P02 MR RFI PWS.docx

Request for Information 36C10B27Q0056

DRAFT

PERFORMANCE WORK STATEMENT

DEPARTMENT OF VETERANS AFFAIRS

Office of Information & Technology Product Delivery Service for

Veterans Health Information Systems and Technology Architecture Blood Establishment Computer Software Operations and Maintenance Support II

Date: October 19, 2026 PWS Version: 1.0

Contents

BACKGROUND

The Department of Veterans Affairs (VA) Office of Information & Technology (OIT) was established to unite a variety of disparate Information Technology systems across its enterprise with a central center of excellence serving all of VA’s administrations and facility. Since 2018, OIT’s central purpose is to provide seamless, unified Veteran experience through the delivery of state-of-the-art technology and to collaborate with business partners to create the best possible digital experience for all Veterans. Within OIT, Product Delivery Service (PDS) was established to standardize product-delivery processes, break down silos, accelerate decision-making, and improve the Veteran experience. In support of VHA, OIT provides the infrastructure, technical services, and operational support necessary to maintain the secure and reliable performance of the VBECS application.

The Veterans Health Information Systems and Technology Architecture (VistA) Blood Establishment Computer Software (VBECS) is a Food and Drug Administration (FDA) 510(k) certified Class II Medical Device developed by the VA Veterans Health Administration to support blood banking and transfusion services across VA healthcare facilities. VBECS enables safe, accurate, and efficient management of blood products, automating key workflows to reduce human error and enhance patient safety. Based on legislative requirements, VBECS assists Electronic Health Record Modernization (EHRM) initiatives with providing blood bank database extracts, and therefore, specialized interface management is essential to ensure ongoing interoperability with VistA and approved third-party applications, including automated laboratory instrument integrations

NOTE: For informational purposes, the current VBECS business requirements comprise approximately 103 Use Cases, 1,109 Business Rules, 50 Maintenance Business Rules,104 Software Design Documents, and 289 individual Hazard Analysis cause IDs, fully traced into the implemented code. There are over 550,000 lines of code in VBECS with another 92,000+ lines of code operation within the database. Additionally, there are over 25,000 lines of code that require support of the custom VBECS Provisioning tool.

The VBECS solution must continuously meet all regulatory requirements, maintaining compliance with agencies such as the FDA, the International Council for Commonality in Blood Bank Automation, and the American Association of Blood Banks (AABB). To ensure the continued effectiveness of VBECS, the system requires ongoing Development and Operations (DevOps) support, including agile software development, comprehensive sustainment services, and proactive management of the application and database servers. Further, VBECS requires robust security measures to protect sensitive patient and operational data in accordance with the VA and federal information security requirements.

APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. 21 CFR Part 11, Electronic Records; Electronic Signatures https://www.ecfr.gov/current/title-21/chapter-I/subchapter-A/part-11.

2. 21 CFR Part 801, Labeling https://www.ecfr.gov/current/title-21/chapter-I/subchapter-H/part-801.

3. 21 CFR Part 803, Medical Device Reporting https://www.ecfr.gov/current/title-21/chapter-I/subchapter-H/part-803.

4. 21 CFR Part 806, Medical Devices; Reports of Corrections and Removals https://www.ecfr.gov/current/title-21/chapter-I/subchapter-H/part-806.

5. 21 CFR Part 807, Establishment Registration and Device Listing for Manufacturers and Initial Importers of Devices https://www.ecfr.gov/current/title-21/chapter-I/subchapter-H/part-807.

6. 21 CFR Part 820, Quality Management System Regulation (effective 2/2/2026) https://www.ecfr.gov/current/title-21/chapter-I/subchapter-H/part-820.

7. 21 CFR Part 830, Unique Device Identification https://www.ecfr.gov/current/title-21/chapter-I/subchapter-H/part-830.

8. 21 CFR Part 864, Hematology and Pathology Devices (864.9165 only) https://www.ecfr.gov/current/title-21/chapter-I/subchapter-H/part-864.

9. International Standards Organization (ISO) 13485, Medical Devices - Quality management systems - Requirements for regulatory purposes https://www.iso.org/standard/59752.html.

10. Historical Blood Bank Migration from VBECS to Millennium Mappings 08/06/2021.

11. VBECS Data Extraction Process for Import into Cerner Millennium.

12. FHCC Blood Bank Checklist.

13. Data Extract for Blood Bank Migration.

14. “Federal Information Security Modernization Act of 2014.”

15. Federal Information Processing Standards (FIPS) Publication 140-3, “Security Requirements for Cryptographic Modules”, March 22, 2019.

16. FIPS Pub 199. “Standards for Security Categorization of Federal Information and Information Systems,” February 2004.

17. FIPS Pub 200, “Minimum Security Requirements for Federal Information and Information Systems,” March 2006.

18. FIPS Pub 201-3, “Personal Identity Verification of Federal Employees and Contractors,” January 2022.

19. 10 U.S.C. § 2224, "Defense Information Assurance Program", as amended.

20. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974.”

21. Public Law 109-461 (P.L. 109-461), Veterans Benefits, Health Care, and Information Technology Act of 2006, as amended, Title IX, Information Security Matters.

22. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”, as amended.

23. VA Directive 6102, “Internet/Intranet Services,” August 5, 2019.

24. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and Guidelines,” as amended.

25. Office of Management and Budget (OMB) Circular A-130, “Managing Federal Information as a Strategic Resource,” July 28, 2016.

26. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed Services (CHAMPUS)”, as amended.

27. NIST SP 800-66 Rev. 2, “Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule: A Cybersecurity Resource Guide,” February 2024.

28. 45 C.F.R Parts 160 and 164, Subparts A and E, the Standards for Privacy of Individually Identifiable Health Information (“Privacy Rule”); and 45 C.F.R. Parts 160 and 164, Subparts A and C, the Security Standard (“Security Rule”); as amended.

29. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended.

30. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004.

31. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021 (see VA NOTICE 24-18, dated September 27, 2024, “Update to VA Directive 6500 Cybersecurity Program”, and VA Notice 25-07, dated 3/18/25, “Amending VA Directive 6500 to incorporate M-24-15”).

32. VA Handbook 6500, “Risk Management Framework for VA Information Systems VA Information Security Program,” February 24, 2021 (see VA Notice 25-01, dated October 15, 2024, “Update to VA Handbook 6500 Risk Management Framework for VA Information Systems VA Information Security Program”, and VA Notice 25-06, dated 3/18/25, “Amending VA Directive 6500 to incorporate M-24-15”, VA Notice 25-16, dated September 15, 2025, “Amending VA Handbook 6500 to Replace Enterprise Mission Assurance Support Services Tool With Office of Information Technology Governance Risk Compliance Tool, and VA Notice 25-17, dated September 22, 2025, “Rescission Of Office Of Information Security (OIS) Deputy Assistant Secretary (DAS) Memorandum – Requirements of Proper Plan of Action and Milestones (POA&M) Completion).

33. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI),” June 30, 2023.

34. VA Handbook 6500.6, “Contract Security,” March 12, 2010 (see VA Notice 24-12, dated April 22, 2024, “Update to VA Handbook 6500.6, Contract Security, Appendix C VA Information and Information System Security/Privacy Language For Inclusion Into Contracts, As Appropriate”).

35. VA Handbook 6500.8, “Information System Contingency Planning,” March 25, 2025.

36. VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018 (see VA NOTICE 25-10, dated June 9, 2025, “Use of Personally Owned Mobile Devices Policy Amendment of Department of Veterans Affairs Handbook 6500.10”, and VA Notice 25-15, dated August 22, 2025, “Update to VA Handbook 6500.10 Mobile Device Security Policy”).

37. VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017.

38. OIT Process Asset Library (PAL), OIT Process Asset Library.

39. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx).

40. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014.

41. VA Directive 6510, “VA Identity, Credential and Access Management,” September 3, 2024.

42. VA Handbook 6510, “VA Identity, Credential and Access Management,” September 27, 2024.

43. VA Directive and Handbook 6513, “Secure External Connections,” October 12, 2017.

44. VA Directive 6300, “Records and Information Management,” September 21, 2018.

45. VA Handbook, 6300.1, “Records Management Procedures,“ March 24, 2010.

46. NIST SP 800-37 Rev 2, “Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy,” December 2018.

47. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020).

48. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015.

49. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” March 24, 2014.

50. OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005.

51. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019.

52. OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008.

53. Federal Identity, Credential, and Access Management (FICAM) Architecture, June 30, 2023 (FICAM Architecture (idmanagement.gov)).

54. NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access,“ June 2018.

55. NIST SP 800-63 Rev 4, 800-63A-4, 800-63B-4, 800-63C-4, “Digital Identity Guidelines,” August 1, 2025.

56. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014

57. VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514).

58. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514).

59. VA Memorandum “Personal Id PIV entity Verification () Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896.

60. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents.

61. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019.

62. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008.

63. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (P.L. 110–140), December 19, 2007.

64. Section 104 of the Energy Policy Act of 2005, (P.L. 109–58), August 8, 2005

65. Executive Order 14148, “Initial Rescissions of Harmful Executive Orders and Actions,” dated January 20, 2025.

66. OIS VAIQ #7424808 Memorandum, “Remote Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

67. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103.

68. “Veteran Focused Integration Process (VIP) Guide 4.0,” March 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371.

69. VA Memorandum “Proper Use of Email and Other Messaging Services,” January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28.

70. “Product Line Management Transformation Playbook” version 3.1, August 2023, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946.

71. NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020.

72. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol Version 6 (IPv6),” November 19, 2020.

73. Social Security Number (SSN) Fraud Prevention Act of 2017..

74. Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23, 2018

75. C.F.R Title 15 Part 7, “Securing the Information and Communications Technology and Services (ICTS) Supply Chain”, as amended.

76. Executive Order 14028, “Executive Order on Improving the Nation's Cybersecurity,” May 12, 2021, https://bidenwhitehouse.archives.gov/briefing-room/presidential-actions/2025/01/16/executive-order-on-strengthening-and-promoting-innovation-in-the-nations-cybersecurity/.

77. OMB Memorandum M-22-09, “Moving the U.S. Government Toward Zero Trust Cybersecurity Principles”, January 26, 2022, https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf.

78. NIST SP 800-52 Revision 2, “Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations.

79. OMB M-26-05, “Adopting a Risk-based Approach to Software and Hardware Security,” January 23, 2026.

80. OMB M-21-31, “Improving the Federal Government’s Investigative and Remediation Capabilities Related to Cybersecurity Incidents,” August 27, 2021.

81. NIST SP 800-88 Revision 1 “Guidelines for Media Sanitization,” December 2014.

82. CISA Binding Operational Directive (BOD) 19-02: “Vulnerability Remediation Requirements of Internet-Accessible Systems,” April 29, 2019, BOD 19-02: Vulnerability Remediation Requirements for Internet-Accessible Systems | CISA.

83. CISA BOD 22-01: “Reducing the Significant Risk of Known Exploited Vulnerabilities,” November 3, 2021, BOD 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities | CISA.

84. CISA BOD 23-01: Improving Asset Visibility and Vulnerability Detection on Federal Networks.” Cybersecurity & Infrastructure Security Agency (CISA), BOD 23-01: Improving Asset Visibility and Vulnerability Detection on Federal Networks | CISA.

85. VA Directive 6550, Pre-Procurement Assessment and Implementation of Medical Devices/Systems, June 03, 2019.

86. VA Memorandum, “VA Security Controls,” January 17, 2025, https://www.voa.va.gov/DocumentView.aspx?DocumentID=5010.

87. E.O. 13960, “Promoting the Use of Trustworthy Artificial Intelligence in the Federal Government,” December 3, 2020.

88. E.O. 14319, “Preventing Woke AI in the Federal Government,” July 23, 2025.

89. OMB Memorandum M-25-21, “Accelerating Federal Use of AI through Innovation, Governance, and Public Trust,” April 3, 2025.

90. OMB Memorandum M-25-22, “Driving Efficient Acquisition of Artificial Intelligence in Government,” April 3, 2025.

91. OMB Memorandum M-26-04, “Increasing Public Trust in Artificial Intelligence (AI) Through Unbiased AI Principles,” December 11, 2025.

92. OMB Memorandum M-26-10, “Reinforcing Transparency, Accountability, and Oversight of Federal Technology”, March 31, 2026.

93. Protected Health Information (PHI) And Business Associate Agreements Management”, September 2, 2014.

SCOPE OF WORK

The Contractor shall ensure that all work performed hereunder directly supports the safe, secure, compliant, and uninterrupted operation of the VBECS medical device within VA’s enterprise infrastructure.

The Contractor shall provide full‑lifecycle sustainment and operational support, and any associated bug/fix development, and regulatory compliance services for the VA’s existing Veterans Health Administration’s VBECS, an FDA‑regulated Class II Medical Device Software product.

The Contractor shall plan, manage, develop bug/fixes, test, deploy, maintain, document, and continuously monitor the VBECS system throughout the DevOps lifecycle. This includes system administration; configuration management; implementation of security controls; execution of system, integration, and regression testing; development of bug/fix patch releases; sustainment of operational environments; support for database extract activities; and timely resolution of ServiceNow (SNOW) incidents and requests.

The Contractor shall maintain all system‑related documentation, ensuring accuracy, traceability, and compliance with FDA Quality System Regulations (21 CFR 820), ISO 13485:2016, and VA cybersecurity and privacy requirements. The Contractor shall support all activities required to maintain the VBECS’s existing Authority to Operate (ATO), including preparation, validation, and submission of documentation within the SNOW Continuous Authorization and Monitoring (CAM) environment, and continuous support for audits, assessments, and security reviews. The Contractor shall maintain all artifacts in an audit‑ready state throughout performance.

The Contractor shall ensure all deliverables adhere to VA policies and federal regulatory requirements.

PERFORMANCE DETAILS

PERFORMANCE PERIOD

The Period of Performance (PoP) shall be 12 months from date of award, with four (4) 12-month option periods and two (2) Optional Tasks.

The PoP for the optional task is as follows:

Optional Task 1performance shall commence upon issuance of the modification exercising the task and shall end with the base or option period in which it was exercised.

Optional Task 2 has a six (6) month PoP.

The total duration of this contract, including the exercise of any options, shall not exceed 60 months.

Any work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO). If required, the CO may designate the Contractor to work during holidays and weekends.

There are 11 Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, five are set by date:

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

PLACE OF PERFORMANCE

During required FDA audit(s) and inspections, internal and external audit tasks under this PWS shall be performed in VA facilities located in Hines Office of Information Field Office, Hines, IL 60141. Audit work may be performed at remote locations with prior concurrence from the Contracting Officer’s Representative (COR).

All other Tasks under this PWS shall be performed at Contractor facilities. The Contractor shall identify the Contractor’s place of performance in their proposal submission.

TRAVEL

The Government anticipates travel under this effort to perform the tasks associated with the effort, as well as to attend program-related meetings or conferences throughout the PoP. The Contractor shall include all travel costs in its firm-fixed price line items. Travel costs will not be directly reimbursed by the Government.

The Government anticipates three trips for four contractor staff, travelling for seven calendar days in support of program related meetings. Anticipated locations include the following:

· Hines, IL, or location mandated by the FDA.

Travel shall be in accordance with the Federal Travel Regulations and requires advanced concurrence by the COR.

CONTRACTOR PERSONNEL

The Contractor shall provide personnel who possess documented experience supporting FDA-regulated medical device software environments. Anticipated resources shall support regulatory, quality, development, cybersecurity, system administration, or project management functions. These assigned personnel shall have a minimum of five (5) years of experience performing duties comparable to those assigned under this Task Order within an FDA-regulated medical device, healthcare technology, laboratory information system, blood bank information system, or similarly regulated environment. All individuals assigned to this project, including Subcontractors, must demonstrate experience in Blood Bank operations and demonstrate experience supporting comparable FDA-regulated blood bank, laboratory, medical device, or healthcare software systems, along with verifiable experience in meeting FDA and ISO 13485:2016 standards. The Contractor shall demonstrate prior experience supporting at least one (1) FDA-regulated medical device software system, healthcare technology system, laboratory information management system, blood bank information system, or comparable regulated software platform within the previous five (5) years. Experience may be demonstrated through contract references, project descriptions, or past performance documentation.

The Contractor is responsible for providing personnel whose education, certifications, training, and professional experience align with the duties assigned under this Task Order and who possess documented experience working within regulated quality-management. The VA will not provide training on FDA or ISO regulations or processes; therefore, Personnel assigned to development, sustainment, cybersecurity, testing, quality management, or operational support functions shall possess prior experience performing similar duties in a production environment before assignment to this Task Order.

Should any assigned personnel be lost, the Contractor must promptly provide FDA and ISO 13485:2016-qualified replacements meeting the experience guidelines above, mitigating any adverse impact in accordance with this PWS. The Contractor retains the right to remove or terminate contract personnel at its discretion but must notify the Government’s COR, Product Manager (PM), and Management Representative (MR) in writing within 24 hours of such action.

All Contractor personnel supporting this requirement must complete the VBECS-specific Quality System training set, as approved under VBECS’ FDA 510(k) clearance, within 20 calendar days from the date of award and before generating, modifying, or approving any VBECS Quality System deliverables.

According to the United States CFR, the required training is based on International Standard ISO 13485:2016, Medical Devices — Quality Management Systems — Requirements for Regulatory Purposes. The ISO 13485.2016 standard establishes the regulatory framework for all Quality System activities under this contract and provides the foundational competencies necessary for personnel to fulfill FDA-regulated responsibilities in accordance with VBECS process controls.

Personnel in roles requiring a Personal Identity Verification (PIV) credential must obtain this credential before completing any mandatory training that requires authenticated access to VA systems. In such cases, the 20-day training requirement may be extended only as necessary to complete PIV issuance, and the Contractor must document and report these instances as controlled exceptions to the COR.

Contractor personnel may perform other assigned tasks related to the VBECS project while completing the required training, provided that no Quality System deliverables are created or approved until all training obligations are fully met.

The Contractor must also demonstrate expertise in preparing and submitting FDA 510(k) applications and in developing and delivering Quality System Management Reviews for submission to top management in accordance with regulatory requirements.

VBECS supports ongoing compliance with all FDA medical device standards and enhances the VA’s ability to deliver high-quality blood products and transfusion services to Veterans. The system adheres to blood bank standards, national accrediting body requirements (including AABB standards referenced in Section 2.0), FDA regulations, and VA policies. The Contractor must ensure full compliance with all applicable FDA Good Manufacturing Practice (GMP) regulations throughout the performance of this effort.

Key positions with requisite experience include:

The Contractor is responsible for identifying which team members need access to the VA network and approved toolset. Once the COR concurs with Contractor access, the Contractor shall work with the COR to ensure that all Contractor personnel complete the applicable VA Talent Management System (TMS) training courses within ten (10) business days.

· TMS ID 10176: VA Privacy and Information Security Awareness and Rules of Behavior

· TMS ID 10204: Privacy and HIPAA Focused Training

· TMS ID 3197: Information Security Role-Based Training for IT Specialists (Web Based Training)

· TMS ID 3867205: Training for Elevated Privileges for System Access (Web Based Training)

· TMS ID 3867207: Information Security Role-Based Training for System Owners (Web Based Training)

· TMS ID 1016925: Information Security Role-Based Training for Software Developers (Web Based Training)

· TMS ID 1357076: Information Security and Privacy Role-Based Training for System Administrators (Web Based Training)

· TMS ID 1357084: Information Security Role-Based Training for Data Managers (Web Based Training)

· TMS ID 1357083: Information Security Role-Based Training for Network Administrators (Web Based Training)

· TMS ID 64899: Information Security Role-Based Training for IT Project Managers (Web Based Training)

SPECIFIC TASKS AND DELIVERABLES

The Contractor shall perform the following:

PROJECT MANAGEMENT (BASE AND OPTION PERIODS)

CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, timeline, and tools to be used in execution of the work herein. The CPMP shall take the form of both a narrative and graphic format that displays the schedule, milestones, risks, and resource support. The CPMP shall include how the Contractor intends to coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within this PWS. The Contractor shall submit the initial, baseline CPMP to the VA PM for Government concurrence. The CPMP shall be updated no less than monthly.

Within CPMP, the Contractor shall describe its management of resources and personnel to accomplish the defined deliverables in this PWS and as outlined in Clause 6.2 of ISO 13485:2016.

The Contractor shall update and maintain the COR approved CPMP throughout the PoP.

Deliverable:

Contractor Project Management Plan.

MONTHLY REPORTING REQUIREMENTS

The Contractor shall provide to the COR the Monthly Progress Reports. The Monthly Progress Reports shall be in electronic form in Microsoft Word or VA approved formats. The initial Monthly Progress report shall be delivered within 20 calendar days of the start of performance and then delivered monthly thereafter. These reports shall reflect data as of the last day of the preceding Month.

The Monthly Progress Reports shall cover all work completed during the reporting period and work planned for the subsequent reporting period. The report shall also identify any problems that arose and a description of how the problems were resolved. If problems have not been completely resolved, the Contractor shall provide an explanation including their plan and timeframe for resolving the issue. The Contractor shall monitor performance against the CPMP and report any deviations. It is expected that the Contractor will keep in communication with VA accordingly so that issues that arise are transparent to both parties.

The report shall include detailed instructions/explanations for each required data element, to ensure that data is accurate and consistent. The following are the data elements for the Monthly Progress Report:

A. All Contract personnel working under this effort, including:

1) Status according to Clause 6.2 of ISO 13485:2016

2) Current Quality Management System that includes: Role, Competency Levels, Training Course, Due Date, Last training date completed, Training Material Location, Verification Completed.

3) VA mandatory training status for each staff member assigned to the contract.

4) Clear identification and verification of at least two staff members being HL-7 Standard Certified (minimum standard version of 2.6).

B. All work accomplished and any deliverables provided during the reporting period.

C. List and status of all Government Furnished Equipment Report.

D. List all VBECS application production releases for the reporting period, including application, system security, system updates, or Quality Management System (QMS) updates.

E. Onboarding Status Report (see section 5.1.6).

Deliverable:

Monthly Progress Reports.

TECHNICAL KICKOFF MEETING (BASE PERIOD ONLY)

The Contractor shall coordinate with the COR and establish a technical kickoff meeting to be held within 14 calendar days after award, via MS Teams or conference call.

During the kickoff-meeting, the Contractor shall present for Government review and approval by the Government, the details of the intended approach, work plan, and project schedule for each effort via a draft of the CPMP. The Contractor shall update the CPMP which shall include notes on any major issues, agreements, or disagreements discussed during the kickoff meeting.

The Contractor shall submit the updated CPMP to the COR for review within three calendar days after the meeting.

Deliverables:

A. Draft CPMP.

B. Updated CPMP.

SOFTWARE SUSTAINMENT SUPPORT (BASE AND OPTION PERIODS)

The Contractor shall meet all regulations, processes, and requirements applicable to the VBECS FDA 510(k)–regulated medical device at the time of award of a contract. The Contractor shall ensure that all assigned personnel possess full, pre‑existing proficiency in the FDA regulatory framework, medical‑device compliance obligations, and all processes necessary to perform the work described herein.

VA will not provide any training, instruction, clarification, or remediation on any aspect of FDA medical‑device compliance, FDA Quality System Regulations, ISO 13485 requirements, or any related regulatory obligations. The project schedule does not support, and the Government will not permit, the training or upskilling of Contractor personnel on tools, regulations, processes, or the pre‑existing VBECS application.

The Contractor shall field only fully qualified personnel and shall not utilize reverse engineering or any similar methodology to reproduce, reconstruct, or derive source code for the purposes of maintenance, enhancement, or sustainment under this effort.

The Contractor shall support all VBECS software which currently is at Version 2.4.1.1A-00-02. In execution of this task, the Contractor shall provide personnel with expert-level knowledge of the VBECS system (as deployed) in the following underlying specific technologies.

NOTE: Expert-level knowledge is defined as a person with sufficient knowledge to utilize, implement, troubleshoot, train, and audit VBECS with a minimum 6 years supporting C# applications in production healthcare environments with the following technologies:

Azure Automation Runbooks

Azure Availability Sets and Load Balancers

Azure Backup Windows Workload (ABWW)

Azure Dev Ops

Azure DevOps CI/CD Pipelines

Azure Monitoring Agent (AMA)

Azure Policy (AP)

Azure Service Tools and Extensions (Log Analytics, Azure Backup, Key Vault, Azure Automation accounts)

C# programming language

Change Tracking (CT)

Continuous Readiness in Information Security Program (CRISP)

Domain Join (DJ)

DSC (Desired State Configuration)

DynaTrace OneApp

HL-7 Version 2.3-2.5

Hybrid Worker Extension (HWE)

Infrastructure as Code (IaC)

Json

Microsoft .Net Framework 4.5 or greater

Microsoft Remote Desktop Services

Microsoft SharePoint 2016 or later and related technologies

Microsoft Structured Query Language (SQL) Server 2016 SP2

Microsoft SQL Server 2022

Microsoft SQL Server Always On

Microsoft Thread Modeler

Powershell

RDS Gateway in Microsoft Azure Government

RedGate

SharePoint tools and web parts including MS Teams

SQL Infrastructure as a Service (IaaS) Agent

SQL Server Reporting Services Enterprise Edition

Toad Data Modeler xUnit, NAnt, NCover, and Nunit

Zebra

The Contractor shall comply with all standards and technical guidelines for programming and software security defined in internal project documents to include the FDA Quality System Regulations, FDA Current Good Manufacturing Practices, Federal Information Security Management Act, Health Insurance Portability and Accountability Act (HIPAA), National Institute of Standards and Technology (NIST). The Contractor shall ensure that all software tools used to support VBECS are VA approved.

The Contractor shall conduct all sustainment, including any development required for sustainment, and operational activities in strict accordance with the VBECS Agile Software Development Standard Operating Procedure (SOP), the VBECS Agile Software Sustainment SOP, and all applicable VA Agile and DevSecOps practices established by the Veterans Health Administration (VHA) and the Veterans Intake Process (VIP). Such activities shall include, but shall not be limited to, iterative software development, backlog refinement, sprint planning and execution, continuous integration and continuous delivery (CI/CD), automated testing, secure coding practices, and continuous system monitoring. The Contractor shall produce and maintain all evidence of compliance as required by the VBECS Agile Software Development and Sustainment Standard Operating Procedures (SOP) and shall make such artifacts available to the Government upon request.

The Contractor shall ensure that each software increment delivered through the Agile release pipeline is free from identified patient‑safety deficiencies. For the purposes of this requirement, a patient‑safety deficiency is defined as any defect that may cause direct or indirect injury to a Veteran patient and that arises within the scope of the project or assigned work.

USE of MICROSOFT AZURE/ JIRA/ GITHUB

The Contractor shall utilize VA’s Microsoft Azure as the enterprise cloud platform to support hosting, infrastructure services, systems integration, and delivery of the VBECS solution. Azure shall provide a secure, scalable, and compliant Infrastructure‑as‑a‑Service (IaaS) environment capable of supporting validated medical device software operations.

The Contractor shall ensure VA’s Microsoft Azure is used to deliver an integrated operational ecosystem that includes compute, storage, networking, and platform services required to sustain end‑to‑end software lifecycle management. This includes support for Azure DevOps pipelines, source control, automated build and deployment processes, Infrastructure‑as‑Code, and Desired State Configuration (DSC) to maintain reproducible, consistent, and fully validated environments.

The Contractor shall maintain regulatory and security compliance, supporting applicable FDA and ISO 13485 requirements in the Azure environment for traceability, change control, auditability, and deployment integrity throughout the system lifecycle. Azure provides VA with a stable and controlled environment enabling automated validation, consistent release workflows, and seamless traceability from requirements through code, build, and deployment.

The Contractor shall utilize Jira and GitHub as enterprise platforms for project and product lifecycle management and for tracking execution activities. The Contractor shall document, maintain, and update the VBECS Customer NSR Backlog, releases, risk/ issues, failover results, security scan remediations and automated test scripts. Specifically, the Contractor shall manage and track the following in Jira and GitHub:

A. Jira:

1. Input and manage project/product risks and issues.

2. Input all current approved National Service Requests (NSR).

3. Input as a task, all VBECS releases that include description and value to veteran, including monthly failover results.

4. Input as a task, completion of each security scan remediation, with reporting of the total Critical, High, Medium, and Low issues resolved.

B. GitHub:

1. Input, manage, and track all VBECS Automated test Script(s)

The Contractor shall show all requirements, changes, tests performed, and test results in the correlating Microsoft Azure/Jira/GitHub to show evidence of code coverage and test coverage of all the requirements specified. This requirement will allow VA to have high confidence in a fully documented, as evidenced by data in the tools. This information shall be submitted as part of the Monthly VBECS Status Report. The Bi-Weekly VBECS Status Report shall include risk updates, system configuration changes, and master schedule changes.

The Contractor shall demonstrate progress toward the reduction of the VBECS backlog. Therefore, the Contractor shall also ensure that the Monthly VBECS Status Report documents backlog reduction with the following criterial set:

A. Backlog items at the beginning of the month compared to backlog items at the end of the month.

B. New items added to the backlog in each month will be represented at the following months beginning count. This is to ensure the Contractor can show backlog progress of items that were known at the beginning of the month.

Deliverable:

Monthly VBECS Status Report.

TIER 3 DEFECT ANALYSIS AND REMEDIATION

The Contractor shall provide for the maintenance and sustainment for the VBECS product. The Contractor shall maintain a VBECS Ticket, Triage, and Resolution Log in support of this effort. The Government will provide both Tier 1 (local) and Tier 2 (application customer support) trouble ticket analysis. If Tier 2 personnel cannot resolve a trouble ticket, such tickets shall be assigned to the Contractor (Tier 3) for resolution. Tier 3 support is defined as problem analysis and defect management functions that usually require specialized resolution, such as software defect and code changes that cannot be resolved by Tier 1 or Tier 2.

Historically, 5 – 10 tickets have been referred to the Contractor for remediation monthly. Services for referred tickets shall be delivered during normal operating hours being 7:00 am eastern time through 7:00 pm eastern time, Monday through Friday less government holidays.

The Contractor shall support resolution of critical severity code tickets and/or High-Priority Incident / Critical Priority Incident calls for Tier 3 VBECS issues as prioritized by Table 1. The Contractor shall adhere to Table 2 for Defect Remediation Processing. The Contractor shall deliver the VBECS Ticket, Triage, and Resolution Log to the COR every month.

The Contractor may determine as an outcome of defect analysis that an enhancement is required to properly address the validated defect. If a defect is determined to be an enhancement, the Contractor shall provide the VA COR with a Defect Analysis Report for the subject defect to include their Enhancement classification reasoning.

Examples of potential VBECS sustainment defects include:

· Example 1: SNOW entry INC28702557 - When the Affected End User enters the information in specimen check section in VBECS user states that the option to go to the next screen is grayed out.

· Example 2: SNOW entry INC27833540 - VBECS will not connect to the Computerized Patient Record System which is affecting patient testing.

Table 1 – Ticket Maintenance Priority and Defect Severity

P2 - Logging Functionally Essential Software Errors

P4 - Patient Personally Affected

P5 - Logging Functionality Needed Software Error

P7 - External Database Interface Issue

P9 - Miscellaneous/Housekeeping Problems

Table 2 - Performance Standards for Tier 3 Ticket and Defect Remediation Processing by Ticket Defect Priority

MOU Approval. May occur any time after Core Work begins.

Occurs when Core Work is complete.

End State – successful package release or determination that no patch is required

*Days shown are Business Days.

Deliverables:

A. VBECS Ticket, Triage, and Resolution Log.

B. Defect Analysis Report.

SOFTWARE CODE AND DATABASE STRUCTURE SUPPORT

The Contractor shall ensure that any changes to the software code and database structure meets the business, regulatory, and technical requirements in accordance with internal project documents, which follows the FDA regulations, addressed in “Paragraph 2.0 - Applicable Documents” and adheres to the existing requirements and design of the software.

The Contractor shall update the Monthly VBECS Status Report with the revisions recommended for database elements that do not conform to regulatory data traces such as the antibody table in the AABB technical manual 21st edition, or, as new editions become available, the most current edition. Any issues found will enter the backlog and receive appropriate business owner/OIT/security defined priority.

VBECS NETWORK CONFIGURATION and SYSTEM ADMINISTRATION MAINTENANCE SUPPORT

At the direction of the COR, the Contractor shall adjust VBECS network configurations in accordance with standards issued by VA Network Operations. This shall include changes to VBECS Virtual Local Network settings, Active Directory, Windows Updates, automated Virus Definition releases/updates, and cloud hosting configurations. The Contractor shall create Enterprise Security External Change Council (ESECC) tickets as required to request changes in the operational VBECS network in support of such things as access to instrument manager servers for automated instruments. Additionally, the Contractor shall create and maintain an ESECC Ticket Log and Software Design Document (SDD) System Configuration and Architecture Change Log.

The Contractor shall perform configuration management with VBECS prescribed project tools, listed in section 5.2 for controlling software and document configuration that is traceable from requirement to implementation in the software. The Contractor may utilize additional project tools that are approved by the COR and TRM compliant. Further, the Contractor shall adhere to existing configuration management structures (for example, Internal Operating Procedures, Work Instructions (WI), etc.

The Contractor shall adhere to approved VA cyber security policy in the execution of this TO. The Contractor shall perform periodic Penetration Test executions and remediations per current cyber security policy. The Contractor shall provide triage and corrective action(s) to current and emergent security findings as defined by the VA. This includes, but is not limited to, new security hardening protocols, software patching, operating system updates and deployments, SQL service packs/updates, Azure extensions, and network security mandates (to include creating and maintaining runbooks used to support any server maintenance events and maintaining a VBECS Group Policy Object). The Contractor shall maintain and sustain (to include a backup) a VBECS user reports file share.

The Contractor shall receive, evaluate, test, validate, and deploy all VA‑mandated Monthly Security Patch Releases to all VBECS‑assigned physical and virtual servers. Currently, there are approximately 460 virtual servers. The Contractor shall ensure that all operating system patches, cumulative updates, security rollups, and vulnerability remediations issued by VA are implemented in strict accordance with VA Directive 6500; NIST SP 800‑53, SI‑2; and VA enterprise change‑management, cybersecurity, and configuration‑management policies.

The Contractor shall conduct full compatibility testing of all patches within the VBECS FDA‑regulated medical‑device environment, including validation of impacts to system functionality, performance, interoperability, interfaces, data integrity, VA’s security/cybersecurity, and Quality System controls. No security patch shall be deployed into production until all validation activities are complete, documented, and approved in accordance with VBECS Quality Management System procedures. The Contractor shall ensure that critical and high‑severity vulnerabilities (as defined by VA Cybersecurity) are remediated within the required compliance windows.

The Contractor shall conduct Technical Reference Model (TRM) software tool validation and compliance activities on a quarterly basis. As part of this requirement, the Contractor shall review all software tools, utilities, scripts, platforms, and components used in support of VBECS development, sustainment, testing, operations, cybersecurity, and Quality System processes to ensure they remain fully compliant with the VA TRM and are listed as “Approved,” “Approved w/ Constraints,” or otherwise authorized for use within the VA enterprise.

The Contractor shall identify any tool that has changed version, status, approval category, constraint language, or lifecycle designation within the TRM and shall immediately assess the operational and compliance impact of such changes. The Contractor shall document all findings, recommendations, risk assessments, remediation actions, and required change‑control activities in a Quarterly TRM Compliance Report. The Contractor shall provide all necessary information requested by VA to ensure TRM approval is obtained prior to use on VA’s network for software.