4.15 Veteran and Employee Experience Services

4.16 Enabling and Support Services

4.16.1 Business Processing Services (BPS)

4.16.2 Professional Services

4.16.3 Organizational Change Management Services

4.16.4 Marketing and Outreach Services

4.16.5 Communications Strategy, Planning, and Implementation Services

4.16.6 Customer Relationship Services

4.16.7 Case Management Services

4.16.8 System Modernization and Retirement Services (OIT Funding only)

4.16.9 Training Services

4.16.10 Integration, Setup, Test, and Validation Services

4.16.11 Service Updates

4.16.12 Transition-In and Transition-Out Services

4.16.13 Help Desk / Call Center Services

5.0 Deliverables

5.1 Products

5.2 Rights in Data

6.0 Security and Privacy

6.1 Information Security and Privacy Security Requirements

6.2 Personnel Security Requirements

6.3 Facility/Resource Access Provisions

6.4 Badges

6.5 Incident Reporting and Management

6.6 Security Requirements/Assessments

6.7 Security and Privacy Awareness Training

6.8 Security Role-Based Training

7.0 Contract Management

7.1 Government Support

7.1.1 IDIQ COR

7.1.2 Task Order COR

7.1.3 Onsite Government Representative

7.2 Contractor Program Management

7.2.1 Key Personnel

7.2.2 Work Control

ADDENDUM A. Additional VA Security Requirements, Consolidated

A.1 Cyber and Information Security Requirements for VA IT Services A.2 VA Enterprise Architecture Compliance A.3 Notice of the Federal Accessibility Law Affecting All Electronic and Information Technology Procurements (Section 508) A.4 Physical Security & Safety Requirements A.5 Confidentiality and Non-Disclosure A.6 Information Technology Using Energy-Efficient Products

ADDENDUM B. VA Information and Information System Security / Privacy Language

ADDENDUM C. Performance Based Service Assessment

1.0 SCOPE

Through its three (3) administrations, National Cemetery Administration (NCA), Veterans Benefits Administration (VBA), and Veterans Health Administration (VHA), Veterans Affairs (VA) administers vital services to America's Veterans. VA provides health care services, benefits programs, and access to national cemeteries for former military personnel and their dependents.

The fundamental mission of VBA is to provide Veterans, transitioning service members, and their families with benefits and services including education benefits, home loans, life insurance, and disability compensation or pension benefits. Award of these benefits often requires information gathering from a multitude of third parties, government agencies and digital repositories as well as the application of complex rules.

Prior to 2012, VBA processed most benefits utilizing paper claim folders. In September 2012 VBA began scanning claim folders and uploading the files into the Veterans Benefits Management System (VBMS) for claims processors to view electronically as searchable Portable Document Files (PDFs). Scanning efforts expanded to mail in 2014 and back scanning of historical file banks in 2016. The success of VBA’s scanning program supported the reduction of rating claim backlogs from over 600,000 in early 2012 to less than 90,000 by the end of Fiscal Year (FY) 2019. It also enabled the opportunity to further reduce the claim cycle by extracting data from images to automate business processes.

In today’s process, mail arrives at the Evidence Intake Center from Veterans, or their representatives, to support a Veteran’s, or their family member’s, claim for benefits and services. This mail is tracked and converted into searchable PDF (PDF Image plus Text) format in compliance with the VBMS PDF specification. Also, as records are located or generated during claim development activities, they are retrieved and added to the body of evidence supporting the claim in the systems of records for the claimant. These materials typically support one or more business processes, primarily related to Veterans benefits claims processing, using other input material provided by other entities (such as VHA, NCA and other federal partners).

The Veterans Intake, Conversion and Communication Services (VICCS) Indefinite Delivery Indefinite Quantity (IDIQ) was established in 2019 to continuously improve benefits processing efficiency and cycle‐time. VBA has partnered with industry leaders to provide a host of managed‐service contracts. Services in the existing VICCS contract portfolio include:

Benefits Transformation Platform services (BTPS)

Mail Automation Services

Additional Presumptive Capacity Automation Services (APCAS)

Pension Optimization Initiative (POI)

Freedom of Information Act/Privacy Act (FOIA/PA) Services

Get Results in Transition (GRIT) Services

Mail Management Services (MMS)

File Conversion Services

Records Management Services (RMS) that provide storage for converted source materials

Centralized Benefits Communication Management (CBCM) services supporting the centralization of printing and mailing for all VA regional offices

Services supporting Private Medical Records (PMR) retrieval

This VA Processing and Automation Services (VPAS) IDIQ provides a successor to the VICCS IDIQ to provide managed services for all elements of VA to provide the following categories of services:

Source Material Processing Services, such as o Intake o Source Material Tracking o Source Material Management o Digitization and data extraction o Upload and Routing o Inbound Mail Management Support o Rule‐Based Processing (such Optical Character Recognition, Iterative Fusion based Recognizer, Natural Language Processing) o Centralized Outbound o Data Transfer o Graphical Self‐Service Report Generation o Inbound Calls o Outbound Calls o Automation Development and Operations o Business Process Automation o Claims / Application processing o Private medical records processing o Mail automation o Veteran transition support o Records Research o Freedom of Information Act (FOIA) / Privacy Act request processing o Operations and Maintenance

Integration Services, such as o Organizational Integration o Connectivity, Access, and Security o Data Integration o Automation Integration o Integration Library

Data Storage, Sharing and Analysis Services

Customer/Employee Experience Services

Enabling and Support Services, such as o Business Processing o Professional services o Organizational Change Management o Marketing/Outreach o Communications Strategy, Planning, and Implementation o Customer Relationship Services o Case Management Services o System Modernization and Retirement Services o Training Services o Integration, Setup, Test and Validation Services o Service Updates o Transition In/Out o Help Desk / Call Center Services

This performance work statement (PWS) provides general requirements. Specific requirements shall be defined in individual Task Orders. Service area requirements are described in Section

4.0 and are not mutually exclusive for Task Order requirements. Requirements may fall within one specific service area but in many cases, the requirements will encompass and apply across and within multiple service areas. Service performance requirements shall be established in individual Task Orders.

2.0 APPLICABLE DOCUMENTS

The Contractor shall comply with the documents listed below. Additional documents may be listed in individual Task Orders.

1. 44 U.S.C. § 3541‐3549, “Federal Information Security Management Act (FISMA) of 2002”

2. 44 U.S.C. § 3551‐3558, “Federal Information Security Modernization Act (FISMA) of 2014.”

3. Health Insurance Portability and Accountability Act (HIPAA); 45 CFR Part 160, 162, and 164; Health Insurance Reform: Security Standards; Final Rule dated February 20, 2003

4. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and Guidelines,” January 18, 2017

5. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (Public Law 110–140), December 19, 2007.

6. Section 104 of the Energy Policy Act of 2005, (Public Law 109–58), August 8, 2005.

7. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974.”

8. Public Law 109‐461, “Veterans Benefits, Health Care, and Information Technology Act of 2006, Title IX, Information Security Matters.”

9. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended by the Workforce Investment Act of 1998 (P.L. 105‐220), August 7, 1998.

10. 36 C.F.R. Part 1194 “Electronic and Information Technology Accessibility Standards.”

11. Section 701 of the Promise to Address Comprehensive Toxics (PACT) Act of 2022 (Public Law 117‐168), August 2, 2022

12. Clinger‐Cohen Act of 1996, 40 U.S.C. §11101 and §11103

13. Social Security Number (SSN) Fraud Prevention Act of 2017

14. Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23, 2018

15. Federal Travel Regulation (FTR) (www.gsa.gov/federaltravelregulation)

16. Executive Order 13693, “Planning for Federal Sustainability in the Next Decade,” dated March 19, 2015.

17. Executive Order 13221, “Energy‐Efficient Standby Power Devices,” August 2, 2001.

18. Executive Order 13834, “Efficient Federal Operations,” dated May 17, 2018

19. Executive Order 13960, “Promoting the Use of Trustworthy Artificial Intelligence in the Federal Government,” dated December 3, 2020.

20. Executive Order 14026, “Increasing the Minimum Wage for Federal Contractors,” dated April 27, 2021.

21. Executive Order 14028, “Improving the Nation's Cybersecurity,” dated May 12, 2021.

22. Executive Order 14034, “Protecting Americans' Sensitive Data from Foreign Adversaries,” dated June 9, 2021.

23. Executive Order 14058, “Transforming Federal Customer Experience and Service Delivery to Rebuild Trust in Government,” dated December 13, 2021.

24. “Homeland Security Presidential Directive (12) (HSPD‐12)”, August 27, 2004.

25. Office of Management and Budget (OMB) Circular A‐130, “Managing Federal Information as a Strategic Resource,” July 28, 2016.

26. OMB Memorandum “Security Authorization of Information Systems in Cloud Computing Environments,” December 8, 2011 (FedRAMP Policy Memorandum)

27. OMB Memorandum 05‐24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005

28. OMB Memorandum M‐08‐05, “Implementation of Trusted Internet Connections (TIC),” November 20, 2007.

29. OMB Memorandum M‐08‐23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008.

30. OMB Memorandum M‐04‐04, “E‐Authentication Guidance for Federal Agencies,” December 16, 2003.

31. OMB Memorandum M‐05‐24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005.

32. OMB Memorandum M‐11‐11, “Continued Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” February 3, 2011.

33. OMB Memorandum M‐19‐17, “Enabling Mission Delivery through Improved Identity, Credential, and Access Management,” May 21, 2019.

34. OMB Memorandum M‐19‐26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019

35. OMB Memo M‐21‐06, “Guidance for Regulation of Artificial Intelligence Applications,” dated November 17, 2020.

36. OMB Memorandum M‐21‐07, “Completing the Transition to Internet Protocol version 6 (IPv6),” November 19, 2020.

37. OMB Memo M‐21‐30, “Protecting Critical Software Through Enhanced Security Measures,” dated August 10, 2021.

38. OMB Memo M‐22‐01, “Improving Detection of Cybersecurity Vulnerabilities and Incidents on Federal Government Systems through Endpoint Detection and Response,” dated October 8, 2021.

39. OMB Memorandum M‐22‐09, “Moving the U.S. Government Toward Zero Trust Cybersecurity Principles,” January 26, 2022.

40. OMB Memorandum for Chief Information Officers, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008.

41. “Trusted Internet Connections (TIC) Reference Architecture Document, Version 2.2, Federal Interagency Technical Reference Architectures, Department of Homeland Security,” June 19, 2017.

42. “Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance,” V2.0, December 2, 2011.

43. “Draft National Institute of Standards and Technology Interagency Report (NISTIR) 798, “Mobile, PIV, and Authentication,” March 2014.

44. Federal Information Processing Standards (FIPS) Publication 140‐2, “Security Requirements for Cryptographic Modules,” May 25, 2001.

45. FIPS 186‐5, “Digital Signature Standard (DSS),” dated February 3, 2023.

46. FIPS Publication 199, “Standards for Security Categorization of Federal Information and Information Systems,” February 2004.

47. FIPS Publication 200, “Minimum Security Requirements for Federal Information and Information Systems,” March 2006.

48. FIPS Publication 201‐3, “Personal Identity Verification of Federal Employees and Contractors,” January 2022.

49. FIPS Special Publication 800‐172, “Enhanced Security Requirements for Protecting Controlled Unclassified Information: A Supplement to NIS Special Publication 800‐171,” February 2021.

50. NIST SP 500‐267B Revision 1, ”USGv6 Profile,” November 2020

51. NIST SP 800‐37, “Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach, Rev. 2,” December 20, 2018.

52. NIST SP 800‐53, “Security and Privacy Controls for Federal Information Systems and Organizations,” dated May 26, 2022.

53. NIST SP 800‐57, “Recommendation for Key Management,” dated May 4, 2020.

54. NIST SP 800‐63‐3, 800‐63A, 800‐63B, 800‐63C, “Digital Identity Guidelines,” December 1, 2017.

55. NIST Special Publication (SP) 800‐66 Rev 2 (Draft): “An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule,” July 2022.

56. NIST SP 800‐116 Rev. 1, “Guidelines for the Use of PIV Credentials in Facility Access,” June 29, 2018.

57. NIST SP 800‐157, “Guidelines for Derived PIV Credentials,” December 19, 2014.

58. VA Directive 0058, “VA Green Purchasing Program,” July 19, 2013 (https://www.va.gov/vapubs/index.cfm)

59. VA Handbook 0058, “VA Green Purchasing Program,” July 19, 2013 (https://www.va.gov/vapubs/index.cfm)

60. VA Handbook 0710, “Personnel Suitability and Security Program” dated May 2, 2016

61. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, (https://www.va.gov/vapubs/index.cfm)

62. VHA Directive 1605.05, Business Associate Agreements, November 17, 2020, (https://www.va.gov/vhapublications/ViewPublication.asp?pub_ID=9178)

63. VA Directive and Handbook 6102, “Internet/Intranet Services,” August 5, 2019 (https://www.va.gov/vapubs/index.cfm)

64. VA Directive 6102 (Internet/Intranet Services), August 5, 2019 (https://www.va.gov/vapubs/index.cfm)

65. VA Handbook 6102 (Internet/Intranet Services), August 5, 2019 (https://www.va.gov/vapubs/index.cfm

66. VA Directive 6300, “Records and Information Management,” September 21, 2018 (https://www.va.gov/vapubs/index.cfm)

67. VA Handbook, 6300.1, “Records Management Procedures,” March 24, 2010 (https://www.va.gov/vapubs/index.cfm)

68. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021 (https://www.va.gov/vapubs/index.cfm)

69. VA Handbook 6500, “Risk Management Framework for VA Information Systems – Tier 3: VA Information Security Program,” February 24, 2021 (https://www.va.gov/vapubs/index.cfm)

70. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI),” March 12, 2019 (https://www.va.gov/vapubs/index.cfm)

71. VA Handbook 6500.5, “Incorporating Security and Privacy in System Development Lifecycle,” March 22, 2010 (https://www.va.gov/vapubs/index.cfm)

72. VA Handbook 6500.6, “Contract Security,” March 12, 2010 (https://www.va.gov/vapubs/index.cfm)

73. VA Handbook 6500.8, “Information System Contingency Planning,” April 6, 2011 (https://www.va.gov/vapubs/index.cfm)

74. VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018.

75. VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017.

76. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014.

77. VA Handbook 6508.1, “Procedures for Privacy Threshold Analysis and Privacy Impact Assessment,” July 30, 2015.

78. VA Directive and Handbook 6510, “VA Identity and Access Management,” January 15, 2016.

79. A Directive and Handbook 6513, “Secure External Connections,” October 12, 2017

80. VA Directive and Handbook 6517, “Risk Management Framework for Cloud Computing,” November 15, 2016.

81. VA Directive 6609, “Mailing of Sensitive Personal Information,” May 20, 2011 (https://www.va.gov/vapubs/index.cfm)

82. VA Handbook 0730, “Security and Law Enforcement,” dated August 11, 2000.

(https://www.va.gov/vapubs/viewPublication.asp?Pub_ID=93&FType=2)

83. VA Handbook 0730/1, “Security and Law Enforcement,” dated August 20, 2004.

(https://www.va.gov/vapubs/viewPublication.asp?Pub_ID=96&FType=2)

84. VA Handbook 0730/4, “Security and Law Enforcement,” dated March 29, 2013.

(https://www.va.gov/vapubs/viewPublication.asp?Pub_ID=700&FType=2)

85. VA Directive 6066, “Protected Health Information (PHI) and Business Associate Agreements Management,” dated September 2, 2014.

86. VA Regulation 2022‐13312, “Individuals Using the Department of Veterans Affairs’ Information Technology Systems to Access Records Relevant to a Benefit Claim,” dated June 24, 2022.

87. “Authorization Requirements Standard Operating Procedures, v1.35,” dated April 13, 2022.

88. “BTS Emergency Notification SOP, v2.0, dated July 22, 2021

89. “Veteran Focused Integration Process (VIP) Guide 4.0,” January 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

90. “One‐VA Technical Reference Model (TRM)” ‐ (reference at https://www.va.gov/trm/TRMHomePage.aspx)

91. VA Enterprise Cloud Technical Reference Guide, v2.0, dated November 2022.

92. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD‐12) Program,” October 26, 2015.

93. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD‐12) Program,” March 24, 2014.

94. VA Enterprise Cloud (VAEC) Technical Reference Guide, July 2018 version 1.

95. “IAM Identity Management Business Requirements Guidance Document”, May 2013.

https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514

96. VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland Security Presidential Directive 12 (HSPD‐12),” April 29, 2011

97. VA Memorandum, VAIQ #7712300, “Mandate to meet PIV Requirements for New and Existing Systems,” June 30, 2015.

98. VA Memorandum, VAIQ #7660995, “Continuous Diagnostics and Monitoring of all VA Information Systems,” dated January 29, 2016.

99. VA Memorandum, VAIQ #7497987, “Compliance – Electronic Product Environmental Assessment Tool (EPEAT) – IT Electronic Equipment,” August 11, 2014 (reference Document Libraries, EPEAT/Green Purchasing Section.

https://www.voa.va.gov/documentlistpublic.aspx?NodeID=552

100. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote Access,” January 15, 2014. https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

101. VA Memorandum, VAIQ #7614373, “Implementation of Federal Personal Identity Verification (PIV) Credentials for Federal and Contractor Access to VA IT Systems,” July 9, 2015. https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

102. VA Memorandum, VAIQ #7613595, “Mandatory Use of PIV Multifactor Authentication to VA Information System,” June 30, 2015.

https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

103. VA Memorandum, VAIQ #7613597, “Mandatory Use of PIV Multifactor Authentication for Users with Elevated Privileges,” June 30, 2015.

https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

104. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

105. VA Memorandum, VAIQ #7581492, “Use of Personal Email,” April 24, 2015.

https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

106. VA Memorandum VAIQ #7823189, “Updated VA Information Security Rules of Behavior,” September 15, 2017.

https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

107. “Records Control Schedule VB‐1,” dated January 31, 2014.

108. VAAR 804.1303, Contract Clause Requiring Compliance with Personal Identity Verification of Contractor Personnel; and

109. VAAR 804.1970, Information Security Policy – Contractor General Responsibilities.

3.0 GENERAL REQUIREMENTS

The Contractor shall provide and acquire, when necessary, the services required by individual Task Orders pursuant to the requirements specified below.

3.1 Contract Type

This is a Multiple Award IDIQ contract.

3.2 Ordering Period

The ordering period for the basic contract shall be a four (4) year base period followed by two

(2) three (3) year option periods.

3.3 Hours of Work

Work at a Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO). Hours of work will be established at the Task Order level. The Contractor may also be required to support 24/7 operations 365 days per year as identified in individual Task Orders.

There are 11 Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, five are set by date:

New Year's Day January 1 Juneteenth Day June 19 Independence Day July 4 Veterans Day November 11 Christmas Day December 25

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six (6) are set by a day of the week and month:

Martin Luther King's Birthday Third Monday in January Washington's Birthday Third Monday in February Memorial Day Last Monday in May Labor Day First Monday in September Columbus Day Second Monday in October Thanksgiving Fourth Thursday in November

3.4 Place of Performance

The place of performance shall be identified in individual Task Orders. Locations will be Government and Contractor sites within the Continental United States (CONUS). No work shall be performed outside of the Continental United States (OCONUS). Work may be performed at either a Government or non‐Government facility. Each Task Order shall delineate the location requirements. All work is anticipated to be performed within CONUS. Exceptions to be approved by the CO/COR.

3.5 Travel

Travel shall be in accordance with (IAW) individual Task Order requirements. Travel details must be provided to and approved by the Contracting Officer’s Representative (COR) or the Government designee prior to the commencement of travel. All travel shall be IAW Federal Acquisition Regulation (FAR) 31.205‐46.

3.6 Safety and Environmental

Safety and environmental procedures shall be identified in individual Task Order requirements.

The Contractor shall comply with the Office of Federal Sustainability Acquisition and Electronics Stewardship initiatives as identified in individual Task Orders IAW the policies referenced at https://www.sustainability.gov/resources‐eo‐efo.html

3.7 Materials, Equipment, and Locations

3.7.1 Government‐Furnished

Government Furnished Property (GFP) which includes Government Furnished Material (GFM), Government Furnished Information (GFI), and Government Furnished Equipment (GFE) may be provided and shall be identified in the individual Task Order. The Contractor shall be responsible for conducting all necessary examinations, inspections, maintenance, and tests upon receipt.

VA will provide VA specific system access as appropriate and required in individual Task Orders.

Contractors shall comply with VA security policies and procedures with respect to protecting sensitive data. See Section 6.0 for detailed security requirements.

3.7.2 Contractor‐Acquired

The Contractor shall acquire and provide, when necessary, any hardware and software, when necessary, required to accomplish each Task Order that is not provided as GFP. Software integrity shall be maintained by the Contractor within the licensing agreement of the producer.

3.7.3 Connectivity

VA will provide connectivity to VA specific systems and network as required for execution of a task via VA approved remote access technology. Currently this connectivity may include but is not limited to Citrix Access Gateway (CAG), site‐to‐site VPN, or Cisco AnyConnect Secure Mobility Client. The Contractor must meet the requirements of VA Handbook 6500 and will bear the cost to provide connectivity to VA systems and networks. Other connectivity to VA systems may be authorized as appropriate in individual Task Orders.

3.7.4 Facilities

Work may be performed at either a Government or non‐Government facility. Each Task Order shall delineate the location requirements.

3.7.4.1 Government Facilities

Certain Government office space may be made available for performance of individual Task Orders. Contractors may be required to establish operations and support at Government locations and shall comply with VA, Federal assessment and authorization (A&A) requirements.

Such facilities shall be specified in the individual Task Order.

3.7.4.2 Non‐Government Facilities

Personnel shall perform at Contractor facilities as specified in the individual task order and shall comply with VA and/or Federal A&A requirements. The Contractor shall disclose specific facility information during the Request for Task Order Proposal (RTOP) process. All facilities shall be approved by VA and in compliance with PWS paragraph 6.0, Security and Privacy. All facilities containing VA source materials shall be compliant with 36 CFR Part 1234, Subpart B, with no exceptions made for the waivers discussed within 36 CFR Part 1234, Subpart B. While National Archives and Records Administration (NARA) certification is not required, the Contractor shall maintain compliance with the referenced NARA requirements. The Contractor shall specify whether their operations take place in a leased or own building, and notify the Government within 90 days of expiration of the lease.

3.7.5 Warranty

Items acquired under this contract may require warranty protection. Commercial warranties shall be transferred to the Government. The type of warranty and extent of coverage shall be determined on an individual Task Order basis.

3.7.6 Marking, Handling, Storage, Preservation, Packaging, Tracking & Shipping

The Contractor shall establish and, when necessary, maintain procedures IAW VA Handbook 6500 and VA Directive 6609 for handling, storage, preservation, packaging, marking, tracking, and shipping to protect the quality of products and prevent damage, loss, deterioration, degradation, or substitution of products.

3.7.7 Export Control

The Contractor shall comply with all applicable laws and regulations regarding export‐ controlled information and technology and shall not use, distribute, transfer, or transmit technology (even if incorporated into products, software, or other information) except in compliance with such laws and regulations. In addition, the Contractor shall plan for, obtain, and maintain all export licensing required to satisfy individual Task Order requirements.

3.8 Government Inspection and Oversight

The Contractor shall cooperate with authorized Government offices in the areas of facilities access, audits, security incident notification, and hosting location as specified in the individual Task Order. Specifically, the Contractor (and any Subcontractor) shall:

a. Provide the CO, COR, and representatives of authorized Government offices, full and free physical and remote/logical access to its facilities, installations, operations documentation, databases, and personnel used for contract hosting services. This access shall be provided to the extent required to carry out audits, inspections, device scanning utilizing Government prescribed tools, investigations, or other reviews to ensure compliance with contractual requirements for IT and information security, and to safeguard against threats and hazards to the integrity, availability, and confidentiality of agency information in the possession or under the control of the Contractor (or Subcontractor).

b. Fully cooperate with all audits, inspections, investigations, or other reviews conducted by or on behalf of the CO or other authorized Government offices as described in subparagraph (a). Full cooperation includes, but is not limited to, prompt disclosure (per agency policy) to authorized requests of data, information, and records requested in connection with any audit, inspection, investigation, or review, making employees of the Contractor available for interview by auditors, inspectors, and investigators upon request, and providing prompt access (per agency policy) to Contractor facilities, systems, data and personnel to the extent the auditors, inspectors, and investigators reasonably believe necessary to complete the audit, inspection, investigation, or other review. Audits, inspections, investigations, and reviews may be announced or unannounced at the Government’s discretion. The Contractor’s (and any Subcontractors’) cooperation with audits, inspections, investigations, and reviews shall be provided at no additional cost to the Government.

c. Preserve such data, records, logs, and other evidence which are reasonably necessary to conduct a thorough investigation of any computer security incident. A computer security incident (as defined in NIST SP 800‐61, Computer Security Incident Handling Guide) includes, but is not limited to, those constituting an actual or potential threat or hazard to the integrity, availability, or confidentiality of agency information in the possession or under the control of the Contractor (or Subcontractor), or to the function of information systems operated by the Contractor (or Subcontractor) in the performance of this contract.

d. Promptly notify the designated agency representative in the event of any computer security and privacy incident as described in paragraph (c) above. This notification requirement is in addition to any other notification requirements which may be required by law or this contract. Established Federal agency timeframes for reporting security and privacy incidents to the United States Computer Emergency Readiness Team (US‐CERT), although not exhaustive, serve as a useful guideline for determining whether reports under this paragraph are made promptly. (See NIST SP 800‐61, Computer Security Incident Handling Guide, Appendix J).

e. Provide to the requestor (CO, a representative of the CO, or authorized Government offices) Government data, information, or records under the control of or in the possession of the Contractor pursuant to this contract, which the Agency or authorized Government offices, including the Office of Inspector General (OIG), may request in furtherance of other audits, inspections, investigations, reviews or litigation in which the Agency or other authorized Government offices are involved in the form specified at the task order level. Requests for production under this paragraph shall specify a deadline not less than 10 days for compliance, which will determine whether response to the request has been made in a timely manner. Unless expressly provided otherwise elsewhere in this contract, the production of data, information, or records under this paragraph will be at no additional cost to the Government.

f. Include the substance of this Section, including this paragraph (f) in any subcontract which would require or otherwise result in Subcontractor employees having access to agency information in the possession or under the control of the Contractor (or Subcontractor), or access to information systems operated by the Contractor (or Subcontractor) in the performance of this contract.

g. Ensure that all hosting services pertaining to this contract are performed within the continental United States of America, including the storage of agency data, information, and records under the control of or in the possession of the Contractor pursuant to this contract.

3.9 Communicating with the Government

The Contractor shall communicate with the Government on the VA network, with a VA account, using VA‐authorized systems, encrypted email when required, and using video conferencing (Microsoft Teams is the current VA video conferencing and instant messaging technology).

3.10 508 Compliance

The Contractor shall ensure its solution allows Federal employees and Veterans with disabilities to have access to and use of information and data, so that the access is comparable to the access to and use of information and data by Federal employees and Veterans who are not individuals with disabilities, unless an undue burden would be imposed on the agency. General 508 guidelines can be found via the website below:

https://www.access‐board.gov/guidelines‐and‐standards/communications‐and‐it/about‐ the‐ict‐ refresh/final‐rule/text‐of‐the‐standards‐and‐guidelines

3.11 Authentication Methods and Requirements

Contractors, contractor personnel, subcontractors, and subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security.

According to the Identity, Credential, and Access Management (ICAM) Program Management Office which allows trusted users access to VA services via their VA Personal Identity Verification (PIV) badge. The Contractor’s solution shall include authentication procedures to track Contractor and VA resources authorized to access, view, and edit, to log available tracking information and metadata using one of the VA approved authentication methodologies.

To avoid these contractors’ accounts being disabled after 90 days and deleted after 180 days, the Contractors shall log in to each of their VA resources (VA email, Centralized Mail portal, VBMS, etc.) at least once per month to avoid have their systems access disabled.

3.12 Enterprise and IT Framework Constraints

3.12.1 Federal Identity, Credential, and Access Management (FICAM)

The Contractor shall ensure Commercial Off‐The‐Shelf (COTS) product(s), software configuration and customization, and/or new software are Personal Identity Verification (PIV) card‐enabled by accepting HSPD‐12 PIV credentials using VA Enterprise Technical Architecture (ETA) and VA Identity and Access Management (IAM) approved enterprise design and integration patterns at VA Enterprise Architecture Home. The Contractor shall ensure all Contractor delivered applications and systems comply with the VA Identity, Credential, and Access Management policies and guidelines set forth in the VA Handbook 6510 and align with the Federal Identity, Credential, and Access Management Roadmap and Implementation Guidance v2.0.

The Contractor shall ensure all Contractor delivered applications and systems provide user authentication services compliant with the National Institute of Standards and Technology (NIST) Special Publication (SP) 800‐63‐3, VA Handbook 6500 Appendix F, “VA System Security Controls”, and VA IAM enterprise requirements for direct, assertion‐based authentication, and/or trust‐based authentication, as determined by the design and integration patterns. Direct authentication at a minimum must include Public Key Infrastructure (PKI) based authentication supportive of PIV card and/or Common Access Card (CAC), as determined by the business need.

The Contractor shall ensure all Contractor delivered applications and systems conform to the specific Identity and Access Management PIV requirements set forth in the Office of Management and Budget (OMB) Memoranda M‐04‐04, M‐05‐24, M‐11‐11, and NIST Federal Information Processing Standard (FIPS) 201‐3. OMB Memoranda M‐04‐04, M‐05‐24, and M‐11‐ 11 can be found at:

https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/omb/memoranda/fy04/ m04‐04.pdf, https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/omb/memoranda/fy200 5/m05‐24.pdf, and https://obamawhitehouse.archives.gov/sites/default/files/omb/memoranda/2011/m11‐11.pdf respectively. Contractor delivered applications and systems shall be on the FIPS 201‐2 Approved Product List (APL). If the Contractor delivered application and system is not on the APL, the Contractor shall be responsible for taking the application and system through the FIPS 201 Evaluation Program.

The Contractor shall ensure all Contractor delivered applications and systems support:

Automated provisioning and can use enterprise provisioning service.

Interfacing with VA’s Master Veteran Index (MVI) to provision identity attributes, if the solution relies on VA user identities. MVI is the authoritative source for VA user identity data.

The VA defined unique identity (Secure Identifier [SEC ID]/Integrated Control Number

[ICN]).

Multiple authenticators for a given identity and authenticators at every Authenticator Assurance Level (AAL) appropriate for the solution.

Identity proofing for each Identity Assurance Level (IAL) appropriate for the solution.

Federation for each Federation Assurance Level (FAL) appropriate for the solution, if applicable.

Two‐factor authentication (2FA) through an applicable design pattern as outlined in VA Enterprise Design Patterns.

A Security Assertion Markup Language (SAML) implementation if the solution relies on assertion‐based authentication. Additional assertion implementations, besides the required SAML assertion, may be provided if they are compliant with NIST SP 800‐63‐3 guidelines.

Authentication/account binding based on trusted Hypertext Transfer Protocol (HTTP) headers if the solution relies on Trust based authentication.

Role Based Access Control.

Auditing and reporting capabilities.

Compliance with VAIQ# 7712300 Mandate to meet PIV requirements for new and existing systems.

https://www.voa.va.gov/DocumentView.aspx?DocumentID=4846

The required Assurance Levels for this specific effort are Identity Assurance Level 3, Authenticator Assurance Level 3, and Federation Assurance Level 3.

3.12.2 Authority to Operate (ATO)/Interim Authority to Operate (IATO)

The Contractor shall obtain and maintain any ATO or, if acceptable to the Government, any IATO within 180 calendar days following Task Order award. The Contractor shall develop, implement, and execute processes to obtain VA authorizations for all services (including updated services as required) as specified by individual Task Orders. Specific activities include, but are not limited to, security certifications, or comprehensive assessments of the management, operational, and technical security controls in Contractor‐provided services to determine the extent to which the controls are implemented correctly. For detailed Security and Privacy Requirements, refer to the most current Authorization Requirements Standard Operating Procedures.

3.12.3 Browser/Mobile Standards

The Contractor shall ensure services are developed in accordance with VA standard browser baselines and shall update services as required by VA when new browser standards are implemented. In the event mobile services were required, VA mobile development, security and privacy standards should be followed to ensure adequate protection of VA information. VA approves the latest version of Windows and transitions agency‐wide to new versions after approval. Although VA has Chrome, it is currently limited in functionality and is not considered the standard browser for daily usage across VA applications.

3.12.4 Zero Trust Architecture

The Contractor shall comply with the Presidential Executive Order M‐22‐09 to establish and implement Zero Trust Architecture and related cybersecurity requirements in the development, deployment, and sustainment of managed service provider solutions.

Additionally, the following requirements shall be applicable in the assessment, authorization, and continuous monitoring of the solution:

The solution selected by the Contractor shall comply with Zero Trust Architecture guidelines in the NIST SP 800‐207.

Following guidance from the Federal CIO, VA will utilize existing VA ATO or agency ATO issued by another agency as a starting point for FedRAMP requirements. If neither of those exist, VA will sponsor FedRAMP Certification. VA will be using the FedRAMP baselines as a starting point, since they are specifically tailored for cloud services.

Migration to the VAEC eliminates the requirement for a FedRAMP Certification once complete.

As specified in the Task Order, the Contractor shall complete a FedRAMP System Security Plan (SSP) and supporting documentation after Task Order award.

The Contractor shall complete a Third‐Party Assessment Organization (3PAO) Security Assessment Plan (SAP) after Task Order award.

As specified in the Task Order, the Contractor shall complete a 3PAO Security Assessment Report (SAR) after Task Order award.

The Contractor shall require dual factor authentication for ANY and ALL connections that have login ability to the VA network.

Under Zero Trust guidelines published in Executive Order (EO) 14028, the Contractor shall implement as part of this solution the existing and emerging guidelines published in National Institute of Standards and Technology (NIST) Special Publication (SP) 800‐92, A Guide to Computer Security Log Management and OMB Memorandum M‐21‐31, Improving the Federal Government’s Investigative and Remediation Capabilities Related to Cybersecurity Incidents. Specifically, and not limited to, Meeting the Event Logging (EL) 1 maturity level, intermediate logging categories, publication of standardized log structure, inspection of encrypted data, intermediate centralized log access. The Contractor shall be responsible for incorporating requirements for logging, log retention, and log management.

3.12.5 Internet Protocol Version 6 (Ipv6)

The Contractor solution shall support Internet Protocol Version 6 (IPv6) based upon the memo issued by the Office of Management and Budget (OMB) on November 19, 2020 (https://www.whitehouse.gov/wp‐content/uploads/2020/11/M‐21‐07.pdf). IPv6 technology, in accordance with the USGv6 Program (https://www.nist.gov/programs‐projects/usgv6‐ program/usgv6‐revision‐1), NIST Special Publication (SP) 500‐267B Revision 1 “USGv6 Profile” (https://doi.org/10.6028/NIST.SP.500‐267Br1), and NIST SP 800‐119 “Guidelines for the Secure Deployment of IPv6” (https://doi.org/10.6028/NIST.SP.800‐119), compliance shall be included in all IT infrastructures, application designs, application development, operational systems and sub‐systems, and their integration. In addition to the above requirements, all devices shall support native IPv6 and dual stack (IPv6 / IPv4) connectivity without additional memory or other resources being provided by the Government, so that they can function in a mixed environment. All public/external facing servers and services (e.g., web, email, DNS, ISP services, etc.) shall support native IPv6 and dual stack (IPv6 / IPv4) users and all internal infrastructure and applications shall communicate using native IPv6 and dual stack (IPv6 / IPv4) operations.

3.12.6 Trusted Internet Connection (TIC)

The Contractor solution shall meet the requirements outlined in Office of Management and Budget Memorandum M‐19‐26, “Update to the Trusted Internet Connections (TIC) Initiative“ (https://www.whitehouse.gov/wp‐content/uploads/2019/09/M‐19‐26.pdf), VA Directive 6513 “Secure External Connections”, and shall comply with the TIC 3.0 Core Guidance Documents, including all Volumes and TIC Use Cases, found at the Cybersecurity & Infrastructure Security Agency (CISA) (https://www.cisa.gov/publication/tic‐30‐core‐guidance‐documents). Any deviations must be approved by the VA TIC 3.0 Working Group at vaoisesatic30team@va.gov.

3.12.7 Standard Computer Configuration

The Contractor IT end user solution that is developed for use on standard VA computers shall be compatible with and be supported on the standard VA operating system, currently Windows 10 (64bit), Edge (Chromium based), and 365 Apps for enterprise. Applications delivered to VA and intended to be deployed to Windows 10 workstations shall be delivered as a signed .msi package with switches for silent and unattended installation and updates shall be delivered in signed .msp file formats for easy deployment using Microsoft Endpoint Configuration Manager (CM) VA’s current desktop application deployment tool. Signing of the software code shall be through a vendor provided certificate that is trusted by VA using a code signing authority such as Verizon/Cybertrust or Symantec/VeriSign. The Contractor shall also ensure and certify that their solution functions as expected when used from a standard VA computer, with non‐admin, standard user rights that have been configured using the United States Government Configuration Baseline (USGCB) and Defense Information Systems Agency (DISA) Secure Technical Implementation Guide (STIG) specific to the particular client operating system being used.

3.12.8 Enterprise Management Framework

The EMF provides an enterprise‐wide view of VA IT systems comprised of tools, reports, databases, dashboards, and analytics. The EMF enables the Office of Information Technology (OIT) to view the health and performance of systems and provides intelligent analysis and trending that enables proactive enterprise system management. Performance, availability, user experience and reliability of IT service delivery are improved as OIT can make strategic, operational and investment decisions based on real‐time information.

The EMF supports a unified enterprise service management model including release management, configuration management, change management, and incident management aligned with industry standard IT Infrastructure Library (ITIL) service management best practices. The EMF Federated Data Repository (FDR) includes the implementation of a foundational component. The EMF FDR is a national repository that collects enterprise IT management data from VA Managed Data Repositories (MDRs) and integrates with existing VA monitoring and performance systems.

Additional frameworks may be specified in individual task orders.

3.12.9 Authoritative Data Sources

The VA Enterprise Architecture Repository (VEAR) is one component within the overall EA that establishes the common framework for data taxonomy for describing the data architecture used to develop, operate, and maintain enterprise applications. The Contractor shall comply with the department’s Authoritative Data Source (ADS) requirement that VA systems, services, and processes throughout the enterprise shall access VA data solely through official VA ADSs where applicable, see below. The Information Classes which compose each ADS are located in the VEAR, in the Data & Information domain. The Contractor shall ensure that all delivered applications and system solutions support:

1. Interfacing with VA’s Master Person Index (MPI) (formerly the Master…