Q--NETWORK ASSESSMENT

The Dorn VA Medical Center, 6439 Garners Ferry Road, Columbia, SC 29209 intends to purchase Unify/Atos OpenScape brand name proprietary network assessment that is required before the Atos/Unify OpenScape Branch Telephone System can be installed and replace the existing Unify 3000 PBX, a private telephone network used within an enterprise, currently installed at the Dorn VAMC and associated CBOC s located in Florence, SC, Sumter, SC and Anderson SC. The requirement is for the network to be evaluated for jitter and overall QOS. The total estimated price of this proposed action is $12,059.62, with no options. Interested persons may identify their interest and capability to respond to the requirement or submit proposals. This notice of intent is not a request for competitive proposals or a solicitation for offers. However, parties interested in responding to this notice shall submit technical data, including cost, sufficient to determine capability in providing the same product to Joseph M. Locke, Contract Specialist at contact@example.gov. Phone number: +1 (555) 000-0000, Ext: 7814 by August 11, 2017 no later than 2pm EST. All capability statements received by the closing date of this notification of this synopsis will be considered by the Government. Information received will normally be considered solely for determining whether to conduct a competitive procurement. This acquisition is being conducted under FAR Part 12 commercial procedures. There are no set-aside restrictions for this requirement. The intended procurement will be classified under North American Industry Classification System (NAICS) 541511- Custom Computer Programming. This is for informational purposes only and not to be considered as a commitment by the Government. Any information submitted to this notice of intent is voluntary. STATEMENT OF WORK Network Assessment GENERAL: The WJB Dorn VA Medical Center requires a top down assessment of our network to determine if its performance characteristics are suitable to support planned Voice over IP (VoIP) project(s). DESCRIPTION OF WORK: 2.1 Contractor shall conduct a current-state ( as-is ) on-site analysis that will identify potential problem areas and will include specific action steps necessary to mitigate or eliminate those problems. 2.2 Contractor shall utilizes state of the art technologies to simulate voice traffic and perform comprehensive measurements that indicate the effect of the coexistence of that voice traffic with the traffic regularly traversing that network. 2.3 The analysis shall begin with an in-depth review of the network to be evaluated. One or more Consultants shall travel to each site and study the network and perform the analysis described above. The analysis shall conclude with a detailed written report of the findings, a conference call to review the findings, and a report detailing specific action steps required to remedy the problem areas identified in the assessment. 2.4 Primary data collection and analysis will be performed at the following site: Remote assessments to include Anderson CBOC, Sumter CBOC and Florence CBOC. 2.5 The C&A requirements do not apply, and that a Security Accreditation Package is not required. PLACE OF PERFORMANCE: VA - Columbia will require the following sites be re-assessed: Community Based Outpatient Center 3030 North Highway 81 Anderson, SC 29621 Community Based Outpatient Center 407 North Salem Avenue Sumter, SC 29150 Community Based Outpatient Center 1822 Sally Hill Farms Road Florence, SC 29501 PERIOD OF PERFORMANCE: 30 DAYS AFTER DATE OF AWARD HOURS OF PERFORMANCE: Monday through Friday, 8:00 a.m. 4:00 p.m., excluding holidays. 5.2 GOVERNMENT HOLIDAYS: The ten holidays observed by the Federal Government are: New Year s Day, Martin Luther King s Birthday, President Day, Memorial Day, Independence Day, Labor Day, Columbus Day, Veterans Day, Thanksgiving, Christmas and any other day specifically declared by the President of the United States to be a national holiday. SPECIFIC TASKS: 6.1 Remote Assessment: 6.1.1 In some circumstances, the VAMC/CBOC s may be eligible for a remote assessment. The primary advantages for doing so include reduced costs (saving travel expenses) and increased flexibility. Remote assessments require that VAMC/CBOC s grant the contractor remote access to its network. X YES VA - Columbia will like to discuss the option of a remote assessment. Note that remote assessment eligibility requires approval of the Network Integration Services Practice Manager. NO an on-site assessment is a better option in this environment 6.2 Process: 6.3 Scope of Services Gather existing data network documentation and review with the VA - Columbia technical contact for accuracy and completeness. Review key network device configurations as well as the Wide Area Network (WAN), where applicable. Gather existing voice network documentation and review with the VA - Columbia technical contact for accuracy and completeness. The voice network review will be limited to information required for the planned converged network. Review the network router and/or switch configurations and associated network connectivity for each device that is in the voice critical path. Identify and document single points of failure in voice critical path in the LAN and/or WAN in the links connecting the sites identified in the site table above. Perform a traffic utilization analysis on the VoIP voice path segments using state-of-the art diagnostic tools. Perform further evaluation of any potential network bottlenecks and traffic patterns. Perform RTP traffic load testing across the network utilizing provided customer call patterns. Develop and document recommended configuration changes to be implemented as a result of the findings of this Readiness Assessment. 6.4 Services Not In Scope Additional Fees May Apply: Modifications to network infrastructure electronics, including switches and routers. Design and/or implementation of Quality of Service (QoS) or other traffic prioritization strategies. 6.5 Deliverables: 6.5.1 The contractor shall conduct a follow up conference call in which they will detail the results of the analysis. Written documentation, in electronic format, will be provided prior to that meeting. This documentation is considered work-for-hire and becomes the property of VA - Columbia effective upon receipt of payment for these services. 6.5.2 Deliverables include: Updated network topology map of the key LAN and/or WAN network components that are along the voice path. Connections to remote sites are shown on the drawings, but details at the core sites are limited to the information collected or provided during the on-site assessment. This assessment report will be provided in a PDF format and will be delivered electronically before the debrief session. Identification of any single points of failure along the voice path of the existing network. Network Traffic Analysis reports for all analyzed LAN and/or WAN segments. Recommended network design enhancements that may include one or more of the following: Network equipment upgrade recommendations Network software and configuration recommendations Network bandwidth expansion recommendations 6.6 Network Performance Requirements This section is to be used as a general guideline only, to provide information as to the minimum performance characteristics the network must demonstrate in order to support basic VoIP traffic. More information can be found in VoIP Customer Requirements Guide. Broadcast Traffic Minimize broadcast domains (suggested 100 devices if possible) Broadcast/Multicast traffic < 10% Latency End-to-end LAN/MAN < 10 ms End-to-end WAN latency less than 100 ms Total end to end latency < 250 ms Jitter End-to-end WAN jitter less than 30 ms peak End-to-end LAN jitter less than 10 ms peak Loss Packet loss less than 1% peak over 5 minute period Bandwidth Frame Relay, minimum 256KB CIR Peak link usage on the LAN trunks less than 75% Peak link usage on the WAN less than 75% All Switches should be manageable GOVERNMENT RESPONSIBILITIES: 7.1 Contract Administration/Performance Monitoring: After award of contract, all inquiries and correspondence relative to the administration of the contract shall be addressed to: 7.2. CO/CS RESPONSIBILITIES: The Contracting Officer is the only person authorized to approve changes or modify any of the requirements of this contract. The Contractor shall communicate with the Contracting Officer on all matters pertaining to contract administration. Only the Contracting Officer is authorized to make commitments or issue any modification to include (but not limited to) terms affecting price, quantity or quality of performance of this contract. 7.2.1. The Contracting Officer shall resolve complaints concerning Contractor relations with the Government employees or patients. The Contracting Officer is final authority on validating complaints. In the event the Contractor effects any such change at the direction of any person other than the Contracting Officer without authority, no adjustment shall be made in the contract price to cover an increase in costs incurred as a result thereof. 7.2.2. In the event that contracted services do not meet quality and/or safety expectations, the best remedy will be implemented, to include but not limited to a targeted and time limited performance improvement plan; increased monitoring of the contracted services; consultation or training for Contractor personnel to be provided by the VA; replacement of the contract personnel and/or renegotiation of the contract terms or termination of the contract. 7.3 VA - Columbia shall prepare the site and provide the contractor with information described below. Network diagrams and configuration information shall be provided at least 10 days prior to the scheduled engagement to allow the contractor enough time to study the network and prepare for the assessment. 7.4 VA - Columbia agrees to: 7.4.1 Provide the contractor with a full network diagram of all switches and routers than will transport VoIP traffic. This information must be provided at least one week prior to the scheduled on-site activities. Routers and switches included in the voice path, including all port IDs Data circuits, indicating type and speed (with CIR if applicable) LAN wiring information media type and cable grade 7.4.2 Provide the contractor with SNMP read-only access for all voice path networking equipment at all locations within the scope of this assessment. 7.4.3 Provide the contractor with complete router and switch configuration, including: Router and switch configuration information SNMP read community strings for the voice path networking equipment. IP Addresses for each routers and switches (loopback interface when available) Software (IOS) versions 7.4.4 Provide on-site technical resources that are knowledgeable with the network, has full access to all locations where on-line network electronics are stored, and other miscellaneous support activities. 7.4.5 Complete the VoIP Customer Requirements ver 2.0 (or later) at least one week prior to the on-site visit. 7.4.6 Install endpoints for testing RTP traffic flows. Endpoints must be installed at each remote location or on each LAN segment and remain running throughout the duration of the analysis. Complete instructions for endpoint installation and configuration will be provided in a separate document. Minimum configuration for the endpoint PCs: VA is responsible for providing appropriate laptop/PC with software that meets vendor s specification for assessment. 7.4.7 Provide the contractor with endpoint IP addresses. 7.4.8 Place endpoints on the appropriate VLAN if you intend to run voice traffic on a separate VLAN. (recommended) 7.4.9 Enable RTP header compression, if applicable. 7.4.10 Implement QoS/Diffserv or other traffic prioritization technologies prior to the assessment, if applicable. 7.4.11 Provide the contractor with three (3) IP address for each site that Consultant(s) will visit in-person. 7.4.12 Provide the contractor with three (3) switch ports in a secure area to install network monitoring devices at each site that Consultant(s) will visit in-person. 7.4.13 Provide real or estimated call traffic requirements between each site from each direction. Number of site-to-site calls at each peak hour. Average duration of site-to-site calls DESTRUCTION OF GOVERNMENT PROPERTY: Subject to the terms of the contract and the circumstances surrounding the particular case, the contractor may be liable for shortages, loss, damages, or destruction of Government property. The contractor may also be liable when the use or consumption of Government property unreasonably exceeds the allowances provided for by the task order, the bill of material or other appropriate criteria. The contractor shall investigate and report to management at the VA Medical Center all cases of loss, damage or destruction of Government property in its possession or control as soon as the facts become known or when requested by the property administrator at the VA Medical Center. A report shall also be furnished when completed and accepted products or end items are lost, damaged, or destroyed while in the contractor s possession or control. The contractor shall require any of its subcontractors possessing or controlling Government property accountable under the contract to investigate and report all instances of loss, damage, or destruction of such property. INVOICES: 9.1 Payment will be made upon receipt of a properly prepared detailed invoice, prepared by the Contractor and submitted through Tungsten Network (formerly known as OB10) http://www.tungsten-network.com/us/en/. A properly prepared invoice shall contain: Invoice Number and Date Contractor s Name and Address Accurate Purchase Order Number Supply or Service provided Period Supply or Service Provided Total Amount Due 9.1.2 Please begin submitting your electronic invoices through the Tungsten Network for payment processing, free of charge. 9.1.3 If you have questions about the e-invoicing program or Tungsten Network, contact information is as follows: Tungsten e-Invoice Setup Information: +1 (555) 000-0000 Tungsten e-Invoice email: contact@example.gov FSC e-Invoice Contact Information: +1 (555) 000-0000 FSC e-invoice email: contact@example.gov 9.1.4 Web Address: HTTP://WWW.FSC.VA.GOV/EINVOICE.ASP 9.2 Performance Deductions: If the contractor fails to meet the Acceptable Quality Level on any performance measure that references a deduction as a disincentive, the following method for calculating and applying the deduction shall be employed: 9.3 Method of calculation: The COR will prepare a contract discrepancy report and will notify the CO in the event the contractor failed to report to work. The CO will provide the contractor with the CDR and documentation (as appropriate) supporting the government s intent to apply the deduction in the following manner: Hourly rate of VA provider who covered the shift times the number of hours in the shift. The contractor has thirty (30) days to respond if the contractor wishes to provide evidence that the government s action or inaction prevented the Contractor from providing services. The Contracting Officer shall make the final determination regarding the deduction after reviewing the contractor s response. MONITORING: Documentation of services performed shall be reviewed prior to certifying payment. The COR will perform periodic spot checks and document with the using service to ensure reports monitoring. VAMC will pay only for services actually performed and in strict accordance with the schedule of price/costs. Contract monitoring and record keeping procedures shall be sufficient to ensure proper payment and allow audit verification that services were provided. 11. QUALITY ASSURANCE SURVELIENCE PLAN (QASP): PERFORMANCE OBJECTIVE PERFORMANCE STANDARD REF PWS METHOD OF ASSESSMENT INCENTIVE/DISINCENTIVES FOR MEETING OR NOT MEETING THE PERFORMANCE STANDARDS Coordinate with site to ensure the laptop is in place Successful VPN Dial-in Par 2 Remote Dial-in 5% of the total invoice amount shall be deducted when performance standard is missed. Dial into laptops installed at the remote locations Successful diagnostic and data capture Par 3 Coordination with the Cisco NW technician at VAMC Columbia 5% of the total invoice amount shall be deducted when performance standard is missed. Perform the diagnostics for the designed place once laptops have been installed Written notification received within 5 days of completed network scan. Provide statistics for each aspect of the network, i.e. phone, data Par 3 Notification received on time 5% of the total invoice amount shall be deducted when performance standard is missed. TERMINATION FOR CONVENIENCE: Subject to a 14 day advance notice, the Government reserves the right to terminate this contract for convenience if the need for this service changes or is no longer required. VA INFORMATION AND INFORMATION SYSTEM SECURITY/PRIVACY LANGUAGE: Contractor Security Requirements (Handbook 6500.6) All Contractors and Contractor personnel shall be subject to the same Federal laws, regulations, standards and VA policies as VA, and VA personnel, regarding information and information system security. Contractor must follow policies and procedures outlined in VA Directive 6500, Information Security Program and its handbooks to ensure appropriate security controls are in place. http://www.iprm.oit.va.gov/docs/VA_Handbook_6500_6_Contract_Security_030210_Final.pdf ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS: 14.1. A contractor/subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order. 14.2. All contractors, subcontractors, and third-party servicers and associates working with VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures. 14.3. Contract personnel who require access to national security programs must have a valid security clearance. National Industrial Security Program (NISP) was established by Executive Order 12829 to ensure that cleared U.S. defense industry contract personnel safeguard the classified information in their possession while performing work on contracts, programs, bids, or research and development efforts. The Department of Veterans Affairs does not have a Memorandum of Agreement with Defense Security Service (DSS). Verification of a Security Clearance must be processed through the Special Security Officer located in the Planning and National Security Service within the Office of Operations, Security, and Preparedness. 14.4. Custom software development and outsourced operations must be located in the U.S. to the maximum extent practical. If such services are proposed to be performed abroad and are not disallowed by other VA policy or mandates, the contractor/subcontractor must state where all non-U.S. services are provided and detail a security plan, deemed to be acceptable by VA, specifically to address mitigation of the resulting problems of communication, control, data protection, and so forth. Location within the U.S. may be an evaluation factor. 14.5. The contractor or subcontractor must notify the Contracting Officer immediately when an employee working on a VA system or with access to VA information is reassigned or leaves the contractor or subcontractor s employ. The Contracting Officer must also be notified immediately by the contractor or subcontractor prior to an unfriendly termination. VA INFORMATION CUSTODIAL LANGUAGE: 15.1. Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. 15.2. VA information should not be co-mingled, if possible, with any other data on the contractors/subcontractor s information systems or media storage systems in order to ensure VA requirements related to data protection and media sanitization can be met. If co-mingling must be allowed to meet the requirements of the business need, the contractor must ensure that VA s information is returned to the VA or destroyed in accordance with VA s sanitization requirements. VA reserves the right to conduct onsite inspections of contractor and subcontractor IT resources to ensure data security controls, separation of data and job duties, and destruction/media sanitization procedures are in compliance with VA directive requirements. 15.3. Prior to termination or completion of this contract, contractor/subcontractor must not destroy information received from VA, or gathered/created by the contractor in the course of performing this contract without prior written approval by the VA. Any data destruction done on behalf of VA by a contractor/subcontractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self-certification by the contractor that the data destruction requirements above have been met must be sent to the VA Contracting Officer within 30 days of termination of the contract. 15.4. The contractor/subcontractor must receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with the terms of the contract and applicable Federal and VA information confidentiality and security laws, regulations and policies. If Federal or VA information confidentiality and security laws, regulations and policies become applicable to the VA information or information systems after execution of the contract, or if NIST issues or updates applicable FIPS or Special Publications (SP) after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations and policies in this contract. 15.5. The contractor/subcontractor shall not make copies of VA patients sensitive information except as authorized and necessary to perform the terms of the agreement or to preserve electronic information stored on contractor/subcontractor electronic storage media for restoration in case any electronic equipment or data used by the contractor/subcontractor needs to be restored to an operating state. If copies are made for restoration purposes, after the restoration is complete, the copies must be appropriately destroyed. 15.6. If VA determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12. 15.7. If a VHA contract is terminated for cause, the associated BAA must also be terminated and appropriate actions taken in accordance with VHA Handbook 1600.01, Business Associate Agreements. Absent an agreement to use or disclose protected health information, there is no business associate relationship. 15.8. The contractor/subcontractor must store, transport, or transmit VA sensitive information in an encrypted form, using VA-approved encryption tools that are, at a minimum, FIPS 140-2 validated. 15.9. The contractor/subcontractor s firewall and Web services security controls, if applicable, shall meet or exceed VA s minimum requirements. VA Configuration Guidelines are available upon request. 15.10. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor/subcontractor may use and disclose VA information only in two other situations: (i) in response to a qualifying order of a court of competent jurisdiction, or (ii) with VA s prior written approval. The contractor/subcontractor must refer all requests for, demands for production of, or inquiries about, VA information and information systems to the VA contracting officer for response. 15.11. Notwithstanding the provision above, the contractor/subcontractor shall not release VA records protected by Title 38 U.S.C. 5705, confidentiality of medical quality assurance records and/or Title 38 U.S.C. 7332, confidentiality of certain health records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse, or infection with human immunodeficiency virus. If the contractor/subcontractor is in receipt of a court order or other requests for the above mentioned information, that contractor/subcontractor shall immediately refer such court orders or other requests to the VA contracting officer for response. 15.12. For service that involves the storage, generating, transmitting, or exchanging of VA Sensitive information but does not require C&A or an MOU-ISA for system interconnection, the contractor/subcontractor must complete a Contractor Security Control Assessment (CSCA) on a yearly basis and provide it to the COR. 16. LIQUIDATED DAMAGES FOR DATA BREACH: 16.1. Consistent with the requirements of 38 U.S.C. §5725, a contract may require access to sensitive personal information. If so, the contractor is liable to VA for liquidated damages in the event of a data breach or privacy incident involving any SPI the contractor/subcontractor processes or maintains under this contract 16.2. The contractor/subcontractor shall provide notice to VA of a security incident as set forth in the Security Incident Investigation section above. Upon such notification, VA must secure from a non-Department entity or the VA Office of Inspector General an independent risk analysis of the data breach to determine the level of risk associated with the data breach for the potential misuse of any sensitive personal information involved in the data breach. The term 'data breach' means the loss, theft, or other unauthorized access, or any access other than that incidental to the scope of employment, to data containing sensitive personal information, in electronic or printed form, that results in the potential compromise of the confidentiality or integrity of the data. Contractor shall fully cooperate with the entity performing the risk analysis. Failure to cooperate may be deemed a material breach and grounds for contract termination. 16.3. Each risk analysis shall address all relevant information concerning the data breach, including the following: Nature of the event (loss, theft, unauthorized access) Description of the event, including: date of occurrence; data elements involved, including any PII, such as full name, social security #; date of birth, home address, account number, disability code; Number of individuals affected or potentially affected; Names of individuals or groups affected or potentially affected; Ease of logical data access to the lost, stolen or improperly accessed data in light of the degree of protection for the data, e.g., unencrypted, plain text; Amount of time the data has been out of VA control; The likelihood that the sensitive personal information will or has been compromised (made accessible to and usable by unauthorized persons); Known misuses of data containing sensitive personal information, if any; Assessment of the potential harm to the affected individuals; Data breach analysis as outlined in 6500.2 Handbook, Management of Security and Privacy Incidents, as appropriate; and Whether credit protection services may assist record subjects in avoiding or Mitigating the results of identity theft based on the sensitive personal information that may have been compromised. 16.4. Based on the determinations of the independent risk analysis, the contractor shall be responsible for paying to the VA liquidated damages in the amount of $37.50 per affected individual to cover the cost of providing credit protection services to affected individuals consisting of the following: 16.4.1 Notification; One year of credit monitoring services consisting of automatic daily monitoring of at least 3 relevant credit bureau reports; Data breach analysis; Fraud resolution services, including writing dispute letters, initiating fraud alerts and credit freezes, to assist affected individuals to bring matters to resolution; One year of identity theft insurance with $20,000.00 coverage at $0 deductible; and 16.4.2 Necessary legal expenses the subjects of an SPI data breach may incur to repair falsified or damaged credit are not included in the liquidated damages amount and will be handled as actual damages, which the contractor should anticipate as among the costs of doing business, and should consider in developing its cost estimates. 17. SECURITY CONTROLS COMPLIANCE TESTING: On a periodic basis, VA, including the Office of Inspector General, reserves the right to evaluate any or all of the security controls and privacy practices implemented by the contractor under the clauses contained within the contract. With 10 working-days notice, at the request of the government, the contractor must fully cooperate and assist in a government-sponsored security controls assessment at each location wherein VA information is processed or stored, or information systems are developed, operated, maintained, or used on behalf of VA, including those initiated by the Office of Inspector General. The government may conduct a security control assessment on shorter notice (to include unannounced assessments) as determined by VA in the event of a security incident or at any other time. 18. SECURE FAX: This fax is intended only for the use of the person or office to which it is addressed and may contain information that is privileged, confidential, or protected by law. All others are hereby notified that the receipt of this fax does not waive any applicable privilege or exemption for disclosure and that any dissemination, distribution, or copying of this communication is prohibited. If you have received this fax in error, please notify this office immediately at the telephone number listed on the front page of the facsimile cover page. 19. BADGES: Contractor is required to wear I.D. badge during the entire time he/she is on VAMC grounds. I.D. badges MUST have an identification picture and shall be issued by VAMC. 20. NO SMOKING POLICY: Except in designated are smoking is strictly prohibited. 21. DATA SECURITY-INFORMATION GATHERED OR CREATED IN PERFORMANCE OF SERVICES: 21.1. Information, including, but not limited to, veteran individually-identifiable information (iii) and personal healthcare information (PHI), gathered or created by the Contractor in the performance of this contract is the exclusive property of VA and must be received, gathered, stored, backed up, maintained, used, disclosed and disposed of in accordance with the terms of this contract and applicable federal and VA information confidentiality and security laws, regulations and policies, including VA Directive and Handbook number 6500. 21.2. The Contractor shall provide access to VA information only to employees, subcontractors, and affiliates only: (1) to the extent necessary to perform the services specified in this contract, (2) t...