36C10B18Q3124-0001001.pdf

36C10B18Q3124 0001

5. PROJECT NUMBER (if applicable)

CODE 7. ADMINISTERED BY

2. AMENDMENT/MODIFICATION NUMBER

CODE

6. ISSUED BY

8. NAME AND ADDRESS OF CONTRACTOR

4. REQUISITION/PURCHASE REQ. NUMBER 3. EFFECTIVE DATE

9A. AMENDMENT OF SOLICITATION NUMBER

9B. DATED

PAGE OF PAGES

10A. MODIFICATION OF CONTRACT/ORDER NUMBER

10B. DATED

BPA NO. 1. CONTRACT ID CODE

FACILITY CODE CODE

Offers must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended, by one of the following methods:

The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offers

E. IMPORTANT:

is extended,

(a) By completing Items 8 and 15, and returning __________ copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted; or (c) By separate letter or electronic communication which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR

ACKNOWLEDGMENT TO BE RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY is not extended.

12. ACCOUNTING AND APPROPRIATION DATA

(REV. 11/2016)

is required to sign this document and return ___________ copies to the issuing office. is not, A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE CONTRACT ORDER NO. IN ITEM 10A.

15C. DATE SIGNED

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES

SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(b).

RESULT IN REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by letter or electronic communication, provided each letter or electronic communication makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER

BY

Contractor

16C. DATE SIGNED

14. DESCRIPTION OF AMENDMENT/MODIFICATION

16B. UNITED STATES OF AMERICA

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15A. NAME AND TITLE OF SIGNER 16A. NAME AND TITLE OF CONTRACTING OFFICER

15B. CONTRACTOR/OFFEROR

STANDARD FORM 30 PREVIOUS EDITION NOT USABLE

Prescribed by GSA - FAR (48 CFR) 53.243

(Type or print) (Type or print)

(Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

(Number, street, county, State and ZIP Code)

(If other than Item 6)

(Specify type of modification and authority)

(such as changes in paying office, appropriation date, etc.)

(If required)

(SEE ITEM 11)

(SEE ITEM 13)

(X)

CHECK

ONE

13. THIS ITEM APPLIES ONLY TO MODIFICATIONS OF CONTRACTS/ORDERS,

IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

(Signature of person authorized to sign) (Signature of Contracting Officer)

1 71

TAC-18-49850

Department of Veterans Affairs

Technology Acquisition Center

23 Christopher Way

Eatontown NJ 07724

Department of Veterans Affairs

Technology Acquisition Center

23 Christopher Way

Eatontown NJ 07724

To all Offerors/Bidders

36C10B18Q3124

X

X

See continuation page

CONTINUATION PAGE:

The purpose of this Amendment A0001, to Request for Quote (RFQ) 36C10B18Q3124 titled

“VA API Development and Operations,” is as detailed below. All changes to RFQ

36C10B18Q3124 have been captured in track changes.

1. Performance Work Statement (PWS) Paragraphs 3.0 Scope of Work and 5.3 VA API Gateway

Development and Operations – Optional Task (Labor Hour) are hereby revised to clarify the use of alternative API Gateway products.

2. PWS Paragraph 5.1.3, Key Personnel: The statement for “The Contractor shall identify statement of qualification for individuals that will fulfill the key personnel positions identified below” is hereby deleted.

3. PWS Paragraph 5.2.1 API Development is hereby revised to clarify the VA Product team and the Contractor sprint team shall determine the acceptance criteria for the sprint and populate the

Sprint Backlog in the sprint planning meeting.

2. Section E.10, Quote Submission Requirements, has been revised to clarify the three sections as (i) Technical; (ii) Price Factors; and (iii) Solicitation, Quote, and Award Documents and certifications/representations.

5. The Quote Due Date is hereby extended to September 10, 2018 at 12:00PM EST.

Except as provided herein, all other terms and conditions of RFQ 36C10B18Q3124 remain unchanged and in full force and effect.

B.5 PERFORMANCE WORK STATEMENT

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS (VA)

Office of Information & Technology

Enterprise Program Management Office (EPMO)

VA API Development and Operations

Date: August 320, 2018

TAC-18-49850

Version Number: 1.10

1.0 BACKGROUND

The Department of Veterans Affairs (VA) requires Contractor support to design, develop, and maintain various aspects of the VA Application Programming Interface (API) platform, including but not limited to platform design, API development and maintenance, developer documentation, and product management best practices to work with teams internal and external to VA, using modern software development methods and tools.

From shopping for car insurance, to paying bills online, to scheduling a dentist appointment, Americans expect the places where they do business to offer easy-to-use, secure digital tools.

Veterans, caregivers, Servicemembers, Veterans Service Organizations (VSO), and VA’s other users are no different; they expect VA to offer a digital experience on par with the private sector companies they interact with in their day-to-day lives.

VA is taking an API-first strategy to deliver the high quality digital experiences our users expect.

A single set of APIs will power every VA digital service, and these same APIs will be exposed to approved third parties to build products and applications on top of VA services and data.

These APIs across every vertical of VA’s business will enable VA users to receive a consistent, high quality experience across all VA communication channels (e.g., digital, phone, mail, in-person, etc.).

The health industry is quickly converging on the Fast Healthcare Interoperability Resources

(FHIR) standard to enable enhanced data interoperability between both internal and external systems. API-enabled and FHIR based solutions are easier for developers to implement as it makes use of modern web standards and RESTful architectures with more easily understood specifications. By liberating data and enhancing interoperability with FHIR, VA will shift data ownership to Veterans, making it more readily available.

In the benefits space, VSOs and other third parties spend significant amounts of time manually looking in VA systems to check on the status of a claim for a Veteran they are working with, or to find out if a rating has been granted. If VA were instead able to provide APIs to this information, authorized individuals and organizations would be able to access it more readily, improving the experience they can provide for Veterans and reducing VA costs.

Finally, one of VA’s core competencies should be “knowing and sharing what we know” about a

Veteran, including data such as service history, accurate mailing address, and disability ratings.

VA should be able to share this information with Veterans and Veteran-authorized third parties.

Veterans should not need to upload a Department of Defense Form 214 (DD214) to a website to prove their military service history or discharge status, which is not only difficult for some

Veterans but also presents identity theft risks by needlessly sharing personally identifiable information (PII). With APIs, VA plans to put this data back in the hands of Veterans so that they can use it more efficiently and securely, resulting in a better, more personalized digital experience for Veterans.

This contract is not for creating a specific number of APIs, or APIs in a single domain, but rather for agile, cross-functional teams that can work alongside a VA product team to prioritize, build, operate, and iterate on APIs across many parts of VA. It will include creating new APIs, refactoring or replatforming existing APIs, building on top of existing APIs, and/or working with other teams to improve their APIs and/or expose their data in a modern way.

2.0 APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. “Federal Information Security Modernization Act of 2014”

2. Federal Information Processing Standards (FIPS) Publication 140-2, “Security

Requirements For Cryptographic Modules”

3. FIPS Pub 200, Minimum Security Requirements for Federal Information and

Information Systems, March 2016

4. FIPS Pub 201-2, “Personal Identity Verification of Federal Employees and

Contractors,” August 2013

5. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

6. Public Law 109-461, Veterans Benefits, Health Care, and Information Technology

Act of 2006, Title IX, Information Security Matters

7. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”

8. VA Handbook 0710, Personnel Security and Suitability Security Program, May 2,

9. Office of Management and Budget (OMB) Circular A-130, “Managing Federal

Information as a Strategic Resource,” July 28, 2016

10. An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule, October 2008

11. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended by the Workforce Investment Act of 1998 (P.L. 105-220), August 7, 1998

12. VA Handbook 6500, “Risk Management Framework for VA Information Systems –

Tier 3: VA Information Security Program,” March 10, 2015

13. VA Handbook 6500.1, “Electronic Media Sanitization,” November 03, 2008

14. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal

Information (SPI)”, July 28, 2016

15. VA Handbook 6500.3, “Assessment, Authorization, And Continuous Monitoring Of

VA Information Systems,” February 3, 2014

16. VA Handbook 6500.5, “Incorporating Security and Privacy in System Development

Lifecycle”, March 22, 2010

17. VA Handbook 6500.6, “Contract Security,” March 12, 2010

18. VA Handbook 6500.8, “Information System Contingency Planning”, April 6, 2011

19. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

20. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy

Impact Assessment,” October 15, 2014

21. VA Handbook 6508.1, “Procedures for Privacy Threshold Analysis and Privacy

Impact Assessment,” July 30, 2015

22. VA Handbook 6510, “VA Identity and Access Management”, January 15, 2016

23. VA Handbook, 6300.1, Records Management Procedures, March 24, 2010

24. NIST SP 800-37, Guide for Applying the Risk Management Framework to Federal

Information Systems: a Security Life Cycle Approach, June 10, 2014

25. NIST SP 800-53 Rev. 4, Security and Privacy Controls for Federal Information

Systems and Organizations, January 22, 2015

26. OMB Memorandum, “Transition to IPv6”, September 28, 2010

27. VA Directive 0735, Homeland Security Presidential Directive 12 (HSPD-12)

Program, October 26, 2015 https://www.va.gov/trm/TRMHomePage.aspx

28. OMB Memorandum M-07-16, Safeguarding Against and Responding to the Breach of Personally Identifiable Information, May 22, 2007

29. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, Digital Identity Guidelines, June

30. Trusted Internet Connections (TIC) Reference Architecture Document, Version 2.0, Federal Interagency Technical Reference Architectures, Department of Homeland

Security, October 1, 2013, https://s3.amazonaws.com/sitesusa/wp-content/uploads/sites/482/2015/04/TIC_Ref_Arch_v2-0_2013.pdf

31. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote

Access”, January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

32. “Veteran Focused Integration Process (VIP) Guide 2.0”, May 2017, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

33. VA Memorandum “Use of Personal Email (VAIQ #7581492)”, April 24, 2015, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

34. VA Memorandum “Updated VA Information Security Rules of Behavior (VAIQ

#7823189)”, September, 15, 2017, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

35. API Best Practices

a. 18 F API Standards (https://github.com/18F/api-standards)

b. WH API Standards https://github.com/WhiteHouse/api-standards

36. Building Twelve-Factor App (https://12factor.net/).

37. Experience with incorporating and using open source technologies

(https://sourcecode.cio.gov/OSS/).

38. The Agile Manifesto (http://www.agilemanifesto.org/)

39. The U.S. Digital Services Playbook (https://playbook.cio.gov/)

40. The Techfar Hub (https://techfarhub.cio.gov/)

41. VA Enterprise Cloud (VAEC) Technical Reference Guide for Acquisition Support, October 2017 (Attachment 001)

3.0 SCOPE OF WORK

The Contractor shall provide VA with agile development and operations of APIs and support for the VA API Gateway. This includes project management, product management, requirements refinement, human centered design, iterative development, user research and usability testing, standards enforcement, automated testing, performance metrics definition and reporting, automated monitoring and performance reporting, and continuous integration / continuous delivery (CI/CD) for the development and enhancement of APIs and the API Gateway.

Through the Government’s prioritization of the backlog, the Contractor shall prioritize execution of all aspects of the API Gateway. The Contractor shall also work to ensure that all APIs are deployed or migrated into a VA designated cloud.

The Government will provide the Contractor with access to the VAEC to include the credits required for all VAEC cloud development, testing, and production environment requirements.

The VAEC includes a secure dedicated Wide Area Network connection between VA and the

VAEC Cloud Service Provider (CSP). The Contractor shall not be responsible for buying cloud credits for this contract. The VAEC is currently supported by two Federal Risk and

Authorization Management Program (FedRAMP) High Certified and VA ATO approved CSPs.

Both VAEC environments provide access to all of each CSP's FedRAMP Authorized Services in their respective cloud to implement the proposed solution. In addition, each VAEC CSP provides https://s3.amazonaws.com/sitesusa/wp-content/uploads/sites/482/2015/04/TIC_Ref_Arch_v2-0_2013.pdf https://s3.amazonaws.com/sitesusa/wp-content/uploads/sites/482/2015/04/TIC_Ref_Arch_v2-0_2013.pdf https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371 https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 https://github.com/18F/api-standards) https://github.com/WhiteHouse/api-standards https://12factor.net/) https://sourcecode.cio.gov/OSS/ http://www.agilemanifesto.org/ http://www.agilemanifesto.org/) https://playbook.cio.gov/ https://playbook.cio.gov/) https://techfarhub.cio.gov/) a set of common shared services such as security scanning; Active Directory and single-sign

(SSO); PIV integration; and performance monitoring to facilitate solution implementation.

Specifications for each VAEC CSP, including access requirements, will be provided at the project kick off meeting.

A Minimum Viable Product (MVP) API Gateway has already been stood up in AWS but the contractor may propose the use of a different VAEC cloud if they can demonstrate how the alternative will provide equal to or superior performance than AWS at equal to or lower cost to the Government, including transition costs. The MVP API Gateway is using open-source Kong, but the Contractor may propose the use of other API Gateway products if they can demonstrate how the product and platform will provide equal to or superior performance than Kong and adequately present to the Government the value of utilizing the alternative products.

at equal to or lower cost to the Government, including transition costs.

The Contractor’s support and solutions shall align with the U.S. Digital Services Playbook

(https://playbook.cio.gov). The Contractor shall be familiar with the concepts in each play and implement them in its approaches and support.

4.0 PERFORMANCE DETAILS

This is a hybrid Firm-Fixed Price (FFP)/Time-and-Materials (T&M)/Labor-Hour type contract.

4.1 PERFORMANCE PERIOD

The Period of Performance shall consist of one 12-month period.

There are 10 Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, four are set by date:

New Year's Day January 1

Independence Day July 4

Veterans Day November 11

Christmas Day December 25

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

Martin Luther King's Birthday Third Monday in January

Washington's Birthday Third Monday in February

Memorial Day Last Monday in May

Labor Day First Monday in September

Columbus Day Second Monday in October

Thanksgiving Fourth Thursday in November

4.2 PLACE OF PERFORMANCE

Tasks under this PWS may be performed at Contractor facilities. The Contractor is expected to attend in-person VA meetings and / or working sessions as requested by VA.

https://playbook.cio.gov/

4.3 TRAVEL

The Government anticipates travel under this effort to perform the tasks associated with the effort, as well as to attend program-related meetings or conferences throughout the PoP. The meeting locations shall be located in Washington, DC. The Contractor shall include all estimated travel costs in its FFP line items. These costs will not be directly reimbursed by the

Government. The following is the estimated travel for the FFP portion of the effort.

Purpose Number of

Trips

TT TTrips

Number of Days

Number of

Staff

Kick-off Meeting 1 1-3 4

Quarterly Program Reviews 4 1-3 4

5.0 SPECIFIC TASKS AND DELIVERABLES

The Contractor shall perform the following:

5.1 PROJECT MANAGEMENT

5.1.1 REPORTING REQUIREMENTS

The Contractor shall deliver Monthly Status Reports. These reports shall provide accurate, timely, and complete project information supporting reporting Requirements. The Monthly

Status Report shall include the following data elements and reporting capability shall address the below requirements:

a. Project Name

b. Overview and description of the contract

c. Overall high-level assessment of contract progress

d. All work in-progress and completed during the reporting period

e. Identification of any contract related issues uncovered during the reporting period and especially highlight those areas with a high probability of impacting schedule, cost or performance goals and their likely impact on schedule, cost, or performance goals

f. Explanations for any unresolved issues, including possible solutions and any actions required of the Government and/or Contractor to resolve or mitigate any identified issue, including a plan and timeframe for resolution

g. Status on previously identified issues, actions taken to mitigate the situation and/or progress made in rectifying the situation.

h. Work planned for the subsequent two reporting periods, when applicable

i. Provide expenditures based upon your proposed spend plan.

j. Workforce staffing data showing all Contractor personnel performing on the effort by task during the current reporting period along with status of their background investigation/VA clearance and biographies. After the initial labor baseline is provided, each Monthly Status Report shall identify any changes in staffing identifying each person who was added to the contract or removed from the contract.

k. Original schedule of deliverables at the start of each sprint and the corresponding deliverables made during the current reporting period.

l. Cost analysis that includes consumption of cloud resources by API.

m. Software licenses at or nearing end of life and software security certificates nearing expiration.

The Contractor shall communicate with VA so that issues that arise are transparent to both parties to prevent escalation of outstanding issues.

For each T&M/Labor-Hour task, indicate:

a. Summary of work performed

b. Expenditures for the reporting period, to include prime labor and each subcontractor identified separately

c. Contract Line Item Number expenditure

d. Burn rate

e. Percentage of work completed

Deliverable:

A. Monthly Status Report

5.1.2 TECHNICAL KICK-OFF MEETING

The Contractor shall conduct a kick-off meeting with the VA PM, Contracting Officer’s

Representative (COR) and the Contracting Officer (CO). The meeting shall be held within 10 business days after contract award. The kick-off meeting shall be an in-person meeting in a VA or

VA-approved Contractor facility. The Contractor shall propose an agenda for VA COR approval three days prior to the meeting. The Contractor shall provide meeting minutes capturing discussion, agreements, and action items resulting from the kick-off meeting. The kick-off meeting shall address post award topics and shall present the Contractor’s draft plans and approach for meeting PWS requirements.

5.1.3 KEY PERSONNEL

Specific expertise and experience in product management, engineering, and operating highly available products is essential for accomplishing the tasks outlined in this PWS. The Contractor shall identify statements of qualifications for individuals that will fulfill the key personnel positions identified below.

Key Roles:

• Product Manager:

o Experience managing entire agile software development lifecycle for a project of at least one million dollars up to and including production delivery and some phase of post-delivery support.

o Experience as a product manager accountable for delivery with at least 10 software professionals with a duration of greater than one year.

o Demonstrated success with delivering digital products.

• Chief Engineer:

o Background as a Software Engineer for at least five years, including experience as a Software Engineer for at least one project in one of the VAEC’s CSP Vendors

Clouds.

o Chief Architect or Senior Engineer on a production system in one of the VAEC

CSP Vendors Clouds.

o Demonstrated knowledge and use of modern software development and Dev/Ops tools, including GitHub.

• Chief Operations Manager:

o Background as a Software Engineer, Site Reliability Engineer, or DevOps

Engineer for at least three years.

o Experience running a 24x7 Software based System for at least 6 months.

o Experience with oversight of an operations team of at least 5 people for at least one year.

o Experience in Incident Management for a software based system.

o Experience with oversight of a team running a trouble ticket system.

o Demonstrated success using modern DevOps methods and tools including automated testing tools and monitoring tools.

o Demonstrated ability to drive frequent release cycles (daily / weekly)

Any personnel the Contractor offers as substitutes shall have the ability and qualifications equal to or better than the key personnel which are being replaced. If any change to a key personnel position becomes necessary, the Contractor shall immediately notify the VA PM and COR in writing, but whenever possible Contractor shall notify the VA PM of substitutions in personnel in writing 30 calendar days prior to making any change in key personnel, and provide a detailed explanation of the circumstances necessitating the proposed substitution and shall demonstrate that the proposed replacement personnel are of at least substantially equal ability and qualifications as the individual originally proposed for that position.

The Contractor agrees that it has a contractual obligation to mitigate the consequences of the loss of Key Personnel and shall promptly secure any necessary replacements in accordance with

(IAW) this PWS section. Failure to replace a Key Person pursuant to this clause and without a break in performance of the labor category at issue shall be considered a condition endangering contract performance and may provide grounds for termination for cause.

5.1.4 PRIVACY AND HIPAA TRAINING

The Contractor shall submit status of VA Privacy and Information Security Awareness training for all individuals engaged on the task. The status reporting shall identify; a single Contractor

Security Point of Contract, the names of all personnel engaged on the task, their initial training date for VA Privacy and Information Security training, and their next required training date. This information shall be submitted as part of the Weekly/ Progress Status Report.

The Contractor shall submit Talent Management System (TMS) training certificates of completion for VA Privacy and Information Security Awareness training. The Contractor shall also provide VA Privacy and Information Security Awareness Signed Rules of Behavior, and

VA Health Insurance Portability and Accountability Act (HIPAA) Certificate of Completion

IAW Section 9, Training, from Appendix C of the VA Handbook 6500.6, “Contract Security”.

Deliverables:

A. TMS Training Certificates of Completion for VA Privacy and Information Security

Awareness Training

B. VA Privacy and Information Security Awareness Signed Rules of Behavior

C. VA HIPAA Certificate of Completion

5.2 VA API Development & Operations

VA is taking an API-first strategy to deliver the high quality digital experiences our users expect.

A single set of APIs will power every VA digital service, and these same APIs will be exposed to approved third parties to build products and applications on top of VA services and data.

These APIs across every vertical of VA’s business will enable VA users to receive a consistent, high quality experience across all VA communication channels (e.g., digital, phone, mail, in-person, etc.).

5.2.1 API Development

The Contractor shall provide cross-functional Contractor Sprint Teams for the development of

VA APIs. This contract is not for creating a specific number of APIs, or APIs in a single domain, but rather for agile, cross-functional teams that can work alongside a VA product team to prioritize, build, operate, and iterate on APIs across many parts of VA. It will include creating new APIs, refactoring or replatforming existing APIs, building on top of existing APIs, and/or working with other teams to improve their APIs and/or expose their data in a modern way. The specific scope of functionality of the tasks will be determined by VA API Product Owners and the VA PM/COR, prior to sprint commencing. At the beginning of each two-week sprint, each

Contractor Sprint Team shall initiate, coordinate, and participate in a Sprint Planning Meeting and develop a Sprint Plan with the VA Project Team, including the VA PM, COR, designated

VA Product Owner and additional stakeholders, to plan the work to be accomplished for the sprint. Additionally, the VA Product team and the Contractor Sprint team shall determine the acceptance criteria for the sprint and populate the Sprint Backlog in the sprint planning meeting.

The Contractor, in collaboration with the VA Project Team, shall prioritize a backlog, estimate the relative complexity of each task, and determine the amount of work that can be accomplished in a two-week sprint. All activity scheduled in each sprint and backlog shall be captured and have status showing all work items, changes, and impediments. The Contractor shall update the

Sprint Plan at the conclusion of the sprint planning. Once the Sprint Plan is accepted by the VA

PM/COR and the VA Product Team, the sprint backlog may change throughout the duration of the sprint, however, the effort of work will remain constant.

The Contractor shall provide a Sprint Demonstration that confirms all functionality developed in the sprint is operational. At the Sprint Demonstration, the Contractor Sprint Team shall submit a

Sprint Certification Package to the VA PM/COR for review and approval.

The Sprint Certification Package shall include a summary of the planned, accomplished, and unaccomplished work for the two-week sprint to include issues encountered and corrective actions taken as well as all artifacts produced, including any and all code (submitted to a VA source code repository, such as GitHub), during the sprint. This package, certification that all work is completed, and a demonstration that all work planned for the sprint has been fully implemented, are necessary for sprint acceptance by the Government. The Contractor shall complete all work planned for each sprint and receive VA PM/COR approval of the Sprint

Certification Package for the prior sprint before beginning a new sprint.

Specifically, the Contractor shall support the building and maintaining of APIs as products, including:

a. Discovery - Conduct discovery activities on existing VA APIs as well as internal and external business process flows and functions. Work closely with VA customers to understand their needs and how those map to VA capabilities. Collect available data, user feedback, and VA stakeholder feedback and capture in a Discovery Report.

b. Product Roadmap - A comprehensive list of the APIs and API functionality that needs to be built or updated and prioritization of these based on Discovery that has happened.

c. Coordination - Participate in VA stakeholder meetings, some of which will be in-person at VA facilities, to plan building and integrating the services and change management activities including but not limited to managing agendas, minutes, action items, and collaboration tool management meetings.

d. Mock API development – Mock proposed APIs to receive feedback from potential consumers and iterate on designs quickly prior to beginning software development.

e. Code Development - Define, author, and deliver code in a way that meets private sector best practices, meets the needs of the users, and conforms to the requirements and architecture provided by the government; ensure peer reviews for code quality;

incorporate testing into code development, including security scans. The Contractor shall follow an agile methodology that may result in several production releases in each sprint.

The Contractor shall adhere to objectives defined in the U.S. Digital Services Playbook, as well as VA’s VIP policy. All Contractor team members shall be proficient on VA tools, including GitHub, and all code should be developed in the open.

f. Integration Support – Integrate with external systems and other VA systems as needed to access appropriate data, including configuring, testing, and documenting the integration.

g. Data Migration – Develop, implement, and document any necessary data migration strategies/plan(s).

h. Deployment Activities - Plan for, create and validate the implementation and deployment instructions for use during service deployment. All deployment steps should be instrumented as infrastructure as code.

i. DevOps – Work collaboratively and cross functionally with other contractor engineering and DevOps teams to implement CI/CD processes.

j. Metrics Reporting – Develop and communicate product metrics. Metrics may include but are not limited to how many users are using the product, transactions performed, concurrent users, and value provided to the VA and API consumers. This task includes identifying and measuring baseline metrics for comparison.

k. Communication - Participating in integrated program/project teams and/or Scrum teams to enhance communication, share lessons learned, and facilitate rapid identification and mitigation of dependencies between various functional entities. The includes communication internal and external to VA.

l. Documentation - Work with the Government to architect and document, in the API

Documentation, the API design specifications, including all data elements that the services provide or read.

Rights in Computer Software:

The Contractor is required to deliver the APIs, technical data, configurations, documentation or other information, including source code, during contract performance. The Government shall receive Unlimited Rights in intellectual property first produced and delivered in the performance of this contract in accordance with FAR 52.227-14, Rights In Data-General (DEC 2007). This includes all rights to source code and any and all documentation created in support thereof. License rights in any Commercial Computer Software shall be governed by FAR

52.227-19, Commercial Computer Software

A. Sprint Plan

B. Product Roadmap

C. Discovery Reports

D. API Documentation

E. Sprint Certification Package and Artifacts

F. API Code

5.2.1.1 API MARKETING, OUTREACH, AND PRODUCT MANAGEMENT

The success of VA’s APIs will be determined by the value they deliver to both VA and its customers. Thus, getting API consumers using the APIs and providing those consumers with a positive experience is crucial to the success of VA’s API Program.

The Contractor shall provide:

a. Communication with current and potential API consumers to understand their needs and how VA can best work with them.

b. Outreach and marketing materials to inform current and potential API consumers about what is available and the value of using VA’s APIs.

c. Onboarding for new consumers, as they learn about and use VA APIs.

d. Working with internal and external customers to define and measure Key Performance

Indicators (KPIs) for each stage of the API customer marketing funnel and reporting out on KPI status to internal and external audiences.

e. Measuring customer satisfaction with APIs built and determining how to maximize customer satisfaction.

f. Evangelize VA APIs internally and externally to VA

5.2.2 API OPERATIONS

The Contractor shall manage and operate the APIs they develop for the life of this contract, as well as the existing three APIs that were created for the minimum viable product. The

Contractor shall maintain and operate multiple environments for its APIs including, but not limited to the following environments, stood up as part of the MVP:

• Development (will not necessarily be connected to VA internal systems)

• Staging

• Production

These environments are already set up and connected to the VA network; the Contractor shall build off these existing environments rather than starting from scratch. The Contractor shall ensure that all software associated with maintaining and operating VA APIs is delivered and tracked on VA approved version control systems, such as GitHub.

The Contractor shall ensure all API Service Level Agreements, as defined below, are met, and that the APIs function correctly.

The Contractor shall:

a. Provide 24x7 Production support for VA APIs they built and manage

b. Provide Database Administration (DBA) support to cloud-based and hosted database systems for VA APIs, as needed.

c. Provide non-production environment support during normal VA business hours (8 am – 8 pm

EST).

d. Work collaboratively with VA support-related stakeholders including but not limited to VA call centers, VA Customer Relationship Management (CRM) systems, VA customer service platforms, and other VA teams as needed.

e. Monitor system, network, application, database logs, and SLA metrics via VA approved monitoring tools and provide a real-time dashboard available to all program stakeholders.

f. Write and monitor synthetic monitoring scripts for VA infrastructure, APIs, and applications.

g. Provide external systems integration support through configuring, testing, and documenting the integration.

h. Perform infrastructure, operating system, and product updates, upgrades, and patches without system downtime.

i. Document in the Monthly Status Report support metrics including but not limited to: number of issues reported, problem type identification, % resolved, time for resolution, priority, severity, etc. as requested

j. Perform postmortems of any outages occurred, including root cause analysis and steps to prevent future outages

The Contractor shall provide an SLA Monitoring Plan that defines how SLA metrics will be monitored throughout the performance of the requirements, including the automated testing tools and automated SLA testing scripts that shall be used. The Contractor shall provide the SLA

Monitoring Plan to the VA PM/COR for review and approval. Upon approval, the Contractor shall implement SLA monitoring IAW the approved plan and establish an SLA Dashboard that provides real time SLA metrics data available to all program stakeholders. The Contractor shall provide a VA API SLA Report monthly which shall capture data as specified in the Deliverable

Metrics/SLAs.

A. SLA Monitoring Plan

B. Monthly VA API SLA Report

C. Postmortems

DELIVERABLE METRICS/SLAs:

Service Availability: All deployed services shall be available and functional to serve user requests at no less than 99.9% availability. An external entity shall be able to access and receive a successful response to all APIs deployed to this platform at all times. As available on a per API basis, sample transactions or health check endpoints that are exposed to external entities shall be evaluated to determine if the response is successful. Services that are faulted due to an external entity shall have trouble tickets logged with the responsible party, with all outage time attributable to this team until the ticket is logged with the responsible entity. An automated test, IAW the approved SLA Monitoring Plan, with an execution frequency of no more than 300 seconds, and the logged reports of execution, including timing details, of that test shall be provided in the VA API SLA Report. Any faulted services attributed to an external entity shall include a record of the trouble ticket that was issued to the responsible party. This record shall include the time that it was filed, and if resolved, the time of resolution. Any maintenance window outages due to upstream or downstream maintenance shall include a record of the notification that was distributed to VA Stakeholders, and the time which the record was distributed.

Service Reachability: Services on this platform shall be reachable by internal and external entities no less than 99.9% of the time. All required routing and proxying services are correctly functioning and forwarding traffic. Services that are faulted due to an external entity shall have trouble tickets logged with the responsible party, with all outage time attributable to this team until the ticket is logged with the responsible entity. Services that are unavailable due to upstream maintenance must have an outage notification to all VA stakeholders prior to the maintenance window for attribution to the upstream team. The Contractor shall have access to the Government’s published maintenance windows times and dates upon award. An automated test, IAW the approved SLA Monitoring Plan, and the logged reports of execution, including timing details, of that test shall be provided in the VA API SLA Report.

Development Environment Availability: The APIs shall be available in the staging environment during normal VA business hours (7 am – 9 pm EST). An external entity shall be able to log into the environment, execute build and deploy jobs in the development enclave, and observe the results of those jobs with no less than 99.0% availability. An automated test, IAW the approved SLA Monitoring Plan, and the logged reports of execution, including timing details, of that test shall be provided in the VA API Platform SLA Report.

5.2.2.1 AUTHORITY TO OPERATE

The Contractor shall develop and maintain Application/Infrastructure security documentation in support of achieving and maintaining an Authority to Operate (ATO) for the API platform, inclusive of all APIs developed within it. The current MVP APIs and API Gateway are already covered by an existing full ATO at VA, which should continue to be used and updated as needed.

a. Comply with VA ATO process.

b. Use VA FISMA control tracking system as the security documentation repository to complete and update security controls.

c. Coordinate with the VA security office and adhere to its policies.

d. Complete all VA required training (i.e. on-boarding, security, ethics, etc.) as well as provide certificates of completion to the COR.

e. Create, as directed, a wide variety of National Institute of Standards and Technology

(NIST) SP800-Series security artifacts per FISMA requirements for VA systems.

f. Enter data into the VA security documentation repository, which is currently known as

RiskVision and runs on a Trusted Agent FISMA application.

g. Manually review upcoming due dates for security artifacts and work with system maintainers or appropriate representatives to ensure artifacts are updated annually.

h. Support, and develop annual attestation documentation in conjunction with the system maintainer and business owner.

i. Peer review security artifacts and provide feedback to document authors.

j. Coordinate and lead quarterly familiarization exercise for Contingency Plan and Incident

Response Plan.

k. Provide security documentation reporting to PMs, Information Security officers (ISO), and others.

l. Update existing Privacy Impact Analysis (PIA), System Security Plan (SSP) documents and create new PIA documents as required in support of VA apps.

m. Update ATO package as necessary

A. ATO Package Documentation

5.2.2.2 MONITORING AND ALERTING

The Contractor shall support VA requirements for monitoring VA APIs, using the VAEC supported monitoring tools and processes as they exist and evolve over time. Monitoring tools may include native CSP monitoring tools (See Attachment 001 for additional details).

Additionally, the Contractor shall integrate all logs with appropriate monitoring tools such as

Grafana, Prometheus, Splunk, and/or ElasticSearch. The Contractor shall create queries to support dashboards, reporting, and proactive alert generation based on system, operations, security and business needs.

a. Create synthetic scripts to obtain real-life metrics and statistics and create dashboards, monitoring, API reporting, and proactive alerting based on synthetic script monitoring tools utilized.

b. Utilize monitoring plugins and agents to monitor numerical metrics provided by external services, servers, or equipment to collect more in-depth metrics.

c. Use Email, Short Message Service (SMS), and other methods, such as Pagerduty, for alerting schedules, escalation policies and services that escalate system, infrastructure, or security issues to a VA API on-call engineer. The Contractor shall acknowledge all alerts and remediate all issues IAW VA requirements

d. Establish and participate in monitoring of other VA upstream partner systems.

e. Assist application development teams to identify proper reporting metrics and alerts to isolate external decencies from internal services.

f. Provide assistance to internal and external teams to resolve issues during outages affecting external systems.

g. Provide an API Response Time Monitoring Report, appended to the Monthly Status

Report, that provides API response time frames at the 50th, 75th, 95th, and 99th percentiles for each API.

5.2.2.3 COST AND COMPUTE OPTIMIZATION AND REPORTING

The Contractor shall review all usage of cloud computing services provided by VA associated with this effort. Plans shall be submitted and implemented quarterly on how to best optimize the environment to reduce the costs associated with resource utilization. The Contractor shall provide a breakdown of all costs by API, environment, and utilization and shall report on utilization of each class of resource as a percentage of provisioned capacity in a Monthly

Utilization Report.

The Contractor shall, as part of its VA API SLA Report, include the total infrastructure expenditure and total number of request services for Cloud Resource Optimization.

A. Quarterly Resource Utilization Optimization Plan

B. Monthly Utilization Report

5.2.2.4 SECURITY OPERATIONS AND MONITORING AND MANAGEMENT

The Contractor shall provide support for security operations and monitoring of VA APIs.

a. Assign a Security officer to manage all security related task.

b. Provide 24x7x365 on call staffing for response to alerts from Network Operations Center

(NOC) and/or Security Operations Center (SOC).

c. Create 24x7x365 automated monitoring and alerting

d. Continuously monitor and report the security status of the system on a regular and ad-hoc basis.

e. Provide Remediation and documentation of findings in the security assessment reports as requirement.

f. Identify and report any incidents using existing tools and strategies IAW the VA incident handling policies (VA Handbook 6500.5)

g. Conduct regular infrastructure, network and code scanning/penetration to report any security vulnerabilities based on result reports with a recommendation and/or corrective plan of action.

h. The Contractor shall proactively prepare for and actively participate in interviews, examinations, testing and reviews from the auditing community. This supports external and internal audit activities, Office of Inspector General (IG) audits, FISMA audits, third-party audits and self-assessments. The Contractor shall also support evolving VA automated security requirements such as open controls, security compliance masonry.

i. Update security documentation.

j. Create a monthly Security Assessment Report that includes:

• Number of Incidents

• Number Anomalies

• Results of Penetration test

• System down time

• Provide Remediation and documentation of findings in the security assessment reports as requirement.

A. Monthly Security Assessment Report

5.3 VA API GATEWAY DEVELOPMENT AND OPERATIONS -

OPTIONAL TASK 1 (LABOR-HOUR)

The Contractor shall develop, deploy, and maintain an API Gateway that enables developers to publish, monitor, and secure APIs across VA Enterprise. This API Gateway shall handle all the tasks involved with accepting and processing concurrent API calls, including traffic management, authorization and access control, monitoring, rate limiting, API version management, and any other features required across all VA APIs. An MVP API Gateway using open-source Kong has been stood up, but the Contractor may propose the use of other API

Gateway products if they can demonstrate how the product and platform will provide equal to or superior performance than Kong and adequately present to the Government the value of utilizing the alternative products. at equal to or lower cost to the Government, including transition costs.

The Contractor shall build the API Gateway to scale based on demand, and handle API requests from any authorized consumer, internal or external to VA.

The API Gateway shall be hosted at api.va.gov and shall be the single connection point for any consumer to interact with VA’s APIs. The API Gateway does not include business or orchestration logic, which are covered in section 5.2 of this PWS. The development of this gateway shall follow an agile process and best practices from the U.S. Digital Service Playbook, but may not be in specific two-week sprints, depending on the amount of work needed; this optional task is therefore Labor Hour instead of Firm Fixed Price. The Operations of this API

Gateway shall comply with all requirements in 5.2.2 (including sub-tasks) above. The API

Gateway shall exist within the same VAEC environments and monitoring and alerting stack set up for and used in PWS Task 5.2.2; this task is only for API Gateway specific needs or requirements.

5.4 API SUPPORT TASKS - OPTIONAL TASK 2 (LABOR-HOUR)

5.4.1 API DEVELOPER PORTAL

The Contractor shall build and/or iterate on an API Developer Portal for internal and external customers to learn about the VA API platform functionality and processes and be able to use the

API in a self-service capacity. This portal shall expose documentation from individual APIs to consumers in a consistent, easily understandable and usable experience, and provide information about how to use VA’s APIs from both a technical and policy perspective. An MVP developer portal has been stood up and is accessible at https://developer.va.gov. The Contractor shall utilize an agile development process including creation of a backlog of features and capabilities to be presented to the VA PM and COR for review and approval prior to development commencing.

5.4.2 GOVERNANCE AND TECHNICAL SUPPORT

The Contractor shall provide support, as needed, to ensure VA has the necessary API governance in place to create a world-class API program. As defined by the VA Product Owner, this could include documenting API best practices or API standards.

Technical guidance to the product owner and development teams building other APIs and applications on top of the VA API Gateway. Defining architectural changes as needed across VA based on industry best practices and working with VA teams to implement needed changes.

5.4.3 SOFTWARE LICENSE MANAGEMENT - OPTIONAL TASK 3 (T&M)

The Contractor is responsible for procuring, managing, migrating, modifying, and terminating

VA API Gateway software licenses as required. The Contractor shall coordinate with other contractors and vendors as necessary to support the procurement, management, migration, modification and termination of the software licenses. Any licenses procured for the proposed

API Gateway solution shall be licensed for the benefit of VA. The software licenses listed may change over time and may be substituted for more current versions, quantities, via modification to the contract. Some necessary software licenses may include:

a. Licenses for an API Gateway, which can be open source or commercial, as defined by the

Contractor in their proposal.

b. Licenses needed for building, deploying, and operating the VA API Gateway to maintain defined SLAs (separate from what is already procured for the API Operations in 5.2.2, which is included in that price).

All software licenses procured by the Contractor on behalf of VA in support of API Gateway shall be transferred to the Government at the end…