24D22 PWS_Analytics and Administration_SSNR 2.0.docx

Technical and Business Management Support for Social Security Number (SSN) Reduction

VA-24-00032265

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Office of Information Technology Software Products Management, Portfolio Integration (SPM/PI)

Technical and Business Management Support for Social Security Number (SSN) Reduction

Date April 22, 2024

VA-24-00032265

PWS Version Number: 1.0

Contents

BACKGROUND

The mission of the Department of Veterans Affairs (VA) Office of Information and Technology (OIT) Software Products Management (SPM) is to design, deliver, maintain, and harden software assets across VA through portfolios including Corporate Services, Health Services, Benefits and Memorials, and Financial Technology. SPM accomplishes its mission by continually increasing efficiency, reducing technical debt, and modernizing offerings to support VA’s priorities and enhance the Veteran experience. SPM employs product line management best practices to speed the delivery of products and services to VA’s workforce and the Nation’s Veterans.

The SPM is organized into six units – one of the units is the Portfolio Integration Office (SPM/PIO) unit which is responsible for governance, oversight, and technical support across all Portfolios and Product Lines within SPM which have enterprise-wide impacts. This team supports the full product life cycle within the DevSecOps environment. SPM serves as a crucial element in meeting the goals of building accessible and quality IT software solutions. Within the SPM/PI is the Special Projects (SP) Team which handles End-of-Life (EOL) Unauthorized Software, U.S. Space Force, and Social Security Number Reduction (SSNR).

The SSN Fraud Prevention Act of 2017 requires all Social Security Numbers currently used as identifiers or authenticators be eliminated from all VA documents and files for all electronic and information technology procured, used, maintained, or developed by the VA.

The work performed in this Performance Work Statement (PWS) shall assist in adhering to the Federal Law and avoid being in violation of the SSN Fraud Protection Act requirements by removing social security numbers from all products and systems (with a minimal exception). This project provides oversight, coordination, and tracking across all Products and Product Lines to ensure VA compliance.

APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. 44 U.S.C. § 3541-3549, “Federal Information Security Management Act (FISMA) of 2002”

2. “Federal Information Security Modernization Act of 2014”

3. Federal Information Processing Standards (FIPS) Publication 140-2, “Security Requirements for Cryptographic Modules”

4. FIPS Pub 199. “Standards for Security Categorization of Federal Information and Information Systems,” February 2004

5. FIPS Pub 200, “Minimum Security Requirements for Federal Information and Information Systems,” March 2006

6. FIPS Pub 201-2, “Personal Identity Verification of Federal Employees and Contractors,” August 2013

7. 10 U.S.C. § 2224, "Defense Information Assurance Program"

8. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974.”

9. Public Law 109-461, Veterans Benefits, Health Care, and Information Technology Act of 2006, Title IX, Information Security Matters

10. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”

11. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, https://www.va.gov/vapubs/index.cfm

12. VA Handbook 0710, “Personnel Security and Suitability Program,” May 2, 2016, https://www.va.gov/vapubs/index.cfm

13. VA Directive and Handbook 6102, “Internet/Intranet Services,” August 5, 2019

14. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and Guidelines,” January 18, 2017

15. Office of Management and Budget (OMB) Circular A-130, “Managing Federal Information as a Strategic Resource,” July 28, 2016

16. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed Services (CHAMPUS)”

17. NIST SP 800-66 Rev. 1, “An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule,” October 2008

18. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended, January 18, 2017

19. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

20. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021

21. VA Handbook 6500, “Risk Management Framework for VA Information Systems VA Information Security Program,” February 24, 2021

22. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI),” March 12, 2019

23. VA Handbook 6500.5, “Incorporating Security and Privacy into the System Development Lifecycle,” March 22, 2010

24. VA Handbook 6500.6, “Contract Security,” March 12, 2010

25. VA Handbook 6500.8, “Information System Contingency Planning,” April 6, 2011

26. VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018

27. VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017

28. OIT Process Asset Library (PAL), https://www.va.gov/process/ . Reference Process Maps at https://www.va.gov/process/maps.asp and Artifact templates at https://www.va.gov/process/artifacts.asp

29. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

30. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014

31. VA Handbook 6508.1, “Procedures for Privacy Threshold Analysis and Privacy Impact Assessment,” July 30, 2015

32. VA Handbook 6510, “VA Identity and Access Management,” January 15, 2016

33. VA Directive and Handbook 6513, “Secure External Connections,” October 12, 2017

34. VA Directive 6300, “Records and Information Management,” September 21, 2018

35. VA Handbook, 6300.1, “Records Management Procedures, “March 24, 2010

36. NIST SP 800-37 Rev 2, “Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy,” December 2018

37. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020)

38. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015

39. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” March 24, 2014

40. OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005

41. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019

42. OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008

43. Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance, December 2, 2011, (NOTE: Part A of the FICAM Roadmap and Implementation Guidance, v2.0, was replaced in 2015 with an updated Architecture (https://arch.idmanagement.gov/#what-is-the-ficam-architecture)

44. NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access, “June 2018

45. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, “Digital Identity Guidelines,” updated March 02, 2020

46. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014

47. NIST SP 800-164, “Guidelines on Hardware-Rooted Security in Mobile Devices (Draft),” October 2012

48. Draft National Institute of Standards and Technology Interagency Report (NISTIR) 7981, “Mobile, PIV, and Authentication,” March 2014

49. VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

50. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

51. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

52. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

53. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019

54. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008

55. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (Public Law 110–140), December 19, 2007

56. Section 104 of the Energy Policy Act of 2005, (Public Law 109–58), August 8, 2005

57. Executive Order 13834, “Efficient Federal Operations,” dated May 17, 2018

58. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 2, 2001

59. VA Directive 0058, “VA Green Purchasing Program,” July 19, 2013

60. VA Handbook 0058, “VA Green Purchasing Program,” July 19, 2013

61. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

62. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

63. “Veteran Focused Integration Process (VIP) Guide 4.0,” January 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

64. VA Memorandum “Proper Use of Email and Other Messaging Services,” January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

65. “DevSecOps Product Line Management Playbook” version 2.0, May 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

66. NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020

67. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol Version 6 (IPv6),” November 19, 2020

68. Social Security Number (SSN) Fraud Prevention Act of 2017

69. Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23, 2018

70. Federal Information Technology Reform Act [Title VIII, Subtitle D of the National Defense Authorization Act (NOAA) for Fiscal Year 2015, Pub. L. No. 11 3-291] as amended.

71. Information Technology Management, as amended, 40 U.S.C. Subtitle III

72. Adoption of the Integration Control Number (ICN) as an alternative to SSN for SSN Reduction and Elimination" (VIEWS 04829289).

SCOPE OF WORK

The Contractor shall include, at a minimum provide Enterprise business and technical IT strategic support services to assist in reaching SPM/PI Special Projects desired outcomes. This request for support is divided into three (3) domains of the “Remediation” processes. The SSNR Program support includes Master Person Index (MPI) Integration or similar as initial domain, with additional domains ensuring full SSNR remediation consistent with relevant legislation previously mentioned.

The Contractor shall, at a minimum, review, analyze, and catalog approximately 1150 VA Products (IT Systems) throughout the life of the contract, bringing them into legislative compliance. The Contractor shall perform the following:

a. Business Functions to IT Systems Analysis Crosswalk

b. MPI Integration of VA IT Product that have not been integrated with MPI.

c. Preliminary - SSN Protections Analysis (Planning & Execution)

PERFORMANCE DETAILS

PERFORMANCE PERIOD

The Period of Performance (PoP) shall be 12 months from date of award, with four 12-month option periods and eight Optional Tasks. The overall POP shall not exceed 60 months.

There are eleven (11) Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, four are set by date:

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

PLACE OF PERFORMANCE

Tasks under this PWS shall be performed at Contractor facilities. The Contractor shall identify the Contractor’s place of performance in their proposal submission.

TRAVEL

The Government does not anticipate any travel under this effort.

SPECIFIC TASKS AND DELIVERABLES

The Contractor shall perform the following:

PROJECT MANAGEMENT

CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall include, at a minimum deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, timeline, and tools to be used in execution of the contract. The CPMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks, and resource support. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPMP shall be concurred upon and updated in accordance with Section B of the contract. The Contractor shall update and maintain the VA PM approved CPMP throughout the PoP.

Deliverable:

A. Contractor Project Management Plan

REPORTING REQUIREMENTS

The Contractor shall provide the COR with Weekly Progress Reports in electronic form in Microsoft Word and Project formats. The report shall include detailed instructions/explanations for each required data element, to ensure that data is accurate and consistent. These reports shall reflect data as of the last day of the preceding Weekly reporting period.

The Weekly Progress Reports shall cover all work completed during the reporting period and work planned for the subsequent reporting period. The report shall also identify any problems that arose and a description of how the problems were resolved. If problems have not been completely resolved, the Contractor shall provide an explanation including their plan and timeframe for resolving the issue. The Contractor shall monitor performance against the CPMP and report any deviations. It is expected that the Contractor will keep in communication with the COR and OIS Leadership between Weekly Progress Reports as needed so that issues that arise are transparent to both parties to prevent escalation to risks.

The Weekly Progress Report shall include the following data elements:

a. Overarching Project Name and PWS Name

b. Overall high-level assessment of Contractor progress and related outcomes

c. All work in-progress completed during the reporting period, presented in a user-friendly format for program management.

d. Identification of any programmatic issues uncovered during the reporting period; highlight those areas with a high probability of impacting schedule, cost, or performance goals.

e. Explanations for any unresolved issues, including possible solutions and any actions required of the Government and/or Contractor to resolve or mitigate any identified issue, including a plan and timeframe for resolution.

f. Status on previously identified issues, actions taken to mitigate the situation and/or progress made in rectifying the situation.

g. Work planned for the subsequent reporting period.

h. Current schedule overlaid on initial schedule showing any delays or advancement in schedule of key communication activities.

i. Current schedule overlaid on initial schedule showing any delays or advancement in schedule of project deliverables.

j. Workforce staffing data showing all Contractor personnel performing on the effort during the current reporting period. After the initial labor baseline is provided, each Weekly Progress Report shall identify any changes in staffing, identifying each person who was added to or removed from the contract.

k. Original schedule of deliverables and Contractor progress towards meeting each deliverable.

Deliverable:

A. Weekly Progress Report

TECHNICAL KICKOFF MEETING

A technical kickoff meeting shall be held within 10 days after contract award. The Contractor shall coordinate the date, time, and location (can be virtual) with the Contracting Officer (CO), as the Post-Award Conference Chairperson, the VA PM, as the Co-Chairperson, the Contract Specialist (CS), and the COR. The Contractor shall provide a draft agenda and Technical Kickoff Briefing Slides to the CO and VA PM at least five (5) calendar days prior to the meeting. Upon Government approval of a final agenda, the Contractor shall distribute to all meeting attendees. During the kickoff-meeting, the Contractor shall present, for review and approval by the Government, the details of the intended approach, work plan, and project schedule for each effort via a Microsoft Office PowerPoint presentation. At the conclusion of the meeting, the Contractor shall update the presentation with a final slide entitled “Summary Report” which shall include notes on any major issues, agreements, or disagreements discussed during the kickoff meeting and the following statement “As the Post-Award Conference Chairperson, I have reviewed the entirety of this presentation and assert that it is an accurate representation and summary of the discussions held during the Technical Kickoff Meeting for the Technical and Business Management Support for Social Security Number (SSN) Reduction.” The Contractor shall submit the final updated presentation to the CO for review and signature within three (3) calendar days after the meeting. The Contractor shall also work with the CS, the Government’s designated note taker, to prepare and distribute the meeting minutes of the kickoff meeting to the CO, COR, and all attendees within three (3) calendar days after the meeting. The Contractor shall obtain concurrence from the CS on the content of the meeting minutes prior to distribution of the document.

Deliverable:

A. Technical Kickoff Briefing Slides

PRIVACY & HIPAA TRAINING

The Contractor shall submit Talent Management System (TMS) training certificates of completion for VA Privacy and Information Security Awareness and Rules of Behavior and Health Insurance Portability and Accountability Act (HIPAA) training and provide signed copies of the Contractor Rules of Behavior in accordance with Section 9, Training, from Appendix C of the VA Handbook 6500.6, “Contract Security”.

Deliverables:

A. VA Privacy and Information Security Awareness and Rules of Behavior Training Certificate B. VA HIPAA certificate of completion C. Signed Contractor Rules of Behavior

ONBOARDING SUPPORT

The Contractor shall manage the onboarding process for VA access and to individual system/environment access for all Contractor staff supporting this contract. The Contractor shall collect signed rules of behavior documents, signed non-disclosure agreements, training certificates, applications for access to VA information systems, TMS, PIV card requests and other onboarding related information for assigned projects, and provide secure storage for these electronic files, in accordance with National Archives and Records Administration (NARA) and VA guidance. The Contractor shall provide the files and information to VA PM, COR, or other VA staff, to support VA’s onboarding process for granting access to VA systems. The Contractor shall submit access requests, including TMS applications, PIV card applications, remedy tickets, and electronic Contractor Access Request Forms (eCARFs) in accordance with VA onboarding processes. The Contractor shall monitor the submission of the artifacts and follow up with Contractors to assure that all artifacts submitted are complete and correct. The Contractor shall also track VA system access requests, for assigned projects, to completion. The Contractor shall document all findings in the Weekly Onboarding Status Report.

Deliverable:

A. Weekly Onboarding Status Report

SOCIAL SECURITY NUMBER (SSN) REDUCTION SUPPORT SERVICES (VA PRODUCTS (IT SYSTeMS)) (FFP The Contractor shall, at a minimum, review, analyze, and catalog approximately 150 VA Products (IT Systems) throughout the life of the contract, bringing them into legislative compliance. VA will identify the selected IT businesses and/or products, for SSNR remediation evaluation, the Contractor shall perform the evaluation on approximately 400 VA products, annually.

SOCIAL SECURITY NUMBER REDUCTION (SSNR) SUPPORT (FFP)

The Contractor shall, at a minimum, support Department-wide efforts to eliminate unnecessary collection, maintenance, and use of Social Security Numbers (SSNs) and support Departmental compliance with the SSN Fraud Prevention Act, Consolidated Appropriations Act and Federal and VA requirements related to SSNR efforts.

Business Functions to IT Systems Analysis Crosswalk The Contractor shall, at a minimum, provide an IT systems analysis crosswalk of business processes and products (IT systems) and the impact of undergoing SSNR remediation Upon VA identifying the selected IT businesses and products, the Contractor shall perform this crosswalk on the IT Products (systems). This Business Processes to IT Systems Crosswalk Analysis Plan should include, at a minimum: the Analysis of Business Processes to System Functions by System (Both IT and Business Objectives Capabilities/Understanding); the development of an SSN System and Business Use Cases per VA Product; a “Master IT Systems Crosswalk Listing”; development of a “Identify and Document Up/Downstream Business Dependencies” with in and out of IT System Interfaces; in addition, ready to facilitate a series of “Tabletop” exercises aimed at validating the findings from the plan. In addition, the Business Processes to IT Systems Crosswalk Analysis Plan shall include Illustrations of SSN System and Business Dependencies per VA Product, deliver a Web-based Platform Archiving Contract Deliverables, Catalog of SSN System and Business Use Cases per VA Product, deliver a Master IT Crosswalk Listing, prepare System Functions Crosswalk and Traceability Documentation/TableTop Deliver Post-Analysis Finding Report

These requirements are in accordance with the Consolidated Appropriations Acts (CAA) 2023/2024. Business functions that affect system processes and functions must be analyzed to determine technical enhancements of remediation (fixes) required.

a. The Contractor shall, at a minimum, identify all systems and business processes that involve SSN data. This helps OIT identify necessary enhancements and/or remediation of system methods, functions, processes and/or procedures. If there are quality or quantity gaps in reported Business Processes delivered to SPM/PI, then the Contractor shall provide project/program risks to OIT/SPM and VA Systems Inventory (VASI) systems. To support this effort, the Contractor must coordinate with business and system (technical) representatives to thoroughly progress through affected systems and catalog the changes required from the “As-Is" to convert to the "To-Be” processes identified by the business owners. This plan shall include, at a minimum, the processes identifying technical solutions with proposed business process that may be affected. This includes varying approaches based on risk, system types, and other categorizations. The Contractor shall assist the team in the identification of VA Products (IT systems) dependencies (up/down stream) that are an integrated part of the solutioning consideration. The “Business Processes to IT Systems Crosswalk Analysis Plan“ shall also include, at a minimum, the creation of a methodology for a “Visual Display” of the crosswalk between the Business Processes and IT Functions; assist in meeting with VA Product Teams to obtain understanding of the VA Product being analyzed; do an analysis Business Processes to System Functions by System (Both IT and Business Objectives Capabilities/Understanding); Catalog of SSN System and Business Use Cases per each VA Product; Prepare a Post-Analysis Artifact; Identify and Catalog Methods, Procedures, Functions, that can be utilized as SSNR Remediation tools, as tracking mechanisms; Catalog and Document all Identified Interface Dependencies the development of a SSN System and Business Use Cases by VA Product; develop and maintain a “Master IT Systems Crosswalk Listing” with diagrams for reporting as well as the identification and documenting of Up/Downstream Business Dependencies in and out of VA IT System Interfaces; Provide personnel to facilitate the VA SSNR TableTop exercises marrying the business functionality to the IT functions for assessment of the ideal pilot to test the first SSNR changes. The Contractor shall update the Business Processes to IT Systems Crosswalk Analysis Plan, as needed and as selected IT Products are added to the SSNR analysis and remediation process.

The Contractor shall not identify remediation efforts to a product or system without a complete knowledge of the total impact on the business and product alike. Underestimating the business impact could prove to be catastrophic. The Contractor shall ensure that due diligence has been applied in identifying all the risks and locations involved in the remediation of any product or system. This includes business processes and/or products (systems) up and downstream dependencies (interfaces). Deriving and doing the analysis of SSN Use Cases across the enterprise to determine the compliance of the “Use Case” to the legislative mandate.

Deliverable:

A. Business Processes to IT Systems Crosswalk Analysis Plan

Program Management Plan (FFP) The Contractor shall provide a Program Management Plan with dependencies and constraints to include all known assumptions in the planning of the “remediation” process for SSNs. The program plan must identify how outcomes and deliverables must be realized through the management of this plan. This plan shall include, at a minimum, a roadmap for success. This roadmap shall have timelines (Integrated Master Schedule (IMS)) on which the tasks that make up the number of projects within the plan and the critical project(s) points, with start and end dates. However, since this is a program, there are several projects mapped across a timeline, which will assist in the strategy and collaboration of this plan. This shall include the required governance, organizational structure, and the process to which the plan is to utilize, control and execute through this plan. The Program Management Plan shall include an IMS, (communication plan, risk (covered separately), Resource Management Plan, Project Management Plans with template for each of the Projects, Change Management & Control Plans to include Change Control Methodology and establishment of a Change Control Board, closeout procedure and all the other general aspects of creating a program plan. This Program Management Plan is an essential part of the management of projects under the SSNR Remediation Program umbrella.

The Program Management Plan exists to manage, execute, and control the program and its goals and objectives within the SPM SSNR Remediation process. Therefore, this program plan, shall outline and consist of the overview and strategy for the program. To do this, the program must be clearly defined, and the scope outlined. This Program Management Plan will be concerned with more of the outcome, benefits, and the quality of its deliverables. For this program plan, success lives in how well the program is meeting the requirements, outcomes and OKRs (Outcomes & Key Results) SPM SSNR Program Team. The Contractor shall update the Program Management Plan, if needed and as selected IT Products are added to the SSNR analysis and remediation process.

Deliverable:

A. Program Management Plan

Change Management Methodology Plan (FFP) The Contractor shall devise and construct a Change Management Strategy and Implementation Plan, this strategy and plan shall provide, at a minimum, the establishment of a change control methodology and recommended members for the board. The Contractor shall provide a Change Management Methodology document detailing the methodology, covering the selected IT Business Processes and Products. The Contractor shall update the Change Management Methodology Plan, as necessary and as additional IT Products are added to the SSNR analysis and remediation process. The document shall also include a “Change Management Template” and an “Escalation Methodology” for major issues and concerns. In addition, the Contractor shall facilitate, track, and manage the changes obtained. The Contractor shall update the Change Management Strategy and Implementation Plan and the Change Management Methodology, if needed and as selected IT Products are added to the SSNR analysis and remediation process.

Deliverable:

A. Change Management Strategy and Implementation Plan B. Change Management Methodology

Enterprise Architecture (FFP) The Contractor shall obtain an understanding of the Enterprise Architecture surrounding the SSN usage, and document where remediation is to take place. The Contractor shall develop and update, as necessary, an Enterprise Architecture Document and Diagram to include, at a minimum, a diagram, for future use, as well as perform VA Product SSNR Validation and Assessment to include an SSNR Registry and Listing; and maintain a knowledge base of “Migration Strategies and Efforts” for all the selected IT Business Processes and Products. The Contractor shall update the Enterprise Architecture Document and Diagram as needed and as additional IT Products are added to the SSNR analysis and remediation process.

Deliverable:

A. Enterprise Architecture Document and Diagram

Strategic Communications Plan (FFP) The Contractor shall, at a minimum, provide effective and timely communications with major Points-of-Contact (POCs) of all stakeholder groups and individuals, (both internal to the VA and external to the VA), such that objectives, approaches, plans, status, progress, risks, and issue communications are effectively defined and promulgated to the appropriate stakeholders, groups, teams, and entities. Communications and its related processes and plans shall include, at a minimum, the following stakeholders: Veterans and other external entities, VA and OIT executives, directors, Product Line Managers (PLMs), Product Owners, Product technical staffs, OIT Business Integration and Outcomes Service (BIOS) team, PMO teams, SPM management and SPM teams, and all SPM Special Project Core Team members. The Contractor shall provide a Strategic Communications Plan to cover all the selected IT Business Processes and Products. The Contractor shall update the Strategic Communications Plan as necessary and as additional IT Products are added to the SSNR analysis and remediation process.

Stakeholder Management, Outreach Management, Risk Management, and Issue Management are all synthesized with Strategic Communications Planning such that they are leveraged together to the benefit of the Program, in total. Issue Management will be covered under a separate deliverable. The Contractor shall define approach, design, and implement 508 compliant enhancements to SPM and other websites and share-point sites to document, retain, and communicate information for each of the stakeholder groups and to support information gathering and dissemination across stakeholders to support the communications, stakeholder, risk, outreach, and issue management processes in a tightly coupled and integrated fashion.

The Contractor shall, at a minimum, create communication tools and materials for various audiences, specifically VA executives, Portfolio Managers, PLMs Product Managers, and various IT staff members, BIOS, Program Management Offices, Veterans, and other external parties. These communications tools could include dashboards and other communication tools. The Contractor shall develop communication strategies and plans for various information campaigns. The Contractor shall define, design, and prepare communications strategies within the organization as well as evaluate and assist in establishing Standard Operating Procedures (SOPs). The Contractor shall review and edit communications submitted for organizational issues and work closely with various agency departments to ensure messages are delivered clearly and effectively. The Contractor shall create, review, retrieve, utilize, consolidate, and/or reconcile existing deliverables to obtain relevant information and assist in the preparation, effective and efficient support and delivery and completion of other deliverables, to include ad hoc, periodic (ex. weekly, bi-weekly, monthly) communications deliverables and provide drafts for government review and approval prior to promulgating to intended receivers.

The Contractor shall, at a minimum, provide communication strategy elements to include dashboards, websites, mobile applications, graphic design elements, intranet sites, share-point based websites.

The Contractor shall, at a minimum, identify communication needs of and with overall program level. The Contractor shall develop and implement Initial Communications Plan with objectives and outcomes which are planned and defined. The Contractor shall provide weekly status updates digitally on SharePoint sites and Dashboards with the on-going migration efforts through to successful implementation and final completion. Create/ refine / implement and support a web-based platform displaying and archiving contract deliverables. The Contractor shall develop SharePoint and Dashboard Schemas for reporting and metric updating. The Contractor shall format, upload, test, and display multiple-level Metrics to SharePoint sites, websites, and Dashboards as part of the Communications Plan. All SharePoint sites, websites, and dashboards shall fulfill Section 508 standards for accessibility. The Strategic Communications Plan shall be provided within 60 days of contract award, and updated if needed and as selected IT Products are added to the SSNR analysis and remediation process.

Deliverables:

A. Strategic Communications Plan

Outreach Management Plan (FFP) The Contractor shall identify Outreach Processes by identifying and planning the needs of portfolios with an overall program level communications plan, and related plans and processes. The Contractor shall provide an Outreach Management Plan that, at a minimum, identifies outreach communication requirements at the overall program, portfolio levels. and product/service-line management levels. Identify outreach requirements for each product, including the needed outreach to each IT system owner. The Contractor shall coordinate and confer with portfolio directors and PLM on program-level efforts; develop and implement initial Outreach Management Plan with objectives and outcomes, outlined to the relevant party’s base upon requirement per the defined plan. The Outreach Management Plan shall be provided within 60 days of contract award, with updated if needed and as selected IT Products are added to the SSNR analysis and remediation process.

The Contractor shall, at a minimum, assist with providing strategic management of outreach support to teams and owners of up to a 1000+ separate IT applications. This outreach support shall include expert advice, assistance, and guidance; strategic business and IT remediation and updating/ modernizing action planning; and development of IT owner, IT management, customer, Program-level, and IT technical owner feedback systems to successfully gather information using surveys, requests for status and plans, assessments (custom-designed as needed). The Contractor shall provide customer outreach planning and provide guidance and SOPs specifically on Outreach Management.

For Outreach Management, all major POCs for outreach are to be effectively identified and contacted such that they are informed, consulted, and interacted with so that these outreach POCs and groups have the proper information provided to them and are proactively contacted so that they can effectively engage as appropriate in the program.

The Contractor shall update the Outreach Management Plan, if needed and as selected IT Products are added to the SSNR analysis and remediation process.

Deliverable:

A. Outreach Management Plan

Stakeholders Management (FFP) The Contractor shall create a Stakeholder Management Plan approach. The Contractor shall develop and implement the initial Stakeholder Management Plan with objectives and outcomes. Refine the plan, as needed, to increase stakeholder engagement, responses, and needed data and inputs for each technical IT system, and Product Line area. The Contractor shall coordinate with Stakeholders to effectively facilitate analysis, planning, software remediation and modernization approaches and plans engagement. The initial Stakeholder Management Plan shall be provided within 60 days of contract award, with plan refinements and plan updates provided, if needed and as selected IT Products are added to the SSNR analysis and remediation process.

The Contractor shall include, at a minimum identify stakeholders and stakeholder groups, and establish stakeholder relationships The Contractor shall interact with each stakeholder, so that they are aware of appropriate program information during the appropriate time. The Contractor shall effectively interact with Stakeholders such that needed information, status, plans, and other relevant information is provided from each stakeholder appropriately to plan and execute the program efficiently and effectively.

Deliverable:

A. Stakeholders Management Plan

Risk Management Plan (FFP) The Contractor shall, at a minimum, identify, assess, and manage risks for each Project and overall Program, to include Risk Registers with mitigation strategy. The Contractor shall create a Risk Management Plan and process with an adequate number of Risk Registers required for each project. Maintain Knowledge Base of Mitigation Strategy and Efforts. Provide in the Risk Management Plan the business Issues or concerns that may impede remediation, modernization, or migration to newer systems, versions, or platforms. The Contractor shall provide a Risk Occurrence Document within three (3) days of any risk occurrence. Management of Issues is included and in-scope to the total Risk Management Plan and process. The Contractor shall include, at a minimum develop, document, refine and operate the effort including Risk Definitions, the Risk Management Plan, and Risk occurrence documents. The Risk Occurrence Documents shall include situational, interdependence, magnitude, level, likelihood, impact, consequence, and other aspects as appropriate for each risk. The Contractor shall develop, implement, and provide the initial Risk Management Plan with objectives and outcomes within 60 days of contract award, and provide updates if needed and as selected IT Products are added to the SSNR analysis and remediation process.

The Risk Management Plan shall provide a planned and implemented Risk and Issue Management Process and Program to identify, quantify, analyze, mitigation planning, perform risk response planning, track, control, mitigation implementation, and reaction such that Risk impacts are minimized and the Program achieves its objectives, while risk and the risk impacts are minimized. Internal and external, predictable, and unpredictable risks are in-scope, of the risk and issue management process. As the Program’s success is tied to key business objectives, application of risk management and its associated processes early and on a continuing basis is essential. Risk Management and its associated processes shall be tightly coupled to both project and Program planning and management. The Contractor shall update both the Risk Registers and the Risk Occurrence Document, if needed.

Deliverable:

A. Risk Management Plan and Risk Registers B. Risk Occurrence Document

Problem and Incident Management Plan (FFP) The Contractor shall, at a minimum, provide assistance in obtaining and tracking current problems/incidents and reporting updates weekly. The Contractor shall develop a Problem and Incident Management Plan to include methodology as well as provide a Weekly Problem/Incident Report (addressing only problems with MPI Migration or changes with the SPM Product pipeline). The Contractor shall update the Problem and Incident Management Plan as needed and as additional IT Products are added to the SSNR analysis and remediation process. The Contractor shall updatethe Weekly Problem/Incident Reportto include any additional IT Products that have been added to the SSNR analysis and remediation process.

Deliverable:

A. Problem and Incident Management Plan B. Weekly Problem/Incident Report

Systems Assessment & Validation Plan (FFP) The Contractor shall develop a Systems Assessment & Validation Plan that includes, at a minimum, a list of all Systems that are currently compliant to the legislation with rationale and provide a level of effort (LOE) assessment and recommendations for activities required for compliance. The Systems Assessment & Validation Plan shall be updated as needed and as additional IT Products are added to the SSNR analysis and remediation process.

Deliverable:

A. Systems Assessment & Validation Plan

Product Migration Plan (FFP) The Contractor shall provide a Product Migration Plan with, at a minimum, a System Post-Analysis Findings Template (Digital: MS Word Template) to include plan product migration/compliance efforts; make recommendation for remediation by developing a “Remediation Strategy” for each “Use Case”, then facilitate, coordinate and track product migration/compliance efforts; identify tasks necessary for a product’s full SSNR migration as well as identify and prepare all components necessary for a Product Migration Plan. The Contractor shall update the Product Migration Plan, as needed and as selected IT Products are added to the SSNR analysis and remediation process.

Deliverable:

A. Product Migration Plan

SOCIAL SECURITY NUMBER(SSN) CONVERSION TO INTEGRATION CONTROL NUMBER (ICN) (FFP)

MPI Integration of VA IT Product The Contractor shall assist in the development of a Methodology for Tracking the Implementation of “MPI Conversion Enhancements” on VA IT products. The tracking methodology shall address all the IT Products and should only need to be updated on outlier IT Products. The SPM/PI SSNR project team seeks to obligate SSNR program appropriations for VA Systems that are flagged for MPI conversion activities in Budget Fiscal Year (BFY) 2024. This tracking methodology shall assist SPM/PI, as the appropriated and obligated funds for MPI conversions will fall into the Product Line’s budget and can be expensed only for the products flagged for conversion activities. This tracking methodology shall assist the SSNR program with tracking and reporting on spending related to conversion progress. Appropriations obligated to Product line or Product budgets, controlled by SSNR project dimensions, allows for VA systems carrying out conversions to financially support the planning and execution of MPI conversion activities.

The Integration Control Number (ICN) is the VA CIO’s preferred method of an alternative identifier that is required to ensure that all remediation candidates are converted from SSN to ICN prior to remediation. There are over 100 VA products (IT systems) that must be converted during FY24 that fall into this category. This conversion meets the requirements laid out by the VA Deputy Secretary issuance of the VAIQ 7836410, VA Person Identity Authoritative Source Selection on February 22, 2018, and VA CIO memo titled "Adoption of the Integration Control Number (ICN) as an alternative to SSN for SSN Reduction and Elimination" (VIEWS 04829289). MPI is the authoritative identity services within the VA to leverage the ICN in place of SSN. The products (IT systems) must integrate with MPI.

The Contractor shall at a minimum identify and coordinate the preliminary work that is required prior to the remediation for those “targeted” products (IT systems) that have not yet been integrated with the MPI to take advantage of the SSN to ICN data stored in MPI. These tasks are mandated by the VA CIO memo titled "Adoption of the Integration Control Number (ICN) as an alternative to SSN for SSN Reduction (SSNR) and Elimination" (VIEWS 04829289). No VA Product (IT System) will use the SSN outside of compliance.

The Contractor shall at a minimum provide Weekly Status and Metrics Reports on the progress made by Identity Access Management (IAM) organization in their MPI integration process. The Contractor shall update the Methodology for Tracking the Implementation of “MPI Conversions Enhancements” as needed and as selected IT Products are added to the SSNR analysis and remediation process. The Weekly Status and Metrics Reports shall be expanded as selected IT Products are added to the SSNR analysis and remediation process.

Deliverables:

A. Methodology for Tracking the Implementation of “MPI Conversions Enhancements” B. Weekly Status and Metrics Reports

SSN PROTECTIONS ANALYSIS (PLANNING & EXECUTION) – Data Protection Plan (FFP) The Contractor shall provide a Data Protection Plan to assist in the planning for preliminary protection of SSN data, to protect customer PII/PHI until a permanent solution has been identified and implemented across the IT enterprise, for those products that are non-compliant requiring either an exemption until early decommissions dates (prior to 09/2026 or shortly thereafter this date); or are not able to be remediated due to complexity or volume of interfaces. Components of the Data Protection Plan shall adhere to a proposed policy for “Required for Data Protection” elements with recommended situations where this “Data Protection” should be implemented; an identified methodology for data protection on non-compliant systems (where applicable): an analysis of and recommendation for data protection enhancements to include types of “Data Protection” options for SSNR data, and an architecture document with required data protection approaches and methods. The Data Protection Plan shall be updated as needed and as additional IT Products are added to the SSNR analysis and remediation process.

The Contractor shall for those VA products (IT systems) that fall outside of the compliance criteria of the CAA 2023, requiring either an extension to the legislation due to its complexity being too great to convert adequately to the ICN, then the process of "encryption" or "masking" is warranted. Likewise, if the product (IT system) is confirmed for decommissioning prior to or shortly thereafter the due date of 09/2026, then this process of "encryption" or "masking" is warranted as well.