VetPro - PWS for RFI.pdf

VETPRO

VA-25-00033964

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Office of Information & Technology (OIT) Product Delivery Service (PDS)

Managed Services VetPro Application Support

Date: January 27, 2025

PWS Version Number: 1.0

Contents

1.0 BACKGROUND

2.0 APPLICABLE DOCUMENTS

3.0 SCOPE OF WORK

4.0 PERFORMANCE DETAILS

4.1 PERFORMANCE PERIOD

4.2 CONTRACTOR Requirements

4.3 PLACE OF PERFORMANCE

4.4 TRAVEL

5.0 SPECIFIC TASKS AND DELIVERABLES

5.1 PROJECT MANAGEMENT

5.1.1 CONTRACTOR PROJECT MANAGEMENT PLAN

5.1.2 MANDATORY TRAINING

5.1.3 PROJECT MANAGEMENT SERVICES

5.1.4 REPORTING REQUIREMENTS

5.1.5 TECHNICAL KICKOFF MEETING

5.1.6 SOFTWARE LICENSES

5.2 BUSINESS REQUIREMENT ANALYSIS

5.3 DEVELOPMENT REQUIREMENT

5.4 B. Project Schedule DOCUMENTATION SUPPORT

5.5 APPLICATION DEVELOPMENT PLAN

5.6 RELEASE PLAN AND RELEASE NOTES

5.7 SCOPE MANAGEMENT PLAN

5.8 COMMUNICATIONS PLAN

5.9 RISK MANAGEMENT PLAN

5.10 APPLICATION SERVICE MANAGEMENT

5.11 CLOUD MIGRATION AND APPLICATION ENHANCEMENTS

5.11.1 CLOUD MIGRATION OBJECTIVES

5.11.2 VA CLOUD STRATEGY ASSESSMENT

5.11.3 DATA MIGRATION AND SYNCHRONIZATION

5.11.4 MIGRATION AND CODE REFACTORING APPLICATION

5.11.5 OPTIMIZATION AND PERFORMANCE TUNING

5.11.6 SECURITY AND COMPLIANCE

5.11.7 DISASTER RECOVERY (DR) AND BUSINESS CONTINUITY

5.11.8 TRANSITION AND KNOWLEDGE TRANSFER

5.12 VETPRO APPLICATION MODERNIZATION / NEW FEATURES –

OPTIONAL TASK 1

5.12.1 REQUIREMENTS GATHERING

5.12.2 DEVELOPMENT REQUIREMENTS

5.12.3 TESTING AND QUALITY ASSURANCE

5.12.4 DOCUMENTATION, TRAINING AND KNOWLEDGE TRANSFER

5.12.5 PERFORMANCE METRICS AND KEY PERFORMANCE INDICATORS

(KPIS) 26

5.12.6 DELIVERABLE ACCEPTANCE CRITERIA

5.12.7 PROJECT MANAGEMENT, REPORTING, AND HANDOFF

5.13 TRANSITION SUPPORT – OPTIONAL TASK 2

6.0 GENERAL REQUIREMENTS

6.1 ENTERPRISE AND IT FRAMEWORK

6.1.1 VA TECHNICAL REFERENCE MODEL

6.1.2 FEDERAL IDENTITY, CREDENTIAL, AND ACCESS MANAGEMENT

(FICAM)

6.1.3 INTERNET PROTOCOL VERSION 6 (IPV6)

6.1.4 TRUSTED INTERNET CONNECTION (TIC)

6.1.5 STANDARD COMPUTER CONFIGURATION

6.1.6 VETERAN FOCUSED INTEGRATION PROCESS (VIP) AND PRODUCT

LINE MANAGEMENT (PLM)

6.1.7 PROCESS ASSET LIBRARY (PAL)

6.1.8 AUTHORITATIVE DATA SOURCES

6.1.9 SOCIAL SECURITY NUMBER (SSN) REDUCTION

6.1.10 SOFTWARE AND LICENSING REQUIREMENTS

6.2 SECURITY AND PRIVACY REQUIREMENTS

6.2.1 POSITION/TASK RISK DESIGNATION LEVEL(S)

6.2.2 CONTRACTOR PERSONNEL SECURITY REQUIREMENTS

6.3 METHOD AND DISTRIBUTION OF DELIVERABLES

6.4 PERFORMANCE METRICS

6.5 FACILITY/RESOURCE PROVISIONS

6.6 GOVERNMENT FURNISHED PROPERTY

ADDENDUM A – ADDITIONAL VA REQUIREMENTS, CONSOLIDATED

ADDENDUM B – VA INFORMATION AND INFORMATION SYSTEM

SECURITY/PRIVACY LANGUAGE

1.0 BACKGROUND

Department of Veterans Affairs (VA), OI&T, PDS strives to provide high quality, effective, and efficient Information Technology (IT) services to those responsible for providing care to the Veterans at the point-of-care as well as throughout all the points of the Veterans’ healthcare in an effective, timely and compassionate manner. VA depends on Information Management/Information Technology (IM/IT) systems to meet mission goals.

VA must credential and privilege health care providers in accordance with VA and accreditation requirements.

VA utilizes a Government Off-The-Shelf credentialing software system, VetPro, to credential healthcare providers. VetPro is a custom developed, managed service, major application used by all Veterans Health Administration (VHA) facilities for the credentialing of all VHA licensed, registered and/or certified health care providers. The VetPro system includes a web-based front end for basic input/output, with middle-tier modules and database procedures for image processing, intelligent character recognition (ICR), and electronic data interchange (EDI) with the National Practitioner Data Bank (NPDB) and the Federation of State Medical Boards (FSMB). The VetPro System maintains the credentials for over 250,000 actively appointed healthcare providers who are licensed, registered or certified. Healthcare provider's data is stored, managed, used, updated and verified continuously. The VHA is the largest federal health care provider with more than 1,700 sites of care including over 151 hospitals, over 800 community and facility-based clinics, over 133 nursing homes, and 48 domiciliary.

VetPro is hosted on Windows Server 2016 and utilizes the following technologies:

• Microsoft IIS (Internet Information Services) 10.0

• Microsoft SQL Server 2019

• Microsoft ASP.NET MVC version 4 using JavaScript, HTML, jQuery, CSS and C#

• Middle-tier programming modules created using C#

• Data import/export routines written in C#, which performs both real-time and scheduled electronic data interchange with external databases, such as those provided by the National Practitioner Data Bank (NPDB) and the Federation of State Medical Boards (FSMB).

• SQL Server views, stored procedures, and user-defined functions utilizing complex T-SQL routines.

VetPro is modernizing its Web application and enhancing service delivery by adopting Agile application development methodologies, migrating the application to a secure FedRamp approved cloud environment, and improving functionality available to end users. Agile development allows for swift response to policy changes or user needs, fostering collaboration, flexibility, and transparency. Cloud migration enhances security, ensures applications are always available, up-to-date, and compliant with federal security standards, and offers scalability and cost-effectiveness. Functional enhancements improve end user experience and assist with visibility and management of VHA credentialing and privileging data.

2.0 APPLICABLE DOCUMENTS

In the performance of the tasks associated with this PWS, the Contractor shall comply with the following:

1. 44 U.S.C. § 3541-3549, “Federal Information Security Management Act (FISMA) of 2002”

2. “FISMA of 2014”

3. Federal Information Processing Standards (FIPS) Publication 140-3, “Security

Requirements for Cryptographic Modules”

4. FIPS Pub 199. “Standards for Security Categorization of Federal Information and

Information Systems,” February 2004

5. FIPS Pub 200, “Minimum Security Requirements for Federal Information and

Information Systems,” March 2006

6. FIPS Pub 201-3, “Personal Identity Verification (PIV) of Federal Employees and

Contractors,” January 2022

7. 10 U.S.C. § 2224, "Defense Information Assurance Program"

8. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

9. Public Law 109-461, Veterans Benefits, Health Care, and Information Technology

Act of 2006, Title IX, Information Security Matters

10. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”

11. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, https://www.va.gov/vapubs/index.cfm

12. VA Handbook 0710, “Personnel Security and Suitability Program,” May 2, 2016, https://www.va.gov/vapubs/index.cfm

13. VA Directive and Handbook 6102, “Internet/Intranet Services,” August 5, 2019

14. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and

Guidelines,” January 18, 2017

15. Office of Management and Budget (OMB) Circular A-130, “Managing Federal

Information as a Strategic Resource,” July 28, 2016

16. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed

Services”

17. National Institute of Standards and Technology (NIST) Special Publication (SP) 800-

30 Rev 1, “Guide for Conducting Risk Assessment,” September 2012

18. NIST SP 800-37 Rev 2, “Risk Management Framework for Information Systems and

Organizations: A System Life Cycle Approach for Security and Privacy,” December

19. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020)

20. NIST SP 800-66 Rev. 2, “An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule,” February http://www.va.gov/vapubs http://www.va.gov/vapubs

21. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended, January 18, 2017

22. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

23. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021

24. VA Handbook 6500, “Risk Management Framework for VA Information Systems VA

Information Security Program,” February 24, 2021

25. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal

Information (SPI),” June 30, 2023

26. VA Handbook 6500.6, “Contract Security,” March 12, 2010

27. VA Handbook 6500.8, “Information System Contingency Planning,” April 6, 2011

28. VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018

29. VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017

30. OIT Process Asset Library (PAL), https://www.va.gov/process/ Reference Process

Maps at https://www.va.gov/process/maps.asp and Artifact templates at https://www.va.gov/process/artifacts.asp

31. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

32. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014

33. VA Handbook 6510, “VA Identity and Access Management,” January 15, 2016

34. VA Directive and Handbook 6513, “Secure External Connections,” October 12, 2017

35. VA Directive 6300, “Records and Information Management,” September 21, 2018

36. VA Handbook, 6300.1, “Records Management Procedures,” March 24, 2010

37. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12)

Program,” October 26, 2015

38. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-12)

Program,” March 24, 2014

39. OMB Memorandum M-05-24, “Implementation of Homeland Security Presidential

Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005

40. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019

41. Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance, December 2, 2011, (NOTE: Part A of the FICAM Roadmap and Implementation Guidance, v2.0, was replaced in 2015 with an updated Architecture (https://arch.idmanagement.gov/#what-is-the-ficam-architecture)

42. NIST SP 800-116 Rev 1, “Guidelines for the Use of PIV Credentials in Facility Access,” June 2018

43. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, “Digital Identity Guidelines,” updated March 02, 2020

44. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014

45. NIST SP 800-164, “Guidelines on Hardware-Rooted Security in Mobile Devices

(Draft),” October 2012

46. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

47. VA Memorandum “PIV Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

48. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

49. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019

50. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (Public Law 110–140), December 19, 2007

51. Section 104 of the Energy Policy Act of 2005, (Public Law 109–58), August 8, 2005

52. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 2, 2001

53. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote

Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

54. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

55. “Veteran Focused Integration Process (VIP) Guide 4.0,” January 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

56. “Product Line Management (PLM) Transformation Playbook,” version 3.1, August

2023, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

57. VA Memorandum “Proper Use of Email and Other Messaging Services,” January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

58. “DevSecOps Product Line Management Playbook” version 2.0, May 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

59. NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020

60. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol Version

6 (IPv6),” November 19, 2020

61. Social Security Number (SSN) Fraud Prevention Act of 2017

62. Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23, 2018

63. VA Enterprise Design Patterns and Application Programming Interfaces (API) Best

Practices: https://www.oit.va.gov/library/recurring/edp/ OIT PAL: Home - Process Asset Library (sharepoint.com)

64. Scaled Agile Framework (SAFe) Diagram and related SAFe information can be referenced here: http://www.scaledagileframework.com/

65. VA Office of Information Security (OIS), Secure Code Review, Web Application Security Assessment (WASA), and Network Security Operations Center (NSOC) standards: https://vaww.oit.va.gov/office-of-information-security/

66. OIS Secure Code Review: https://mobile.va.gov/content/code-review

67. 18 F b: https://github.com/18F/api-standards

68. Credentialing and Privileging specific documents:

69. VHA Directive 1063, Utilization of Physician Assistants (PA) https://www.va.gov/vhapublications/ViewPublication.asp?pub_ID=2958

70. VHA Directive 2012-030, Credentialing of Health Care Professionals https://www.va.gov/vhapublications/ViewPublication.asp?pub_ID=2815 https://github.com/18F/api-standards

71. VHA Handbook 1100.18, Reporting and Responding to State Licensing Boards https://www.va.gov/vhapublications/ViewPublication.asp?pub_ID=9174

72. VHA Handbook 1100.20, Credentialing of Health Care Providers https://www.va.gov/vhapublications/ViewPublication.asp?pub_ID=9444

73. VHA Handbook 1100.21, Privileging https://www.va.gov/vhapublications/ViewPublication.asp?pub_ID=10179

74. VHA Credentialing and Privileging Standard Operating Procedures https://vaww.qps.med.va.gov/divisions/qm/msa/Credentialing/msaCRPolicy.aspx

75. VHA Standards of Practice https://www.govinfo.gov/content/pkg/FR-2020-11- 12/pdf/2020-24817.pdf

76. The Joint Commission of Accreditation Standards (particularly Hospital Medical Staff standards) https://e-dition.jcrinc.com/MainContent.aspx

77. Privacy Act System of Records Notice 77VA10E2E https://www.govinfo.gov/content/pkg/FR-2021-01-25/pdf/2021-01541.pdf

78. VA Directive 6066, “Protected Health Information (PHI) And Business Associate Agreements Management”, September 2, 2014 https://www.va.gov/vapubs/viewPublication.asp?Pub_ID=761&FType=2

3.0 SCOPE OF WORK

The Contractor shall maintain, design, develop, and deploy an application which addresses the following:

• Ensure uninterrupted operations of the VetPro system through effective maintenance.

• Implement user-driven enhancements to improve functionality and usability.

• Migrate the VetPro system from National Institute of Health (NIH) environment, where it is currently hosted, to a secure, scalable cloud environment in the VA Cloud.

• Provide comprehensive help desk support, ensuring user satisfaction and minimal downtime.

• Create and maintain thorough documentation for users and technical staff.

• To modernize the application architecture, improving performance and user experience.

4.0 PERFORMANCE DETAILS

This Task Order (TO) shall be proposed on a Firm-Fixed Price (FFP).

4.1 PERFORMANCE PERIOD

The period of performance shall be 12 months from date of award, with four 12-month option periods, and one 30-day optional task for transition support.

There are eleven (11) Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, five are set by date:

New Year's Day January 1 Juneteenth June 19 Independence Day July 4 Veterans Day November 11 Christmas Day December 25

If any of the above falls on a Saturday, then Friday shall be observed as a holiday.

Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

Martin Luther King's Birthday Third Monday in January Washington's Birthday Third Monday in February Memorial Day Last Monday in May Labor Day First Monday in September Columbus Day Second Monday in October Thanksgiving Fourth Thursday in November

4.2 CONTRACTOR REQUIREMENTS

Contractor shall have familiarity with the cloud service providers Microsoft & Amazon

4.3 PLACE OF PERFORMANCE

Efforts under this TO shall be performed at contractor facilities or another location approved by VA and contractor. The main VA location is VA Central Office, 810 Vermont Ave, NW Washington DC 20420. Work may be performed at additional locations with prior concurrence from the COR.

4.4 TRAVEL

The Government does not anticipate travel under this effort.

5.0 SPECIFIC TASKS AND DELIVERABLES

5.1 PROJECT MANAGEMENT

5.1.1 CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, timeline, and tools to be used in execution of this order (hereinafter either “order” or “contract”). The CPMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks, and resource support. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPMP shall be concurred upon and updated in accordance with Section B of the contract. The Contractor shall update and maintain the VA Program Manager (PM) approved CPMP throughout the period of performance.

Deliverable:

A. Contractor Project Management Plan

5.1.2 MANDATORY TRAINING

The Contractor shall submit Talent Management System (TMS) training certificates of completion for VA Privacy and Information Security Awareness and Rules of Behavior and Health Insurance Portability and Accountability Act (HIPAA) training and provide signed copies of the Contractor Rules of Behavior in accordance with Section 9, Training, Appendix C of the VA Handbook 6500.6, “Contract Security”. The Contractor shall provide newly obtained certificates as part of the Biweekly Status Report (5.1.3).

Contractor employees may be required to complete VA training courses before receiving access to the Data Repository. Contractor employees who have completed these VA training courses within a specified time and have furnished certificates will not be required to re-take the training courses. The Contractor shall collect and store copies of Training Certificates as evidence of completion for each individual. The Contractor shall provide a copy of the Training Roster and certificates to indicate the staff that have completed training in the Biweekly Status Report (5.1.3).

In addition, the Contractor may be required to complete the following VetPro and NIH training:

• VetPro Privacy and Security Training

• NIH Information Security Awareness Courses

• NIH Privacy Awareness Courses

5.1.3 PROJECT MANAGEMENT SERVICES

The Contractor shall:

• Collaborate and cooperate with client offices and other staff in the VetPro environment to foster a seamless, team-oriented environment.

• Provide oversight on Agile Sprint planning and deliver report on backlog plan and delivery.

• Provide oversight on operations and maintenance of the VetPro application.

• Ensure necessary contractual, program management and quality assurance goals, and administrative and security compliance requirements are met.

• Ensure that the services and deliverables required by VetPro are provided in accordance with the task order.

• Discuss all current activities and the scope of work and provide a draft executable project management plan and timeline, updated roster of key personnel, and proposed communication schedule.

5.1.4 REPORTING REQUIREMENTS

The Contractor shall provide the COR with Monthly Progress Reports in electronic form in Microsoft Word and Project formats. The report shall include detailed instructions/explanations for each required data element, to ensure that data is accurate and consistent. These reports shall reflect data as of the last day of the preceding Month.

The Monthly Progress Reports shall cover all work completed during the reporting period and work planned for the subsequent reporting period. The report shall also identify any problems that arose and a description of how the problems were resolved. If problems have not been completely resolved, the Contractor shall provide an explanation including their plan and timeframe for resolving the issue. The report shall also include an itemized list of all Information and Communication Technology (ICT) deliverables and their current Section 508 conformance status. The Contractor shall monitor performance against the CPMP and report any deviations. It is expected that the Contractor will keep in communication with VA accordingly so that issues that arise are transparent to both parties to prevent escalation of outstanding issues.

Deliverable:

A. Monthly Progress Report B. Progress Update Agenda C. Progress Update Meeting Minutes

5.1.5 TECHNICAL KICKOFF MEETING

A technical kickoff meeting shall be held within 10 days after TO award. The Contractor shall coordinate the date, time, and meeting platform (teleconference, MS Teams, WebEx, etc.) with the Contracting Officer (CO), as the Post-Award Conference Chairperson, the VA PM, as the Co-Chairperson, the Contract Specialist (CS), and the COR. The Contractor shall provide a draft agenda to the CO and VA PM at least five (5) calendar days prior to the meeting. Upon Government approval of a final agenda, the Contractor shall distribute to all meeting attendees. During the kickoff-meeting, the Contractor shall present, for review and approval by the Government, the details of the intended approach, work plan, and project schedule for each effort via a Microsoft Office PowerPoint presentation. At the conclusion of the meeting, the Contractor shall update the presentation with a final slide entitled “Summary Report” which shall include notes on any major issues, agreements, or disagreements discussed during the kickoff meeting and the following statement “As the Post-Award Conference Chairperson, I have reviewed the entirety of this presentation and assert that it is an accurate representation and summary of the discussions held during the Technical Kickoff Meeting for the VetPro Application Support.” The Contractor shall submit the final updated presentation to the CO for review and signature within three (3) calendar days after the meeting. The Contractor shall also work with the CS, the Government’s designated note taker, to prepare and distribute the meeting minutes of the kickoff meeting to the CO, COR and all attendees within three (3) calendar days after the meeting. The Contractor shall obtain concurrence from the CS on the content of the meeting minutes prior to distribution of the document.

Deliverables:

A. Kickoff Meeting Agenda

B. Kickoff Meeting Summary Report

5.1.6 SOFTWARE LICENSES

VetPro requires the following licenses to be maintained by the Contractor.

• Visual Studio Enterprise (1 license per developer)

• HealthStream (Verity) API ( yearly API fee)

5.2 BUSINESS REQUIREMENT ANALYSIS

The Contractor shall Meet weekly and communicate with the government to understand their requirements.The contractor shall document the business case for the project to perform the right requirements analysis and prioritize the effortsand Create a context-level diagram, which is valuable both for planning and communications purposes, to identify interfaces, data flows, and high-level processes associated with the project. Contractor shall Apply an approach to manage and record requirements, decisions, and changes with documented strategies for content organization and collaboration.

Contractor wshall Develop and maintain a requirements traceability matrix throughout the project lifecycle and shall perform organizational process reviews to identify the currently supported processes and existing gaps and shall perform review sessions to confirm the accuracy of the requirements.

Contractor shall create lists of functional and information needs related to each scenario and capture the business objectives/rules and shalldocument all the workflows and systems by creating user manuals, document functionalities and other documents as required by the software development life cycle.

Contractor shall analyze the Operations and Maintenance (O&M) items and provide functions per the user need and facilitate testing and modification of software before moving to production.

Contractor shall make changes to eliminate any security vulnerabilities found during the security assessment or communicated by the COR to the Contractor.

Contractor shall coordinate with the VetPro Project Manager (PM), VetPro COR and VetPro security representatives to remedy security issues.

Contractor shall provide COR approved business requirements documents which include an outline of the requirement andwith customer sign-off verifying that the project is complete.

A. Business Requirements Document

5.3 DEVELOPMENT REQUIREMENT

The Contractor shall be responsible for Agile Development Teams performing the full suite of development tasks using Agile methodologies, including, but not limited to, participating in creating user stories for both business functionality and technical requirements and defining acceptance criteria; estimating the size of stories; solution design; development; and testing. To support this effort, the Contractor shall:

• Develop code that does not add technical debt to a release.

• Correct any defects identified by testers, code reviewers, automated tools, or as part of the continuous integration and continuous delivery/deployment (CI/CD) activities.

• Conform to the architecture and standards provided by the Government and Agile process's best practices.

• Provide code that meets the functional and non-functional requirements, meets database development requirements, and is deployable and thoroughly tested.

• Assist in the documentation of user stories, acceptance criteria, tasks, and other application documentation to be completed to fulfill the “definition of done” for a user story.

• Develop code against user stories documented or as assigned by VetPro.

• Provide traceability of corrected defects back to the original user story.

• Regularly validate their user interface mockups and perform usability testing with VetPro personnel, including application system end users, subject matter experts, stakeholders, and regular users.

Provide effective management of project schedule, performance, risks, warranties, subcontracts, and data to produce upgraded/modernized application systems that satisfy all functionality requirements, including, but not limited to:

• Schedule and performance information throughout the program's life cycle.

• Communications and change management processes that involve all key stakeholders.

• Well-established entry and exit criteria for each task.

• Training materials, work aids, and other support tools to assist in conducting training for end users and other stakeholders, as applicable, throughout the performance period.

The Contractor shall support the integration and configuration activities to ensure the automatic build and deployment process works effectively across all environments, including the Contractor's development and test environments/platforms. Deployment and testing in those respective environments shall emulate code performed for deployment and testing in pre-production and production. Contractor will update software Source Code as needed and will keep track of all activities in the project schedule.

A. Source Code

5.4 B. PROJECT SCHEDULE DOCUMENTATION SUPPORT

The Contractor shall maintain and update the VetPro Documentation referenced below with respect to all software code migrations and updates. The Government will provide baseline versions of each document.

• User Documentation: Creating detailed user manuals and FAQs to guide users in navigating the VetPro system.

• Technical Documentation: Maintaining comprehensive technical documentation covering system architecture, APIs, and integration points.

• Update Procedures: Ensuring that all documentation is updated with each enhancement or operational change.

• Security Documentation: Creating and maintaining security documentation required for A&A efforts to achieve Authorization.

Technical Documents

The Contractor shall maintain and deliver the following VetPro technical documents:

• VetPro General System Design Document (GSDD)

• VetPro Technical Architecture Design Mode (TADM)

• VetPro Entity Relationship Diagram (ERD)

• VetPro User Manual

• VetPro PIV Module (VPM) User Manual

Authority to Operate (ATO) Documents

The Contractor shall provide documentation, including as applicable creation, updates, and reviews, required in support of VetPro’s Authority to Operate (ATO) required per NIST standards:

• VetPro ATO Standard Operating Procedures (SOPs) for NIST control families

• VetPro Customer Responsibility Matrix

• VetPro Configuration Management Plan (CMP)

• VetPro Configuration Checklists

• VetPro Incident Response Plan (IRP)

• Business Impact Analysis (BIA)

• VetPro Information System Contingency Plan (ISCP)

• VetPro Disaster Recovery Plan (DRP)

• VetPro Information System Vulnerability Management Plan (ISVMP)

• VetPro Interconnection Security Agreements/Memoranda of Understanding/Interface Control Documents (ISA/MOU/ICD), for all system interconnections

• VetPro Hardware/Software Inventory

• VetPro Ports, Protocols, and Services

• VetPro System Authorization Boundary

• VetPro Threat Model

• VetPro Data Flow Diagrams/Topological Drawings

• VetPro Audit Logs

• VetPro Vulnerability Scans

• VetPro Security Impact Analysis (SIA)

5.5 APPLICATION DEVELOPMENT PLAN

The Contractor shall provide highly qualified, certified personnel with proven expertise tailored to meet the VetPro application requirements in a team-based Agile environment. There shall be one Agile team of contractors working in parallel with the O&M environment. The development team shall work with the IT Stakeholders to deploy the Contractor-developed application to the VetPro’s operational environment. The Government expects the Contractor to work with a technical architecture and design and adhere to the Agile process and SDLC frameworks defined by VetPro.

The Contractor shall provide an Application Development Plan (ADP) for each development effort, and the plan shall ensure iterative development, continuous integration, and frequent delivery of functional software. Regarding infrastructure, the plan shall ensure Contractor solutions leverage VetPro’s approved environments for application deployment. The plan shall ensure that the contractor-developed application adheres to stringent federal security standards and can seamlessly integrate with existing VetPro IT infrastructure. The Contractor's ADP serves as a roadmap for the successful development and deployment of federal applications, ensuring they are secure, efficient, and tailored to the needs of VetPro stakeholders.

The ADP shall include by not limited to the following:

Project Overview; team structure; project schedule; development tasks; user story management; test integration and development/release; quality assurance; sprint activities; continuous integration and continuous improvement delivery/development;

after-action review and sprint retrospective reporting; code management, quality, and coverage.

Deliverables:

A. Application Development Plan

5.6 RELEASE PLAN AND RELEASE NOTES

The Contractor shall prepare a VetPro release plan according to Agile methodology. At the end of each release cycle the Contractor shall provide release notes.

A. Release Plan B. Release Notes

5.7 SCOPE MANAGEMENT PLAN

The Contractor shall describe the process to determine how the project scope will be defined, developed, and verified for the VetPro effort. The Contractor shall ensure the Scope management plan:

• Prevents unapproved work from being performed (scope creep), which avoids potential increases in project cost and schedule while also ensuring higher quality products are delivered.

• Defines the disciplined process for how requirements are collected, communicated, and Modified.

• Identifies processes to monitor effective scope management to reduce the risk of project cost overruns and increase the likelihood of meeting scope that provides the set of activities required to define and manage work on the VetPro effort to ensure work stays within the boundaries of the scope statement.

The Contractor shall possess comprehensive and detailed knowledge of the VetPro application including but not limited to:

• The original and subsequent modifications to technical and business architecture.

• The evolution of business requirements and any associated changes, capturing both historical and current scope.

• The scope of historical and current testing processes, including test cases, business requirements, and any scope adjustments, is made because of testing outcomes and findings.

This depth of knowledge is essential to effectively manage the scope of the project, ensuring alignment with past and current objectives.

Deliverables:

A. Scope Management Plan

5.8 COMMUNICATIONS PLAN

The contractor shall provide a Communications Management Plan that sets the communications framework for the entire VetPro effort. The Contractor’s Communications Management Plan shall:

• Serve as a guide for communications throughout the life of the effort and will be updated as communication needs change;

• Provide details of structured communications that engage stakeholders, build credibility, foster collaboration, and build support for all project-related activities;

• Define the methodology for informing stakeholders of the VetPro mission, key activities, including cross-departmental activities, how changes impact stakeholders, actions required to support the VetPro effort, and timing of critical events, activities, and decisions; and

• Understand the plan is vital to meeting the requirements of all.

Deliverables:

A. Communications Management Plan

5.9 RISK MANAGEMENT PLAN

The Contractor shall establish, maintain, and adhere to a Risk Management Plan (RMP). The RMP shall describe the Contractor's approach to managing risk and issues as well as the Contractor's plan to develop and implement mitigation strategies and contingency plans for identified and accepted risks. The RMP shall include a Risk Register as an attachment to the RMP, in which the Contractor identifies and logs risks and documents responses and mitigation strategies.

The Contractor shall possess a thorough understanding of the historical risks and issues that have emerged since the initial deployment of the VetPro application. Given changes in leadership and stakeholders, various risks and issues have been effectively mitigated and resolved in previous years. To prevent recurrence, the Contractor shall have comprehension of these historical challenges and their respective mitigation strategies to prevent recurrence. This approach will ensure that lessons learned are applied proactively, supporting effective risk management and continuity of operational stability.

Deliverables:

A. Risk Management Plan B. Risk Register

5.10 APPLICATION SERVICE MANAGEMENT

The Contractor shall demonstrate the capability and expertise to deliver Tiered service management effectively utilizing personnel with a thorough historical understanding of the VetPro application and its environment. The Contractor shall demonstrate knowledge of the original and modified architecture, business rules, and a detailed familiarity with the codebase and its changes, where documentation is limited or outdated. This depth of understanding is essential to ensure continuity responsiveness and accuracy in services management and O&M activities.

A. Tier 1 Service Desk

The Contractor shall meet the VetPro Service Level Agreement (SLA) for successful continued Tier 1 service desk operation. The role of the Tier 1 service desk is to identify and resolve all end user application trouble issues and recommend to VetPro for approval application enhancements to be implemented. All incoming inquiries are analyzed and triaged by the Tier 1 Service Desk staff (4 full time technicians needed) The technicians shall manage responses to inquiries through the VetPro application, e-mail, and phone support.

Tier 1 support will be required weekdays, from 7:00 am to 6:00 pm EST, excluding Federal holidays.

B. Tier 2 Service Desk

The Contractor shall meet the VetPro SLA for successful continued Tier 2 operation.

The role of the Tier 2 service is to assure efficient application and database operations, address tickets that can’t be resolved by other Tier levels, troubleshooting and support for all application issues outside of hosting support, and deliver application monitoring and escalations to Tier 3 as required. Tier 2 services include but not limited to:

• System Monitoring: Continuous monitoring of system performance metrics, including uptime, response time, and user access.

• Incident Management: Prompt identification and resolution of incidents, with a structured escalation process for critical issues.

• Updates and Patches: Regular installation of security patches and software updates to mitigate vulnerabilities.

• Backup Management: Backups of the system, with periodic testing of recovery procedures to ensure data integrity.

• Performance Optimization: Routine assessments of system performance and implementation of necessary optimizations to enhance efficiency.

• Execution: Migration of data and applications to the operational environment, ensuring minimal disruption through off-peak scheduling.

• Post-Migration Review: Validation of data integrity and application functionality, along with user feedback collection.

Tier 2 support is required weekdays, from 7:00 am to 6:00 pm EST, excluding Federal holidays.

C. Tier 3 Service Desk

The Contractor shall meet the VetPro SLA for successful continued Tier 3 operation.

The role of the Tier 3 service is to assure efficient application and database operations, address tickets that can’t be resolved by other Tier levels, troubleshooting and support for all application issues outside of hosting support, and deliver application and infrastructure changes required to address defects, business needs, compliance, and policy changes.

All modifications or maintenance changes to code are not to occur prior to gaining approval from the VetPro COR. Communication between the Contractor and the COR may be verbal or via email. If verbal discussions occur, the details and agreements with timeframes will be documented in writing. If issues are identified during monitoring activities, the Contractor shall notify the VetPro with a mitigation plan and seek approval from the COR for appropriate resolution.

Tier 3 support shall include:

• Resolving existing open tickets remaining from the prior contract. The Transition Plan should include a timeline for completion.

• Resolving new tickets. Responding to each Service Desk ticket with a plan, software code modification, or system maintenance change, along with a completion date that is approved by the COR.

• Resolving application and database issues related to the maintenance of the ATO and VetPro security.

• Monitoring and maintaining all VetPro applications, databases, and imaging operations, including interfaces, traffic, storage requirements, processor load, and performance.

• Performing code modifications or system maintenance changes utilities, mapping, tables, views, stored procedures, and triggers when refinements to the application are needed or if an algorithmic or security issue is identified.

• Ensuring the plan, design, and implementation of the VetPro system and imaging meets VetPro’s need to incorporate all existing information, as well as planning for growth in the future.

• Reviewing existing code to optimize for refactoring and efficiencies, which may include but not limited to linking and condensing tables, creating new code to replace legacy code, and updating coding language.

• Design, develop, code, test, and implement software applications. Any new updates should follow agile development methodology. The Contractor shall plan to deliver product releases on 2-4 week sprint cycle.

The Contractor shall maintain a product backlog of change requests in Jira and prioritize based on VetPro defined priority in Sprint planning meetings.

• Furnish complete documentation and deliverables, for each project, in accordance with the government Point of Contact (POC)-approved methodology.

The Contractor shall securely provide updated Source Code related to VetPro. This includes all code used at the presentation layer (HTML files, Active Server Pages, script libraries, style sheets, etc.), the middle-tier business-logic layer and the back-end database (including a full script of all SQL Server databases, with documented stored procedures, views, triggers, user-defined functions, etc.). Any Contractor modifications or enhancements to existing code shall be well-documented, with embedded comments inserted in the programming code.

The Contractor shall create a System Test Plan and Test Cases/Scripts for software code modification and/or system maintenance. The Contractor shall implement automated testing when applicable. The Contractor shall provide test results as part of the Requirements Traceability Matrix (RTM).

Contractor shall complete unit testing in the development environment on all code development and modifications and report results to COR. Following development and unit testing, the Contractor will review results with COR and schedule VetPro Acceptance testing of each software code modification to include a Conformance Validation Statement (508 Compliance Certificate) by VHA Office of Health Information (OHI) Section 508.

Contractor shall install the product component system change on the staging environment and shall perform component integration testing, including major regression testing, when needed. The Staging Environment replicates and simulates the Production Environment. Test results for System Integration Test (SIT) are due for each major software code modification or system maintenance change as agreed upon in the searchable log/system by the COR. When issues are found during formal acceptance testing, the VetPro staff will make a decision on whether or not to migrate code, to turn it back over to contractor to fix the defect or reject the delivery.

Successful Formal Acceptance Test Results are due from the VetPro prior to migration of each software code modification or system maintenance change to the production environment. Contractor shall thoroughly test the product prior to delivery for formal acceptance testing. VetPro will verify successful migration to the production environment. The Contractor shall be responsible for correcting and modifying codes to address defects discovered during testing (i.e., unit, integration, User Acceptance Testing (UAT), and regression). The Contractor shall capture all defects found during the testing and report and update it in the Biweekly Progress Report

Hours of operations:

Tier 3 support shall be available on weekdays from 7:00 am to 6:00 pm ET, excluding Federal holidays. System migrations are simple code and/or data fixes that can occur weekly. System migrations will occur remotely after 10:00 pm ET, unless otherwise agreed upon. Larger release migrations will be scheduled at a mutually agreeable time, approximately two migrations per year.

5.11 CLOUD MIGRATION AND APPLICATION ENHANCEMENTS

The Contractor shall migrate the existing VetPro NET Framework-based application, currently hosted at National Institutes of Health (NIH) to a secure, scalable VA cloud environment. This migration shall enhance operational resilience, optimize costs, improve performance, and establish flexible architecture that supports ongoing and future enhancements. In addition, the Contractor shall provide evidence of supporting FedRamp infrastructure hosting/maintenance, application development, and cloud migrations.

The VetPro application shall serve as the foundation of a robust electronic infrastructure enabling the VetPro to streamline and enhance the environment. Key components of the optional tasks include:

• Cloud and data migration

• Application enhancements

5.11.1 CLOUD MIGRATION OBJECTIVES

The contractor shall transition VetPro to VA Cloud, reduce dependence on physical infrastructure and enable scalability. Assess and modernize the VetPro .NET Framework application, transformation to native cloud services, lowering the technical debt and maximizing micro-services. Provide security and compliance ensuring the cloud application meets data security and regulatory compliance standards. Leverage cloud-native services to enhance performance, including load balancing, auto-scaling, and managed database services.

The Contractor shall:

a. Coordinate with the VA Cloud or other teams to develop a clear approach to data migration and replication that minimizes the product production downtime.

b. Provide a Migration Support Plan that identifies the tasks, schedule, as well as the roles and responsibilities for the migration and provides recommendations for phasing out aging infrastructure when moving to the cloud.

c. Provide a Migration Test Plan that identifies the Contractor’s testing approach, including pass/fail criteria, risks, etc.

d. Execute testing in accordance with the approved plan and provide a Migration Test Summary Report that identifies the tests executed, what tests passed or failed as well as any defects encountered during the migration test.

e. Respond to related technical questions from the VAEC and/or from existing infrastructure POC.

f. Verify the product operating as required and all data is validated in all of its production and non-production environments. The Contractor shall support the resolution of migration anomalies.

g. Ensure all the development and build tools, as well as interfaces to external systems are operating in their new environments as required.

h. Support the validation of connectivity (endpoints) including dependent systems and interfaces as defined in the System Design Document.

i. Create and drive the Implementation Plan to include the cloud migration strategy and schedule.

A. Migration Support Plan B. Migration Test Plan C. Migration Test Summary Report D. Cloud Migration Strategy Document

5.11.2 VA CLOUD STRATEGY ASSESSMENT

Contractor shall create and maintain cloud strategy assessment document to include a comprehensive assessment of the existing .NET application, dependencies, data storage, and integration points; a risk mitigation plan and approach options (re-hosting, re-platforming, or refactoring);a migration timeline and detailed roadmap with dependencies; and a proposal for a cloud solution using the VetPro VA cloud platform to lower the technical debt. The Contractor shall coordinate with existing infrastructure POC and other stakeholders to create and maintain the Cloud Strategy Assessment document

Deliverables:

A. Cloud Strategy Assessment Document

5.11.3 DATA MIGRATION AND SYNCHRONIZATION

The contractor shall plan and execute the migration of databases and storage components using cloud-native tools. Establish a data synchronization strategy, if required, for continuity between on-premises and cloud environments during migration. Contractor shall perform data validation post-migration to ensure data integrity and completeness.

Contractor shall create data migration plans and validation reports to ensure proper data migration.

Deliverable:

A. Data Migration Plan and Validation Report.

5.11.4 MIGRATION AND CODE REFACTORING APPLICATION

The contractor shall refactor code where applicable, integrate cloud-native services to optimize performance and operational overhead. Contractor shall conduct thorough testing, including unit testing, integration testing, and load testing and document in the application migration playbook based on the cloud Migration Strategy Assessment Document

Deliverable:

A. Application Migration Playbook

5.11.5 OPTIMIZATION AND PERFORMANCE TUNING

The contractor shall implement auto-scaling configurations and caching solutions to enhance performance.

Perform load testing and monitor resource utilization to optimize costs and performance.

Use cloud-native tools for CPU, memory, and database performance monitoring.

Contractor shall create a performance optimization report after working with the customer to identify “key” business transactions for monitoring / optimization purposes

Deliverable:

A. Performance Optimization Report

5.11.6 SECURITY AND COMPLIANCE

The contractor shall configure security protocols, including firewalls, VPCs, and VPNs.

Contractor shall ensure encryption of sensitive data, Implement multi-factor authentication. Contractor shall support a post-migration security audit to ensure compliance with regulatory requirements. The Contractor shall provide support, applicable documentation to include Security and Compliance Continuity Plan, and coordinate with data centers and VAEC to ensure consistency with VA ATO requirements and that the applications/systems comply with VA information security policies and standards. In addition to engaging with data center partners, the contractor shall provide A&A support required to achieve and maintain full VA A&A certification in compliance with the most current versions of VA Handbook 6500, VA Handbook 6500.6 (Section 3), and VA Handbook 6500.3. The contractor shall also address any delta between the VA control target profile and Customer Responsibility controls from the VAEC Control Implementation Summary (CIS).

Deliverable:

A. Security and Compliance Continuity Plan

5.11.7 DISASTER RECOVERY (DR) AND BUSINESS CONTINUITY

The contractor shall establish a disaster recovery plan aligned with…