36C10B18R2609-A0002002.pdf

36C10B18R2609 A0002

5. PROJECT NUMBER (if applicable)

CODE 7. ADMINISTERED BY

2. AMENDMENT/MODIFICATION NUMBER

CODE

6. ISSUED BY

8. NAME AND ADDRESS OF CONTRACTOR

4. REQUISITION/PURCHASE REQ. NUMBER 3. EFFECTIVE DATE

9A. AMENDMENT OF SOLICITATION NUMBER

9B. DATED

PAGE OF PAGES

10A. MODIFICATION OF CONTRACT/ORDER NUMBER

10B. DATED

BPA NO. 1. CONTRACT ID CODE

FACILITY CODE CODE

Offers must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended, by one of the following methods:

The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offers

E. IMPORTANT:

is extended,

(a) By completing Items 8 and 15, and returning __________ copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted; or (c) By separate letter or electronic communication which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR

ACKNOWLEDGMENT TO BE RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY is not extended.

12. ACCOUNTING AND APPROPRIATION DATA

(REV. 11/2016)

is required to sign this document and return ___________ copies to the issuing office. is not, A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE CONTRACT ORDER NO. IN ITEM 10A.

15C. DATE SIGNED

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES

SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(b).

RESULT IN REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by letter or electronic communication, provided each letter or electronic communication makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER

BY

Contractor

16C. DATE SIGNED

14. DESCRIPTION OF AMENDMENT/MODIFICATION

16B. UNITED STATES OF AMERICA

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15A. NAME AND TITLE OF SIGNER 16A. NAME AND TITLE OF CONTRACTING OFFICER

15B. CONTRACTOR/OFFEROR

STANDARD FORM 30 PREVIOUS EDITION NOT USABLE

Prescribed by GSA - FAR (48 CFR) 53.243

(Type or print) (Type or print)

(Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

(Number, street, county, State and ZIP Code)

(If other than Item 6)

(Specify type of modification and authority)

(such as changes in paying office, appropriation date, etc.)

(If required)

(SEE ITEM 11)

(SEE ITEM 13)

(X)

CHECK

ONE

13. THIS ITEM APPLIES ONLY TO MODIFICATIONS OF CONTRACTS/ORDERS,

IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

(Signature of person authorized to sign) (Signature of Contracting Officer)

1 47

A0002

TAC-18-45446

Department of Veterans Affairs

Technology Acquisition Center

23 Christopher Way

Eatontown NJ 07724

Department of Veterans Affairs

Technology Acquisition Center

23 Christopher Way

Eatontown NJ 07724

To all Offerors/Bidders

36C10B18R2609

08-14-2018

X

X X

August 22, 2018 3:00PM EST

SEE CONTINUATION PAGE

CONTINUATION PAGE

The purpose of this Amendment A0002, to Request for Proposal (RFP) 36C10B18R2609 titled

“VA Mobile Applications Cloud Migration (MACM),” is as detailed below. All changes to RFP

36C10B18R2609 have been captured in track changes.

1. Section B.5 Performance Work Statement, Paragraph 4.3 Travel

a. “Number of Days” column is hereby added to the estimated travel table.

2. Section B.5 Performance Work Statement, Paragraph 5.1.2 Reporting Requirements

a. The reference to Bi-Weekly Status report is hereby revised to Monthly Status

Report.

3. Section B.5 Performance Work Statement, Paragraph 5.1.4 Key Personnel

a. The Chief Cloud Architect requirement reference to VAEC AWS is hereby revised to AWS GovCloud.

4. Section B.5 Performance Work Statement, Paragraph 5.2 VA MACM Platform

Development and App Migration

a. “The Contractor may be required to perform 1-4 sprints in parallel” is hereby revised to “The Contractor may be required to staff 1-4 Sprint Teams in parallel”

5. Section B.5 Performance Work Statement, Paragraph 5.2.2 Mobile Application Migration

a. The requirement “Upon approval and acceptance by the VA PM/COR that the migrated app is working in all MACM environments, the Contractor shall decommission the successfully migrated app from the IBM Terremark environment. Where there is physical hardware associated with the app at IBM

Terremark, the physical hardware shall also be decommissioned by the

Contractor,” is hereby removed.

6. Section B.5 Performance Work Statement, Paragraph 5.3.1 VA MACM Operations and

System Maintenance Support

a. The Development environment requirement “will not be connected to VA” is hereby removed.

7. Section B.5 Performance Work Statement, Paragraph 5.3.1 VA MACM Operations and

System Maintenance Support – Deliverable Metric/SLA Development Environment

Availability

a. “All working hours” is hereby revised to “normal VA Business hours (7 am – 9 pm EST).

8. Section B.5 Performance Work Statement, Paragraph 5.3.3 Disaster Recovery and

Continuity of Operations

a. Paragraph (d) is hereby revised to, “Provide system details that includes a detailed representation of key infrastructure and networking configurations and requirements”

b. Paragraph (e) is hereby revised to, “Document failover and failback procedures that includes a step-by-step recovery and restoration process in the DR and

Backup Plan”

c. Paragraph (e) is hereby revised to include the failover and failback procedures as part of the DR and Backup Plan.

9. Section B.5 Performance Work Statement, Paragraph 5.3.4 Monitoring and Alerting –

Deliverable Metric/SLA Data Collection Monitoring

a. The Deliverable Metric/SLA is hereby revised as follows: “The Contractor shall collect data from all instrumented sources, with an aggregate frequency loss of no more than 300 seconds over a 24-hour period.”

10. Section B.5 Performance Work Statement, Paragraph 5.3.5 Software License

Management (T&M)

a. Paragraph (j) is hereby removed.

11. Section B.5 Performance Work Statement, Paragraph 5.3.6 Engineering Technical

Support – Deliverable Metric/SLA Ticket Time to Close

a. The Deliverable Metric/SLA is hereby revised as “Tickets opened for this team for action related to the development environment receive a timely resolution. The

95th percentile of tickets has a resolution time less than minimum acceptable performance level which is 3 days.”

12. Section B.5 Performance Work Statement, Paragraph 5.4.2 Change Management –

Deliverable Metric/SLA Change Control Ticket Response

a. The Deliverable Metric/SLA is hereby revised as “Tickets opened for this team for change control action receive a timely response. The 95th percentile of tickets has a response time less than the minimum acceptable performance level of one day.”

13. Section B.5 Performance Work Statement, Paragraph 6.4.1 Deliverable Metrics/Service

Level Agreements Performance

a. Paragraph 6.4.1 hereby incorporates the following: “The Contractor will not be faulted for lower service levels that occur due to external circumstances beyond the Contractor’s control.”

b. Paragraph 6.4.1 hereby incorporates the following: “Measurement of Deliverable

Metrics/SLAs shall begin 30 days after Government acceptance of the VA

MACM MVP.”

14. Section D, Attachment 006 - VA MACM Excel Price Evaluation Spreadsheet is hereby revised under Attachment 006 - VA MACM Excel Price Evaluation Spreadsheet A0002 as follows:

a. Labor Category: Security Analyst, Senior is hereby incorporated into Performance

Work Statement, Paragraph 5.5 Tier 4 Help Desk Support (Optional Task) –

Labor-Hour to tabs “T&M and Labor Hour Rate Table” and “Labor Hour Labor”

b. Tab “T&M and Labor Hour Definitions” is hereby incorporated into Attachment

15. Section E.14, Proposal Submission, Paragraph (2)(c)(i)(1) is hereby revised as follows:

The Offeror shall provide a detailed technical approach to the development and provisioning of the VA MACM Minimum Viable Product (MVP) and container orchestration platform IAW with PWS Task 5.2 and 5.2.1. The Offeror’s approach shall include its planned consumption/use of VAEC-AWS cloud service credits and its proposed model of application federation across the VA Network.

The Offeror shall specifically detail the AWS cloud services and cloud service quantities required to develop the proposed VA MACM MVP.

16. Section E.14 Proposal Submission, Paragraph (2)(c)(v) Volume V – Solicitation, Offer and Award Documents and Certifications/Representations

a. Paragraph (e) is hereby incorporated to include “Screen shots of the proposed prices out of the AWS estimating tool for the date the estimate was developed.”

17. The solicitation is hereby extended to close on August 22, 2018 3:00PM EST.

Except as provided herein, all other terms and conditions of RFP 36C10B18R2609 remain unchanged and in full force and effect.

B.5 PERFORMANCE WORK STATEMENT

DEPARTMENT OF VETERANS AFFAIRS (VA)

Office of Information & Technology

Enterprise Program Management Office (EPMO)

VA Mobile Applications Cloud Migration (MACM)

Date: 8/14/2018

TAC-18-45446

Version Number: 2.0

1.0 BACKGROUND

The Department of Veterans Affairs (VA) continuously seeks ways to improve the services provided to Veterans and their families. VA is using mobile technologies to transform the

Veteran experience by improving access to VA resources need wherever they are needed.

VA’s Office of Information and Technology (OIT) has partnered with VHA’s Office of

Connected Care (OCC) to establish a VA Mobile Infrastructure (VA MIS) platform currently hosted by Booz Allen Hamilton and International Business Machines (IBM) Terremark. The VA

MIS is a General Support System (GSS) in Assessment and Authorization/Authority to Operate

(A&A / ATO) terminology, and acts as an umbrella for sharing common controls and management across multiple enclaves and major applications (apps). Currently, VA MIS uses dedicated hosting resources identified in Attachment 001 – Current Servers and Attachment 002

– Current Software Inventory to this document for hosting all mobile apps and supporting web services in the production pipeline. Currently there are between 20 and 30 mobile apps supporting services hosted in the VA Mobile Framework (VAMF) production environment.

The VA MIS Platform currently consists of three enclaves (two internal and one external):

• External Cloud Environment (ECE), which allows mobile app users demonstrations and agile development with no connectivity back to VA’s network.

• Mobile Application Environment (MAE) for web and mobile app development.

• VAMF for production web and mobile apps.

In addition to the current operational environments in the VA MIS platform, additional environments are being commissioned in the VA Enterprise Cloud (VAEC), located in Amazon

AWS GovCloud (VAEC-AWS) and Microsoft Azure Government Cloud (VAEC-AZC). These environments will host all new app deployments and will eventually be utilized to host all services currently located in ECE, MAE, and VAMF. VA has begun a migration effort for the

VA Online Scheduling (VAOS) based on Kubernetes (K8S), GitHub Enterprise, Unbound DNS, and AWS CLI and the following open source technologies: Consul, Vault, Packer, Terraform (all from HashiCorp) Nexus, Jenkins, Ansible.

The replacement solution for the VA MIS platform shall be the VA Mobile Applications Cloud

Migration (MACM) as described in this PWS. VA requires the implementation, phasing in, and migration of mobile apps and supporting services into an operational VA MACM. OIT’s ultimate goal is to achieve a Continuous Integration/Continuous Deployment (CI/CD) platform through hosting technologies within VAEC-AWS and VAEC-AZC as part of the VAEC. A full break down between VAEC and VA MACM contractor responsibilities is detailed in the “VAEC

Technical Reference Guide for Acquisition Support” dated October 2017 (Attachment 003).

2.0 APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. 44 U.S.C. § 3541-3549, “Federal Information Security Management Act (FISMA) of

2002”

2. “Federal Information Security Modernization Act of 2014”

3. Federal Information Processing Standards (FIPS) Publication 140-2, “Security

Requirements For Cryptographic Modules”

4. FIPS Pub 199. Standards for Security Categorization of Federal Information and

Information Systems, February 2004

5. FIPS Pub 200, Minimum Security Requirements for Federal Information and

Information Systems, March 2016

6. FIPS Pub 201-2, “Personal Identity Verification of Federal Employees and

Contractors,” August 2013

7. 10 U.S.C. § 2224, "Defense Information Assurance Program"

8. Carnegie Mellon Software Engineering Institute, Capability Maturity Model®

Integration for Development (CMMI-DEV), Version 1.3 November 2010; and

Carnegie Mellon Software Engineering Institute, Capability Maturity Model®

Integration for Acquisition (CMMI-ACQ), Version 1.3 November 2010

9. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

10. Public Law 109-461, Veterans Benefits, Health Care, and Information Technology

Act of 2006, Title IX, Information Security Matters

11. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”

12. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, http://www.va.gov/vapubs/

13. VA Handbook 0710, Personnel Security and Suitability Security Program, May 2, 2016, http://www.va.gov/vapubs

14. VA Directive and Handbook 6102, “Internet/Intranet Services,” July 15, 2008

15. 36 C.F.R. Part 1194 “Electronic and Information Technology Accessibility

Standards,” July 1, 2003

16. Office of Management and Budget (OMB) Circular A-130, “Managing Federal

Information as a Strategic Resource,” July 28, 2016

17. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed

Services (CHAMPUS)”

18. An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule, October 2008

19. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended by the Workforce Investment Act of 1998 (P.L. 105-220), August 7, 1998

20. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

21. VA Directive 6500, “Managing Information Security Risk: VA Information Security

Program,” September 20, 2012

22. VA Handbook 6500, “Risk Management Framework for VA Information Systems –

Tier 3: VA Information Security Program,” March 10, 2015

23. VA Handbook 6500.1, “Electronic Media Sanitization,” November 03, 2008

24. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal

Information (SPI)”, July 28, 2016

25. VA Handbook 6500.3, “Assessment, Authorization, And Continuous Monitoring Of

VA Information Systems,” February 3, 2014

26. VA Handbook 6500.5, “Incorporating Security and Privacy in System Development

Lifecycle”, March 22, 2010

27. VA Handbook 6500.6, “Contract Security,” March 12, 2010

28. VA Handbook 6500.8, “Information System Contingency Planning”, April 6, 2011

29. OI&T Process Asset Library (PAL), https://www.va.gov/process/ . Reference

Process MACMs at https://www.va.gov/process/MACMs.asp and Artifact templates at https://www.va.gov/process/artifacts.asp

30. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

31. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy

Impact Assessment,” October 15, 2014 http://www.va.gov/vapubs/ http://www.va.gov/vapubs http://www.va.gov/vapubs https://www.va.gov/process/ https://www.va.gov/process/maps.asp https://www.va.gov/process/artifacts.asp https://www.va.gov/trm/TRMHomePage.aspx

32. VA Handbook 6508.1, “Procedures for Privacy Threshold Analysis and Privacy

Impact Assessment,” July 30, 2015

33. VA Handbook 6510, “VA Identity and Access Management”, January 15, 2016

34. VA Directive 6300, Records and Information Management, February 26, 2009

35. VA Handbook, 6300.1, Records Management Procedures, March 24, 2010

36. NIST SP 800-37, Guide for Applying the Risk Management Framework to Federal

Information Systems: a Security Life Cycle Approach, June 10, 2014

37. NIST SP 800-53 Rev. 4, Security and Privacy Controls for Federal Information

Systems and Organizations, January 22, 2015

38. OMB Memorandum, “Transition to IPv6”, September 28, 2010

39. VA Directive 0735, Homeland Security Presidential Directive 12 (HSPD-12)

Program, October 26, 2015

40. VA Handbook 0735, Homeland Security Presidential Directive 12 (HSPD-12)

Program, March 24, 2014

41. OMB Memorandum M-06-18, Acquisition of Products and Services for

Implementation of HSPD-12, June 30, 2006

42. OMB Memorandum 04-04, E-Authentication Guidance for Federal Agencies, December 16, 2003

43. OMB Memorandum 05-24, Implementation of Homeland Security Presidential

Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal

Employees and Contractors, August 5, 2005

44. OMB memorandum M-11-11, “Continued Implementation of Homeland Security

Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for

Federal Employees and Contractors, February 3, 2011

45. OMB Memorandum, Guidance for Homeland Security Presidential Directive

(HSPD) 12 Implementation, May 23, 2008

46. Federal Identity, Credential, and Access Management (FICAM) Roadmap and

Implementation Guidance, December 2, 2011

47. NIST SP 800-116, A Recommendation for the Use of Personal Identity Verification

(PIV) Credentials in Physical Access Control Systems, November 20, 2008

48. OMB Memorandum M-07-16, Safeguarding Against and Responding to the Breach of Personally Identifiable Information, May 22, 2007

49. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, Digital Identity Guidelines, June

50. NIST SP 800-157, Guidelines for Derived PIV Credentials, December 2014

51. NIST SP 800-164, Guidelines on Hardware-Rooted Security in Mobile Devices

(Draft), October 2012

52. Draft National Institute of Standards and Technology Interagency Report (NISTIR)

7981 Mobile, PIV, and Authentication, March 2014

53. VA Memorandum, VAIQ #7100147, Continued Implementation of Homeland

Security Presidential Directive 12 (HSPD-12), April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

54. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

55. VA Memorandum “Mandate to meet PIV Requirements for New and Existing

Systems” (VAIQ# 7712300), June 30, 2015, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4846 https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514 https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4846

56. Trusted Internet Connections (TIC) Reference Architecture Document, Version 2.0, Federal Interagency Technical Reference Architectures, Department of Homeland

Security, October 1, 2013, https://s3.amazonaws.com/sitesusa/wp-content/uploads/sites/482/2015/04/TIC_Ref_Arch_v2-0_2013.pdf

57. OMB Memorandum M-08-05, “Implementation of Trusted Internet Connections

(TIC), November 20, 2007

58. OMB Memorandum M-08-23, Securing the Federal Government’s Domain Name

System Infrastructure, August 22, 2008

59. VA Memorandum, VAIQ #7497987, Compliance – Electronic Product

Environmental Assessment Tool (EPEAT) – IT Electronic Equipment, August 11, 2014 (reference Document Libraries, EPEAT/Green Purchasing Section, https://www.voa.va.gov/documentlistpublic.aspx?NodeID=552)

60. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (Public

Law 110–140), December 19, 2007

61. Section 104 of the Energy Policy Act of 2005, (Public Law 109–58), August 8, 2005

62. Executive Order 13693, “Planning for Federal Sustainability in the Next Decade”, dated March 19, 2015

63. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 2, 2001

64. VA Directive 0058, “VA Green Purchasing Program”, July 19, 2013

65. VA Handbook 0058, “VA Green Purchasing Program”, July 19, 2013

66. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote

Access”, January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

67. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

68. VA Memorandum, “Implementation of Federal Personal Identity Verification (PIV)

Credentials for Federal and Contractor Access to VA IT Systems”, (VAIQ#

7614373) July 9, 2015, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

69. VA Memorandum “Mandatory Use of PIV Multifactor Authentication to VA

Information System” (VAIQ# 7613595), June 30, 2015, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

70. VA Memorandum “Mandatory Use of PIV Multifactor Authentication for Users with Elevated Privileges” (VAIQ# 7613597), June 30, 2015;

https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

71. “Veteran Focused Integration Process (VIP) Guide 2.0”, May 2017, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

72. “VIP Release Process Guide”, Version 1.4, May 2016, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4411

73. “POLARIS User Guide”, Version 1.2, February 2016, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4412

74. VA Memorandum “Use of Personal Email (VAIQ #7581492)”, April 24, 2015, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

75. VA Memorandum “Updated VA Information Security Rules of Behavior (VAIQ

#7823189)”, September, 15, 2017, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

76. API Best Practices

a. 18 F API Standards (https://github.com/18F/api-standards)

b. WH API Standards https://github.com/WhiteHouse/api-standards

77. Building Twelve-Factor App (https://12factor.net/).

https://s3.amazonaws.com/sitesusa/wp-content/uploads/sites/482/2015/04/TIC_Ref_Arch_v2-0_2013.pdf https://s3.amazonaws.com/sitesusa/wp-content/uploads/sites/482/2015/04/TIC_Ref_Arch_v2-0_2013.pdf https://www.voa.va.gov/documentlistpublic.aspx?NodeID=552 https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4411 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4412 https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 https://github.com/18F/api-standards) https://github.com/WhiteHouse/api-standards https://12factor.net/)

78. Experience with incorporating and using open source technologies

(https://sourcecode.cio.gov/OSS/).

79. The Agile Manifesto (http://www.agilemanifesto.org/)

80. Project Management Institute (PMI) Project Management Body of Knowledge

(PMBOK) (https://www.pmi.org/)

81. The U.S. Digital Services Playbook (https://playbook.cio.gov/)

82. The Techfar Hub (https://techfarhub.cio.gov/)

83. VA Enterprise Cloud (VAEC) Technical Reference Guide for Acquisition Support, October 2017 (Attachment 003)

84. Best Practices for Agile Practices (Attachment 004)

85. VA MACM Maintenance Definitions (Attachment 005).

3.0 SCOPE OF WORK

The Government requires a VA MACM solution that will be comprised of three environments, Development, Staging and Production, hosted in the VAEC. There will be approximately 20 -

30 mobile responsive web apps hosted in the MACM in addition to the services needed to support these apps.

The Contractor shall implement, operate, and maintain the VA MACM including all cloud services required to support VA MACM operations. The Contractor shall migrate mobile apps and supporting services into an operational VA MACM. The Contractor shall provide operations and maintenance (O&M) support of all VA MACM cloud environments as well as the infrastructure software contained within each environment. The Contractor shall provide all software and support required to create and maintain an operational VA MACM as described in this PWS. This effort also includes an optional task for transition out services.

The Government will provide the Contractor with access to the VAEC to include the credits required for all VAEC cloud development, testing, and production environment requirements.

The VAEC includes a secure dedicated Wide Area Network connection between VA and the

VAEC Cloud Service Provider (CSP). The Contractor shall not be responsible for buying cloud credits for this contract. The VAEC is currently supported by two Federal Risk and

Authorization Management Program (FedRAMP) High Certified and VA ATO approved CSPs.

Both VAEC environments provide access to all CSP's FedRAMP Authorized Services in each respective CSP cloud to implement the proposed solution. In addition, each VAEC CSP provides a set of common shared services such as security scanning; Active Directory and single-sign

(SSO); PIV integration; and performance monitoring to facilitate solution implementation.

Specifications for each VAEC CSP, including access requirements, will be provided at the project kick off meeting and in Attachment 003 to this document. For this effort the Contractor is required to utilize the VAEC-AWS environment for its platform and the Contractor shall be provided credits to the VAEC-AWS as Government Furnished Equipment (GFE) during contract performance.

4.0 PERFORMANCE DETAILS

This is a hybrid Firm-Fixed Price (FFP)/Time-and-Materials (T&M)/Labor-Hour type contract.

Only tasks identified as T&M shall be on a T&M basis.

4.1 PERFORMANCE PERIOD

https://sourcecode.cio.gov/OSS/ http://www.agilemanifesto.org/ http://www.agilemanifesto.org/) https://www.pmi.org/ https://www.pmi.org/) https://playbook.cio.gov/ https://playbook.cio.gov/) https://techfarhub.cio.gov/)

The Period of Performance (PoP) shall be a base of 12 months followed by four (4) 12-month option periods. There are 10 Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, four are set by date:

New Year's Day January 1

Independence Day July 4

Veterans Day November 11

Christmas Day December 25

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

Martin Luther King's Birthday Third Monday in January

Washington's Birthday Third Monday in February

Memorial Day Last Monday in May

Labor Day First Monday in September

Columbus Day Second Monday in October

Thanksgiving Fourth Thursday in November

4.2 PLACE OF PERFORMANCE

Tasks under this PWS shall be performed at Contractor facilities. The Contractor shall identify the Contractor’s place of performance in their submission.

4.3 TRAVEL

The Government anticipates travel to perform the tasks associated with the effort, as well as to attend program-related meetings or conferences throughout the PoP. The meeting locations shall be located in St. Petersburg, Florida or Washington DC. The Contractor shall include all estimated travel costs in its FFP line items. These costs will not be directly reimbursed by the

Government. The following is the estimated travel for the FFP portion of the effort.

Purpose Number of Trips

TT

TTrips

Number of Days

Number of Staff

Base/Option

Kick-off Meeting 1 1-3 4 Base

Quarterly Program Reviews 4 1-3 4 Base and Option

5.0 SPECIFIC TASKS AND DELIVERABLES

The Contractor shall perform the following:

5.1 PROJECT MANAGEMENT

5.1.1 CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the

Contractor’s approach, timeline and tools to be used in execution of the contract. The CPMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks and resource support. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPMP shall be concurred upon by the VA Program

Manager (PM). The VA PM will provide detailed comments on the initial baseline CPMP, which shall be incorporated in the operational CPMP. The CPMP shall be updated based on input provided by the VA PM and shall be updated and maintained monthly thereafter throughout the PoP.

Deliverable:

A. Contractor Project Management Plan

5.1.2 REPORTING REQUIREMENTS

The Contractor shall deliver Monthly Status Reports. These reports shall provide accurate, timely, and complete project information supporting reporting Requirements. The Bi-

WeeklyMonthly Status Report shall include the following data elements and reporting capability shall address the below requirements:

a. Project Name

b. Overview and description of the contract

c. Overall high-level assessment of contract progress

d. All work in-progress and completed during the reporting period

e. Identification of any contract related issues uncovered during the reporting period and especially highlight those areas with a high probability of impacting schedule, cost or performance goals and their likely impact on schedule, cost, or performance goals

f. Explanations for any unresolved issues, including possible solutions and any actions required of the Government and/or Contractor to resolve or mitigate any identified issue, including a plan and timeframe for resolution

g. Status on previously identified issues, actions taken to mitigate the situation and/or progress made in rectifying the situation.

h. Work planned for the subsequent four reporting periods, when applicable

i. Current contract schedule overlaid on original contract schedule showing any delays or advancement in schedule

j. Provide expenditures based upon your proposed spend plan.

k. Workforce staffing data showing all Contractor personnel performing on the effort by task during the current reporting period along with status of their background investigation/VA clearance and biographies. After the initial labor baseline is provided, each Monthly Status Report shall identify any changes in staffing identifying each person who was added to the contract or removed from the contract.

l. Original schedule of deliverables and the corresponding deliverables made during the current reporting period.

m. Cost analysis that includes consumption of cloud resources by app.

n. Software licenses at or nearing end of life and software security certificates nearing expiration.

The report shall also include an itemized list of all Electronic and Information Technology (EIT) deliverables and their current Section 508 conformance status. The Contractor shall monitor performance against the CPMP and report any deviations. It is expected that the Contractor will keep in communication with VA accordingly so that issues that arise are transparent to both parties to prevent escalation of outstanding issues.

For each T&M task, indicate:

a. Summary of work performed

b. Expenditures for the reporting period

c. Contract Line Item Number expenditure

d. Burn rate

e. Percentage of work completed

A. Monthly Status Report

5.1.3 TECHNICAL KICK-OFF MEETING

The Contractor shall conduct a kick-off meeting with the VA PM, Contracting Officer’s

Representative (COR) and the Contracting Officer (CO). The meeting shall be held within 10 business days after contract award. The kick-off meeting shall be a face-to-face meeting in a VA or

VA-approved Contractor facility. The Contractor shall propose an agenda for VA COR approval three days prior to the meeting. The Contractor shall provide meeting minutes capturing discussion, agreements, and action items resulting from the kick-off meeting. The kick-off meeting shall address post award topics and shall present the Contractor’s draft plans and approach for meeting PWS requirements.

5.1.4 KEY PERSONNEL

Specific expertise and experience in Program/Project Management, Cloud Architecture, Configuration Management, and Information Security is essential for accomplishing the tasks outlined in this PWS. The key personnel positions are identified below along with the minimum requisite qualifications for each position.

Key Personnel Positions:

• Project Manager:

o Expertise Managing Entire Agile Software Development Life Cycle for a project of at least one million dollars up to and including production delivery and some phase of post-delivery support.

o Expertise Managing Project with at least 15 software professionals with a duration of greater than one year.

• Chief Cloud Architect:

o Background as a Software Engineer for at least three years prior to a position as a

Cloud Architect.

o Expertise as a Software Engineer for at least one project using Container

Orchestration and VAEC AWS GovCloud.

o Cloud Architect or Senior Engineer on a Production System in one of the VAEC

CSP Vendors’ Clouds.

o Cloud Architect or Senior Engineer on a Production System that uses a Container

Orchestration System.

• Chief Configuration Manager:

o Background as a Lead Developer, Lead Release Manager, or Lead/Chief

Configuration Manager for at least one year.

• Chief Network and Security Architect:

o Background as a Software Engineer, Site Reliability Engineer, or DevOps

Engineer for at least three years prior to a position as an Architect.

o Security Architect or Senior Engineer on a Production System using a Software

Defined Infrastructure.

o Security Architect or Senior Engineer on a Production System using one of the

VAEC CSP Vendors Clouds.

• Chief Operations Manager:

o Expertise running a 24x7 Software based System for at least 6 months.

o Experience with oversight of an operations team of at least 5 people for at least one year.

o Expertise in Incident Management for a Software based System.

o Expertise with oversight of a team running a trouble ticket system.

The Contractor shall provide resumes for any individual(s) who Contractor proposes to fill the five Key Personnel positions identified above. Submitted resumes are to be redacted to prevent disclosure of personally identifiable information (PII). Examples of PII include but are not limited to: names, addresses, phone numbers, social security numbers, and birthdays/dates. For those individuals proposed as Key Personnel who are not current employees of your company, a signed letter of intent will be required. The Key Personnel positions and redacted resumes of individuals who shall fill the key personnel positions shall be included as an attachment to the contract in Section D upon award.

During the first 90 days of performance, the Contractor shall not replace or substitute Key

Personnel that the Contractor proposed pre-award unless the replacement is necessitated by illness, death, or termination of employment. The Contractor shall notify the Contracting Officer within 15 calendar days after the occurrence of any of these events and provide a detailed explanation of the circumstances necessitating the proposed substitution and shall demonstrate that the proposed replacement personnel are of at least substantially equal ability and qualifications as the individual originally proposed for that position.

After the initial 90 days, any personnel the Contractor offers as substitutes for the above identified Key personnel positions shall have the ability and qualifications equal to or better than the Key Personnel which are being replaced and shall meet or exceed the qualifications designated for that Key Personnel position. If any change to a Key Personnel position becomes necessary, the Contractor shall immediately notify the VA PM and COR in writing, but whenever possible Contractor shall notify the VA PM of substitutions in personnel in writing 30 calendar days prior to making any change in Key Personnel, and provide a detailed explanation of the circumstances necessitating the proposed substitution and shall demonstrate that the proposed replacement personnel are of at least substantially equal ability and qualifications as the individual originally proposed for that position and that the proposed replacement meets or exceeds the qualifications designated for that Key Personnel position.

The Contractor agrees that it has a contractual obligation to mitigate the consequences of the loss of Key Personnel and shall promptly secure any necessary replacements in accordance with

(IAW) this PWS section. Failure to replace a Key Personnel pursuant to this clause and without a break in performance of the labor category at issue shall be considered a condition endangering contract performance and may provide grounds for default termination.

5.1.5 DAILY STATUS UPDATES

The Contractor shall support daily status meetings to discuss issues, propose resolutions, plan moves/add/changes, plan upgrades, and resolve tickets. These meetings will be conducted via teleconference.

5.1.6 PRIVACY AND HIPAA TRAINING

The Contractor shall submit status of VA Privacy and Information Security Awareness training for all individuals engaged on the task. The status reporting shall identify; a single Contractor

Security Point of Contract, the names of all personnel engaged on the task, their initial training date for VA Privacy and Information Security training, and their next required training date. This information shall be submitted as part of the Weekly/ Progress Status Report.

The Contractor shall submit Talent Management System (TMS) training certificates of completion for VA Privacy and Information Security Awareness training. The Contractor shall also provide VA Privacy and Information Security Awareness Signed Rules of Behavior, and

VA Health Insurance Portability and Accountability Act (HIPAA) Certificate of Completion

IAW Section 9, Training, from Appendix C of the VA Handbook 6500.6, “Contract Security”.

Deliverables:

A. TMS Training Certificates of Completion for VA Privacy and Information Security

Awareness Training

B. VA Privacy and Information Security Awareness Signed Rules of Behavior

C. VA HIPAA Certificate of Completion

5.2 VA MACM PLATFORM DEVELOPMENT AND APP MIGRATION

The Contractor shall provide cross-functional Contractor Sprint Teams to support the development of the VA MACM Platform and the migration of mobile apps from the VA MIS platform to the VA MACM Platform. Both development of the VA MACM Platform and migration of mobile apps to the VA MACM Platform shall take place in iterative two-week sprints. The Government estimates that each Contractor Sprint Team shall be comprised of 5 - 7 staff. The Contractor may invoice at the end of each sprint upon Government acceptance of the

Sprint Certification Package and Artifacts.

For MACM platform development and migration tasks, the Contractor shall follow an agile continuous integration (CI) / continuous deployment (CD) methodology, as outlined in “Best

Practices for Agile Processes” (Attachment 004), that may result in several releases in each sprint. If app development releases are required, the Contractor shall follow OIT’s Veterans

Integrated Process (VIP) requirements, IAW PWS Section 6.1.6, in coordination with the VA

PM/COR, the VA Product Owner, and OIT personnel.

The specific scope of functionality of the tasks will be determined by VA App Product Owners and the VA PM/COR, prior to sprint commencing. The Contractor shall adjust deliverables and updates to match the nature of each task.

At the beginning of each two-week sprint, each Contractor Sprint Team shall initiate, coordinate, and participate in a Sprint Planning Meeting and develop a Sprint Plan with the VA Project

Team, including the VA PM, COR, designated VA Product Owner and additional stakeholders, to plan the work to be accomplished for the sprint. Additionally, the team shall determine the acceptance criteria for the sprint and populate the Sprint Backlog. The Contractor, in collaboration with the VA Project Team, shall use an Agile Poker Estimation technique to define the relative complexity of each task and determine the amount of work that can be accomplished.

All activity scheduled in each sprint and backlog shall be captured and have status showing all work items, changes, impediments, and retrospectives. The Contractor shall update the Sprint

Plan at the conclusion of sprint planning. Once the Sprint Plan is accepted by the VA PM/COR and the VA Product Team, the sprint backlog may change throughout the duration of the sprint, however, the effort of work will remain constant.

The Contractor shall provide Sprint Demonstration that confirms all functionality developed in the sprint is operational. At the Sprint Demonstration, the Contractor Sprint Team shall submit a

Sprint Certification Package to the VA PM/COR for review and approval.

The Sprint Certification Package shall include a summary of the planned, accomplished, and unaccomplished work for the two-week sprint to include issues encountered and corrective actions taken as well as all artifacts produced, including any and all code (submitted to VA source code repository), during the sprint. This package, certification that all work is completed, and a demonstration that all work planned for the sprint has been fully implemented, are necessary for sprint acceptance by the Government. The Contractor must complete all work planned for each sprint and receive VA PM/COR approval of the Sprint Certification Package for the prior two-week sprint before beginning a new sprint.

The Contractor shall provide 13 sprints in the base contract period for the development of the

VA MACM Platform and the migration of mobile apps from the VA MIS platform to the VA

MACM Platform. The Contractor may be required to perform staff 1 – 4 sprints Sprint Teams in parallel.

The price for the delivery of the Minimum Viable Product (MVP) as defined in PWS 5.2.1 is 100 percent of the fixed-price of each sprint provided the Contractor successfully delivers and the

Government accepts the MVP within three months from contract award. Upon Contractor delivery and Government acceptance of each sprint, the Government shall pay 75 percent of the fixed-price of the sprint. Upon the successful delivery and acceptance of the MVP within three months from contract award, the Government shall pay the Contractor the remaining 25 percent of the fixed-price of each sprint withheld at the time of each Sprint delivery. In the event the

Contractor delivers the MVP later than three months from contract award, the price for the delivery of the MVP shall be 75 percent of the fixed-price for each sprint. The Government will continue to pay 75 percent of the fixed-price of each sprint until successful delivery and acceptance by the Government of the MVP. Notwithstanding when the MVP is delivered and accepted by the Government, the Contractor remains obligated to deliver the MVP and failure to deliver the MVP within a commercially reasonable time from contract award will be deemed a condition endangering contract performance and may provide grounds for default termination.

Upon successful delivery and acceptance of the MVP, additional sprints for the Mobile

Application Migration IAW PWS Section 5.2.2 will be paid at 100 percent of the fixed-price of each sprint.

The below subtasks contain the basic requirements for the development of the VA MACM MVP as well as app migration. Once the VA MACM MVP has been delivered by the Contractor, additional sprints will enhance, maintain, and sustain VA MACM as well as perform app migration through the period of performance of this contract.

A. Sprint Plan

B. Sprint Certification Package and Artifacts with Source Code

5.2.1 VA MACM MVP REQUIREMENTS

The Contractor shall deliver a stable and functional VA MACM MVP which meets each and every baseline requirement as set forth below in order to support all VA Mobile Application engineering activities such as application operations, development, testing, and troubleshooting.

The Contractor shall provide the configuration, administration, integration, application programming Interface (API) configuration, and future upgrades of the VA MACM. The baseline requirements for the VA MACM MVP shall include the following:

a. Container Orchestration System

b. Continuous Integration and Continuous Delivery System

c. Monitoring of availability and accessibility

d. Access Auditing

e. External Connectivity

f. Test Case Management and Automation Framework

g. Infrastructure, platform, and apps successfully build from code

h. Intermediate artifacts are stored in repositories

i. Deployable runtimes that have successful health checks

j. Established Incidence Response procedure

k. Integration of Project Management Systems, including:

l. A Ticketing system (e.g. JIRA and its Plugins)

m. A Knowledge management system (e.g. Confluence and its Plugins)

n. A Source Code Management system (e.g. GitHub Enterprise)

o. A Service Desk support tool (e.g. JIRA Help Desk Atlassian)

p. A real-time collaboration system (e.g. HipChat)

q. As necessary a single sign on service (e.g. Crowd)

r. VA MACM Standard Operating Procedures (SOP) and Tooling Support Plan to support the use of development and engineering tools to be used in MACM environments

s. Developer’s Manual that instructs development teams on how to build, deploy, test, and monitor their apps using the platform

t. Automated ad-hoc build analytics as well as the ability to provide system performance analytic reports requested by the VA.

u. Display a working health check application, running in the VA MACM production environment that shows the running status of the orchestration software.

The Contractor shall include all project artifacts in the Sprint Certification Package.

Rights in Computer Software:

The Contractor is required to deliver the VA MACM MVP, technical data, configurations, documentation or other information, including source code, during contract performance. The

Government shall receive Unlimited Rights in intellectual property first produced and delivered in the performance of this contract in accordance with FAR 52.227-14, Rights In Data-General

(DEC 2007). This includes all rights to source code and any and all documentation created in support thereof. License rights in any Commercial Computer Software shall be governed by

FAR 52.227-19, Commercial Computer Software

5.2.2 MOBILE APPLICATION MIGRATION

The Contractor shall migrate all VA mobile applications located in IBM Terremark (currently 20 to 30 mobile apps; however, the number of apps may change) as well as all associated databases and supporting services to the VA MACM IAW sprint planning activities. Each app shall be migrated from IBM Terremark to the MACM and the Contractor shall demonstrate that the app is working in all MACM environments using the CI/CD system. Upon approval and acceptance by the VA PM/COR that the migrated app is working in all MACM environments, the

Contractor shall decommission the successfully migrated app from the IBM Terremark environment. Where there is physical hardware associated with the app at IBM Terremark, the physical hardware shall also be decommissioned by the Contractor.

The Contractor shall include all project artifacts in the Sprint Certification Package.

5.2.3 ADDITIONAL VA MACM PLATFORM DEVELOPMENT APP MIGRATION

SUPPORT (OPTIONAL TASK)

In the event the Government exercises the Optional Task in the base period or any option period, the Contractor shall provide up to 32 iterative two-week sprints, as defined in PWS Section 5.2 above, to enhance, maintain, and sustain VA MACM as well as perform app migration through the period of performance of this contract.

5.3 MOBILE ENVIRONMENT SUPPORT

5.3.1 VA MACM OPERATIONS AND SYSTEM MAINTENANCE SUPPORT

The Contractor shall maintain and operate the ongoing availability of VA MACM. The

Contractor shall develop a VA MACM Operations and Maintenance (O&M) Support Plan that details the Contractor’s plan to maintain all VA MACM including incidence resolution procedures. The Contractor shall deliver the VA MACM O&M Support Plan to the VA

PM/COR for review and approval.

The Contractor shall maintain and operate multiple VA environments within MACM including, but not limited to the following environments:

• Development (will not be connected to VA)

• Staging/Testing

• Production

Each VA environment may be divided into sub-environments as determined by VA. The

Contractor shall ensure that all software associated with maintaining and operating the VA

MACM is delivered and tracked on VA owned and operated version control systems. The

Contractor shall ensure COTS software is licensed appropriately. VA shall provide the

Contractor with access to such systems.

The Contractor shall provide VA MACM system maintenance to include corrective maintenance; adaptive maintenance; perfective maintenance; and preventative maintenance to ensure all apps and services hosted in MACM are continuously available, function correctly, provide current information features, and provide the best possible user experience. Maintenance types are defined in the “VA MACM Systems Maintenance Definitions” (Attachment 005).

The Contractor shall:

a. Provide 24x7 Production support for VA MACM application infrastructure; database infrastructure to support database systems; security, and their utilities IAW the approved VA

MACM O&M Support Plan.

b. Provide Database Administration (DBA) support to cloud-based and hosted database systems in the VA MACM.

c. Provide non-production environment support during normal VA business hours (7 am – 9 pm

EST).

d. Identify requirements for additional functionality within the application infrastructure. The

Contractor shall include the results of this activity in an Application Infrastructure

Recommendations Report appended to the Monthly Status Report.

e. Monitor system, network, application, database logs, and Service Level Agreement (SLA) metrics via VA approved monitoring tools and provide a real-time dashboard available to all program…