DRAFT COSE PWS_15 July 2026.docx

Cybersecurity Architecture and Engineering Services

VA-26-00064748

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Office of Information & Technology (OIT) Office of Information Security (OIS) Cybersecurity Operations Systems Engineering (COSE)

Cybersecurity Architecture and Engineering Services

Date: 07/15/2026

VA-26-00064748

PWS Version Number: 1.0

Contents

BACKGROUND

The Department of Veterans Affairs (VA), Office of Information & Technology (OIT), Office of Information Security (OIS) strives to provide high quality, effective, and efficient Information Technology (IT) services to those responsible for providing care to the Veterans at the point-of-care as well as throughout all the points of the Veterans’ health care in an effective, timely and compassionate manner. VA depends on Information Management/Information Technology (IM/IT) systems to meet mission goals.

Protecting these systems and the sensitive data they contain is critical to executing the VA mission. The OIS ensures these infrastructures are cybersecurity-ready by managing a world-class workforce and modernizing programs to mitigate risks from expanding threats and dynamic technology shifts.

To ensure the resiliency of VA’s cybersecurity infrastructure, OIS established the Cybersecurity Operations Systems Engineering (COSE) program. COSE serves as an overarching technical engine that unifies Architecture and Engineering Services throughout the VA Enterprise. This program implements cohesive organizational security architecture and underlying engineering components that utilize national security standards, guidelines, and frameworks. COSE bridges the gap between high-level business requirements and technical structures, enabling the consistent deployment of secure technologies through implementation guidance and the establishment of an analytic library.

Systems security engineering within COSE contributes a holistic perspective to the systems engineering effort, ensuring that stakeholder protection needs are addressed throughout the entire system life cycle from concept and development to production, support, and decommissioning. By drawing upon well-established systems engineering and security principles, COSE adapts and supplements practices to protect intellectual property, data, and the methods used to create VA systems. These activities improve the security posture of VA applications to prevent, deter, or detract from cyberattacks by nefarious adversaries or insider threats.

The COSE program is responsive to Presidential Executive Orders, Office of Management and Budget (OMB) mandates, and National Institute of Standards and Technology (NIST) direction, while also addressing VA Office of Inspector General (OIG) findings. The expertise provided through this initiative spans a broad range of emerging technical challenges and modern technological domains to ensure the VA remains ahead of the shifting threat landscape. Through proactive monitoring, adaptive responses, and the creation of standardized artifacts such as reference architectures, design patterns, and hardened configuration guides COSE ensures that Veteran and VA information is not subjected to unacceptable risk. By aligning enterprise requirements to a unified security architecture, COSE empowers the VA to innovate and adapt while maintaining the confidentiality, integrity, and availability of its mission-critical information systems.

· Goal 1. Secure and protect VA and Veteran information

· Goal 2. Protect information systems and assets

· Goal 3. Leverage innovation to strengthen cybersecurity

· Goal 4. Enhance cybersecurity through partnerships and information sharing

· Goal 5. Empower VA mission through cybersecurity risk management

APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. “Federal Information Security Modernization Act of 2014”

2. Federal Information Processing Standards (FIPS) Publication 140-3, “Security Requirements for Cryptographic Modules”, March 22, 2019

3. FIPS Pub 199. “Standards for Security Categorization of Federal Information and Information Systems,” February 2004

4. FIPS Pub 200, “Minimum Security Requirements for Federal Information and Information Systems,” March 2006

5. FIPS Pub 201-3, “Personal Identity Verification of Federal Employees and Contractors,” January 2022

6. 10 U.S.C. § 2224, "Defense Information Assurance Program", as amended

7. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

8. Public Law 109-461 (P.L. 109-461), Veterans Benefits, Health Care, and Information Technology Act of 2006, as amended, Title IX, Information Security Matters

9. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”, as amended

10. VA Directive 0710, “Personnel Vetting Program,” September 8, 2025, https://www.va.gov/vapubs/index.cfm

11. VA Handbook 0710, “Personnel Vetting Program,” September 8, 2025, https://www.va.gov/vapubs/index.cfm

12. VA Directive 6102, “Internet/Intranet Services,” August 5, 2019

13. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and Guidelines,” as amended

14. Office of Management and Budget (OMB) Circular A-130, “Managing Federal Information as a Strategic Resource,” July 28, 2016

15. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed Services (CHAMPUS)”, as amended

16. NIST SP 800-66 Rev. 2, “Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule: A Cybersecurity Resource Guide,” February 2024

17. 45 C.F.R Parts 160 and 164, Subparts A and E, the Standards for Privacy of Individually Identifiable Health Information (“Privacy Rule”); and 45 C.F.R. Parts 160 and 164, Subparts A and C, the Security Standard (“Security Rule”); as amended

18. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended

19. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

20. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021 (see VA NOTICE 24-18, dated September 27, 2024, “Update to VA Directive 6500 Cybersecurity Program”, and VA Notice 25-07, dated 3/18/25, “Amending VA Directive 6500 to incorporate M-24-15”)

21. VA Handbook 6500, “Risk Management Framework for VA Information Systems VA Information Security Program,” February 24, 2021 (see VA Notice 25-01, dated October 15, 2024, “Update to VA Handbook 6500 Risk Management Framework for VA Information Systems VA Information Security Program”, and VA Notice 25-06, dated 3/18/25, “Amending VA Directive 6500 to incorporate M-24-15”, VA Notice 25-16, dated September 15, 2025, “Amending VA Handbook 6500 to Replace Enterprise Mission Assurance Support Services Tool With Office of Information Technology Governance Risk Compliance Tool, and VA Notice 25-17, dated September 22, 2025, “Rescission Of Office Of Information Security (OIS) Deputy Assistant Secretary (DAS) Memorandum – Requirements of Proper Plan of Action and Milestones (POA&M) Completion)

22. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI),” June 30, 2023

23. VA Handbook 6500.6, “Contract Security,” March 12, 2010 (see VA Notice 24-12, dated April 22, 2024, “Update to VA Handbook 6500.6, Contract Security, Appendix C VA Information and Information System Security/Privacy Language For Inclusion Into Contracts, As Appropriate”)

24. VA Handbook 6500.8, “Information System Contingency Planning,” March 25, 2025

25. VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018 (see VA NOTICE 25-10, dated June 9, 2025, “Use of Personally Owned Mobile Devices Policy Amendment of Department of Veterans Affairs Handbook 6500.10”, and VA Notice 25-15, dated August 22, 2025, “Update to VA Handbook 6500.10 Mobile Device Security Policy”)

26. VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017

27. OIT Process Asset Library (PAL), OIT Process Asset Library.

28. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

29. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014

30. VA Directive 6510, “VA Identity, Credential and Access Management,” September 3, 2024

31. VA Handbook 6510, “VA Identity, Credential and Access Management,” September 27, 2024

32. VA Directive and Handbook 6513, “Secure External Connections,” October 12, 2017

33. VA Directive 6300, “Records and Information Management,” September 21, 2018

34. VA Handbook, 6300.1, “Records Management Procedures,“ March 24, 2010

35. NIST SP 800-37 Rev 2, “Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy,” December 2018

36. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020)

37. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015

38. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” March 24, 2014

39. OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005

40. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019

41. OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008

42. Federal Identity, Credential, and Access Management (FICAM) Architecture, June 30, 2023 (FICAM Architecture (idmanagement.gov))

43. NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access,“ June 2018

44. NIST SP 800-63 Rev 4, 800-63A-4, 800-63B-4, 800-63C-4, “Digital Identity Guidelines,” August 1, 2025

45. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014

46. VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

47. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

48. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

49. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

50. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019

51. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008

52. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (P.L. 110–140), December 19, 2007

53. Section 104 of the Energy Policy Act of 2005, (P.L. 109–58), August 8, 2005

54. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 2, 2001

55. Executive Order 14148, “Initial Rescissions of Harmful Executive Orders and Actions,” dated January 20, 2025

56. VA Directive 0057, “VA Environmental Management Program,” October 25, 2022

57. OIS VAIQ #7424808 Memorandum, “Remote Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

58. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

59. “Veteran Focused Integration Process (VIP) Guide 4.0,” March 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

60. VA Memorandum “Proper Use of Email and Other Messaging Services,” January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

61. “Product Line Management Transformation Playbook” version 3.1, August 2023, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

62. NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020

63. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol Version 6 (IPv6),” November 19, 2020

64. Social Security Number (SSN) Fraud Prevention Act of 2017

65. Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23, 2018

66. C.F.R Title 15 Part 7, “Securing the Information and Communications Technology and Services (ICTS) Supply Chain”, as amended

67. Executive Order 14028, “Executive Order on Improving the Nation's Cybersecurity,” May 12, 2021, https://bidenwhitehouse.archives.gov/briefing-room/presidential-actions/2025/01/16/executive-order-on-strengthening-and-promoting-innovation-in-the-nations-cybersecurity/

68. OMB Memorandum M-22-09, “Moving the U.S. Government Toward Zero Trust Cybersecurity Principles”, January 26, 2022, https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf.

69. NIST SP 800-52 Revision 2, “Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations

70. OMB M-26-05, “Adopting a Risk-based Approach to Software and Hardware Security,” January 23, 2026

71. OMB M-21-31, “Improving the Federal Government’s Investigative and Remediation Capabilities Related to Cybersecurity Incidents,” August 27, 2021

72. NIST SP 800-88 Revision 1 “Guidelines for Media Sanitization,” December 2014

73. CISA Binding Operational Directive (BOD) 19-02: “Vulnerability Remediation Requirements of Internet-Accessible Systems,” April 29, 2019, BOD 19-02: Vulnerability Remediation Requirements for Internet-Accessible Systems | CISA

74. CISA BOD 22-01: “Reducing the Significant Risk of Known Exploited Vulnerabilities,” November 3, 2021, BOD 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities | CISA

75. CISA BOD 23-01: Improving Asset Visibility and Vulnerability Detection on Federal Networks.” Cybersecurity & Infrastructure Security Agency (CISA), BOD 23-01: Improving Asset Visibility and Vulnerability Detection on Federal Networks | CISA

76. VA Directive 6550, Pre-Procurement Assessment and Implementation of Medical Devices/Systems, June 03, 2019

77. VA Memorandum, “VA Security Controls,” January 17, 2025, https://www.voa.va.gov/DocumentView.aspx?DocumentID=5010

78. E.O. 13960, “Promoting the Use of Trustworthy Artificial Intelligence in the Federal Government,” December 3, 2020

79. E.O. 14319, “Preventing Woke AI in the Federal Government,” July 23, 2025

80. OMB Memorandum M-25-21, “Accelerating Federal Use of AI through Innovation, Governance, and Public Trust,” April 3, 2025

81. OMB Memorandum M-25-22, “Driving Efficient Acquisition of Artificial Intelligence in Government,” April 3, 2025

82. OMB Memorandum M-26-04, “Increasing Public Trust in Artificial Intelligence (AI) Through Unbiased AI Principles,” December 11, 2025

SCOPE OF WORK

The Contractor shall support the COSE program, ensuring the end-to-end security lifecycle is integrated across the enterprise. This support includes:

· Cybersecurity Architecture & Strategic Operations: Design and development of security reference architectures, solution architectures, architectural analysis, models, security patterns, and governance frameworks to align COSE initiatives with Federal mandates and VA strategic objectives.

· Security Engineering & Solution Development: Providing specialized expertise to design, build, and operationalize secure technical implementations, ensuring high-fidelity, repeatable security across the VA environment.

· Project, Program, and Service Management: Oversight of technical workstreams to ensure consistent delivery of security outcomes and architectural alignment.

· Research, Risk, and Analytics: Continuous technology scouting and data-driven risk modeling to address the evolving threat landscape and evaluate emerging security tools.

· Security Control Risk Management & Domain Subject Matter Expert (SME) Support: Evaluating control efficacy and managing risk throughout the system development lifecycle using expert engineering and architectural analysis.

PERFORMANCE DETAILS

PERFORMANCE PERIOD

The Period of Performance (PoP) shall consist of a 6-month base period, four 12-month option periods and four optional tasks for a total of 54 months.

Any work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO).

There are 11 Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, five are set by date:

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

PLACE OF PERFORMANCE

Tasks under this Task Order (TO) shall be performed at Contractor facilities, as well as the VA Central Office (VACO) Government facility for meetings and coordination as needed.

The Contractor staff shall be available to coordinate with VA-COSE staff on normal Federal Government workdays and shall be responsive between the core hours of 8:00am and 5:00pm EST.

VA does not anticipate routine on-site performance. However, when required, the Government will provide temporary workspace at VA OIS facilities located at 811 Vermont St., Washington, D.C., for up to ten (10) Contractor personnel. On-site support will be coordinated in advance with the Contracting Officer’s Representative (COR).

TRAVEL

The Government anticipates travel under this effort to perform the tasks associated with the effort, as well as to attend program-related meetings or conferences throughout the PoP.

The total estimated number of trips in support of the program related meetings for this effort is two (2) trips per year for three (3) individuals, estimated at one day in duration. The anticipated location is VACO 811 Vermont St., Washington, D.C.

Travel shall be in accordance with the Federal Travel Regulations and requires advanced concurrence by the COR. Contractor travel within the local commuting area will not be reimbursed.

KEY PERSONNEL

The Contractor shall supply personnel possessing the necessary skills and experience to effectively carry out tasks outlined in the PWS. The Contractor acknowledges that the individuals listed below as Key Personnel are essential to this effort and may not be removed, replaced, or added to the contract without a compelling justification and written notification to the CO.

It is the Contractor's responsibility to ensure that all support personnel and subcontractors have the appropriate educational qualifications, professional experience, security clearance, and access authorization—or an equivalent combination thereof—to fulfill the labor category requirements for the designated PWS tasks. Additionally, the Contractor shall provide personnel proficient in high value asset assessment, risk and vulnerability assessments, cyber hunt operations, incident response, and penetration testing.

Should changes to Key Personnel assigned to the specified labor categories become necessary (including initial staffing, substitutions, or additions), the Contractor must immediately inform the CO, COR, and Program Manager (PM) in writing, providing the resume of any proposed replacement personnel. The proposed individual must satisfy the experience and education criteria established for the relevant Key Personnel position. Substitution or replacement of personnel is generally not anticipated within the first six months following the award date.

The Contractor further agrees to mitigate the impact of losing Key Personnel by promptly securing suitable replacements in accordance with this section of the PWS. Failure to replace Key Personnel pursuant to these requirements, resulting in any interruption in performance for the affected labor category, will be considered a condition jeopardizing contract performance and may constitute grounds for default termination. The labor categories listed in Table 1 below are identified as Key Personnel; each Key Personnel must meet the requirements specified in the corresponding Labor Description column.

Table 1: Key Personnel

· Minimum of 10 years of Information Security Experience of which at least 5 years are of Cybersecurity and Cloud Security experience at a large Government agency similar in size/scope to GSA, IRS, DoD or VA.

· Expertise in project management, security architecture and security engineering with ability to translate customer requirements and relay them to the team.

· Expertise in managing IT and Cloud design, security, development, systems engineering, and implementation efforts.

· Expertise in security solutions in federal and/or commercial industry.

· Expertise with Federal A&A and Authority to Operate (ATO) activities.

· Expertise in cybersecurity architecture and engineering requirements and authorizations (FedRAMP/RMF)

· Expertise in Federal policies, processes, and standards.

Minimum Education Level

· Bachelor’s degree in Business Administration, Business Management, Cybersecurity, Computer Science, Information Systems, Information Assurance, Information Security, Information Resource Management, or related fields.

· Certification in one or more of the following: Project Management Professional (PMP), Information Assurance Technician (IAT) III, Information Assurance Management (IAM) III or Information Assurance System Architects and Engineers (IASAE) III certifications.

· Minimum of 15 years of Enterprise Security Architecture Information Security experience at a large company or Government agency similar in size/scope to GSA, IRS, DoD or VA.

· An additional advanced degree (e.g. Master’s or PhD) in an IT related field may substitute for up to 5 years of the required experience.

· Expertise in project management, security architecture and security engineering with ability to translate customer requirements and relay them to the team.

· Expertise and ability to advance the development of legacy and new health IT digital architectures including cloud, mobile, IoT, APIs, VR/XR, 5G, PQC, DLP, Cryptography, Quantum Computing and Artificial Intelligence (AI) technologies.

· Expertise in risk management.

· Expertise in using Enterprise Architecture (EA) tools.

· Expertise in guiding architecture tool processes and products (e.g. SABSA)

· Expertise in performing analysis and research of complex problems and processes relating to the subject matter.

· Expertise in coordinating with program and project leaders to analyze system architectures during design reviews and throughout the conceptual design lifecycle.

· Expertise in identifying strategies for addressing requirements, risks, and issues, conducting detailed trade-off analysis of requirements against fiscal, schedule, and performance issues.

· Expertise in creating diagrams and documentation with all components that comprise IT systems including network topology.

· Expertise in security frameworks and Federal policies, processes, and standards. (e.g., NIST, FISMA, FedRAMP, CIS Controls, HIPAA).

Minimum Education Level

· Master’s degree in Cybersecurity, Math, Engineering, Computer Science, Information Technology, Information Systems Architecture, Telecommunications Systems Design, Architecture Implementation, Information Systems Integration, Software Development Methodologies, Security Engineering, and Network Systems Communications Management.

· Certification in one or more of the following: PMP, IAT III, IAM III or IASAE III certifications.

· Minimum of 10 years of Information Security Experience of which at least 5 years are of Cybersecurity and Cloud Security experience at a large Government agency similar in size/scope to GSA, IRS, DoD or VA.

· Expertise in cybersecurity architecture and engineering requirements and authorizations (FedRAMP/RMF) into systems and applications.

· Expertise in IT and Cloud security architecture design, security engineering, development, systems engineering, and implementation efforts.

· Expertise in Cloud solutions in federal and/or commercial industry.

· Expertise with Federal A&A and ATO activities.

· Expertise with security compliance requirements and regulatory standards (e.g., NIST, FISMA, FedRAMP, CIS Controls, HIPAA).

Minimum Education Level

· Bachelor’s degree in Business Administration, Business Management, Cybersecurity, Computer Science, Information Systems, Information Assurance, Information Security, Information Resource Management, or related fields.

· Certification in one or more of the following: IAT III, IAM III or IASAE III certifications.

· Minimum of 7 years of Information Security Experience of which at least 5 years are of risk and compliance experience at a large company or Government agency similar in size/scope to GSA, IRS, DoD or VA.

· An advanced degree (e.g. Master’s or PhD) in related field may substitute for up to 2 years of the required experience.

· Expertise in risk management, compliance, audit, or related roles within an organization.

· Expertise conducting internal and external audits to assess compliance with regulatory requirements and organizational policies.

· Expertise developing and implementing risk management programs, including risk assessments, risk mitigation strategies, and continuous monitoring.

· Expertise policy development, documentation, and enforcement.

· Expertise handling and reporting compliance issues and coordinating with regulatory bodies.

Minimum Education Level

· Bachelor’s degree in Business Administration, Business Management, Cybersecurity, Computer Science, Information Systems, Information Assurance, Information Security, Information Resource Management, or related fields.

· Minimum of 10 years of DevSecOps experience of which at least 5 years are of Cybersecurity and Cloud Security experience at a large Government agency similar in size/scope to GSA, IRS, DoD or VA.

· Expertise in DevSecOps or related fields, including experience with CI/CD pipelines, containerization, and cloud-native environments.

· Expertise in software development and familiarity with development practices, code repositories (e.g., Git), and version control.

· Expertise in cybersecurity roles that include performing security assessments, vulnerability management, and incident response.

· Expertise in integrating security tools into DevOps pipelines and automating security testing and compliance.

Minimum Education Level

· Bachelor’s degree in Business Administration, Business Management, Cybersecurity, Computer Science, Information Systems, Information Assurance, Information Security, Information Resource Management, or related fields.

· Minimum of 10 years of experience in relevant fields including IT security, data science, or software engineering, of which at least 5 years involve the design, development, or deployment of AI or machine learning systems in enterprise or Government environments A PhD in a related field (IT security, data science, or software engineering) may substitute for up to 5 years of the required experience

· Expertise working on data science, machine learning, or AI projects, either through internships, research projects, or professional roles.

· Expertise building, training, and deploying machine learning models and AI systems in a production environment.

· Expertise collaborating with cross-functional teams, including data scientists, software developers, and domain experts.

· Expertise in data collection, cleaning, and analysis techniques to prepare datasets for AI modeling.

· Expertise applying AI solutions to real-world problems in various enterprises and domains such as large corporations and Government agencies similar in size/scope to GSA, IRS, DoD or VA

Minimum Education Level

· Master’s degree in Artificial Intelligence, Business Administration, Business Management, Cybersecurity, Computer Science, Information Systems, Information Assurance, Information Security, Information Resource Management, or related fields.

· Minimum of 5 years IT experience of which at least 3 years are of Configuration Management/Tech Editing experience at a large corporation or Government agency similar in size/scope to GSA, IRS, DoD or VA.

· A Master’s degree in a related IT field (i.e. Cybersecurity, Computer Science, Information Systems, Information Assurance, Information Security, Information Resource Management).may substitute for up to 2 years of the required experience

· Expertise configuration management, change management, or related roles within IT or software development environments.

· Expertise overseeing and maintaining configuration items such as hardware, software, documentation, and other deliverables.

· Expertise with documenting technical processes, system configurations, and change management procedures to ensure an accurate record.

· Expertise with IT service management (ITSM) frameworks and best practices (e.g., ITIL). Proven experience in maintaining a centralized. configuration management database (CMDB).

· Expertise in project management or working in a project-oriented environment, with an understanding of how configuration management fits into the overall project lifecycle within a large corporation and Government agency similar in size/scope to GSA, IRS, DoD or VA.

Minimum Education Level

· Bachelor’s degree or Associates degree in IT related field (i.e. Cybersecurity, Computer Science, Information Systems, Information Assurance, Information Security, Information Resource Management).

· Certification in one or more of the following: IAT III, IAM III or IASAE III certifications.

· Minimum of 10 years IT experience of which at least 5 years are of Quantum Computing and Cryptography experience at a large corporation or Government agency similar in size/scope to GSA, IRS, DoD or VA.

· A Master’s degree in a related IT field may substitute for up to 2 years of the required experience

· Expertise in quantum mechanics, quantum algorithms (e.g., Shor’s algorithm, Grover’s algorithm), and quantum information theory.

· Expertise in quantum programming languages and frameworks such as Qiskit (IBM), Cirq (Google), Quipper, and Microsoft Quantum Development Kit

· Expertise in cryptographic protocols (e.g., RSA, AES) and principles of public-key infrastructure (PKI).

· Expertise in post-quantum cryptography and quantum-resistant algorithms.

· Expertise in existing cryptographic standards and frameworks (e.g., NIST, ISO/IEC 19790).

· Proficiency in programming languages such as Python, C++, and Java for implementing and testing cryptographic algorithms.

· Expertise with classical and quantum simulation tools.

· Expertise working with and advising on quantum-resistant algorithm migration plans and post-quantum cryptography (PQC) implementation strategies. Expertise assessing organizational cryptographic inventory and identifying migration priorities. Expertise collaborating with cross-functional teams to communicate quantum risk to non-technical leadership. Experience providing policy and guidance inputs for cryptographic modernization aligned with NIST PQC standards (FIPS 203, 204, 205).

· Expertise in project management or working in a project-oriented environment, with an understanding of how configuration management fits into the overall project lifecycle within a large corporation and Government agency similar in size/scope to GSA, IRS, DoD or VA.

Minimum Education Level

· Bachelor’s degree in Business Administration, Business Management, Cybersecurity, Computer Science, Information Systems, Information Assurance, Information Security, Information Resource Management, or related fields.

SPECIFIC TASKS AND DELIVERABLES

The Contractor shall perform the following:

PROJECT MANAGEMENT

CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, timeline, and tools to be used in execution of the contract. One initial plan due 30 calendar days after contract award. The Contractor shall update and resubmit the CPMP monthly thereafter throughout the PoP. The CPMP shall be submitted in Microsoft Word and Microsoft Project formats. All updates shall reflect the current approved baseline and incorporate any changes since the prior submission. The CPMP shall take the form of both a narrative and graphic format that displays the schedule, milestones, risks, and resource support. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The CPMP shall also include a work breakdown structure, activity lists and resources, plan and work schedule (dependencies and interdependencies), and project baseline to continuously improve the VA’s cybersecurity posture. The initial baseline CPMP shall be concurred upon and updated in accordance with Section B of the contract/TO. The Contractor shall update and maintain the VA PM approved CPMP throughout the PoP.

Deliverable:

A. Contractor Project Management Plan.

REPORTING REQUIREMENTS

The Contractor shall provide the COR with a Weekly Progress Report (WPR) in electronic form in Microsoft Word and Project formats. The report shall include detailed instructions/explanations for each required data element, to ensure that data is accurate and consistent. The report shall reflect data as of the last day of the preceding week.

The WPR shall cover all work completed during the reporting period and work planned for the subsequent reporting period. The report shall identify any problems that arose, describe how the problems were resolved, and for unresolved problems, provide the Contractor’s plan and timeframe for resolution. The WPR shall also include an itemized list of all Information and Communication Technology (ICT) deliverables and their current Section 508 conformance status. The Contractor shall monitor performance against the CPMP and report any deviations. The Contractor shall maintain regular communication with the VA to ensure issues are transparent to both parties and to prevent escalation of outstanding issues.

The Contractor shall attend a weekly teleconference meeting with the VA OIS/COSE staff to discuss and document any issues, pending deliverables, and other pertinent topics concerning the task areas.

The Project Management Report (PMR) shall be due every Friday throughout the PoP and shall reflect data as of the close of business the preceding Thursday. The PMR shall be submitted in Microsoft Word and Microsoft Project formats. The PMR shall be incorporated into the WPR as an integrated section and shall include: work completed during the reporting period; work planned for the subsequent period; problems identified and resolution status; deviations from the CPMP; an itemized list of all ICT deliverables; details regarding levels of effort, activities and milestones; changes since the last update; and explanations for any changes.

The Contractor shall develop and deliver weekly briefs to leadership, due every Friday throughout the PoP. The briefing package shall include all briefing slides, information papers, and recommendation reports developed for OIS leadership during the reporting week. All products shall be submitted using current OIS-provided templates in Microsoft PowerPoint, Microsoft Word, or both, as appropriate to the product type. The Contractor shall coordinate the resolution of any tasking issued to COSE including gathering data/metrics to support briefings and information papers, create slides/power point presentations, and author recommendation reports. The Government estimates these briefings, papers, presentations and reports to be one to two a week.

Deliverable:

A. Weekly Progress Report to include the Project Management Report B. Leadership Briefing Package

MONTHLY PROGRESS REPORT

The Contractor shall provide the COR with a Monthly Progress Report in electronic form in Microsoft Word and Project formats. The report shall be due by the fifth calendar of each month throughout the PoP and shall reflect data as of the last day of the preceding month.

The Monthly Progress Report shall include detailed instructions/explanations for each required data element, to ensure that data is accurate and consistent and cover all work completed during the reporting period and work planned for the subsequent reporting period. The report shall also include stakeholder inputs for cybersecurity initiatives; emerging threats and suggested areas of innovation; technology scouting and solution discovery activities; briefings and whitepapers produced; problems identified and their resolution; potential risks and suggested mitigations; an itemized list of all Electronic and Information Technology (EIT) deliverables and their Section 508 conformance status; and the status of all reportable Government Furnished Equipment (GFE) as required by PWS Section 6.6.

The Contractor shall monitor performance against the CPMP and report any deviations in the MPR. The Contractor shall maintain regular communication with the VA to ensure issues are transparent to both parties and to prevent escalation of outstanding issues.

The Contractor shall create and maintain a Microsoft SharePoint repository to be provided by OIS to support the data monitoring and management for this program. The repository shall be the main location for program documentation, including copies of deliverables as well as formal and informal work products. The Contractor shall store and manage artifacts produced on behalf of OIS/COSE and shall manage the maintenance and user privileges for the SharePoint site at the direction of the VA PM.

The Contractor shall also schedule and coordinate a weekly virtual status meeting to review the current status of each task, provide recommendations on next steps, and alert VA of any risks, impediments or urgent issues that arise along with suggested mitigation actions. The Contractor shall submit a Weekly Status Quad Chart every Friday throughout the PoP in Microsoft PowerPoint format using the Government-provided template. The quad chart shall address: (1) recent accomplishments; (2) planned activities; (3) a rolling timeline of upcoming milestones and deliverables for the next quarter; and (4) risks and suggested mitigation actions.

Deliverables:

A. Monthly Progress Report B. Weekly Status Quad Chart

TECHNICAL KICKOFF MEETING

A technical kickoff meeting shall be held within 10 days after TO award. The technical kickoff meeting shall be onsite at a VA facility, with the location to be determined by the Government. Some attendees may participate virtually. The Contractor shall coordinate the date, time, and location with the CO (Post-Award Conference Chairperson), VA PM (Co-Chairperson), Contract Specialist (CS), and COR. The Contractor shall provide a draft agenda to the CO and VA PM at least five calendar days prior to the meeting. Upon Government approval of the final agenda, the Contractor shall distribute to all meeting attendees.

During the kickoff-meeting, the Contractor shall present, for Government review and approval, the intended approach, work plan, and project schedule for each effort via a Microsoft Office PowerPoint presentation. At the conclusion of the meeting, the Contractor shall update the presentation with a final slide titled, “Summary Report.” The final presentation shall be submitted in Microsoft PowerPoint format to the CO, CS, COR, and VA PM within three calendar days after the kickoff meeting. The Summary Report shall include notes on all major issues, agreements, and disagreements discussed during the meeting, and shall include the required Post-Award Conference Chairperson attestation statement:

“As the Post-Award Conference Chairperson, I have reviewed the entirety of this presentation and assert that it is an accurate representation and summary of the discussions held during the Technical Kickoff Meeting for the COSE Support effort.”

The Contractor shall also work with the CS and the Government’s designated note taker to prepare one set of meeting minutes. The Contractor shall obtain concurrence from the CS on the content of the meeting minutes prior to distribution. The final meeting minutes shall be distributed to the CO, CS, COR, VA PM, and all attendees within three calendar days after the kickoff meeting.

Deliverables:

A. Summary Report Presentation B. Meeting Minutes

VA TRAINING

The Contractor shall ensure all Contractor personnel engaged on this effort complete VA required and provided training. The current core requirements include VA Privacy and Information Security Awareness Training and Rules of Behavior Status. Role-based specific training of equivalent complexity may also be required. VA has the right to modify the training requirements. Completion of these training requirements are required during the onboarding of personnel and required to begin individual performance.

The Contractor shall submit VA Privacy and Information Security Training Certificates for each Contractor employee in accordance with Appendix C of the VA Handbook 6500.6, “Contract Security”. The training referenced above is required to be renewed annually.

The Contractor shall provide the VA COR with progress and completion status of VA Privacy and Information Security Awareness Training and Rules of Behavior in the form of a Training Status Report. The initial Training Status Report is due five (5) calendar days after contract award. Updated reports shall be submitted within two (2) business days of any change in personnel, training completion status, or certification status throughout the PoP. The Training Status Report shall be submitted in Microsoft Excel format and shall include full name of each Contractor employee engaged on the effort, initial training completion date(s), and next required training date. The training status report and completion certificates shall be maintained by the Contractor in a VA provided central location.

The Contractor shall provide a Quarterly Staff Certification Report that tracks and reports all industry certifications held and obtained by Contractor staff on a quarterly basis. This report is due by the first business day of each quarter throughout the PoP, and within five business days of any new hire onboarding. The report shall be submitted in Microsoft Excel format.

Deliverables:

A. Training Status Report B. Quarterly Staff Certification Report

CONTRACTOR PERSONNEL MANAGEMENT

In support of more efficient onboarding, the Contractor shall provide dedicated support for VA Onboarding/Offboarding Service Portal for all personnel working under this TO. As part of this support, the Contractor shall ensure that all personnel who require privilege level access to network devices, servers, security devices and/ or desktop systems shall possess industry standard knowledge and skill sets specific to the technology to be accessed with the prescribed experience defined in the below sections of the PWS. Where qualifications are not specifically identified, the Contractor shall provide personnel who are adequately qualified to successfully perform the required functions.

The Contractor shall provide a Staffing Plan due three business days after contract award. Updated and resubmitted within one business day of any personnel change throughout the PoP. The Staffing Plan shall include: Labor Category (LCAT); resource function and role; resource name; PWS task section affiliation; experience and certification requirements met; physical location; and onboarding/offboarding status. Unfilled positions shall be identified. The Plan shall be sortable and filterable by all categories.

The Contractor shall maintain a Contractor Staff Roster due three business days after contract award. Updated and resubmitted within one business day of any change in employee status, training completion, background investigation level, personnel additions, or personnel removals throughout the PoP. The Roster shall remain a historical document, and personnel no longer supporting the contract shall be noted in the comments field.

The Staffing Plan and Contractor Staff Roster shall be in Microsoft Excel format and submitted via encrypted email or another FIPS 140-2 (or successor) compliant method.

Deliverables:

A. Staffing Plan B. Contractor Staff Roster

CYBERSECURITY ARCHITECTURE AND ENGINEERING

ENTERPRISE SECURITY ARCHITECTURE AND DESIGN

The Contractor shall provide Enterprise Security Architecture and Design services to ensure VA information systems, technologies, and enterprise platforms are designed and implemented in accordance with cybersecurity best practices, federal security frameworks, Zero Trust principles, and VA enterprise security policies. These services shall guide secure modernization, enable consistent risk-based decision-making, and ensure security is embedded across the technology lifecycle.

SECURITY ARCHITECTURE REVIEWS

The Contractor shall conduct security architecture reviews for new, existing, and modernized systems to validate that proposed or implemented designs adequately address identified threats, vulnerabilities, and regulatory requirements. The Contractor shall provide clear, actionable recommendations to ensure consistent and effective security posture across the enterprise. The Contractor shall perform risk analyses and architecture gap analyses to evaluate compliance with VA and federal security policies, standards, and frameworks. The Contractor shall document all findings and provide mitigation strategies that are technically sound, actionable, and aligned with enterprise risk tolerance. The Contractor shall develop secure solutions by applying Zero Trust principles, defense‑in‑depth strategies, least privilege, and secure‑by‑design methodologies.

SECURE ARCHITECTURE THREAT MODELING

The Contractor shall perform enterprise‑level and system‑specific threat modeling using standardized methodologies, identifying potential attack vectors, threat actors, and architectural security weaknesses in both proposed and existing solutions.

SECURITY STANDARDS AND REQUIREMENTS DEVELOPMENT

The Contractor shall develop, maintain, and enhance enterprise security architecture artifacts, patterns, and reference models that support VA’s strategic, technical, and cybersecurity objectives. The Contractor shall ensure all security architectures are fully aligned with enterprise goals, cybersecurity strategies, modernization initiatives, and technology roadmaps.