Description
This Sources Sought Notice is for informational and planning purposes only and shall not be construed as a solicitation or as an obligation or commitment by the Government. This notice is intended strictly for Market Research. This is a Request for Information only. This is NOT a solicitation for proposals, proposal abstracts, or quotations. The Department of Veterans Affairs Audie L. Murphy VA Hospital Pharmacy Service in San Antonio, Texas intends to award a brand name or equal contract award for the purchase of NEW ConsortieEx. The Government is conducting a market survey to help determine the availability and technical capability of qualified service-disabled veteran-owned small businesses, veteran-owned small businesses, small businesses, HUBZone small businesses and/or other large businesses capable of serving the needs identified below. This notice of intent is for open market as well as Federal Supply Schedule items. The purpose of this notice is to gain knowledge of potential qualified sources and their size classification/socioeconomic status (service-disabled veteran owned small business, veteran owned small business, women owned small business, HUB Zone, 8(a), small business or large business, relative to NAICS 541519 with a size standard of 30Million. Responses to this notice will be used by the Government to make appropriate acquisition decisions. A solicitation is not currently available. If a solicitation is issued, it will be announced on Federal Business opportunities website http://www.fbo.gov or GSA E-Buy at a later date, and all interested parties must respond to that solicitation announcement separately from the responses to this announcement. Your responses to the information requested will assist the Government in determining the appropriate acquisition method, including whether a set-aside is possible. ITEM NUMBER DESCRIPTION OF SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT 0001 1.00 YR Annual subscription for DSCSA Compliance Software. 0002 1.00 EA One time implementation Fee 1001 1.00 YR Annual subscription for DSCSA Compliance Software. 2001 1.00 YR Annual subscription for DSCSA Compliance Software. 3001 1.00 YR Annual subscription for DSCSA Compliance Software. 4001 1.00 YR Annual subscription for DSCSA Compliance Software. Statement of Work for SaaS/CaaS (Software as a Service/Compliance as a Service) This product will meet the following VA strategic goals: - Meet the DSCSA regulatory compliance law. This law was passed in 2013 and has hospital milestones that must be met. - Help STXVA reduce the number of FTEs necessary to be DSCSA compliant. - Improve efficiency and reduce FTE burden of receiving drugs into the pharmacy department by utilizing a barcode scanner and software solution that automatically reconciles DSCSA documents, Advanced Shipping Notices, and the 2D barcoded label matrix. - Improve patient safety by identifying which recalled drug lot numbers have been received by STX VA. In addition, the vendor must show that they are committed to do the FedRAMP Process. Requirements: 1.1 ASSESSMENT, AUTHORIZATION, AND CONTINUOUS MONITORING 1. The information system solution selected by the Contractor shall comply with the Federal Information Security Management Act (FISMA). 2. The Contractor shall comply with FedRAMP requirements as mandated by Federal laws and policies, including making available any documentation, physical access, and logical access needed to support this requirement. 3. Following guidance from the Federal CIO, VA will utilize existing JAB ATO or agency ATO issued by another agency as a starting point for FedRAMP requirements. If neither of those exist, VA will sponsor FedRAMP ATO. VA will be using the FedRAMP baselines as a starting point, since they are specifically tailored for cloud services. 4. The Contractor shall, where applicable, assist with the VA ATO Process to help achieve agency authorization of the cloud service or migrated application. 5. The Contractor shall complete a FedRAMP System Security Plan (SSP) and supporting documentation within 45 days after contract award. (If Data Security Categorization is High Impact, this will be due 85 days after contract award.) 6. The Contractor shall complete a Third-Party Assessment Organization (3PAO) Security Assessment Plan (SAP) within 90 days after contract award. (If Data Security Categorization is High Impact, this will be due after 130 days after contract award.) 7. The Contractor shall complete a 3PAO Security Assessment Report (SAR) within 140 days after contract award. (If Data Security Categorization is High Impact, this will be due 180 days after contract award.) 8. The Contractor shall afford VA access to the Contractor s and Cloud Service Provider s (CSP) facilities, installations, technical capabilities, operations, documentation, records, and databases. 9. If new or unanticipated threats or hazards are discovered by either VA or the Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party in accordance with the security addendum B. 10. The Contractor shall not release any data without the consent of VA in writing. All requests for release must be submitted in writing to the Contracting Officer s Representative (COR)/Contracting Officer (CO). 11. In order for live VA data to be used in this system, a FedRAMP Authorization and Agency ATO will be required. Deliverables: A. FedRAMP System Security Plan (SSP) and supporting documentation B. VA Implementation Diagram: This is a VA specific architecture diagram demonstrating the proposed implementation of this system at VA (VAID) C. 3PAO Security Assessment Plan (SAP) D. 3PAO Security Assessment Report (SAR) 12. Periods of Performance: A. Base year 2/1/2023 - 1/31/2024 B. Option year 1: 2/1/2024 1/31/2025 C. Option year 2: 2/1/2025 1/31/2026 D. Option year 3: 2/1/2026 1/31/2027 E. Option year 2: 2/1/2027 1/31/2028