CORP TMS PWS RFI.pdf

VA-24-00048379 CORP Technical Management Support

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Office of Information & Technology (OIT) Software Product Management (SPM)

Corporate (CORP) Service Line

CORP Technical Management Support

Date: February 14, 2024

VA-24-00048379

PWS Version Number: 1.0

Contents

1.0 BACKGROUND

2.0 APPLICABLE DOCUMENTS

3.0 SCOPE OF WORK

3.1 ORDER TYPE

4.0 PERFORMANCE DETAILS

4.1 PERFORMANCE PERIOD

4.2 PLACE OF PERFORMANCE

4.3 TRAVEL

5.0 SPECIFIC TASKS AND DELIVERABLES

5.1 SL MANAGEMENT (FFP)

5.1.1 CONTRACTOR PROJECT MANAGEMENT PLAN

5.1.2 WORK PLAN

5.1.3 TRAINING

5.1.4 TECHNICAL KICKOFF MEETING

5.1.5 RESOURCE MANAGEMENT

5.1.5.1 ON-BOARDING SUPPORT

5.1.5.2 RESOURCE INTAKE

5.1.5.3 OFF-BOARDING SUPPORT

5.1.6 PROCESS IMPROVEMENT

5.2 SCOPING OF CORPORATE SUPPORT TASKS (FFP)

5.3 OPTIONAL TASK ONE - CROSS-FUNCTIONAL MANAGEMENT SUPPORT

(T&M)

5.3.1 MANAGEMENT SUPPORT

5.3.2 SCHEDULE SUPPORT

5.3.3 RISK MANAGEMENT

5.3.4 STRATEGIC PLANNING AND ANALYSIS

5.3.5 MEETING SUPPORT

5.3.6 CAPITAL PLANNING AND INVESTMENT CONTROL (CPIC)

5.3.7 FINANCIAL INFORMATION INTEGRATOR REPORTING

5.3.8 ACQUISITION SUPPORT

5.3.9 DOCUMENT AND DATA SUPPORT

5.3.9.1 DOCUMENT AND DATA DEVELOPMENT

5.3.9.2 DOCUMENT AND DATA QUALITY

5.3.9.3 DOCUMENT AND DATA REPOSITORIES

5.3.9.4 DOCUMENT AND REPOSITORY REVIEWS

5.3.9.5 DELIVERABLE TRACKING AND REVIEW MANAGEMENT

5.3.10 CHANGE MANAGEMENT (CM)

5.3.10.1 OCM

5.3.10.2 BUSINESS PROCESS RE-ENGINEERING

5.3.10.3 PRODUCT CM

5.3.10.4 CONFIGURATION MANAGEMENT

5.3.11 COMMUNICATION MANAGEMENT

5.3.11.1 COMMUNICATIONS PLAN

5.3.11.2 DATA CALL MANAGEMENT

5.3.11.3 ACTION ITEM MANAGEMENT

5.3.12 SOFTWARE LICENSE MANAGEMENT

5.3.13 TRAVEL ADMINISTRATION

5.3.14 TRAINING SUPPORT

5.4 OPTIONAL TASK TWO - ENGINEERING AND TECHNICAL SUPPORT (T&M)

5.4.1 REQUIREMENTS MANAGEMENT

5.4.2 ARCHITECTURE AND DESIGN SUPPORT

5.4.3 INTERFACE SUPPORT

5.4.4 SECURITY MANAGEMENT

5.4.5 INTEGRATION MANAGEMENT

5.4.6 SOFTWARE QUALITY ASSURANCE (SQA) TESTING

5.4.7 RELEASE MANAGEMENT SUPPORT

5.4.8 SYSTEMS ADMINISTRATION SUPPORT

5.4.9 ADVANCED TECHNOLOGY INTERGRATION

5.4.10 HUMAN CENTERED DESIGN (HCD)

5.4.10.1 HCD DISCOVERY

5.4.10.2 HCD ANALYSIS

5.5 OPTIONAL TASK THREE - SOFTWARE LICENSES (CR)

5.6 OPTIONAL TASK FOUR - TRANSITION SUPPORT (FFP)

6.0 GENERAL REQUIREMENTS

6.1 ENTERPRISE AND IT FRAMEWORK

6.1.1 VA TECHNICAL REFERENCE MODEL

6.1.2 FEDERAL IDENTITY, CREDENTIAL, AND ACCESS MANAGEMENT

(FICAM)

6.1.3 INTERNET PROTOCOL VERSION 6 (IPV6)

6.1.4 TRUSTED INTERNET CONNECTION (TIC)

6.1.5 STANDARD COMPUTER CONFIGURATION

6.1.6 VETERAN FOCUSED INTEGRATION PROCESS (VIP) AND PLM

6.1.7 PROCESS ASSET LIBRARY

6.1.8 AUTHORITATIVE DATA SOURCES

6.1.9 SOCIAL SECURITY NUMBER (SSN) REDUCTION

6.1.10 SOFTWARE AND LICENSING REQUIREMENTS

6.2 SECURITY AND PRIVACY REQUIREMENTS

6.2.1 POSITION/TASK RISK DESIGNATION LEVEL(S)

6.2.2 CONTRACTOR PERSONNEL SECURITY REQUIREMENTS

6.3 METHOD AND DISTRIBUTION OF DELIVERABLES

6.4 PERFORMANCE METRICS

6.5 FACILITY/RESOURCE PROVISIONS

6.6 GOVERNMENT FURNISHED PROPERTY

ADDENDUM A – ADDITIONAL VA REQUIREMENTS, CONSOLIDATED

1.0 BACKGROUND

The Department of Veterans Affairs (VA), Office of Information & Technology (OIT), Software Product Management (SPM) strives to provide high quality, effective, and efficient Information Technology (IT) services to those responsible for providing care to the Veterans at the point-of-care as well as throughout all the points of the Veterans’ health care in an effective, timely and compassionate manner. VA depends on Information Management/Information Technology (IM/IT) systems to meet mission goals.

The VA OIT SPM, Corporate (CORP) Service Line (SL) delivers world-class, Veteran-centric capabilities that provide secure, seamless delivery of IT systems to VA corporate offices so these offices may efficiently and effectively provide benefits and services to Veterans and their families. CORP IT systems enable the delivery of services to Veterans by enabling technology to provide relevant internal, foundational information to the VA workforce. CORP is looking to incorporate advanced technology solutions into the products, which includes but is not limited to artificial intelligence (AI). CORP provides available, adaptable, secure, and cost-effective IT products and services to VA business offices, enabling VA staff to provide mission-critical support to the Nation’s Veterans.

CORP manages a variety of products, programs, and projects that require oversight in the key areas of IT development, operations, and sustainment. CORP includes the following four Product Lines (PLs):

1. Acquisition and Property Management - IT products for conducting acquisition and performance management activities, including acquisition planning, sourcing, contracting, purchasing, equipment and inventory management and facility operations.

2. Financial Management - IT products for conducting financial management activities including budget formulation and execution, account management, payment processing and financial performance reporting.

3. Human Capital Management - IT products for conducting human capital management, including talent acquisition and development, employee performance and compensation management and employee separation and retirement management.

4. Sec VA/Congressional/Legal Affairs - IT products for supporting the activities of Office of the Secretary of VA, Office of General Counsel and Congressional Liaison operations. It also includes products for enabling regulatory activities such as matter intake and tracking under the VA accountability and whistleblower's protection program.

CORP is currently responsible for approximately 170 products assigned within four PLs.

These products are routinely re-assigned within OIT, and so the number of products and their assigned product line are subject to change, both internally to the portfolio, and to other SLs within OIT. The number of product lines within the SL is also subject to change as it is anticipated that new PLs will be added to CORP throughout the life of this Task Order (TO).

2.0 APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. 44 U.S.C. § 3541-3549, “Federal Information Security Management Act (FISMA) of 2002”

2. “Federal Information Security Modernization Act of 2014”

3. Federal Information Processing Standards (FIPS) Publication 140-2, “Security

Requirements for Cryptographic Modules”

4. FIPS Pub 199. “Standards for Security Categorization of Federal Information and

Information Systems,” February 2004

5. FIPS Pub 200, “Minimum Security Requirements for Federal Information and

Information Systems,” March 2006

6. FIPS Pub 201-2, “Personal Identity Verification of Federal Employees and

Contractors,” August 2013

7. 10 U.S.C. § 2224, "Defense Information Assurance Program"

8. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

9. Public Law 109-461, Veterans Benefits, Health Care, and Information

Technology Act of 2006, Title IX, Information Security Matters

10. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”

11. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, https://www.va.gov/vapubs/index.cfm

12. VA Handbook 0710, “Personnel Security and Suitability Program,” May 2, 2016, https://www.va.gov/vapubs/index.cfm

13. VA Directive and Handbook 6102, “Internet/Intranet Services,” August 5, 2019

14. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and

Guidelines,” January 18, 2017

15. Office of Management and Budget (OMB) Circular A-130, “Managing Federal

Information as a Strategic Resource,” July 28, 2016

16. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed

Services (CHAMPUS)”

17. NIST SP 800-66 Rev. 1, “An Introductory Resource Guide for Implementing the

Health Insurance Portability and Accountability Act (HIPAA) Security Rule,” October 2008

18. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended, January 18, 2017

19. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

20. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021

21. VA Handbook 6500, “Risk Management Framework for VA Information Systems

VA Information Security Program,” February 24, 2021

22. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal

Information (SPI),” March 12, 2019

23. VA Handbook 6500.5, “Incorporating Security and Privacy into the System

Development Lifecycle,” March 22, 2010

24. VA Handbook 6500.6, “Contract Security,” March 12, 2010

25. VA Handbook 6500.8, “Information System Contingency Planning,” April 6, 2011 https://www.va.gov/vapubs/index.cfm https://www.va.gov/vapubs/index.cfm http://www.va.gov/vapubs http://www.va.gov/vapubs

26. VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018

27. VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017

28. OIT Process Asset Library (PAL), https://www.va.gov/process/ . Reference

Process Maps at https://www.va.gov/process/maps.asp and Artifact templates at https://www.va.gov/process/artifacts.asp

29. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

30. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014

31. VA Handbook 6508.1, “Procedures for Privacy Threshold Analysis and Privacy Impact Assessment,” July 30, 2015

32. VA Handbook 6510, “VA Identity and Access Management,” January 15, 2016

33. VA Directive and Handbook 6513, “Secure External Connections,” October 12,

34. VA Directive 6300, “Records and Information Management,” September 21, 2018

35. VA Handbook, 6300.1, “Records Management Procedures,“ March 24, 2010

36. NIST SP 800-37 Rev 2, “Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy,” December 2018

37. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020)

38. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015

39. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” March 24, 2014

40. OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005

41. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019

42. OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008

43. Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance, December 2, 2011, (NOTE: Part A of the FICAM Roadmap and Implementation Guidance, v2.0, was replaced in 2015 with an updated Architecture (https://arch.idmanagement.gov/#what-is-the-ficam-architecture)

44. NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access,“ June 2018

45. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, “Digital Identity Guidelines,” updated March 02, 2020

46. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014

47. NIST SP 800-164, “Guidelines on Hardware-Rooted Security in Mobile Devices

(Draft),” October 2012 https://www.va.gov/process/ https://www.va.gov/process/maps.asp https://www.va.gov/process/artifacts.asp https://www.va.gov/trm/TRMHomePage.aspx https://arch.idmanagement.gov/#what-is-the-ficam-architecture https://arch.idmanagement.gov/#what-is-the-ficam-architecture

48. Draft National Institute of Standards and Technology Interagency Report (NISTIR) 7981, “Mobile, PIV, and Authentication,” March 2014

49. VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

50. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

51. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

52. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

53. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019

54. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008

55. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (Public Law 110–140), December 19, 2007

56. Section 104 of the Energy Policy Act of 2005, (Public Law 109–58), August 8,

57. Executive Order 13834, “Efficient Federal Operations,” dated May 17, 2018

58. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 2,

59. VA Directive 0058, “VA Green Purchasing Program,” July 19, 2013

60. VA Handbook 0058, “VA Green Purchasing Program,” July 19, 2013

61. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote

Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

62. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

63. “Veteran Focused Integration Process (VIP) Guide 4.0,” January 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

64. VA Memorandum “Proper Use of Email and Other Messaging Services,” January

2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

65. “DevSecOps Product Line Management Playbook” version 2.0, May 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

66. NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020

67. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol

Version 6 (IPv6),” November 19, 2020

68. Social Security Number (SSN) Fraud Prevention Act of 2017

69. Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23, 2018

70. Executive Order on the Safe, Secure, and Trustworthy Development and Use of

Artificial Intelligence, October 30, 2023 https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514 https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896 https://www.cisa.gov/publication/tic-30-core-guidance-documents https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371 https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

3.0 SCOPE OF WORK

The Contractor shall provide IT program management, product management, technical management, and detailed solutioning support for the CORP SL. The Contractor shall perform and execute the tasks at various levels of support to include SL, products, projects, and special initiatives. Major work areas include IT product line management (PLM), product management, technical management, schedule and risk management, strategic analysis, meeting support, capital planning and investment support, financial management, acquisition support, document and data support, change management, communications management, license management, travel administration, training support, detailed requirements elaboration and analysis, architecture support, security management, integration management, software quality assurance, release management, system administrative support, technical writing, artificial intelligence (AI), and human centered design support.

3.1 ORDER TYPE

The effort shall be proposed on a hybrid Firm-Fixed Price (FFP), Time and Materials (T&M), and Cost Reimbursable (CR) basis.

4.0 PERFORMANCE DETAILS

4.1 PERFORMANCE PERIOD

The period of performance (PoP) shall be 12 months with four 12-month option periods and four optional tasks. The overall TO PoP shall not exceed 62 months.

There are 11 Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, five are set by date:

New Year's Day January 1 Juneteenth June 19 Independence Day July 4 Veterans Day November 11 Christmas Day December 25

If any of the above falls on a Saturday, then Friday shall be observed as a holiday.

Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

Martin Luther King's Birthday Third Monday in January Washington's Birthday Third Monday in February Memorial Day Last Monday in May Labor Day First Monday in September Columbus Day Second Monday in October Thanksgiving Fourth Thursday in November

4.2 PLACE OF PERFORMANCE

Tasks under this PWS shall be performed at Contractor facilities. The Contractor shall identify the Contractor’s place of performance in their proposal submission.

4.3 TRAVEL

The Government anticipates travel to perform the tasks associated with the effort, as well as to attend program-related meetings or conferences throughout the PoP. Travel shall be Cost Reimbursable with a not to exceed ceiling on travel expenses per year.

Travel shall be in accordance with the Federal Travel Regulations (FTR) and requires advanced concurrence by the Contracting Officer’s Representative (COR). Travel and per diem shall be reimbursed in accordance with FTR. Each Contractor invoice must include copies of all receipts that support the travel costs claimed in the invoice. Travel must be pre-approved by the COR. Local travel within a 50-mile radius from the Contractor’s facility is considered the cost of doing business and will not be reimbursed.

This includes travel, subsistence, and associated labor charges for travel time. Travel performed for personal convenience and daily travel to and from work at the Contractor’s facility will not be reimbursed. Travel, subsistence, and associated labor charges for travel time for travel beyond a 50-mile radius of the Contractor’s facility are authorized on a case-by-case basis and must be pre-approved by the COR.

5.0 SPECIFIC TASKS AND DELIVERABLES

The Contractor shall perform PWS Sections 5.1 and 5.2, and all subsections (except 5.1.4) in the Base Period and each Option Period, if exercised.

5.1 SL MANAGEMENT (FFP)

The Contractor shall provide all necessary programmatic support to ensure that the Corporate Portfolio and all programs/projects are compliant with VA guidelines and process requirements.

5.1.1 CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall prepare and deliver a Contractor Project Management Plan (CPMP) that outlines the Contractor’s approach, timeline, and tools to be used in execution of the TO. The CPMP will describe the Contractor’s plans to support CORP.

The CPMP shall detail how the resources shall support the maintenance and updating of all management artifacts. The CPMP shall incorporate the tasks described in this PWS. The CPMP shall take the form of both a narrative and graphic format that displays the schedule, milestones, risks, and resource support. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and special data collection reporting requests. The Contractor shall identify an individual as the primary contact point for all programmatic issues/concerns/status. The initial baseline CPMP shall be concurred upon and updated in accordance with Section B of the TO. The Contractor shall maintain a staffing plan of resource assignments for all products and the SL to be included in the CPMP.

The Contractor shall provide an Invoice Status Report to the COR of all submitted invoices to include date of submission, amount of invoice and payment status (e.g., pending or paid in full).

The CPMP shall also include a staff roster identifying the following:

1. Employee Name

2. Personnel PIV Expiration

3. Personnel clearance level and adjudication date

4. Role

5. List of GFE

6. Product affiliation

7. Personnel duty location address, alternate email, phone number

The Contractor shall include a plan, within the CPMP, of their project management processes for the following project management disciplines:

1. Schedule Management

2. Financial Management

3. Quality Management

4. Resource Management

5. Communication Management

6. Risk Management

7. Internal Controls

Deliverables:

A. CPMP

B. Invoice Status Report

5.1.2 WORK PLAN

The purpose of the Work Plan is to provide a means to allow VA to effectively manage this TO as well as reprioritize activities on a biweekly basis (every two weeks). The Contractor shall provide a Work Plan, which includes information on all work-in-progress (WIP) activities and task backlog currently ongoing as part of this TO. Specifically, the Work Plan shall include the following data elements, for each activity ongoing under this

PWS:

a. Product and specific activities.

b. Overview and description of the activity.

c. Overall high-level assessment of progress of the activity.

d. All WIP and completed for the activity during the period.

e. Backlog tasks aligned and prioritized to the domain roadmap.

f. Build domain roadmap.

g. Identification of any contract related issues uncovered during the previous period and especially highlight those areas with a high probability of impacting schedule, cost, or performance goals and their likely impact on schedule, cost, or performance goals.

h. Explanations for any unresolved issues, including possible solutions and any actions required of the Government and/or Contractor to resolve or mitigate any identified issue, including a plan and timeframe for resolution.

i. Status on previously identified issues and actions taken to mitigate the situation and/or progress made in rectifying the situation.

j. Work planned for the subsequent period.

k. Current activity schedule overlaid on original activity schedule showing any delays or advancement in schedule.

l. Current expenditures overlaid over the original budget showing any deviations in the actual expenditures versus the original budget and versus the current budget.

m. Workforce staffing data showing all Contractor personnel performing on the effort during the previous period. After the initial labor baseline is provided, each Work Plan Report shall identify any changes in staffing identifying each person who was added to the activity, removed, and/or moved from one product to another from the task order (TO), including applicable PWS paragraph(s). This should also include any planned travel for the activity.

n. Original schedule of deliverables and the corresponding deliverables made during the previous period.

o. On-Boarding Status Reports including but not limited to status of personnel during on-boarding activities including anticipated personnel, training status, and security clearance status.

p. Strategic Planning-Analysis Activity Summary including but not limited to achievements, challenges, and recommendations in the areas of strategic planning framework, stakeholder engagement and feedback, innovation exploration, risk management, performance monitoring and reporting, and continuous improvement.

Additionally, the Contractor shall conduct a biweekly meeting to present the Work Plan.

These reports shall not be the only means of communication between the Contractor, COR, and CORP management to advise of performance/schedule issues and to develop strategies for addressing the issues. The Contractor shall continuously monitor performance and report any deviation from the previous Work Plan to the COR and Program Manager (PgM)/Project Manager (PM) during routine, regular communications.

The Contractor shall respond to all COR queries related to milestones and schedule within four business hours of receipt of written request.

Deliverable:

A. Work Plan

5.1.3 TRAINING

The Contractor shall submit all on-boarding paperwork and documentation as required by all applicable VA onboarding requirements, including but not limited to VA Directive 0710, as well as documentation specifically requested by the COR, to ensure the timely on-boarding of contractor staff. Additionally, the Contractor shall submit Talent Management System (TMS) training certificates of completion for VA Privacy and Information Security Awareness and Rules of Behavior and HIPAA training and provide signed copies of the Contractor Rules of Behavior in accordance with Section 9, Training, from Appendix C of the VA Handbook 6500.6, “Contract Security.”

The Contractor shall be required to complete all necessary training courses to obtain access to and utilize appropriate tools, upon concurrence by the COR.

Examples of these tools include but are not limited to Slack, Jira, Selenium, Jenkins, GitHub, Prometheus, Docker, Kubernetes, Confluence, ServiceNow, and AppDynamics.

Contractors who have completed these VA training courses within 24 months of their onboarding date and have furnished certificates will not be required to re-take the training course.

Deliverable:

A. VA Training Certificates

5.1.4 TECHNICAL KICKOFF MEETING

A technical kickoff meeting shall be held within 10 business days after TO award. The Contractor shall coordinate the date, time, and location (can be virtual) with the Contracting Officer (CO), as the Post-Award Conference Chairperson, the VA PgM, as the Co-Chairperson, the Contract Specialist (CS), and the COR. The Contractor shall provide a draft agenda to the CO and VA PgM at least five calendar days prior to the meeting. Upon Government approval of a final agenda, the Contractor shall distribute to all meeting attendees. During the kickoff meeting, the Contractor shall present, for review and approval by the Government, the details of the intended approach, work plan, and product schedule for each effort via a PowerPoint presentation. At the conclusion of the meeting, the Contractor shall update the presentation with a final slide entitled “Summary Report” which shall include notes on any major issues, agreements, or disagreements discussed during the kickoff meeting and the following statement, “As the Post-Award Conference Chairperson, I have reviewed the entirety of this presentation and assert that it is an accurate representation and summary of the discussions held during the Technical Kickoff Meeting for the “CORP Technical Management Support.” The Contractor shall submit the final updated presentation to the CO for review and signature within three calendar days after the meeting. The Contractor shall also work with the CS, the Government’s designated note taker, to prepare and distribute the meeting minutes of the kickoff meeting to the CO, COR, and all attendees within three business days after the meeting. The Contractor shall obtain concurrence from the CS on the content of the meeting minutes prior to distribution of the document.

5.1.5 RESOURCE MANAGEMENT

5.1.5.1 ON-BOARDING SUPPORT

The Contractor shall assist with the on-boarding process for VA access and for individual system/environment access for all Contractor staff supporting CORP. This includes but is not limited to the Technical Management Support and Develop, Security, and Operations (DevSecOps) Contractors.

The Contractor shall:

1. Collect signed rules of behavior documents, signed non-disclosure agreements, training certificates, applications for access to VA information systems, Personal Identity Verification (PIV) card requests and other related information, for assigned product teams, and provide secure storage for the documents and files, in accordance with VA guidance.

2. Provide the documents, files and information to the VA PM, COR, and IT staff for review/approval/signature, when requested, to support VA’s on-boarding process for granting access to VA systems.

3. Prepare and submit access requests, including TMS applications, PIV card applications, and current VA approved contractor request forms. After receipt of a favorable Special Agreement Check (SAC) determination, and COR approval, the Contractor shall create Helpdesk tickets to request VA user accounts (for e-mail and remote access).

4. Monitor the submission of the artifacts and follow up to assure that all artifacts submitted are complete and correct. The Contractor shall track VA system access requests through completion.

5. Track and report on the status of CORP on-boarding of personnel as follows:

a. Upon COR approval, contact VA's Security Investigations Center (SIC) requesting the SAC and OPM background investigation status documentation by e-mail and-or by telephone.

b. Upon COR approval, request VA access for the subject using the intranet-based Computer Access Request site that resides inside of the VA network.

Provide all information to complete the on-line version of a Computer Access Request Form and upload the required certificates as PDF files: Contractor Rules of Behavior, Non-Disclosure Agreement, Training Certificates, and the proof of SAC approval (the SAC approval can be an e-mail from the SIC or a report from the SIC). Notify the COR that the form is ready for approval, signature, and submission.

c. Coordinate with the TMS point of contact so that all Contractor personnel are listed under the proper supervisor (COR) and that contract start-end dates are accurate in TMS.

d. Provide a Resource Management Report in the form of a spreadsheet that lists all personnel currently and formerly assigned across all teams (VA and Contractors). The spreadsheet shall contain, at a minimum, name, city nearest to work location, telephone, alternate e-mail, background investigation initiation and completion dates, a log of Electronic Permission Access System requests, assigned GFE, and role. This spreadsheet shall reside on a VA SharePoint site in a location specified by the COR.

The Contractor shall provide a summary of the on-boarding support activities performed in updates to the CPMP.

Deliverable:

A. Resource Management Report

5.1.5.2 RESOURCE INTAKE

The Contractor shall create a Resource Intake Slide Deck to share with CORP staff detailing the available capabilities and support within this TO. The Contractor shall present this content to staff as needed. The Resource Intake Slide Deck and presentation shall include the Contractor’s overall support approach, outline types of support provided by this TO and how capabilities are being leveraged across the SL.

The Contractor shall create and maintain a CORP Technical Management Support resource request, intake, and disposition process. The Contractor shall document the request, intake, and disposition process within a Resource Intake Guide which will include process flows and guides depicting processes and sub-process. The Contractor shall maintain an intake repository providing status updates on demand. The Contractor shall apply advanced technologies to pinpoint resource constraints, cost-saving possibilities, and ideal project prioritization to ensure efficient resource utilization.

Deliverables:

A. Resource Intake Slide Deck B. Resource Intake Guide

5.1.5.3 OFF-BOARDING SUPPORT

The Contractor shall assist with the off-boarding process for VA access, including individual system/environment access, for all Contractor staff, CORP Technical Management Support, and DevSecOps Contractors. The Contractor shall prepare all forms necessary for termination of access to VA information systems, in accordance with VA guidance. The Contractor shall assist in confirming whether the GFE equipment, associated documentation, and PIV card has been returned to the proper receiving authorities in accordance with VA policy. All findings shall be documented in the Resource Management Report under paragraph 5.1.5.1 of this PWS.

5.1.6 PROCESS IMPROVEMENT

The Contractor shall support CORP in continuous process improvement and innovation throughout the lifecycle of this TO. The Contractor shall research and implement automated and intelligent workflows using advanced technologies to simplify routine tasks, reduce manual labor, minimize errors, and expedite project completion. The Contractor shall provide a minimum of three process improvement recommendations quarterly as an addendum to the CPMP to improve overall operational performance at the SL and PL levels. These improvements shall consider implementing new VA approved tools and processes to optimize operations and execution throughout the SL.

The Contractor shall collect feedback from VA staff within CORP and externally, to identify opportunities to leverage existing and create new processes that would mature CORP operations and execution. The Contractor shall link process improvement and innovation suggestions to organizational goals when applicable and provide executable recommendations, as the process improvement opportunities arise.

5.2 SCOPING OF CORPORATE SUPPORT TASKS (FFP)

CORP is constantly evolving to meet VA priorities and requires support for cross-functional management, engineering and technical management, and innovation stakeholder engagement, which will be incorporated through the exercise of Optional Tasks, throughout the PoP of this TO. The Contractor shall evaluate and scope capabilities that were identified through the existing CORP intake processes.

The Government also anticipates that each effort may require differently sized support teams depending on the complexity of the effort. The Contractor needs to be prepared to provide teams of 2 people (extra-small team), 3-4 people (small team), 5-6 people (medium team), 7-8 people (large team) and 9-10 people (extra-large team) as part of the Execution Plan and provide pricing accordingly for both critical and non-critical. The Government also reserves the right to order multiple teams for the same effort if necessary. Teams requiring more than 10 people will be achieved through the combination of multiple teams. The Government anticipates that the scoping of individual efforts should require no more than 30 days to complete. However, some efforts will need to be phased in throughout the year during the PoP. Accordingly, the Contractor shall provide monthly pricing to allow the Government to obtain services of teams for less than the full PoP in either the base period or any of the option periods.

The Government and Contractor will work collaboratively to decide the team composition, which optional tasks are applicable, which product documents may need to be created and/or updated. When developing the Contractor Execution Plan for Optional Tasks, the PoP shall not exceed 12 months for each time the Optional Task is exercised.

Once the requirements are determined by both parties, the following steps shall apply:

1. The Contractor shall submit an Execution Plan (EP) that contains the appropriate labor categories, the proposed or suggested team size, additional deliverables if necessary, and the schedule to meet the effort’s requirements.

2. The Government will provide a technical evaluation of the Contractor’s EP and, if necessary, discuss any revisions.

3. Upon agreement of the scope of the EP, the COR will collaborate with the CO, who will issue a modification to commence work.

4. The Contractor shall indicate the manner and extent it will use shared resources to accomplish the Optional Tasks.

Deliverable:

A. Execution Plan

5.3 OPTIONAL TASK ONE - CROSS-FUNCTIONAL MANAGEMENT

SUPPORT (T&M)

The VA anticipates that cross-functional management support teams will be required throughout the base and option periods. Additional teams may be added throughout the PoP. If exercised, the Contractor shall provide strategic and programmatic support for CORP at the SL, PL, and product levels for approximately 170 products within CORP.

The Contractor shall directly support VA cross functional teams and provide daily active collaboration and feedback for CORP’s goals, scope, requirements, costs, schedule, and risks. The cross functional teams must have awareness of the work being completed throughout the SL and implement solutions in a consistent, cohesive manner in alignment with CORP’s goals. The Contractor shall follow VA’s approved methodologies to include, but not limited to, Scaled Agile Framework (SAFe) Agile and DevSecOps while supporting the cross functional teams. The Contractor shall ensure efficiencies are leveraged across PLs and throughout CORP while providing the support specified within this PWS.

5.3.1 MANAGEMENT SUPPORT

The Contractor shall assist with ensuring CORP goals at all levels are established and met. The Contractor shall incorporate advanced technology solutions, including but not limited to AI, into the CORP management process to automate decision-making, optimize resource allocation, streamline processes, provide predictive insights, and improve operational efficiency. The Contractor shall interact with the VA management and teams to provide daily feedback into goals, scopes, requirements, costs, schedule, and risks. The Contractor shall provide ad-hoc updates and status reports. For each level, the Contractor shall include improvements to governance and links to strategic performance planning.

The Contractor shall provide the following SL support, but not limited to:

a. Interfacing with executive management, stakeholders, and all PLs in support of activities such as modernizing management processes, ensure coordination, and implementing new processes, regulations, and policies across the SL.

b. Assisting with identification of components into relevant business groups to which common decision filters can be applied for evaluation, selection, prioritization, and balancing.

c. Gathering performance indicators, provides periodic reporting on them, and reviews the SL periodically for continued alignment.

The Contractor shall provide the following PLM support, but not limited to:

a. Interfacing with business owners, stakeholders, and across all PLs in support of activities such as defining business objects and project prioritization.

b. Making recommendations and providing direction to PLM.

c. Maintaining high-level and granular visibility into all key project information.

The Contractor shall provide the following product level support, but not limited to:

a. Interfacing with the Product Owners, scrum team, and scrum masters, in support of activities such as sprint backlog grooming, prioritization and burndown, defect management, removing impediments, blocking distractions, and enabling close cooperation across all roles and functions of the scrum team(s).

b. Ensuring product dashboards and other approved OIT tools are accurately maintained with appropriate product information.

c. Assisting the Government with coordination with Enterprise Cloud Solutions Office and project teams who are planning on migrating legacy applications to VA Enterprise Cloud (VAEC) as well as developing new applications in the VAEC.

d. Assisting the Government with identifying cloud capacity (credits) requirements for VAEC-Azure and VAEC-AWS applications and tracking usage.

5.3.2 SCHEDULE SUPPORT

The Contractor shall develop and maintain a schedule for each PL and product that depicts the full lifecycle. The Contractor shall ensure the schedule depicts this information as a logical cohesive whole for each product. The Contractor shall analyze and expand upon each integrated master schedule (IMS) to address customer-facing milestones, contractor deliverables, workgroup activities and schedules, as well as interfacing activities to define internal and external dependencies.

The Contractor shall:

a. Identify and outline all applicable milestones, discrete events, and dependent activities (i.e., service requests) necessary for completion.

b. Capture the VA approved project management methodology requirements.

c. Determine the expected duration of each event and resources required for each.

d. Maintain the data from various VA staff and contractor participants.

e. Maintain planned versus actual performance, identify changes in the schedule, identify all late tasks, and critical paths.

f. Lead schedule reviews that walkthrough items highlighted in the schedule. The

Contractor shall meet with vendors and stakeholders as needed to ensure information provided is near real time.

g. Present all schedule information to the respective stakeholders and provide all schedule updates and status reports at an agreed upon time. Deliver ad-hoc reports, which may include one or more of the following views: detail level schedules, critical path depictions, what-if analysis, and subsections for individual groups/teams, as required.

h. Alert VA within one business day when variance in the schedule is identified that creates overall critical path slippage.

i. Maintain all Enterprise Program Management Division schedule activities in accordance with VA directives and guidance when applicable.

j. Update the schedule including future/new/closed products using VA’s approved scheduling tools.

k. Create and maintain a rollup IMS for each PL based off the individual project schedules.

l. Develop and maintain a detailed Technical Roadmap to provide a strategic plan delineating the systematic evolution of key technologies through the product lifecycle and PL maturity levels.

m. Ensure that the roadmap aligns with SL and PL objectives, accommodates emerging technologies, and incorporates mechanisms for risk mitigation.

Deliverables:

A. IMS

B. Technical Roadmap

5.3.3 RISK MANAGEMENT

The Contractor shall develop and implement a Risk Management Plan for all necessary product requirements. The Contractor shall provide risk tracking in accordance with product and VA risk management plans and other relevant guidance. Based on inputs from designated participants, the Contractor shall provide detailed risk analyses and document the various aspects of competing risks and then provide all findings in the Risk Management System.

The Contractor shall actively participate in comprehensive risk analysis activities for all CORP products including both business processes and IT processes and investments.

The Contractor shall maintain the Risk Reporting System and tailor it to meet VA future needs. The Contractor shall review, assess, and create strategies to comply with emerging VA methods, tools, and resources for managing risk. Following VA concurrence of strategies, the Contractor shall modify and update existing plans, procedures, and tools to bring them into compliance to meet VA requirements.

The Contractor shall maintain a risk management tool using VA hosted repositories.

Within that tool, the Contractor shall create and maintain a rolled-up Risk Register for each PL that shall be updated on a weekly basis, along with an encompassing CORP Risk Register that shall be updated on a weekly basis and will be the central repository for all risks identified within CORP. The risk register must contain all issues and information such as description, product name, source, impact, and resolution. The Contractor shall examine and incorporate technology-driven risk assessment tools to proactively identify and mitigate risks.

Utilizing the Risk Registers, the Contractor shall:

a. Identify, document, and monitor program management risks as well as coordinating with business and technical representatives to gather and capture those risks in the Risk Register. Each risk has a unique identifier and includes information such as source, product, trigger, description, impact, impact severity, probability of occurrence, mitigation strategy, risk category, response strategy, and dependencies.

b. Create and maintain an Issue Log. Each issue will have a unique identifier and includes information such as source, product, description, impact, severity, response strategy, risk category, and dependencies.

c. Deliver an Issue Analysis Report. Conduct detailed analysis of identified issues describing background, alternatives, and recommended next steps.

d. Maintain reporting and create any needed new reports that outline program risks.

Assess risk mitigation strategies already in place for dependent applications and create strategies to ensure compatibility and compliance.

e. Be able to escalate all risks to its higher-level risk register.

A. Risk Management Plan

B. Risk Registers C. Issue Log D. Issue Analysis Report

5.3.4 STRATEGIC PLANNING AND ANALYSIS

The Contractor shall create and review strategies to develop and document alternatives to address technical and schedule challenges that will enhance CORP for the current and future state. The Contractor shall conduct research regarding various aspects of proposed strategies and alternatives and provide summaries of findings. Where applicable, the Contractor shall identify and apply a variety of process analysis approaches to determine the impact of complex issues. When alternative strategies and approaches are required, the Contractor shall provide a composite list of all alternatives considered, and a detailed summary of cost, schedule, and performance risks and benefits of each. The Contractor shall identify and apply advanced technology that offer instant insights and predictive analysis to aid in making well-informed, data-centric decisions that align with CORP goals. Following VA PMs approval of selected strategies, the Contractor shall document and analyze outcomes.

The Contractor shall provide strategic planning and analysis support, including the following:

a. Maintain mission and vision statements while providing recommendations to build operational plans and specify measurable outcomes through a consolidated strategic planning process.

b. Make recommendations to and assist in the monitoring of program goals, objectives, and plans.

c. Apply sound business principles and performance metrics. Provide metrics analysis and insight into operating performance, and then make recommendations for improvements.

d. Conduct complex management studies and reviews including analysis of organizational structure, policy, processes, and operations.

e. Analyze programs, functional areas, and organizations to determine whether the management systems currently being utilized are efficiently accomplishing the objectives sought and whether they provide controls necessary for sound management.

f. Perform analysis and reporting impacts to CORP due to business case savings analysis, new products, new scope, organization changes, business changes, pricing adjustments and unplanned events.

g. Prepare and manage an Organizational Strategic Analysis and Action Plan.

A. Organizational Strategic Analysis and Action Plan

5.3.5 MEETING SUPPORT

The Contractor shall coordinate with Government leadership to plan, facilitate, and document a variety of meetings. The Contractor shall coordinate with proposed meeting participants to compare calendars and identify mutually acceptable meeting dates, times, cadence, and locations (virtual or in person). The Contractor shall schedule meetings using automated tools (e.g., Outlook and Teams), VA’s teleconferencing system, and/or reserve Government facilities and equipment. The Contractor shall create a Meeting Agenda, define meeting outcomes, and collect data prior to the meeting. The Contractor shall facilitate meetings using tools such as Teams, Teams Live Meetings, and Mural, as well as present slides and meetings content.

The Contractor shall provide Meeting Minutes from all briefings and meetings to include attendees, topics of discussions, related responses or decisions, and Action Items. The Contractor shall create, organize, and track all Action Items though completion.

The Contractor shall support the following events:

a. Maturity Level reviews

b. Program Increment (PI) planning

c. Retrospectives

d. Requirements reviews

e. Design reviews

f. Test readiness reviews

g. Reviews required as part of the approved VA OIT project management methodology

h. Critical Decision Reviews (CDRs)

i. Product Management reviews

j. Technical reviews

k. Daily scrums

l. Integrated Product Team (IPT) meetings

m. IPT workgroups

n. Strategy reviews and working groups

o. Management status reviews

p. Other CORP related meetings

Deliverables:

A. Meeting Agenda B. Meeting Minutes C. Action Items

5.3.6 CAPITAL PLANNING AND INVESTMENT CONTROL (CPIC)

The Contractor shall collaborate and coordinate with CORP and their designees to ensure the integration of product budgets with management reports to support timely and accurate financial management and reporting activities.

The Contractor shall prepare, and review planning and expenditures data related to Operational Management Review, Internal Process Review, and Enterprise Project Structure and all other reporting requests to ensure accuracy.

The Contractor shall:

a. Provide day-to-day tracking of execution year funding.

b. Assist in the development and updating of budget execution artifacts. Coordinate with the VA Management Analysts (MA), SPM, Budget Execution Team, Program Planning & Oversight Investment Managers and Procurement Coordinators to ensure that budget status reports and monthly “actuals” for inclusion in the monthly OMB IT Dashboard submission are valid.

c. Monitor and coordinate the preparation of program reports, ensuring collaboration with the VA MA and their designees to include:

• Quarterly, mid, and end of year reviews

• Monthly Program Reviews

• Operational Management Reviews

• Budget Execution Reports to include Change Requests (CRs), Balance Line

Data and Obligation Rates

• Historical execution inputs to aid in the development and update of budget formulation artifacts for Government Accountability Office and Office of Inspector General (OIG) inquiries

• Data calls from sources that may include VA Internet Quorum, SPM, Budget, and OIG

• Financial Management System reports and reconciliation

d. Coordinate the integration of fiscal management support activities with overall program management activities by:

• Participating in the meetings on program requirements priorities and providing mapping and impact analysis.

• Coordinating and collaborating with leadership and their designees to identify and communicate to the VA PM budget risks and proposed risk responses.

• Identifying and escalating issues to the VA PM and MA that cannot be resolved at the working group…