DRAFT_VA Enterprise Contract Management System_PWS.docx

VA Enterprise Contract Management System (CMS)

VA-26-00066426

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS (VA)

Office of Procurement

VA Enterprise Contract Management System (CMS)

Date: July 16, 2026

VA-26-00066426

PWS Version Number: 1.0

CONTENTS

1.0 BACKGROUND

The Department of Veterans Affairs (VA), Office of Acquisition, Logistics, and Construction strives to provide high quality, effective, and efficient Information Technology (IT) services to those responsible for providing care to the Veterans at the point-of-care as well as throughout all the points of the Veterans’ health care in an effective, timely and compassionate manner. VA depends on Information Technology (IT) systems to meet mission goals.

VA is one of the largest consumers of commercially acquired goods and services in the Federal Government. The VA operates from many locations throughout the United States supporting Veterans and their families. The Office of Procurement under the leadership of the Senior Procurement Executive (SPE) is responsible for Department-wide Acquisition Management and oversight for policy development, workforce development, supply chain management and Acquisition Business Systems management.

The program office, Procurement Systems Management (PSM), is responsible for configuration management, change management, communication management, understanding technical and functional capabilities required by the VA Acquisition Workforce (AWF) and aligning with the VA Strategic Objectives related to modernization and transformation. This work is vital to improving, modernizing, and transforming acquisition management across the enterprise along with intentional timely deployment of emerging technology to integrate enterprise acquisition standards for the four cornerstones:

Acquisition Policy – Builds on federal mandates and regulatory guidance, develops and manages the direction of acquisition policy for the Department. Ensures compliance when making acquisition decisions. Requires the latest technology in acquisition business systems to properly align electronic processes with frequently changing acquisition regulatory and VA internal guidance.

Workforce Development - Builds, enables, and sustains a knowledgeable workforce that can execute on the acquisition business needs of the Department of Veterans Affairs.

Acquisition Business Strategy - Provides support and monitors the performance of VA acquisition activities related to various federal initiatives. Assures the VA business systems include the required technology-based tools and templates required to limit manual processes, reduce non-value-added processes, and drive output that adds value.

Acquisition Systems Capabilities – Manages the collection and exchange of acquisition data using technology to create transparency, accountability, and acquisition lifecycle reform, leading to supportable data-based decisions and improvements in the exchange of information between the government and the public.

The current portfolio of applications, called “eCMS”, are an integration of proprietary Commercial-off-the-Shelf (COTS) products, existing Government off-the-Shelf (GOTS) software, and custom integration and software designed to meet VA specific needs. The system infrastructure is comprised of Microsoft .NET platform, ASP.NET Model-View-Controller (MVC), Core.NET, WebAPI, Web Forms, AngularJS JBoss, Java 2 Platform Enterprise Edition (J2EE), Microsoft SQL Server, and Microsoft Internet Information Server (IIS), access by end-users to a web-based system -- single sign-on via Microsoft Integrated Windows Authentication (IWA). System Architecture is available and formally describes the various components, technologies and interfaces in an organized way that defines structural properties of the applications that make up the systems referred to as the eCMS portfolio.

By adhering to these guidelines and providing the specified support services, the Contractor shall support the program office, PSM, in achieving its objectives of modernizing acquisition management, improving efficiency, and integrating emerging technologies within the VA’s acquisition systems.

This portfolio, its associated applications/components, and applicable system definitions are fully outlined within the below referenced technical attachments.

· PWS Attachment 1 - AV-2_Integrated Dictionary_Baseline 7.pdf

· PWS Attachment 2 - SV-0_Systems Inventory_Baseline 7.pdf

· PWS Attachment 3 - System Design Document (SDD) for external use.docx

2.0 APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. Federal Acquisition Regulation (FAR) and all applicable VA VAAR class deviations, currently through FAC 2026-01 March 13, 2026

2. “Federal Information Security Modernization Act of 2014”

3. Federal Information Processing Standards (FIPS) Publication 140-3, “Security Requirements for Cryptographic Modules”, March 22, 2019

4. FIPS Pub 199. “Standards for Security Categorization of Federal Information and Information Systems,” February 2004

5. FIPS Pub 200, “Minimum Security Requirements for Federal Information and Information Systems,” March 2006

6. FIPS Pub 201-3, “Personal Identity Verification of Federal Employees and Contractors,” January 2022

7. 10 U.S.C. § 2224, "Defense Information Assurance Program", as amended

8. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

9. Public Law 109-461 (P.L. 109-461), Veterans Benefits, Health Care, and Information Technology Act of 2006, as amended, Title IX, Information Security Matters

10. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”, as amended

11. VA Directive 0710, “Personnel Vetting Program,” September 8, 2025, https://www.va.gov/vapubs/index.cfm

12. VA Directive 6102, “Internet/Intranet Services,” August 5, 2019

13. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and Guidelines,” as amended

14. Office of Management and Budget (OMB) Circular A-130, “Managing Federal Information as a Strategic Resource,” July 28, 2016

15. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed Services (CHAMPUS)”, as amended

16. NIST SP 800-66 Rev. 2, “Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule: A Cybersecurity Resource Guide,” February 2024

17. 45 C.F.R Parts 160 and 164, Subparts A and E, the Standards for Privacy of Individually Identifiable Health Information (“Privacy Rule”); and 45 C.F.R. Parts 160 and 164, Subparts A and C, the Security Standard (“Security Rule”); as amended

18. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended

19. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

20. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021 (see VA NOTICE 24-18, dated September 27, 2024, “Update to VA Directive 6500 Cybersecurity Program”, and VA Notice 25-07, dated 3/18/25, “Amending VA Directive 6500 to incorporate M-24-15”)

21. VA Handbook 6500, “Risk Management Framework for VA Information Systems VA Information Security Program,” February 24, 2021 (see VA Notice 25-01, dated October 15, 2024, “Update to VA Handbook 6500 Risk Management Framework for VA Information Systems VA Information Security Program”, and VA Notice 25-06, dated 3/18/25, “Amending VA Directive 6500 to incorporate M-24-15”, VA Notice 25-16, dated September 15, 2025, “Amending VA Handbook 6500 to Replace Enterprise Mission Assurance Support Services Tool With Office of Information Technology Governance Risk Compliance Tool, and VA Notice 25-17, dated September 22, 2025, “Rescission Of Office Of Information Security (OIS) Deputy Assistant Secretary (DAS) Memorandum – Requirements of Proper Plan of Action and Milestones (POA&M) Completion)

22. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI),” June 30, 2023

23. VA Handbook 6500.6, “Contract Security,” March 12, 2010 (see VA Notice 24-12, dated April 22, 2024, “Update to VA Handbook 6500.6, Contract Security, Appendix C VA Information and Information System Security/Privacy Language For Inclusion Into Contracts, As Appropriate”)

24. VA Handbook 6500.8, “Information System Contingency Planning,” March 25, 2025

25. VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018 (see VA NOTICE 25-10, dated June 9, 2025, “Use of Personally Owned Mobile Devices Policy Amendment of Department of Veterans Affairs Handbook 6500.10”, and VA Notice 25-15, dated August 22, 2025, “Update to VA Handbook 6500.10 Mobile Device Security Policy”)

26. VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017

27. OIT Process Asset Library (PAL), OIT Process Asset Library.

28. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

29. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014

30. VA Directive 6510, “VA Identity, Credential and Access Management,” September 3, 2024

31. VA Handbook 6510, “VA Identity, Credential and Access Management,” September 27, 2024

32. VA Directive and Handbook 6513, “Secure External Connections,” October 12, 2017

33. VA Directive 6300, “Records and Information Management,” September 21, 2018

34. VA Handbook, 6300.1, “Records Management Procedures,“ March 24, 2010

35. NIST SP 800-37 Rev 2, “Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy,” December 2018

36. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020)

37. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” September 19, 2025

38. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” September 18, 2025

39. OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005

40. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019

41. OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008

42. Federal Identity, Credential, and Access Management (FICAM) Architecture, June 30, 2023 (FICAM Architecture (idmanagement.gov))

43. NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access,“ June 2018

44. NIST SP 800-63 Rev 4, 800-63A-4, 800-63B-4, 800-63C-4, “Digital Identity Guidelines,” August 1, 2025

45. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014

46. VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

47. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

48. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

49. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

50. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019

51. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008

52. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (P.L. 110–140), December 19, 2007

53. Section 104 of the Energy Policy Act of 2005, (P.L. 109–58), August 8, 2005

54. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 2, 2001

55. Executive Order 14148, “Initial Rescissions of Harmful Executive Orders and Actions,” dated January 20, 2025

56. VA Directive 0057, “VA Environmental Management Program,” October 25, 2022

57. OIS VAIQ #7424808 Memorandum, “Remote Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

58. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

59. “Veteran Focused Integration Process (VIP) Guide 4.0,” March 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

60. VA Memorandum “Proper Use of Email and Other Messaging Services,” January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

61. “Product Line Management Transformation Playbook” version 3.1, August 2023, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

62. NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020

63. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol Version 6 (IPv6),” November 19, 2020

64. Social Security Number (SSN) Fraud Prevention Act of 2017

65. Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23, 2018

66. C.F.R Title 15 Part 7, “Securing the Information and Communications Technology and Services (ICTS) Supply Chain”, as amended

67. Executive Order 14028, “Executive Order on Improving the Nation's Cybersecurity,” May 12, 2021, https://bidenwhitehouse.archives.gov/briefing-room/presidential-actions/2025/01/16/executive-order-on-strengthening-and-promoting-innovation-in-the-nations-cybersecurity/

68. OMB Memorandum M-22-09, “Moving the U.S. Government Toward Zero Trust Cybersecurity Principles”, January 26, 2022, https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf.

69. NIST SP 800-52 Revision 2, “Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations

70. OMB M-26-05, “Adopting a Risk-based Approach to Software and Hardware Security,” January 23, 2026

71. OMB M-21-31, “Improving the Federal Government’s Investigative and Remediation Capabilities Related to Cybersecurity Incidents,” August 27, 2021

72. NIST SP 800-88 Revision 1 “Guidelines for Media Sanitization,” December 2014

73. CISA Binding Operational Directive (BOD) 19-02: “Vulnerability Remediation Requirements of Internet-Accessible Systems,” April 29, 2019, BOD 19-02: Vulnerability Remediation Requirements for Internet-Accessible Systems | CISA

74. CISA BOD 22-01: “Reducing the Significant Risk of Known Exploited Vulnerabilities,” November 3, 2021, BOD 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities | CISA

75. CISA BOD 23-01: Improving Asset Visibility and Vulnerability Detection on Federal Networks.” Cybersecurity & Infrastructure Security Agency (CISA), BOD 23-01: Improving Asset Visibility and Vulnerability Detection on Federal Networks | CISA

76. VA Directive 6550, Pre-Procurement Assessment and Implementation of Medical Devices/Systems, June 03, 2019

77. VA Memorandum, “VA Security Controls,” January 17, 2025, https://www.voa.va.gov/DocumentView.aspx?DocumentID=5010

78. E.O. 13960, “Promoting the Use of Trustworthy Artificial Intelligence in the Federal Government,” December 3, 2020

79. E.O. 14319, “Preventing Woke AI in the Federal Government,” July 23, 2025

80. OMB Memorandum M-25-21, “Accelerating Federal Use of AI through Innovation, Governance, and Public Trust,” April 3, 2025

81. OMB Memorandum M-25-22, “Driving Efficient Acquisition of Artificial Intelligence in Government,” April 3, 2025

82. OMB Memorandum M-26-04, “Increasing Public Trust in Artificial Intelligence (AI) Through Unbiased AI Principles,” December 11, 2025

83. ITIL Framework

84. TOGAF, DoDAF, FEAF Frameworks

85. ISO/IEC/IEEE 29119-3

86. NIST SP 800‑53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020)

3.0 SCOPE OF WORK

The Contractor shall provide a comprehensive Commercial Off-the-Shelf (COTS) CMS and associated services that deliver end-to-end acquisition lifecycle management capabilities for VA. The CMS shall provide a modern, integrated enterprise solution that supports requirements collaboration, acquisition planning, pre-award, award, post-award administration, and contract closeout across VA’s acquisition community.

The solution shall align with all phases of the VA Acquisition Lifecycle Framework (ALF):

· Conceptualization

· Program Definition

· Program Development

· Program Delivery

· Close-out

Figure 1 - Acquisition Lifecycle Framework The Contractor’s solution shall include an enterprise contract writing capability and related functional modules (e.g., lease agreement management, vendor management, order management, COR post-award management, requirements collaboration, ratification management, ordering officer management, contract catalog capabilities, workload management, audit and compliance, reporting and analytics, access control, usability and workflow configuration, and data integrity and compliance) operating within a single, integrated acquisition ecosystem. The Contractor shall provide all services required to plan, configure, integrate, test, deploy, operate, maintain, and enhance the CMS in accordance with VA policy, applicable federal laws and regulations, and VA enterprise IT governance, including program and project management; requirements elicitation and traceability; business process modeling and human-centered design; system architecture and solution design; configuration-first implementation practices with limited, Government-approved customization only where necessary to meet statutory, regulatory, security, or mission-essential operational requirements; interface analysis and development; data management and migration; testing and quality assurance; training and change management; and ongoing operations, maintenance, and user support.

The CMS shall be implemented and sustained as an enterprise cloud-hosted solution within the VA Enterprise Cloud (VAEC) Microsoft Azure Government (MAG) and shall integrate with VA financial, procurement, inventory, identity, and reporting systems, as well as applicable external federal systems, to minimize duplicate data entry and support authoritative data exchange. The Contractor shall ensure that the solution aligns with federal contract writing system guidance, supports applicable federal contract writing standards, and maintains compliance with the AR and subsequent Revolutionary FAR Overhaul (RFO), Veterans Affairs Acquisition Regulation (VAAR), VA Acquisition Manual (VAAM), and other statutory and VA-specific requirements identified in Section 2.0, while remaining aligned with VA’s Software Development Life Cycle (SDLC), Technical Reference Model (TRM), Process Asset Library (PAL), security and privacy requirements, and enterprise governance processes.

The system shall make use of the Azure File Storage repository currently in use by eCMS to house all contract artifacts. In addition, the Contractor shall be responsible for coordination with the program office, PSM, Maintenance & Operations Support team for the installation, maintenance, system administration (SA), monitoring and reporting, detailed system documentation and the continuous security compliance of this requirement in accordance with program.

4.0 PERFORMANCE DETAILS

4.1 PERFORMANCE PERIOD

The Period of Performance (PoP) shall be 12 months from date of award, with four 12-month option periods and optional tasks, to be exercised at the Government’s discretion.

Any work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO). If required, the CO may designate the Contractor to work during holidays and weekends

There are 11 Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, five are set by date:

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

4.2 PLACE OF PERFORMANCE

The primary place of performance shall be Contractor facilities within the Continental United States (CONUS), with periodic on-site support, collaboration sessions, governance meetings, testing support, transition activities, or other Government-directed activities occurring at VA or other Government-designated facilities as required.

4.3 TRAVEL

The Government anticipates travel under this effort to perform the tasks associated with the effort, as well as to attend program-related meetings throughout the PoP. Include all estimated travel costs in your firm-fixed price line items. These costs will not be directly reimbursed by the Government.

5.0 SPECIFIC TASKS AND DELIVERABLES

The Contractor shall follow the Agile methodology as detailed within Section 5.0 and the VA VIP Guide v3.2. They shall utilize User Centered Design (UCD) concepts where practicable to ensure that solutions are user-friendly and meet the needs of the VA's acquisition workforce. The Contractor shall perform the following in the Base Period and, if exercised, each Option Period (except 5.1.8, Kickoff Meeting).

5.1 PROJECT MANAGEMENT

The Contractor shall plan, govern, coordinate, execute, and report on all tasks and activities performed under this PWS. The Contractor shall provide management, ensure compliance, measure performance, and report on all activities.

Project Management for all development and implementation activities shall utilize the Project Management Institute (PMI) standards or equivalent. Annual Software Maintenance and Operations and Maintenance (O&M) support shall be based on the Software Engineering Institute’s (SEI’s) Software Maintenance Maturity Model (SMmm or S3M) or equivalent.

Consequently, the Contractor shall establish milestones for each task against which progress shall be monitored, measured, and evaluated. These milestones must be related to distinct and measurable products with specific outcomes. Each task shall be subdivided into discrete work elements according to a structured top-down approach that emphasizes the relationship of work elements to each other and to the overall task. The discrete work elements shall be the basis for progress reporting and for financial monitoring and control of the project.

Requirements contained within this PWS require coordination with several different resources which may be Government personnel or other Contractors. Services shall be provided through collaboration with all parties. The Contractor quality control and adherence to timelines/milestones shall account for the collaboration required to meet or exceed the stated PWS requirements.

Coordination shall take place in writing through formal processes such as team working agreements, status reports and participation in project meetings and informal processes while working side by side. The Contractor shall be proactive and work collaboratively with all Government personnel and contractors supporting this effort.

Any configuration decisions that affect the Enterprise Configuration discussed in informal processes (examples include working side by side, or in office hours meeting) shall be documented and presented via the formal change control process for approval.

5.1.1 CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor Project Management Plan (CPMP) task involves the management and oversight of all activities performed by Contractor personnel, including sub-Contractors, to satisfy the requirements identified in this PWS. The Contractor shall identify a Program Manager (PM) by name, who shall provide management, direction, administration, quality assurance, and leadership of the execution of this contract. The VA shall retain overall Program Management Responsibility. The Contractor shall operate and coordinate within the Office of Procurement. The Contractor’s Program and Project Managers shall coordinate their efforts with VA Program and Project Managers.

The Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, timeline, and tools to be used in execution of the contract. The CPMP shall be delivered no later than thirty (30) business days after contract award and updated monthly thereafter by the fifth (5) business day of each month throughout the period of performance. The CPMP shall take the form of both a narrative and graphic format that displays the schedule, milestones, risks, and resource support. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS.

The Contractor shall describe in the CPMP the organizational resources, and management controls the Contractor shall employ to meet the support, schedule, quality, and performance requirements defined in this PWS. The Government will use this CPMP to manage, track, and evaluate the Contractor’s performance. The VA PM will approve the Contractor’s baseline CPMP prior to execution. The VA PM will approve any updates to the CPMP that the Contractor prepares.

The initial baseline CPMP shall be concurred upon and updated in accordance with PWS. The Contractor shall update and maintain the VA Program Manager (PM) approved CPMP throughout the PoP.

Deliverable:

A. Contractor Project Management Plan

5.1.2 REPORTING REQUIREMENTS

The Contractor shall ensure that the Government has accurate, timely, and comprehensive reporting which allows for effective Government oversight of all provided services and deliverables. The Government has outlined numerous reports and their required delivery schedules throughout this PWS. The Contractor shall provide recommendations on how reporting can be streamlined, consolidated, or otherwise improved to increase the quality of data provided and the availability of this data in as close to real-time as possible. No recommended changes to reporting shall be implemented without government review of the proposed changes and written authorization the PSM to implement the changes. The system shall support configurable executive dashboards, operational reporting, audit-support reporting, and ad hoc reporting capabilities without requiring custom code development.

The Contractor shall provide the COR with Monthly Progress Reports in electronic form per Government designated format and media. The Progress Report is due by the fifth business day following the end of each bi-weekly period throughout the period of performance. The report shall include detailed instructions/explanations for each required data element, to ensure that data is accurate and consistent. These reports shall reflect data as of the last day of the preceding Biweekly report.

The Biweekly Progress Reports shall cover all work completed during the reporting period and work planned for the subsequent reporting period. The report shall also identify any problems that arose and a description of how the problems were resolved. If problems have not been completely resolved, the Contractor shall provide an explanation including their plan and timeframe for resolving the issue. The report shall also include an itemized list of all Information and Communication Technology (ICT) deliverables and their current Section 508 conformance status. The Contractor shall monitor performance against the CPMP and report any deviations. It is expected that the Contractor shall keep in communication with VA accordingly so that issues that arise are transparent to both parties to prevent escalation of outstanding issues.

Deliverable:

A. Biweekly Progress Report

5.1.3 INTEGRATED MASTER SCHEDULE

The Contractor shall create and maintain an Integrated Master Schedule (IMS) in MS Project format that depicts the full scope of the project and deliverables, timelines showing integration with other systems, and processes to achieve effective and seamless implementation of the required services. The IMS shall include defined activities and all applicable milestones for identifying and documenting discrete events necessary to complete the project. The Contractor shall identify task dependencies, estimate task durations, and assign required resources to each task. Any changes to the project schedule shall be reported per the requirements stated in IAW PWS paragraph 5.1.1.

The IMS shall clearly identify the critical path for the project. The IMS shall be delivered to the government no later than 30 business days after contract award. The Contractor shall obtain the necessary data and update the IMS at minimum on a weekly basis, or more frequently as required, for generating schedule reports that depict planned versus actual program, product/project performance and critical path.

Deliverable:

A. Integrated Master Schedule

5.1.4 RISK MANAGEMENT

The Contractor shall develop a Risk Management Plan (RMP) and supporting tools and make recommendations for improvement based on lessons learned to the Government for approval. The RMP shall be delivered to the Government no later than 30 business DAC and updated at a minimum on a quarterly basis, or more frequently as required. The objectives of the RMP are to identify, address, and mitigate risks before they become threats to success or major sources of rework. The Contractor shall also be responsible for:

· Implementing a structured and systematic approach to recognizing risks

· Analyzing and evaluating risks by identifying the risk sources, impact, and owner, in addition to the probability of the risk occurring

· Identifying, assessing, and presenting a range of risk response options, including mitigation strategies and solutions to the Government

· Soliciting input, comments, and guidance from the Government

· Monitoring and reviewing the implemented risk response options to evaluate whether the risk response achieved the intended result

· Supporting and participating in risk status reviews/Program Level Risk Management Board as directed by the Contracting Officer Representative (COR)

· Provide information, recommendations, and support to the Program Level Risk Process

Deliverable:

A. Risk Management Plan

5.1.5 KEY PERSONNEL AND STAFFING

Key personnel are those deemed essential for successful Contractor accomplishment of the work to be performed. The Contractor shall provide key personnel at a minimum that includes Program Manager, Technical/Solutions Architect and Database Administrator. Each key person must have demonstrated experience relevant to their role, federal acquisition system modernization, and successful delivery of large-scale enterprise solutions in a government environment. If required, the Contractor must provide a narrative explaining the work distribution if one person is fulfilling multiple responsibilities. All personnel shall hold the appropriate security clearance as determined by the level of access, and determined by the COR. All background checks and security clearances shall be processed in accordance with this section. The Contractor shall provide a description of the duties of key personnel to be assigned to this task. The Contractor shall submit a resume for each key person. Contractor employee résumés shall reflect the minimum required qualifications or certifications.

The following positions shall be key positions under the contract/task order and shall be 100% dedicated to this effort:

Program Manager:

The Contractor Program Manager shall be responsible for managing the overall performance, quality, schedule, and cost of the contract. The Program Manager shall have successful experience in implementing a large, complex acquisition management cloud-based solution for a Cabinet Level Agency. The Program Manager shall have extensive experience in project management methodologies. The Program Manager shall have extensive experience including acquisition, finance, and IT. The Program Manager shall have at minimum:

· Active Project Management Professional (PMP) Certification

· 15 years of progressive experience in fields related to acquisition, finance, and information technology, with increasing responsibility.

· Proven experience managing programs at VA, or at an agency with similar size and operational complexity.

· Extensive knowledge of federal acquisition regulations and business processes relevant to government contracting.

· Demonstrated expertise in business transformation and program integration for large scale IT modernization efforts.

Technical/Solutions Architect:

The Contractor technical solutions architect shall be responsible for the overall design, integration, and technical integrity of the VA Contract Management System modernization initiative. This Subject Matter Expert (SME) acts as the bridge between business needs and technology solutions, ensuring the delivered system is robust, scalable, secure, and aligned with VA’s enterprise goals. The Contractor shall manage all system integrations, interfaces, and API strategies, including data exchanges with internal and external entities ensuring technical risks are identified and addressed. They shall provide technical oversight throughout the program lifecycle, ensuring quality and alignment with VA standards. The architect shall have at minimum:

· Extensive hands-on experience designing and implementing large-scale, cloud-based acquisition or contract management systems for federal agencies, preferably at cabinet or enterprise scale.

· Deep knowledge of cloud platforms, enterprise integration, security compliance, and IT performance management in federal environments.

· History of successful delivery of enterprise IT modernization projects that involved complex data migration and legacy system integration.

· Proficiency in architectural frameworks, standards, and methodologies (e.g., TOGAF, ITIL, agile, API management, DevSecOps).

Database Administrator (DBA):

The Contractor Database Administrator (DBA) shall be responsible for the administration, security, performance, availability, and lifecycle management of the databases supporting the VA Contract Management System (CMS). The DBA shall support database design, migration, configuration, monitoring, performance tuning, backup and recovery, disaster recovery, and implementation of database changes supporting system releases and system integrations. The DBA shall coordinate with the Contractor’s technical team to support database availability, data integrity, and database changes required for implementation and operations. The DBA shall have at minimum:

· Bachelor’s degree in Computer Science, Information Technology, or a related technical discipline.

· Five years of experience administering enterprise relational database platforms supporting mission-critical business applications.

· Demonstrated experience designing, implementing, administering, and maintaining enterprise database solutions in cloud-hosted or enterprise environments.

· Demonstrated experience supporting database security, access controls, backup, performance monitoring, troubleshooting, and disaster recovery.

· Demonstrated experience supporting database migration, data validation, and enterprise system integrations for large-scale IT modernization efforts.

· Demonstrated proficiency with Structured Query Language (SQL) and database performance tuning.

· Demonstrated experience supporting data integrity, availability, and recovery for enterprise applications.

During the first 90 calendar days of performance, the Contractor shall not replace or substitute Key Personnel who the Contractor proposed pre-award unless the replacement is necessitated by illness, death, or termination of employment. The Contractor shall notify the Contracting Officer within 15 calendar days after the occurrence of any of these events and provide a detailed explanation of the circumstances necessitating the proposed substitution and shall demonstrate that the proposed replacement personnel are of at least substantially equal ability and qualifications as the individual originally proposed for that position. The proposed replacement personnel shall be approved by the CO or COR prior to final determination.

After the initial 90 calendar days, any personnel the Contractor offers as substitutes for the above identified key personnel positions shall have the ability and qualifications equal to or better than the key personnel which are being replaced and shall meet or exceed the qualifications designated for that Key Personnel position. If any change to a key personnel position becomes necessary, the Contractor shall immediately notify the VA PM and COR in writing, but whenever possible Contractor shall notify the VA PM of substitutions in personnel in writing 30 calendar days prior to making any change in key personnel, and provide a detailed explanation of the circumstances necessitating the proposed substitution and shall demonstrate that the proposed replacement personnel are of at least substantially equal ability and qualifications as the individual originally proposed for that position and that the proposed replacement meets or exceeds the qualifications designated for that Key Personnel position.

The Contractor shall mitigate the consequences of the loss of Key Personnel and shall promptly secure any necessary replacements in accordance with this PWS section. Failure to replace a Key Personnel pursuant to this clause and without a break in performance of the labor category at issue shall be considered a condition endangering contract performance and may provide grounds for default termination.

5.1.6 STAFFING PLAN

The Contractor shall deliver a Staffing/Resource Plan to the Government for approval at the kickoff meeting. The Staffing/Resource Plan shall include an analysis of current and projected resource needs to meet the system requirements for performance, product quality, and security. The Contractor shall identify any known technology resource requirements and provide the materials that are needed to support the task order. The Contractor shall identify, secure, and utilize staff with optimal skill sets, that are required to support the complete acquisition management ecosystem. This includes the contract writing system, the acquisition service bus (ASB), and any other interfacing systems. The Staffing/Resource Plan shall include an analysis of current and projected resource needs to meet the system requirements for performance, product quality, and security.

Deliverable:

A. Staffing/Resource Plan

5.1.7 QUALITY ASSURANCE AND QUALITY CONTROL

The Contractor shall ensure that all application software and associated materials meet accepted industry standards, best practices for quality, and Federal Acquisition Regulations requirements. The Contractor shall ensure adherence to the performance measures specified in the Performance Requirements Summary (PRS) defined in the Quality Assurance and Surveillance Plan (QASP). The Government will use this QASP to measure Contractor performance against the metrics defined in this PWS.

Consistent with Quality Assurance and Quality Control (QA/QC) plan, the QA/QC program shall include management and technical reviews and audits to validate the quality of the work performed by the Contractor's personnel and of the work performed by its sub-contractors. Management and technical reviews and audits will be performed by personnel/sub-contractors who are not directly responsible for the work performed.

The Contractor shall maintain records documenting all corrective actions and process improvements undertaken during contract performance. The records shall validate the Contractor's compliance with the processes contained in the QA/QC plan. The QA/QC shall be provided to the government no later than thirty (30) business DAC and updated as required to reflect changing requirements and performance standards. The Contractor shall make the records available to the Government during contract performance.

The Government has the right to perform periodic surveillance of the Contractor to assure that the Contractor's work products and QA processes are in compliance with the contract requirements, including performing root cause analysis on specific problems and/or issues.

Deliverable:

A. QA/QC Plan

5.1.8 KICKOFF MEETING

The Contractor shall conduct a Kickoff meeting within five calendar days after award to introduce the Government team, including but not limited to the COR and CO, to the Contractor’s Project Leadership Team and present the Contractor’s overall operating plans and approach for this effort. At the meeting, the Contractor shall present a Staffing and Quality Plan, CPMP outline, and high-level schedule. Three (3) days prior to the Kick-off Meeting, the Contractor shall submit to the government an agenda, location, and virtual option of the meeting for COR approval. The Contractor’s Staffing Plan and milestones shall address all aspects of onboarding personnel required to access VA information or networks. The Contractor shall provide the meeting minutes two days after the Kick-off Meeting.

During the kickoff-meeting, the Contractor shall present, via Microsoft Office PowerPoint, the following:

· A high-level management intended approach that addresses the scope, resources, project assumptions, constraints, task objectives, key milestones, Contractor’s project organization and Contract administration, delivery schedule, and deliverables.

· A high-level work plan for all activities that addresses on and off-site personnel support expected by month.

· Contractor’s high-level approach, schedule, and methodology to implementing planned software upgrades for the duration of the period of performance.

· Contractor’s high-level approach and methodology to address risks, security, staffing/ resource issues including any sub-contractors.

· Contractor’s high-level operating plan and approach, containing methodology to address risks, security, staffing/ resource issues including any sub-contractors.

· Identification of Key Personnel as well as a Responsible, Accountable, Consulted, and Informed (RACI), and discuss Staffing/Resource Planning.

· Contractor’s high-level approach and methodology to identify and address changes to include application/software, hosting, upgrades and database communications, and Configuration Management issues.

Deliverables:

A. Kickoff Meeting Agenda B. Kickoff Meeting Minutes C. High-level Operating Plan and Approach

5.2 ACQUISITION LIFECYCLE FUNCTIONALITY

The proposed solution must cover all phases of the acquisition lifecycle and be able to support 20,000 program office users, 6,000 contracting users, 25,000 vendors and 150,000 awarded actions annually and scale as necessary. The Contractor provide CMS

5.2.1 CONTRACT WRITING SYSTEM

The Contractor shall provide an enterprise contract writing capability that supports the complete VA acquisition lifecycle and enables authorized users to perform pre-award, award, post-award, and closeout activities through secure, integrated, configurable, and auditable business processes.

· The Contractor shall configure and maintain contract writing workflows that enable users to create, route, review, approve, publish, award, modify, administer, and close acquisition actions, including solicitations, notices, contracts, orders, modifications, and related lifecycle records.

· The capability shall provide lifecycle continuity by enabling the connection of related acquisition records; management of data values, milestones, line items, funding, documents, clauses, forms, approvals, and comments; and maintenance of a complete electronic history of each action from initiation through closeout.

· The capability shall provide role-based access, configurable approval paths, internal and external review capabilities where applicable, action status tracking, workflow ownership visibility, milestone tracking, routing history, elapsed processing time, pending action visibility, audit trails, and user support features necessary to ensure controlled execution, transparency, accountability, and lifecycle performance visibility across contract writing activities.

· The capability shall support required publication, reporting, and interoperability functions by integrating the contract writing capability with applicable VA and external systems used for procurement reporting, financial processing, vendor-facing publication, records management, and other acquisition lifecycle exchanges.

· The Contractor shall ensure the contract writing capability supports VA operational and compliance needs, including validation of required data, document and file management, construction and specialized acquisition processing, milestone visibility, reporting, and retention of records needed for oversight, administration, and closeout.

See Attachment A, Contract Writing System tab for specific requirements.

5.2.2 LEASE AGREEMENT MANAGEMENT

The Contractor shall provide a lease agreement management capability for real property leases within the CMS that enables authorized users to create, modify, renew, administer, and close out lease agreement actions through secure, integrated, configurable, and auditable workflows that support lease-specific data management, required reviews, document development, and related acquisition business processes.

· The capability shall provide and maintain lease agreement management functions that enable the creation, modification, renewal, and closeout of lease agreement actions, while preserving lifecycle continuity, action status visibility, and complete electronic records for each lease action.

· The capability shall require and manage lease-specific data elements, including property details, lease terms, cost breakdowns, tenant information, and other required lease data fields, using structured data capture and validation rules aligned to applicable federal data requirements and standardized data structures.

· The capability shall provide configurable workflows that route lease agreement actions for required legal…