FINAL SOO VBA-Fraud Waste Abuse Prevention Services-V2-03-17-2025.docx

FINAL - Statement of Objectives (SOO) for the

Fraud, Waste, and Abuse Prevention Services

Date: March 17, 2025 Version 2.0

Department of Veterans Affairs Office of Financial Management (OFM) Benefits Delivery Protection & Remediation (BDP&R) Directorate

Version History

Contents

INTRODUCTION

Through three (3) administrations - Veterans Benefits Administration (VBA), Veterans Health Administration (VHA), and National Cemetery Administration (NCA) - the Department of Veterans Affairs (VA) administers vital services to US Veterans. VA provides benefits programs, health care services, and access to national cemeteries to former military personnel and their dependents.

Within VBA, the Office of Financial Management (OFM) provides strategic planning, oversight, and service delivery to proactively safeguard Veteran benefits and promote fiscal stewardship. In 2018, the Benefits Delivery Protection & Remediation (BDP&R) Directorate was established under the OFM within VBA to support the VBA enterprise in its efforts to reduce the impacts of Fraud, Waste, and Abuse (FWA) on the delivery of Veteran benefits. Through the BDP&R Directorate, VBA has established a permanent and dedicated resource for counter-FWA and risk management support to VBA, including the Lines of Business (LoB) and Staff Offices (SO) responsible for the delivery of benefits and services delivered under the VBA mission: Compensation Service; Education Service; Insurance Service; Loan Guaranty Service; Medical Disability Examination Office; Office of Administrative Review; Outreach, Transition and Economic Development; Pension and Fiduciary Service; Strategic Program Management Office; and Veteran Readiness and Employment. VBA has embraced a novel approach to risk management by investing resources in BDP&R to provide an extra layer of support to the LoBs and SOs in developing and maintaining internal controls over programs, operations, and benefits delivery. BDP&R proactively partners with the business owners to perform risk assessments, followed by deep-dive analyses to determine root causes of risks, and the development of new, or enhancement of existing internal controls to effectively manage risks. BDP&R does not operate from an oversight and compliance position of authority; it is strictly collaborative. This approach aims to improve the VBA ability to detect, prevent, and mitigate FWA. As part of these duties, OFM, BDP&R contracts for specific services to engage industry expertise in advanced analytics and operations.

Over the last decade, there have been ongoing efforts to increase Veteran self-service access for benefits delivery. As ease of access is delivered, it must be balanced with security measures to prevent fraud against Veterans, fraud against the VA, and to ensure sound fiscal stewardship over taxpayer dollars. Modern technology, including artificial intelligence (AI), will advance the VBA’s ability to deliver services and benefits to Veterans, and also enable the VA to more aggressively respond to bad actor fraud. It is estimated that agencies lose an average of between 3 and 7 percent of obligated funds annually to bad actor fraud. Additional losses are derived through waste, improper payments, and abuse. BDP&R seeks innovative solutions to identify, mitigate, and eliminate FWA.

This Request for Information (RFI) describes BDP&R requirements for contractor support related to FWA awareness, prevention, and remediation services. In addition, the purpose of the RFI is to engage industry vendors with expert knowledge and extensive experience as well as with credibility in addressing and mitigating FWA risks. The government seeks innovative solutions from industry to protect Veteran benefits from FWA.

BACKGROUND

In fiscal year 2023 (FY23), BDP&R began creating the BDP&R Strategic Plan Fiscal Years 2025-2028. The strategic planning team conducted an environmental scan to understand leading practices for FWA organizations. The strategic planning team also analyzed the VBA Long-Range Plan and the OFM strategic plan, including the actions assigned to BDP&R. These activities helped the team better understand how BDP&R could support OFM to improve central coordination, focus, integration, analysis, and the championing of counter-FWA solutions at the VBA enterprise level.

The BDP&R mission is to protect the delivery of benefits for Veterans and their families and to ensure good fiscal stewardship of VA resources through prevention, early detection, and timely mitigation of FWA.

The BDP&R vision is to be the Center of Excellence and premier service provider of FWA risk management services and innovative solutions, ensuring the safe delivery of Veteran benefits while also ensuring that the taxpayer dollars assigned to benefit services are not disrupted by FWA activity.

BDP&R works toward its vision of the future while maintaining a commitment to these values:

Veteran Advocacy: Committing to the Mission. Working to serve, support, and advocate for the Veteran.

Fiscal Stewardship: Demonstrating the highest levels of fiscal integrity to protect Veteran benefits funded by the American people from FWA.

Innovation: Advancing state-of-the-art solutions in support of our Mission.

Optimization: The ongoing improvement of products, services, processes, and operations through delivering incremental and breakthrough solutions; and fostering an organizational culture that encourages all employees to practice continuous improvement.

Teamwork: Collaborating and working synergistically to achieve our shared Vision by leveraging individual strengths and contributions.

Lifelong Learning: The ongoing individual and organizational pursuit of knowledge and capabilities in support of the Mission. An organizational culture that recognizes and values the qualities and experiences of its employees and respects the strengths that flow from their unique abilities.

The BDP&R strategic goals are:

Goal 1: Understand and communicate the threat of FWA vulnerabilities and their impact to benefits delivery by fostering organizational awareness and commitment to service delivery capability improvement.

Goal 2: Apply knowledge and innovation to support the development of lean, holistic, and extensible counter-FWA solutions.

Goal 3: Expand services to improve VBA efficiency, timeliness, and accuracy of FWA incident and event response efforts. And, Goal 4: Empower organizational capability, collaboration, transparency, and accountability.

BDP&R delivers its mission through the following core services: Risk Management, Incident and Case Management, Research and Development, Data Analysis, and Education, Outreach, and Communications.

BDP&R CORE SERVICES

Risk Management Research and Development Data Analysis Education, Outreach, and Communications Incident and Case Management

Applicable Documents The Contractor shall comply with the documents listed below. Additional documents may be listed in individual Task Orders.

44 U.S.C. § 3541-3549, “Federal Information Security Management Act (FISMA) of 2002.”

44 U.S.C. § 3551-3558, “Federal Information Security Management Act (FISMA) of 2014.”

Health Insurance Portability and Accountability Act (HIPAA); 45 CFR Part 160, 162, and 164; Health Insurance Reform: Security Standards; Final Rule, February 20, 2003.

36 C.F.R. Part 1194 “Information and Communication Technology Standards and Guidelines,” January 18, 2017.

Sections 524 and 525 of the Energy Independence and Security Act of 2007 (Public Law 110–140), December 19, 2007.

Section 104 of the Energy Policy Act of 2005 (Public Law 109–58), August 8, 2005.

5 U.S.C. § 552a, as amended, “The Privacy Act of 1974.”

Public Law 109-461, “Veterans Benefits, Health Care, and Information Technology Act of 2006, Title IX, Information Security Matters.”

Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended by the Workforce Investment Act of 1998 (P.L. 105-220), August 7, 1998.

36 C.F.R. Part 1194 “Electronic and Information Technology Accessibility Standards, January 18, 2017. (See Addendum D) Section 701 of the Promise to Address Comprehensive Toxics (PACT) Act of 2022 (Public Law 117-168), August 2, 2022.

Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103.

Social Security Number (SSN) Fraud Prevention Act of 2017.

Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23, 2018.

Federal Travel Regulation (FTR). www.gsa.gov/federaltravelregulation Executive Order 13693, “Planning for Federal Sustainability in the Next Decade,” March 19, 2015.

Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 2, 2001.

Executive Order 13834, “Efficient Federal Operations,” May 17, 2018.

Executive Order 13960, “Promoting the Use of Trustworthy Artificial Intelligence in the Federal Government,” December 3, 2020.

Executive Order 14026, “Increasing the Minimum Wage for Federal Contractors,” April 27, 2021.

Executive Order 14028, “Improving the Nation's Cybersecurity,” May 12, 2021.

Executive Order 14034, “Protecting Americans' Sensitive Data from Foreign Adversaries,” June 9, 2021.

Executive Order 14058, “Transforming Federal Customer Experience and Service Delivery to Rebuild Trust in Government,” December 13, 2021. The Green Book | U.S. GAO “Homeland Security Presidential Directive (12) (HSPD-12),” August 27, 2004.

Office of Management and Budget (OMB) Circular A-130, “Managing Federal Information as a Strategic Resource,” July 28, 2016.

OMB Memorandum “Security Authorization of Information Systems in Cloud Computing Environments,” December 8, 2011 (Federal Risk and Authorization Management Program (FedRAMP) Policy Memorandum).

OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005.

OMB Memorandum M-08-05, “Implementation of Trusted Internet Connections (TIC),” November 20, 2007.

OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008.

OMB Memorandum M-04-04, “E-Authentication Guidance for Federal Agencies,” December 16, 2003.

OMB Memorandum M-11-11, “Continued Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” February 3, 2011.

OMB Memorandum M-19-17, “Enabling Mission Delivery through Improved Identity, Credential, and Access Management,” May 21, 2019.

OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019.

OMB Memo M-21-06, “Guidance for Regulation of Artificial Intelligence Applications,” November 17, 2020.

OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol version 6 (IPv6),” November 19, 2020.

OMB Memo M-21-30, “Protecting Critical Software Through Enhanced Security Measures,” August 10, 2021.

OMB Memo M-22-01, “Improving Detection of Cybersecurity Vulnerabilities and Incidents on Federal Government Systems through Endpoint Detection and Response,” October 8, 2021.

OMB Memorandum M-22-09, “Moving the U.S. Government Toward Zero Trust Cybersecurity Principles,” January 26, 2022.

OMB Memorandum for Chief Information Officers, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008.

“Trusted Internet Connections (TIC) Reference Architecture Document, Version 2.2, Federal Interagency Technical Reference Architectures, Department of Homeland Security,” June 19, 2017.

“Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance,” V2.0, December 2, 2011.

“Draft National Institute of Standards and Technology Interagency Report (NISTIR) 798, “Mobile, PIV, and Authentication,” March 2014.

Federal Information Processing Standards (FIPS) Publication 140-2, “Security Requirements for Cryptographic Modules,” May 25, 2001.

FIPS 186-5, “Digital Signature Standard (DSS),” February 3, 2023.

FIPS Publication 199, “Standards for Security Categorization of Federal Information and Information Systems,” February 2004.

FIPS Publication 200, “Minimum Security Requirements for Federal Information and Information Systems,” March 2006.

FIPS Publication 201-3, “Personal Identity Verification of Federal Employees and Contractors,” January 2022.

FIPS Special Publication 800-172, “Enhanced Security Requirements for Protecting Controlled Unclassified Information: A Supplement to NIS Special Publication 800-171,” February 2021.

NIST SP 500-267B Revision 1, ”USGv6 Profile,” November 2020.

NIST SP 800-37, “Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach, Rev. 2,” December 20, 2018.

NIST SP 800-53, “Security and Privacy Controls for Federal Information Systems and Organizations,” May 26, 2022.

NIST SP 800-57, “Recommendation for Key Management,” May 4, 2020.

NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, “Digital Identity Guidelines,” December 1, 2017.

NIST Special Publication (SP) 800-66 Rev 2 (Draft): “An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule,” July 2022.

NIST SP 800-116 Rev. 1, “Guidelines for the Use of PIV Credentials in Facility Access,” June 29, 2018.

NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 19, 2014.

VA Handbook 0710, “Personnel Security and Suitability Program,” May 2, 2016.

VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010. https://www.va.gov/vapubs/index.cfm VHA Directive 1605.05, Business Associate Agreements, November 17, 2020. https://www.va.gov/vhapublications/ViewPublication.asp?pub_ID=9178 VA Directive and Handbook 6102, “Internet/Intranet Services,” August 5, 2019. https://www.va.gov/vapubs/index.cfm VA Directive 6300, “Records and Information Management,” September 21, 2018. https://www.va.gov/vapubs/index.cfm VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021. https://www.va.gov/vapubs/index.cfm VA Handbook 6500, “Risk Management Framework for VA Information Systems – Tier 3: VA Information Security Program,” February 24, 2021. https://www.va.gov/vapubs/index.cfm VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI),” March 12, 2019. https://www.va.gov/vapubs/index.cfm VA Handbook 6500.6, “Contract Security,” March 12, 2010. https://www.va.gov/vapubs/index.cfm VA Handbook 6500.8, “Information System Contingency Planning,” April 6, 2011. https://www.va.gov/vapubs/index.cfm VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018.

VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017.

VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014.

VA Handbook 6508.1, “Procedures for Privacy Threshold Analysis and Privacy Impact Assessment,” July 30, 2015.

VA Directive and Handbook 6510, “VA Identity and Access Management,” January 15, 2016.

A Directive and Handbook 6513, “Secure External Connections,” October 12, 2017.

VA Directive and Handbook 6517, “Risk Management Framework for Cloud Computing,” November 15, 2016.

VA Directive 6609, “Mailing of Sensitive Personal Information,” May 20, 2011.

https://www.va.gov/vapubs/index.cfm VA Handbook 0730, “Security and Law Enforcement,” August 11, 2000. https://www.va.gov/vapubs/viewPublication.asp?Pub_ID=93&FType=2 VA Handbook 0730/1, “Security and Law Enforcement,” August 20, 2004. https://www.va.gov/vapubs/viewPublication.asp?Pub_ID=96&FType=2 VA Handbook 0730/4, “Security and Law Enforcement,” March 29, 2013. https://www.va.gov/vapubs/viewPublication.asp?Pub_ID=700&FType=2 VA Directive 6066, “Protected Health Information (PHI) and Business Associate Agreements Management,” September 2, 2014.

VA Regulation 2022-13312, “Individuals Using the Department of Veterans Affairs’ Information Technology Systems to Access Records Relevant to a Benefit Claim,” June 24, 2022.

“Authorization Requirements Standard Operating Procedures, v1.35,” April 13, 2022.

“BTS Emergency Notification SOP, v2.0,” July 22, 2021.

“Veteran Focused Integration Process (VIP) Guide 4.0,” January 2021. https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371 “One-VA Technical Reference Model (TRM).” https://www.va.gov/trm/TRMHomePage.aspx VA Enterprise Cloud Technical Reference Guide, v2.0, November 2022.

VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015.

VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” March 24, 2014.

VA Enterprise Cloud (VAEC) Technical Reference Guide, July 2018 version 1.

“IAM Identity Management Business Requirements Guidance Document,” May 2013. https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514 VA Memorandum, VA Intranet Quorum (VAIQ) #7100147, “Continued Implementation of Homeland Security Presidential Directive 12 (HSPD-12),” April 29, 2011.

VA Memorandum, VAIQ #7712300, “Mandate to meet PIV Requirements for New and Existing Systems,” June 30, 2015.

VA Memorandum, VAIQ #7660995, “Continuous Diagnostics and Monitoring of all VA Information Systems,” January 29, 2016.

VA Memorandum, VAIQ #7497987, “Compliance – Electronic Product Environmental Assessment Tool (EPEAT) – IT Electronic Equipment,” August 11, 2014 (reference Document Libraries, EPEAT/Green Purchasing Section). https://www.voa.va.gov/documentlistpublic.aspx?NodeID=552 Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote Access,” January 15, 2014. https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 VA Memorandum, VAIQ #7614373, “Implementation of Federal Personal Identity Verification (PIV) Credentials for Federal and Contractor Access to VA IT Systems,” July 9, 2015. https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 VA Memorandum, VAIQ #7613595, “Mandatory Use of PIV Multifactor Authentication to VA Information System,” June 30, 2015. https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 VA Memorandum, VAIQ #7613597, “Mandatory Use of PIV Multifactor Authentication for Users with Elevated Privileges,” June 30, 2015. https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019. https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896 VA Memorandum, VAIQ #7581492, “Use of Personal Email,” April 24, 2015. https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 VA Memorandum VAIQ #7823189, “Updated VA Information Security Rules of Behavior,” September 15, 2017. https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 “Records Control Schedule VB-1,” January 31, 2014.

VA Acquisition Regulation (VAAR) 804.1303, Contract Clause Requiring Compliance with Personal Identity Verification of Contractor Personnel; and VAAR 804.1970, Information Security Policy – Contractor General Responsibilities.

Enterprise Mission Assurance Support Service (eMASS) Authorization Requirements SOP Guide, May 13, 2024.

Artificial Intelligence Risk Management Framework (AI RMF 1.0), NIST AI 100-1, January 2023. Artificial Intelligence Risk Management Framework (AI RMF 1.0) (nist.gov) FWA Overview and SCOPE Fraud, Waste, and Abuse are defined as follows:

· Fraud – Deliberate unlawful action or misrepresentation that causes Veterans or other beneficiaries to suffer monetary losses.

· Waste – Unnecessary costs and spending that result from inefficient or ineffective practices, systems, or controls.

· Abuse – Excessive and improper use or diversion of Veterans Benefits resources.

VBA BDP&R seeks the support of a Contractor with broad and extensive technical expertise and experience within the Federal Government sector in the areas of FWA to provide research, analysis, development, and implementation of solutions and associated services.

FWA Prevention TASKS AND Services Through every task and deliverable, the VBA expectation is that the Contractor demonstrates a commitment to perfecting FWA awareness, prevention, and remediation service delivery through the integration of emerging technology trends and capabilities such as generative AI (Large Language Models and Large Activity Models) for content development and Machine Learning for predictive analytics. Business process improvement focuses on shifting from manual to automated operations and, informed by lessons learned, evolving industry’s leading practices. Stakeholder collaboration is essential to ensuring that FWA awareness, prevention, detection, and remediation services are aligned with the VBA mission and long-term goals. The task areas to be performed under this contract are below:

Contract Project Management and Task Coordination For all work performed under the contract, the Contractor shall provide Project Management and task coordination support services. All activities provided by the Contractor shall be planned, scheduled, tracked, documented, coordinated, and reported on an ongoing basis to the Government to enable the achievement of objectives and timelines.

The Contractor is responsible for all internal task management and oversight to ensure timely service delivery and to demonstrate agility in responding to changing Government priorities. The Government expects the Contractor to provide a single management focal point, the Program or Project Manager, to accomplish the administrative, managerial, and financial aspects of this contract as well as oversee all contractor leads for this contract, and supply other logistical, programmatic, strategic, and tactical support required for full-service delivery.

The Contractor shall adhere to industry leading practices to support, facilitate, and/or execute each of the following tasks and deliverables for each BDP&R supported project for this contract.

Project Management Plan (PMP) The Contractor shall submit a detailed Project Management Plan (PMP) and briefing for the project team within fourteen (14) calendar days after the effective award date. The PMP is considered a living document that may require revision and updates with Government approval over the duration of the contract period-of-performance. In addition, the Contractor shall provide regular briefings and/or demos to VBA leadership and other key stakeholders on project progress, outcomes, and dependencies.

· The PMP shall include the Contractor plan for completing the contract, describing for each specific task and subtask the technical approach, management plan, organizational structure, specific personnel levels and specializations, and management controls that will meet Statement of Objectives (SOO).

· The Contractor shall keep the PMP up to date throughout the period of performance and report changes in the monthly report. Regular updates are to be submitted as part of monthly progress reporting, focused on lessons learned and areas for process optimization.

· The Contractor shall provide administrative support to BDP&R organizations for the work associated with this contract by including editing, writing, reviewing documents, schedule management, producing meeting minutes, and scheduling meetings using Outlook. Meeting minutes must be submitted to the appropriate POC within three (3) calendar days as needed.

Kickoff Meeting The Contractor shall hold a technical kickoff meeting in-person within ten (10) calendar days after the award, after which performance may commence. The Contractor shall specify dates for the kickoff meeting and provide an agenda to all attendees at least two (2) calendar days prior to the meeting. The Contractor shall invite the Contracting Officer (CO), Contract Specialist (CS), the Contracting Officer’s Representative (COR), and other BDP&R-identified individuals to the kickoff meeting and shall provide meeting minutes for all attendees within three (3) calendar days after the meeting.

Project Management Monthly Progress Reporting The Contractor shall submit a Monthly Progress Report (MPR) on its work from a contractual and project management perspective. All monthly reports shall be sent to the COR by the 5th of each month. The reports shall cover work completed in the previous month, and work planned for the current month. The MPR shall include:

· The staffing and hiring plan and ongoing roster updates defining the roles and responsibilities for all personnel supporting the contract, including an onboarding plan consistent with VA policies.

· The Contractor’s operations report with the operational trends over time.

· The Contractor Privacy and Security Training report and ongoing updates.

· Products or results delivered during the report month in service areas addressed by the contract to include a deliverable matrix with status of all deliverables for the reporting period.

· Report on activities, including hours and labor rates for completed and upcoming tasks, accomplishments, and shortfalls.

· Description of problems that arose; how the problems were resolved or how they are planned to be resolved, along with the resolution timeline; and lessons learned.

· Activities planned for the next reporting period.

· Invoice Reconciliation Report.

The Contractor shall deliver documentation in electronic format. Acceptable electronic media include current and future versions of Microsoft Office Suite Applications and Adobe DC (PDF).

FWA Risk Management VBA pays more than $200 Billion annually in benefits and services to Veterans and beneficiaries. It is crucial to have proactive actions to identify, analyze, mitigate, and resolve risks that impact Veterans and VBA, and measure and report on the return on investment of solutions. As noted in the introduction, this is not an activity related to oversight and compliance; the objective is to provide services to work collaboratively with the business owners of VBA programs and services to determine the risks, size, and category of threats and vulnerabilities, estimate impacts, develop solutions, create awareness, and prioritize response planning across all benefits and services administered by VBA. In addition to VBA FWA risk management activities, the Government seeks Contractor support to enhance existing operations and provide new approaches to risk management activities that are consistent with VA risk management policy and guidance.

Risk Research The objective is to provide risk research for assessing and identifying the probability and magnitude of harm caused by FWA, and to identify mechanisms utilized by industry to mitigate potential harm.

Risk Analysis The objective is to analyze the risk of the existing systematic processes for identifying, assessing, and prioritizing potential risks, consistent with VA risk management policy and guidance. The Contractor will propose approaches for the maturation and enhancement of the current processes. This service shall include analyzing risk likelihood and impact, as well as proposing, for approval, risk strategies that minimize risk levels (probability of occurrence, impact) or harm as well as determining and monitoring measures of effectiveness.

Risk Assessment The objective is to identify appropriate resources (e.g., human, information technology, partnerships) needed to achieve proactive risk mitigation supporting improvements in assessments and analytic efforts.

Risk Monitoring The objective is to propose for approval and provide risk monitoring in support of the government’s framework for remaining aware of its risk exposure and risk types. This also includes implementing a supporting risk management system and activities that inform the government’s risk decision-making for FWA.

FWA Incident and Case Management The objective is to respond to a fraud incident in a manner that eliminates, negates, or decreases Veteran and customer impact. The Government is currently monitoring Veteran benefits payments made via direct deposit for fraudulent activity (payment redirection), which occurs when fraudsters submit fraudulent forms, or call VA Contact Centers, or through online form submissions. Over the last few years, improvements have been made to detect and prevent fraudulent redirections through a proactive approach of monitoring with various Machine Learning and other monitoring scripts to identify suspected fraudulent activity. The Contractor incident review team supports the Government with an initial review and assessment of data and other information of record within VBA systems to aid in the validation of referrals resulting from script and model referrals. In addition to continuing this service, the Government seeks expertise to work with private industry, to include but not limited to the banking industry, to interface on behalf of the Government with financial crime loss prevention groups.

Incident Referral Intake and Life Cycle Management The objective is the monitoring of potential referral intake of cases through the case queue and other channels. The actions include reviewing data and information provided in the referral and confirming that required data points are captured, as well as maintaining an efficient intake process to ensure appropriate routing and operational efficiency.

Incident Case Investigation The objective is assessing incidents, and collecting and analyzing data to conduct case investigations for fraud, including but not limited to:

· Receiving potential fraud cases reported by Veterans to VBA, identifying data relevant to the potential case, and providing the bundled information to VBA.

· Identifying potential fraud cases not reported by Veterans by proactively analyzing and mining data in VA systems and open sources and providing the potential cases to VBA.

· Identifying potential data errors and/or anomalies associated with a Veteran and working with BDP&R to resolve and/or correct the issue.

· Providing ad-hoc investigative support for VBA and the Office of Inspector General (OIG), e.g., Social Security Administration (SSA) Death Match and Connected Case Analysis.

· Increasing process accuracy by improving the standardization and completeness of bundled information to make an initial determination whether the potential case is workable or not. Workable cases are given a higher priority for faster processing. Working with VBA to establish an agreement on the definition of a workable case and to establish which potential cases should be sent to VBA.

FWA Research and Development The Government is in the early stages of setting up a research and development center to identify, size, scope, and propose solutions for FWA across all VBA programs and services. To achieve its desired state, the Government envisions utilizing modern technology including but not limited to AI and working collaboratively with other federal agencies/private industry/law enforcement to effectuate change that results in visibility, measurability, and accountability for the known and unknown fraud within VBA, and better control over waste and abuse resulting from gaps in oversight, policy, processes, and systems used to deliver benefits and services to Veterans. The Government seeks to employ and apply private sector tools and modern technology, computer, and traditional forensics capabilities and expertise to:

· Identify and assess FWA threats and vulnerabilities,

· Assist in the development and testing of technical, non-technical, and hybrid FWA risk solutions,

· Assist in the preparation of suspected fraud evidence packages to provide the OIG reports and recommendations for VBA stakeholders and other customers.

Basic Research Management The basic research objective is to provide solution design, coordination, delivery and implementation management, and solution performance and outcomes coordination, tracking, and modifications for continuous improvement in FWA risk topic areas determined by the government. Conducting risk topic research and data gathering will include research analysis and theory formulation for developing risk solutions.

Applied Research Management The applied research objective, consistent with basic research analysis activities, is to assess collected information and to assist in formulating FWA problem statements. Research tasks, methods, and plans should include an approach for data collection, analysis, interpretation, and solution hypothesis formulation.

Experimental Development The objective of experimental development is to provide FWA risk solution support and services to include solution objective definition and experimental design, concept research and design, internal testing and validation, and acceptance testing and approval.

Production and monitoring The objective is to provide support and services in production and monitoring to include solutions technical management, iterative solution development and delivery, and solution lifecycle management and monitoring.

FWA Data Analysis The Government requires support to examine and use data; conduct standard data mining, ad-hoc data/research requests, environmental scans, and basic data/comparative analysis to test theories; and to engage with VBA business lines and stakeholders to enhance decision making. There is a series of Machine Learning models and scripts in operation to monitor and control various VBA programmatic risks, including suspected fraud incidents, improper payments, and employee errors.

The Government seeks industry expertise to grow and enhance detection capabilities and expand its use of VA/VHA/VBA databases/interagency data/public data to identify threats and vulnerabilities and develop solutions for detection, avoidance, and mitigation. The Government seeks expertise with integration of emerging technology trends and capabilities such as AI (Large Language Models and Large Activity Models) for content development and Machine Learning for predictive analytics, and expertise from industry to support shifting from manual to automated operations into a cloud environment as well as adding defensive tools to match and counter how generative AI has changed the security landscape. There is a need to identify and propose options for combining data across VBA programs and databases within VA coupled with the use of public data to facilitate advanced analytics aimed at identifying threats and vulnerabilities contributing to FWA.

Data Analytics Request Intake Management The objective is to identify, request, and obtain data regarding known and suspected cases and methods of FWA and obtain data in response to targeted requests for investigation.

The objective is to integrate data from multiple VA sources, as required, including:

· Identifying and proposing options for combining data across programs and separate databases within VA to facilitate analytics and increase the availability of comprehensive eligibility documentation.

· Identifying and proposing options for reporting alternative (e.g., non-claims- based) data that could be used to facilitate analytics.

Data Analytics Management The objective is to establish or streamline business procedures and processes to facilitate data requests and streamline or establish a self-service framework and business rules for requesting access to data, increased access to information, a better knowledge repository, and improved data integration tools to enhance ease of access to databases and datasets.

Data Analytics Tools Management The objective is to build models and scripts and standardize the process to review developed models and scripts. The Contractor will build or improve Standard Operating Procedures (SOPs) for building dashboards that align with industry leading practices for user interface and user experience and with VBA’s accessibility standards and processes for performing self-service extraction from the dashboards.

Solution Delivery Management The objective is to support BDP&R’s customers in preparing documentation of existing or new processing of solutions such as business cases, charters, planning documents, and presentations identifying key information, and take actions necessary such as assistance in navigating the approval process. The existing process may change as VBA is developing a future-state business architecture and the Contractor may be required to provide recommendations for implementing the future state. The solutions supported will assist in delivering effective results to the customer, with all necessary components and information for independent utilization. The Contractor may find it necessary to provide training and educational resources to individuals within the customer’s organization on how to effectively use and apply a selected solution.

FWA Education, Outreach, and Communications The objective is to provide services to promote broad FWA awareness and education, increasing stakeholder interest in, and ownership of, addressing FWA issues. The Government has implemented an education and outreach service to raise awareness about FWA impacting Veterans and VBA. Current efforts have focused on raising awareness about fraud against Veterans. This has been done through fostering stakeholder relationships and conducting targeted outreach and communication campaigns designed to alert and educate Veterans about prevalent fraudulent schemes and predatory actors. The communications strategies include social media posts, blog articles, interviews, presentations, and Gov Delivery and VA Newsletters, amongst others. The Government seeks expertise to provide innovation including but not limited to content creation and development/graphic design/public relations/advertising to enhance current-state operations through innovations from private industry and to expand its capabilities to include training and education for VBA employees and other stakeholders.

Communications and Outreach Assessment The objective is to provide research and analysis on the effectiveness and breadth of communications and outreach activities to specified audience demographics. The analysis shall evaluate such factors but is not limited to the effects of the activities on the VA website traffic related to FWA, on Contact Us interactions, and on VBA satisfaction measures. The services include proposing improvements based on the analyses, as the information and requirements evolve, to the content of the messaging and the type of outreach used on the delivery of VBA services and analyzing the effectiveness of changes that are implemented.

Communications Strategy Support The objective is to support BDP&R’s communications strategy to engage each FWA stakeholder or group and fulfill the communication needs of BDP&R. The services include supporting communication goals, stakeholder identification, analysis, and approaches and plans for communication, which may include:

· Support the development of short- and long-term communication strategies.

· Support efforts to align communication objectives with overall organizational strategies.

· Support the development and management of a multi-channel communications strategy.

· Support efforts to conduct in-depth audience segmentation for targeted messaging.

· Support efforts to develop and manage communications calendars across stakeholders.

· Develop and track Key Performance Indicators (KPIs) for communication efforts.

· Support efforts to identify and mitigate potential communication risks.

· Support stakeholder engagement strategies.

· Support crisis communication protocols designed specifically for fraud-related incidents.

FWA Performance Reporting The objective is reporting on relevant metrics, including, but not limited to: instances of fraud, the results of investigations into fraud, monitoring plans, resolution time (average number of days to resolve an issue), investigation cost (resource hours and costs), repeat incidents (number of current-period incidents that are similar in nature to incidents in earlier periods), incident location (number of incidents in a specific business unit, operational area, or geography), value of losses recovered and future losses prevented, corrective actions (type of remediation and implementation date), and analytic agility (cycle time between discovery of a new fraud pattern and the subsequent adjustments to fraud algorithms).

Data Scripts and Models Transition-In The objective and expectation are that the Contractor shall transition-in all risk assessments, outreach and education campaigns, data scripts and models, and any and all other ongoing efforts as required from the incumbent contractor. Upon award of this contract, the Government will facilitate meetings between the Contractor and the incumbent contractor to review the scripts and models to be transitioned. The Contractor shall analyze these materials for utility and detail the results in a Utility Report.

Data Scripts and Models Transition-Out The Contractor shall develop a Transition-out plan to affect a smooth and orderly transfer of contract responsibility to a successor team. Any data sets and tools purchased by the Contractor are the property of the Government. The plan shall fully describe the Contractor’s approach to the following issues, at a minimum: inventories and turnover of government property, removal of Contractor property, reconciliation of all property accounts, turn-in of excess property, data and information transfer, clean-up of Contractor work areas, and any other actions required to ensure continuity of operations.

Key Personnel and work control Key Personnel Certain skilled experienced professional and/or technical personnel are essential for accomplishing the work to be performed. These individuals are defined as “Key Personnel” and are those persons whose résumés are submitted and marked by the Contractor as “Key Personnel.”

The Government believes the following key positions are needed and, in consideration of the requirements, requests the Contractor provide a proposed profile of the skillsets and experience aligned with the appropriate proposed GSA Labor Categories:

1) Project Manager

2) Assistant Project Manager

3) Data Engineer

4) Data Architect

5) FWA Subject Matter Expert (SME) (experienced with Government Agency work)

6) Financial Crimes SME (on-call – experienced with Government Agency work)

7) Communications SME (on-call)

8) Graphic Designer and Content Creation SME

9) Videographer (on-call)

10) Instructional Design/Training SME (on-call)

11) Editor (on-call – experienced with 508 accessibility compliance and multilingual translation); and

12) Media Analyst (on-call – research digital landscape to identify fraudulent vulnerabilities and publications trends)

13) Risk Assessor/Analyst (on-call)

14) Policy Analyst (on-call) Work Control All program requirements, contract actions, and data interchange shall be conducted in a digital environment using electronic and web-based applications. At minimum, such data shall be compatible with the Microsoft Office 2010® family of products, Microsoft Windows 10 products, and Adobe Portable Document Format (PDF). In coordination with the Contractor PM, a standard naming convention for all electronic submissions shall be determined within 60 calendar days after award.

General Requirements The general requirements and terms of this contract are specified below and through various sections of this document:

Contract Type This is a firm fixed-price effort.

Ordering Period The ordering period for the basic contract shall be a one (1) year base period followed by four (4) one (1) year option periods.

Work at a Government site shall not take place on Federal holidays or weekends unless directed by the CO. Hours of work will be established at the award. The Contractor may also be required to support 24/7 operations 365 days per year.

There are 11 Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, five are set by date:

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six (6) are set by a day of the week and month:

Place of Performance The place of performance shall be identified at Government and Contractor sites within the Continental United States (CONUS). No work shall be performed outside of the Continental United States (OCONUS). Work may be performed at either a government or non-government facility. All work is anticipated to be performed within CONUS. Exceptions are to be approved by the CO/COR.

Travel Travel shall be in accordance with (IAW) requirements. Travel details must be provided to and approved by the COR or the Government designee prior to the commencement of travel. All travel shall be IAW Federal Acquisition Regulation (FAR) 31.205-46.

Safety and Environmental Safety and environmental procedures shall be identified and the Contractor shall comply with the Office of Federal Sustainability Acquisition and Electronics Stewardship initiatives as identified IAW the policies referenced at https://www.sustainability.gov/resources-eo-efo.html.

Materials, Equipment, and Locations Government-Furnished Government Furnished Property (GFP), which includes Government Furnished Material (GFM), Government Furnished Information (GFI), and Government Furnished Equipment (GFE), may be provided and shall be identified in coordination with the COR. The Contractor shall be responsible for conducting all necessary examinations, inspections, maintenance, and tests upon receipt.

VA will provide VA-specific system access as appropriate and required. Contractors shall comply with VA security policies and procedures with respect to protecting sensitive data.

Contractor-Acquired The Contractor shall acquire and provide any hardware and software, when necessary, that is not…