36C10B26Q0492 RFI VAEC Brokerage Service Amended 6.16.26.pdf

DEPARTMENT OF VETERANS AFFAIRS

Office of Information and Technology (OIT)

Technology Acquisition Center (TAC)

REQUEST FOR INFORMATION (RFI)

VA Enterprise Cloud Brokerage Service

Federal Acquisition Package

RFI Number: 36C10B26Q0492

NAICS Code: 518210 - Computing Infrastructure Providers, Data Processing, Web Hosting, and

Related Services

PSC Code: D399 - IT and Telecom - Other IT and Telecommunications

Set-Aside: Full and Open Competition (Market Research Phase)

Date Issued: June 2, 2026

Response Due: June 29, 2026

DISCLAIMER / NOTICE

This document is issued for information and planning purposes only and does not constitute a solicitation or a commitment by the Government to issue a solicitation or award a contract. The

Department of Veterans Affairs (VA) will not reimburse respondents for any costs associated with the preparation or submission of responses to this Request for Information (RFI). This RFI is issued pursuant to Federal Acquisition Regulation (FAR) 15.201, Exchanges with Industry

Before Receipt of Proposals. The Government reserves the right to cancel this RFI at any time without obligation or notice.

TABLE OF CONTENTS

SECTION 1: STATEMENT OF OBJECTIVES (SOO)

1.1 Purpose

1.2 Background

1.3 Scope

1.4 Objectives

1.5 Explicitly Out of Scope

1.6 Period of Performance

1.7 Place of Performance

1.8 Applicable Standards and Regulations

SECTION 2: PERFORMANCE WORK STATEMENT (PWS)

2.1 General

2.2 Definitions

2.3 Task Areas

Task Area 1: Cloud Brokerage Platform Operations

Task Area 2: Credit Procurement and Financial Management

Task Area 3: Intake-to-Provisioning Automation

Task Area 4: Governance and Compliance

Task Area 5: Security and Risk Management

Task Area 6: Operational Handoff and Transition

2.4 Government-Furnished Property/Information

2.5 Contractor-Furnished Property

2.6 Security Requirements

2.7 Section 508 Compliance

2.8 Deliverables

SECTION 3: QUALITY ASSURANCE SURVEILLANCE PLAN (QASP)

3.1 Purpose

3.2 Performance Standards

3.3 Surveillance Methods

3.4 Procedures

3.5 Remediation Process

SECTION 4: INSTRUCTIONS, CONDITIONS, AND NOTICES TO OFFERORS

4.1 General Instructions

4.2 RFI Response Format

4.3 RFI Response Content Structure

4.4 Submission Instructions

4.5 Points of Contact

4.6 Important Notices

SECTION 5: MARKET RESEARCH QUESTIONS

Category A: Cloud Brokerage Platform Capabilities

Category B: Security and Compliance

Category C: Pricing and Commercial Models

Category D: Transition and Operations

Category E: Innovation and Future State

SECTION 6: ATTACHMENTS AND EXHIBITS

Attachment 6-1: Acronym and Definition List

Attachment 6-2: Service Level Agreement (SLA) Matrix

Attachment 6-3: Labor Category Descriptions

Attachment 6-4: Deliverables Schedule

Attachment 6-5: Government-Furnished Equipment/Information List

Attachment 6-6: Security Requirements Checklist

SECTION 1: STATEMENT OF OBJECTIVES (SOO)

1.1 Purpose

The Department of Veterans Affairs (VA), Office of Information and Technology (OIT), through the

Technology Acquisition Center (TAC), issues this Request for Information (RFI) pursuant to Federal

Acquisition Regulation (FAR) 15.201, Exchanges with Industry Before Receipt of Proposals, to seek industry feedback and capability demonstrations for a Cloud Brokerage Service. The intended

Cloud Brokerage Service shall consolidate, optimize, and govern multi-cloud operations across the

VA Enterprise Cloud (VAEC) environment.

Several ongoing FinOps pilots and governance programs are developing cost‑visibility, optimization, and reporting capabilities. To avoid duplication, this RFI is not seeking solutions that recreate or replace existing FinOps dashboards, cost‑optimization tooling, tagging frameworks, or multi‑cloud visibility services. This RFI is focused specifically on identifying partners who can help streamline and modernize how VA procures, allocates, and charges back CSP credits, consistent with ongoing Infrastructure Operations (IO) FinOps guidance.

This RFI is issued solely for market research and information-gathering purposes. It does not constitute a solicitation, a Request for Proposal (RFP), or a Request for Quotation (RFQ), and it shall not be construed as a commitment by the Government to issue a solicitation or ultimately award a contract. The Government will not reimburse respondents for any costs incurred in preparing or submitting responses to this RFI. Responses will not be evaluated for contract award. Information received may be used to shape requirements for a potential future acquisition.

1.2 Background

The VA Enterprise Cloud (VAEC) serves as the Department's primary cloud computing environment, currently hosting approximately 757 applications across three Federal Risk and

Authorization Management Program (FedRAMP) High-certified Cloud Service Providers (CSPs):

Amazon Web Services (AWS) and Microsoft Azure. The VAEC supports mission-critical operations for the three VA administrations - the Veterans Health Administration (VHA), the Veterans Benefits

Administration (VBA), and the National Cemetery Administration (NCA) - as well as OIT and VA

Central Office (VACO) staff offices.

The Enterprise Cloud Solutions Office (ECSO), operating within OIT, manages the VAEC environment and serves as the central governing body for cloud strategy, operations, and policy enforcement across the Department. ECSO is responsible for ensuring that all cloud-hosted workloads comply with federal security requirements, VA-specific directives, and applicable regulatory standards. While VA faces challenges in Cloud Credit procurement and chargeback consistency, FinOps pilots are actively addressing cost‑management challenges such as optimization, multi‑cloud visibility, and standardized tagging. This RFI limits its scope to procurement and financial‑allocation challenges, not optimization or FinOps tooling duplication.

As the VAEC continues to mature and expand, the VA faces several operational challenges that this acquisition seeks to address:

• Manual Credit Procurement: Cloud credit procurement processes are largely manual, creating delays in provisioning and inefficient use of appropriated funds across fiscal year boundaries for customer chargeback purposes.

• CSP Credit Procurement & Chargeback Complexity: Current processes for purchasing, allocating, and financially reconciling cloud service provider (CSP) credits are inconsistent and labor intensive. This RFI focuses specifically on improving the efficiency, transparency, and automation of how VA buys, allocates, and charges back CSP credits, distinct from other efforts that address cost optimization, tagging, engineering, or FinOps operational capabilities.

• Inconsistent Governance: Governance policies, including tagging standards, naming conventions, access controls, and approved service configurations, are implemented differently across CSP environments, leading to compliance gaps and audit findings.

• Manual Intake and Provisioning Workflows: Cloud resource requests are processed through semi-manual workflows, resulting in extended fulfillment timelines and inconsistent configurations.

• Limited Chargeback Granularity: The current chargeback model lacks the granularity needed to accurately allocate costs to individual programs, offices, and cost centers, limiting financial accountability across VA business lines.

• CSP Expansion Requirements: The VA is exploring expansion to additional FedRAMP

High-authorized CSPs beyond its current AWS and Azure footprint to support workload portability, avoid vendor lock-in, and leverage best-of-breed services, further complicating multi-cloud management.

1.3 Scope

The Cloud Brokerage Service shall provide comprehensive, end-to-end lifecycle management across multiple FedRAMP High-authorized Cloud Service Providers. The scope of services encompasses the following functional areas:

1. Multi-CSP Credit and Commitment Procurement and Management. The Contractor shall procure, allocate, track, and reconcile cloud credits, reservations, and financial commitments across all managed CSP environments on behalf of the VA.

2. Enterprise Discount and Savings Plan Optimization. The Contractor shall continuously analyze consumption patterns and execute strategies leveraging Reserved Instances, Savings Plans, Committed Use Discounts, and Enterprise Discount Programs to maximize cost savings.

3. Financial Management with Chargeback/Showback. The Contractor shall implement granular financial management capabilities, including chargeback and showback reporting to VA business lines, programs, and organizational cost centers with monthly reconciliation.

4. Automated Intake-to-Provisioning Pipeline with Approval Workflows. The Contractor shall provide a self-service intake portal with configurable, multi-tier approval workflows and automated provisioning of approved cloud resources using Infrastructure-as-Code

(IaC) methodologies. The response shall include workflow automations that can be derived from requestor inputs.

5. Cloud Governance and Policy Enforcement. The Contractor shall implement and enforce governance policies encompassing tagging standards, naming conventions, regional restrictions, approved service catalogs, and security guardrails using policy-as-code frameworks across all managed CSP environments.

6. Enhanced Tiered Reporting. The Contractor shall implement a tiered reporting dashboard for Executives, Product Line Management, & Customer Journey management teams to include monitoring of Operational KPIs.

7. Security and Compliance Monitoring. The Contractor shall integrate security and compliance monitoring with VA Security Operations Center (SOC) capabilities, Enterprise

Security Architecture, and Continuous Diagnostics and Mitigation (CDM) programs.

8. Operational Handoff, Transition Management, and Knowledge Transfer. The

Contractor shall execute structured transition-in and transition-out activities, maintain comprehensive operational documentation, and conduct periodic knowledge transfer sessions with VA staff.

9. AI/ML Cost Optimization and Workload Placement Recommendations. The Contractor shall leverage artificial intelligence and machine learning capabilities to provide intelligent cost optimization recommendations, workload placement analysis, and predictive analytics for capacity planning and spend forecasting.

Where Cloud Broker activities intersect with FinOps, the Broker’s role is limited to:

• Providing data inputs necessary for CSP credit procurement decisions

• Supporting RI/SP rate analysis only where it informs procurement strategy

• Executing allocation or chargeback workflows once defined by VA FinOps

1.4 Objectives

The VA seeks to achieve the following specific, measurable objectives through the Cloud Brokerage

Service:

Establish a unified Cloud Brokerage Platform supporting a minimum of two (2) FedRAMP High-authorized CSPs (AWS and Microsoft Azure) with capacity to onboard additional CSPs. The

Contractor shall ensure the platform for AWS and Microsoft Azure is operational within 6 months of contract start and additional CSPs are onboarded and operational within 12 months.

Obj. # Objective Success Metric

O-1 Reduce cloud credit procurement cycle time by forty percent (40%) or greater from current baseline.

Measured quarterly against baseline established during transition-in.

O-2 Achieve ninety-eight percent (98%) or greater chargeback accuracy to VA organizational cost centers.

Monthly reconciliation audit; variance ≤ 2%.

O-3 Automate eighty percent (80%) or greater of standard cloud resource provisioning requests through self-service workflows.

Measured monthly; ratio of automated to total standard requests.

O-4 Maintain continuous Authority to Operate (ATO) compliance across all managed CSP environments.

Zero lapses in ATO status; continuous compliance monitoring dashboard.

O-5 Deliver monthly FinOps dashboards with cost anomaly detection, trend analysis, and optimization recommendations.

Dashboard delivered by the 10th business day of each month; anomaly detection latency ≤ 24 hours.

O-6

Provide real-time reporting dashboards with Customer Journey mapping and integrate with VA’s intake system.

Real-time reporting of current Customer Journey lifecycle with remaining exit criteria

O-7 Provide real-time governance policy enforcement with automated remediation for non-compliant resources.

Policy violation detection ≤ 15 minutes; automated remediation for 90%+ of standard violations.

Obj. # Objective Success Metric

O-8 Enable workload portability assessments and migration planning across CSPs to support strategic workload placement.

Portability assessment reports for 100% of Tier 1 applications within 18 months.

Portability assessment reports for 100% of newly added Tier 1 applications within 12 months.

O-9 Integrate with VA's existing enterprise platforms, including ITSM (ServiceNow), Identity (SailPoint/Okta), and monitoring (Splunk).

Bi-directional integration operational within 6 months of contract start for AWS and Azure and within 12 months of contract start for new CSPs.

O-10 Achieve System and Organization Controls (SOC) 2 Type II and FedRAMP High operational compliance for the Cloud Brokerage Platform itself.

SOC 2 Type II attestation and FedRAMP High authorization maintained throughout period of performance.

O-11 Provide Monthly KPI reporting for Customer Journey analytics.

Report shall include Journey entry and exit criteria for process mapping, FinOps services, project reengagements, and modernization opportunities

O-12 Provide FinOps Backlog Tracking Metrics Monthly reporting for FinOps programming, to include optimizations, rightsizing, unattached resources, & Discount and Savings Optimization efforts.

1.5 Explicitly Out of Scope

The below tasks are ongoing efforts within VA and would not be a desired objective of this effort.

• Introducing new cost-visibility dashboards or multi-cloud reporting functions already under the FinOps program

• Duplicating optimization engines, RI/SP analytics, or savings-plan governance

• Adding policy-as-code or cloud governance layers that overlap with existing VA governance tools

• Re-creating ATO-in-a-box, onboarding accelerators, or architecture templates managed under IO Architecture and Security. These activities are already in execution under FinOps, Governance, or Architecture programs and should not be proposed as Cloud Broker capabilities.

• The Broker shall not create or operate any hosted application facing FinOps dashboards, governance tooling, optimization algorithms, or reporting systems that duplicate current VA

FinOps efforts.

1.6 Period of Performance

The anticipated period of performance for the resulting contract shall be structured as follows:

Period Duration Description

Base Year 12 Months Knowledge transfer, system integration, parallel operations, baseline establishment.

Full transition of AWS and Azure within the first six (6) months Full transition of additional CSPs within twelve (12) months

Option Year 1 12 Months Full operational capability for all task areas.

Option Year 2 12 Months Continued operations with performance-based enhancements.

Option Year 3 12 Months Continued operations with performance-based enhancements.

Option Year 4 12 Months Continued operations with performance-based enhancements.

Option Year 5 12 Months Continued operations with performance-based enhancements.

Transition-Out 6 Months (two 3-month optional Tasks)

Optional Task 1: Knowledge transfer, documentation handoff, 90-day post-transition support.

Optional Task 2: Knowledge transfer, documentation handoff, 90-day post-transition support.

The total potential period of performance, including transition periods, is six (6) years and six (6) months. The Government may exercise option years at its sole discretion in accordance with FAR

52.217-9, Option to Extend the Term of the Contract.

1.7 Place of Performance

Primary Place of Performance: VA Office of Information and Technology, Washington, DC metropolitan area. The Contractor's primary facility supporting this effort must be located within the Continental United States (CONUS).

Remote Work: The primary place of performance is at the Contractor’s facility or remote performance. All remote work locations must meet VA security requirements for handling

Controlled Unclassified Information (CUI) and be within CONUS.

Travel: The Contractor shall anticipate periodic travel to VA facilities nationwide, including but not limited to VA data center locations and regional offices, not to exceed an estimated four (4) trips per year for 2 resources per trip. Travel shall be reimbursed in accordance with the Federal Travel

Regulation (FTR) and requires prior COR approval Travel cost shall be included as a Firm-Fixed

Price amount built into the Contract Line Item price.

1.8 Applicable Standards and Regulations

The Contractor shall comply with the following standards, regulations, directives, and executive orders throughout the period of performance:

Standard / Regulation Description / Applicability

FedRAMP High Baseline All managed CSP environments and the brokerage platform itself shall maintain FedRAMP High authorization.

NIST SP 800-53 Rev. 5 Security and Privacy Controls for Information Systems and Organizations. Applicable control baselines per system categorization.

NIST SP 800-171 Rev. 2 Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations.

VA Directive 6500 VA Information Security Program. Governs all VA information and information systems.

VA Handbook 6500 Risk Management Framework for VA Information Systems.

Defines ATO process and ongoing authorization requirements.

Federal Information Security Modernization Act (FISMA)

Requires federal agencies to implement information security programs. Annual assessment and reporting requirements.

Federal Information Technology Acquisition Reform Act

(FITARA)

CIO authority over IT investments and acquisitions. ECSO governance alignment required.

OMB Circular A-130 Managing Information as a Strategic Resource. Governs federal information resources management.

FAR Part 39 Acquisition of Information Technology. Governs IT procurement policies and procedures.

VAAR Part 839 VA Acquisition Regulation - Acquisition of Information Technology. VA-specific IT procurement requirements.

Section 508, Rehabilitation Act All electronic and information technology deliverables must be accessible to individuals with disabilities.

Executive Order 14028 Improving the Nation's Cybersecurity. Zero trust architecture, software supply chain security, incident reporting requirements.

Standard / Regulation Description / Applicability

NIST SP 800-161 Rev. 1 Cybersecurity Supply Chain Risk Management Practices.

Supply chain risk management program requirements.

CONTROLLED UNCLASSIFIED INFORMATION - FOR OFFICIAL USE ONLY

SECTION 2: PERFORMANCE WORK STATEMENT

(PWS)

2.1 General

This Performance Work Statement (PWS) describes the performance-based requirements for the

VA Enterprise Cloud Brokerage Service as outlined in the Statement of Objectives (SOO), Section 1 of this document. This acquisition is structured as a performance-based acquisition in accordance with FAR Subpart 37.6, Performance-Based Acquisition, and OMB Circular A-76, Performance of

Commercial Activities. The Contractor shall provide all personnel, management, supervision, equipment, tools, materials, and facilities necessary to perform the tasks described herein, except as specified in Section 2.4 (Government-Furnished Property/Information).

The Contractor shall perform all work in accordance with the quality standards defined in the

Quality Assurance Surveillance Plan (QASP), Section 3 of this document. Performance shall be measured against the objectives, standards, and acceptable quality levels defined therein. The

Contractor is expected to exercise professional judgment and apply industry best practices, including FinOps Foundation principles, Cloud Security Alliance (CSA) guidance, and IT

Infrastructure Library (ITIL) frameworks, in the execution of all task areas.

2.2 Definitions

The following terms and definitions apply throughout this document:

Term Definition

Cloud Brokerage Platform

An integrated technology platform that serves as an intermediary between the VA and multiple Cloud Service Providers, providing unified management of procurement, provisioning, governance, financial management, security, and operations across heterogeneous cloud environments.

Cloud Service Provider

(CSP)

A third-party company that provides cloud computing services, including infrastructure, platforms, and software delivered over the internet. In this context, CSPs must hold FedRAMP High authorization.

Chargeback A financial management practice in which actual cloud consumption costs are billed back to the consuming organizational unit, program, or cost center based on measured usage.

Customer Journey

The end‑to‑end path an internal customer follows during the cloud intake process, from initial Intake request submission through assessment, approvals, provisioning, and Deployment. Continuance into Sustainment and Operations Management are NOT within the scope of this PWS.

Showback A financial reporting practice that displays cloud consumption costs attributable to an organizational unit without formal billing, used for awareness and accountability.

FinOps Financial Operations - a collaborative practice combining systems, best practices, and culture to increase an organization's ability to understand and manage cloud costs and make business tradeoffs.

FinOps Capabilities

FinOps Capabilities (Existing VA Program): A set of ongoing VA initiatives that include:

• Multi-cloud cost visibility

• Tagging standards

• Optimization analytics (RI/SP, usage, commitment)

• Spend management policy and dashboards

Authority to Operate

(ATO)

A formal authorization granted by an Authorizing Official that permits a system to operate at an accepted level of risk based on the implementation of an approved set of security and privacy controls.

Continuous ATO (cATO)

An approach to authorization that replaces periodic re-authorization with continuous monitoring, automated evidence collection, and real-time risk assessment to maintain ongoing operational authorization.

Landing Zone A pre-configured, security-hardened cloud environment with baseline networking, identity, security, and governance configurations that serves as the foundation for deploying workloads.

Guardrail An automated policy mechanism that prevents or detects cloud resource configurations that violate organizational standards for security, compliance, cost, or operational best practices.

Intake Request

A formal request submitted by a VA stakeholder for cloud resources, services, or changes, processed through the brokerage platform's intake portal and approval workflow.

Provisioning The process of allocating, configuring, and deploying cloud resources (compute, storage, networking, services) to a requestor's environment using approved templates and automation.

Workload A distinct application, service, or set of computing tasks running on cloud infrastructure that can be identified, managed, and measured as a unit.

Tenant A logical organizational unit within the cloud brokerage platform, typically corresponding to a VA program, administration, or office, with isolated resources, access controls, and cost tracking.

Cost Center A VA organizational or programmatic unit to which cloud costs are allocated for financial tracking, budgeting, and accountability purposes.

Enterprise Discount Program

(EDP)

A negotiated pricing arrangement between an enterprise customer and a CSP that provides volume-based discounts on cloud services in exchange for spend commitments.

Savings Plan A CSP pricing model (e.g., AWS Savings Plans) that offers reduced rates in exchange for a commitment to a consistent amount of usage (measured in $/hour) for a one- or three-year term.

Reserved Instance

A CSP pricing model that provides a significant discount compared to on-demand pricing in exchange for a commitment to use a specific instance type in a specific region for a one- or three-year term.

Spot Instance A CSP pricing model that allows customers to use spare cloud capacity at steep discounts, with the understanding that instances may be reclaimed by the CSP with short notice.

2.3 Task Areas

2.3.1 Task Area 1: Cloud Brokerage Platform Operations

2.3.1.1 Platform Deployment and Configuration

The Contractor shall deploy, configure, and maintain the Cloud Brokerage Platform in a FedRAMP

High-authorized environment. The platform shall provide:

• Multi-tenant architecture with logical isolation between VA organizational units.

• Role-based access control (RBAC) with integration to VA's enterprise identity management systems.

• Comprehensive Application Programming Interface (API) framework for integration with

VA enterprise tools, including ServiceNow, Splunk, SailPoint, and Okta.

• Web-based management console compliant with Section 508 accessibility requirements.

• Automated backup, disaster recovery, and business continuity capabilities with a Recovery

Time Objective (RTO) of four (4) hours and a Recovery Point Objective (RPO) of one (1) hour.

• Release management processes with documented change control, testing, and rollback procedures.

2.3.1.2 Multi-CSP Account and Subscription Management

The Contractor shall manage organizational structures across all supported CSP environments, including but not limited to:

• AWS Organizations - management of organizational units (OUs), accounts, and service control policies (SCPs).

• Azure Management Groups - management of management group hierarchies, subscriptions, and Azure Policy assignments.

• Google Cloud Platform (GCP) Folders - management of organization, folder, and project hierarchies (if applicable).

• Oracle Cloud Infrastructure (OCI) Compartments - management of tenancy structure, compartment hierarchies, and OCI Identity and Access Management (IAM) policy assignments.

• Account lifecycle management including creation, configuration, monitoring, decommissioning, and archive of CSP accounts/subscriptions.

• Consolidated billing management and cost allocation tag propagation across account hierarchies.

2.3.1.3 Service Catalog Management

The Contractor shall develop and maintain an approved service catalog of pre-vetted, FedRAMP

High-compliant cloud services. The service catalog shall include:

• Categorized listing of approved cloud services by CSP, with security classification levels and approved use cases.

• Automated provisioning templates (IaC) for each cataloged service.

• Service descriptions, pricing information, compliance implications, and usage guidelines.

• Monthly review cycle to evaluate new CSP service offerings for inclusion and retire deprecated services.

• Exception request process for services not currently in the approved catalog.

• Maintain Standard Image Baselines with repository management and version controls

2.3.1.4 Platform Availability

The Contractor shall maintain ninety-nine point nine percent (99.9%) platform uptime, calculated monthly, excluding planned maintenance windows. Planned maintenance shall be scheduled during non-peak hours (10:00 PM – 6:00 AM Eastern Time, weekends, and federal holidays) and communicated to stakeholders a minimum of seventy-two (72) hours in advance. Emergency maintenance may be performed with two (2) hours advance notice with VA PM and COR notification.

2.3.2 Task Area 2: Credit Procurement and Financial Management

2.3.2.1 Multi-CSP Credit Procurement

The Contractor shall procure, allocate, and track cloud credits and financial commitments across all managed CSPs on behalf of the VA. Responsibilities include:

• Executing credit purchases and commitment agreements in accordance with VA-approved procurement authorities and appropriation constraints.

• Tracking credit balances, expiration dates, and utilization rates across all CSP accounts.

• Providing advance notification (minimum 60 days) of credit expiration to enable timely action.

• Providing forecast estimation per CSP to include; date of current funds expiration per CSP, a forecasted consumption need per CSP for the next future credit purchase, a forecasted total lifecycle date of projected consumption and date of forecasted expiration per CSP. All forecasts shall provide transparent mathematical logic behind all forecasts.

• Managing credit transfers and reallocations between VA organizational units as directed by the COR.

• Ensuring alignment of credit procurement with federal fiscal year boundaries and appropriation requirements (31 U.S.C. § 1502, Bona Fide Needs Rule).

2.3.2.2 Discount and Savings Optimization

The Contractor shall continuously analyze cloud usage patterns and recommend and/or execute cost optimization strategies, including:

• Reserved Instance (RI) purchasing recommendations and lifecycle management, including modification, exchange, and marketplace resale where applicable.

• Savings Plan coverage analysis and commitment recommendations.

• Committed Use Discount (CUD) strategy for GCP environments.

• Oracle Cloud Infrastructure (OCI) Universal Credits and Annual Flex pricing analysis and commitment management.

• Enterprise Discount Program (EDP) negotiation support and compliance monitoring.

• Right-sizing recommendations for underutilized or idle resources.

• Spot/Preemptible instance strategy for fault-tolerant workloads.

• Monthly savings realization report quantifying actual savings achieved against on-demand baseline pricing.

2.3.2.4 Chargeback and Showback

The Contractor shall implement and operate a granular chargeback and showback system that provides:

• Cost allocation to VA organizational units, programs, projects, and cost centers based on actual consumption.

• Allocation of shared costs (e.g., landing zone infrastructure, shared services, platform fees) using configurable allocation methodologies approved by the COR.

• Monthly chargeback reports delivered by the tenth (10th) business day of each month for the prior month's consumption.

• Self-service showback dashboards accessible to VA cost center managers with real-time or near-real-time data (latency ≤ 24 hours).

• Monthly reconciliation process with documented variance analysis for discrepancies exceeding two percent (2%).

• Integration with VA financial systems for automated chargeback data feeds.

2.3.2.5 Budget Forecasting and Anomaly Detection

The Contractor shall provide AI-driven budget forecasting and automated anomaly detection capabilities, including:

• Monthly and quarterly spend forecasts with configurable confidence intervals, using a minimum of twelve (12) months of historical data.

• Automated anomaly alerts triggered when consumption deviates beyond configurable thresholds. The default threshold shall be fifteen percent (15%) above projected spend, adjustable per product line or products.

• Root cause analysis support for cost anomalies within four (4) business hours of alert generation.

• Annual budget planning support with scenario modeling capabilities (best case, expected, worst case).

• Trending analysis identifying cost drivers, growth trajectories, and optimization opportunities.

2.3.2.6 Invoice Reconciliation

The Contractor shall reconcile CSP invoices against internal consumption tracking on a monthly basis. Responsibilities include:

• Line-item reconciliation of CSP invoices against brokerage platform consumption records.

• Identification, documentation, and resolution of discrepancies within ten (10) business days.

• Maintenance of auditable financial records for a minimum of seven (7) years in compliance with federal records retention requirements.

• Support for audits from Government agencies such as VA Office of Inspector General (OIG) and Government Accountability Office (GAO) audits related to this Contract.

2.3.3 Task Area 3: Provisioning Automation known as the Customer Journey

Management Process

2.3.3.2 Automated Provisioning

The Contractor shall automate provisioning of approved cloud resources using Infrastructure-as-

Code (IaC) templates and methodologies, including:

• Terraform modules for multi-CSP resource provisioning.

• AWS CloudFormation templates for AWS-specific resources.

• Azure Bicep/ARM templates for Azure-specific resources.

• OCI Resource Manager (Terraform-based) stacks for Oracle Cloud Infrastructure-specific resources.

• Version-controlled IaC repositories with code review and approval processes.

• Automated triage to evaluate Provisioning supportability using a structured gate‑check process.

• Automated testing (linting, security scanning, compliance validation) of IaC templates prior to deployment.

• Idempotent, repeatable deployments with documented rollback procedures.

2.3.3.3 Landing Zone Deployment

The Contractor shall deploy and maintain standardized, security-hardened landing zones for each managed CSP environment. Landing zones shall incorporate:

• Network segmentation with micro-segmentation capabilities aligned to VA security architecture.

• Centralized logging and monitoring integration with VA Splunk and Security Operations

Center (SOC).

• Identity federation with VA enterprise Active Directory and identity governance platforms.

• Baseline security controls pre-implemented per NIST SP 800-53 Rev. 5 High baseline.

• Automated compliance scanning and drift detection upon deployment.

• Documented landing zone architecture with regular review and update cycle (minimum quarterly).

• Coordination and approval through a Government-Controlled Change Management Process.

2.3.3.4 Approval Workflow Engine

The Contractor shall configure and operate multi-tier approval workflows with the following capabilities:

• Configurable approval tiers: Technical Review, Security Review, Financial Review, and

Executive Approval.

• Automated routing based on request type, cost threshold, security classification, and organizational unit.

• SLA-based escalation: automatic escalation to next-level approver if approval is not completed within defined SLA (default: 24 business hours per tier).

• Delegation of authority capabilities for approver absences.

• Audit trail of all approval actions with timestamp, approver identity, and decision rationale.

2.3.3.5 Customer Satisfaction & Feedback

The Contractor shall implement a customer satisfaction program that incorporates both human and

AI‑enabled feedback capabilities where possible.

• Conduct customer satisfaction surveys and post‑interaction surveys to measure service quality for the intake through provisioning Customer Journey points.

• Use AI‑assisted analysis (e.g., sentiment analysis, pattern detection, trend identification) to automatically assess feedback and identify recurring issues or improvement opportunities.

• Maintain a closed‑loop feedback process to review results, perform root‑cause analysis on negative trends, and implement corrective actions.

• Report customer satisfaction metrics, AI‑generated insights, and documented improvement actions during monthly and quarterly service reviews.

2.3.3.6 Request Fulfillment SLAs

The Contractor shall fulfill cloud resource requests within the following service level targets:

Request Category

Definition Fulfillment

SLA

AQL

Standard Request

Pre-approved, catalog-based requests requiring no additional security review (e.g., standard VM, storage, database from approved templates).

4 business hours from final approval

95% compliance

Complex Request

Requests requiring custom configuration, security review, or multi-service orchestration.

3 business days from final approval

90% compliance

Emergency Request

Urgent requests approved by COR or designee to support critical mission operations.

2 business hours from final approval

95% compliance

Customer Satisfaction

Metrics that showcase customer satisfaction results at the Customer Journey checkpoints

Monthly & Quarterly

100% Compliance

2.3.4 Task Area 4: Governance and Compliance

2.3.4.1 Policy-as-Code

The Contractor shall implement and enforce governance policies across all managed CSP environments using policy-as-code frameworks, including but not limited to:

• Open Policy Agent (OPA) / Rego for cross-CSP policy evaluation.

• AWS Service Control Policies (SCPs) and AWS Config Rules for AWS environments.

• Azure Policy and Azure Blueprints for Azure environments.

• Sentinel (HashiCorp) for Terraform-integrated policy enforcement.

• OCI Policies and OCI Cloud Guard for Oracle Cloud Infrastructure governance and threat detection.

• Policies shall enforce VA-Approved: tagging standards, naming conventions, allowed regions (US-only for VA data), approved instance types and sizes, required encryption configurations, network access controls, and prohibited service usage.

• All policies shall be version-controlled, peer-reviewed, and tested in non-production environments prior to enforcement.

2.3.4.2 Tagging Enforcement

The Contractor shall enforce a mandatory VA-Approved tagging taxonomy for all cloud resources across all managed CSP environments. The tagging taxonomy shall include, at minimum:

Tag Key Purpose Example Values Required va:cost-center Cost allocation to VA organizational unit

VHA-EHRM, VBA-CLAIMS,

NCA-OPS

Yes va:application-id Application identification and portfolio tracking

APP-00752, APP-01234 Yes va:environment Environment classification production, staging, development, sandbox

Yes va:data-classification

Data sensitivity level CUI, PHI, PII, Public Yes va:owner Resource ownership and accountability team-email or individual-id Yes va:compliance-scope

Applicable compliance framework

FedRAMP-High, HIPAA, PCI Yes va:expiration-date

Resource lifecycle management 2027-03-31 Conditional

The Contractor shall identify non-compliant resources, including: automated tagging of resources with default values where determinable, notification to resource owners for resources missing required tags, and automated quarantine or deletion of untagged resources after a configurable grace period (default: 14 calendar days) with COR approval.

2.3.4.3 Compliance Monitoring

The Contractor shall perform continuous compliance monitoring against NIST SP 800-53 Rev. 5, FedRAMP High Baseline, and VA Directive 6500 controls. Monitoring shall include:

• Automated evidence collection for applicable technical controls with mapping to NIST control families.

• Continuous compliance scoring dashboards accessible to VA security personnel and ECSO leadership.

• Automated generation of Plan of Action and Milestones (POA&M) entries for identified deficiencies.

• Integration with VA's GRC (Governance, Risk, and Compliance) platform for centralized compliance tracking.

• Support for Third-Party Assessment Organization (3PAO) audits, including evidence package preparation and audit facilitation.

2.3.4.4 Drift Detection

The Contractor shall identify infrastructure configuration drift detection and remediation capabilities, including:

• Continuous comparison of deployed resource configurations against approved IaC baselines.

• Automated alerting within fifteen (15) minutes of drift detection for security-relevant configurations.

• Automated remediation (self-healing) for pre-approved drift categories (e.g., security group modifications, encryption settings).

• Semi-automated remediation with human approval for complex drift scenarios.

• Weekly drift summary reports with trend analysis and root cause categorization.

2.3.4.5 Reporting

The Contractor shall generate and deliver VAEC-Approved Governance and Compliance Reports on the following schedule:

• Monthly: Governance compliance reports detailing policy compliance rates, tagging compliance, drift incidents, remediation actions, and exception requests.

• Quarterly: Executive briefings summarizing governance posture, trends, risks, and recommendations for VAEC leadership.

• Annually: Comprehensive governance maturity assessment benchmarked against industry standards (e.g., FinOps Foundation maturity model, CSA Cloud Controls Matrix).

• Ad hoc: Custom reports as requested by the COR or Contracting Officer with a seven (7) business day turnaround.

2.3.5 Task Area 5: Security and Risk Management

2.3.5.1 Security Integration

The Contractor shall integrate the Cloud Brokerage Platform and all managed cloud environments with VA's security operations infrastructure, including:

• Obtain and retain an Authorization To Operate (ATO) - following VA Governance, Risk, and

Compliance (GRC) policies and procedures.

• VA Cybersecurity Operations Center (VA CSOC) - security event forwarding, alert correlation, incident coordination, and forensic support..

• Continuous Diagnostics and Mitigation (CDM) program - asset discovery, vulnerability data, and configuration data feeds.

• VA Enterprise Security Architecture - alignment with zero trust architecture principles per

Executive Order 14028 and OMB Memorandum M-22-09.

• Enterprise SIEM - log aggregation, correlation rules, and alerting for cloud-specific security events.

2.3.5.2 Vulnerability Management

The Contractor shall monitor VA vulnerability scanning results, support Application Owners with remediation tracking, and POA&M management for all brokerage-managed infrastructure.

Responsibilities include:

• Review monthly automated vulnerability scanning of all managed cloud resources using VA-approved scanning tools.

• Support Critical/High/Moderate vulnerability remediation per VA Security Policy.

• Provide POA&M support, tracking, and remediations for all identified vulnerabilities with milestones and responsible parties.

2.3.5.3 Identity and Access Management

The Contractor shall integrate the Cloud Brokerage Platform with the Department of Veterans

Affairs (VA) enterprise Identity and Access Management (IAM) infrastructure to ensure secure, standardized, and compliant access to all brokerage and Cloud Service Provider (CSP) environments. At a minimum, the Contractor shall support the following capabilities:

• Federated Authentication using VA Active Directory through Security Assertion Markup

Language (SAML) 2.0 or OpenID Connect (OIDC) to provide single sign‑on (SSO) and centralized identity validation.

• Integration with Microsoft Entra ID (Azure Active Directory) to support modern authentication using OAuth 2.0 and OIDC, aligned with VA Zero Trust and Conditional

Access requirements.

o Directory synchronization and lifecycle management for user, service, and group objects utilized by the Cloud Brokerage Platform.

o Enforcement of VA‑approved Multi‑Factor Authentication (MFA) policies through

Conditional Access and authentication strength requirements.

o Role‑Based Access Control (RBAC) alignment between Entra ID security groups and platform roles to ensure least‑privilege access.

o Monitoring and logging of identity events through Entra ID Identity Protection, including risk‑based sign‑in detection, anomaly reporting, and integration with VA security operations.

• Integration with SailPoint IdentityNow for identity governance, including automated provisioning/de‑provisioning, access certifications, separation‑of‑duties checks, and role management.

• Integration with Okta for enforcement of Multi‑Factor Authentication (MFA) per VA MFA policy where Okta is designated as the authoritative MFA provider.

• Privileged Access Management (PAM) for administrative access to cloud environments, including just‑in‑time (JIT) access capabilities, session recording, credential vaulting, and audit‑ready reporting.

• Quarterly Access Reviews and re‑certification of all user accounts with access to the Cloud

Brokerage Platform, underlying CSP environments, or related administrative interfaces, in accordance with VA security and governance requirements.

2.3.5.4 Data Protection

The Contractor shall enforce data protection controls across all managed cloud environments, including:

• Encryption at rest using Advanced Encryption Standard (AES)-256 (or equivalent) for all data stored in managed CSP environments, utilizing CSP-managed or customer-managed encryption keys as directed by the COR.

• Encryption in transit using Transport Layer Security (TLS) 1.2 or higher for all data communications.

• Key management using Federal Information Processing Standards (FIPS) 140-2 Level 3 validated Hardware Security Modules (HSMs) or equivalent.

• Data Loss Prevention (DLP) monitoring for sensitive data categories, including Protected

Health Information (PHI), Personally Identifiable Information (PII), and CUI.

• Data residency enforcement ensuring all VA data remains within authorized US geographic regions.

2.3.5.5 Incident Response

The Contractor shall support VA CSOC incident response procedures and maintain the following capabilities:

• Initial Response SLA: The Contractor shall acknowledge, triage, and initiate response within the current VA Policy timeframes.

• Forensic data collection and preservation capabilities, including log retention, memory captures, and disk snapshots per VA forensic procedures.

• Coordination with VA CSOC, US-CERT, and law enforcement as directed by the VA Chief

Information Security Officer (CISO).

• Post-incident root cause analysis and lessons learned reports delivered within five (5) business days of incident closure.

• Annual incident response tabletop exercises with VA security personnel.

• Maintained and tested incident response playbooks specific to cloud security scenarios (e.g., compromised credentials, data exfiltration, cryptomining, unauthorized resource deployment).

2.3.6 Task Area 6: Operational Handoff and Transition

2.3.6.1 Transition-In Plan

The Contractor shall develop and execute a phased transition-in plan over a six (6) month period.

The transition-in plan shall include:

• Phase 1 - Discovery and Planning (Months 1-2): Requirements validation, environment assessment, baseline establishment, integration planning, and transition schedule development.

• Phase 2 - Build and Integrate (Months 2-4): Platform deployment, integration with VA enterprise systems, IaC template development, policy configuration, and user acceptance testing.

• Phase 3 - Pilot and Validate (Months 4-5): Pilot deployment with selected VA applications, parallel operations with existing management processes, performance baselining, and issue resolution.

• Phase 4 - Full Operations (Months 5-6): Complete migration of management functions, decommission of replaced tools/processes, transition to steady-state operations, and formal acceptance by the COR.

2.3.6.2 Operational Documentation

The Contractor shall develop and maintain comprehensive operational documentation, including:

• Standard Operating Procedures (SOPs) for all recurring operational activities.

• Runbooks for incident response, escalation, and emergency procedures.

• Architecture diagrams (logical, physical, network, security) for the brokerage platform and all managed environments.

• Configuration documentation for all platform settings, policies, integrations, and IaC templates.

• All documentation shall be updated within five (5) business days of any operational change and maintained in a VA-accessible repository.

2.3.6.3 Knowledge Transfer

The Contractor shall conduct structured knowledge transfer sessions with VA staff on a quarterly basis. Knowledge transfer shall include:

• Platform administration training for designated VA technical staff.

• FinOps practices and cost management training for VA cost center managers.

• Governance policy management and exception handling training.

• Recorded training sessions with materials maintained in a VA-accessible learning management system.

• Cross-training to ensure VA staff can assume critical functions in the event of contract transition.

2.3.6.4 Transition-Out

The Contractor shall develop and execute a transition-out plan to be initiated no later than six (6) months prior to contract conclusion. The transition-out plan shall ensure:

• Zero data loss during transition of management responsibilities to the successor contractor or Government personnel.

• Complete documentation handoff, including all SOPs, runbooks, architecture diagrams, IaC repositories, policy configurations, and operational records.

• Ninety (90) calendar days of post-transition support, including subject matter expert availability (minimum 20 hours/week) for the successor entity.

• Orderly transfer of all credentials, access rights, and administrative privileges.

• Removal of all Contractor proprietary tools and data from VA environments within thirty

(30) calendar days of contract conclusion.

2.3.6.5 Staffing

The Contractor shall provide qualified personnel in the labor categories described in Attachment J-

3 (Labor Category Descriptions). The Contractor shall:

• Identify Key Personnel (Program Manager, Cloud Solutions Architect, FinOps Lead, Cloud

Security Engineer) who shall not be removed or replaced without prior written COR approval.

• Maintain a maximum fifteen percent (15%) annual turnover rate for Key Personnel positions.

• Provide replacement personnel of equal or greater qualifications within thirty (30) calendar days of any vacancy.

• Ensure all personnel possess required certifications as specified in Attachment J-3 prior to performing work under this contract.

2.4 Government-Furnished Property/Information

The Government shall provide the following property, equipment, and information to support the

Contractor's performance:

GFP # Item Description

GFP-1 VAEC Environment Access

Access to VA Enterprise Cloud environments in AWS and Azure, including management plane access for brokerage operations.

GFP-2 VA Network Connectivity (TIC 3.0)

Trusted Internet Connections (TIC 3.0) compliant network connectivity between Contractor facilities and VA environments.

GFP-3 ServiceNow Instance Access

Access to VA's ServiceNow ITSM instance for integration, ticket management, and workflow configuration.

GFP-4 VA Enterprise Security Tools

Access to VA-licensed security tools including Splunk, vulnerability scanners, and CDM tools as needed for integration.

GFP-5 System Documentation

Relevant system architecture documentation, security plans, ATO packages, and configuration baselines for VAEC environments.

GFP-6 Government Workspace

On-site workspace at VA facilities for Contractor personnel when required for on-site work. Subject to space availability.

GFP-7 VA Active Directory Integration

Integration access to VA Active Directory for federated authentication and…