Benefits Enterprise Services_PWS_RFI Loopback.docx

Benefits Enterprise Services

VA-25-00006417

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Office of Information & Technology Benefits and Memorials

Benefits Enterprise Services

Date: July 8, 2025

VA-25-00006417

PWS Version Number: 0.1

Contents

BACKGROUND

The Department of Veterans Affairs (VA), Office of Information & Technology (OIT), Software Product Management (SPM) Office, Benefits and Memorial Services (BAM) Portfolio’s mission is to deliver world-class, innovative systems that ensure reliable, secure, and seamless delivery of benefits and services directly to Veterans and their families. The BAM Portfolio serves the Veterans Benefits Administration (VBA), the Board of Veterans Appeals (BVA), and the National Cemetery Administration (NCA) to develop and manage advanced technology solutions. The BAM Portfolio provides technology solutions to improve benefit claims processing, case management, and benefits and service delivery. The BAM Portfolio collaborates with Business lines to identify and validate business needs, prioritize initiatives to fulfill those needs, oversee the work, and validate whether the work meets the business needs upon delivery. The BAM Portfolio provides direction on product management and ownership, overarching prioritization, and execution.

VA OIT BENEFITS INTEGRATION PLATFORM

The Benefits Integration Platform (BIP) is the centerpiece for the BAM Portfolio to provide modern benefits architecture and engineering solutions, services, and data. BIP is a multitenant platform that can be leveraged by other VA products to reduce development costs and provide quicker to market solutions to better serve our Veterans. BIP is currently deployed in the VA Enterprise Cloud (VAEC) Amazon Web Services (AWS) GovCloud environment, adheres to Zero Trust security principles, and provides modern platform tooling, automation, and development frameworks that provides patterns for building well-integrated, well-structured, and standardized (e.g., OpenAPI Specification-based) Application Programing Interfaces (API) and applications. APIs and automation improve accessibility to benefits related data, hastens benefit claims processing, streamlines appeals management, and enhances overall VA benefits service delivery. The BAM Portfolio Product teams use the BIP to deliver on top priorities to support VBA and NCA missions, drive application modernization efforts, and ensure common data sharing – thereby providing a standardized approach to software delivery and the decommissioning of legacy systems. Portfolio-level common service solutions, platform, frameworks, accelerators, and APIs, provide the modern technical foundation necessary for automation and innovation including the use of Artificial Intelligence (AI) and Machine Learning (ML).

VISION-DRIVEN EXECUTION

The BAM Portfolio uses vision-driven-execution to enhance the digital experience for Veterans and VA business partners by executing a clear vision, roadmap, resource plans, and metrics of success. The Portfolio’s vision is to pursue excellence in the way BAM envisions, plans, prioritizes, resources, and executes IT services and support. The Portfolio has the following goals:

· Strategy: Develop a clear vision and roadmap with prioritized strategic outcomes. Maintain continuous strategy-to-execution alignment. Align investment decisions with strategic goals and utilize an agile approach to allocate resources.

· Modern Architecture: Shrink monolithic and stove-piped products to develop and grow portfolio-wide benefits, appeals, and memorials data and services that supports Veteran benefits claims processes.

· Efficiency: Reduce duplicative efforts and develop cross-cutting services and authoritative data to enable faster progress toward achieving strategic goals.

· Collaboration: Continuously improve customer and end user experiences. Promote collaboration and cross-functional teams.

· Agility: Use agile, iterative approach to data-driven informed decision making.

BAM PORTFOLIO PRODUCT LINES

VA OIT is organized to enable Portfolio Management, Product Line Management, and Product Management. The BAM Portfolio, Product Line, and Product teams are comprised of cross-functional individuals with shared responsibility and skills that allow them to build, deploy, monitor, and operate products through entire lifecycle from conception to retirement. Product management organizes work by outcomes and uses lean agile methodology to support rapid value delivery. Product Management Development, Security, and Operations a.k.a. DevSecOps (DSO) teams, referred to as Product teams, are led by a VA OIT Product Manager (VA PM), supported by a Contracting Officer’s Representative (COR), and may include team members from OIT and the business, as well as the teams that will be performing under this effort to provide customer-centric iteratively-developed solutions to keep up with changing customer needs. Product teams may encompass one or more software application systems to enable legacy systems modernization.

The BAM Portfolio includes, but is not limited to, the following Product Lines. As the BAM Portfolio continues to evolve, products may be added or removed from the BAM Portfolio Product Lines throughout the life of this effort.

Benefits Integration and Administration (BIA) Product Line: The BIA Product Line’s mission is to deliver high-quality platform, data, business intelligence and automation, and administrative products and services that serve as a foundation to our VA partners’ efforts to deliver benefits to Veterans. The product line accomplishes this by closely collaborating with its VA partners, including the Compensation and Pension (C&P) and Memorial Benefits Services (MBS) product lines, to make methods for delivering benefits as seamless, efficient, and effective as possible.

The BIA Product Line’s centerpiece product is BIP which is a modern Kubernetes, Docker, and Jenkins based Platform as a Service (PaaS) that resides within VAEC in the AWS GovCloud environment. It enables teams to quickly, easily, and securely develop, build, deploy, scale, and manage container-based applications in a multi-tenant cloud environment. Furthermore, it currently hosts Veterans Benefits Management System (VBMS) components, Memorial Benefits Management System (MBMS) components, and various services and APIs within its production cluster.

Other notable products within the BIA Product Line include Corporate Database (CRP), VBA Data Warehouse (VD2), and Benefits Enterprise Platform (BEP). CRP acts as a repository for most benefits related data. Over 40 distinct applications, including VBMS, connect to CRP to read and write benefits related data.

VBA and NCA will continue to position itself to leverage BIP, CRP, and the system integration and automation capabilities provided by the BIA Product Line. As a result, these strategic systems and capabilities must continue to evolve and mature to meet the growing needs of stakeholders. To do this, tooling and frameworks within BIP will be enhanced and expanded to provide a more robust feature set for tenants. Furthermore, the BIA Product Line will develop new APIs and automation that improves accessibility to benefits related data, hastens benefit claims processing, streamlines appeals management, and enhances overall benefits and service delivery.

Compensation and Pension (C&P) Product Line: The C&P Product Line includes a suite of systems driving VBA's core modernization efforts, leveraging integration of more functionalities into VBMS, increasing utilization of cloud-based commercial products, enhancing currently integrated systems, standardizing record sharing between federal agencies, and replacing or retiring as many legacy systems as possible. To provide benefits in a secure and timely manner, significant enhancements to the Compensation Service (CS) and Pension & Fiduciary (P&F) Service require digital modernization of the IT environment. Additionally, diminishing knowledge of legacy systems within VBA underlies the urgency for these CS and P&F’s decommissioning efforts. These include retiring the graphical user interfaces (GUI) for the following Veterans Service Network (VETSNET) components: Share, Search and Participant Profile (SPP), VETSNET Modern Award Processing Development (MAP-D),Statement of Case (SOC), and Personnel Information Exchange System (PIES).

VBMS is undergoing a business transformation initiative supported by technology and designed to improve VBA service delivery to Veterans. It is a holistic solution that integrates a business transformation strategy to address process and people, along with a 21st century, web-based paperless claims processing system. VBMS is an online electronic work environment designed for processing C&P claims. Beyond claims processing, VBMS consists of an electronic document repository that replaces the older paper folder used to track and store Veteran Claims Evidence; a National Work Queue (NWQ) which manages and distributes the claims workload to field users; a correspondence tool to create, send and track communications to the Veteran; a system to manage fiduciaries for disabled Veterans; a rating feature set that allows for Disability Benefit Questionnaire (DBQ) exam results to be requested and processed through a complex schedule of rules to determine issues and service connection; and an awards module to award the Veteran benefits and send the information to Treasury through the Enterprise Management of Payments, Workload, and Reporting (eMPWR-VA)system through which Veterans receive payment for their awarded benefits. The hardware and software associated with these functions are located in the government cloud and consist of customized software complimented by some commercial off the shelf (COTS) products to provide a homogeneous system for VBA to process C&P claims.

Compensation and Pension Record Interchange (CAPRI) is a GUI for Veterans Health Information Systems and Technology Architecture (VistA) Automated Medical Information Exchange (AMIE II) menu options. CAPRI supports Compensation and Pension exam management. The CAPRI software acts as a bridge between VBA and the Veterans Health Administration (VHA) information systems. It offers VBA Rating Specialists help in building the rating decision documentation through online access to medical data. It offers extensive reporting functionality to aid CS & Patient Financial Services (PFS) in the administration of Veterans' CS & PFS benefits. CAPRI is currently modernizing some services but other services will be replaced in Electronic Health Record Modernization (EHRM), CAPRI must be maintained and supported until the last VistA instance is converted and modernized capabilities exist.

The CAPRI Proxy Server, located at the Austin Information Technology Center (AITC), is an essential component of the CAPRI system architecture. It provides secure socket layer (SSL) communication to Data Access Services (DAS) during the transmission of DBQs and other clinical and service treatment documents to DAS for VBMS. Currently CAPRI generates approximately 9,000 to 9,500 documents daily to DAS via the CAPRI Proxy Server. The CAPRI Proxy to DAS interface was designed to support a potential capacity of 90,000 transactions per week at less than 1MB per transaction. The CAPRI end users create DBQs and PDFs using existing processes in CAPRI. Once the DBQs and PDF documents are signed off by clinicians in CAPRI, CAPRI automatically sends the files to DAS and ultimately to VBMS. As an enabler of CAPRI process, the CAPRI proxy server must be maintained and supported until all VistA instances have been converted to the new VA EHRM.

The Claims Authentication server, housed at Philadelphia Information Technology Center (PITC), is critical to the functioning of the CAPRI system. The server provides user authentication support and connectivity for VBA and remote users from multiple program offices through the VA Medical Centers’ medical records to facilitate medical data search and retrieval, and C&P exam development and management. This also provides user authentication support and connectivity for the Suicide Hotline/Veteran’s Crisis Line (VCL) system, a critical service provided by VHA. It is also used by other applications critical to Veteran care (e.g. VistA Remote Access Management [VRAM], Joint Longitudinal Viewer [JLV], and Web VRAM). As an enabler of CAPRI processes, the claim authentication server must be maintained and supported until all VistA instances have been converted to the new VA EHRM.

Memorial Benefits and Services Product Line: The MBS Product Line teams with NCA to establish modern enterprise services and solutions that increases efficacy and efficiency of memorial benefits for our nation’s Veterans. NCA oversees the largest cemetery system in the country with over four million Americans memorialized by burial in VA’s national cemeteries. The legacy Burial Operations Support System - Enterprise (BOSS-E) is a system of systems supporting all aspects of interment and inurnment processing. BOSS-E functions supports cemeteries nationwide with over 3.7 million occupied gravesites and processes over 135,000 new interments annually. BOSS-E l consists of 14 custom-developed modules that are complex and difficult to update. Started in 1994, the BOSS-E system is no longer compatible with VA's needs. The legacy IT system fails to comply with security and accessibility requirements, lacks integration with other VA systems, and relies on manual processes. VA is in the process of replacing BOSS-E and its legacy applications with MBMS: a more cohesive, compliant, and functional enterprise platform. To develop MBMS, VA is leveraging and expanding upon BIP functionality to incorporate NCA requirements. The goal of MBMS is to migrate the functionality of disparate systems into a single integrated enterprise platform solution which will expedite memorial benefits processing and improve the overall Veteran and family experience. MBMS will enable automation of manual NCA processes, access to authoritative data across Lines of Business (LoB) and streamline VA's management for scheduling office and cemetery operations. VA will leverage BIP shared services in order to meet the mission needs of NCA and realize cost savings by reducing duplicative and antiquated systems. MBS Product Line initiatives will develop new features that benefit eligible Veterans, spouses, and dependent children, as well as NCA employees by integrating with appropriate BIP authoritative data sources and automating approval of benefits. Veterans and their families will have the ability to submit online self-service requests for Pre-Need or Time of Need applications for burial services and all other memorial benefits.

Enterprise Management of Payments, Workload, and Reporting (eMPWR-VA):

The eMPWR-VA system is a powerful financial tool designed to streamline and enhance the way VA handles financial transactions and payments. This modern, web-based application not only processes fiscal and accounting transactions but also interfaces directly with the U.S. Department of Treasury to disburse benefits payments efficiently.

eMPWR-VA offers a user-friendly interface and robust features such as workflow and caseflow management, business intelligence, and advanced reporting capabilities. It seamlessly integrates with various systems like Common Security Services (CSS), Share, Search, and Participant Profile (SPP), Modern Awards Processing Development (MAP-D), VBMS-A, VBMS-R, and Statement of Case (SOC).

This system supports the information gathering and budgetary needs of several programs, including the Compensation & Pension Service, Education Service, Loan Guaranty, and Insurance Service. It meets the stringent Core Financial System Requirements set by the Federal Financial Management System Requirements (FFMSR-1) and is fully compliant with current accounting standards.

eMPWR-VA is designed to be versatile, making it suitable for use across other VBA benefit programs, providing a unified and compliant financial system. It enables online transaction processing, and audit functions, and automates manual reviews like check verification and fiscal adjustments. The system interfaces daily with the Financial Management System, providing the ability to conduct systematic reviews of client accounts and daily payment processing.

With 24/7 processing capabilities, a graphical user interface for finance users, and web-enabled reports, eMPWR-VA ensures compliance with the U.S. Standard General Ledger and enhances the overall efficiency and accuracy of financial operations.

Veterans Appeals Product Line:

The Veterans Appeals Product Line is designed to provide cutting-edge technological solutions to streamline and enhance the management of Veteran Appeals. The Board of Veterans’ Appeals is dedicated to making the appeals process more effective and timelier, ensuring that decisions on benefits and services are resolved quickly and accurately.

Our IT solutions are tailored to support every step of the Veterans’ appeals process, ensuring that all supporting evidence is handled efficiently to produce legally correct decisions. This not only speeds up the process but also reduces the cost per appeal, ultimately enhancing the overall experience for Veterans.

By leveraging automation and AI, we can improve the intake decision reviews and the processing of appeals from VBA, VHA, and NCA. This technology significantly boosts the timeliness of decisions.

Additionally, our virtual tele-hearing functionality minimizes or even eliminates the need for travel, making it easier for Veterans, especially those in remote areas, to participate in hearings. We also utilize a data lake that aggregates information from various sources, which enhances our ability to manage workloads and meet congressionally mandated reporting requirements.

APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement (PWS), the Contractor shall comply with the following:

1. “Federal Information Security Modernization Act of 2014”

2. Federal Information Processing Standards (FIPS) Publication 140-3, “Security Requirements for Cryptographic Modules”, March 22, 2019

3. FIPS Pub 199. “Standards for Security Categorization of Federal Information and Information Systems,” February 2004

4. FIPS Pub 200, “Minimum Security Requirements for Federal Information and Information Systems,” March 2006

5. FIPS Pub 201-3, “Personal Identity Verification of Federal Employees and Contractors,” January 2022

6. 10 U.S.C. § 2224, "Defense Information Assurance Program", as amended

7. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

8. Public Law 109-461 (P.L. 109-461), Veterans Benefits, Health Care, and Information Technology Act of 2006, as amended, Title IX, Information Security Matters

9. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”, as amended

10. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, https://www.va.gov/vapubs/index.cfm

11. VA Handbook 0710, “Personnel Security and Suitability Program,” May 2, 2016, https://www.va.gov/vapubs/index.cfm

12. VA Directive 6102, “Internet/Intranet Services,” August 5, 2019

13. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and Guidelines,” as amended

14. Office of Management and Budget (OMB) Circular A-130, “Managing Federal Information as a Strategic Resource,” July 28, 2016

15. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed Services (CHAMPUS)”, as amended

16. National Institute of Standards and Technology (NIST) Special Publication (SP) 800-66 Rev. 2, “Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule: A Cybersecurity Resource Guide,” February 2024

17. 45 C.F.R Parts 160 and 164, Subparts A and E, the Standards for Privacy of Individually Identifiable Health Information (“Privacy Rule”); and 45 C.F.R. Parts 160 and 164, Subparts A and C, the Security Standard (“Security Rule”); as amended

18. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended

19. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

20. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021 (see VA NOTICE 24-18, dated September 27, 2024, “Update to VA Directive 6500 Cybersecurity Program”, and VA Notice 25-07, dated 3/18/25, “Amending VA Directive 6500 to incorporate M-24-15”)

21. VA Handbook 6500, “Risk Management Framework for VA Information Systems VA Information Security Program,” February 24, 2021 (see VA Notice 25-01, dated October 15, 2024, “Update to VA Handbook 6500 Risk Management Framework for VA Information Systems VA Information Security Program”, and VA Notice 25-06, dated 3/18/25, “Amending VA Directive 6500 to incorporate M-24-15”)

22. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI),” June 30, 2023

23. VA Handbook 6500.6, “Contract Security,” March 12, 2010 (see VA Notice 24-12, dated April 22, 2024, “Update to VA Handbook 6500.6, Contract Security, Appendix C VA Information and Information System Security/Privacy Language For Inclusion Into Contracts, As Appropriate”)

24. VA Handbook 6500.8, “Information System Contingency Planning,” March 25, 2025

25. VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018

26. VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017

27. OIT Process Asset Library (PAL), OIT Process Asset Library.

28. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

29. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014

30. VA Directive 6510, “VA Identity, Credential and Access Management,” September 3, 2024

31. VA Handbook 6510, “VA Identity, Credential and Access Management,” September 27, 2024

32. VA Directive and Handbook 6513, “Secure External Connections,” October 12, 2017

33. VA Directive 6300, “Records and Information Management,” September 21, 2018

34. VA Handbook, 6300.1, “Records Management Procedures,“ March 24, 2010

35. NIST SP 800-37 Rev 2, “Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy,” December 2018

36. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020)

37. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015

38. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” March 24, 2014

39. OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005

40. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019

41. OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008

42. Federal Identity, Credential, and Access Management (FICAM) Architecture, June 30, 2023 (FICAM Architecture (idmanagement.gov))

43. NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access,“ June 2018

44. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, “Digital Identity Guidelines,” updated March 02, 2020

45. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014

46. VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

47. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

48. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

49. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

50. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019

51. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008

52. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (P.L. 110–140), December 19, 2007

53. Section 104 of the Energy Policy Act of 2005, (P.L. 109–58), August 8, 2005

54. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 2, 2001

55. VA Directive 0057, “VA Environmental Management Program,” October 25, 2022

56. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

57. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

58. “Veteran Focused Integration Process (VIP) Guide 4.0,” March 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

59. VA Memorandum “Proper Use of Email and Other Messaging Services,” January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

60. “Product Line Management Transformation Playbook” version 3.1, August 2023, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

61. NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020

62. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol Version 6 (IPv6),” November 19, 2020

63. Social Security Number (SSN) Fraud Prevention Act of 2017

64. Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23, 2018

65. C.F.R Title 15 Part 7, “Securing the Information and Communications Technology and Services (ICTS) Supply Chain”, as amended

66. Executive Order 14028, “Executive Order on Improving the Nation's Cybersecurity,” May 12, 2021, https://bidenwhitehouse.archives.gov/briefing-room/presidential-actions/2025/01/16/executive-order-on-strengthening-and-promoting-innovation-in-the-nations-cybersecurity/

67. OMB Memorandum M-22-09, “Moving the U.S. Government Toward Zero Trust Cybersecurity Principles”, January 26, 2022, https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf.

68. NIST SP 800-52 Revision 2, “Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations

69. OMB M-22-18, “Enhancing the Security of the Software Supply Chain through Secure Software Development Practices,” September 14, 2022

70. OMB M-23-16, “Update to Memorandum M-22-18,” June 9, 2023

71. OMB M-21-31, “Improving the Federal Government’s Investigative and Remediation Capabilities Related to Cybersecurity Incidents,” August 27, 2021

72. NIST SP 800-88 Revision 1 “Guidelines for Media Sanitization,” December 2014

73. CISA Binding Operational Directive (BOD) 19-02: “Vulnerability Remediation Requirements of Internet-Accessible Systems,” April 29, 2019, BOD 19-02: Vulnerability Remediation Requirements for Internet-Accessible Systems | CISA

74. CISA BOD 22-01: “Reducing the Significant Risk of Known Exploited Vulnerabilities,” November 3, 2021, BOD 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities | CISA

75. CISA BOD 23-01: Improving Asset Visibility and Vulnerability Detection on Federal Networks.” Cybersecurity & Infrastructure Security Agency (CISA), BOD 23-01: Improving Asset Visibility and Vulnerability Detection on Federal Networks | CISA

76. VA Directive 6550, Pre-Procurement Assessment and Implementation of Medical Devices/Systems, June 03, 2019

77. VA Memorandum, “VA Security Controls,” January 17, 2025, https://www.voa.va.gov/DocumentView.aspx?DocumentID=5010

78. Office of Management and Budget (OMB) (i.e., OMB Guidance M-16-21, et al)

79. NIST et al including, NIST SP 800-218, Secure Software Development Framework (SSDF) Version 1.1, February 2022

80. Ethical framework principles for access to and use of veteran data, 38 CFR 0.605, https://www.ecfr.gov/current/title-38/section-0.605

81. The Twelve Factor App https://12factor.net/

82. The Agile Manifesto http://agilemanifesto.org/

83. The U.S. Digital Services Playbook https://playbook.cio.gov/

84. The TechFAR Hub https://techfarhub.cio.gov/

85. VA UX Style Guide https://www.va.gov/web/standards/styles.cfm

86. VA Digital Services Handbook Research and Discovery Checklist https://department-of-veterans-affairs.github.io/va-digital-service-handbook/delivery/research-and-discovery/checklist

87. The Digital Analytics Program https://digital.gov/dap/

88. VA Design System https://design.va.gov/

89. United States Web Design System https://designsystem.digital.gov/

90. VA Developer Portal https://developer.va.gov/

91. VA EA Architecture Style Guide https://vaww.ea.oit.va.gov/architecture-development-library/#asg

92. SAFe® for Government https://scaledagileframework.com/government/

93. VA Directive 6404, VA Systems Inventory (VASI), February 23, 2016

94. VA Directive 6500, VA CYBERSECURITY PROGRAM, February 24, 2021

95. VA Directive 6517, Risk Management Framework for Cloud Computing Services, November 15, 2016

96. VA Directive 6551, Enterprise Design Patterns, March 17, 2016

97. IRS Publication 1075, Tax Information Security Guidelines For Federal, State and Local Agencies, November 2021

98. VA BAM OIT Portfolio and Product Line Configuration Management (CM) Plan

99. VA OIT Risk Management Plan

100. Attachment 0001 BIA DevSecOps Application Systems Product List

101. Attachment 0002 C&P DevSecOps Application Systems Product List

102. Attachment 0003 Memorials DevSecOps Application Systems Product List

103. Attachment 0004 eMPWR- VA DevSecOps Application Systems Product List

104. Attachment 0005 Veterans Appeals DevSecOps Application Systems Product List

SCOPE OF WORK

The Contractor shall provide portfolio-level technical management and coordination to further develop and provide secure BAM architecture, engineering, solutions, services, and data. The Contractor shall provide portfolio and product line technical management and maintain continuous strategy-to-execution alignment in partnership with stakeholders to maximize outcomes. The Contractor shall support the intake of business needs, prioritization, and delivery. The Contractor shall support and oversee initiatives and epics through initial business need definition, prioritization, and execution. The Contractor shall identify and coordinate in accordance with internal and external dependencies, inputs, and outputs, the timeline for completion of integrated efforts, and processes to manage the overall integrated effort. The Contractor shall adhere to modern practices to continuously improve VA experiences and outcomes through a combination of people, processes, and technology.

The Contractor shall streamline benefits systems and data to improve scalability; increase availability of services; and enable secure, efficient, and effective delivery of products. The Contractor shall provide DSO product support services for BAM Portfolio, BIP, Product Lines, and Products. The Contractor shall provide dedicated teams of cross-functional staff to operate, build, maintain, and develop the BIP and BAM Portfolio and Product Line Products. The Contractor shall provide VA with iterations of Agile software development and Continuous Integration and Continuous Delivery (CI/CD pipelines. The Contractor shall provide Training and Help Desk Support. The Contractor shall transition legacy systems functionality and data to BIP and decommission legacy systems.

The Contractor shall follow the core functions of Software Development Lifecycle Management (SDLC) and lean scaled agile framework, such as the Scaled Agile Framework (SAFe) and other emerging innovative frameworks, to deliver a broad range of solutions. The Contractor shall blend development, security, operations, infrastructure, and architecture together to provide DSO Product support. The Contractor shall continuously improve new and existing solutions by implementing continual configurations, capabilities, enhancements, bug fixes, proactive monitoring, testing and evaluation, business intelligence and application performance monitoring analytics, and support activities, while collaborating closely with the BAM Portfolio, Product Lines, and VA LoBs throughout the development process. The Contractor shall configure, develop, maintain, test, and deploy business and technology feature releases. Teams for this effort shall be composed of an evolving mix of technical and operational skill sets across agile frameworks as required to meet the necessary stage of the capability SDLC and technical nature of the capability. The Contractor shall adjust deliverables and repository tool updates to match the nature of the capability and/or SDLC frameworks.

ORDER TYPE

The effort shall be Firm Fixed Price (FFP) with a Cost Reimbursement line item for Travel.

PERFORMANCE DETAILS

PERFORMANCE PERIOD

The Period of Performance (PoP) shall be one (1) 12-month base period with four (4) 12-month Option Periods, along with five (5) optional tasks for additional Systems Teams, Agile Development Teams, Help Desk Support, Training Teams, and Transition Out Support. The overall PoP shall not exceed 60 months.

There are 11 Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, five are set by date:

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

PLACE OF PERFORMANCE

Tasks under this PWS shall be performed at Contractor facilities. The Contractor shall identify the Contractor’s place of performance in their proposal submission. When travel is required, work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Office (CO) or the Contracting Officer’s Representative (COR).

TRAVEL OR SPECIAL REQUIREMENTS

The Government anticipates travel to perform the tasks associated with the effort, as well as to attend planning and program-related meetings or conferences throughout the PoP.

Travel and per diem shall be in accordance with the Federal Travel Regulations (FTR) and requires concurrence in advance of travel arrangements by the VA PM and COR. The Contractor shall provide cost estimates with each travel request. Each Contractor invoice must include copies of all receipts that support the travel costs claimed in the invoice.

Local travel within a 50-mile radius from the Contractor’s normal duty location is considered the cost of doing business and will not be reimbursed. This includes travel, subsistence, and associated labor charges for travel time. Travel performed for personal convenience and daily travel to and from work at the Contractor’s facility will not be reimbursed. Travel, subsistence, and associated labor charges for travel time for travel beyond a 50-mile radius of the Contractor’s facility may be authorized on a case-by-case basis and must be pre-approved by the COR.

SPECIFIC TASKS AND DELIVERABLES

The Contractor shall use an agile approach to continuously deliver value outcomes across the BAM Portfolio, Product Lines, and Products. The Contractor shall provide expertise and IT support for Products and Software Tools identified in Attachments 0001 – 0005 Application Systems Product List. The Contractor shall provide portfolio and product line technical management and coordination of all activities across products to ensure quality delivery and performance. The Contractor shall provide support for requirements management, security, quality, compliance, automation, customer-centric, product usability, and support portfolio and product line processes and governance. The Contractor shall provide centralized communications to maintain continuous and seamless operation, delivery, and strategy-to-execution. The Contractor shall provide support for portfolio, product line, and product business and technical requirements intake demand management.

PROJECT MANAGEMENT

TRANSITION SUPPORT TO BES (BASE PERIOD ONLY)

Following a Government-approved plan, the Contractor shall assist in transitioning from the previous contract. The Contractor shall provide support and coordination with Government personnel and predecessor staff to ensure continuous operation of existing business applications. This includes taking over analysis, management, and operations. Additionally, the Contractor shall support requirements gathering, design, development, and testing of BAM Product Line Products from the previous contract.

The scope for BAM Product Line Products transition includes a thorough review of products including key milestones, operation and maintenance tasks, requirements, agile development, support teams, and backlog priorities.

The Contractor shall deliver an overall Transition Strategy, which shall include, but is not limited to:

· Understanding and transition of the support services

· Understanding of the existing policies and procedures

· Understanding of the baseline metrics and statistics

· Transition of historic data

· Transition of collective and comprehensive Product tools’ data and accounts

· Understanding of the business and/or technical documentation

· Understanding of the team, tools, methodologies, and business processes

· Transfer of GFE and Government Furnished Information

· Transition approach

The Contractor shall provide and implement a Transition Methodology that ensures a smooth transition while acquiring program knowledge of the BAM Portfolio. The Contractor shall describe an approach to acquire the necessary knowledge, including an understanding of the business functions, the technical architecture, the software, and development approach employed for the BAM Portfolio. The Contractor shall identify key roles and responsibilities for Contractor team members and the Government during the transition.

The Contractor shall deliver a Risk Management Transition Plan that identifies likely transition risks to the BAM Portfolio and each product as a result of the transition. The Contractor shall provide mitigation strategies for these risks. The Contractor shall log the risks in the BAM Portfolio risk log.

The Contractor shall provide a Transition Timeline that ensures all transition work is completed within a six-month timeframe, after which the Contractor is fully able to assume all work on the BAM Product Line Products. The timeline shall include important milestones, key resources, and identify key dependencies.

Once the Strategy, Methodology, and Timeline are approved by the Government, the Contractor shall provide a Weekly Transition Status Report detailing progress toward the transition and noting any blockers or new risks and issues.

Deliverables:

A. Transition Strategy (Due 30 days after award) B. Transition Methodology (Due 60 days after award) C. Transition Risk Management Transition Plan (Due same as “B”) D. Transition Timeline (Due same as “B”) E. Weekly Transition Status Report

PORTFOLIO AND PRODUCT LINE MANAGEMENT

The Contractor shall plan, coordinate, execute, and report on all tasks and activities performed under this effort. The Contractor shall provide portfolio and product line management and maintain continuous strategy-to-execution alignment in partnership with stakeholders. The Contractor shall ensure compliance, measure performance, and report on program activities.

The Contractor shall deliver a Contractor Portfolio and Product Line Management Plan (CPLMP) to convey the Contractor’s approach on how it plans to provide the project management for the performance of this effort. In addition, the CPLMP shall include a section for the Portfolio and each Product Line which will contain information about the applicable contract line items, standing meetings, processes that vary from the overall contract management strategies, and how the Contractor intends to coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The Contractor shall provide portfolio-level strategic organization, coordination, and execution. The Contractor shall effectively respond and manage demand changes. The Contractor shall provide resource management and execution plans and portfolio-level priority and capacity views.

In accordance with the VA Business and IT Priorities and in coordination with Product teams, the Contractor shall develop and maintain roadmap on the Portfolio, Product Line, Product, Solution, and Service level, and associated documentation to enable full visibility and transparency of all work from user-stories through epics up to the strategic objective priorities and roadmaps.

Prioritization of the specific functionality and tasks will be determined by VA OIT Portfolio Managers, Product Line Managers, PMs, and CORs, prior to the Sprint and PI. All Contractor-proposed improvement activities will be provided as an epic to the VA PM for approval and prioritization. The Contractor shall not operate independently to determine improvement projects to be developed, and all projects supported by this PWS must be approved in advance by the VA PM.

Except as noted below, for each deliverable that is provided as a word-processor-type or diagram document (i.e., not as data entered into a database or repository), must be provided in both an editable format (e.g., Microsoft Word, Gliphy, Visio) and in a non-editable format (e.g., Portable Document Format [PDF], image files). For deliverables that are updated periodically, differences from the prior version shall be indicated in the editable format by using change tracking (preferred), highlighting, or similar notation.

Deliverables:

A. Contractor Portfolio and Product Line Management Plan (Due 30 days after award and updated quarterly throughout the PoP) B. Portfolio Roadmap (Due 90 days after award and updated quarterly throughout the PoP) C. Product Line Roadmap (Due same as “B”) D. Product Roadmap (Due 90 days after award and updated quarterly throughout the PoP) E. Solution Roadmap (Due same as “D”) F. Service level Roadmap (Due same as "D")

TECHNICAL KICKOFF MEETING

A technical kickoff meeting shall be held within 10 days after award. The Contractor shall coordinate the date, time, and location (which may be virtual) with the Contracting Officer (CO), the Contract Specialist (CS), Portfolio leadership, VA PMs, and CORs. The Contractor shall provide a draft agenda to the CO, CORs, and VA PMs at least five (5) business days prior to the meeting. Upon Government approval of a final agenda, the Contractor shall distribute it to all meeting attendees.

During the kickoff meeting, the Contractor shall display the Kickoff Presentation which includes the details of the intended approach, work plan, and project schedule for each effort. At the conclusion of the meeting, the Contractor shall update the Kickoff Presentation with a final slide entitled “Summary Report” which shall include notes on any major issues, agreements, or disagreements discussed during the kickoff meeting. The Contractor shall distribute the Kickoff Presentation to all attendees within three (3) business days after the meeting.

Additionally, technical kickoff meetings shall be held within 10 days of award for all Optional Tasks, including award of a new or renewal of an Optional Task for continuation of support services. The CO and CS need not attend these subsequent meetings.

DELIVERABLES:

A. Kickoff Presentation (Due three business days after the Technical Kickoff meeting occurs)

REPORTING REQUIREMENTS

Monthly Status Report The Contractor shall deliver Monthly Status Reports. These reports shall provide accurate, timely, and complete product/project information. The detail and technical level of this report shall be appropriate for VA management and shall summarize, not replicate, the information contained in the Sprint Review. This report shall reflect data as of the last day of the preceding month. Change tracking, except where noted, is not required. The Monthly Status Report shall include the following data elements for the Portfolio, each Product Line, and Product:

a) High-level schedule and milestones from the current reporting period (i.e., the prior month) through two months in the future

b) Epics or similar work completed and in progress

c) Work planned for the subsequent two months, when applicable

d) Value Outcomes maps

e) System and Agile Development Team staffing, with changes from prior month indicated through change tracking

f) Risks and Issues

a. Contract-related issues uncovered during the month and especially highlight those areas with a high probability of impacting schedule or performance goals and their likely impact on same

b. Explanations for any unresolved issues, including possible solutions and any actions required of the Government and/or Contractor to resolve or mitigate the issue, including a plan and timeframe for resolution

c. Status on previously identified issues, actions taken to mitigate the situation and/or progress made in rectifying the situation

g) Original schedule of project management deliverables and the corresponding deliverables made during the current reporting period

h) Software licenses at or nearing end of life and software security certificates nearing expiration

DELIVERABLES:

A. Monthly Status Report (Due by the 10th of the month for the prior month)

Workforce Staffing Updates The Contractor shall enter the data pertinent to their workforce into the approved VA repositories (e.g., Account Provisioning/De-Provisioning System [APDS], VA Contract Management Tool [VCMT]). This includes Initial onboarding and ongoing changes to demographic information and GFE assignments as well as changes to workforce and COR assignments.

ONBOARDING

The Contractor shall manage the onboarding of its staff. Onboarding shall include steps to obtain a VA network and email account, complete required VA training, initiate background investigations, and gain physical and logical access, which may include elevated privileges to the necessary development and test environments for the various systems to be enhanced.

A Contractor Onboarding POC shall be designated by the Contractor who tracks the onboarding status of all Contractor personnel. The Contractor Onboarding POC shall be responsible for accurate and timely submission of all required VA onboarding paperwork to the COR or his/her onboarding designee. The Contractor shall be responsible for tracking the status of all their staff’s onboarding activities.