Notice of Intent to Sole Source Design of Chat Bot (VA-24-00099598)

Special Notice Special Notice Page 3 of 15 Special Notice *= Required Field Special Notice Page 1 of 15 This Notice of Intent to Sole Source is not a request for competitive quotations or proposals. The Department of Veterans Affairs (VA) Strategic Acquisition Center, Frederick (SAC-F) contracting office intends to award a firm fixed price sole source contract for the Veterans Health Administration (VHA), Office of Mental Health. Aurelius Talent Solution LLC 8341 Governor Run Ellicott City, MD 21043-3448 The proposed contract action is to procure Contractor support services for a Simulated Orator to Promote Help-seeking and Recovery, Orient Self-care, and Yield Native Engagement (SOPHROSYNE): A Chatbot/Interface to Support Motivational Interviewing and Care Navigation to Encourage Reduced Substance Use. This acquisition is conducted in accordance with Public Law 109-461, codified at 38 USC 8127, in order to increase contracting opportunities for small business concerns owned and controlled by veterans and small business concerns owned and controlled by veterans with service-connected disabilities. Contracting Officers of the VA are given specific statutory authority to award a contract to a small business concern owned and controlled by veterans using procedures other than competitive procedures (i.e. a sole source contract). The contracting officer may do so in accordance with VAAR 819.7007. Interested parties may identify their interest and capability to respond to this requirement. Supporting information must be furnished in sufficient detail to demonstrate the ability to comply with the requirements. No solicitation package is available and telephone requests will not be honored. Information must be sent to the Contracting Officer Wanda Y. Edwards at Wanda.Edwards@va.gov Responses received will be reviewed; however, a determination by the Government not to compete the proposed procurement based upon responses to this notice is solely within the discretion of the Government. Information received will be considered solely for the purpose of determining whether to conduct a competitive procurement. No cost to the government will arise as a result of contractor submissions of responses to this announcement or the government use of such information. Interested parties are responsible for adequately marking proprietary or competitively sensitive information contained in their response. No sub-contracting opportunity is anticipated. Interested parties may e-mail Wanda.Edwards@va.gov no later than Sept. 14, 2024, 11:00 EDT. See attached Performance Work Statement (PWS) PERFORMANCE WORK STATEMENT BACKGROUND The Department of Veterans Affairs (VA), Veterans Health Administration, Office of Mental Health seeks a Simulated Orator to Promote Help-seeking and Recovery, Orient Self-care, and Yield Native Engagement (SOPHROSYNE): A Chatbot/Interface to Support Motivational Interviewing and Care Navigation to Encourage Reduced Substance Use. Rates of substance use disorder and overdose mortality have been increasing rapidly in the United States, both in the general population and Veterans. The National Drug Control Strategy has outlined a cross-agency approach to reducing harms from substance use. Veterans Health Administration (VHA) has been assigned a large role in this strategy and improving substance use disorder identification, prevention and treatment is an agency priority. Towards this end, VHA is working to expand use of existing prevention and treatment programs and implement innovative new approaches to identification and treatment of patients at risk of developing or experiencing harm from substance use behaviors. VHA s efforts to address substance use disorder-related harm overlap with efforts to prevent suicide and overdose. Patients with substance use disorders have the highest rate of suicide amongst diagnosed patient populations in VHA, and rates of suicide are increasing in this subpopulation of Veterans. Substance use disorder is the largest cause of overdose, and rates of overdose due to use of illicit fentanyl have increased dramatically. In the domain of targeted intervention, VHA has successfully utilized predictive analytics-based computerized decision support systems to implement novel targeted prevention interventions to patients at risk of suicide or overdose. Specifically, VHA Office of Mental Health and Suicide Prevention (OMHSP) and the Office of Pain Management, Opioid Safety and Prescription Drug Monitoring Programs (PMOP) have implemented the Recovery Engagement And Coordination for Health Veterans Enhanced Treatment (REACHVET) and Stratification Tool for Opioid Risk Mitigation (STORM) decision support systems with paired mandated clinical programming focused on targeted case review with treatment planning/outreach to address unmet care needs for patients estimated to be at highest risk of suicide or overdose based on predictive models. In addition to these predictive models, VHA OMHSP has developed novel case-finding tools which search VA s electronic medical record data to identify signs and free-text mentions suggestive of substance use. These new case finding tools can identify patients with signs of substance use who either have not been fully assessed and/or diagnosed or who have been diagnosed but are not engaged in treatment. Together, these novel VHA innovations identify a large patient population likely to benefit from behavioral health interventions to reduce substance use or related risky health behaviors. There are significant challenges to getting patients with substance use behaviors to seek treatment and support for behavior change. First, because drug use is often illegal and frequently stigmatized, patients may not be comfortable with or willing to honestly disclose substance use behaviors to their clinicians. For example, patients may fear that clinicians will treat them differently if they know about substance use behaviors, or simply worry about eliciting disapproval or other negative responses from their clinical providers. They may feel unable to reduce substance use and fear attempting to stop because they assume they will fail. Moreover, patient fears are not unfounded. Providers do have variable reactions to admission of substance use behaviors, and some may respond in ways that have been found to increase rather than decrease substance use and/or risk to patients (e.g., confrontational or accusatory language, abrupt discontinuation of controlled substance prescriptions or treatment relationships). Second, providers report insufficient training and lack of competence in assessing and addressing substance use behaviors at high rates, and report that competing priorities in health care visits (e.g., management of chronic conditions such as diabetes or hypertension, for which they have greater self-reported treatment competency) limit attention to substance use assessment and behavior change. Because of these barriers to reporting and effective clinical response, trials of universal drug screening by clinicians have not been found to improve treatment engagement or outcomes for patients. Positively, however, patients have been found to report substance use behaviors more completely and honestly when reporting to an electronic device rather than a human clinician. Additionally, effective communication and therapeutic approaches to motivating patients to reflect on substance use behaviors and consequences, develop interest in behavior change and accept support or treatment have been developed and widely disseminated. With protocols defining fidelity to these approaches (e.g., Motivational Interviewing) and examples of appropriate communication with these methods, it becomes plausible to train a chatbot or develop an algorithm to navigate a patient through reflection on their substance use behavior and its consequences, and options for self-management, community supports, or formal VA treatment. The primary aim of this project is to develop and optimize based on VA provider and patient feedback a chatbot or self-directed patient interface which would employ a Motivational Interviewing style and approach to allow a patient to: Report/reflect on their current substance use patterns. Get accurate and personalized information about harms, consequences, costs, and likelihood of benefits from use of specific substances. Get accurate and personalized information about the potential benefits of reducing use of specific substances. Reflect on ambivalence about substance use behaviors, towards strengthening desire to change. Learn about the symptoms of drug withdrawal and how and when they may be experienced. Consider long-term goals and values, and their alignment with substance use behaviors. Learn about types of support and treatment available for a specific substance use problem. Get information about how to access a specific support or treatment. Reduce isolation and promote self-expression and introspection. Reduce guilt, shame or embarrassment related to substance use behaviors and develop comfort in discussing them honestly. Share information about a substance use problem, personal goals, and treatment interest with their health care team. Learn about ways to increase engagement with natural rewards (e.g., social skills development, savoring, exercise, peer support, problem-solving skills, coping skills, etc.) The tool shall be built on an existing VA approved development platform within VA national data systems utilizing Microsoft Copilot for Azure, allowing for national deployment within VHA once a system is fully tested and found to have benefit for patients. This existing development platform is within VA OIT data systems and meets VHA OIT cybersecurity policies and regulations. Initial development will focus on creating a nationally deployable solution using an algorithmic approach. While MS Copilot Generative Artificial Intelligence capabilities will be available in the development environment, these are not approved for operational deployment in the production environment currently. While VA is interested in exploring Generative Artificial Intelligence capabilities as time permits, the focus of the minimal viable product development will be on creating a useful deployable system that provides guidance to Veterans. The chatbot is intended for use by Veteran patients in a controlled VA healthcare setting (e.g., Primary Care clinic). As such, patients will have access to clinicians and health care system staff for any questions, concerns, or crises that may arise. Veterans will also be encouraged to discuss questions elicited by chatbot interactions with their provider(s) after use of the chatbot, to help align patients and providers on treatment goals and mitigate any risk factors that may be present for the patient on the day of chatbot use. SCOPE OF WORK The Contractor shall develop a prototype of a tool to support brief self-guided interventions for drug use. This effort will cover iterative development and usability testing of a prototype, with the expectation that subsequent to this effort this prototype would be additionally pilot tested for use in a VA primary care setting with patients with medical record signs of drug use to determine clinical value. The Contractor shall provide iterative development and usability/acceptability testing of a prototype interactive interface to support patient education and build motivation and goals for reducing drug use. The application must utilize a Motivational Interviewing-informed approach and VA approved educational content. Use of chatbot functionality is encouraged to increase accessibility and patient engagement. Design should be optimized to maximize patient acceptability and perceived usefulness, while maintaining accuracy of presented content. The prototype must be developed within VA environments that allow for national deployment if the prototype is found to have clinical benefit (e.g., the VA Microsoft Copilot for Azure environment, if chatbot functionality is utilized). PERFORMANCE DETAILS PERFORMANCE PERIOD The PoP shall be 12 months for this effort from contract award, with an option for an additional 12 months. Tasks under this PWS shall be performed at Contractor facilities for development and piloting. Contractor staff can request office workspace at the VA Menlo Park to facilitate collaboration with OMHSP staff, VA clinicians or Veteran volunteers. The Contractor shall identify the Contractor s place of performance in their Task Execution Plan submission. Temporary duty travel (TDY) to a government facility with the effort doesn t change the Place of Performance to the Government Site. TRAVEL The Government does not anticipate travel under this effort to perform the tasks associated with the effort, as meetings and development can be conducted virtually. SPECIFIC TASKS AND DELIVERABLES During performance of this effort, focus on developing a system of value to the patient is the guiding principle. Agile project management is evolutionary (iterative and incremental) which regularly produces high quality results in a cost effective, timely, and highly collaborative manner via a value driven lifecycle. This requires open lines of communication among all participants contributing to a project which may include multiple stakeholders with different perspectives (e.g. providers and patients). All project artifacts developed and delivered shall be VA Office of Information and Technology (OI&T) Process Asset Library compliant. The project will utilize a schedule of incremental deliveries of useable capabilities every three months or less. Backlog grooming and prioritization are continued throughout the product life cycle and shall be managed throughout the period of performance. Based on the scope of work established in the Backlog, development builds shall be three months or less. The Contractor shall develop and deliver a Build Plan, in DevOps, in collaboration with the project team prior to beginning the build. The Build Plan is the scope of work which will be completed in the agreed upon build timeframe. Each build ends with a new prototype delivery. A build will consist of a series of sprints (typically 1-4 weeks duration). The Contractor shall provide a Sprint Plan, prior to the beginning of each Sprint which defines the work to be completed during the Sprint. Once the Sprint Plan is approved by the Contracting Officers Representative (COR) /VA PM, the sprint(s) shall commence, and completion shall be based upon the COR/VA PM acceptance. For delivery of all project artifacts, the Contractor shall utilize DevOps for managing project execution details and for the management and storage of artifacts using the VA OIT VIP and Process Asset Library compliant templates. The Contractor shall perform the following: PROJECT MANAGEMENT CONTRACTOR PROJECT MANAGEMENT PLAN The Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor s approach, timeline, and tools to be used in execution of the contract. The CPMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks, and resource support. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPMP shall be concurred upon and updated in accordance with Section B of the contract. The Contractor shall update and maintain the VA PM approved CPMP throughout the period of performance. Deliverable: Contractor Project Management Plan REPORTING REQUIREMENTS The Contractor shall provide the COR with Monthly Progress Reports in electronic form in Microsoft Word formats. The report shall include detailed instructions/explanations for each required data element, to ensure that data is accurate and consistent. These reports shall reflect data as of the last day of the preceding Month. The Monthly Progress Reports shall cover all work completed during the reporting period and work planned for the subsequent reporting period. The report shall also identify any problems that arose and a description of how the problems were resolved. If problems have not been completely resolved, the Contractor shall provide an explanation including their plan and timeframe for resolving the issue. The report shall also include an itemized list of all Information and Communication Technology (ICT) deliverables and their current Section 508 conformance status. The Contractor shall monitor performance against the CPMP and report any deviations. It is expected that the Contractor will keep in communication with VA accordingly so that issues that arise are transparent to both parties to prevent escalation of outstanding issues. Deliverable: Monthly Progress Report ADDITIONAL TASKS TECHNICAL KICKOFF MEETING The Contractor shall hold a technical kickoff meeting within 10 business days after award. The Contractor shall present, for review and approval by the Government, the details of the intended approach, work plan, and project schedule for each effort. The Contractor shall specify dates and times, Technical Kickoff Meeting Agenda (which shall be provided to all attendees at least five calendar days prior to the meeting), and Technical Kickoff Meeting Minutes (which shall be provided to all attendees within three calendar days after the meeting). The Contractor shall also provide Technical Kickoff Meeting Materials (PowerPoint presentations and any other handouts) at least five calendar days prior to the meeting. The meeting shall take place via teleconference. The Contractor shall invite the Contracting Officer, Contract Specialist (CS), COR, VA Subject Matter Experts (SMEs) and the VA Program Manager. Deliverables: Technical Kickoff Meeting Agenda Technical Kickoff Meeting Minutes Technical Kickoff Meeting Materials 5.2.2 PRIVACY & HIPAA TRAINING The Contractor shall submit Talent Management System (TMS) training certificates of completion for VA Privacy and Information Security Awareness (TMS ID: 10176) and Rules of Behavior and Health Insurance Portability and Accountability Act (HIPAA) (TMS ID: 10203) training and provide signed copies of the Contractor Rules of Behavior in accordance with Section 9, Training, from Appendix C of the VA Handbook 6500.6, Contract Security . The Contractor shall complete all the following VA TMS training courses and provide certificates of completion. Contractors who have completed these VA training courses within the past 12 months and have furnished certificates will not be required to re-take the training courses. The training referenced above is required to be renewed annually. Deliverables: VA Privacy and Information Security Awareness and Rules of Behavior Training Certificate VA HIPAA Certificate of Completion Signed Contractor Rules of Behavior 5.2.3 PLANNING The Contractor shall work with the PM to discern relevant stakeholders needed to accomplish the tasks and prototype testing. 5.2.4 BUILD AND DEVELOPMENT The Contractor shall continuously support the iterative build and development methodology described herein to complete the expected tasks of the work statement. 5.2.5 DEVELOPMENT / IMPLEMENTATION The Contractor shall develop and implement all necessary components of the chatbot/interface to develop a prototype tool to support a Motivational Interviewing approach to discussion and information sharing regarding substance use behaviors. The prototype will be developed in accordance with Project Specific Agile Requirements in Section 4.4 and all sub-paragraphs, and iterative design and development will be guided by feedback from VA clinician and patient volunteers. 5.2.6 PROJECT SPECIFIC REQUIREMENTS The Contractor shall develop a user interface that enables a patient with suspected substance use or interest in learning more about the effects of substance use and treatment options to explore personalized information about substance use costs and consequences, interact with the interface utilizing a Motivational Interview approach, and learn about support and treatment available and how to access it. The user interface shall use VA approved software (see One-VA Technical Reference Model (TRM)), and VA approved clinical content (e.g., patient education materials, links to community resources). Chatbot features must be developed in a VA provisioned development platform on the VA Enterprise Cloud utilizing methods approved for deployment in the associated production environment. The VA provisioned development platform is being actively updated and augmented, and thus available and approved functionality in the VA Chatbot Platfom may increase before and during the contracting period. The currently approved VA Chatbot platform architecture and approach utilizes Microsoft Power Virtual Agents (PVA), which is part of in Microsoft Copilot for AzureStudio. PVA is a low-code conversational language solution that allows for the creation of agents or copilots which help orchestrate user workflows with pre-built or custom plugins. These workflows can be constructed with a low-code tool called Power Automate or through custom applications written in general-purpose programming languages (e.g. NodeJS/JavaScript) using the Bot Framework SDK. PVA enables the creation of trigger phrases that allow its built-in Natural Language Understanding (NLU) to take user input and identify the correct topic to continue the interaction. It also provides a fallback option for when none of the trigger phrases match the user input. For this fallback, the chatbot platform offers Custom Question Answer (CQA), Microsoft s Custom Question Answer product. CQA is a simple product that interprets user input as a question and uses its NLU to determine which answer should be surfaced. The CQA knowledge base can incorporate vetted content (i.e. either contractor generated and VHA approved, or VHA developed), sorted into question and answer pairs. When the VA Chatbot cannot find a relevant match from its topics, it can default to the CQA fallback, interpreting the input as a general-purpose question. This provides a primary unauthenticated way for users to explore the chatbot's capabilities. CQA is limited in its ability to answer every question and requires maintenance of the curated list of question and answer pairs. However, its primary advantage is safety; it only returns specific text from the curated list, minimizing the risk of providing harmful or dangerous information. At worst, it may not answer the question or provide an incorrect answer, but it will not generate potentially unsafe responses. Specifically, the Contractor shall perform the following: Work with the COR/PM to obtain access to VA development environments, including the VA Chatbot platform architecture in the VA Enterprise Cloud.. Collaborate with the COR/PM and VA subject matter experts on data sources (e.g., example Motivational Interviewing consistent language) and included or developed clinical content. Develop prototypes of the SOPHROSYNE tool, test SOPHROSYNE for performance and accuracy, assess usability and acceptability and obtain feedback from the PM, SMEs, and volunteer VA clinician and patient volunteers, and iterate to optimize. Document all methods and code. Develop implementation and maintenance guides to enable VA staff to run and modify the prototype after the end of the contract period. Develop end-user guides and training materials for the final prototype. 5.2.7 SOPHROSYNE features The Contractor will develop a prototype that includes features from the following list, with prioritization and focus based on feedback from the PM, SMEs, and volunteer clinicians and patients. Additional features may be added to or substitute for features on this list if prioritized and approved by the PM and SMEs. Ability to prompt for information about current drug use, using a standard reporting methodology (e.g., days in the past week, quantity/frequency). Provide accurate information about: the risks of drug use, tailored toward patient interests and self-reported drug use; the benefits of reducing drug use, tailored toward patient interests and self-reported drug use; the cost of drug use, assuming stable or escalating use over time; potential for and symptoms of withdrawal subsequent to regular use of a drug of interest; the effects of drug use on the brain and decision-making processes; evidence-based treatments for reducing use of a drug of interest; how evidence-based treatments work for treating addiction; evidence-based harm reduction strategies for reducing harm from use of a drug of interest; mutual help groups, and ways to engage with them; why engagement in natural rewards is important for addiction prevention and recovery; strategies for increasing natural rewards in your life, including resources for social skills development, problem-solving training, coping skills training, mindfulness training, savoring exercises, relaxation skills, exercise. Use Motivational Interviewing strategies to reflect on ambivalence and strengthen desire to change behavior. Support reflection on and specification of values and goals. Utilize active listening approaches to encourage self-expression and introspection and reduce isolation. Ability to summarize and transmit information the patient wishes to share with their clinician. Ability to navigate to topics of interest to the patient. Ability to generate a collection of links, tools, and documents of interest to the patient and send it to the patient s chosen email or phone number. Ability to summarize the information covered in the chatbot session and transmit the summary to the patient s email or phone number. Ability to navigate patients to information on topics of interest. Engage the patient in discussion about drug use in a safe and comfortable manner to build comfort in discussing drug use and treatment. Deliverables: Prototype SOPHROSYNE tool at the end of each build cycle Documented code and methods description for the current prototype at the end of each build cycle 5.2.8 Usability and Acceptability Testing The contractor will meet with the PM, SMEs, and volunteer providers and patients at the start of each build to plan and prioritize features and revisions to be included in the prototype for that build cycle. Before completion of the build cycle, the contractor will demo the prototype for the PM, SMEs, and volunteer providers and patients, ideally by allowing these users to interact with prototype. The Contractor will collect structured feedback from each test user regarding: (1) usability of the prototype, including ease of navigation, intuitiveness of the design, understandability of language, and ability to accurately interpret and respond to the user; (2) performance of the prototype, including response lags and wait times for content delivery; (3) accuracy and clinical appropriateness of the prototype, including both appropriateness of information provided, accuracy of content delivered, and appropriateness of language, tone and phrasing of content delivered; (4) utility and perceived benefit of the prototype to the user, (5) specific errors identified, and (6) suggestions for improvement. The Contractor shall also record end-user walk-throughs where end-users attempt to use the tool to get specific information (e.g., are given a task of learning about evidence-based treatments for opioid use disorder, or understanding how much money one is likely to spend on cannabis use in a year), while noting their thought process as they interact with the system. The contractor will summarize findings from each round of feedback and share with the PM and SMEs at least 2 days before the planning session for the next build to inform prioritization of development tasks in the next build. An initial build for usability and acceptability testing is expected by month 6 with 3 month build and testing cycles thereafter (i.e., Build cycles in months 1-6, 7-9, and 9-12 with formal testing at the end of each cyclen). Deliverable: Report on patient, provider, and SME feedback regarding features at the end of each build cycle. 5.2.9 Demonstration of SOPHROSYNE prototype to encourage substance use behavior change. The Contractor shall hold a Prototype Demonstration Meeting at the end of each Development Build. This will be followed by user testing by the PM, SMEs and volunteer clinicians and patients. For the Prototype Demonstration Meeting the Contractor shall specify dates and times, Prototype Demonstration Meeting Agenda (shall be provided to all attendees at least 2 calendar days prior to the meeting), Prototype Demonstration Meeting Minutes (shall be provided to all attendees within three calendar days after the meeting) and provide any Prototype Demonstration Meeting Materials. The meetings shall take place via teleconference. The Contractor shall invite the CO, CS, COR, VA SMEs, and the VA PM. Deliverables: Prototype Evaluation Meeting Agenda Prototype Evaluation Meeting Minutes Prototype Evaluation Meeting Materials (PowerPoint presentations and any other handouts) 5.2.10 Technical and End-User documentation for SOPHROSYNE prototypes The Contractor shall develop end-user guides and training materials to support use of the prototype by patients and provision of technical support to users by VA maintenance staff. These guides should provide information on how to engage with the prototype to access key functionality of the system. The guides should also support troubleshooting of common problems or misunderstandings encountered with use of the system. The guides should be supported by a Frequently Asked Questions (FAQ) document, which should address concerns brought up during user testing as well as based on developer experience. The Contractor shall also develop a maintenance guide. This guide will include: an organized directory of all static clinical content available via SOPHROSYNE (e.g., patient education materials, links to external websites or tools) to support on-going updating of clinical and educational content within the tool. English language summary of methodology and coding logic (e.g., pseudocode) to support interpretation of code by a moderately experience programmer. Instructions for trouble-shooting anticipatable maintenance issues and necessary updates. The Contractor will provide trainings and a walk-through of code and anticipated maintenance to VA OMHSP programmers before the end of the contract. Deliverables: User guide, training materials and FAQs. Maintenance guide, including description of methodology and logic, and maintenance instructions. GENERAL REQUIREMENTS ENTERPRISE AND IT FRAMEWORK VA TECHNICAL REFERENCE MODEL The Contractor shall support the VA enterprise management framework. In association with the framework, the Contractor shall comply with OIT Technical Reference Model (VA TRM). The VA TRM is one component within the overall Enterprise Architecture (EA) that establishes a common vocabulary and structure for describing the information technology used to develop, operate, and maintain enterprise applications. Moreover, the VA TRM, which includes the Standards Profile and Product List, serves as a technology roadmap and tool for supporting OIT. Architecture & Engineering Services (AES) has overall responsibility for the VA TRM. FEDERAL IDENTITY, CREDENTIAL, AND ACCESS MANAGEMENT (FICAM) The Contractor shall ensure Commercial Off-The-Shelf (COTS) product(s), software configuration and customization, and/or new software are Personal Identity Verification (PIV) card-enabled by accepting HSPD-12 PIV credentials using VA Enterprise Technical Architecture (ETA), https://www.ea.oit.va.gov/EAOIT/VA_EA/Enterprise_Technical_Architecture.asp, and VA Identity and Access Management (IAM) approved enterprise design and integration patterns, https://www.oit.va.gov/library/recurring/edp/index.cfm. The Contractor shall ensure all Contractor delivered applications and systems comply with the VA Identity, Credential, and Access Management policies and guidelines set forth in VA Handbook 6510 VA Identity and Access Management, VA Handbook 0735 Homeland Security Presidential Directive 12 (HSPD-12) Program, and align with the Federal Identity, Credential, and Access Management Roadmap and Implementation Guidance v2.0. The Contractor shall ensure all Contractor delivered applications and systems provide user authentication services compliant with the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-63-3, VA Handbook 6500 Appendix F, VA System Security Controls , and VA IAM enterprise requirements for direct, assertion-based authentication, and/or trust based authentication, as determined by the design and integration patterns. Direct authentication at a minimum must include Public Key Infrastructure (PKI) based authentication supportive of PIV card and/or Common Access Card (CAC), as determined by the business need. The Contractor shall ensure all Contractor delivered applications and systems conform to the specific Identity and Access Management PIV requirements set forth in the Office of Management and Budget (OMB) Memoranda M-05-24, M-19-17, and NIST Federal Information Processing Standard (FIPS) 201-2. OMB Memoranda M-05-24 and M-19-17 can be found at: https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2005/m05-24.pdf, and https://www.whitehouse.gov/wp-content/uploads/2019/05/M-19-17.pdf respectively. Contractor delivered applications and systems shall be on the FIPS 201-2 Approved Product List (APL). If the Contractor delivered application and system is not on the APL, the Contractor shall be responsible for taking the application and system through the FIPS 201 Evaluation Program. The Contractor shall ensure all Contractor delivered applications and systems support: Automated provisioning and are able to use enterprise provisioning service. Interfacing with VA s Master Person Index (MPI) to provision identity attributes, if the solution relies on VA user identities. MPI is the authoritative source for VA user identity data. The VA defined unique identity (Secure Identifier [SEC ID] / Integrated Control Number [ICN]). Multiple authenticators for a given identity and authenticators at every Authenticator Assurance Level (AAL) appropriate for the solution. Identity proofing for each Identity Assurance Level (IAL) appropriate for the solution. Federation for each Federation Assurance Level (FAL) appropriate for the solution, if applicable. Two-factor authentication (2FA) through an applicable design pattern as outlined in VA Enterprise Design Patterns. A Security Assertion Markup Language (SAML) implementation if the solution relies on assertion-based authentication. Additional assertion implementations, besides the required SAML assertion, may be provided as long as they are compliant with NIST SP 800-63-3 guidelines. Authentication/account binding based on trusted Hypertext Transfer Protocol (HTTP) headers if the solution relies on Trust based authentication. Role Based Access Control. Auditing and reporting capabilities. Compliance with VIEWS 00155984, PIV Logical Access Policy Clarification https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896. The required Assurance Levels for this specific effort are Identity Assurance Level 3, Authenticator Assurance Level 3, and Federation Assurance Level 3. INTERNET PROTOCOL VERSION 6 (IPV6) The Contractor solution shall support Internet Protocol Version 6 (IPv6) based upon the memo issued by the Office of Management and Budget (OMB) on November 19, 2020 (https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-07.pdf). IPv6 technology, in accordance with the USGv6 Program (https://www.nist.gov/programs-projects/usgv6-program/usgv6-revision-1), NIST Special Publication (SP) 500-267B Revision 1 USGv6 Profile (https://doi.org/10.6028/NIST.SP.500-267Br1), and NIST SP 800-119 Guidelines for the Secure Deployment of IPv6 (https://doi.org/10.6028/NIST.SP.800-119), compliance shall be included in all IT infrastructures, application designs, application development, operational systems and sub-systems, and their integration. In addition to the above requirements, all devices shall support native IPv6 and dual stack (IPv6 / IPv4) connectivity without additional memory or other resources being provided by the Government, so that they can function in a mixed environment. All public/external facing servers and services (e.g. web, email, DNS, ISP services, etc.) shall support native IPv6 and dual stack (IPv6 / IPv4) users and all internal infrastructure and applications shall communicate using native IPv6 and dual stack (IPv6 / IPv4) operations. TRUSTED INTERNET CONNECTION (TIC) The Contractor solution shall meet the requirements outlined in Office of Management and Budget Memorandum M-19-26, Update to the Trusted Internet Connections (TIC) Initiative (https://www.whitehouse.gov/wp-content/uploads/2019/09/M-19-26.pdf), VA Directive 6513 Secure External Connections , and shall comply with the TIC 3.0 Core Guidance Documents, including all Volumes and TIC Use Cases, found at the Cybersecurity & Infrastructure Security Agency (CISA) (https://www.cisa.gov/publication/tic-30-core-guidance-documents). Any deviations must be approved by the VA TIC 3.0 Working Group at vaoisesatic30team@va.gov. STANDARD COMPUTER CONFIGURATION The Contractor IT end user solution that is developed for use on standard VA computers shall be compatible with and be supported on the standard VA operating system, currently Windows 10 (64bit), Edge (Chromium based), and 365 Apps for enterprise. Applications delivered to VA and intended to be deployed to Windows 10 workstations shall be delivered as a signed .msi package with switches for silent and unattended installation and updates shall be delivered in signed .msp file formats for easy deployment using Microsoft Endpoint Configuration Manager (CM) VA s current desktop application deployment tool. Signing of the software code shall be through a vendor provided certificate that is trusted by VA using a code signing authority such as Verizon/Cybertrust or Symantec/VeriSign. The Contractor shall also ensure and certify that their solution functions as expected when used from a standard VA computer, with non-admin, standard user rights that have been configured using the United States Government Configuration Baseline (USGCB) and Defense Information Systems Agency (DISA) Secure Technical Implementation Guide (STIG) specific to the particular client operating system being used. VETERAN FOCUSED INTEGRATION PROCESS (VIP) AND PRODUCT LINE MANAGEMENT (PLM) The Contractor shall support VA efforts IAW the updated Veteran Focused Integration Process (VIP) and Product Line Management (PLM). The major focus of the new VIP is on Governance and Reporting and is less prescriptive, with a focus on outcomes and continuous delivery of value. Product Line Management (PLM) is a framework that focuses on delivering functional products that provide the highest priority work to customers while delivering simplified, reliable, and practical solutions to the business, medical staff, and our Veterans. The VIP Guide is a companion guide to the PLM Playbook and can be found at: https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371 and the PLM Playbook can be found at https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946. The PLM Playbook pivots from project-centric to product-centric delivery and contains descriptive practices that focuses on outcomes. The PLM Playbook contains a set of plays that implement Development, Security, and Operations (DevSecOps) principles and processes such as automated development, continuous integration/continuous delivery, and release on demand. The PLM Playbook details how product lines implement Lean-Agile principles, methods, practices, and techniques through levels of maturity. VIP and PLM are the authoritative processes that IT projects must follow to ensure development and delivery of IT products. PROCESS ASSET LIBRARY (PAL) The Contractor shall perform their duties consistent with the processes defined in the OIT Process Asset Library (PAL). The PAL scope includes the full spectrum of OIT functions and activities, such as VIP project management, operations, service delivery, communications, acquisition, and resource management. PAL serves as an authoritative and informative repository of searchable processes, activities or tasks, roles, artifacts, tools and applicable standards and guides to assist the OIT workforce, Government and Contractor personnel. The Contractor shall follow the PAL processes to ensure compliance with policies and regulations and to meet VA quality standards. The PAL includes the contractor onboarding process consistent with Section 6.2.2 and can be found at https://www.va.gov/PROCESS/artifacts/maps/process_CONB_ext.pdf. The main PAL can be accessed at www.va.gov/process. AUTHORITATIVE DATA SOURCES The VA Enterprise Architecture Repository (VEAR) is one component within the overall EA that establishes the common framework for data taxonomy for describing the data architecture used to develop, operate, and maintain enterprise applications. The Contractor shall comply with the department s Authoritative Data Source (ADS) requirement that VA systems, services, and processes throughout the enterprise shall access VA data solely through official VA ADSs where applicable, see below. The Information Classes which compose each ADS are located in the VEAR, in the Data & Information domain. The Contractor shall ensure that all delivered applications and system solutions support: Interfacing with VA s Master Person Index (MPI) (formerly the Master Veteran Index (MVI)) to provision identity attributes, if the solution relies on VA user identities. MPI is the authoritative source for VA user identity data. Interfacing with Capital Asset Inventory (CAI) to conduct real property record management actions, if the solution relies on real property records data. CAI is the authoritative source for VA real property record management data. Interfacing with electronic Contract Management System (eCMS) for access to contract, contract line item, purchase requisition, offering vendor and vendor, and solicitation information above the micro-purchase threshold, if the solution relies on procurement data. ECMS is the authoritative source for VA procurement actions data. Interfacing with HRSmart Human Resources Information System to conduct personnel action processing, on-boarding, benefits management, and compensation management, if the solution relies on personnel data. HRSmart is the authoritative source for VA personnel information data. Interfacing with Vet360 to access personal contact information, if the solution relies on VA Veteran personal contact information data. Vet360 is the authoritative source for VA Veteran Personal Contact Data. Interfacing with VA/Department of Defense (DoD) Identity Repository (VADIR) for determining eligibility for VA benefits under Title 38, if the solution relies on qualifying active-duty military service data. VADIR is the authoritative source for Qualifying active-duty military service in VA. SOCIAL SECURITY NUMBER (SSN) REDUCTION The Contractor solution shall support the Social Security Number (SSN) Fraud Prevention Act (FPA) of 2017 which prohibits the inclusion of SSNs on any document sent by mail. The Contractor support shall also be performed in accordance with Section 240 of the Consolidated Appropriations Act (CAA) 2018, enacted March 23, 2018, which mandates VA to discontinue using SSNs to identify individuals in all VA information systems as the Primary Identifier. The Contractor shall ensure that any new IT solution discontinues the use of SSN as the Primary Identifier to replace the SSN with the ICN in all VA information systems for all individuals. The Contractor shall ensure that all Contractor delivered applications and systems integrate with the VA Master Person Index (MPI) for identity traits to include the use of the ICN as the Primary Identifier. The Contractor solution may only use a Social Security Number to identify an individual in an information system if and only if the use of such number is required to obtain information VA requires from an information system that is not under the jurisdiction of VA.