Modernized Enterprise eFOIA SaaS Solution DRAFT PWS -Posted.pdf

Modernized Enterprise eFOIA SaaS Solution

VA-26-00037131

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Office of Information & Technology Compliance, Risk and Remediation

Date: February 23, 2026

PWS Version Number: 1.0

Contents

1.0 BACKGROUND

2.0 APPLICABLE DOCUMENTS

3.0 SCOPE OF WORK

4.0 PERFORMANCE DETAILS

4.1 PERFORMANCE PERIOD

4.2 PLACE OF PERFORMANCE

4.3 TRAVEL

5.0 SPECIFIC TASKS AND DELIVERABLES

5.1 PROJECT MANAGEMENT

5.1.1 CONTRACTOR PROJECT MANAGEMENT PLAN

5.1.2 REPORTING REQUIREMENTS

5.1.3 TECHNICAL KICKOFF MEETING

5.2 eFOIA RISK MANAGEMENT FRAMEWORK AND INFORMATION

ASSURANCE

5.3 DATA MIGRATION (BASE PERIOD ONLY)

5.4 EFOIA SYSTEM MAINTENANCE SUPPORT

5.5 EFOIA SOLUTION TRAINING

5.6 EFOIA LESSONS LEARNED

5.7 ASSESSMENT, AUTHORIZATION, AND CONTINUOUS MONITORING

5.7.1 IF THE SOLUTION IS FedRAMP AUTHORIZED BUT NOT VA

AUTHORIZED:

5.7.2 IF THE SOLUTION IS FedRAMP AUTHORIZED AND VA AUTHORIZED:

5.8 ENHANCED EXECUTIVE ANALYTICS AND DASHBOARD CAPABILITY

5.9 OPTION PERIOD 1

5.10 OPTION PERIOD 2

5.11 OPTION PERIOD 3

5.12 OPTION PERIOD 4

5.13 OPTIONAL TASK ONE – TRANSITION SUPPORT

5.14 OPTIONAL TASK TWO – ADDITIONAL STORAGE

5.15 OPTIONAL TASK THREE – ADDITIONAL CONCURRENT USERS

5.16 OPTIONAL TASK FOUR – APPLICATION PROGRAMMABLE INTERFACES

(API) INTEGRATION ENABLEMENT AND CONFIGURATION

6.0 GENERAL REQUIREMENTS

6.1 ENTERPRISE AND IT FRAMEWORK

6.1.1 VA TECHNICAL REFERENCE MODEL

6.1.2 ZERO TRUST – VA CRITICAL SECURITY CONTROLS

6.1.3 FEDERAL IDENTITY, CREDENTIAL, AND ACCESS MANAGEMENT

(FICAM)

6.1.4 INTERNET PROTOCOL VERSION 6 (IPv6)

6.1.5 TRUSTED INTERNET CONNECTION (TIC)

6.1.6 STANDARD COMPUTER CONFIGURATION

6.1.7 VETERAN FOCUSED INTEGRATION PROCESS (VIP) AND PRODUCT

LINE MANAGEMENT (PLM)

6.1.8 PROCESS ASSET LIBRARY (PAL)

6.1.9 AUTHORITATIVE DATA SOURCES

6.1.10 SOCIAL SECURITY NUMBER (SSN) REDUCTION

6.2 SECURITY AND PRIVACY REQUIREMENTS

6.2.1 POSITION/TASK RISK DESIGNATION LEVEL(S)

6.2.2 CONTRACTOR PERSONNEL SECURITY REQUIREMENTS

6.3 METHOD AND DISTRIBUTION OF DELIVERABLES

6.4 PERFORMANCE METRICS

6.5 FACILITY/RESOURCE PROVISIONS

6.6 GOVERNMENT FURNISHED PROPERTY

6.7 SHIPMENT OF HARDWARE OR EQUIPMENT

ADDENDUM A – ADDITIONAL VA REQUIREMENTS, CONSOLIDATED

ADDENDUM B – VA INFORMATION AND INFORMATION SYSTEM SECURITY/

PRIVACY LANGUAGE

1.0 BACKGROUND

The Department of Veterans Affairs (VA), Office of Information and Technology (OIT), Quality, Performance, and Risk, Office of Quality Compliance, strives to provide high quality, effective, and efficient information technology services that support those responsible for delivering care to Veterans across all points of care in a timely and compassionate manner. VA relies on information management and information technology systems to support mission objectives and enable effective program operations.

The Freedom of Information Act, 5 U.S.C. 552, as amended by Public Law No. 110-175, establishes the public’s right of access to federal agency records, except where records are protected from disclosure by statutory exemptions or exclusions. Executive Order

13392 and the Openness Promotes Effectiveness in our National Government Act further amended FOIA and directed agencies, including VA, to improve FOIA program management and provide more customer focused service. VA’s web based Electronic

Freedom of Information Act system was developed in response to these statutory and policy requirements. More recently, the STRONG Veterans Act of 2022 and the Joseph

Maxwell Cleland and Robert Joseph Dole Memorial Veterans Benefits and Health Care

Improvement Act of 2022 reinforced the need for modern eFOIA capabilities and reduced response timelines for VA FOIA programs.

The VA FOIA Office requires an eFOIA system capable of preserving, collecting, processing, reviewing, analyzing, and producing electronically stored information in compliance with legal obligations under the Federal Rules of Civil Procedure and the

Freedom of Information Act, 5 U.S.C. 552, as amended.

VA FOIA operations must support time sensitive requests involving large volumes of electronically stored information, including the ability to process, upload, and analyze millions of records to meet court ordered deadlines associated with litigation, investigations, FOIA requests, and congressional oversight. Failure to meet these requirements increases the risk of court sanctions and costly or unmerited settlements.

Currently, the VA FOIA Office manages approximately 12 terabytes of data that will carry forward from the legacy system, which reached end of life on April 30, 2024, with daily ingestion of standard and non standard documents, audio files, and video files.

The VA Central Office FOIA records retention schedule established by the National

Archives and Records Administration is six years, excluding litigation holds, appeals, and related exceptions. The VA FOIA Office requires support for approximately 900 users during each period of performance, with the ability to adjust the number of licenses based on program needs. Individual requests may range in size from more than 150 gigabytes to a single page document. In fiscal year 2022, the VA FOIA program received approximately 23,000 requests, increasing to approximately 71,200 requests in fiscal year 2023, and more than 120,000 requests in fiscal year 2024.

2.0 APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. 44 U.S.C. § 3541-3549, “Federal Information Security Management Act (FISMA) of 2002”

2. “Federal Information Security Modernization Act of 2014”

3. Federal Information Processing Standards (FIPS) Publication 140-2, “Security

Requirements for Cryptographic Modules”

4. FIPS Pub 199. “Standards for Security Categorization of Federal Information and

Information Systems,” February 2004

5. FIPS Pub 200, “Minimum Security Requirements for Federal Information and

Information Systems,” March 2006

6. FIPS Pub 201-2, “Personal Identity Verification of Federal Employees and

Contractors,” August 2013

7. 10 U.S.C. § 2224, "Defense Information Assurance Program"

8. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

9. 5 USC 552 (FOIA) and the VA, 38 CFR Chapter 1 Part 1 & 2

10. Public Law 109-461, Veterans Benefits, Health Care, and Information

Technology Act of 2006, Title IX, Information Security Matters

11. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”

12. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, https://www.va.gov/vapubs/index.cfm

13. VA Handbook 0710, “Personnel Security and Suitability Program,” May 2, 2016, https://www.va.gov/vapubs/index.cfm

14. VA Directive and Handbook 6102, “Internet/Intranet Services,” August 5, 2019

15. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and

Guidelines,” January 18, 2017

16. Office of Management and Budget (OMB) Circular A-130, “Managing Federal

Information as a Strategic Resource,” July 28, 2016

17. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed

Services (CHAMPUS)”

18. NIST SP 800-66 Rev. 1, “An Introductory Resource Guide for Implementing the

Health Insurance Portability and Accountability Act (HIPAA) Security Rule,” October 2008

19. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended, January 18, 2017

20. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

21. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021

22. VA Handbook 6500, “Risk Management Framework for VA Information Systems

VA Information Security Program,” February 24, 2021

23. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal

Information (SPI),” March 12, 2019 https://www.va.gov/vapubs/index.cfm https://www.va.gov/vapubs/index.cfm http://www.va.gov/vapubs http://www.va.gov/vapubs

24. VA Handbook 6500.5, “Incorporating Security and Privacy into the System Development Lifecycle,” March 22, 2010

25. VA Handbook 6500.6, “Contract Security,” March 12, 2010

26. VA Handbook 6500.8, “Information System Contingency Planning,” April 6, 2011

27. VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018

28. VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017

29. OIT Process Asset Library (PAL), https://www.va.gov/process/ . Reference

Process Maps at https://www.va.gov/process/maps.asp and Artifact templates at https://www.va.gov/process/artifacts.asp

30. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

31. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014

32. VA Handbook 6508.1, “Procedures for Privacy Threshold Analysis and Privacy Impact Assessment,” July 30, 2015

33. VA Handbook 6510, “VA Identity and Access Management,” January 15, 2016

34. VA Directive and Handbook 6513, “Secure External Connections,” October 12,

35. VA Directive 6300, “Records and Information Management,” September 21, 2018

36. VA Handbook, 6300.1, “Records Management Procedures,” March 24, 2010

37. NIST SP 800-37 Rev 2, “Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy,” December 2018

38. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020)

39. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015

40. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” March 24, 2014

41. OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005

42. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019

43. OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008

44. Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance, December 2, 2011, (NOTE: Part A of the FICAM Roadmap and Implementation Guidance, v2.0, was replaced in 2015 with an updated Architecture (https://arch.idmanagement.gov/#what-is-the-ficam-architecture)

45. NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access,” June 2018

46. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, “Digital Identity Guidelines,” updated March 02, 2020 https://www.va.gov/process/ https://www.va.gov/process/maps.asp https://www.va.gov/process/artifacts.asp https://www.va.gov/trm/TRMHomePage.aspx https://arch.idmanagement.gov/#what-is-the-ficam-architecture https://arch.idmanagement.gov/#what-is-the-ficam-architecture

47. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014

48. NIST SP 800-164, “Guidelines on Hardware-Rooted Security in Mobile Devices

(Draft),” October 2012

49. Draft National Institute of Standards and Technology Interagency Report

(NISTIR) 7981, “Mobile, PIV, and Authentication,” March 2014

50. VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland

Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

51. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

52. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

53. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

54. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019

55. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008

56. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (Public Law 110–140), December 19, 2007

57. Section 104 of the Energy Policy Act of 2005, (Public Law 109–58), August 8,

58. Executive Order 13834, “Efficient Federal Operations,” dated May 17, 2018

59. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 2,

60. VA Directive 0058, “VA Green Purchasing Program,” July 19, 2013

61. VA Handbook 0058, “VA Green Purchasing Program,” July 19, 2013

62. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote

Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

63. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

64. “Veteran Focused Integration Process (VIP) Guide 4.0,” January 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

65. VA Memorandum “Proper Use of Email and Other Messaging Services,” January

2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

66. “DevSecOps Product Line Management Playbook” version 2.0, May 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

67. NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020

68. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol

Version 6 (IPv6),” November 19, 2020

69. Social Security Number (SSN) Fraud Prevention Act of 2017

70. Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23, 2018 https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514 https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896 https://www.cisa.gov/publication/tic-30-core-guidance-documents https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371 https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

71. VAAR Part 804.1303, Contract Clause Requiring Compliance with Personal Identity Verification of Contractor Personnel:

https://www.va.gov/oal/library/vaar/vaar804.asp#8041303

72. VAAR 804.1970, Information Security Policy – Contractor General Responsibilities: https://www.va.gov/oal/library/vaar/vaar804.asp#8041970

73. FedRAMP’s Continuous Monitoring Strategy Guide:

https://www.fedramp.gov/assets/resources/documents/CSP_Continuous_Monitor ing_Strategy_Guide.pdf

3.0 SCOPE OF WORK

The Contractor shall provide a Commercial Off the Shelf (COTS) Modernized Enterprise Electronic Freedom of Information Act (eFOIA) Software as a Service solution, inclusive of, project management, project planning, training, data migration, human centered design, application performance monitoring and alerting, risk management, information assurance, operations and maintenance, and lessons learned.

4.0 PERFORMANCE DETAILS

4.1 PERFORMANCE PERIOD

The Period of Performance (PoP) shall consist of a 12-month base period plus four 12-month option periods and four optional tasks.

Any work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO).

There are 11 Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, five are set by date:

New Year's Day January 1 Juneteenth June 19 Independence Day July 4 Veterans Day November 11 Christmas Day December 25

If any of the above falls on a Saturday, then Friday shall be observed as a holiday.

Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

Martin Luther King's Birthday Third Monday in January Washington's Birthday Third Monday in February Memorial Day Last Monday in May Labor Day First Monday in September Columbus Day Second Monday in October Thanksgiving Fourth Thursday in November https://www.va.gov/oal/library/vaar/vaar804.asp#8041303 https://www.va.gov/oal/library/vaar/vaar804.asp#8041970 https://www.fedramp.gov/assets/resources/documents/CSP_Continuous_Monitoring_Strategy_Guide.pdf https://www.fedramp.gov/assets/resources/documents/CSP_Continuous_Monitoring_Strategy_Guide.pdf

4.2 PLACE OF PERFORMANCE

Tasks under this PWS shall be performed at Contractor facilities. The Contractor shall identify the Contractor’s place of performance in their proposal submission.

Work may be performed at remote locations with prior approval of the Government Program Manager (PM). The Contractor shall maintain an online presence during normal Monday through Friday business hours. After-business-hours, emergency, and pre-approved scheduled work may be performed at remote locations with prior approval of the Government PM as stated in this PWS.

4.3 TRAVEL

The Government does not anticipate travel under this effort to perform the tasks associated with the effort.

5.0 SPECIFIC TASKS AND DELIVERABLES

Normal business hours are Monday throughout Friday from 9:00am to 5:00pm Eastern Time.

The Contractor shall provide a Commercial Off-the-Shelf (COTS) Modernized Enterprise eFOIA Software as a Service (SaaS) solution, hereafter referred to as the “COTS eFOIA SaaS solution”, “eFOIA SaaS solution” or “the solution”.

The Contractor shall deliver a fully configured, deployed, and baselined solution within 30 calendar days of award and shall achieve go live within 90 calendar days of award. A baseline solution shall mean that system configuration is complete, user roles and permissions are established, required workflows are implemented, and the solution is ready for VA testing. Go live shall mean that the solution is operating with full functionality to include VA production data is being processed in the solution and designated FOIA offices are able to intake, track, review, redact, and close requests in the production environment.

The Contractor shall provide all application hosting, licensing, operational environments, help desk and system support, and maintenance required for VA use and shall allow VA-directed hybrid or split data storage arrangements, as applicable.

The Contractor shall provide all required installation, configuration, data migration, testing, deployment support, product support, technical support, and Service Level

Agreements.

The Contractor shall ensure the solution is operational, reliable, and available for VA use at least 99.9 percent of the time each calendar month, excluding VA approved planned maintenance.

The Contractor shall ensure all required salient characteristics are fully available and operational at go live and shall be expandable or scalable during the period of performance without requiring solution redesign or replacement. The requirements in this section establish the minimum salient characteristics required to support VA FOIA program needs and are not listed in order of importance.

The solution shall meet at a minimum all of the following salient characteristics:

1. The solution shall have a current FedRAMP Moderate authorization and meet

FISMA Moderate requirements at the time of proposal submission. The authorization and controls shall apply to the complete solution proposed for VA use, including hosting, core application components, supporting services, and any integrated modules.

2. The solution shall have API(s) that connect the solution to VA information management systems such as those that handle VA Privacy, records management, identity, reporting, payment information or payment transactions, and VA-owned databases. The solution shall support both real-time and scheduled data exchanges, including transactional data feeds, metadata synchronization, and reporting outputs, using industry-standard protocols and data formats, i.e., Representational State Transfer (REST). This requirement does not mandate public access to the solution from FOIA.gov.

3. The solution shall process Freedom of Information Act requests, Privacy Act requests under 5 U.S.C. 552a, and combined FOIA and Privacy Act requests.

Unless a requirement is expressly limited to FOIA or Privacy Act processing, all requirements in this section apply equally to FOIA requests, Privacy Act requests, and combined FOIA and Privacy Act requests. The solution shall comply with 5 U.S.C. 552, 5 U.S.C. 552a, applicable Department of Justice

Office of Information Policy guidance, and VA FOIA and Privacy Act policies and procedures.

4. The solution shall provide the ingestion, viewing, processing, and export of large electronic files, including documents, images, audio, and video. The solution shall:

• Accept and export all commonly used electronic file formats, including but not limited to PDF, DOCX, XLSX, PPTX, TXT, JPG, PNG, MP4, and

WAV, and any format required for FOIA processing during the period of performance.

• Be able to introduce into the solution any additional file formats introduced during the period of performance without requiring re-competition or solution redesign.

• Support reliable uploads and exports of individual files of at least 20 GB at award, including the ability to complete transfers without timeouts and to resume interrupted uploads or downloads without data loss, with the capability to scale to larger file sizes during the period of performance without requiring solution replacement.

• By exception, support VA directed uploads and exports of files larger than the standard maximum file size for specific FOIA requests.

• Maintain the integrity and metadata of files during transfer and export and ensure confidentiality and integrity of data while in transit and at rest.

5. The solution shall provide document review capabilities that support FOIA workflows including viewing and navigating large record sets; automated redaction for text, images, audio, and video across all supported file formats;

review tracking; multiple review layers; full revision history; applying a single redaction action automatically to all occurrences of the same information within a record set; and de-duplication of identical content within a request to reduce reviewer workload.

6. The solution shall provide a public-facing portal that allows requesters to submit

FOIA requests, track submission status, and securely receive responsive records. The portal shall require multifactor authentication and integrate with identity verification services that meet federal digital identity standards as defined in NIST 800-63.

7. The solution shall support at least one VA-approved, federally recognized digital identity provider, such as Login.gov or ID.me, at proposal submission and shall be capable of supporting additional VA-approved digital identity providers during the period of performance.

8. The solution shall provide comprehensive search capabilities across all content within a request, including Optical Character Recognition-generated text, embedded text, handwritten content that can be recognized by the solution, audio transcripts, and video transcripts. Search functions shall support keyword, Boolean, proximity, and metadata-based queries and shall return results across all documents, media, and derived content associated with the request.

9. The solution shall provide automated processing capabilities that support FOIA operations, including Optical Character Recognition for documents and embedded images, file level de duplication, content analytics to identify sensitive information, classify materials, and prioritize items for review, and operational analytics to forecast workload, processing times, and request trends for FOIA program management.

10. The solution shall provide a configurable dashboard that meets FOIA reporting requirements and supports operational oversight. The dashboard shall display metrics including Average Processing Time for Simple, Complex, and Expedited requests, and shall allow metrics to be viewed and filtered by individual user, organizational component, office, administration, or other VA-defined grouping.

Record Retrieval Response Time, System Health, Uptime Monitoring, Active

User Counts, and a user work summary that reflects individual and aggregate workload activity. The dashboard shall also provide additional commonly used

FOIA program management metrics and shall allow VA to modify or add displayed metrics during the period of performance

11. The solution shall include a Substantial Interest review process or an equivalent second level review capability that allows designated users to route, track, and document additional review requirements before release. The solution shall provide visibility into review status, reviewer actions, and completion time for all second level reviews.

12. The solution shall include a FOIA Reading Room that provides public access to records designated for proactive disclosure. The Reading Room shall allow hosting, searching, browsing, and downloading of posted records and shall support metadata tagging to facilitate organization and retrieval. The solution shall preserve prior versions of posted records when updates or replacements occur and shall maintain a history of changes for audit and compliance purposes.

13. The solution shall provide a correspondence management capability that supports creation, editing, versioning, and use of standardized FOIA communication templates. Templates shall provide auto population with request data, requester information, deadlines, document status, fee information, and other fields defined by VA. Users shall be able to create new templates or modify existing templates without vendor assistance, and templates shall support attachments, conditional logic, and customizable formatting. The solution shall maintain version control for all templates, including tracking changes, preserving prior versions, and allowing VA to restore or review earlier versions. Templates shall be usable for email correspondence, solution generated messages, or other communication channels supported by VA. The solution shall provide request tracking and advanced document management capabilities that support the full

FOIA lifecycle in accordance with NARA General Records Schedule 4.2. The solution shall allow users to organize, assign, monitor, and process requests and shall provide tools for version control, document history, retention tagging, and efficient navigation of large record sets.

14. The solution shall provide the ability to analyze and classify inbound requests submitted through the public portal or other supported intake channels. The solution shall identify whether an inbound submission is a FOIA request, a

Privacy Act request, a combined FOIA or Privacy Act request, an invalid or unperfected request, or a submission that is not a proper FOIA request. Based on VA defined rules, the solution shall recommend or generate disposition actions including routing, closure, or return for clarification. When enabled by VA, the solution shall automatically close requests identified as improper, invalid, or duplicate submissions. The solution shall also identify duplicate or substantially identical requests from the same requester or with similar content and shall provide tools to consolidate or close such requests in accordance with VA policy.

15. All automated and recommended actions performed by the solution shall be fully logged. Logged information shall include, at a minimum, the classification determination, action taken, date and time of the action, and the rule or condition that triggered the action.

16. The solution shall generate reports summarizing automated and recommended actions, and VA shall control the frequency, recipients, and distribution schedule of such reports.

17. The solution shall also maintain a complete, immutable audit log of all user actions and solution actions, including document edits, redaction events, classification decisions, and access events. Audit logs shall include user identifier, timestamp, action type, affected records, and prior and resulting states.

Audit logs and reports shall be exportable in machine-readable formats suitable for compliance, litigation, and oversight reviews (e.g., CSV, JSON, or XML).

18. The solution shall have and maintain a complete data dictionary. The data dictionary shall define all data elements used in the solution, including column or field names, descriptions, data types, allowable values, data relationships, and business rules. The data dictionary shall cover request data, requester data, workflow fields, document metadata, reporting fields, solution generated fields, and any fields used for interfaces or integrations. The solution shall update the data dictionary as part of the solution’s configuration management process whenever configuration changes occur during the period of performance and shall be provided to VA in a machine readable format such as CSV andor JSON.

19. The solution shall support processing of Privacy Act requests and combined

FOIA and Privacy Act requests within the same system used for FOIA processing. The solution shall provide the capability to apply Privacy Act access provisions and exemptions, in accordance with applicable law and Department of

Justice guidance. The solution shall allow Privacy Act determinations, redactions, correspondence, and final responses to be documented, tracked, and produced within the solution without requiring use of external records management or response tools.

20. The solution shall comply with Federal accessibility requirements, including

Section 508 of the Rehabilitation Act, and shall meet all VA 508 compliance standards for both the requester portal and the internal user interface. The

Contractor shall ensure that all functionality, content, and outputs generated by the solution are accessible to users with disabilities.

21. The solution shall be web-based and accessible from any VA office or VA-operated location without installation of client software. The solution shall support secure access through standard web browsers and shall function consistently across VA network environments, meaning users experience the same core functionality regardless of VA location, including VA headquarters, field offices, and remote VA facilities.

22. The solution shall support the requirements of 5 U.S.C. 552, Department of

Justice Office of Information Policy (OIP) guidance, and VA FOIA policy by tracking deadlines, documenting requester communications, recording processing actions, and capturing final determinations. The solution shall calculate statutory due dates, flag approaching or overdue deadlines, maintain a complete communication history, and allow users to document exemption decisions, releases, and closures in accordance with FOIA and VA policy.

The solution shall also support FOIA program reporting and compliance by generating standard and ad hoc reports using solution data. The solution shall provide the ability to produce customized reports based on VA-defined criteria, including filtering and aggregation by person, organization, office, administration, time period, and other VA-defined parameters. The solution shall generate reports that comply with Department of Justice OIP reporting requirements, including Monthly, Quarterly, and Annual FOIA reports. All reports shall be exportable in commonly used electronic formats, including but not limited to PDF, CSV, and XLSX, without requiring vendor intervention.

23. The solution shall fully support VA FOIA program needs and scalability requirements (i.e., additional users and storage), including increased user capacity, expanded data volume, and additional FOIA offices or components added during the period of performance without requiring redesign of the solution. The solution shall keep up with any future FOIA requirements imposed by the federal government.

24. The Contractor shall configure the COTS eFOIA SaaS solution to support VA-owned domain routing through a Canonical Name (CNAME) record. The solution shall allow VA to direct a VA-controlled .gov hostname to the Contractor’s service endpoint without exposing the underlying vendor URL. The Contractor shall provide all required target values, DNS instructions, and security validation details necessary for VA to establish and maintain the CNAME. The Contractor shall ensure the service remains fully functional and accessible through the VA-designated domain.

25. The solution shall support at least 900 concurrent active users. The solution shall allow expansion of concurrent user capacity during the period of performance without requiring solution redesign or replacement and without degradation of performance.

26. The solution shall provide a minimum of 15 terabytes of active storage for FOIA records managed in accordance with applicable National Archives and Records

Administration (NARA) retention schedules. The solution shall allow expansion of storage capacity during the period of performance without requiring solution redesign or replacement and without degradation of performance.

27. The solution shall provide the capability to include a maximum of 15 fully segregated and isolated operational environments within the same SaaS platform. Each segregated environment shall be logically and administratively isolated such that data, records, metadata, indexes, audit logs, searches, analytics, and reporting are not visible, discoverable, or accessible outside of the explicitly authorized user group for that environment. Access shall be restricted exclusively to users granted permission for the segregated environment, and users without access, including enterprise, system, or program administrators for other environments, shall have no visibility into the existence, contents, or activity of the segregated environment. Each segregated environment shall provide the same functional capabilities as the primary eFOIA SaaS environment, including intake, processing, review, redaction, reporting, auditing, and compliance features, and segregation shall be enforced through technical controls consistent with Federal cybersecurity standards rather than procedural controls alone.

Deliverable:

A. COTS Modernized Enterprise eFOIA SaaS Solution

5.1 PROJECT MANAGEMENT

5.1.1 CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Project Management Plan (CPMP) that describes the Contractor’s approach, timeline, and tools for executing the contract, including the project schedule, milestones, risks, and resource requirements. The

CPMP shall describe how the Contractor will coordinate and fulfill planned, routine, and ad hoc reporting requirements identified in the PWS.

The CPMP shall also describe the Contractor’s approach to risk management, system continuity, and operational resilience, including the existence and maintenance of a

Disaster Recovery and Business Continuity Plan appropriate to the solution and hosting architecture. The Contractor shall make such plans available to the Government for review upon request. Government review and feedback shall not constitute approval and shall not relieve the Contractor of responsibility for solution availability, data protection, or recovery operations.

The initial baseline CPMP shall be submitted for VA concurrence and updated in accordance with Section B – Price Schedule. The Contractor shall maintain the VA-approved CPMP throughout the period of performance and update it as necessary to reflect material changes to project execution, solution architecture, or risk posture.

A. Contractor Project Management Plan

5.1.2 REPORTING REQUIREMENTS

The Contractor shall provide the Contracting Officer’s Representative with a Monthly

Progress Report in an electronic format agreed upon by VA. The report shall be structured and concise and shall support month-to-month comparison and trend analysis.

The report shall summarize work completed during the reporting period, work planned for the subsequent reporting period, and any changes from the prior report. The report shall identify risks, issues, and deviations from the Contractor Project Management

Plan, including impacts, mitigation actions, and changes in status since the prior reporting period. Narrative content shall be limited to explanations of variances, risks, or issues and shall not be used for general status reporting.

The report shall include a tabular status of all Information and Communication

Technology deliverables, including planned and actual dates, current status, variances, and Section 508 conformance status.

The Contractor shall monitor performance of all PWS tasks against the CPMP and report any deviations. The Monthly Progress Report shall include updates on Risk

Management Framework activities and solution training only when there are changes in status, identified risks, completed activities, or upcoming actions requiring VA awareness or decision.

The Contractor shall maintain regular communication with VA to ensure that emerging issues are visible to both parties and addressed prior to escalation.

A. Monthly Progress Report

5.1.3 TECHNICAL KICKOFF MEETING

The Contractor shall support and facilitate a Technical Kickoff Meeting to introduce the

Contractor team, confirm roles and responsibilities, review the high-level program approach, and discuss initial timelines and expectations. The Technical Kickoff Meeting shall occur no later than five business days after contract award at a time coordinated with VA.

The Contractor shall prepare and provide presentation materials or equivalent documentation to support the meeting. VA will review the materials in advance and may provide comments prior to the meeting. The Technical Kickoff Meeting materials shall include, at a minimum:

1. Points of contact for VA and Contractor personnel, including roles and responsibilities

2. An overview of the draft Contractor Project Management Plan

3. Current FedRAMP authorization status and VA Temporary Authority to Operate or Authority to Operate status

The Contractor shall document meeting outcomes and provide meeting minutes to VA.

Deliverables:

A. eFOIA Technical Kickoff Meeting Materials B. eFOIA Technical Kickoff Meeting Minutes

5.2 EFOIA RISK MANAGEMENT FRAMEWORK AND INFORMATION

ASSURANCE

The Contractor shall ensure that the solution complies with applicable VA security requirements and federal cybersecurity standards, including the National Institute of

Standards and Technology (NIST) Risk Management Framework, Office of

Management and Budget guidance, and VA information security policies for systems processing personally identifiable information (PII).

The Contractor shall provide Risk Management Framework (RMF) documentation that identifies solution risks, associated mitigation strategies, and ongoing risk monitoring activities. The documentation shall include the results of periodic security assessments, vulnerability scans, and other security testing performed to evaluate solution security posture. The Contractor shall maintain and update RMF documentation throughout the period of performance in accordance with VA direction and applicable security requirements.

A. Risk Management Framework Documentation

5.3 DATA MIGRATION (BASE PERIOD ONLY)

Most of the existing FOIA data currently resides in VA’s legacy system called

FOIAXpress, but some data may come from outside FOIAExpress.

The Contractor shall migrate existing FOIA data from FOIAXpress to the COTS eFOIA

SaaS solution at the beginning of the base period of performance. Migration may include all FOIA data or a subset of FOIA data based on VA decisions. Data migration shall include the transfer of VA provided FOIA records, metadata, and supporting information necessary to begin production operations.

The Contractor shall provide a Data Migration Plan that describes the Contractor’s approach, scope, tools, sequencing, validation, and rollback procedures for migrating

FOIA data from FOIAXpress to the COTS eFOIA SaaS solution. The plan shall address both full and partial migration scenarios and shall describe how data integrity, metadata, audit history, and retention attributes will be preserved. Upon VA approval of the Data

Migration Plan, the Contractor shall migrate only the FOIA data identified by VA.

A. Data Migration Plan

5.4 EFOIA SYSTEM MAINTENANCE SUPPORT

The Contractor shall provide solution maintenance to include release management, help desk support, incident/issue resolution, user support, and reporting services for the solution.

Maintenance. The Contractor shall implement software updates and upgrades in accordance with VA Handbook 6500 and in coordination with VA to avoid disruption of

FOIA operations. The Contractor shall limit planned maintenance to periods approved in advance by VA. Planned maintenance shall not exceed four hours per calendar month and shall not occur during VA business hours unless expressly authorized by VA. VA may authorize additional planned maintenance time when necessary for security updates, system upgrades, or other critical activities, provided the Contractor obtains prior written approval from the COR and coordinates timing to minimize operational impact.

Release Management. The Contractor shall provide advance notice to VA of all planned system updates, enhancements, and releases. The Contractor shall maintain a continuously updated set of solution release notes the Weekly Maintenance Logs, to document new features, changes, fixes, and known issues. The Contractor shall provide a proposed update and release schedule and shall not deploy updates that impact functionality, workflows, or user experience without prior VA concurrence on release timing and scope. Emergency or security-driven updates shall be coordinated with VA as soon as practical and documented in the release notes.

Help Desk Support. The Contractor shall provide 24x7x365 help desk support, including on-call technical support and remedial user assistance as needed. During VA business hours, the help desk shall acknowledge all tickets with a non-automated response within one business hour. Outside VA business hours, automated acknowledgment is acceptable, provided that a non-automated response is issued no later than the next VA business hour. For all incidents, automated notification is acceptable outside VA business hours, with human follow-up provided no later than the next business hour unless VA requests after-hours escalation.

Incident/Issue Resolution. The Contractor shall notify the COR and PM within 30 minutes of detection or receipt of VA notification of any system outage, security event, or service interruption that affects solution availability, performance, or functionality. The

Contractor shall provide:

An initial technical response to Critical incidents within 30 minutes of and shall resolve it by restoring core system functionality within two hours of detection or receipt of VA notification, regardless of time of day.

An initial technical response to Major incidents within one business hour of and shall resolve it by restoring functionality within four hours of detection or receipt of VA notification.

An initial technical response to Minor incidents within four business hours of and shall resolve it within eight business hours of detection or receipt of VA notification.

For all incidents, automated notifications to VA-designated distribution points, which may include the COR, PM, VA ticketing systems, or VA monitoring systems.

Critical incidents are defined as solution outages or security-related events that render the solution unavailable or pose an immediate risk to the confidentiality, integrity, or availability of FOIA or Privacy Act data. Major incidents are defined as issues that prevent submission, retrieval, review, redaction, or closure of FOIA requests. Minor incidents are defined as issues that degrade solution functionality without preventing

FOIA processing.

User Support. For User support tickets that do not involve solution defects or incidents, the Contractor shall provide that user with a non-automated response within one business day and resolve the ticket within three business days, unless resolution requires VA action, policy clarification, or user follow-up.

Reporting. The Contractor shall maintain and provide a Weekly Help Desk Maintenance

Log that delivers actionable insight into solution performance and support activity. At a minimum, the log shall include the number of tickets opened, closed, and pending;

tickets exceeding defined Service Line Agreements (SLA) thresholds; incident severity classifications; SLA compliance for acknowledgment and resolution; summaries of critical and major incidents and their root causes; recurring issues and trends; system-impacting events; impacts to request intake, processing, or release activities;

maintenance activities performed during the reporting period; and any risks or emerging issues under active monitoring. All notifications, response actions, resolution steps, and timelines shall be documented in the Weekly Help Desk Maintenance Logs.

A. Weekly Help Desk Maintenance Logs

5.5 EFOIA SOLUTION TRAINING

The Contractor shall provide training for VA staff to ensure effective use and administration of the COTS eFOIA SaaS solution. All training materials, user guides, administrator guides, and recorded sessions shall comply with Section 508 accessibility requirements.

The Contractor shall provide initial training 10 business days after TO award, prior to Go Live. Initial training shall consist of 10 instances (one a week) of interactive instructor led Training with exercises & On demand videos. The Contractor shall provide a proposed Initial Training schedule which shall be executed after VA COR Approval of the schedule.

VA requires Recurrent Training that occurs after Go Live. The Contractor shall provide a

COTS eFOIA SaaS Recurrent Training Plan that documents the approach, schedule, delivery method, and target audiences for scheduled recurrent training, which includes at a minimum virtual instructor-led and role-based training. Training shall cover all core user functions needed for request intake, assignment, review, redaction, correspondence, release, reporting, and system administration. The Contractor shall provide recurrenting instructor-led virtual training sessions which shall be provided on a weekly basis throughout the period of performance, with each session focused on different solution features, functions, or updates using a rotating topic schedule. The

Contractor shall provide role-based training for FOIA Officers, reviewers, and system administrators, and shall provide ad hoc virtual training upon VA request to address solution updates, configuration changes, new features, or other solution changes that affect user performance. VA will provide at least five business days’ notice for ad hoc training requests. Ad hoc training shall be provided at no additional cost to VA.

The Contractor shall provide a training environment or sandbox, separate from the production system, that allows VA users to practice solution system functions without affecting live data.

The Contractor shall provide and maintain an eFOIA Solution User Guide, an eFOIA

System Administrator Guide, and all associated training materials. The Contractor shall update all guides and materials whenever solution functionality or configuration changes affect their accuracy. Updated materials shall be provided to VA in electronic format at least five business days prior to any scheduled recurrent training session.

All training sessions conducted by the Contractor shall be recorded and the Recorded

Training Sessions shall be delivered to VA using Microsoft Teams or another VA approved platform within seven calendar days after the training.

A.Training Plan B.User Guide C. System Administrator Guide

D. Training Materials including Training Environment or Sandbox E. Recorded Training Sessions

5.6 EFOIA LESSONS LEARNED

The Contractor shall provide an Annual eFOIA SaaS Project Activity Lessons Learned

Report. The report shall identify significant challenges, risks, and successes encountered during this task order period of performance and shall document actionable lessons learned related to solution performance, configuration, operations, training, security, and support. For each identified lesson, the report shall describe the underlying cause, the impact to VA operations or users, and recommended improvements or corrective actions. The report shall also identify any lessons that were implemented during the reporting period and the outcomes of those actions.

A. Annual eFOIA SaaS Project Activity Lessons Learned Report

5.7 ASSESSMENT, AUTHORIZATION, AND CONTINUOUS MONITORING

5.7.1 IF THE SOLUTION IS FedRAMP AUTHORIZED BUT NOT VA AUTHORIZED:

1. The information system solution selected by the Contractor shall comply with the Federal Information Security Management Act (FISMA)

2. The Contractor shall remain in compliance with FedRAMP requirements as mandated by Federal laws and policies, including making available any documentation, physical access, and logical access needed to support this requirement.

3. The system must be FedRAMP Authorized at no less than the

Moderate.

4. The Contractor shall, where applicable, assist with the VA ATO Process to help achieve agency authorization of the cloud service or migrated application.

5. The Contractor shall provide confirmation of the completion of its

FedRAMP System Security Plan (SSP) and supporting documentation by providing, to the VA PM, COR, and Digital Transformation Center

(DTC), its repository ID number and associated link for VA to download the SSP and all required artifacts within five calendar days of contract award.

6. The Contractor shall work with a VA DTC Subject Matter Expert to develop and provide a VA specific system boundary diagram including any integration and connectivity components for VA use. This will be known as the VA Implementation Diagram (VAID) and will demonstrate the proposed implementation of this system at VA.

https://www.fedramp.gov/

7. The Contractor shall provide the results of their most recent

Third-Party Assessment Organization (3PAO) Security

Assessment Plan (SAP).

8. The Contractor shall complete a 3PAO Security Assessment Report (SAR).

9. The Contractor…