Draft Performance Work Statement - Integrated OCDAO Support.docx

Integrated OCDAO Support

VA-27-00011003

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Office of Information & Technology (OIT) Office of the Chief Data and Analytics Officer

Integrated OCDAO Support

Date: 10/30/2026

VA-27-00011003

PWS Version Number: 8.0

Contents

BACKGROUND

The Department of Veterans Affairs (VA), Office of Information and Technology (OIT), Office of the Chief Data and Analytics Officer (OCDAO) is responsible for establishing and maturing VA's enterprise approach to data governance, data architecture, business analytics, and mission-enabling data services in support of the Department's strategic goal of managing data as a strategic asset. VA depends on trusted, well-governed, and readily accessible data to support Veteran-facing benefits and health care delivery, evidence-based policymaking, and sound stewardship of taxpayer resources across the Veterans Health Administration (VHA), Veterans Benefits Administration (VBA), National Cemetery Administration (NCA), and OIT's own enterprise architecture, security, and mission-support functions. This effort supports OCDAO's mission by providing coordinated contractor support across five interdependent work streams: an Enterprise Data & Analytics Integrator function that ensures coherence and non-duplication across the remaining work streams; Business Analytics & Metrics Success Support for the Business Analytics and Metrics Office (BAMO); Data Governance & Management Support for the CDAO Data Management and Governance Office; Enterprise Data Architecture Support for VA's Business Architecture, reference model, and data catalog functions; and Mission Success Support for cross-cutting initiative delivery, road mapping, and enablement. This effort consolidates and continues support currently provided under 36C10X24N0098 (Data Analytics), HUB Operations and Maintenance, and 36C10B26C0092 (Data Analytics Service Line Support).

The scope of this effort reflects the breadth of VA's current data and analytics priorities: implementing Zero Trust-aligned data inventory, classification, and taxonomy practices consistent with OMB Memorandum M-22-09; maturing VA's Enterprise Data Catalog, Enterprise Information Model, and Business Reference Model as authoritative sources for data discovery and governance; sustaining and modernizing existing VA systems and applications that depend on accurate, well-governed data; and supporting VA's capital planning, IT investment management, and financial decision-making processes with reliable analytics and reporting. This work is performed in coordination with, and is intended to complement rather than duplicate, related enterprise functions performed by the Office of Information Security, Infrastructure Operations, and other OIT organizations, consistent with VA's federated governance model in which multiple Administrations and Staff Offices share responsibility for the data they own while OCDAO maintains enterprise-wide standards and oversight.

The Contractor's accountability under this PWS extends beyond individual task completion to measurable progress against four enterprise efficiency principles: (1) Reduce — eliminating duplicative builds, redundant dashboards, and redundant data stores; (2) Reuse — leveraging existing governed and trusted data objects, Enterprise Data Catalog assets, and self-service tools rather than developing parallel solutions; (3) Alignment— aligning to VA's taxonomy, reference models, and Business Reference Model-aligned processes; and (4) Efficiency — demonstrating process, time, and cost savings acrosswork stream activities.

This effort is further intended to evolve VA's management of this contract from activity- and task-based oversight toward outcome-based Program Governance and Performance Management.

APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. “Federal Information Security Modernization Act of 2014”

2. Federal Information Processing Standards (FIPS) Publication 140-3, “Security Requirements for Cryptographic Modules”, March 22, 2019

3. FIPS Pub 199. “Standards for Security Categorization of Federal Information and Information Systems,” February 2004

4. FIPS Pub 200, “Minimum Security Requirements for Federal Information and Information Systems,” March 2006

5. FIPS Pub 201-3, “Personal Identity Verification of Federal Employees and Contractors,” January 2022

6. 10 U.S.C. § 2224, "Defense Information Assurance Program", as amended

7. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

8. Public Law 109-461 (P.L. 109-461), Veterans Benefits, Health Care, and Information Technology Act of 2006, as amended, Title IX, Information Security Matters

9. Public Law 115-435 (P.L. 115-435), Foundations for Evidence-Based Policymaking Act of 2018

10. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”, as amended

11. VA Directive 0710, “Personnel Vetting Program,” September 8, 2025, https://www.va.gov/vapubs/index.cfm

12. VA Handbook 0710, “Personnel Vetting Program,” September 8, 2025, https://www.va.gov/vapubs/index.cfm

13. VA Directive 6102, “Internet/Intranet Services,” August 5, 2019

14. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and Guidelines,” as amended

15. Office of Management and Budget (OMB) Circular A-130, “Managing Federal Information as a Strategic Resource,” July 28, 2016

16. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed Services (CHAMPUS)”, as amended

17. NIST SP 800-66 Rev. 2, “Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule: A Cybersecurity Resource Guide,” February 2024

18. 45 C.F.R Parts 160 and 164, Subparts A and E, the Standards for Privacy of Individually Identifiable Health Information (“Privacy Rule”); and 45 C.F.R. Parts 160 and 164, Subparts A and C, the Security Standard (“Security Rule”); as amended

19. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended

20. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

21. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021 (see VA NOTICE 24-18, dated September 27, 2024, “Update to VA Directive 6500 Cybersecurity Program”, and VA Notice 25-07, dated 3/18/25, “Amending VA Directive 6500 to incorporate M-24-15”)

22. VA Handbook 6500, “Risk Management Framework for VA Information Systems VA Information Security Program,” February 24, 2021 (see VA Notice 25-01, dated October 15, 2024, “Update to VA Handbook 6500 Risk Management Framework for VA Information Systems VA Information Security Program”, and VA Notice 25-06, dated 3/18/25, “Amending VA Directive 6500 to incorporate M-24-15”, VA Notice 25-16, dated September 15, 2025, “Amending VA Handbook 6500 to Replace Enterprise Mission Assurance Support Services Tool With Office of Information Technology Governance Risk Compliance Tool, and VA Notice 25-17, dated September 22, 2025, “Rescission Of Office Of Information Security (OIS) Deputy Assistant Secretary (DAS) Memorandum – Requirements of Proper Plan of Action and Milestones (POA&M) Completion)

23. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI),” June 30, 2023

24. VA Handbook 6500.6, “Contract Security,” March 12, 2010 (see VA Notice 24-12, dated April 22, 2024, “Update to VA Handbook 6500.6, Contract Security, Appendix C VA Information and Information System Security/Privacy Language For Inclusion Into Contracts, As Appropriate”)

25. VA Handbook 6500.8, “Information System Contingency Planning,” March 25, 2025

26. VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018 (see VA NOTICE 25-10, dated June 9, 2025, “Use of Personally Owned Mobile Devices Policy Amendment of Department of Veterans Affairs Handbook 6500.10”, and VA Notice 25-15, dated August 22, 2025, “Update to VA Handbook 6500.10 Mobile Device Security Policy”)

27. VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017

28. OIT Process Asset Library (PAL), OIT Process Asset Library.

29. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

30. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014

31. VA Directive 6510, “VA Identity, Credential and Access Management,” September 3, 2024

32. VA Handbook 6510, “VA Identity, Credential and Access Management,” September 27, 2024

33. VA Directive and Handbook 6513, “Secure External Connections,” October 12, 2017

34. VA Directive 6300, “Records and Information Management,” September 21, 2018

35. VA Handbook, 6300.1, “Records Management Procedures,“ March 24, 2010

36. NIST SP 800-37 Rev 2, “Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy,” December 2018

37. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020)

38. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015

39. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” March 24, 2014

40. OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005

41. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019

42. OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008

43. Federal Identity, Credential, and Access Management (FICAM) Architecture, June 30, 2023 (FICAM Architecture (idmanagement.gov))

44. NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access,“ June 2018

45. NIST SP 800-63 Rev 4, 800-63A-4, 800-63B-4, 800-63C-4, “Digital Identity Guidelines,” August 1, 2025

46. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014

47. VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

48. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

49. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

50. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

51. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019

52. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008

53. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (P.L. 110–140), December 19, 2007

54. Section 104 of the Energy Policy Act of 2005, (P.L. 109–58), August 8, 2005

55. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 2, 2001

56. Executive Order 14148, “Initial Rescissions of Harmful Executive Orders and Actions,” dated January 20, 2025

57. VA Directive 0057, “VA Environmental Management Program,” October 25, 2022

58. OIS VAIQ #7424808 Memorandum, “Remote Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

59. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

60. “Veteran Focused Integration Process (VIP) Guide 4.0,” March 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

61. VA Memorandum “Proper Use of Email and Other Messaging Services,” January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

62. “Product Line Management Transformation Playbook” version 3.1, August 2023, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

63. NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020

64. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol Version 6 (IPv6),” November 19, 2020

65. Social Security Number (SSN) Fraud Prevention Act of 2017

66. Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23, 2018

67. C.F.R Title 15 Part 7, “Securing the Information and Communications Technology and Services (ICTS) Supply Chain”, as amended

68. Executive Order 14028, “Executive Order on Improving the Nation's Cybersecurity,” May 12, 2021, https://bidenwhitehouse.archives.gov/briefing-room/presidential-actions/2025/01/16/executive-order-on-strengthening-and-promoting-innovation-in-the-nations-cybersecurity/

69. OMB Memorandum M-22-09, “Moving the U.S. Government Toward Zero Trust Cybersecurity Principles”, January 26, 2022, https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf.

70. NIST SP 800-52 Revision 2, “Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations

71. OMB M-26-05, “Adopting a Risk-based Approach to Software and Hardware Security,” January 23, 2026

72. OMB M-21-31, “Improving the Federal Government’s Investigative and Remediation Capabilities Related to Cybersecurity Incidents,” August 27, 2021

73. NIST SP 800-88 Revision 1 “Guidelines for Media Sanitization,” December 2014

74. CISA Binding Operational Directive (BOD) 19-02: “Vulnerability Remediation Requirements of Internet-Accessible Systems,” April 29, 2019, BOD 19-02: Vulnerability Remediation Requirements for Internet-Accessible Systems | CISA

75. CISA BOD 22-01: “Reducing the Significant Risk of Known Exploited Vulnerabilities,” November 3, 2021, BOD 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities | CISA

76. CISA BOD 23-01: Improving Asset Visibility and Vulnerability Detection on Federal Networks.” Cybersecurity & Infrastructure Security Agency (CISA), BOD 23-01: Improving Asset Visibility and Vulnerability Detection on Federal Networks | CISA

77. VA Directive 6550, Pre-Procurement Assessment and Implementation of Medical Devices/Systems, June 03, 2019

78. VA Memorandum, “VA Security Controls,” January 17, 2025, https://www.voa.va.gov/DocumentView.aspx?DocumentID=5010

79. E.O. 13960, “Promoting the Use of Trustworthy Artificial Intelligence in the Federal Government,” December 3, 2020

80. E.O. 14319, “Preventing Woke AI in the Federal Government,” July 23, 2025

81. OMB Memorandum M-25-21, “Accelerating Federal Use of AI through Innovation, Governance, and Public Trust,” April 3, 2025

82. OMB Memorandum M-25-22, “Driving Efficient Acquisition of Artificial Intelligence in Government,” April 3, 2025GAO-24-107665, “IT Portfolio Management: Preliminary Results of Federal Efforts to Address Statutory Requirements,” September 20, 2024

83. OMB Memorandum M-26-04, “Increasing Public Trust in Artificial Intelligence (AI) Through Unbiased AI Principles,” December 11, 2025

84. Share IT Act, Pub. L. No. 118‑187, 138 Stat. 2638 (2024).

SCOPE OF WORK

The Contractor shall provide program management, data governance, data architecture, business analytics, and mission-support services to the Office of the Chief Data and Analytics Officer (OCDAO), including cross-work stream integration and coordination; Business Analytics and Metrics Office (BAMO) analytics, dashboard, and business intelligence support; data governance, stewardship, and Enterprise Data Catalog services; Business Architecture refresh, alignment, and reference model management; and mission-enabling initiative delivery, roadmapping, and training and enablement support; software development of large and small applications, including operations and maintenance, help desk, training, and Authority to Operate activities; as further detailed in Section 5.0 of this PWS. The effort provides Integrator coordination across the work streams, and performs defined work stream work. This contract also includes Optional Tasks, including but not limited to supporting VA’s Zero Trust Architecture (ZTA) Data Security Governance and Policy program.

Success under this PWS shall be measured at two levels: (1) task-level deliverable completion and acceptance, as detailed in each subsection of Section 5.0; and (2) mission-level outcomes, which describe the business and Veteran-facing results that task-level work is intended to produce (e.g., business stakeholders using trusted analytics to make decisions; VA data assets being discovered, governed, and reused rather than duplicated). The Contractor's overarching objective — the program's "north star" — is to mature OCDAO's data and analytics capability such that VA's data is trusted, discoverable, non-duplicative, and actively used to improve Veteran-facing outcomes and sound stewardship of taxpayer resources. Mission-level outcome measures are defined through the Enterprise Outcome Framework deliverable in Section 5.2.10.

PERFORMANCE DETAILS

PERFORMANCE PERIOD

The Period of Performance shall be a one-year base period with four one-year option periods:

Base Year: 02/01/2027 - 01/31/2028 Option Period 1: 02/01/2028 - 01/31/2029 Option Period 2: 02/01/2029 - 01/31/2030 Option Period 3: 02/01/2030 - 01/31/2031 Option Period 4: 02/01/2031 - 01/31/2032

There are 11 Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, five are set by date:

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

PLACE OF PERFORMANCE

Tasks under this PWS shall be performed at Contractor facilities. The Contractor shall identify the Contractor’s place of performance in their proposal submission.

TRAVEL

The Government anticipates travel under this effort to perform the tasks associated with the effort, as well as to attend program-related meetings or conferences throughout the PoP. Include all estimated travel costs in your firm-fixed price line items. These costs will not be directly reimbursed by the Government.

The total estimated number of trips in support of the program related meetings for this effort is up to 20 trips per year. Anticipated locations include the following, each estimated at one business day in duration:

Washington, DC

SPECIFIC TASKS AND DELIVERABLES

The Contractor shall perform the following:

PROJECT MANAGEMENT

CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor's approach, timeline, and tools to be used in execution of the contract. The CPMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks, and resource support. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPMP shall be concurred upon and updated in accordance with Section B of the contract. The Contractor shall update and maintain the VA Program Manager (PM) approved CPMP throughout the PoP.

Deliverables:

a) Contractor Project Management Plan

REPORTING REQUIREMENTS

The Contractor shall provide the COR with Weekly Progress Reports in Microsoft Word and Project formats. The report shall include detailed instructions/explanations for each required data element, to ensure that data is accurate and consistent. These reports shall reflect data as of the last day of the preceding Week.

The Weekly Progress Reports shall cover all work completed during the reporting period and work planned for the subsequent reporting period. Additionally, each work stream submits a separate weekly or monthly report as specified in the tasks described throughout Section 5 of this contract. The report shall also identify any problems that arose and a description of how the problems were resolved. The Contractor shall monitor performance against the CPMP and report any deviations.

Deliverables:

a) Weekly Progress Report

ENTERPRISE DATA & ANALYTICS INTEGRATOR (C0)

The Contractor shall serve as the CDAO's enterprise integration layer across the Business Analytics & Metrics Success Support, Data Governance & Management Support, Enterprise Data Architecture Support, and Mission Success Support work streams, ensuring that analytics, governance, architecture, and mission-delivery activities remain interoperable, non-duplicative, and traceable to the CDAO's Mission, Vision, and Operating Tenets. The Integrator has no independent production authority overwork stream deliverables; its role is coordination, quality assurance, and executive visibility.

The Integrator's role under this section extends to outcome governance: the Contractor shall track, aggregate, and report onwork stream progressagainst defined mission outcomes (not solely activity and schedule status), consistent with Section 5.2.10 (Enterprise Outcome Framework & Benefits Realization).

Cross-Work Stream Program Management & Governance Coordination The Contractor shall develop and maintain a master integrated master schedule (IMS) spanning Sections 5.3 through 5.6, track cross-work stream dependencies (e.g., a Business Analytics & Metrics work stream dashboard that depends on a Data Governance & Management work stream certified dataset, which depends on a Enterprise Data Architecture work stream EIM/Taxonomy Business Object), and escalate blocking dependencies to the CDAO. The Contractor shall operate a single enterprise risk and issue register visible to all work stream leads, and shall convene and facilitate a recurring cross-work stream coordination forum.

The Contractor shall deliver the Integrated Master Schedule (IMS) described above for Government acceptance, updated monthly. The Contractor shall deliver the Cross-Work Stream Dependency Register, listing all identified cross-work stream dependencies, their status, and escalation history, for Government review and comment. The Contractor shall deliver the Enterprise Risk/Issue Log reflecting the single enterprise risk and issue register described above, for Government review and comment. The Contractor shall deliver Coordination Forum Minutes following each recurring cross-work stream coordination forum, for Government acceptance.

Deliverables:

a) Integrated Master Schedule Cross-Work Stream Dependency Register

b) Enterprise Risk/Issue Log

c) Coordination Forum Minutes Enterprise Data Flow Analysis & Modeling The Contractor shall execute a four-phase data flow discovery and modeling methodology: Discovery, Artificial Intelligence (AI) -Enabled Analysis, Modeling, and Continuous Observability, across VA's legacy and modern platforms, using VA-approved tools and frameworks (Federal Enterprise Architecture (FEA), The Open Group Architecture Framework (TOGAF), Department of Defense Architecture Framework (DoDAF). This task is the sole owner of the authoritative enterprise data flow inventory; data flow or integration-pattern findings produced under Sections 5.4.3, 5.5.2, or 5.5.4 shall be submitted to this task for incorporation rather than maintained as separate, parallel inventories. The intended AI use is data flow discovery and modeling, and that will use VA-approved AI consistent with Section 6.1.12. The Contractor's use of AI under this task is limited to applying a VA-approved, pre-existing AI/LLM tool to perform data flow discovery and modeling and to generate first-draft documentation; the Contractor is not developing, training, or fine-tuning an AI model under this task. Accordingly, the Contractor shall provide the Section 6.1.12 documentation applicable to an AI tool user, and shall rely on the AI vendor's own disclosures (per Section 6.1.12.1) where development-level detail is requested but not available to a user of the tool. This work shall produce the authoritative enterprise data flow inventory consumed by the work streams under Sections 5.3–5.6: platform integration patterns, lineage and classification, trusted data-object sourcing, and roadmap sequencing, respectively.

· Phase I – Discovery: Stakeholder engagement with the OCDAO and Office of Information Security; SPL query drafting; data acquisition from engineering telemetry sources (e.g., Azure Log Analytics); AI-enabled discovery of Interface Control Documents, Application Programming Interface (API) endpoints, Extract, Transform, Load (ETL) processes, and message queues; Common Information Model (CIM) environment readiness validation.

· Phase II – AI-Enabled Analysis: Schema generation and semantic interpretation; communication pattern summarization; System-of-Record crosswalk against the VA Systems Inventory (VASI) and Business Reference Model (BRM); AI-assisted first-draft data flow documentation; deterministic schema alignment to the Splunk CIM.

· Phase III – Modeling: Import of crosswalk/mapping files into System Architect; generation of standardized information-flow models (source, payload protocol, information exchange mapped to BRM, directionality, method) consistent with DoDAF Operational Activity and Data and Information viewpoints.

· Phase IV – Continuous Observability: Conversion of discovery-phase queries into recurring automated searches; delivery of a macro-level network topology/data-movement dashboard; knowledge transfer to VA Enterprise Architecture and Data Governance teams.

The Contractor shall deliver Knowledge Transfer Package: acceptance of this deliverable shall require Government sign-off against a defined Knowledge Transfer Completion Checklist, to include, at a minimum: (a) a documented handoff session with designated VA Enterprise Architecture and Data Governance personnel; (b) demonstrated personnel competency in operating and interpreting the transferred data flow models, tools, and the Continuous Observability Dashboard; and (c) Government confirmation that all source materials, documentation, and access credentials necessary for VA to independently sustain the transferred capability have been received. The Knowledge Transfer Package deliverable shall not be considered accepted, and payment shall not be authorized, until this checklist has been completed and signed by the COR.

The Contractor shall deliver an Executive-Level Operational Activity Model summarizing enterprise data flow findings for leadership audiences, for Government review and comment. The Contractor shall deliver a Baseline Data Flow Inventory documenting the Phase I–II discovery and analysis results described above, for Government acceptance, updated quarterly thereafter. The Contractor shall deliver the Data Flow Model Package in System Architect format, reflecting the Phase III modeling output, for Government acceptance. The Contractor shall deliver and maintain the Continuous Observability Dashboard described in Phase IV, for Government acceptance. The Contractor shall deliver the Knowledge Transfer Package described above, subject to the Knowledge Transfer Completion Checklist and COR sign-off as a condition of acceptance.

Deliverables:

a) Executive-Level Operational Activity Model

b) Baseline Data Flow Inventory

c) Data Flow Model Package (System Architect format)

d) Continuous Observability Dashboard

e) Knowledge Transfer Package Enterprise Reference Models & Taxonomy Stewardship Oversight While Section 5.5 (C3) performs day-to-day Reference Model Management, the Contractor shall provide the enterprise-level check that any Enterprise Information Model – Taxonomy (EIM/Taxonomy)/Technology Business Management (TBM)/Business Reference Model (BRM)/Data Architecture Capability Model (DACM)/Technical Reference Model (TRM) change proposed under Section 5.5, or any taxonomy proposed under the EDC Content function at Section 5.4, is evaluated for cross-work stream impact before CDAO approval. The Contractor's role under this section is cross-work stream review and the operation of the Three-Tier Taxonomy Service Model described below; the design and substantive development of VA-wide data taxonomy updates is performed under Section 5.5.7, and subject area/information class creation in support of data stewardship onboarding is performed under Section 5.4.5. This section reviews and evaluates those outputs for cross-work stream impact rather than independently authoring them, except where the Three-Tier Service Model assigns a Use Case to the Tier 3 — White Glove/Embedded tier." The Contractor shall maintain a single enterprise version-control ledger of all reference model changes regardless of whichwork stream originated them.

The taxonomy establishes how data is structured and classified so that it can be consistently organized and integrated. The VA-wide taxonomy, the Enterprise Information Model (EIM/Taxonomy), is critical to data findability and to consolidating data across VA under defined subject areas, setting the stage for domain-level standardization and enterprise-wide stewardship.

Three-Tier Taxonomy Development Service Model. To ensure Taxonomy development adequately supports and scales to the VA Enterprise Data Catalog (EDC), the Contractor shall implement and operate a three-tier service model through which Taxonomy Use Cases may develop a taxonomy for their data store(s):

· Tier 1 — Self-Service: The Use Case independently develops its taxonomy using Contractor-developed self-service tools, templates, and guidance, without direct Contractor involvement in taxonomy creation.

· Tier 2 — Consulted: The Contractor provides active consultation support to the Use Case — including working sessions, review, and guidance — to help the Use Case create its taxonomy.

· Tier 3 — White Glove/Embedded: The Contractor directly creates the taxonomy on behalf of the Use Case, in close coordination with the Use Case's data owners and stewards.

The Contractor shall oversee and support implementation of this three-tier service model, including intake and triage of incoming Use Cases to the appropriate tier, tracking of Use Case progress and tier assignment, and coordination with Use Cases and Section 5.4 (EDC Content) to ensure tier assignment and execution remain consistent with EDC intake standards. Anticipated Use Case Counts per year are 5 for Tier 1-Self-Service, 3 for Tier 2-Consulted, and 2 for Tier 3-White Glove/Embedded.

The Contractor shall update existing Self-Service deliverables/tools and shall develop new educational materials to support Use Cases under the Self-Service and Consulted tiers (e.g., guidance such as "How to Write Good Table/Column Descriptions" and "How to Create a Taxonomy for Your Data Store"), enabling a do-it-yourself/consulting-based support model for Taxonomy Use Cases.

Taxonomy Completion Monitoring & Alignment to the VA Enterprise Data Taxonomy. The Contractor shall monitor and track completion of taxonomy development across VA's universe of data stores, regardless of the tier under which each Use Case's taxonomy was developed. For Use Cases that elect the Self-Service tier, the Contractor shall subsequently review the resulting taxonomy — coordinating with the VA Business Architecture team's review, per Section 5.5 — and identify and recommend improvements needed to further align the Use Case's taxonomy to the VA Enterprise Data Taxonomy.

The Contractor shall deliver Reference Model Change Impact Assessments for each EIM/Taxonomy/TBM/BRM/DACM/TRM change proposed under Section 5.5 or taxonomy proposed under Section 5.4, for Government review and comment, prior to CDAO approval. The Contractor shall deliver and maintain the Enterprise Reference Model Version Ledger recording all reference model changes regardless of originating work stream, for Government acceptance. The Contractor shall deliver Three-Tier Taxonomy Service Model Operating Procedures describing intake, triage, and tier assignment, for Government acceptance. The Contractor shall deliver and maintain the Taxonomy Use Case Intake & Tier Tracking Log, for Government review and comment. The Contractor shall deliver Updated Self-Service Taxonomy Tools/Deliverables and Self-Service & Consulted-Tier Educational Materials as described above, for Government review and comment. The Contractor shall deliver a Taxonomy Completion Status Report, tracking completion across VA's universe of data stores, for Government review, delivered monthly. The Contractor shall deliver Self-Service Taxonomy Alignment Review Findings & Recommendations for each reviewed Use Case, for Government review and comment.

Deliverables:

a) Reference Model Change Impact Assessments

b) Enterprise Reference Model Version Ledger

c) Three-Tier Taxonomy Service Model Operating Procedures

d) Taxonomy Use Case Intake & Tier Tracking Log

e) Updated Self-Service Taxonomy Tools/Deliverables

f) Self-Service & Consulted-Tier Educational Materials (e.g., table/column description guidance, data store taxonomy creation guidance)

g) Taxonomy Completion Status Report (VA-wide, by data store)

h) Self-Service Taxonomy Alignment Review Findings & Recommendations (per Use Case) Cross-Work Stream Quality Gate& Standards Compliance Oversight The Contractor shall provide findings, on at least a quarterly basis, of whether data products released by VA Business Lines and/or Program Offices comply with the enterprise's defined dimensions of data quality maintained by the Office of the Chief Data and Analytics Officer (including freshness, lineage, definitional accuracy) and reuse-first principle (e.g., proper reuse of Veteran Object, Employee Object, Facilities Object, etc., rather than duplicative builds, as documented in VA Data Strategy documentation).

Deliverables:

a) Quarterly Quality Gate Compliance Report

b) Duplicative-Build Findings Log Enterprise AI Governance & Data Readiness Support The Contractor shall support VA's AI Data Readiness and Model Defense objectives under OMB Memoranda M-25-21, M-25-22, and M-26-04 by linking Collibra metadata (governed under Section 5.4) to VA's AI Use Case Inventory and mapping which specific data sources feed which AI models, in coordination with the "AI on the data layer" operating tenet (human-in-the-loop, auditable, governed objects only). This task's function is governance and documentation of AI use occurring elsewhere in the enterprise (per the AI Use Case Inventory); it does not itself involve the Contractor developing, training, or deploying an AI model. Where the Contractor uses an AI/LLM tool to perform its own analysis or crosswalk work under this task, such use is limited to a VA-approved existing tool, consistent with Section 6.1.12.

The Contractor shall deliver an AI Data Lineage Map linking Collibra metadata to VA's AI Use Case Inventory, for Government acceptance, updated quarterly. The Contractor shall deliver an AI Use Case-to-Data-Source Crosswalk identifying which data sources feed which AI models, for Government acceptance, updated quarterly.

Deliverables:

a) AI Data Lineage Map

b) AI Use Case-to-Data-Source Crosswalk Executive Reporting & CDAO Leadership Support The Contractor shall consolidate status, risk, and outcome reporting fromall work streamsinto a single executive-level briefing package forOCDAO leadership, and shall support ad hoc leadership data calls that requirecross-work stream synthesis.

Deliverables:

a) Monthly Enterprise Status Briefing

b) Ad Hoc Leadership Data Call Responses Over-Arching Business Architecture Governance & Capital Planning Alignment The Contractor shall establish and operate the over-arching governance function for the Business Architecture (BA), aligning BA priorities, workloads, and artifacts — produced under Sections 5.5.7–5.5.8 — to support OIT IT Business Framework (ITBF) capital planning activities, consistent with GAO's IT Investment Management (ITIM) best practices. This includes coordinating BA-informed input into IT Strategic Planning, Multi-Year IT Planning, and ongoing Capital Planning and Investment Control (CPIC) processes, and supporting GAO FITARA review readiness where BA content is the underlying evidence.

Additionally, the Contractor shall develop an IT Strategic Plan Enterprise Roadmap that aligns BA Business Functions (refreshed under Section 5.5.7) to IT strategic priorities and roadmap focus areas, and shall produce BA Decision Lens extracts — structured summaries of BA content formatted for direct integration into IT Investment scoring models used in CPIC, coordinating with Section 5.2.7 to ensure consistency with over-arching capital planning alignment. The Contractor shall support development of the underlying IT Investment scoring models themselves, incorporating reliance on other functional domain resources (e.g., Human Capital, Acquisition/Contracts) as scoring factors, coordinating with Section 5.5.7 to ensure the scoring models remain consistent with refreshed BA Business Functions and content.

The Contractor shall deliver an Over-arching BA Governance Charter establishing the governance function described above, for Government acceptance. The Contractor shall deliver a CPIC/ITBF Alignment Report, coordinating BA-informed input into IT Strategic Planning, Multi-Year IT Planning, and CPIC processes, for Government review and comment, on a cadence aligned to VA's capital planning cycle. The Contractor shall deliver a FITARA Review Support Package when BA content is the underlying evidence for a GAO FITARA review, for Government review and comment, as needed. The Contractor shall deliver the IT Strategic Plan Enterprise Roadmap, aligning refreshed BA Business Functions to IT strategic priorities, for Government acceptance.

Deliverables:

a) Over-arching BA Governance Charter

b) CPIC/ITBF Alignment Report (recurring, cadence aligned to VA's capital planning cycle)

c) FITARA Review Support Package (as needed)

d) IT Strategic Plan Enterprise Roadmap Business Architecture, IT Service Management (ITSM), Information Technology Infrastructure Library (ITIL), and Data and Analytics Program Maturity Model Assessments The Contractor shall conduct an annual ITSM/ITIL maturity assessment, scored against the ITIL maturity framework, evaluating the maturity of VA's ITSM/ITIL practices independent of the BA ITIM assessment above. The Contractor shall deliver the required Annual ITSM and ITIL Maturity Assessment Report documenting the results, for Government acceptance. This includes an annual maturity model assessment scoring the effectiveness of the Business Architecture program for IT Investment Management, built on GAO's ITIM framework. This is an assessment of the BA governance program itself — distinct from Section 5.2.4's quality-gate auditing of individual data products — and shall be delivered to CDAO leadership alongside recommendations for closing identified maturity gaps.

The Contractor shall conduct an annualProgram Maturity Assessment covering the overall maturity of VA's data and analytics program acrossall work streams, including an assessment of organizational AI readiness. The Program Maturity Assessment shall provide CDAO leadership with a measure of program progress that is independent of individual task or deliverable completion, and shall identify specific maturity gaps and recommended actions for improvement.

The Contractor shall deliver Maturity Gap Remediation Recommendations alongside each maturity assessment, for Government review and comment. The Contractor shall deliver the Annual Program Maturity Assessment Report, covering overall data and analytics program maturityacross all work streamsincluding AI readiness, for Government acceptance.

Deliverables:

a) Annual ITSM and ITIL Maturity Assessment Report

b) Maturity Gap Remediation Recommendations

c) Annual Program Maturity Assessment Report (including AI readiness) CDAO Office Coordination Advisory Support Purpose: The CDAO's office requires dedicated advisory capacity to synthesize cross-work stream activity into leadership-ready coordination products, supplementing — not replacing — the Integrator's program-management functions under Section 5.2.1. This task provides direct advisory support to the CDAO's office function, distinct from Section 5.2.1's schedule/dependency tracking, focused on synthesis, framing, and advisory judgment in support of enterprise decision-making.

Non-Personal-Services Structure: This task shall be performed as a deliverables- and advisory-product-based effort, not as government-directed day-to-day tasking. The estimated volume of memos and framing packages is up to 6 weekly. Consistent with FAR 37.104, the Contractor shall:

1. Perform under the supervision and management of the Contractor's own firm; the Government's role is limited to defining requirements, accepting deliverables, and standard COR oversight — the Government shall not direct the manner, method, or daily schedule of the Contractor's performance.

2. Be described and staffed by functional labor category (e.g., Enterprise Data Governance Advisor), not by reference to, or as a substitute for, any specific VA position or titled government role.

3. Exercise no inherently governmental authority: the Contractor shall provide synthesis, coordination framing, briefing materials, and advisory recommendations only. All decisions, approvals, and direction to Contractor remain with the CDAO, the Integrator lead, or other designated VA officials.

4. Not be co-located or scheduled in a manner indicative of an employer-employee relationship.

Scope of Work: The Contractor shall:

1. Synthesize status, risk, and dependency information already produced under Sections 5.2.1 and 5.2.6 into advisory framing materials suited for CDAO-level decision-making.

2. Prepare pre-read and follow-up materials for recurringcross-work stream governance forumsand leadership briefings, without directing or chairing those forums in a manner that would substitute for VA decision authority.

3. Provide advisory recommendations on prioritization and sequencing conflicts surfaced through the cross-work stream dependency register, for the CDAO's or designated official's consideration and decision.

4. Support ad hoc synthesis requests from the CDAO's office thatspan multiple work streams, on a deliverable/memo basis.

Deliverables:

a) Advisory Synthesis Memos (recurring, aligned to governance forum and leadership briefing cadence)

b) Pre-Read/Decision Framing Packages Ad Hoc Cross-Work Stream Advisory Responses Enterprise Outcome Framework & Benefits Realization The Contractor shall develop and maintain an Enterprise Outcome Framework that: (a) defines program success measures distinct from individual task/deliverable completion; (b) maps work stream activities (Sections 5.2–5.6) to the mission-level outcomes described in Section 3.0; (c) establishes, for each work stream, at least one outcome metric with a defined formula, data source, and measurement cadence, consistent with the Performance Metrics requirements at Section 6.4; and (d) rolls up work stream-level outcome metrics into a single Enterprise Scorecard reported to CDAO leadership, covering measures such as percentage of governed/cataloged data assets, analytics adoption rate, and data/component reuse rate.

Where baseline performance for a given outcome metric has not been established as of contract award, the Contractor shall collect and validate baseline data over a time period not to exceed 12 months in coordination with the Government. During the time period in which baseline data are collected, performance will be measured using the remaining active methods available in the QASP. Following Government validation of each baseline, the Contractor and the Government shall jointly establish at least one annual improvement target per work stream, which shall be incorporated into subsequent performance reviews under Section 6.4.

The Contractor shall conduct a Benefits Realization Review no less frequently than every 6 months (not to exceed 12 months between reviews), assessing,for each work stream outcome metric, whether the associated benefit has been achieved, is in progress, or is at risk, and shall report findings to CDAO leadership alongside the Enterprise Scorecard.

Deliverables:

a) Enterprise Outcome Framework

b) Enterprise Scorecard

c) Baseline Validation Reports (per outcome metric)

d) Benefits Realization Review

BUSINESS ANALYTICS & METRICS SUCCESS SUPPORT (C1)

Analytic Output Categories This section establishes the analytic product lines delivered under BAMO: Data & Business Process Analytics (5.3.1.1), BI & Metrics Development (5.3.1.2), and Financial Management Decision Support (5.3.1.3). All work under this section shall be performed in accordance with the intake, lifecycle, tooling, and governance requirements established at Section 5.3.2.1 (Program/Portfolio Operations); individual subsections below do not restate those requirements but incorporate them by reference. Distinctions among the subsections reflect differences in analytic subject matter and audience, not differences in underlying process or standards of quality.

Data & Business Process Analytics The Contractor shall provide four analytics capabilities, using shared standards, tooling, and lifecycle practices across all of them. Business Process Analytics primarily focuses on ITSM and may require specialized skills, so it may be staffed separately from Diagnostic & Predictive/Prescriptive Analytics. Diagnostic & Predictive/Prescriptive Analytics resources shall support Business Process Analytics as required.:

Diagnostic & Predictive/Prescriptive Analytics. The Contractor shall use governed and curated data to explain why patterns occurred and to look ahead. This includes:

1. root-cause and trend analysis to investigate why observed patterns occurred;

2. forecasting and predictive models, including scenario and what-if analysis, to anticipate future outcomes; and

3. prescriptive recommendations that propose courses of action.

The contractor shall estimate that 3 analyses occur per month. Where AI or machine learning is used under this task, the Contractor's use is limited to applying VA-approved, pre-existing AI/ML tools and models to perform the analyses described above; the Contractor is not developing, training, or fine-tuning an AI/ML model for delivery under this task unless separately authorized in writing by the CO. Any such use shall follow Section 6.1.12.

Business Process Analytics. The Contractor shall measure and improve how ITSM processes perform. This includes:

1. assessing the quality of ITSM data sources and records;

2. analyzing ITSM practices to find inefficiencies, gaps, and improvement opportunities;

3. performing recurring trend and root-cause analysis of ITSM/ITIL practice performance;

4. assessing process capability in line with ISO/IEC 20000-1 and 33020;

5. supporting performance management by defining, tracking, and reporting ITSM metrics and KPIs; and

6. auditing ITSM practices for capability and compliance against ITIL/ITSM standards and VA policy.

Personnel performing this work shall have ITIL/ITSM experience, statistical and analytical proficiency, and ServiceNow platform experience.

The contractor shall estimate that 3 ITSM improvement analyses occur per month.

Bundled Analytics Project Delivery. The Contractor shall provide bundled support for analytics projects, repeated as customer demand requires. Each project answers Key Analytic Questions (KAQs) provided by the customer. The work includes curating and using integrated data objects (both mission/business and ITSM process data), developing analytic products, engaging customers, and applying analytic best practices. The Contractor shall use approved enterprise platforms, including NCVAS/Foundry, Power BI, Tableau, Databricks, Esri ArcGIS, and ServiceNow Performance Analytics.

A KAQ is an open-ended, clear question that a business owner or group wants answered using data, to support…