RFI_Draft PWS_KGL_Final.pdf

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS(VA)

Enterprise Program Management Office Memorials Benefits and Services (MBS)

Kiosk Grave Locator (KGL)Software

Date: February 15, 2024

VA-24-00033145

PWS Version Number: 1.2

Kiosk Grave Locator Software (KGL)

Contents

1.0 BACKGROUND

2.0 APPLICABLE DOCUMENTS

3.0 SCOPE OF WORK

4.0 PERFORMANCE DETAILS

4.1 PERFORMANCE PERIOD

4.2 PLACE OF PERFORMANCE

4.3 TRAVEL

5.0 SPECIFIC TASKS AND DELIVERABLES

5.1 PROJECT MANAGEMENT

5.1.1 CONTRACTOR PROJECT MANAGEMENT PLAN

5.1.2 REPORTING REQUIREMENTS

5.1.3 TECHNICAL KICKOFF MEETING

5.1.4 VA MANDATORY TRAINING (FFP)

5.1.5 ONBOARDING (FFP)

5.1.6 CONFIGURATION MANAGEMENT (FFP)

5.1.7 ARCHITECTURE SUPPORT (FFP)

5.1.8 RISK MANAGEMENT (FFP)

5.1.9 DATA CALLS AND REPORTING REQUESTS (FFP)

5.2 KGL OPERATIONAL SUPPORT (FFP)

5.2.1 OPERATIONS AND INFRASTRUCTURE SERVICES (FFP)

5.2.2 APPLICATION MIDDLEWARE AND DATABASE ADMINISTRATION

SERVICES (FFP)

5.2.3 DEVSECOPS SUPPORT AND MAINTENANCE SERVICES (FFP)

5.2.4 PRODUCT COMPLIANCE (FFP)

5.2.5 CHANGE AND CONFIGURATION MANAGEMENT SUPPORT

(OPERATIONS) (FFP)

5.2.6 MAINTENANCE UPGRADES (FFP)

5.2.7 BACKUP AND RESTORE (FFP)

5.2.8 SECURITY AND MONITORING (FFP)

5.2.9 SERVICE LEVEL AGREEMENT (SLA) REQUIREMENTS (FFP)

5.2.10 ISSUE-RELATED TECHNICAL SUPPORT (FFP)

5.3 AGILE DEVELOPMENT/SCRUM TEAM (FFP)

5.3.1 PLANNING AND ELABORATION SERVICES (FFP)

5.3.2 DEVELOPMENT SERVICES (FFP)

5.3.3 INTEGRATION AND TESTING SUPPORT SERVICES (FFP)

5.3.4 IMPLEMENTATION SERVICES (FFP)

5.4 OPTIONAL TASK ONE – ADDITIONAL AGILE DEVELOPMENT TEAMS (FFP)

5.5 OPTIONAL TASK TWO - SYSTEM EXPANSION (FFP NTE)

5.6 OPTIONAL TASK THREE - WARRANTY SUPPORT (FFP)

5.7 OPTIONAL TASK FOUR - TRANSITION SUPPORT AND TRANSITION OF

ASSETS (FFP)

5.8 OPTION PERIOD 1

5.9 OPTION PERIOD 2

6.0 GENERAL REQUIREMENTS

6.1 ENTERPRISE AND IT FRAMEWORK

6.1.1 VA TECHNICAL REFERENCE MODEL

6.1.2 FEDERAL IDENTITY, CREDENTIAL, AND ACCESS MANAGEMENT

(FICAM)

6.1.3 INTERNET PROTOCOL VERSION 6 (IPV6)

6.1.4 TRUSTED INTERNET CONNECTION (TIC)

6.1.5 STANDARD COMPUTER CONFIGURATION

6.1.6 VETERAN FOCUSED INTEGRATION PROCESS (VIP) AND PRODUCT

LINE MANAGEMENT (PLM)

6.1.7 PROCESS ASSET LIBRARY (PAL)

6.1.8 AUTHORITATIVE DATA SOURCES

6.1.9 SOCIAL SECURITY NUMBER (SSN) REDUCTION

6.1.10 SOFTWARE AND LICENSING REQUIREMENTS

6.2 SECURITY AND PRIVACY REQUIREMENTS

6.2.1 POSITION/TASK RISK DESIGNATION LEVEL(S)

6.2.2 CONTRACTOR PERSONNEL SECURITY REQUIREMENTS

6.3 METHOD AND DISTRIBUTION OF DELIVERABLES

6.4 PERFORMANCE METRICS

6.5 FACILITY/RESOURCE PROVISIONS

6.6 GOVERNMENT FURNISHED PROPERTY

6.7 SHIPMENT OF HARDWARE OR EQUIPMENT

ADDENDUM A – ADDITIONAL VA REQUIREMENTS, CONSOLIDATED

ADDENDUM B – VA INFORMATION AND INFORMATION SYSTEM

SECURITY/PRIVACY LANGUAGE

1.0 BACKGROUND

The mission of the Department of Veterans Affairs (VA), Office of Information and Technology (OIT), Software Product Management, Benefits, Appeals, and Memorials Portfolio is to provide high quality, effective, and efficient Information Technology (IT) services to those responsible for providing care to the Veterans at the point-of-care as well as throughout all the points of the Veterans’ VA journey in an effective, timely, and compassionate manner. VA depends on Information Management/Information Technology (IM/IT) systems to meet mission goals.

National Cemetery Administration’s (NCA) mission is to honor the military service of our nation’s Veterans. NCA provides a dignified burial and lasting memorial for Veterans and their eligible family members. National Cemeteries are maintained as national shrines. NCA’s vision is to provide a lasting tribute to our nation’s Veterans by being mission driven, results oriented, and customer focused. NCA accomplishes this goal, in part, by scheduling burials and maintaining National Cemeteries. It processes applications for Veteran headstones and markers for placement in National Cemeteries, State Veterans Cemeteries, National Park Service Cemeteries, United States Army Post Cemeteries, and other cemeteries. NCA also administers the State Veterans Cemetery Grants Program, which complements the network of National Cemeteries, and provides Presidential Memorial Certificates to next of kin of deceased Veterans.

NCA is modernizing the NCA National Cemetery Kiosk Software. The current kiosks are significantly outdated and are not able to be easily changed when new functionality is required. The modernized solution will improve the overall user experience, provide walking directions from the kiosk to the gravesite, improve map quality, and provide mobile versions of the kiosk software for use outside of the cemetery.

In 1997, NCA used in-house resources to develop and maintain a grave locator and general information kiosk application as part of its commitment to implement cost-effective customer service improvements and facilitate cemetery administrative processes. The application is designed to run 24 hours a day, seven days per week. It allows visitors to find the exact location of individuals interred at the cemetery; provides the visitor with a cemetery map for use in locating gravesites; and displays the most frequently sought information, to include:

• cemetery operating hours

• upcoming events

• grounds and floral policy

• cemetery history

• military funeral honors policy

• burial eligibility information

• NCA rules and regulations

NCA currently has 113 kiosks in operation.

2.0 APPLICABLE DOCUMENTS

In the performance of the tasks associated with this PWS, the Contractor shall comply with the following:

1. 44 U.S.C. § 3541-3549, “Federal Information Security Management Act (FISMA) of 2002”

2. “Federal Information Security Modernization Act of 2014”

3. Federal Information Processing Standards (FIPS) Publication 140-2, “Security Requirements for Cryptographic Modules”

4. FIPS Pub 199. “Standards for Security Categorization of Federal Information and Information Systems,” February 2004

5. FIPS Pub 200, “Minimum Security Requirements for Federal Information and

Information Systems,” March 2006

6. FIPS Pub 201-2, “Personal Identity Verification of Federal Employees and

Contractors,” August 2013

7. 10 U.S.C. § 2224, "Defense Information Assurance Program"

8. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

9. Public Law 109-461, Veterans Benefits, Health Care, and Information

Technology Act of 2006, Title IX, Information Security Matters

10. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”

11. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, https://www.va.gov/vapubs/index.cfm

12. VA Handbook 0710, “Personnel Security and Suitability Program,” May 2, 2016, https://www.va.gov/vapubs/index.cfm

13. VA Directive and Handbook 6102, “Internet/Intranet Services,” August 5,

14. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and Guidelines,” January 18, 2017

15. Office of Management and Budget (OMB) Circular A-130, “Managing Federal

Information as a Strategic Resource,” July 28, 2016

16. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed

Services (CHAMPUS)”

17. NIST SP 800-66 Rev. 1, “An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule,” October 2008

18. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended, January 18, 2017

19. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

20. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021

21. VA Handbook 6500, “Risk Management Framework for VA Information

Systems VA Information Security Program,” February 24, 2021

22. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI),” March 12, 2019

23. VA Handbook 6500.5, “Incorporating Security and Privacy into the System Development Lifecycle,” March 22, 2010

24. VA Handbook 6500.6, “Contract Security,” March 12, 2010 https://www.va.gov/vapubs/index.cfm https://www.va.gov/vapubs/index.cfm http://www.va.gov/vapubs http://www.va.gov/vapubs

25. VA Handbook 6500.8, “Information System Contingency Planning,” April 6,

26. VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018

27. VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017

28. OIT Process Asset Library (PAL), https://www.va.gov/process/ . Reference

Process Maps at https://www.va.gov/process/maps.asp and Artifact templates at https://www.va.gov/process/artifacts.asp

29. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

30. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014

31. VA Handbook 6508.1, “Procedures for Privacy Threshold Analysis and Privacy Impact Assessment,” July 30, 2015

32. VA Handbook 6510, “VA Identity and Access Management,” January 15,

33. VA Directive and Handbook 6513, “Secure External Connections,” October 12, 2017

34. VA Directive 6300, “Records and Information Management,” September 21,

35. VA Handbook, 6300.1, “Records Management Procedures,“ March 24, 2010

36. NIST SP 800-37 Rev 2, “Risk Management Framework for Information

Systems and Organizations: A System Life Cycle Approach for Security and Privacy,” December 2018

37. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020)

38. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015

39. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-

12) Program,” March 24, 2014

40. OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005

41. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019

42. OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008

43. Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance, December 2, 2011, (NOTE: Part A of the FICAM Roadmap and Implementation Guidance, v2.0, was replaced in 2015 with an updated Architecture (https://arch.idmanagement.gov/#what-is-the-ficam-architecture)

44. NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access,“ June 2018

45. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, “Digital Identity Guidelines,” updated March 02, 2020 https://www.va.gov/process/ https://www.va.gov/process/maps.asp https://www.va.gov/process/artifacts.asp https://www.va.gov/trm/TRMHomePage.aspx https://arch.idmanagement.gov/#what-is-the-ficam-architecture https://arch.idmanagement.gov/#what-is-the-ficam-architecture

46. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014

47. NIST SP 800-164, “Guidelines on Hardware-Rooted Security in Mobile

Devices (Draft),” October 2012

48. Draft National Institute of Standards and Technology Interagency Report

(NISTIR) 7981, “Mobile, PIV, and Authentication,” March 2014

49. VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland

Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

50. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

51. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

52. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

53. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019

54. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008

55. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (Public Law 110–140), December 19, 2007

56. Section 104 of the Energy Policy Act of 2005, (Public Law 109–58), August 8, 2005

57. Executive Order 13834, “Efficient Federal Operations,” dated May 17, 2018

58. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August

2, 2001

59. VA Directive 0058, “VA Green Purchasing Program,” July 19, 2013

60. VA Handbook 0058, “VA Green Purchasing Program,” July 19, 2013

61. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote

Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

62. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

63. “Veteran Focused Integration Process (VIP) Guide 4.0,” January 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

64. VA Memorandum “Proper Use of Email and Other Messaging Services,”

January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

65. “DevSecOps Product Line Management Playbook” version 2.0, May 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

66. NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020

67. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol

Version 6 (IPv6),” November 19, 2020

68. Social Security Number (SSN) Fraud Prevention Act of 2017

69. Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23, https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514 https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896 https://www.cisa.gov/publication/tic-30-core-guidance-documents https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371 https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

70. OMB Guidance M-16-21: Federal Source Code Policy: Achieving Efficiency, Transparency, and Innovation through Reusable and Open Source Software

71. VA Memorandum “Ethical Principles for Access to and Use of Veteran Data (VIEWS 01256748)”, June 24, 2020

72. The Agile Manifesto http://agilemanifesto.org/

73. The U.S. Digital Services Playbook https://playbook.cio.gov/

74. The TechFAR Hub https://techfarhub.cio.gov/

75. VA UX Style Guide https://www.va.gov/web/standards/styles.cfm

76. VA Digital Services Handbook Research and Discovery Checklist https://department-of-veterans-affairs.github.io/va-digital-service-handbook/delivery/research-and-discovery/checklist

77. The Digital Analytics Program https://digital.gov/dap/

78. VA Design System https://design.va.gov/

79. United States Web Design System https://designsystem.digital.gov/

80. VA Developer Portal https://developer.va.gov/

81. SAFe® for Lean Enterprises 5.0:

https://www.scaledagileframework.com/safe-for-lean/enterprises/

82. VA DEVSECOPS Tools DOTS Tools Information - Dept of Veterans Affairs-

External - MAX Federal Community

83. MyVA style guide for websites VA Web Governance | Web Governance |

Veterans Affairs

84. Attachment A – VA Product Line Accountability and Reporting System

(PARS) User Guide

85. Attachment B – VA Product Line Management (PLM) Playbook V2.0, May

86. Attachment C – Ethical Principles for Access to and Use of Veteran Data

3.0 SCOPE OF WORK

The Contractor shall develop, enhance and maintain a managed solution hosted at the VA Enterprise Cloud (VAEC) for KGL. The major tasks include:

1. Develop new kiosk interface using iterative user centered design principles

a. The kiosk interface shall be updated and modernized from existing computer programming languages, architectures, software libraries and protocols and follow Department of Veterans Affairs and NCA design standards

2. Improve the kiosk interface and implement page analytics to help inform design

3. Provide advanced grave location search capability, such as: Veteran war periods, medals, or branches of service.

4. Provide on screen kiosk access to other NCA cemetery interment records.

5. Improve cemetery navigation for visitors

6. Improve cemetery map quality

7. Provide image files of cemetery maps and monument geocoordinates via SMS to a user’s smart device, and display a Quick Response (QR) code on the kiosk that, when scanned will provide exact coordinates on the users smart device map application http://agilemanifesto.org/ https://playbook.cio.gov/ https://techfarhub.cio.gov/ https://www.va.gov/web/standards/styles.cfm https://department-of-veterans-affairs.github.io/va-digital-service-handbook/delivery/research-and-discovery/checklist https://department-of-veterans-affairs.github.io/va-digital-service-handbook/delivery/research-and-discovery/checklist https://digital.gov/dap/ https://design.va.gov/ https://designsystem.digital.gov/ https://developer.va.gov/ https://www.scaledagileframework.com/safe-for-lean/enterprises/ https://community.max.gov/pages/viewpage.action?spaceKey=VAExternal&title=DOTS+Tools+Information https://community.max.gov/pages/viewpage.action?spaceKey=VAExternal&title=DOTS+Tools+Information https://www.va.gov/web/index.cfm https://www.va.gov/web/index.cfm

8. Connect the cemetery kiosks to other NCA systems, including Veteran’s Legacy Memorial (VLM), the Memorials Data Warehouse (MDW), GeoBISL, Daily Burial Schedule, and NCA WebServices.

9. Implement self-guided cemetery tours on various themes, such as: All Veterans who served in World War II, celebrities or otherwise famous Veterans.

10. Build an exact replica mobile application available on Android and iPhone Operating System of the NCA kiosks.

11. Provide configuration and professional/technical services as needed.

12. Provide Operations and Maintenance for the Kiosk solution.

13. Ensure kiosk interface application will print using Practical Automation Thermal

Printer-PT ITK38

4.0 PERFORMANCE DETAILS

4.1 PERFORMANCE PERIOD

The Period of Performance (PoP) shall be a base period of eight months from date of award, with two 12-month option periods, and four optional tasks.

Any work shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO). If required, the CO may designate the Contractor to work during holidays and weekends at no extra cost to the government.

There are 11 Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, five are set by date:

New Year's Day January 1 Juneteenth June 19 Independence Day July 4 Veterans Day November 11 Christmas Day December 25

If any of the above falls on a Saturday, then Friday shall be observed as a holiday.

Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

Martin Luther King's Birthday Third Monday in January Washington's Birthday Third Monday in February Memorial Day Last Monday in May Labor Day First Monday in September Columbus Day Second Monday in October Thanksgiving Fourth Thursday in November

4.2 PLACE OF PERFORMANCE

Tasks under this PWS shall be performed at Contractor facilities. The Contractor shall identify the Contractor’s place of performance in their proposal submission.

4.3 TRAVEL

The Government anticipates travel under this effort to perform the tasks associated with the effort, as well as to attend program-related meetings or conferences throughout the PoP. Include all estimated travel costs in your firm-fixed price line items. These costs will not be directly reimbursed by the Government. Contractor travel within the local commuting area will not be reimbursed.

5.0 SPECIFIC TASKS AND DELIVERABLES

The Contractor shall perform the following:

• Overall resources expended on inspection and verification of the data shall be commensurate with the expected economic return and operational needs for the data.

• A single Point of Contact (POC) shall be designated on each contract to identify and track the submission, inspection, and acceptance of all contract data deliverables for each item or component for which data has been ordered.)

The Contractor shall use an Agile Development Security Operations (DevSecOps) approach to continuously deliver value across the KGL Product to provide greater user visibility, clearly defined technical infrastructure, improved capabilities, as well as information security and accessibility as directed by VA stakeholders. The Contractor shall provide product performance management and Agile program management to improve quality and performance of features and value delivery. The Contractor shall ensure adherence to VA governance, standards, and training. The Contractor shall provide support for centralized OIT intake and management of business and technical needs and requirements. The Contractor shall provide architecture support and design reviews for all system changes. The Contractor shall provide centralized communications to support operational Value Streams and all activities that span product objectives. The contractor shall participate in all Program Increment Planning (PI) activities in accordance with Scaled Agile Framework (SAFe) principles and VA methodologies.

Iteration Description Target Completion

Phase 1 – Production Pilot

a. New and improved kiosk interface

b. Native mobile application

c. Connection to MDW to display all data currently on kiosks

d. Improve cemetery map printing quality

e. Daily burial system integration

f. VLM integration with QR codes

g. Geospatial data library integration with monument images and geocoordinates

h. Mobile walk to grave directions via QR code

18 months after project kick-off

Phase 2 – User Experience Enhancement

i. Admin Application to customize kiosk screen savers and visitor information

j. Cemetery tours on mobile application and kiosks

k. Continued backlog grooming and enhancements as determined by NCA and

OIT

Delivered iteratively no more than every 90 days following production pilot

The Contractor shall comply with IT DevSecOps methodologies for the KGL product in accordance with the working principles and definitions provided in Section 5.0. The Contractor shall provide dedicated teams of cross-functional staff to operate, build, maintain, and develop the KGL platform and associated interfaces with capabilities to streamline systems, improve scalability, increase availability of services, and enable more efficient delivery.

The Contractor shall not utilize KGL to access Veteran data to:

1. Sell or distribute data outside the function of the kiosk

2. Distribute Veteran data for any purposes without specific written VA permission

3. Link to non-VA sites

4. Solicit any additional/similar services or changes to the Veteran, next of kin, or families of Veterans

The Contractor shall not utilize KGL kiosks to advertise services provided to the Government. Such as (but not limited to):

1. Logos

2. Links to other sites

3. Descriptions of services provided

5.1 PROJECT MANAGEMENT

5.1.1 CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Project Management Plan (CPMP) that defines the Contractor’s approach, timeline, and tools to be used in execution of this Task Order (TO). The CPMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks, and resource support. The CPMP shall also include how the Contractor plans to coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPMP shall be concurred upon and updated in accordance with Section B, Price Schedule of the TO. The Contractor shall update and maintain the VA Program Manager (PM) approved CPMP throughout the PoP. As the Contractor updates the document, differences from the prior version shall be highlighted (i.e. “track changes”).

Deliverable:

A. Contractor Project Management Plan

5.1.2 REPORTING REQUIREMENTS

The Contractor shall deliver a Monthly Status Report. This report shall provide accurate, timely, and complete product/project information. The detail and technical level of this report shall be appropriate for VA management and shall summarize, not replicate, the information contained in the Sprint Review. The Monthly Status Report shall include the following data elements:

A. High-level schedule and milestones from the current reporting period (i.e. the prior month) through two months in the future.

B. Epics or similar work completed and in progress.

C. Work planned for the subsequent two months, when applicable.

D. Scrum team staffing, with changes from prior month highlighted.

E. Task Order Risks and Issues:

a. Task Order-related issues uncovered during the month and especially highlight those areas with a high probability of impacting schedule, cost, or performance goals and their likely impact on same.

b. Explanations for any unresolved issues, including possible solutions and any actions required of the Government and/or Contractor to resolve or mitigate the issue, including a plan and timeframe for resolution.

c. Status on previously identified issues, actions taken to mitigate the situation and/or progress made in rectifying the situation.

F. Software licenses, software security certificates, tokens, etc. at or nearing end of life or expiration.

G. Workforce staffing review showing all Contractor personnel performing on the effort by task on a monthly basis with status of their background investigation and the percentage of their time assigned. After the initial labor baseline is provided, each Workforce Staffing review shall identify any changes in staffing identifying each person who was added to, removed from, or moved within the TO. The review shall reflect data as of the last day of the preceding month and shall be included as part of the Monthly Status Report.

This report shall reflect data as of the last day of the preceding month. Change tracking, except where noted, is not required.

A. Monthly Status Report

5.1.3 TECHNICAL KICKOFF MEETING

A technical kickoff meeting shall be held within 10 days after TO award. The Contractor shall coordinate the date, time, and location (can be virtual) with the Contracting Officer (CO), as the Post-Award Conference Chairperson, the VA PM, as the Co-Chairperson, the Contract Specialist (CS), and the Contracting Officer’s Representative (COR). The Contractor shall provide a draft agenda to the CO and VA PM at least five calendar days prior to the meeting. Upon Government approval of a final agenda, the Contractor shall distribute to all meeting attendees.

During the kick-off meeting, the Contractor shall present, for review and approval by the Government, the details of the intended approach, work plan, and project schedule via a Microsoft Office PowerPoint presentation. At the conclusion of the meeting, the Contractor shall update the presentation with a final slide titled “Summary Report” which shall include notes on any major issues, agreements, or disagreements discussed during the kickoff meeting and the following statement: “As the Post-Award Conference Chairperson, I have reviewed the entirety of this presentation and assert that it is an accurate representation and summary of the discussions held during the Technical Kickoff Meeting for the Kiosk Grave Locator Project.” The Contractor shall submit the final updated presentation to the CO and VA PM for review and signature within three calendar days after the meeting. The Contractor shall also work with the CS, The Government’s dedicated note taker, to prepare and distribute the meeting minutes of the kickoff meeting to the CO, COR and all attendees within three calendar days after the meeting. The Contractor shall obtain concurrence from the CS on the content of the meeting minutes prior to distribution of the document.

A. Technical Kickoff Meeting Presentation

5.1.4 VA MANDATORY TRAINING (FFP)

The Contractor and VA PM shall determine which team members require access to the VA network and Jira/GitHub. All personnel that require access shall complete all the required VA Talent Management System (TMS) training courses prior to Kickoff meeting. The Contractor shall work with its respective point of contact, to obtain access to TMS to complete the mandatory training courses.

As an action under the Continuous Readiness in Information Security Program (CRISP), VA’s Assistance Secretary for Information and Technology issued a memorandum requiring all VA Government and contract staff to complete information security awareness and applicable role-based training. The Contractor shall submit TMS Training Certificates annually of completion for VA Privacy and Information Security Awareness (PISA), Rules of Behavior (ROB), Health Insurance and Portability and Accountability Act (HIPAA) and Role-Based trainings. The Contractor shall provide signed copies of the Contractor Rules of Behavior in accordance with Section 9, Training, from Appendix C of the VA Handbook 6500.6, “Contract Security”.

Deliverables:

A. TMS Training Certificates for all Mandatory Training B. Signed Contractor Rules of Behavior

5.1.5 ONBOARDING (FFP)

The Contractor shall manage the onboarding of its staff. Onboarding shall include steps to obtain a VA network and email account, complete training, initiate background investigations, and gain physical and logical access, which may include elevated privileges to the necessary development and test environments for the various systems to be enhanced.

A single Contractor Onboarding POC shall be designated by the Contractor who tracks the onboarding status of all contractor personnel. The Contractor Onboarding POC shall be responsible for accurate and timely submission of all required VA onboarding paperwork to the COR or his/her onboarding designee. The Contractor shall be responsible for tracking the status of all their staff’s onboarding activities and providing it in an Onboarding Status Report.

Deliverable:

A. Onboarding Status Report

5.1.6 CONFIGURATION MANAGEMENT (FFP)

The Contractor shall:

1. Identify the standard and unique aspects of configuration management to be performed and establish a Configuration Management (CM) Plan which meets VA OIT CM requirements. The Contractor shall account for CM activities and standards for each product. The initial baseline CM Plan shall be concurred upon and updated in accordance with Section B of the TO. The Contractor shall implement, update, and maintain the VA approved CM Plan throughout the PoP.

As the Contractor updates the document, differences from the prior version shall be highlighted (i.e. “track changes”).

2. Provide any recommended configuration items that are not in the Configuration Management Plan to be added to the plan and to be placed under configuration and change control. The Contractor shall identify types of configuration items pertaining to each product to be placed under configuration management. Based on VA EPMO requirements, the CM Plan, and the unique needs or nature of each product or component, the Contractor shall determine the components within each product that must be under configuration control.

3. Coordinate with quality assurance, product development, testing, intake, schedule, risk, and defect management, vendors, customers, and business stakeholder teams for configuration management.

4. Audit build packages and release candidates for compliance to configuration standards in compliance with VA configuration management for production releases.

5. Ensure software and/or software releases and patches are managed using continuous integration and industry DevOps tools (i.e. Jira, GitHub, Slack, etc.).

Use of designated VA approved tools and repositories for all software source code and electronic artifact configuration and version management shall be required. The Contractor shall manage change, activity, issue, action, risk and other product data as prescribed by VA standards and processes. If assigned a product using tools that are being deprecated, the Contractor shall assist the VA Tools Team in migrating products using other Change and/or Configuration Management tools.

6. Ensure that all product software and non-software artifacts are versioned correctly according to VA standards and follow a build/release promotion versioning approach which identifies all major, minor, and updates changes to the components.

7. Create Project and Product Artifacts baselined and versioned in the CM repository in order to allow the tool to show active and past histories of the check-ins and check-outs of all software components, data, and software product engineering documents. Maintain all baselines of software, software builds, and electronic artifacts in the repository, labeling updates and versions according to CM procedures.

8. Develop, verify and submit with all project build deliveries, a Version Description Document that addresses the manifest of the contents of all software builds.

9. Establish and maintain status reporting on change and configuration management activity, and ensure records and artifacts are filed and updated daily.

Deliverables:

A. Configuration Management Plan B. Version Description Document

5.1.7 ARCHITECTURE SUPPORT (FFP)

The Contractor shall update and maintain KGL Component Architecture Documentation to include a KGL Component Architecture Report. The Contractor shall review all applications and software for compliance to VA Enterprise Architecture. The Contractor shall report compliance issues between the implemented and/or to be implemented applications and software deliveries and the VA Enterprise Architecture in a KGL Architecture Compliance Report, which shall include technical approaches for the correction of any VA TRM non-compliance with the KGL and component Product architectures.

The Contractor shall participate in the Architecture Review Board (ARB) where design reviews are conducted, and architectural considerations are addressed as needed. The Contractor shall document system dependencies and provides changes to any existing KGL and component product architectures or create, or update, new or existing KGL component architecture. The Contractor shall align work with VA enterprise architects and participate in architecture review sessions to maintain and improve the architectural runway. The Contractor shall develop and deliver Logical Data Models and Business Process Models. In the Logical Data Models and Business Process Models, the Contractor shall define and communicate shared technical and architectural visions and ensure the systems are fit for their intended purpose. The Contractor shall participate in Architecture Synchronization to ensure consistency in how emerging designs and tradeoffs are managed across Portfolio Solutions, allowing frequent opportunities to steer implementation approaches without becoming a source of delays.

As the Contractor updates the documents, differences from the prior version shall be highlighted (i.e. “track changes”).

Deliverables:

A. KGL Component Architecture Documentation B. KGL Component Architecture Report C. KGL Architecture Compliance Report D. Logical Data Models and Business Process Models

5.1.8 RISK MANAGEMENT (FFP)

The Contractor shall conduct Risk Management and document and track risks and issues utilizing Jira Software, or any future VA approved risk management tool. The Contractor shall submit new risks to the VA OIT PM within three days of risk discovery and update and maintain through the risk/issue lifecycle. The Contractor shall participate in virtual weekly risk reviews and provide additional information regarding the risk/issue as requested.

5.1.9 DATA CALLS AND REPORTING REQUESTS (FFP)

The Contractor shall:

1. Provide Data Call Reports in response to data calls from the COR for any system or process that is involved in the delivery of Contractor services within the given timeframe provided at receipt of the request. These requests may differ in form and substance to support Government Accountability Office audits, Office of Inspector General (OIG) audits, and Legislative and/or VA Executive Brief requests. The request for these data calls are solicited on an ad-hoc basis, which may surge to a maximum of three per week and which may overlap in occurrence. Historically, there have been 10 data calls per quarter. VA will provide any specified templates for these data calls/reports upon task order award.

2. Provide any requested customer-specific information that is integral to the delivery of services, including the configuration of Contractor core infrastructure and other Contractor managed resources. One example of responding to data calls and reporting requests is cooperation with the VA OIG in the areas of facilities access, audits, security incident notification, and hosting location.

Specifically, for any required OIG cooperation, the Contractor (and any Subcontractors) shall:

a. Fully cooperate with all audits, inspections, investigations, or other reviews conducted by or on behalf of the CO or the agency OIG as described in paragraph 1. Full cooperation includes, but is not limited to, prompt disclosure (per agency policy) to authorized requests of data, information, and records requested in connection with any audit, inspection, investigation, or review, making employees of the Contractor available for interview by auditors, inspectors, and investigators upon request, and providing prompt access (per agency policy) to Contractor facilities, systems, data, and personnel to the extent the auditors, inspectors, and investigators reasonably believe necessary to complete the audit, inspection, investigation, or other review.

b. Preserve such data, records, logs, and other evidence which are reasonably necessary to conduct a thorough investigation of any computer security incident. A computer security incident (as defined in NIST SP 800-61, Computer Security Incident Handling Guide), includes but is not limited to those constituting an actual or potential thread or hazard to the integrity, availability, or confidentiality of agency information in the possession or under the control of the Contractor (of Subcontractor), or to the function of information systems operated by the Contractor (or Subcontractor) in the performance of this Order.

c. Promptly notify the designated agency representative in the event of any computer security incident as described in paragraph c above. This notification requirement is in addition to any other notification requirements which may be required by law or this Order. Established Federal agency timeframes for reporting security incidents to the United States Computer Emergency Readiness Team (US-CERT), although not exhaustive, serve as a useful guideline for determining whether reports under this paragraph are made promptly. (See NIST SP 8000-61, Computer Security Incident Handling Guide, Appendix J).

d. Provide to the requestor (CO, a representative of the CO, or the agency OIG) Government data, information, or records under the control of or in the possession of the Contractor pursuant to this task order, which the Agency, including the OIG, may request in furtherance of other audits, inspections, investigations, reviews, or litigation in which the Agency or the OIG is involved. Requests for production under this paragraph shall specify a deadline not less than 10 days for compliance which will determine whether response to the request has been made in a timely manner.

e. Include the substance of this paragraph, including this paragraph (f) in any subcontract which would require or otherwise result in Subcontractor employees having access to agency information in the possession or under the control of the Contractor (or Subcontractor), or access to information systems operated by the Contractor (or Subcontractor) in the performance of this order.

f. Ensure that all services pertaining to this Order are performed within the United States of America, including the storage of agency data, information, and records under the control of or in possession of the Contractor pursuant to this Order.

A. Data Call Report

5.2 KGL OPERATIONAL SUPPORT (FFP)

The Contractor shall provide system solution support activities which are associated with the on-going support related to the performance of routine, preventative, predictive, scheduled, and unscheduled actions aimed at preventing system/production failure (i.e., break/fix) and correcting software defects with the goal of increasing efficiency and reliability on a continuous basis. This support shall be provided for the solution and all associated components.

In support of these activities, the Contractor shall configure, maintain, test, and deploy maintenance releases applying the same life cycle tasks, as applicable. The Contractor shall provide licensing and maintenance of the Commercial Off The Shelf (COTS) software to support the KGL solution. The Contractor shall provide technical documentation as a release package to include Product Production Source Code, Production Operations and Maintenance Manual, Service Level Agreement (SLA) Performance Assessment Report, and Sprint Review Report, and shall execute these life cycle processes throughout the period of performance to support the delivery of functionality.

Releases may occur after hours and/or during the weekend. As such, all deployment release packages shall be completely developed by the Contractor Subject Matter Expert (SME) and advisory and troubleshooting support shall be provided. For releases, Contractor support staff shall be identified and available should a problem arise.

All deliverables and release packages shall be input into Jira/Github.

5.2.1 OPERATIONS AND INFRASTRUCTURE SERVICES (FFP)

The Contractor shall comprehensively support the operations, sustainment, maintenance, security, accessibility, performance, core services, technical standards, architectural compliance, operational capability testing, audits, and reviews, integration with external systems, triage and resolution support of issues, monitoring, contingency, capacity planning, and recovery for its assigned Product.

The Contractor shall work in concert with Product Teams to achieve holistic and seamless DevSecOps product support in alignment with the VA Product Line Management (PLM) Playbook.

Key Performance Indicators baselines shall be established at the beginning of an increment, and incremental improvement towards DevSecOps maturity shall be agreed upon at the beginning of the increment and measured at the end of the increment. Prior to each sprint, the Contractor and VA shall agree upon, in writing, a sprint cadence and a Definition of Done for the upcoming sprint increment, including required deliverables.

The Contractor shall use the VA’s implementation of Jira and GitHub or other VA Approved Toolsets. The Jira and GitHub Project/Product Data and Artifact Repositories will be used to provide a single authoritative project and product data and artifact repository. All product data and artifacts shall be managed in this data and artifact repository daily. The following checked out artifacts shall be checked back in daily:

1. Scheduled product sprints and backlog

2. Product Agile requirements

3. Product risks and issues

4. Product configurations and changes

5. Product test plans and execution

6. Product planning and engineering documentation

7. Linkages to correlate requirements to change orders to configurable items to risks, impediments, and issues to test cases and test results to show full traceability

The Contractor shall show all Agile requirements, changes, tests performed, and test results in approved VA project management tools to show evidence of code coverage and test coverage of all the requirements specified. This is required for VA to have high confidence in a fully documented, as evidenced by data in the tools, requirements traceability matrix.

The Contractor shall:

1. Perform all operation services and activities including performance and dashboard monitoring, job scheduling and execution, and backup and restore.

2. Meet or exceed SLA targets outlined in Section 5.2.9 of this PWS.

3. Provide support to keep all environments in an operational state including application/system hardware 24 hours per day, seven days per week, 365 days per year (24x7x365).

4. Support the uptime of system operations 24x7x365.

5. Support software releases during the day and potentially nighttime hours and monitoring/maintenance activities periodically during weeknights. VA estimates that regularly scheduled releases will occur twice a month.

6. Provide a single telephone number that is forwarded to “On Call” team leads.

7. Troubleshoot, respond, and resolve issues and associated tickets generated by automated alerts.

8. Provide the first line of defense for failed pipelines (production and non-production).

9. Detect, diagnose, and resolve issues and operational incidents within the SLA time frames defined in Section 5.2.10 of this PWS.

10. Support VA event management processes for critical and high priority incidents (including participation in Swift Action and Triage (SWATs) and publication of After-Action Reports).

11. Maintain incident metrics and supplementary data to detect patterns and trends and facilitate rapid diagnosis of previously observed incidents.

12. Manage and track software licenses and maintenance agreements.

13. Deploy and maintain automation to detect and generate alerts for lapses in system availability and material deviations from baseline system performance.

14. Provide continuous improvement of monitoring and alerting to detect new failure points.

15. Manage system performance and capacity for all products and platform components:

a. Establish a baseline for system performance and resource utilization.

b. Establish reserve capacity targets to accommodate spikes in real-time demand and organic growth.

c. Work with the VA OIT PM to identify “key” business transactions for monitoring/optimization purposes.

d. Formulate and execute strategies to maintain desired reserve capacity.

e. Conduct periodic reviews of current and forecast system performance and resource utilization.

f. Define criteria for identifying and prioritizing candidates for performance optimization (such as frequency of use, long response times, and high-resource utilization).

16. Identify upgrades, preventative and perfective refactoring for components of the as-is architecture, and emerging technologies apropos to the building, testing, deployment, monitoring, and operation of the system.

17. Work with the OIT Product Owner and relevant Agile teams to incorporate and prioritize Product upgrades and evolutionary changes in the product backlog.

18. Develop, deliver, and maintain Product Production Source Code.

19. Develop, deliver, and maintain a Product Operations and Maintenance Manual (POM).

20. Develop, deliver, and maintain an SLA Performance Assessment Report to include:

a. Application performance, capacity, and availability

b. Incident Response and Resolution

21. Establish and perform Disaster Recovery.

22. Assume responsibility and ensure maintainability of Product, software code, and associated deliverables upon production implementation release.

The Contractor shall provide a review at the end of each sprint. The Contractor shall prepare a slide deck and conduct a meeting with VA OIT to go over the contents which includes:

1. Demonstration of work completed, if applicable

2. Status of progress of work against Business Roadmap

3. Value added by sprint

4. Sprint metrics

a. Story statistics

b. Burn up chart

5. Risks and issues

6. Sprint Retrospective

The Contractor shall provide the above information in a Sprint Review Report. The Contractor shall use VA’s implementation of approved project management tools to accomplish this reporting to provide a single Agile project/product lifecycle management tool to track execution details. The VA approved project management tool will be used to provide a single authoritative project and product data and artifact repository.

Deliverables:

A. Product Production Source Code B. Product Operations and Maintenance Manual C. SLA Performance Assessment Report D. Sprint Review Report

5.2.2 APPLICATION MIDDLEWARE AND DATABASE ADMINISTRATION

SERVICES (FFP)

The Contractor shall perform product middleware and data administration services as follows:

1. Perform activities required for providing, maintaining, securing, scheduling, backing up, recovering, and supporting inbound and outbound application interfaces (electronic data extraction and translation and load), Web services and databases.

2. Define data models for relational and non-relational databases.

3. Provide input on standards and policies for managing databases.

4. Review database operations including Data Definition Language (DDLs), Data Manipulation Language (DMLs) and tune for performance.

5. Install and configure database products and/or create and configure data-related cloud services.

6. Govern all changes made to the databases.

7. Implement, configure, and use Database Migration Tools (Ex. Liquibase, Flyway).

8. Analyze how data is queried from the databases and tune/optimize database performance.

9. Develop and deliver industry standard Physical Data Model.

A. Physical Data Model

5.2.3 DEVSECOPS SUPPORT AND MAINTENANCE SERVICES (FFP)

The Contractor shall provide DevSecOps and maintenance support, as applicable to the Product as follows:

1. Incorporate Configuration Management to support the development methodology in all environments.

2. Build, deliver, and maintain DevSecOps pipelines for implementing Continuous Integration/Continuous Delivery (CI/CD) for cloud applications.

3. Automate all phases of software delivery via an instance of CI/CD pipeline derived from an enterprise pipeline framework. The phases shall support functional and regression testing, including test data conditioning, and incorporate, at a minimum:

a. Automated Unit Testing

b. Automated Builds

c. Automated Functional Testing

d. Automated Performance Testing

e. Automated Resiliency Testing

f. Automated Section 508 Compliance Testing

g. Automated Static and Dynamic Security Testing (e.g. Fortify)

h.…