PWS Template_May_16_Rev2_MAR_18_2026.docx

<Title of Project>

<VA-XX-XXXXXXXX>

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Office of Information & Technology (OIT) <Office Name>

<Title of Project>

Date: <date>

<VA-XX-XXXXXXXX>

PWS Version Number: <X.X> Disclaimer: The TAC accepts no liability for the completeness or correctness concerning the Information Technology content of this template. This template is a means to simply assist the requiring activity in developing their requirements. It is the Requiring Activity’s responsibility to ensure the correctness of all requirements within their final Performance Work Statement

Instructions for Completing the PWS Kevin Wymbs, Engineer, TAC Engineering Service is responsible for the maintenance of this Performance Work Statement template. However, the TAC accepts no liability for the completeness or correctness concerning the Information Technology content of this template. All proposed changes to this template document must be submitted to Kevin Wymbs at Kevin.Wymbs@va.gov.

Update fields throughout the document indicated by < text > in Microsoft Word “Emphasis” “Style, within carrots, and in blue color. Any Instructions to the preparer are in Microsoft Word “Emphasis” “Style”, in blue color as well, with parenthesis () around the instructions. Any “Emphasis” “Style” blue text that will become a part of the PWS document itself, must be convert to black text “No Spacing” Microsoft Word Style. To format the text this way, highlight the appropriate text to be converted, and click on the Home tab from the Word menu at the top and choose “No Spacing” from the Microsoft Word “Styles” section.

On the cover page, enter the title, date, VA # and PWS version number.

Edit Header to include Title and VA # by double-clicking on Header section above.

NOTE: In steps 5 - 14 below you may click on the section numbers to navigate to the referenced sections.

In Section 1.0 BACKGROUND update the text in <blue> with a description of the task areas required to complete the effort as well as a background on the project.

In Section 2.0 APPLICABLE DOCUMENTS, please review and delete any non-applicable documents. In addition, please add any applicable documents that are not currently contained in this section.

In Section 3.0 SCOPE OF WORK, update the text in <blue> with a brief summary of tasks.

In Section 4.1 PERFORMANCE PERIOD (if applicable), update the text in <blue> to reflect the duration of the contract. If options are required, enter the option duration also.

In Section 4.2 PLACE OF PERFORMANCE, update text in <blue> to reflect the facilities at which the Contractor will be executing the tasks in this PWS.

In Section 4.3 TRAVEL, enter the # of trips, duration and location(s).

In Section 5.0 SPECIFIC TASKS AND DELIVERABLES, include all the tasks that the Contractor will be required to complete under this proposed contract/order as well as a description and a list of required deliverables for the tasks. Task 5.1.1 and 5.1.2 are provided as standard requirements for all efforts and may be modified as necessary. Add additional sections as required by utilizing the standard formatting as described below.

To add a new section, go to the beginning of section 5.2 and replace <ADDITIONAL TASK(S)> with the title of the new task. NOTE: To format each new section, click on the Home tab from the Word menu at the top and choose “H2” from the Microsoft Word “Styles” section. The title should format to a heading and be automatically numbered. Once all of the additional sections are added utilizing the process described above, return to the Table of Contents, hit F9 and select “Update entire table” to automatically update the fields in the table.

In Addendum B (VA Information and Information System Security/ Privacy Language), remove any full Sections (keeping the Section’s Heading Name while indicating N/A as the text within the Section) according to the requirements of the effort by following the specific instructions provided preceding each section, See Addendum B.

SCHEDULE FOR DELIVERABLES (located in NOTES TO THE CONTRACTING OFFICER at the end of this document). Update the table to include all the deliverables that the Contractor will be required to provide for the proposed contract/order. Be sure that the deliverables in the table match the deliverables in Section 5.0 Include the delivery schedule in terms of number of days after receipt of order (ARO) or number of days after contract (DAC) for the deliverables. The delivery schedule can also be event driven (e.g. 30 days after the project schedule is approved).

To link the Task number in the table to Section 5.0 highlight the cell in the table where you would like the cross reference, then click on the Insert tab from the Word menu at the top. Choose the Cross-reference icon.

When the Cross-reference box opens, select “Heading” in the Reference type, select “Heading number” in the Insert reference to. Then in the “For which heading” section, select the section that applies and click Insert.

In Section 6.1 ENTERPRISE AND IT FRAMEWORK, the language provided is based upon the VA Enterprise and IT Framework standards currently established. If additional information is required or changes are to be made, modify as necessary.

In Section 6.2.1, POSITION/TASK RISK DESIGNATION LEVELS, please list the PWS Task Section Numbers for the effort and indicate the appropriate risk designation associated with each task based upon the Position Designation Automated Tool (PDT) (also known as PDAT) tool results by checking the appropriate box. The result is Contractor Position Risk Designations, identified by PWS task, that determines the appropriate level of investigation (Tier 1/Low Risk, Tier 2/Moderate Risk, and Tier 4/High Risk) required of the Contractor personnel working that particular task. This “Task” Position Risk Designation correlates to the individual Contractor personnel background investigation level required, depending upon which particular tasks the Contractor individual is working.

To check/uncheck the checkbox, simply select the checkbox.

Please Note: the language provided in ADDENDUM B is the latest version of Security Privacy language, based upon the updated Appendix C in Handbook 6500.6, to be added to the PWS.

Contents

(NOTICE to all Requiring Activities:

1. ARTIFICIAL INTELLIGENCE

All requiring activities must adhere to the policy for all in-scope AI use-case owners to submit their AI Use-Cases through the CAIO Team Site which contains AI Use-Case Intake Form. Please see the Intake Form site referenced for further information on AI Use-Cases, and the submission instructions. See below for the Use-Case Categories and Examples of Use-Cases that would require submission of your effort using the AI Use-Case Intake Form..

Use-Case Categories and Examples That Require Intake Submission:

· VA AI Use-Cases required for Intake commonly fall under the following categories:

1. A software system that learns from data

1. A tool that mimics or supports human decision making

1. A tool exposed to new data to make predictions, decisions, or recommendations about real people, agency service delivery, or agency program execution

· Some examples of AI Use-Cases at VA include:

1. Machine learning or other AI tools to provide a clinical diagnosis or determine a recommended treatment;

1. AI chat tools to summarize claims and contention data;

1. Natural language processing to review Veteran survey comments and identify potential risks of crisis;

1. AI tools to automate components of benefits and application processing.

The answers provided within the AI Use-Case Intake Form to include, but not limited to the type of AI used, the domain the AI is in, the benefit and output of the AI, will be used by CAIO to evaluate and determine if the use-case is required for Inventory, as well as if it is High-Impact, as required by M-25-21. See also Identification and Review of High-Impact AI Use Cases.

1. After submitting the use-case to the CAIO office Intake process, CAIO office representatives will assist the Use-Case Owner through next steps required for their Use-Case. If High Impact Use-Case, the CAIO office will also provide information regarding required risk management practices, the AI Impact Assessment, and Risk Mitigation Plan requirements. As a result, the Requiring Activity should determine if any specific related requirements tasks are needed for their PWS to support these minimum risk management requirements.

0. Use-Case Owners should also indicate to CAIO whether the AI Use-Case is a pilot, which will release them from the full compliance process, but will trigger a follow-up by CAIO at six months

1. See Section 6.1.12 in the PWS Template for the required information and language that will always be included in your PWS, regardless of intake determination, and instructions regarding any modifications to the requirements, as necessary. Section 6.1.12 also contains PWS requirements to ensure Unbiased AI Principles are adhered to and incorporated into the AI System/LLM.

1. Additionally, there are solicitation instructions/requirements for the Vendor to submit with its proposal, located in the Notes to the CO Section at the end of this document.

2. Source Code Harmonization and Reuse in Information Technology (SHARE IT) Act Requirements:

All custom software development efforts (except for those programs/products for use in national security systems, classified code, or code whose disclosure would create an identifiable risk to individual privacy) must include software source code delivery of custom-developed code for Federal re-use requirements in accordance with the SHARE IT Act, P.L. 118-187, December 23, 2024. (Custom-developed code means source code, or segregable portions of source code, written for a software project, module, plugin, script, middleware, or application programming interface, that is first produced in the performance of a contract, exclusively funded by the Federal Government, for which the Federal Government could obtain unlimited rights under FAR Part 27)

a. See Section 6.1.13, Source Code Harmonization and Reuse in Information Technology (SHARE IT) Act, in this PWS Template for the required information and language to be included in this PWS if the SHARE IT Act applies.

b. The formal deliverable and task such as, “The Contractor shall provide a Custom-Developed Code Package including the source code or segregable portions of source code, and other key technical components of the code (including documentation, data models, schemas, metadata, architecture designs, configuration scripts, and artifacts required to develop, build, test, and deploy the code) to support reuse and transparency in accordance with the SHARE IT Act,” (or similar) must be added to the Software Development requirements at the appropriate location within the PWS task in Section 5.x (to include adding the associated Custom Developed Code Package deliverable and its due date requirements in the Schedule for Deliverables table within the Notes to the CO Section (and corresponding CLIN within the Price Schedule)) to ensure delivery of the custom developed code package throughout the development process to the current VA GitHub Source Code Inventory Repository for VA/Federal re-use, as required in the SHARE IT Act.

c. Add “P.L. 118-187, Source Code Harmonization and Reuse in Information Technology (SHARE IT) Act, December 23, 2024” as the last item in Section 2.0 Applicable Documents of this PWS, remove the bold, change the text to black, and include within the numbered list structure.)

3. VA Enterprise Cloud (VAEC) Efforts, Enterprise Cloud Solutions Office (ECSO):

The VA CIO and Infrastructure Operations Director require that, if a solution cannot be provided by a SaaS solution or Infrastructure as Code, that it next be assessed for hosting on one of VA’s Enterprise Cloud Hosting Platforms including the VA Enterprise Cloud (VAEC), and VA Platform One (VAPO). VAEC is a multi-cloud hosting platform, providing both Amazon Web Services and Microsoft Azure government community clouds. VAPO provides a containerization strategy for migrations and new development within the VAEC clouds. Both VAEC and VAPO support the efficient migration to and utilization of cloud technology by the requiring activity. Through VAEC and VAPO, Infrastructure Operations (IO) provides applications and systems with secure and seamless cloud functionality together with enterprise tools, standards and common services. IO adheres to the Cloud Smart Policy (https://cloud.cio.gov/strategy/),which offers practical implementation guidance to fully realize the potential of cloud-based technologies while ensuring thoughtful execution that incorporates practical realities. New cloud hosting requests can be directed to the IO Unified Intake Services Request here: IO Unified Intake Services Request. To expedite a request, contact OIT IO INTAKE TRIAGE.

To aid requiring activities that need to migrate applications or systems to the VAEC or are implementing applications or systems in the VAEC, the Office of Strategic Sourcing (OSS), Technical Acquisition Center (TAC), and the Enterprise Cloud Solutions Office (ECSO) have provided a VAEC Technical Reference Guide VAEC Technical Reference Guide 11/2022 This guide is applicable to migrations to or new development in the VAEC platforms.

Requiring Activities should also note that there is standard VAEC performance work statement (PWS) language (see below) to be used by project teams that need to migrate applications or systems to the VAEC or are implementing applications or systems in the VAEC. This language includes cloud-specific requirements and deliverables that should be considered in your PWS.

Projects where an existing COTS or custom, legacy application or system has been deemed cloud suitable and is targeted to be migrated to and hosted in the VAEC (or is currently hosted in a VAEC) should refer to the “Standard VAEC PWS Language for Migrations” document for PWS sample language considerations regarding specific VAEC requirements to be added to the Requiring Activity’s PWS.

Projects where there is a new solution implementation should refer to the “Standard VAEC PWS Language for New Implementations” document for PWS sample language considerations regarding specific VAEC requirements to be added to the Requiring Activity’s PWS.

These documents can be found at the VAEC Acquisition Resources page: https://dvagov.sharepoint.com/sites/OITECSO/SitePages/VAEC-Acquisition.aspx?csf=1&e=dhnDL4. If you require further assistance, please contact ecsoinfo@va.gov.

4. SaaS EFFORTS:

In addition, Requiring Activities should note that for Software as a Service (SaaS) acquisitions, Digital Transformation Center (DTC) has developed standardized PWS Language for several scenarios regarding FedRAMP, etc., to be added to your PWS requirements document, as appropriate. Please see the document “SaaS Contract Language and Price Schedule – FY24” in the “SaaS” folder for the latest language and example price schedule, located in the “OIT Acquisition Guides” folder within the “OPAL Acquisition Requirements Package (ARP) Templates” area: OIT Acquisition Guides. Please also see the VA Digital Marketplace at DigitalVA Product Marketplace for existing VA-approved software as a service (SaaS), platform as a service (PaaS), and low-code no-code (LCNC) products to consider reusing an existing, proven solution in the catalog that may satisfy your requirements. However, the Digital VA Product Marketplace is not intended to direct procurements.

5. Clinical Data Determination Standards:

(Requiring Activities should note that for acquisitions of solution(s) involving a Clinical and Data Management System, the VHA Health and Medical Informatics office has developed standardized PWS requirements language to be added to your PWS requirements document as appropriate. Please see the document “PWS Guide – Clinical Terminology Standards Requirements” located in the “VHA Acquisition Guides” folder within the OPAL Acquisition Requirements Package (ARP) Templates” area: VHA Acquisition Guides. This Guide is intended to help programs and projects develop and/or select Clinical and Data Management systems that are aligned with terminology standards. Please contact VHA Health Informatics Knowledge Based Systems Terminology Standards Staff at VHA10P2AHIKBSTerminologyStandardsStaff@va.gov for any questions regarding these requirements.)

BACKGROUND

(Sample Background, replace with appropriate text) The Department of Veterans Affairs (VA), Office of Information & Technology (OIT), <enter specific organization> strives to provide high quality, effective, and efficient Information Technology (IT) services to those responsible for providing care to the Veterans at the point-of-care as well as throughout all the points of the Veterans’ health care in an effective, timely and compassionate manner. VA depends on Information Management/Information Technology (IM/IT) systems to meet mission goals.

<Insert brief background of specific project>

APPLICABLE DOCUMENTS

(Modify as necessary. Remove any referenced documents that do not apply)

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. “Federal Information Security Modernization Act of 2014”

2. Federal Information Processing Standards (FIPS) Publication 140-3, “Security Requirements for Cryptographic Modules”, March 22, 2019

3. FIPS Pub 199. “Standards for Security Categorization of Federal Information and Information Systems,” February 2004

4. FIPS Pub 200, “Minimum Security Requirements for Federal Information and Information Systems,” March 2006

5. FIPS Pub 201-3, “Personal Identity Verification of Federal Employees and Contractors,” January 2022

6. 10 U.S.C. § 2224, "Defense Information Assurance Program", as amended

7. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

8. Public Law 109-461 (P.L. 109-461), Veterans Benefits, Health Care, and Information Technology Act of 2006, as amended, Title IX, Information Security Matters

9. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”, as amended

10. VA Directive 0710, “Personnel Vetting Program,” September 8, 2025, https://www.va.gov/vapubs/index.cfm

11. VA Handbook 0710, “Personnel Vetting Program,” September 8, 2025, https://www.va.gov/vapubs/index.cfm

12. VA Directive 6102, “Internet/Intranet Services,” August 5, 2019

13. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and Guidelines,” as amended

14. Office of Management and Budget (OMB) Circular A-130, “Managing Federal Information as a Strategic Resource,” July 28, 2016

15. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed Services (CHAMPUS)”, as amended

16. NIST SP 800-66 Rev. 2, “Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule: A Cybersecurity Resource Guide,” February 2024

17. 45 C.F.R Parts 160 and 164, Subparts A and E, the Standards for Privacy of Individually Identifiable Health Information (“Privacy Rule”); and 45 C.F.R. Parts 160 and 164, Subparts A and C, the Security Standard (“Security Rule”); as amended

18. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended

19. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

20. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021 (see VA NOTICE 24-18, dated September 27, 2024, “Update to VA Directive 6500 Cybersecurity Program”, and VA Notice 25-07, dated 3/18/25, “Amending VA Directive 6500 to incorporate M-24-15”)

21. VA Handbook 6500, “Risk Management Framework for VA Information Systems VA Information Security Program,” February 24, 2021 (see VA Notice 25-01, dated October 15, 2024, “Update to VA Handbook 6500 Risk Management Framework for VA Information Systems VA Information Security Program”, and VA Notice 25-06, dated 3/18/25, “Amending VA Directive 6500 to incorporate M-24-15”, VA Notice 25-16, dated September 15, 2025, “Amending VA Handbook 6500 to Replace Enterprise Mission Assurance Support Services Tool With Office of Information Technology Governance Risk Compliance Tool, and VA Notice 25-17, dated September 22, 2025, “Rescission Of Office Of Information Security (OIS) Deputy Assistant Secretary (DAS) Memorandum – Requirements of Proper Plan of Action and Milestones (POA&M) Completion)

22. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI),” June 30, 2023

23. VA Handbook 6500.6, “Contract Security,” March 12, 2010 (see VA Notice 24-12, dated April 22, 2024, “Update to VA Handbook 6500.6, Contract Security, Appendix C VA Information and Information System Security/Privacy Language For Inclusion Into Contracts, As Appropriate”)

24. VA Handbook 6500.8, “Information System Contingency Planning,” March 25, 2025

25. VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018 (see VA NOTICE 25-10, dated June 9, 2025, “Use of Personally Owned Mobile Devices Policy Amendment of Department of Veterans Affairs Handbook 6500.10”, and VA Notice 25-15, dated August 22, 2025, “Update to VA Handbook 6500.10 Mobile Device Security Policy”)

26. VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017

27. OIT Process Asset Library (PAL), OIT Process Asset Library.

28. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

29. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014

30. VA Directive 6510, “VA Identity, Credential and Access Management,” September 3, 2024

31. VA Handbook 6510, “VA Identity, Credential and Access Management,” September 27, 2024

32. VA Directive and Handbook 6513, “Secure External Connections,” October 12, 2017

33. VA Directive 6300, “Records and Information Management,” September 21, 2018

34. VA Handbook, 6300.1, “Records Management Procedures,“ March 24, 2010

35. NIST SP 800-37 Rev 2, “Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy,” December 2018

36. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020)

37. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015

38. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” March 24, 2014

39. OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005

40. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019

41. OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008

42. Federal Identity, Credential, and Access Management (FICAM) Architecture, June 30, 2023 (FICAM Architecture (idmanagement.gov))

43. NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access,“ June 2018

44. NIST SP 800-63 Rev 4, 800-63A-4, 800-63B-4, 800-63C-4, “Digital Identity Guidelines,” August 1, 2025

45. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014

46. VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

47. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

48. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

49. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

50. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019

51. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008

52. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (P.L. 110–140), December 19, 2007

53. Section 104 of the Energy Policy Act of 2005, (P.L. 109–58), August 8, 2005

54. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 2, 2001

55. Executive Order 14148, “Initial Rescissions of Harmful Executive Orders and Actions,” dated January 20, 2025

56. VA Directive 0057, “VA Environmental Management Program,” October 25, 2022

57. OIS VAIQ #7424808 Memorandum, “Remote Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

58. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

59. “Veteran Focused Integration Process (VIP) Guide 4.0,” March 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

60. VA Memorandum “Proper Use of Email and Other Messaging Services,” January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

61. “Product Line Management Transformation Playbook” version 3.1, August 2023, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

62. NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020

63. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol Version 6 (IPv6),” November 19, 2020

64. Social Security Number (SSN) Fraud Prevention Act of 2017

65. Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23, 2018

66. C.F.R Title 15 Part 7, “Securing the Information and Communications Technology and Services (ICTS) Supply Chain”, as amended

67. Executive Order 14028, “Executive Order on Improving the Nation's Cybersecurity,” May 12, 2021, https://bidenwhitehouse.archives.gov/briefing-room/presidential-actions/2025/01/16/executive-order-on-strengthening-and-promoting-innovation-in-the-nations-cybersecurity/

68. OMB Memorandum M-22-09, “Moving the U.S. Government Toward Zero Trust Cybersecurity Principles”, January 26, 2022, https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf.

69. NIST SP 800-52 Revision 2, “Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations

70. OMB M-26-05, “Adopting a Risk-based Approach to Software and Hardware Security,” January 23, 2026

71. OMB M-21-31, “Improving the Federal Government’s Investigative and Remediation Capabilities Related to Cybersecurity Incidents,” August 27, 2021

72. NIST SP 800-88 Revision 1 “Guidelines for Media Sanitization,” December 2014

73. CISA Binding Operational Directive (BOD) 19-02: “Vulnerability Remediation Requirements of Internet-Accessible Systems,” April 29, 2019, BOD 19-02: Vulnerability Remediation Requirements for Internet-Accessible Systems | CISA

74. CISA BOD 22-01: “Reducing the Significant Risk of Known Exploited Vulnerabilities,” November 3, 2021, BOD 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities | CISA

75. CISA BOD 23-01: Improving Asset Visibility and Vulnerability Detection on Federal Networks.” Cybersecurity & Infrastructure Security Agency (CISA), BOD 23-01: Improving Asset Visibility and Vulnerability Detection on Federal Networks | CISA

76. VA Directive 6550, Pre-Procurement Assessment and Implementation of Medical Devices/Systems, June 03, 2019

77. VA Memorandum, “VA Security Controls,” January 17, 2025, https://www.voa.va.gov/DocumentView.aspx?DocumentID=5010

78. E.O. 13960, “Promoting the Use of Trustworthy Artificial Intelligence in the Federal Government,” December 3, 2020

79. E.O. 14319, “Preventing Woke AI in the Federal Government,” July 23, 2025

80. OMB Memorandum M-25-21, “Accelerating Federal Use of AI through Innovation, Governance, and Public Trust,” April 3, 2025

81. OMB Memorandum M-25-22, “Driving Efficient Acquisition of Artificial Intelligence in Government,” April 3, 2025

82. OMB Memorandum M-26-04, “Increasing Public Trust in Artificial Intelligence (AI) Through Unbiased AI Principles,” December 11, 2025

SCOPE OF WORK

The Contractor shall <describe the required services i.e. Project Management, Development, etc. and the project the Contractor will be working on> (Update this paragraph to indicate the Scope)

PERFORMANCE DETAILS

PERFORMANCE PERIOD

The PoP shall be (incorporate language associated with the PoP of your task, to include all option periods, and any optional tasks, as a timeframe: (e.g. The PoP shall be xx months from date of award, with x xx-month option period(s) and xx Optional Tasks. The overall Period of Performance shall not exceed xx months.))

(If performance is required at a Government site and this is applicable) Any work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO). (If required, the CO may designate the Contractor to work during holidays and weekends)

There are 11 Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, five are set by date:

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

PLACE OF PERFORMANCE

(If place of performance is at a Government facility (Onsite)) Tasks under this PWS shall be performed in VA facilities located in <place(s) of performance>. Work may be performed at remote locations with prior concurrence from the Contracting Officer’s Representative (COR). (Modify as necessary)

(If place of performance is at a Contractor facility (Offsite)) Tasks under this PWS shall be performed at Contractor facilities. The Contractor shall identify the Contractor’s place of performance in their proposal submission.

Be clear about the Place of Performance. If place of performance is both Government and Contractor site, provide a brief explanation of the location requirements and any limitations regarding the number of Contractor staff that may be supported on-site.

In addition, Travel to a Government facility needed to perform the services doesn’t change the Place of Performance to the Government Site.

TRAVEL

(Modify as necessary) The Government anticipates travel under this effort to perform the tasks associated with the effort, as well as to attend program-related meetings or conferences throughout the PoP. Include all estimated travel costs in your firm-fixed price line items. These costs will not be directly reimbursed by the Government.

The total estimated number of trips in support of the program related meetings for this effort is <please enter number of trips>. Anticipated locations include the following, estimated at <please enter duration of trips> days in duration:

1. <List location(s)>

Delete the content that follows if this is a Firm Fixed Price contract, otherwise convert the text to Style “Normal No Spacing” and return to black font color)

Travel shall be in accordance with the Federal Travel Regulations (FTR) and requires advanced concurrence by the COR. Contractor travel within the local commuting area will not be reimbursed.

SPECIFIC TASKS AND DELIVERABLES

(All software development and sustainment efforts must include Human Centered Design (HCD) and Software Application Performance Monitoring (APM) requirements in the PWS. Use Document Library Repository - Digital Services - HCD and APM - All Documents (sharepoint.com) for guidance)

The Contractor shall perform the following:

(Discuss deliverables within each task to include format and content. The schedule will be identified in Notes to CO at end of PWS)

(GUIDANCE ON DELIVERABLES-Only essential value-added deliverables shall be requested in the PWS. The need, quantity, and frequency of data delivery shall be considered. The generation of documentation as part of the service being performed does not in all cases represent a deliverable (i.e. correspondence, etc.) Deliverables are costly and should be reduced to what is deemed necessary.)

(SCHEDULING DELIVERY OF DATA- Delivery of data shall be scheduled to be in phase with the planned use(s) of the data. Schedule for delivery of data shall take into consideration the requirements for preparation, inspection, acceptance, and handling of the data.)

(DATA INSPECTION AND ACCEPTANCE- Contracts that contain data requirements shall incorporate appropriate provisions for Contractor quality assurance of the data and support of Government inspection and acceptance procedures necessary to ensure that data are prepared and delivered in accordance with the contract. Contractual provisions for withholding payment in accordance with the Federal Acquisition Regulation (FAR) shall be invoked when a Contractor fails to fulfill contractual data requirements including delivery requirements.

1. Guidelines for the receipt and acceptance procedures for technical data.

a. Overall resources expended on inspection and verification of the data shall be commensurate with the expected economic return and operational needs for the data.

b. A single POC shall be designated on each contract to identify and track the submission, inspection, and acceptance of all contract data deliverables for each item or component for which data has been ordered.)

PROJECT MANAGEMENT

CONTRACTOR PROJECT MANAGEMENT PLAN

(If this effort is for development, the following CPMP paragraph is required otherwise determine applicability with customer.) The Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, timeline, and tools to be used in execution of the contract. The CPMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks, and resource support. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPMP shall be concurred upon and updated in accordance with Section B of the contract. The Contractor shall update and maintain the VA Program Manager (PM) approved CPMP throughout the PoP.

Deliverable:

A. Contractor Project Management Plan

REPORTING REQUIREMENTS

The Contractor shall provide the COR with <Weekly or Monthly> Progress Reports in electronic form in Microsoft Word and Project formats. The report shall include detailed instructions/explanations for each required data element, to ensure that data is accurate and consistent. These reports shall reflect data as of the last day of the preceding <Week or Month>.

The <Weekly or Monthly> Progress Reports shall cover all work completed during the reporting period and work planned for the subsequent reporting period. The report shall also identify any problems that arose and a description of how the problems were resolved. If problems have not been completely resolved, the Contractor shall provide an explanation including their plan and timeframe for resolving the issue. The report shall also include an itemized list of all Information and Communication Technology (ICT) deliverables and their current Section 508 conformance status. The Contractor shall monitor performance against the CPMP and report any deviations. It is expected that the Contractor will keep in communication with VA accordingly so that issues that arise are transparent to both parties to prevent escalation of outstanding issues.

(If a specific minimum teleconference progress meeting timeframe (weekly or monthly) is required between the Contractor and COR, please indicate as such.)

Deliverable:

A. <Weekly or Monthly> Progress Report

<ADDITIONAL TASK(S)>

<Deliverables :> A. <List deliverable> B. <List deliverable>

GENERAL REQUIREMENTS

ENTERPRISE AND IT FRAMEWORK

VA TECHNICAL REFERENCE MODEL

The Contractor shall comply with the VA OIT Technical Reference Model (VA TRM). Compliance with the VA TRM is achieved by using only technologies and standards that are listed as approved for use in the VA TRM. The Contractor shall provide all necessary information requested by VA to ensure TRM approval is obtained prior to use on VA’s network.

ZERO TRUST – VA CRITICAL SECURITY CONTROLS

VA has established minimum mandatory security requirements and requires that any network connected software system or service must meet the VA Critical Security Controls as outlined in the VA Memorandum, “VA Security Controls”, https://www.voa.va.gov/DocumentView.aspx?DocumentID=5010. VA Critical Security Controls identify the minimum mandatory requirements that must be implemented across all VA enterprise infrastructure, cloud computing environments, information systems, networks, and specialized devices (medical devices/systems, special-purpose systems, and research scientific computing devices) that process, store, and/or transmit VA data. Effective July 1, 2025, the Contractor shall implement these VA Critical Security Controls, within any network connected software system or service prior to being authorized for use in the VA. This functional requirement is not negotiable, and Plan of Action & Milestones (POAM) will not be accepted in the event these controls cannot be implemented for new systems. Critical Security Controls are intended to increase VA’s security posture and provide security and privacy risk visibility into the VA network and is not a new requirement. The Contractor’s failure to maintain these VA Critical Controls after implementation will result in VA discontinuing the use of the system.

FEDERAL IDENTITY, CREDENTIAL, AND ACCESS MANAGEMENT (FICAM)

(The below paragraph contains the requirement that all Contractor Solutions must support PIV enabled authentication at Identity Assurance Level (IAL) 3, Authenticator Assurance Level (AAL) 3, and Federation Assurance Level (FAL) 3 (if FAL is required). In addition, the PM will need to define which levels are required for their specific effort, and if the Federation Assurance Level is required. If the requiring activity has identified through their Information System Security Officer (ISSO) and/or OIS that their specific requirement in this PWS can be at lower Assurance Levels, then the requiring activity must change the last sentence of the below paragraph to indicate the required Assurance Levels for their specific effort. For information regarding Assurance Level, see the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-63-4, at https://pages.nist.gov/800-63-4/, which includes 800-63A-4, 800-63B-4, and 800-63C-4. Any questions on Assurance Levels should be addressed to OIS or your ISSO.)

The Contractor shall ensure Commercial Off-The-Shelf (COTS) product(s), software configuration and customization, and/or new software are Personal Identity Verification (PIV) card-enabled by accepting HSPD-12 PIV credentials using VA Enterprise Architecture (EA), and VA Identity and Access Management (IAM) approved Enterprise Technology Guidelines (ETG). The Contractor shall ensure all Contractor delivered applications and systems comply with the VA Identity, Credential, and Access Management policies and guidelines set forth in Executive Order 14028, VA Handbook 6510 VA Identity and Access Management, VA Handbook 0735 Homeland Security Presidential Directive 12 (HSPD-12) Program, CISA Binding Operational Directive 23-01, and align with the Federal Identity, Credential, and Access Management Roadmap and Implementation Guidance v2.0.

The Contractor shall ensure all Contractor delivered applications and systems provide user authentication services compliant with the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-63-3, VA Handbook 6500, and VA IAM enterprise requirements for direct, assertion based authentication, and/or trust based authentication, as determined by the ETGs. Direct authentication at a minimum must include Public Key Infrastructure (PKI) based authentication supportive of PIV card and/or Common Access Card (CAC), as determined by the business need.

The Contractor shall ensure all Contractor delivered applications and systems conform to the specific Identity and Access Management PIV requirements set forth in the Office of Management and Budget (OMB) Memoranda M-05-24, M-19-17, M-22-09, and NIST Federal Information Processing Standard (FIPS) 201-3. Contractor delivered applications and systems shall be on the FIPS 201 Approved Product List (APL). If the Contractor delivered application and system is not on the APL, the Contractor shall be responsible for taking the application and system through the FIPS 201 Evaluation Program.

The Contractor shall ensure all Contractor delivered applications and systems support:

1. Automated provisioning and are able to use enterprise provisioning service.

2. Interfacing with VA’s Master Person Index (MPI) to provision identity attributes, if the solution relies on VA user identities. MPI is the authoritative source for VA user identity data.

3. The VA defined unique identity (Secure Identifier [SEC ID] / Integrated Control Number [ICN]).

4. Multiple authenticators for a given identity and authenticators at every Authenticator Assurance Level (AAL) appropriate for the solution.

5. Identity proofing for each Identity Assurance Level (IAL) appropriate for the solution.

6. Federation for each Federation Assurance Level (FAL) appropriate for the solution, if applicable.

7. Two-factor authentication (2FA) through an applicable Technology Guideline as outlined in VA ETG.

8. A Security Assertion Markup Language (SAML) implementation if the solution relies on assertion-based authentication. Additional assertion implementations, besides the required SAML assertion, may be provided as long as they are compliant with NIST SP 800-63-3 guidelines.

9. Authentication/account binding based on trusted Hypertext Transfer Protocol (HTTP) headers if the solution relies on Trust based authentication.

10. Role Based Access Control.

11. Auditing and reporting capabilities.

12. Compliance with VIEWS 00155984, PIV Logical Access Policy Clarification https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896.

The required Assurance Levels for this specific effort are Identity Assurance Level 3, Authenticator Assurance Level 3, and Federation Assurance Level 3.

INTERNET PROTOCOL VERSION 6 (IPv6)

The Contractor solution shall support IPv6-Only based upon the memo issued by the Office of Management and Budget (OMB) on November 19, 2020 (https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-07.pdf). Which defines IPv6-only as the state of an operational system or service when IPv4 protocol functions (addressing, packet forwarding) are not in use. The NIST USGv6 profile defines technical requirements for a product to be capable of operating in IPv6-Only environments. IPv6-Only technology, in accordance with the USGv6 Program (https://www.nist.gov/programs-projects/usgv6-program/usgv6-revision-1), NIST Special Publication (SP) 500-267B Revision 1 “USGv6 Profile” (https://doi.org/10.6028/NIST.SP.500-267Br1), and NIST SP 800-119 “Guidelines for the Secure Deployment of IPv6” (https://doi.org/10.6028/NIST.SP.800-119), compliance shall be included in all IT infrastructures, application designs, application development, operational systems and sub-systems, and their integration. In addition to the above requirements, all devices, applications, and systems shall support all applicable functionality on native IPv6-Only as well as dual stack (IPv6 / IPv4) connectivity without additional memory or other resources being provided by the Government, so that they can function in a mixed environment. All public/external facing servers and services (e.g., web, email, DNS, ISP services, etc.) shall support native IPv6-Only and dual stack (IPv6 / IPv4) users and all internal infrastructure and applications shall support using native IPv6-Only and dual stack (IPv6 / IPv4) for all functionality and operations.

TRUSTED INTERNET CONNECTION (TIC)

The Contractor solution shall meet the requirements outlined in Office of Management and Budget Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative“ (https://www.whitehouse.gov/wp-content/uploads/2019/09/M-19-26.pdf), VA Directive 6513 “Secure External Connections”, and shall comply with the TIC 3.0 Core Guidance Documents, including all Volumes and TIC Use Cases, found at the Cybersecurity & Infrastructure Security Agency (CISA) (https://www.cisa.gov/publication/tic-30-core-guidance-documents).

STANDARD COMPUTER CONFIGURATION

The Contractor IT end user solution that is developed for use on standard VA computers shall be compatible with and be supported on the standard VA operating system, Windows 11, Edge (Chromium based), and 365 Apps for enterprise. Applications delivered to VA and intended to be deployed to Windows 11 workstations shall be delivered as a signed .msi package with switches for silent and unattended installation and updates shall be delivered in signed .msp file formats for easy deployment using Microsoft Endpoint Configuration Manager (CM) VA’s current desktop application deployment tool. Signing of the software code shall be through a vendor provided certificate that is trusted by VA using a code signing authority such as Verizon/Cybertrust or Symantec/VeriSign. The Contractor shall also ensure and certify that their solution functions as expected when used from a standard VA computer, with non-admin, standard user rights that have been configured using the Defense Information Systems Agency (DISA) Secure Technical Implementation Guide (STIG) specific to the particular client operating system being used.

VETERAN FOCUSED INTEGRATION PROCESS (VIP) AND PRODUCT LINE MANAGEMENT (PLM)

The Contractor shall support VA efforts IAW the Veteran-Focused Integration Process (VIP) Guide and Product Line Management (PLM) Playbook. The major focus of VIP is on Enterprise Oversight, Governance, reporting, and establishing practices that focus on outcomes and continuously delivering sustainable IT capabilities to benefit the Veteran. PLM is a framework that focuses on delivering functional products that provide the highest priority work to customers while delivering simplified, reliable, and practical solutions to the business, medical staff, and our Veterans. The VIP Guide is a companion guide to the PLM Transformation Playbook and can be found at: https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371 and the PLM Transformation Playbook can be found at https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946. VIP and PLM are the authoritative processes that IT projects must follow to ensure development and delivery of IT products.

The VIP Guide provides guidance for transitioning from project-centric to product-centric delivery. The VIP guide applies to all OIT Office of Management and Budget (OMB) reportable products that are required to collect and report costs, schedules, risks, and other valuable information in VA PARS (whether products are procured or developed by VA) and any VA Information Technology project effort in Software Product Management (SPM) and Infrastructure Operations (IO), or their successors, that touch the VA network regardless of IT organizational alignment (whether it spends government funding from VA's Congressional IT Appropriation or any other appropriation).

The PLM Transformation Playbook details how OIT leadership expects Product Lines (PLs) to implement PLM, DevOps, and Lean-Agile principles, methods, practices, and techniques through levels of maturity. The PLM Transformation Playbook applies to all Information Technology (IT) products aligned to PLs in the Software Product Management, Infrastructure Operations and Product Engineering organizations within the OIT organization.

Others outside the referenced groups or organizations may…