P01 PWS - Application Services.docx

Infrastructure Operations Application Services

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Office of Information & Technology Infrastructure Operations

Application Services

Date: January 28, 2026

PWS Version Number: 1.0

Contents

BACKGROUND

The Department of Veterans Affairs (VA) Office of Information and Technology (OIT), through its Infrastructure Operations (IO) organization, is responsible for delivering secure, reliable, and modern IT services that enable VA to fulfill its mission of providing healthcare and benefits to Veterans. IO supports a vast and complex enterprise environment spanning on-premises data centers, hybrid cloud platforms, and distributed systems serving millions of users including Veterans, employees, and partners. These services underpin mission-critical systems such as electronic health records, claims processing, benefits administration, cybersecurity, and enterprise-wide communications.

To meet this mission, VA operates within a complex, multi‑vendor IT environment. IO requires comprehensive operational and engineering support across multiple disciplines, including Identity, Credential, and Access Management (ICAM), infrastructure vulnerability management, network and application security, certificate management, application virtualization, database administration, operations and control, Consolidated Mail Outpatient Pharmacy (CMOP), and web and middleware operations. These services are critical to maintaining high availability, security compliance, and performance for VA’s enterprise systems and applications.

VA’s ICAM program is a cornerstone of its Zero Trust cybersecurity strategy, ensuring that only authorized individuals have access to VA resources. This includes managing enterprise identity services, Single Sign-On (SSO), Identity Governance and Administration (IGA), Privileged Access Management (PAM), and the Master Person Index (MPI). The modernization of these services is essential to reducing technical debt, improving interoperability, and enabling secure digital experiences for Veterans and staff. The contractor will support ICAM transformation through agile delivery, risk assessments, engineering, and change management, while ensuring compliance with federal mandates such as Office of Management and Budget (OMB) M-19-17, National Institute of Standards and Technology (NIST) SP 800-63-3, and Executive Order 14028.

In addition to ICAM, IO oversees cybersecurity operations and vulnerability management for over 130 system boundaries and 2 million endpoints. This includes continuous monitoring, remediation of Known Exploited Vulnerabilities (KEVs), and compliance with directives such as OMB 21-31 and CISA Binding Operational Directives. IO requires technical expertise to strengthen VA’s cybersecurity posture through proactive risk identification, remediation, and reporting. IO also manages business continuity and disaster recovery planning for approximately 110 mission-critical systems, ensuring operational resilience during continuity events. This includes developing and testing contingency plans, managing alternate processing sites, and supporting crisis management activities.

Additional areas of responsibility include:

· Network Security Services (NSS): Delivering real-time visibility, attack surface reduction, and compliance enforcement across hybrid environments.

· Database Administration and Operations: Maintaining Oracle and Structured Query Language (SQL) Server databases, supporting migrations to cloud platforms, and ensuring security and compliance.

· Web Infrastructure and Middleware Support: Sustaining enterprise web environments and middleware platforms, proactive monitoring, and secure configuration management.

· Certificate Management/Public Key Infrastructure (PKI): Supporting over 18.9 billion annual transactions with robust certificate lifecycle management and validation services.

Through these efforts, IO aims to modernize VA’s IT infrastructure, enhance cybersecurity, and deliver high-performing, user-centric services that enable VA to meet its mission objectives. The contractor’s role is pivotal in achieving these goals by providing innovative solutions, operational excellence, and measurable outcomes under a performance-based contract structure.

APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with Applicable Documents cited in the MATOC PWS Section 2.0.

SCOPE OF WORK

The Contractor shall support the following functional areas in performance of this task order.

Identity, Credential and Access Management (ICAM) Services:

Objective: Deliver, operate, and modernize VA’s ICAM services portfolio, ensuring high availability, security compliance, and agile delivery of identity and access capabilities.

Scope & Responsibilities: Provide full lifecycle support for ICAM systems including identity governance, single sign-on, multi-factor authentication, and privileged access management. Responsibilities include system operations, integration of new applications, risk assessments, Zero Trust implementation, roadmap development, policy support, and digital identity risk assessments. Support engineering for onboarding, lifecycle management, troubleshooting, adoption/change management, and training. Ensure compliance with NIST SP 800-63 and VA security standards.

Expected Outcome: Maintain a secure, resilient, and modern identity and access management environment that supports VA enterprise operations.

Infrastructure Vulnerability Management:

Objective: Enhance VA’s cybersecurity posture through comprehensive vulnerability management and continuous monitoring across all supported systems and platforms.

Scope & Responsibilities: Identify vulnerabilities using approved scanning tools, analyze results, create and manage POA&Ms, and track remediation activities. Provide guidance for vulnerability mitigation, maintain dashboards and reports, and ensure compliance with federal and VA cybersecurity requirements. Perform posture evaluations, KEV remediation, continuous monitoring, customer engagement, metrics reporting, and vulnerability management services.

Expected Outcome: Reduce risk exposure and maintain continuous compliance through proactive vulnerability identification and remediation.

Certificate Management/Public Key Infrastructure (PKI):

Objective: Maintain and optimize VA’s PKI system to support secure digital transactions and identity validation.

Scope & Responsibilities: Operate and maintain PKI environment including certificate authorities, validation authorities, Online Certificate Status Protocol (OCSP) responders, and CDPs. Manage certificate issuance and lifecycle, monitor performance, and deliver compliance reporting. Provide technical support for PKI integrations and ensure high availability of PKI services.

Expected Outcome: Ensure secure and reliable PKI operations that enable trusted digital transactions across VA systems.

Web Infrastructure and Administration:

Objective: Sustain and optimize VA’s enterprise web infrastructure to ensure uptime and secure operations.

Scope & Responsibilities: Provide administration and technical support for web servers, databases, and middleware components. Manage incident response, change management, performance monitoring, and content promotions. Ensure compliance with VA security baselines and maintain documentation for all configurations and processes.

Expected Outcome: Maintain a secure, stable, and scalable web environment that supports VA mission-critical applications and services.

Middleware Objective: Maintain and optimize VA’s middleware and file transfer infrastructure to ensure secure, reliable, and high-performing operations that support mission-critical applications and data exchange across VA systems.

Scope & Responsibilities: Provide comprehensive middleware and file transfer administration services to ensure secure, reliable, and high-performing operations. Sustain critical application environments, support secure data exchange, maintain compliance with VA security standards, and enable continuous availability of systems that underpin mission-critical services. Deliver proactive monitoring, incident response, and lifecycle management to optimize performance, minimize downtime, and support VA’s evolving technology needs.

Expected Outcome: Deliver secure, stable, and compliant middleware and file transfer operations that maintain uptime, support VA’s enterprise applications, and enable uninterrupted data exchange across VA systems.

Application Virtualization:

Objective: Support VA’s application virtualization environment, ensuring efficient delivery and management of virtualized applications.

Scope & Responsibilities: Maintain virtualization platforms, perform upgrades, troubleshoot issues, and optimize performance. Ensure compliance with VA security standards and provide documentation and reporting on virtualization operations.

Expected Outcome: Deliver a reliable and secure application virtualization solution that enhances user experience and operational efficiency.

Printer Security Management:

Objective: Manage and secure VA’s enterprise printing environment to prevent unauthorized access and protect sensitive information.

Scope & Responsibilities: Implement printer security configurations, monitor compliance, manage firmware updates, and respond to security incidents. Maintain inventory records, provide reporting, and ensure adherence to VA security policies.

Expected Outcome: Maintain a secure and compliant printing infrastructure that mitigates risks and supports VA operations.

Database Administration:

Objective: Provide database administration and operational support for VA’s enterprise databases.

Scope & Responsibilities: Perform installations, upgrades, backups, and recovery operations. Monitor performance and tune databases for optimal efficiency. Ensure compliance with VA security standards, maintain documentation, and provide incident response for database-related issues.

Expected Outcome: Ensure secure, reliable, and high-performing database environments that support VA applications and services.

Operations Control & Consolidated Mail Outpatient Pharmacy:

Objective: Support VA’s certified mail order pharmacy operations, ensuring timely and accurate processing of prescriptions and related services.

Scope & Responsibilities: Maintain production systems, monitor performance, troubleshoot issues, and implement security and compliance measures. Provide technical support, maintain documentation, and deliver reporting on operational status and performance.

Expected Outcome: Ensure reliable, secure, and efficient mail order pharmacy operations that meet VA’s healthcare delivery requirements.

PERFORMANCE DETAILS

PERFORMANCE PERIOD

The PoP shall 12 months from date of award, with four 12-month option period(s) and Optional Tasks that have the following period of performances:

5.1.1.1 Active Director Product Delivery and Operations – Executed monthly, not to exceed the PoP

5.1.7 Identify Governance and Administration Modernization – Executed monthly, not to exceed the PoP

5.1.8 Active Directory Modernization Planning – Six months from date of exercise

7.0 Surge Support – Within 10 business days from date of exercise.

The overall Period of Performance shall not exceed 60 months.

The Contractor shall ensure resource availability during VA business hours (8:00am Eastern Time through 4:30PM Pacific Time), unless otherwise specified.

PLACE OF PERFORMANCE

Tasks under this PWS shall be performed in VA facilities located in <place(s) of performance>. Work may be performed at remote locations with prior concurrence from the Contracting Officer’s Representative (COR).

Tasks under this PWS shall be performed at Contractor facilities. The Contractor shall identify the Contractor’s place of performance in their proposal submission.

TRAVEL

The Government anticipates travel under this effort to perform the tasks associated with the effort, as well as to attend program-related meetings or conferences throughout the PoP. Include all estimated travel costs in your firm-fixed price line items. These costs will not be directly reimbursed by the Government.

The total estimated number of trips in support of the program related meetings for this effort is <please enter number of trips>. Anticipated locations include the following, estimated at <please enter duration of trips> days in duration:

1. <List location(s)> Travel shall be in accordance with the Federal Travel Regulations (FTR) and requires advanced concurrence by the Task Order COR. Contractor travel within the local commuting area will not be reimbursed.

SPECIFIC TASKS AND DELIVERABLES

The Application Services Domain delivers secure, high-performing, and compliant enterprise applications that power VA’s mission-critical systems. The Contractor shall support the Application Services domain in accordance with the following functional areas as defined in the parent contract PWS:

· Identity, Credential, and Access Management

· Infrastructure Vulnerability Management

· Certificate Management/Public Key Infrastructure

· Web Infrastructure and Administration

· Middleware

· Application Virtualization

· Printer Security Management

· Database Administration

· Operations Control

· Task Order Program Management

The Contractor shall support these areas in accordance with the specific tasks described below.

IDENTITY, CREDENTIAL AND ACCESS MANAGEMENT

The Contractor shall sustain, enhance, and operate the set of products that make up its Identity, Credential, and Access Management (ICAM) Services portfolio, while also ensuring the timely and reliable integration of those products with applications across the VA. The ICAM Services portfolio spans legacy and modern systems inclusive of Software-as-a-Service (SaaS), Commercial Off-the-Shelf (COTS) software and custom-developed software hosted in the VA Cloud.

VA requires continuous modernization efforts to build a cohesive ICAM platform leveraging modern tools, services, and processes to improve the VA’s cybersecurity posture, usability, and ease of access for VA systems, and improve cost efficiency and reduce technical debt. The Contractor shall maintain and operate both the legacy and modern systems and ensure the resilience of legacy ICAM products during the transition to modern solutions. Modernization tasks shall include, but are not limited to, transitioning legacy systems to cloud-based platforms, integrating new capabilities, and supporting surge operations.

The ICAM portfolio includes the following products:

· Internal Single Sign On (SSO) – Allows internal users, i.e. VA workforce, to authenticate to VA systems with their PIV cards or alternative Multi-Factor Authentication (MFA) credential.

· Currently implemented with Microsoft Entra ID, including tooling for configuration-as-code capabilities and integrations with VA identity services and legacy authentication flows. There is also limited us of legacy authentication services such as Active Directory Federation Services (ADFS) by applications that still need to be migrated to Entra ID.

· Currently supporting approximately 600k users and over 500m authentications per month, integrated with over 1,000 VA systems.

· External SSO – Allows external users, e.g. Veterans, to authenticate to VA systems with MFA and optionally identity verification.

· Currently implemented with Okta, including tooling for configuration-as-code capabilities and integration with 3rd-party Credential Service Providers, VA identity services, and legacy authentication flows.

· Currently supporting 3m users and approximately 10m authentications per month, integrated with over 200 VA systems.

· Identity Governance and Administration (IGA) – Facilitates identity lifecycle management and application access management, including access request and reviews.

· Currently implemented through both a legacy, custom-developed solution (Account Provisioning and Deprovisioning Systems, or APDS) as well as a modern, FedRAMP-authorized SaaS solution (Saviynt), which is in the process of being fully implemented as the modernized solution.

· Currently supporting onboarding 60% of all new users and managing access for approximately 50 different VA systems through APDS, will eventually be integrated with hundreds of VA systems.

· Enterprise Identity Datastore, i.e. VA Master Person Index (MPI) – Serves as the authoritative enterprise source for VA known identities and their traits/attributes.

· Correlate identity data from various sources including Department of Defense (DoD) and 3rd-party Cloud Service Providers, leveraging probabilistic matching through IBM Master Data Management for identity resolution and retrieval

· Implemented as a combination of COTS products and custom-built software and tooling.

· Currently managing over 85m unique identities, serving 900m transactions per month, integrated with over 200 applications.

· Enterprise Workforce Directory – Serves as the authoritative data source for VA workforce identities, devices, and policies.

· Currently implemented through an on-prem/VA Enterprise Cloud-hosted Active Directory (AD) environment and Microsoft Entra ID, with the latter as the future cloud-based solution. Also includes custom scripts and tooling to facilitate operational support for both regular and privileged users.

· Includes services such as Server Security Structures, Trust Relationships, Logon Authentication, Dynamic Host Configuration Protocol (DHCP), Domain Name Service (DNS), Browsers, Transmission Control Protocol/Internet Protocol (TCP/IP) in an AD environment, Domain Structures, and Domain Database Synchronization.

· Currently managing over 700k identities and 3.3m total objects across 34 domains in the on-premises environment, synced to Entra ID in both the Azure Commercial and Microsoft Azure for Government clouds.

· Privileged Access Management (PAM) – Provides password vaulting and other Privileged Access Management capabilities to allow the VA to manage over 15,000 privileged users and over 75,000 non-individually identifiable accounts.

· Currently implemented through CyberArk hosted across three VA data centers with approximately 150 servers, including password vault, Application Programming Interface (API) secrets management and vaulting, and threat analytics features. This suite provides centralized management of non-individually identifiable accounts and privileged accounts.

· Veteran Health Identification Card (VHIC) – Used to issue health identification cards for use at VA medical facilities to streamline the appointment check-in process. VHIC also serves as the system of record for Veteran photographs.

· Currently implemented as a custom-developed software solution.

All ICAM products and services will be operated following modern DevOps best practices and tools, such as configuration-as-code, and Agile delivery methods, meeting minimum availability targets to ensure the resilience of dependent VA systems. The Contractor shall provide Tier 3 operational support to ICAM services, with a focus on responsiveness and user satisfaction. The Contractor must ensure compliance with federal mandates, such as OMB M-19-17 and NIST SP 800-63-3, while also supporting ICAM program delivery, a cohesive customer experience for VA product and application teams integrating with ICAM services, digital identity risk assessments, policy development, and change management.

Technologies currently utilized by the ICAM portfolio include the following:

1. DataPower XML Security Gateway

2. F5 BIG-IP DNS

3. Java SE

4. Microsoft Internet Information Services (IIS)

5. Microsoft Windows Server

6. Microsoft PowerShell

7. Red Hat Enterprise Linux

8. Splunk Enterprise

9. Splunk Universal Forwarder

10. AppDynamics (AppD)

11. Ansible

12. Oracle Enterprise Manager

13. Java JRE

14. WebLogic Serve

15. Oracle Database

16. JasperReports Library

17. InfoSphere Master Data Management (MDM)

18. Websphere Application Server (WAS)

19. Apache Struts

20. Hibernate Object Relational Mapping (ORM)

21. Jagacy 3270

22. Web Access Manager Agent (formerly CA SSO Web Agent)

23. CA Directory/ Symantec Directory

24. Apache Tomcat

25. Bootstrap

26. Spring Framework

27. Apache HTTP Server

28. IBM Security Directory Server

29. IBM DB2

30. iText Core

31. JavaScript

32. J2EE, including Enterprise JavaBeans (EJB), Java Servlets, Java Server Pages (JSP), Struts

33. HyperText Markup Language (HTML) and Cascading Style Sheets

34. Relational databases and Structured Query Language (SQL)

35. Extensible Markup Language (XML) Schemas & Document Type Definition (DTD)

36. Junit

37. DataPower XI50/xI52

38. DataPower XML Security Gateway [IBM DataPower]

39. DB2 [IBM DB2 Universal Database Enterprise Server Edition]

40. IBM HTTP Server

41. Java DB [Apache Derby]

42. WildFly

43. Microsoft Azure, including Microsoft Entra ID

44. Amazon Web Services (AWS)

45. Okta Customer Identity Solution

46. Saviynt Identity Cloud

47. Microsoft Active Directory

48. CyberArk (Digital Vault, Privileged Vault Web Access, Privileged Threat Analytics, Central Policy Manager, Privileged Session Manager, Privileged Session Manager SSH, Application Access Manager, Conjur)

ICAM SERVICES AGILE PRODUCT DELIVERY AND OPERATIONS

The Contractor shall maintain and operate all ICAM products and services listed above following Agile delivery practices, meeting availability targets and addressing security issues in a timely manner, maintaining any VA-managed infrastructure following industry-standard best practices, and delivering new features and other improvements to meet product requirements. The ICAM product Enterprise Identity Datastore is current operated by Government personnel, the Contractor shall be required to provide these services should Optional Task under section 5.2.1.1 be exercised. The Contractor shall perform the following:

1. Product Management

· Produce and continuously enhance product and service roadmaps (ICAM Product Roadmaps) for each product and service in ICAM that align with business priorities and user needs. Roadmaps shall include key delivery milestones and objectives for each product and be updated quarterly.

· Develop and maintain a prioritized ICAM Product Backlog for each product containing user stories and epics that reflect the current and future needs of the organization and its users. The backlogs shall be updated and re-prioritized for every sprint.

· Facilitate iterative development sprints following modern agile processes and ceremonies, ensuring continuous improvement and alignment with goals. Each sprint for each product shall specify goals and progress on stories and shall be tracked in Jira (Sprint Goals and Jira Tracking).

· Ensure 90% completion of user stories and epics in VA’s Jira instance within each sprint as tracked against Sprint Goals.

· Develop and maintain ICAM Product Risk Registers tracking delivery risks for every sprint.

2. Human-Centered Design

· Develop user-centric solutions using personas, customer journeys, user research and usability testing.

· Maintain consistent look, feel, and digital accessibility in line with the VA Design System and VA Content Style Guide (https://design.va.gov/).

· Develop and conduct User Acceptance Testing (UAT) for completed user stories and system integrations, supporting Agile methodologies.

3. Development and Integration

· Deliver seamless software deployment processes across all environments including development, staging, and production, achieving continuous integration and continuous development (CI/CD) when possible to ensure timely updates, high-quality releases, and reduced downtime.

· Ensure all new features and enhancements are comprehensively tested using automated frameworks, aligning with Test-Driven Development practices.

· Ensure all production changes follow the OIT Change Control process and track all changes in a Change Log. Ensure 98% of monthly changes are completed successfully without requiring rollback.

· Achieve and maintain successful integrations of approximately 70 new applications annually with ICAM services, with a 5% anticipated annual growth rate. Examples of integrations include the following:

· Deploying a new VA application integration with Internal SSO to allow VA staff to authenticate.

· Updating the specific identity attributes a VA application receives in the authentication response from External SSO.

· Configuring a VA application to be able to query VA MPI and retrieve identity information about VA persons of interest.

· Integrating a new VA application with the IGA product to allow users to submit access requests and conduct periodic access reviews.

· Ensure that all configuration and sensitive data is stored in encrypted credential management systems with no inclusion in source code.

· Manage configuration changes for commercial tools that are part of ICAM products using configuration-as-code tools such as Terraform instead of manually through the user interface, to the extent that it is technically feasible.

4. System Availability and Reliability

· Achieve and maintain 99.99% availability for the production environment of Internal SSO, External SSO, and the Enterprise Identity Datastore.

· Achieve and maintain 99.9% availability for the production environment of all other ICAM products and services.

· Maintain 99% availability of non-production environments during 8 am – 8 pm Eastern Standard Time (EST), Monday through Friday.

· Provide Monthly Availability Report for all ICAM products and their different environments that tracks system availability against established Service Level Agreements (SLA).

5. Incident Response and Recovery

· Provide Incident Response and Disaster Recovery (DR) as per Authority To Operate (ATO) guidelines for each product.

· Conduct triage, troubleshooting, and resolution activities for incidents adhering to VA’s Major Incident Management process.

· Provide after-hours emergency support from 8 pm – 8 am ET Monday through Friday and 24-hour during weekends for all products and services.

· Provide Incident Review / After Action Reports within 2 hours of incident resolution and provide a detailed Root Cause Analysis within 24 hours.

· Follow VA policies and procedures as identified in VA Directive 6500, Handbook 6500, and all ATO documentation for reporting and responding to critical security incidents.

· Maintain technical and administrative documentation for all systems and products, including but not limited to ATO and other compliance documentation, DR plans, technical architecture, operational processes and procedures, technical decisions, project status reports.

· Perform annual DR test for each ICAM product or service to validate the accuracy of DR plans and the team’s readiness to execute it.

6. Infrastructure Management

· Install, configure, and manage ICAM portfolio server systems using automated tools and scripting languages such as PowerShell and Terraform.

· Administer updates, patches, and upgrades to VA-managed infrastructure, minimizing interruptions by scheduling during after-hours/weekends.

· Operate and manage all associated infrastructure, including virtual networking tools and services, application hosting, and databases in compliance with the VA’s Technical Reference Model (TRM) and Risk Management Framework (RMF).

· Implement and maintain comprehensive platform support automation, monitoring, logging, and alerting to ensure the resiliency of ICAM products.

7. Operational Support and Ticket Management

· Provide Tier 3 operational support, resolving 95% of high- and critical-priority tickets and 90% of all other tickets within SLA timeframes. Total ticket volume across all included products is approximately 65k-85k tickets annually.

· Maintain a ticket backlog below 200 tickets in 90% of months and below 300 tickets consistently.

· Track and report operational metrics such as ticket throughput, ticket backlog, response, and resolution times. Provide a Monthly Ticket Report with those metrics broken out by ICAM product.

· Provide regular notifications to impacted users during ticket resolution and maintain updated knowledge documentation.

· Manage user access to ICAM products in alignment with VA security policies and associated ATOs.

· Track and ensure compliance with Ticket SLAs as identified below:

· Normal Priority: First response within 1 business day and resolution within 7 business days.

· High Priority: First response within 30 minutes and resolution within 4 hours.

· Critical Priority: First response within 15 minutes and resolution within 1 hour.

· Examples of representative support tickets include:

· A VA employee has an issue authenticating via the Internal SSO product.

· A VA employee is encountering an error when submitting an access request.

· A Veteran’s identity attributes in VA MPI are incorrect and need to be updated to the correct values.

· A PAM user encounters an error accessing a resource with their privileged credential.

8. Data Management

· Ensure the integrity of all data in ICAM services, e.g. MPI and IGA, and address any requests for bulk validation or cleanup of invalid entries.

· Develop scripts and automated tools for routine data integrations and data validation and cleanup requests, including any documentation as needed.

· Ensure accurate reconciliation of identities across all ICAM services.

· Generate reports on user roles and entitlements for VA systems integrated with the IGA product and associated services.

9. Product-Specific Requirements

· Internal SSO & External SSO

· 90% or more of all configuration changes in production shall be implemented using configuration-as-code tools, instead of manually through SaaS UIs.

· PAM

· New accounts shall be onboarded within 6 business hours of request submission.

· 95% or more of accounts shall be maintained in a compliant status.

· Provide a monthly PAM Account report that includes onboarding times for each new account added and a list of accounts that are non-compliant.

Deliverables ICAM Product Roadmaps Monthly Availability Report Monthly Ticket Report

ACTIVE DIRECTORY PRODUCT DELIVERY AND OPERATIONS (OPTIONAL TASK)

The Contractor shall provide product delivery and operational support to the VA’s Enterprise Workforce Directory, as defined in Section 5.1 to include both the legacy Active Directory environment deployed to the VA Enterprise Cloud, as well as Microsoft Entra ID. The Enterprise Workforce Directory operational support generally handles approximately 30k-40k support tickets annually. The Contractor shall:

1. Meet an availability target of 99.9% for all production environments included in the Enterprise Workforce Directory product.

2. Follow all requirements and performance metrics defined in PWS Section 5.1.1. ICAM Services and Agile Product Delivery and Operations to meet the outcomes identified.

Deliverables Enterprise Workforce Directory Product Roadmap Enterprise Workforce Directory Monthly Availability Report Enterprise Workforce Directory Monthly Ticket Report

ICAM ENTERPRISE PROGRAM MANAGEMENT

The Contractor shall provide enterprise program management efforts to coordinate and manage VA’s ICAM overarching delivery and modernization efforts across all ICAM products, ensuring alignment with broader organizational goals and regulatory requirements. The Contractor shall:

· Develop and manage ICAM program-wide Key Performance Indicators (KPIs). This includes setting baselines, creating benchmarks, and developing outcome-based measurements to monitor and adjust ICAM efforts, ensuring alignment with enterprise OKRs. KPIs shall be continuously updated and maintained as ICAM and enterprise OKRs change.

· Create and maintain an ICAM program-wide Risk Register on a monthly basis to identify, track, and manage risks across all ICAM products and the overall program, aligned with the product-specific Risk Registers.

· Develop and maintain a comprehensive enterprise ICAM Program Roadmap driving cohesive and strategic ICAM implementation and aligned with the roadmaps for each individual ICAM product and enterprise strategic objectives.

Deliverable ICAM Program Roadmap

ICAM CUSTOMER EXPERIENCE AND CHANGE MANAGEMENT

The Contractor's customer experience support shall deliver seamless, positive experience throughout the ICAM product delivery process, ultimately enhancing user satisfaction and ensuring the products meet customer expectations effectively.

The Contractor shall:

1. ICAM Customer Relationship Management and Knowledge Base:

· Develop and update repository of key contacts and stakeholders of all application teams leveraging ICAM services, currently approximately 1,000 teams (ICAM Customer Repository).

· Actively engage customers through various channels to gather feedback and address issues. Maintain open communication lines to build trust and ensure transparency throughout the product delivery process.

· Develop and maintain a central Knowledge Base with Frequently Asked Questions (FAQ) and troubleshooting guides.

2. ICAM Transformation Communications:

· Develop and execute communication strategies for effective, accurate and timely ICAM updates using SharePoint, Teams FAQs, newsletters, etc.

· Respond to ad-hoc information requests and provide enterprise-wide access to ICAM policies and updates.

· Support strategic communications for release management, including change management and training. Include scripts, templates, and emails to address service requests efficiently.

· Report on communications metrics such as open rate, click rate, and page views (ICAM Communications Report) and maintain SharePoint and Teams sites, managing artifacts and user privileges.

· Develop and execute a customer satisfaction survey instrument, governance, and rollout plan. Initiate the rollout of customer satisfaction survey and continuously administer on a bi-monthly basis. Deliver survey insights and recommendations to support measurable and continuous improvements in ICAM services.

3. ICAM Guidance and Training:

· Deliver monthly training events and packages for ICAM users, coordinating with technical teams and stakeholders. On average, training events shall include 25-50 participants, and up to 5 trainings per month will be held.

· Develop role-specific training materials for ICAM products and services, including user guides and training modules.

· Offer online training sessions and produce training reports (ICAM Training Report) listing attendees and participation times for all trainings held.

· Create job aids, user guides, and Standard Operating Procedures (SOP) to support ICAM service implementation.

The Contractor shall support change management for ensuring the success of ICAM modernization, facilitating positive customer experiences while mitigating potential negative impacts. The Contractor shall perform the following migration and sunset activities:

· Plan and manage the transition from legacy to modernized ICAM services from start to finish, in collaboration with the associated product delivery teams.

· Develop decommissioning plans and provide implementation steps from planning to realization.

· Adjust existing business processes and develop release management plans, maintaining historical logs for traceability.

· Facilitate stakeholder engagement through working groups, leadership briefs, and stakeholder updates.

Deliverables Quarterly ICAM Communications Report Quarterly ICAM Training Report

ICAM INNOVATION SUPPORT

The Contractor shall support strategic planning for ICAM modernization and program activities through discovery, research, use-case development, and hosting Innovation Lab sessions to share opportunities and technological advances with VA leadership. The Contractor shall:

· Conduct thorough studies and analyses to identify innovative ICAM opportunities and provide a quarterly ICAM Innovations Report outlining those opportunities.

· Identify and develop use-cases for cutting-edge technologies, such as mobile-centric biometric authentication, to enhance trust, accountability, and end-user satisfaction.

· Organize and conduct innovation lab sessions (minimum one annually) to foster collaboration between ICAM subject matter experts and VA leadership. Facilitate discussions that enable informed decision-making on the integration of new tools, technologies, and processes in line with VA’s ICAM vision and provide a written executive read-out following the event.

Deliverables ICAM Innovations quarterly report Annual ICAM Innovation Lab read-out

DIGITAL IDENTITY RISK MANAGEMENT

The Contractor shall conduct and maintain processes to apply digital identity risk management as required by OMB Memorandum M-19-17, “Enabling Mission Delivery through Improved Identity, Credential, and Access Management (ICAM)”, and National Institute of Standards and Technology (NIST) Special Publication 800-63-3 Digital Identity Guidelines. The Contractor shall:

1. Maintain and update processes for Digital Identity Risk Assessments (DIRA) processes and conduct Digital Identity Risk Assessments for VA applications ensuring compliance with OMB 19-17 and NIST 800-63-3.

2. Conduct technical reviews of VA applications (60-70 annually) and evaluate which processes and technologies will be employed to meet each assurance level and document these decisions in a “Digital Identity Acceptance (DIA) Statement” to provide VA with a comprehensive assessment of their applications.

3. Deliver quality and timely technical reviews, effective guidance for stakeholders with clear action items, and feedback loops. Provide quarterly DIRA Assessment Report with assessments completed and response times.

4. Develop and provide program recommendations ensuring VA processes are compliant with NIST 800-63-3, including selection of assurance levels commensurate with the risk to VA’s digital service offerings.

Deliverable Quarterly DIRA Assessment Report

IDENTITY, SECURITY, AND DATA INTEGRATION RISK, REMEDIATION, COMPLIANCE, AND POLICY SUPPORT The Contractor shall help ensure ICAM products and services align and comply with Federal mandates, guidelines, and best practices. They shall also ensure that related VA policy is in compliance with Office of Inspector General (OIG) recommendations and aligns with federal requirements and guidance, including the FICAM Roadmap and Implementation Guidance, OMB M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management (ICAM),” NIST SP 800-63-3, Executive Order 14028, OMB M-22- 09, “Moving the U.S. Government Toward Zero Trust Cybersecurity Principles,” and NIST SP 800-207.

The Contractor shall:

Develop briefings, create action plans, and support meetings to address Notice of Findings (NFR) and material weakness remediation activities identified by Office of the Inspector General (OIG) and FISMA findings on access reviews, access termination, two factor authentication, and other ICAM areas Support ICAM audit reporting requirements, such as CIO reporting, CAP reporting, NFR reporting, ICAM self-assessments, and OMB reporting.

Maintain repository of Federal policy guidance and documentation of standards upon their release, such as NIST 800-63-3.

Develop, update, and maintain VA ICAM Policy 6510 Directive and Handbook, including coordinating review processes for policy updates leveraging VA’s VIEWS process, ensuring all comments are incorporated as VA ICAM comments into a policy package, ensuring proper documentation of comments and changes, briefing note(s), and concurrence sheet(s), and ensuring published policies are posted to the appropriate sources, including ICAM websites, VA Publication sites, SharePoint sites, and Teams channels.

Participate in federal and VA working groups, such as the ICAM Steering Committee (ICAMSC), Credential Provider Working Group (CPWG), Federal Public Key Infrastructure (FPKI) forums, joint DoD/VA ICAM working groups, and other VA-specific groups, and report back to VA ICAM stakeholders on meaningful results of meetings and any required actions.

Provide support with reviews and translation of federal guidelines, including those from the White House, Office of Management and Budget (OMB), Cybersecurity and Infrastructure Security Agency (CISA), National Institute of Standards and Technology (NIST), peer federal agencies, commercial sector best practices, and industry experts.

IDENTITY GOVERNANCE AND ADMINISTRATION (IGA) MODERNIZATION (OPTIONAL TASK)

The Contractor shall support VAs implementation of an enterprise solution based on the Saviynt Enterprise Identity Cloud SaaS tool that will provide IGA capabilities to all estimated 1100 VA applications. This shall require integrating and connecting Saviynt to the many systems required for key features of the IGA System such as access reviews, access requests, identity lifecycle management (provisioning and deprovisioning), and automated workflows. The Contractor shall develop and deploy all required capabilities within the Saviynt SaaS tool and facilitate a smooth transition to sustainment and operations of new capabilities in the Saviynt-based IGA platform, following Agile best practices and other requirements as stated in PWS Section 5.2.1. ICAM Services and Agile Product Delivery and Operations. These transitions are broken out into 2 categories:

1. Legacy APDS Transition – The Contractor will be responsible for fully implementing all required capabilities within Saviynt to replace APDS and migrate all integrations and existing identity management capabilities from APDS to Saviynt so that APDS can be decommissioned. It is estimated that the modernization effort to fully transition APDS to the Saviynt-based IGA platform will require 12 months. Estimated breakdown of Contractor configuration effort and application summary:

2. Integration of Other Existing Systems and Applications - The Contractor will be responsible for integrating and connecting over 1100 applications that do not currently leverage APDS. It is estimated that the modernization effort to fully transition APDS to the Saviynt-based IGA platform will require 24 months. Estimated breakdown of configuration and application summary:

The following documentation will be available as part of the transition to the Contractor under this scope of work.

· Product documentation including product outlines/briefings, OKRs, roadmaps and active epics/stories, stakeholder landscape maps, decision records, and analytics.

· Developer documentation including READMEs, set-up instructions, diagrams, relevant databases and services.

· Design documentation including prototypes, user research reports, design decisions for products in production, early designs for incomplete products, content strategy, and records of interactions with the collaboration cycle.

· Access to accounts for third-party products such as tooling or SaaS products that will be taken over by the new team.

The Contractor shall be responsible for:

· Produce and continuously enhancing the IGA Modernization Product Roadmap aligning with business priorities and user needs. The IGA Modernization Product Roadmap shall include key delivery milestones and objectives and be updated quarterly.

· Develop and maintain a prioritized IGA Modernization Product Backlog containing user stories and epics that reflect the current and future needs of the organization and users. The backlogs shall be updated and reprioritized for every sprint.

· Facilitate iterative development sprints following modern agile processes and ceremonies, ensuring continuous improvement and alignment with goals. Each sprint for each product shall specify goals and progress on stories and shall be tracked in Jira (Sprint Goals and Jira Tracking).

· Ensure 90% completion of user stories and epics in VA’s Jira instance within each sprint as tracked against Sprint Goals.

· Develop and maintain an IGA Modernization Product Risk Register tracking delivery risks for every sprint.

Deliverable IGA Modernization Product Roadmap

ACTIVE DIRECTORY MODERNIZATION PLANNING (OPTIONAL TASK)

VA’s Enterprise Workforce Directory is currently in a hybrid state, with a substantial on-premises Active Directory implementation spanning 34 domains, over 23,000 Organizational Units, nearly 8,000 Group Policy Objects, nearly 700 domain controllers, and almost 700k identities. In addition, the VA is leveraging Microsoft Entra ID as the future workforce Identity platform for both Single Sign-On and Enterprise Directory capabilities.