P01_PWS_Draft_Mackey DistillerSR_10.30.26.pdf

DRAFT

PERFORMANCE WORK STATEMENT

DEPARTMENT OF VETERANS AFFAIRS

Office of Information & Technology Evidence Synthesis Program, Research and Development Service, Veterans

Integrated Service Network 20 VA Portland Health Care System

Cloud-Based Literature Review Platform Software as a Service

Support and Training

Date: October 22, 2026 PWS Version Number: 1.0

1.0 BACKGROUND

The Department of Veterans Affairs (VA), Office of Information & Technology (OIT), Evidence Synthesis Program (ESP), Research and Development Service, VA Portland Health Care System (VAPORHCS) strives to provide high quality, effective, and efficient Information Technology (IT) services to those responsible for providing care to the Veterans at the point-of-care as well as throughout all the points of the Veterans’ health care in an effective, timely and compassionate manner. VA depends on Information Management/Information Technology (IM/IT) systems to meet mission goals.

The VA ESP supports VA’s Learning Health System by producing rigorous evidence syntheses that inform policy, clinical practice, and future research. ESP reviews have guided national quality improvement and research initiatives and contributed to meaningful changes in clinical practice and policy. The program delivers high-quality evidence reviews that shape clinical policies, support guideline development, and inform future research to improve care for Veterans.

ESP is composed of 4 Centers (Durham, NC; Los Angeles, CA; Minneapolis, MN; and Providence, RI) and a Coordinating Center (Portland, OR), producing between 15 to 20 systematic reviews and other types of evidence reports annually.

Systematic review activities involve substantial labor, including comprehensive literature searches, citation deduplication, relevance screening, detailed data extraction, and preparation of final reports. To meet methodological, scientific, regulatory, and transparency requirements, the ESP research team must maintain complete documentation of inclusion and exclusion decisions throughout the review process.

Manual production of summary tables, Preferred Reporting Items for Systematic Reviews and Meta-Analyses (PRISMA) flow diagrams, and other visual outputs further increase workload and processing time. Modern systematic review software can automate many of these tasks, supporting consistent and reproducible deliverables.

Implementing such software provides workflow efficiencies, standardized quality‑assurance controls, and reduced error rates, ultimately shortening overall processing time and improving reliability across reviews.

2.0 APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. E.O. 13960, “Promoting the Use of Trustworthy Artificial Intelligence in the Federal Government,” December 3, 2020

2. E.O. 14319, “Preventing Woke AI in the Federal Government,” July 23, 2025

3. OMB Memorandum M-25-21, “Accelerating Federal Use of AI through

Innovation, Governance, and Public Trust,” April 3, 2025

4. OMB Memorandum M-25-22, “Driving Efficient Acquisition of Artificial

Intelligence in Government,” April 3, 2025

5. OMB Memorandum M-26-04, “Increasing Public Trust in Artificial Intelligence

(AI) Through Unbiased AI Principles,” December 11, 2025

3.0 SCOPE OF WORK

The Contractor shall provide a cloud-based, Artificial Intelligence (AI)-augmented literature review platform, delivered as Software as a Service (SaaS), to support the five VA ESP Centers in conducting systematic reviews. The platform shall automate and manage the technical steps of the systematic review process, support configurable workflows for article screening and data extraction, integrate full-text article retrieval, and maintain complete audit trails that capture all user activity for traceability.

The Contractor shall provide comprehensive support, onboarding, and training services necessary to ensure effective and sustained use of the platform across all ESP Centers.

At a minimum, The Contractor shall deliver five online onboarding programs, one for each ESP Center, within 30 days of contract award, and shall implement a comprehensive Platform Launch Program that includes project management, configuration of one systematic review project template, discovery and configuration review sessions, and up to four hours of instructor-led training for up to ten learners.

The Contractor shall also provide an ongoing training program consisting of self-service materials, role-specific instruction, on-demand learning modules, certification programs, updated training content following system enhancements, and access to a searchable knowledge base to ensure users and administrators maintain continued proficiency with the platform.

4.0 PERFORMANCE DETAILS

4.1 PERFORMANCE PERIOD

The period of performance (PoP) includes one 12-month Base Period and four 12-month Option Periods. The overall PoP shall not exceed 60 months.

the Contractor shall furnish standard support from 9:00 a.m. to 5:00 p.m. EST, Monday through Friday, excluding Federal holidays, and shall maintain access to online documentation and web-based support resources.

here are 11 Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-21-Accelerating-Federal-Use-of-AI-through-Innovation-Governance-and-Public-Trust.pdf https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-22-Driving-Efficient-Acquisition-of-Artificial-Intelligence-in-Government.pdf https://www.whitehouse.gov/wp-content/uploads/2025/12/M-26-04-Increasing-Public-Trust-in-Artificial-Intelligence-Through-Unbiased-AI-Principles-1.pdf?_bhlid=c0113a16495d987bc33f63e3dccf35c28d6bfd15

Under current definitions, five are set by date:

New Year's Day January 1 Juneteenth June 19 Independence Day July 4 Veterans Day November 11 Christmas Day December 25

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

Martin Luther King's Birthday Third Monday in January Washington's Birthday Third Monday in February Memorial Day Last Monday in May Labor Day First Monday in September Columbus Day Second Monday in October Thanksgiving Fourth Thursday in November

4.2 PLACE OF PERFORMANCE

Tasks under this PWS shall be performed at Contractor facilities. The Contractor shall identify the Contractor’s place of performance.

4.3 TRAVEL

Travel will not be required under this effort to perform the tasks associated with the effort.

5.0 SPECIFIC TASKS AND DELIVERABLES

The Contractor shall perform the following:

The Contractor shall provide a SaaS Cloud-Based Literature Review Platform. All tasks shall be executed in accordance with program requirements, national clinical workflows, and VA technical standards.

The Contractor shall additionally provide a basic support package with extended hours from 8:00 a.m. to 8:00 p.m. EST, Monday through Friday, excluding Federal holidays, and shall make enhanced support packages available as optional purchasable items.

The Contractor shall provide a cloud-based literature review platform delivered as Software as a Service (SaaS) to support the systematic review and evidence synthesis work of the five VA Evidence Synthesis Program (ESP) Centers located in Durham, North Carolina, Los Angeles, Carolina, Minneapolis, Minnesota, Portland, Oregon and Providence, Rhode Island. The platform shall be hosted, maintained, and secured by the Contractor and shall be accessible to authorized Government users through a standard web browser without requiring local software installation.

At a minimum, the platform shall support the full systematic review workflow, including automated reference ingestion from bibliographic data providers, deduplication, title/abstract and full-text screening, data and evidence extraction, risk-of-bias assessment, external document linking, and reporting. The platform shall include AI-assisted reference processing and shall support up to 500 concurrent projects per ESP Center, for a total of up to 2,500 projects.

The Contractor shall also provide user onboarding, role-specific training, on-demand learning resources, and technical support as specified in this PWS. All Government data stored on the platform shall remain the property of the Government and shall not be deleted without written permission from the Government.

Platform Functional Requirements

The software solution shall meet the following functional requirements:

1. Systematic Review Topic Management: The platform shall enable users to organize, manage, and navigate multiple concurrent systematic review projects using project folders or equivalent functionality.

2. Data Import and Export: The platform shall support both individual and batch data import/export in standard file formats to facilitate reference management and reporting.

3. Automated Evidence Extraction: The platform shall automatically identify, suggest, and link key data elements from references. Outcomes include automated sentiment analysis and generation of plain-language summaries.

4. Full-Text Retrieval: The platform shall provide automated retrieval of full-text articles through PubMed Central, DOI.org, and optional third-party services (e.g., CCC RightFind, Reprints Desk). The system shall also accept manual full-text uploads.

Support and Training

5. Open-Access Identification: The platform shall integrate an open-access discovery tool (e.g., Unpaywall) to locate publicly available full texts using Digital Object Identifier (DOI) metadata.

6. Cross-Project Dashboard: The platform shall allow access to a real-time dashboard summarizing assigned tasks, statuses, and workload across all projects.

7. Machine Translation: The platform shall provide automated translation for non-English titles and abstracts using a commercially available machine translation service.

8. Automated Reference Ingestion: The platform shall support automated import of references from supported bibliographic data providers, including references delivered through custom email alerts.

9. Administrative Controls: The platform shall support multiple administrators with the ability to manage accounts, permissions, and system configuration.

10. Aggregate Reporting: The platform shall generate integrated datasets combining results across multiple projects through an aggregate reporting tool.

11. External Document Linking: The platform shall support configurable OpenURL or equivalent link-resolver functionality that allows users to open documents stored in external systems directly from the review screens.

12. AI-Assisted Screening: The platform shall provide AI-based predictive ranking and assessment to prioritize references and identify potential screening inconsistencies.

13. Evidence Repository: The platform shall support creation, access, and reuse of a curated evidence repository to minimize duplication and streamline team collaboration.

14. Auditability and Documentation: The platform shall provide a detailed audit trail that captures all reviewer actions and decisions, include comprehensive user-activity logging, and support version control with rollback capability to ensure full traceability of changes.

Support and Training

15. Workflow and Automation: The platform shall allow for automating recurring review tasks such as screening, data extraction, summary table generation, and PRISMA diagram production in addition to enabling standardized workflows and quality-assurance controls across multiple projects and teams.

16. Collaboration and Data Management: The platform shall offer secure, cloud‑based access through any browser or device for authorized personnel;

provide centralized, shared datasets that support real‑time, cross‑site collaboration; and enable simultaneous multi‑user access and coordinated project management.

17. System Availability and Performance: The platform shall be available at least 99.5% uptime, excluding excused downtime. System services shall be available 24 hours per day, 7 days per week. Contractor shall meet this standard 100% of the time.

SUPPORT SERVICES

1. The Contractor shall provide standard support from 9:00 a.m. to 5:00 p.m.

EST for each ESP Center, Monday through Friday, excluding Federal holidays.

2. The Contractor shall provide access to online documentation and web-based support resources.

3. The Contractor shall provide a basic support package with extended support hours of 8:00 a.m. to 8:00 p.m. EST for each ESP Center, Monday through Friday, excluding Federal holidays.

4. The Contractor shall provide enhanced support packages as optional items.

TRAINING AND ONBOARDING

1. Onboarding Programs: The Contractor shall deliver five online onboarding programs, one for each VA ESP team located in Durham, Los Angeles, Minneapolis, Portland, and Providence, within 30 days of contract award.

Support and Training

2. Platform Launch Program: The Contractor shall provide a Platform Launch Program designed to accelerate adoption and ensure a fully compliant, scalable, and optimized implementation tailored to the Government’s requirements. The Contractor shall deliver configuration services using proven processes and templates and shall collaborate with the Government to ensure the solution meets organizational needs. The Launch Program shall include, at a minimum:

a. End‑to‑end project management services to support initial implementation.

b. Expert assistance to configure one platform SR project template.

c. One 30–60-minute discovery session to gather and clarify system requirements.

d. One 60‑minute review session to validate the configured solution and obtain Government feedback.

e. Up to four hours of instructor‑led training for up to 10 learners to ensure effective and productive use of the configured solution.

3. Training: The Contractor shall provide an ongoing comprehensive training program to ensure that all users and administrators can effectively use the platform. At a minimum, the training program shall include:

a. Self‑service training materials, including user guides, manuals, quick‑start materials, and video tutorials.

b. Role‑specific training for system administrators, project leads, and reviewers.

c. Access to online, on demand learning modules covering platform navigation, project setup, evidence extraction, reporting features, and workflow management.

d. Certification programs for both users and administrators to verify competency in key system functions.

e. Updated training materials whenever new features or major platform upgrades are released.

f. A knowledge base or searchable help center containing troubleshooting guidance, frequently asked questions, and best practices.

USER ACCESS

1. The platform shall support up to 500 projects with AI Reference Processing for each of the five ESP Centers, for a total of up to 2,500 projects. Data stored from review projects shall not be deleted without written permission from the Government.

Support and Training

2. The Contractor shall provide Single Sign-On (SSO) integration compatible with VA’s Identity Provider for centralized authentication.

4.1 PROJECT MANAGEMENT

5.1.1 CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, timeline, and tools to be used in execution of the contract. The CPMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks, and resource support as applicable. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPMP shall be concurred upon and updated in accordance with Section B of the contract. The Contractor shall update and maintain the VA Program Manager (PM) approved CPMP throughout the PoP.

Deliverable:

A. Contractor Project Management Plan

5.1.2 REPORTING REQUIREMENTS

The Contractor shall provide the Contracting Officer’s Representative (COR) with Monthly Progress Reports in electronic form in Microsoft Word and Project formats. The report shall include detailed instructions/explanations for each required data element, to ensure that data is accurate and consistent. These reports shall reflect data as of the last day of the preceding month.

The Monthly Progress Reports shall cover all work completed during the reporting period and work planned for the subsequent reporting period. The report shall also identify any problems that arose and a description of how the problems were resolved. If problems have not been completely resolved, the Contractor shall provide an explanation including their plan and timeframe for resolving the issue. The Contractor shall monitor performance against the CPMP and report any deviations. It is expected that the Contractor will keep in communication with VA accordingly so that issues that arise are transparent to both parties to prevent escalation of outstanding issues.

Deliverable:

A. Monthly Progress Report

Support and Training

5.2 ADDITIONAL TASKS

Deliverable:

6.0 GENERAL REQUIREMENTS

6.1 ENTERPRISE AND IT FRAMEWORK

6.1.1 VA TECHNICAL REFERENCE MODEL

The Contractor shall comply with the VA OIT Technical Reference Model (VA TRM).

Compliance with the VA TRM is achieved by using only technologies and standards that are listed as approved for use in the VA TRM. The Contractor shall provide all necessary information requested by VA to ensure TRM approval is obtained prior to use on VA’s network.

6.1.2 ZERO TRUST – VA CRITICAL SECURITY CONTROLS

VA has established minimum mandatory security requirements and requires that any network connected software system or service must meet the VA Critical Security Controls as outlined in the VA Memorandum, “VA Security Controls”, https://www.voa.va.gov/DocumentView.aspx?DocumentID=5010. VA Critical Security Controls identify the minimum mandatory requirements that must be implemented across all VA enterprise infrastructure, cloud computing environments, information systems, networks, and specialized devices (medical devices/systems, special-purpose systems, and research scientific computing devices) that process, store, and/or transmit VA data. Effective July 1, 2025, the Contractor shall implement these VA Critical Security Controls, within any network connected software system or service prior to being authorized for use in the VA. This functional requirement is not negotiable, and Plan of Action & Milestones (POAM) will not be accepted in the event these controls cannot be implemented for new systems. Critical Security Controls are intended to increase VA’s security posture and provide security and privacy risk visibility into the VA network and is not a new requirement. The Contractor’s failure to maintain these VA Critical Controls after implementation will result in VA discontinuing the use of the system.

6.1.3 FEDERAL IDENTITY, CREDENTIAL, AND ACCESS MANAGEMENT (FICAM)

The Contractor shall ensure Commercial Off-The-Shelf (COTS) product(s), software configuration and customization, and/or new software are Personal Identity Verification (PIV) card-enabled by accepting HSPD-12 PIV credentials using VA Enterprise Architecture (EA), and VA Identity and Access Management (IAM) approved Enterprise Technology Guidelines (ETG). The Contractor shall ensure all Contractor delivered applications and systems comply with the VA Identity, Credential, and Access https://www.voa.va.gov/DocumentView.aspx?DocumentID=5010 https://www.ea.oit.va.gov/ https://www.ea.oit.va.gov/ https://digital.va.gov/office-of-information-and-technology/reference-library/enterprise-technology-guidelines/ https://digital.va.gov/office-of-information-and-technology/reference-library/enterprise-technology-guidelines/

Support and Training

Management policies and guidelines set forth in Executive Order 14028, VA Handbook 6510 VA Identity and Access Management, VA Handbook 0735 Homeland Security Presidential Directive 12 (HSPD-12) Program, CISA Binding Operational Directive 23- 01, and align with the Federal Identity, Credential, and Access Management Roadmap and Implementation Guidance v2.0.

The Contractor shall ensure all Contractor delivered applications and systems provide user authentication services compliant with the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-63-4, VA Handbook 6500, and VA IAM enterprise requirements for direct, assertion based authentication, and/or trust based authentication, as determined by the ETGs. Direct authentication at a minimum must include Public Key Infrastructure (PKI) based authentication supportive of PIV card and/or Common Access Card (CAC), as determined by the business need.

The Contractor shall ensure all Contractor delivered applications and systems conform to the specific Identity and Access Management PIV requirements set forth in the Office of Management and Budget (OMB) Memoranda M-05-24, M-19-17, M-22-09, and NIST Federal Information Processing Standard (FIPS) 201-3. Contractor delivered applications and systems shall be on the FIPS 201 Approved Product List (APL). If the Contractor delivered application and system is not on the APL, the Contractor shall be responsible for taking the application and system through the FIPS 201 Evaluation Program.

The Contractor shall ensure all Contractor delivered applications and systems support:

1. Automated provisioning and are able to use enterprise provisioning service.

2. Interfacing with VA’s Master Person Index (MPI) to provision identity attributes, if the solution relies on VA user identities. MPI is the authoritative source for VA user identity data.

3. The VA defined unique identity (Secure Identifier [SEC ID] / Integrated Control Number [ICN]).

4. Multiple authenticators for a given identity and authenticators at every Authenticator Assurance Level (AAL) appropriate for the solution.

5. Identity proofing for each Identity Assurance Level (IAL) appropriate for the solution.

6. Federation for each Federation Assurance Level (FAL) appropriate for the solution, if applicable.

7. Two-factor authentication (2FA) through an applicable Technology Guideline as outlined in VA ETG.

8. A Security Assertion Markup Language (SAML) implementation if the solution relies on assertion-based authentication. Additional assertion implementations, besides the required SAML assertion, may be provided as long as they are compliant with NIST SP 800-63-4 guidelines.

9. Authentication/account binding based on trusted Hypertext Transfer Protocol (HTTP) headers if the solution relies on Trust based authentication.

10. Role Based Access Control.

https://bidenwhitehouse.archives.gov/wp-content/uploads/legacy_drupal_files/omb/memoranda/2005/m05-24.pdf https://bidenwhitehouse.archives.gov/wp-content/uploads/2019/05/M-19-17.pdf https://bidenwhitehouse.archives.gov/wp-content/uploads/2022/01/M-22-09.pdf

11. Auditing and reporting capabilities.

12. Compliance with VIEWS 00155984, PIV Logical Access Policy Clarification https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896.

The required Assurance Levels for this specific effort are Identity Assurance Level 3, Authenticator Assurance Level 3, and Federation Assurance Level 3.

6.1.4 INTERNET PROTOCOL VERSION 6 (IPv6)

The Contractor solution shall support IPv6-Only based upon the memo issued by the Office of Management and Budget (OMB) on November 19, 2020 (https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-07.pdf). Which defines IPv6-only as the state of an operational system or service when IPv4 protocol functions (addressing, packet forwarding) are not in use. The NIST USGv6 profile defines technical requirements for a product to be capable of operating in IPv6-Only environments. IPv6-Only technology, in accordance with the USGv6 Program (https://www.nist.gov/programs-projects/usgv6-program/usgv6-revision-1), NIST Special Publication (SP) 500-267B Revision 1 “USGv6 Profile” (https://doi.org/10.6028/NIST.SP.500-267Br1), and NIST SP 800-119 “Guidelines for the Secure Deployment of IPv6” (https://doi.org/10.6028/NIST.SP.800-119), compliance shall be included in all IT infrastructures, application designs, application development, operational systems and sub-systems, and their integration. In addition to the above requirements, all devices, applications, and systems shall support all applicable functionality on native IPv6-Only as well as dual stack (IPv6 / IPv4) connectivity without additional memory or other resources being provided by the Government, so that they can function in a mixed environment. All public/external facing servers and services (e.g., web, email, DNS, ISP services, etc.) shall support native IPv6-Only and dual stack (IPv6 / IPv4) users and all internal infrastructure and applications shall support using native IPv6-Only and dual stack (IPv6 / IPv4) for all functionality and operations.

6.1.5 TRUSTED INTERNET CONNECTION (TIC)

The Contractor solution shall meet the requirements outlined in Office of Management and Budget Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative“ (https://www.whitehouse.gov/wp-content/uploads/2019/09/M-19-26.pdf), VA Directive 6513 “Secure External Connections”, and shall comply with the TIC 3.0 Core Guidance Documents, including all Volumes and TIC Use Cases, found at the Cybersecurity & Infrastructure Security Agency (CISA) (https://www.cisa.gov/publication/tic-30-core-guidance-documents).

6.1.6 STANDARD COMPUTER CONFIGURATION

https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896 https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-07.pdf https://www.nist.gov/programs-projects/usgv6-program/usgv6-revision-1 https://doi.org/10.6028/NIST.SP.500-267Br1 https://doi.org/10.6028/NIST.SP.800-119 https://www.whitehouse.gov/wp-content/uploads/2019/09/M-19-26.pdf https://www.cisa.gov/publication/tic-30-core-guidance-documents

The Contractor IT end user solution that is developed for use on standard VA computers shall be compatible with and be supported on the standard VA operating system, Windows 11, Edge (Chromium based), and 365 Apps for enterprise.

Applications delivered to VA and intended to be deployed to Windows 11 workstations shall be delivered as a signed .msi package with switches for silent and unattended installation and updates shall be delivered in signed .msp file formats for easy deployment using Microsoft Endpoint Configuration Manager (CM) VA’s current desktop application deployment tool. Signing of the software code shall be through a vendor provided certificate that is trusted by VA using a code signing authority such as Verizon/Cybertrust or Symantec/VeriSign. The Contractor shall also ensure and certify that their solution functions as expected when used from a standard VA computer, with non-admin, standard user rights that have been configured using the Defense Information Systems Agency (DISA) Secure Technical Implementation Guide (STIG) specific to the particular client operating system being used.

6.1.7 VETERAN FOCUSED INTEGRATION PROCESS (VIP) AND PRODUCT LINE

MANAGEMENT (PLM)

The Contractor shall support VA efforts IAW the Veteran-Focused Integration Process (VIP) Guide and Product Line Management (PLM) Playbook. The major focus of VIP is on Enterprise Oversight, Governance, reporting, and establishing practices that focus on outcomes and continuously delivering sustainable IT capabilities to benefit the Veteran. PLM is a framework that focuses on delivering functional products that provide the highest priority work to customers while delivering simplified, reliable, and practical solutions to the business, medical staff, and our Veterans. The VIP Guide is a companion guide to the PLM Transformation Playbook and can be found at:

https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371 and the PLM Transformation Playbook can be found at https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946. VIP and PLM are the authoritative processes that IT projects must follow to ensure development and delivery of IT products.

The VIP Guide provides guidance for transitioning from project-centric to product-centric delivery. The VIP guide applies to all OIT Office of Management and Budget (OMB) reportable products that are required to collect and report costs, schedules, risks, and other valuable information in VA PARS (whether products are procured or developed by VA) and any VA Information Technology project effort in Software Product Management (SPM) and Infrastructure Operations (IO), or their successors, that touch the VA network regardless of IT organizational alignment (whether it spends government funding from VA's Congressional IT Appropriation or any other appropriation).

The PLM Transformation Playbook details how OIT leadership expects Product Lines (PLs) to implement PLM, DevOps, and Lean-Agile principles, methods, practices, and techniques through levels of maturity. The PLM Transformation Playbook applies to all Information Technology (IT) products aligned to PLs in the Software Product https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

Management, Infrastructure Operations and Product Engineering organizations within the OIT organization.

Others outside the referenced groups or organizations may use the VIP Guide and PLM Transformation Playbook for situational awareness as needed.

6.1.8 PROCESS ASSET LIBRARY (PAL)

The Contractor shall perform their duties consistent with the processes defined in the OIT Process Asset Library (PAL). The PAL includes a spectrum of OIT functions and activities, such as project management, operations, service delivery, communications, acquisition, and resource management. PAL serves as an authoritative and informative repository of searchable processes, activities or tasks, roles, artifacts, tools and applicable standards and guides to assist the OIT workforce, Government and Contractor personnel. OIT utilizes PAL processes to ensure compliance with policies and regulations and to meet VA quality standards. The PAL includes the contractor onboarding process consistent with Section 6.2.2 and can be found at process_CONB_ext.docx (live.com). The main PAL can be accessed at www.va.gov/process.

6.1.9 AUTHORITATIVE DATA SOURCES

The VA Enterprise Architecture Repository (VEAR) is one component within the overall EA that establishes the common framework for data taxonomy for describing the data architecture used to develop, operate, and maintain enterprise applications. The Contractor shall comply with the department’s Authoritative Data Source (ADS) requirement that VA systems, services, and processes throughout the enterprise shall access VA data solely through official VA ADSs where applicable, see below. The Information Classes which compose each ADS are located in the VEAR, in the Data & Information domain. The Contractor shall ensure that all delivered applications and system solutions support:

1. Interfacing with VA’s Master Person Index (MPI) (formerly the Master Veteran Index (MVI)) to provision identity attributes, if the solution relies on VA user identities. MPI is the authoritative source for VA user identity data.

2. Interfacing with Capital Asset Inventory (CAI) to conduct real property record management actions, if the solution relies on real property records data. CAI is the authoritative source for VA real property record management data.

3. Interfacing with electronic Contract Management System (eCMS) for access to contract, contract line item, purchase requisition, offering vendor, and solicitation information above the micro-purchase threshold, if the solution relies on procurement data. ECMS is the authoritative source for VA procurement actions data.

4. Interfacing with HRSmart Human Resources Information System to conduct personnel action processing, on-boarding, benefits management, and https://view.officeapps.live.com/op/view.aspx?src=https%3A%2F%2Fdigital.va.gov%2Fprocess-asset-library%2Fwp-content%2Fuploads%2Fsites%2F16%2F2024%2F04%2Fprocess_CONB_ext.docx&wdOrigin=BROWSELINK http://www.va.gov/process compensation management, if the solution relies on personnel data. HRSmart is the authoritative source for VA personnel information data.

5. Interfacing with VA Profile to access personal contact information, if the solution relies on VA Veteran personal contact information data. VA Profile is the authoritative source for VA Veteran Personal Contact Data.

6. Interfacing with VA/Department of Defense (DoD) Identity Repository (VADIR) for determining eligibility for VA benefits under Title 38, if the solution relies on qualifying active duty military service data. VADIR is the authoritative source for qualifying active duty military service in VA.

7. Interfacing with VA Systems Inventory (VASI) to access VA systems information, if the solution relies on VA system information. VASI is the authoritative source for VA Information Technology systems.

8. Interfacing with Enterprise Mission Assurance Support Service (eMASS) to access the historical Authority to Operate (ATO) status of all VA Information Systems prior to migrating to ServiceNow Continuous Authorization and Monitoring (SNowCAM) until it is determined the migration is completed and eMASS is sunset. eMASS contains the historical Authority to Operate (ATO) status of all VA Information Systems prior to September 30, 2025, with all status provided through SNowCAM once migration is completed.

6.1.10 ENTERPRISE SOCIAL SECURITY NUMBER (ESSN) REDUCTION

The Contractor solution shall support the Social Security Number (SSN) Fraud Prevention Act (FPA) of 2017 which prohibits the inclusion of SSNs on any document sent by mail. The Contractor support shall also be performed in accordance with Section 240 of the Consolidated Appropriations Act (CAA) 2018, enacted March 23, 2018, which mandates VA to discontinue using SSNs to identify individuals in all VA information systems as the Primary Identifier. The Contractor shall ensure that any new IT solution discontinues the use of SSN as the Primary Identifier to replace the SSN with the ICN in all VA information systems for all individuals. The Contractor shall ensure that all Contractor delivered applications and systems integrate with the VA MPI for identity traits to include the use of the ICN as the Primary Identifier. The Contractor solution may only use a Social Security Number to identify an individual in an information system if and only if the use of such number is required to obtain information VA requires from an information system that is not under the jurisdiction of

VA.

6.1.11 SOFTWARE AND LICENSING REQUIREMENTS

The Contractor shall be responsible for the provision of all software licenses and any associated licensing maintenance required for any development, delivery, integration, operation, and/or maintenance associated with its proposed application(s), software products, software solution, and/or system including, but not limited to, any and all application(s), software and/or software products that comprise, are a part of, or integrate with the Contractor’s proposed application(s), software products, software solution, and/or system for the life of any resulting contract.

6.1.12 GENERATIVE ARTIFICIAL INTELLIGENCE REQUIREMENTS

(This language should be included in every solicitation. However, there is a Self- Certification in the Notes to the CO section where the Offeror must self-certify that it meets the requirements for Unbiased Principles of AI, or indicate N/A. If N/A is selected then that should indicate no AI would be used in the acquisition.

Therefore, the AI PWS section’s requirements language and headings can be removed from the resulting award, however, the “Artificial Intelligence in VA Contracts” H Clause should remain. Alternatively, the CO may also choose to keep the PWS heading in place, indicate Not Applicable under the heading, and also ensure “Artificial Intelligence in VA Contracts” H Clause remains.)

If Artificial Intelligence (AI) is part of the Contractor system/solution, the Contractor shall be in compliance with E.O. 13960 and 14319, OMB Memorandums M-25-21, M-25-22, and M-26-04, and VA Directive and Handbook 6500 to support VA in trustworthy, secure, responsible, accountable, Truth Seeking, and Ideologically Neutral AI innovation.

No web-based, publicly available generative AI service has been approved for use with VA-sensitive data including, but not limited to OpenAI’s ChatGPT, Microsoft’s Copilot, Google’s Gemini, and Anthropic’s Claude. No PII, protected health information (PHI), or VA-sensitive data should be entered into these unapproved services. The entire definition of VA Sensitive Data can be found at 38 U.S.C. § 5727 (23). The Contractor shall protect VA Sensitive data from unauthorized disclosure or use, and from being used to train or improve the functionality of the vendor's commercial offerings without express permission from VA. Only VA-hosted instances of generative AI services may be approved for use with VA-sensitive data.

The Contractor shall deliver the services, technical data, configurations, models, weights, documentation or other information, including source code, developed during contract performance. The Contractor, in collaboration with VA, must evaluate the output of any AI tool for accuracy prior to using the output in VA efforts. All data, including models, weights, algorithms, and outputs generated using either Government-furnished data or data first developed under this contract shall be the property of the Government with unlimited rights as defined by FAR 52.227-14. The Contractor shall also deliver any custom-developed code developed with AI methodologies in accordance with the SHARE IT Act, if applicable. VA shall also retain unlimited rights to any improvements to that data, including the continued design, development, testing, and operation of AI systems and/or systems utilizing AI.

The Contractor shall ensure that all AI Systems, including Large Language Models (LLM), whether standalone LLMs or integrated into broader software platforms, procured under this effort and/or used in performance of this contract complies with the Unbiased AI Principles as defined in Executive Order 14319 and OMB Memorandum M-

26-04, e.g. Truth Seeking and Ideologically Neutral, as applicable to the intended use of the system.

The Contractor shall ensure that AI System/LLM generated outputs are truthful in responding to user prompts seeking factual information or analysis, prioritize historical accuracy, scientific inquiry, and objectivity, as well as acknowledge uncertainty where reliable information is incomplete or contradictory and do not fabricate, hallucinate, or present unverifiable information as fact.

The Contractor shall ensure that LLMs and AI outputs are neutral, nonpartisan tools that do not manipulate responses in favor of ideological dogmas such as Diversity, Equity, and Inclusion (DEI). The Contractor shall ensure that the LLMs, including the AI System, are not intentionally encoded with partisan or ideological judgments within an AI System’s/LLM’s outputs unless those judgments are prompted by or otherwise readily accessible to the end user.

Compliance with the AI requirements of this contract, including adherence to the Unbiased AI Principles, Truth-Seeking and Ideological Neutrality requirements, disclosure obligations, monitoring and reporting requirements, and corrective action responsibilities, is a material condition of eligibility for payment and continued performance. In accordance with OMB Memorandum M-26-04, failure to comply with these requirements, or refusal to take timely and appropriate corrective action to remedy identified noncompliance, may constitute a material breach of contract and may result in remedies consistent with the terms of the contract and applicable law including but not limited to withholding of payment, termination for cause/default, or other appropriate contractual remedies, as determined by the Contracting Officer.

All AI for delivery and/or use in performance of the contract shall adhere to the VA Trustworthy AI Framework, available at https://department.va.gov/ai/trustworthy/. Once the Contractor has obtained CO authorization to use specific AI in contract performance, the Contractor shall provide the COR a signed Statement of Attestation prior to AI implementation as identified in the Artificial Intelligence in VA Contracts clause, to include its associated list of AI being used in contract performance.

Deliverable:

A. Statement of Attestation

6.1.12.1 AI SYSTEM/LLM DEVELOPMENT AND OPERATION DOCUMENTATION

REQUIREMENTS

(The Requiring Activity should modify the below items 5-8 (Note that OMB requires items 1-4) to include only the documentation requirements needed for their specific effort to assess the AI System/LLM compliance with Unbiased AI Principles. For example, if the system is not public facing or sensitive in nature, a determination may be made that items 5-8 below may not be required at all.

https://department.va.gov/ai/trustworthy/

(Note: the solicitation language should mirror the resulting items within the finalized PWS from below.)

To enable Government continued assessment of compliance with Trustworthy AI requirements and both Unbiased AI Principles, Truth-seeking and Ideological Neutrality, in accordance with OMB M-26-04, the Contractor shall provide AI System/LLM Development and Operation Documentation Package to include, at a minimum:

1. Acceptable Use Policy

The Contractor shall provide an Acceptable Use Policy document governing its AI operation that characterizes and differentiates appropriate and inappropriate use of their product offering

2. Model Cards, System Cards and/or Data Cards

The Contractor shall provide documentation describing essential information about the model, system, and or data as it relates to the AI/LLM product offering. The documentation shall address summaries of training process, identified risks and mitigations, and model evaluation scores on LLM benchmarks at a minimum, where appropriate

3. End User Resources

The Contractor shall provide documentation to include product tutorials, developer guides, and/or other tools to assist VA in ensuring proper use of the AI/LLM to maximize utility

4. Mechanism for End User Feedback

The Contractor shall provide documentation describing the mechanism employed to provide feedback to the Offeror on outputs identified that violate the Unbiased AI Principles. This may be satisfied by a general inbox, specific Point of Contact, or similar feedback mechanism.

5. Pre-Training and Post-Training Activities of the AI System/LLM

The Contractor shall provide documentation of Pre-Training and Post Training Activity that provides details on:

a. Actions taken that impact the factuality and grounding of AI System/LLM outputs

b. System-level prompts that provide natural language instructions to the model specifying guidelines on responding to user-generated queries, to include how a model responds when reliable information is incomplete, contradictory, or subject to individual interpretation

c. The type of outputs restricted via content moderation and safety filters

d. The use of red teaming as a means of continuously assessing the model to protect against incidents of bias in generated output.

e. Training or development, if any, that occurred outside the United States, to include the type of activity and the country in which it occurred.

f. Any modifications or configurations undertaken to comply with any regulation from a government other than the U.S. Federal Government.

6. Model Evaluation Results and Methodologies

The Contractor shall provide documentation describing the Evaluation Results of bias evaluations conducted by the Vendor to include the methodology for performing such tests (e.g., testing prompt pairs for politically oriented topics).

The documentation shall also include Benchmark scoring results measuring the model’s bias, helpfulness, honesty, or accuracy when provided with ambiguous versus straightforward questions. (Including any benchmarks comparing performance across multiple languages, where applicable).

7. Description of Enterprise-Level Controls

The Contractor shall provide documentation describing the Enterprise Governance tools and controls, such as:

a. Customizable system instructions that are additive to a base model’s system prompts or content generation filters.

b. Product features that require a model to cite sources of its outputs or otherwise provide visibility into the provenance of the model’s outputs.

c. AI System/LLM model evaluation tools that enable comparisons either between a model’s outputs, or across various models.

8. Third Party Modification Disclosure

The Contractor shall disclose of any additional controls to modify an AI Model’s/LLM’s output applied by the Contractor if the Contractor is not a direct developer of the LLM (e.g., classifiers, system prompts, fine-tuning, content moderation and filters, etc.)

A. AI System/LLM Development and Operation Documentation Package

6.1.12.2 MONITORING, REPORTING, AND CORRECTIVE ACTION

The Contractor shall develop and implement a Compliance Monitoring and Reporting Plan supporting ongoing monitoring processes to evaluate AI outputs for compliance with Trustworthy AI and Unbiased AI principles. This plan shall include the mechanism for authorized users to provide end user feedback to report suspected violations of Truth-Seeking or Ideological Neutrality requirements.

The Contractor shall notify the COR within 10 business days of identifying any material deviation from these principles and shall submit a written Corrective Action Plan describing mitigation steps, responsible parties, and timelines. Any material deviation, corrective action taken, and results shall be detailed in the Monthly Progress Reports.

A. Compliance Monitoring and Reporting Plan B. Corrective Action Plan

6.1.12.3 AI MODEL UPDATES AND CHANGE DISCLOSURES

The Contractor, in an AI Model/LLM Change Disclosure, shall notify the Government throughout the PoP in advance of any material changes to AI models, including new AI enhancements, features and/or components, controls, retraining, classifiers, system prompts, fine-tuning, content moderation, filters, version replacement, or architectural changes, that could reasonably affect compliance with Trustworthy AI or Unbiased AI principles. Updated documentation shall be provided to VA for VA approval prior to implementation of such changes.

Deliverable:

A. AI Model/LLM Change Disclosure

6.1.13 SOURCE CODE HARMONIZATION AND REUSE IN INFORMATION

TECHNOLOGY (SHARE IT Act)

The Contractor shall comply with the Source Code Harmonization and Reuse in Information Technology (SHARE IT) Act, P.L. 118-187, when developing and delivering custom code first produced for the VA in the performance of this Contract/Order. The Contractor shall deliver to the Government all data first produced under this Contract/Order with unlimited rights as defined by FAR 52.227-14, to include without limitation, all custom-developed code and other key technical components of the code (including documentation, data models, schemas, metadata, architecture designs, configuration scripts, and artifacts required to develop, build, test, and deploy the code).

Custom-developed code includes source code, or segregable portions of source code and all documentation created in support thereof to include source code written for a software project, product, module, plugin, script, middleware, or application programming interface.

6.2 SECURITY AND PRIVACY REQUIREMENTS

https://www.congress.gov/118/plaws/publ187/PLAW-118publ187.pdf

N/A

6.2.1 POSITION/TASK RISK DESIGNATION LEVEL(S)

N/A

6.2.2 CONTRACTOR PERSONNEL SECURITY REQUIREMENTS

6.3 METHOD AND DISTRIBUTION OF DELIVERABLES

The Contractor shall deliver documentation in electronic format, unless otherwise directed in Section B of the solicitation/contract. Acceptable electronic media include:

Microsoft 365 suite, MS Word, MS Excel, MS PowerPoint, MS Project, MS Access, MS Visio, AutoCAD, and Adobe Postscript Data Format (PDF).

6.4 PERFORMANCE METRICS

The table below defines the Performance Standards and Acceptable Levels of Performance associated with this effort.

Performance Objective

Performance Standard Acceptable Levels of Performance

A. Technical / Quality of Product or Service

1. Demonstrates understanding of requirements

2. Efficient and effective in meeting requirements

3. Meets technical needs and mission requirements

4. Provides quality services/products

5.

Satisfactory or higher

B. Project Milestones and Schedule

1. Established milestones and project dates are met

2. Products completed, reviewed, delivered in accordance with the established schedule

3. Notifies customer in advance of potential problems

Satisfactory or higher

C. Cost & Staffing 1. Currency of expertise and staffing levels appropriate to perform tasks required

2. Personnel possess necessary knowledge, skills, and abilities to perform tasks

Satisfactory or higher

D. Management 1. Integration and coordination of all activities to execute effort

Satisfactory or higher

The COR will utilize a Quality Assurance Surveillance Plan (QASP) throughout the life of the contract to ensure that the Contractor is performing the services required by this PWS in an acceptable level of performance. The Government reserves the right to alter or change the surveillance methods in the QASP at its own discretion. Contractor performance.

6.5 FACILITY/RESOURCE PROVISIONS

N/A

6.6 GOVERNMENT FURNISHED PROPERTY

6.7 DELIVERY OF LICENSES

Inspection: Destination Acceptance: Destination Free on Board (FOB): Destination

Deliver To and Mark For:

Primary Alternate Name: Provided at Award Name: Provided at Award Address: n/a Address: n/a Voice: Voice:

Email: Email:

ADDENDUM A – ADDITIONAL VA REQUIREMENTS, CONSOLIDATED

A1.0 Cyber and…