36C24120Q0264-004.docx

ADDENDUM A

GENERAL REQUIREMENTS

The Contractor shall provide and/or acquire the services, hardware, and software required by individual Task Orders pursuant to the general requirements specified below.

Contract Type This is an Indefinite Delivery/Indefinite Quantity (IDIQ) Multiple Award Task Order (MATO) contract. Individual Task Orders shall be issued on a performance-based T&M, CR, and/or FFP basis.

Ordering Period The ordering period for the basic contract shall be five years with one five-year option.

Hours of Work Work at a Government site shall not take place on Federal holidays or weekends unless directed by the CO. The Contractor may also be required to support 24/7 operations 365 days per year as identified in individual Task Orders.

There are ten (10) Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, four are set by date:

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

Place of Performance The place of performance shall be identified in individual Task Orders. Locations will be Government or non-Government sites within the continental United States (CONUS) and/or outside the continental United States (OCONUS). Locations may include but are not limited to Federal, State, VA, or military data centers, facilities, regional offices, benefits delivery centers, medical treatment facilities, health clinics and Tricare facilities as defined in individual Task Orders.

Travel Travel shall be IAW individual Task Order requirements. Travel details must be provided to and approved by the CO’s Representative (COR) or the Government designee prior to the commencement of travel. All travel shall be IAW the Federal Travel Regulations (FTR). OCONUS travel may require additional authorization and approvals as specified in the individual Task Order.

Materials, Equipment and Locations

Government-Furnished Government Furnished Property (GFP) which includes Government Furnished Material (GFM), Government Furnished Information (GFI), and Government Furnished Equipment (GFE) may be provided and shall be identified in the individual Task Order. The Contractor shall be responsible for conducting all necessary examinations, inspections, maintenance, and tests upon receipt. The Contractor shall be responsible for reporting all inspection results, maintenance actions, losses, and damage to the Government through the VA Technology Acquisition Center (TAC) website.

VA may provide VA specific software as appropriate and required in individual Task Orders. The Contractor may utilize VA provided software development and test accounts, document and requirements repositories and others as required for the development, storage, maintenance and delivery of products. Contractors shall comply with VA security policies and procedures with respect to protecting sensitive data. See Section 6.0 for detailed security requirements.

Contractor-Acquired The Contractor shall acquire and/or provide any hardware and/or software required to accomplish each Task Order that is not provided as GFP. Software integrity shall be maintained by the Contractor within the licensing agreement of the producer until such software is delivered to the Government, or otherwise disposed of IAW Government direction. Items delivered to the Government shall be approved by the Government in advance of purchase and shall be in compliance with PWS paragraphs 3.8 and A3.0. See Section 6.0 for detailed security requirements.

Non-Developmental Items and Commercial Processes Non-Developmental Items (NDI), Commercial-Off-The-Shelf (COTS) and Government-Off-The-Shelf (GOTS) products shall be used to the maximum extent. The Contractor shall apply commercially available and industry best processes, standards and technologies to the maximum extent.

Connectivity VA will provide connectivity to VA specific systems/network as required for execution of the task via VA approved remote access technology. Currently this may include but is not limited to Citrix Access Gateway (CAG), site-to-site VPN, or VA Remote Access Security Compliance Update Environment (RESCUE). This remote access will provide connectivity to VA specific software such as Veterans Health Information System and Technology Architecture (VistA), ClearQuest, PAL, Primavera, and Remedy, including appropriate seat management and user licenses. VA may install equipment at the Contractor’s site to ensure security requirements are in place. The Contractor must meet the requirements of VA Handbook 6500 and will bear the cost to provide connectivity to VA. Other connectivity to VA systems may be authorized as appropriate in individual Task Orders.

Facilities Work may be performed at either a Government or non-Government facility. Each Task Order shall delineate the location requirements.

1.1.1.1 Government Facilities

Certain Government office or laboratory space may be made available for performance of individual Task Orders. Contractors may be required to establish operations and support Government locations and shall comply with VA and/or Federal assessment and authorization (A&A) requirements. Such facilities shall be specified in the individual Task Order.

1.1.1.2 Non-Government Facilities

Personnel may perform at Contractor or remote facilities if specified in the individual task order. Contractors may be required to establish operations and support Contractor facilities and shall comply with VA and/or Federal A&A requirements. Such facilities shall be specified in the individual Task Order. The Contractor shall disclose specific facility information during the Request for Task Execution Plan (RTEP) process. All facilities shall be approved by VA and in compliance with PWS paragraph 6.0, Security and Privacy.

Warranty Items acquired under this contract may require warranty protection. Commercial warranties shall be transferred to the Government. The type of warranty and extent of coverage shall be determined on an individual Task Order basis.

Marking, Handling, Storage, Preservation, Packaging, Tracking & Shipping The Contractor shall establish/maintain procedures IAW VA Handbook 6500 and VA Directive 6609 for handling, storage, preservation, packaging, marking, tracking and shipping to protect the quality of products and prevent damage, loss, deterioration, degradation or substitution of products.

Export Control The Contractor shall comply with all applicable laws and regulations regarding export-controlled information and technology and shall not use, distribute, transfer or transmit technology (even if incorporated into products, software or other information) except in compliance with such laws and regulations. In addition, the Contractor shall plan for, obtain, and maintain any and all export licensing required to satisfy individual Task Order requirements.

Safety and Environmental Safety and environmental procedures shall be identified in individual Task Order requirements.

The Contractor shall comply with the Office of Federal Sustainability Acquisition and Electronics Stewardship initiatives as identified in individual Task Orders IAW the policies referenced at https://www.sustainability.gov/resources-eo-efo.html

Enterprise and IT Framework VA Technical Reference Model For VA specific task orders, the Contractor shall support the VA enterprise management framework. In association with the framework, the Contractor shall comply with OI&T Technical Reference Model (VA TRM) and consider the VA Enterprise Technology Strategic Plan. The VA TRM is one component within the overall Enterprise Architecture (EA) that establishes a common vocabulary and structure for describing the IT used to develop, operate, and maintain enterprise applications. Moreover, the VA TRM, which includes the Standards Profile and Product List, serves as a technology roadmap and tool for supporting OI&T.

Federal Identity, Credential, And Access Management (FICAM)

The Contractor shall ensure Commercial Off-The-Shelf (COTS) product(s), software configuration and customization, and/or new software are Personal Identity Verification (PIV) card-enabled by accepting HSPD-12 PIV credentials using VA Enterprise Technical Architecture (ETA), https://www.ea.oit.va.gov/EAOIT/VA_EA/Enterprise_Technical_Architecture.asp, and VA Identity and Access Management (IAM) approved enterprise design and integration patterns, http://www.techstrategies.oit.va.gov/enterprise_dp.asp. The Contractor shall ensure all Contractor delivered applications and systems comply with the VA Identity, Credential, and Access Management policies and guidelines set forth in the VA Handbook 6510 and align with the Federal Identity, Credential, and Access Management Roadmap and Implementation Guidance v2.0.

The Contractor shall ensure all Contractor delivered applications and systems provide user authentication services compliant with the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-63-3, VA Handbook 6500 Appendix F, “VA System Security Controls,” and VA IAM enterprise requirements for direct, assertion based authentication, and/or trust based authentication, as determined by the design and integration patterns. Direct authentication at a minimum must include Public Key Infrastructure (PKI) based authentication supportive of PIV card and/or Common Access Card (CAC), as determined by the business need.

The Contractor shall ensure all Contractor delivered applications and systems conform to the specific Identity and Access Management PIV requirements set forth in the Office of Management and Budget (OMB) Memoranda M-04-04, M-05-24, M-11-11, and NIST Federal Information Processing Standard (FIPS) 201-2. OMB Memoranda M-04-04, M-05-24, and M-11-11 can be found at: https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/omb/memoranda/fy04/m04-04.pdf, https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/omb/memoranda/fy2005/m05-24.pdf, and https://obamawhitehouse.archives.gov/sites/default/files/omb/memoranda/2011/m11-11.pdf respectively. Contractor delivered applications and systems shall be on the FIPS 201-2 Approved Product List (APL). If the Contractor delivered application and system is not on the APL, the Contractor shall be responsible for taking the application and system through the FIPS 201 Evaluation Program.

The Contractor shall ensure all Contractor delivered applications and systems support:

1. Automated provisioning and are able to use enterprise provisioning service.

2. Interfacing with VA’s Master Veteran Index (MVI) to provision identity attributes, if the solution relies on VA user identities. MVI is the authoritative source for VA user identity data.

3. The VA defined unique identity (Secure Identifier [SEC ID] / Integrated Control Number [ICN]).

4. Multiple authenticators for a given identity and authenticators at every Authenticator Assurance Level (AAL) appropriate for the solution.

5. Identity proofing for each Identity Assurance Level (IAL) appropriate for the solution.

6. Federation for each Federation Assurance Level (FAL) appropriate for the solution, if applicable.

7. Two-factor authentication (2FA) through an applicable design pattern as outlined in VA Enterprise Design Patterns.

8. A Security Assertion Markup Language (SAML) implementation if the solution relies on assertion based authentication. Additional assertion implementations, besides the required SAML assertion, may be provided as long as they are compliant with NIST SP 800-63-3 guidelines.

9. Authentication/account binding based on trusted Hypertext Transfer Protocol (HTTP) headers is the solution relies on Trust based authentication.

10. Role Based Access Control.

11. Auditing and reporting capabilities.

12. Compliance with VAIQ# 7712300 Mandate to meet PIV requirements for new and existing systems. https://www.voa.va.gov/DocumentView.aspx?DocumentID=4846

The required Assurance Levels for this specific effort are Identity Assurance Level 3, Authenticator Assurance Level 3, and Federation Assurance Level 3.

Internet Protocol Version 6 (Ipv6) The Contractor solution shall support the latest Internet Protocol Version 6 (IPv6) based upon the directives issued by the Office of Management and Budget (OMB) on August 2, 2005 (https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/omb/memoranda/fy2005/m05-22.pdf) and September 28, 2010 (https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/egov_docs/transition-to-ipv6.pdf). IPv6 technology, in accordance with the USGv6 Profile, NIST Special Publication (SP) 500-267 (https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication500-267.pdf), the Technical Infrastructure for USGv6 Adoption (https://www.nist.gov/programs-projects/usgv6-program), and the NIST SP 800 series applicable compliance () shall be included in all IT infrastructures, application designs, application development, operational systems and sub-systems, and their integration. In addition to the above requirements, all devices shall support native IPv6 and/or dual stack (IPv6 / IPv4) connectivity without additional memory or other resources being provided by the Government, so that they can function in a mixed environment. All public/external facing servers and services (e.g. web, email, DNS, ISP services, etc.) shall support native IPv6 and/or dual stack (IPv6/ IPv4) users and all internal infrastructure and applications shall communicate using native IPv6 and/or dual stack (IPv6/ IPv4) operations. Guidance and support of improved methodologies which ensure interoperability with legacy protocol and services in dual stack solutions, in addition to OMB/VA memoranda, can be found at: https://www.voa.va.gov/documentlistpublic.aspx?NodeID=282.

Trusted Internet Connection (TIC) The Contractor solution shall meet the requirements outlined in Office of Management and Budget Memorandum M08-05 mandating Trusted Internet Connections (TIC) (https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/omb/memoranda/fy2008/m08-05.pdf), M08-23 mandating Domain Name System Security (NSSEC) (https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/omb/memoranda/fy2008/m08-23.pdf), and shall comply with the Trusted Internet Connections (TIC) Reference Architecture Document, Version 2.0 https://www.dhs.gov/sites/default/files/publications/TIC_Ref_Arch_v2.2_2017.pdf.

Standard Computer Configuration The Contractor IT end user solution that is developed for use on standard VA computers shall be compatible with and be supported on the standard VA operating system, currently Windows 7 (64bit), Internet Explorer 11 and Office 365 ProPlus. In preparation for the future VA standard configuration update, end user solutions shall also be compatible with Windows 10. However, Windows 10 is not the VA standard yet and is currently approved for limited use during its rollout. We are in-process of this rollout and making Windows 10 the standard for OI&T. Upon the release approval of Windows 10 as the VA standard, Windows 10 will supersede Windows 7 respectively. Applications delivered to the VA and intended to be deployed to Windows 7 workstations shall be delivered as a signed .msi package with switches for silent and unattended installation and updates shall be delivered in signed .msp file formats for easy deployment using System Center Configuration Manager (SCCM) VA’s current desktop application deployment tool. Signing of the software code shall be through a vendor provided certificate that is trusted by the VA using a code signing authority such as Verizon/Cybertrust or Symantec/VeriSign. The Contractor shall also ensure and certify that their solution functions as expected when used from a standard VA computer, with non-admin, standard user rights that have been configured using the United States Government Configuration Baseline (USGCB) and Defense Information Systems Agency (DISA) Secure Technical Implementation Guide (STIG) specific to the particular client operating system being used.

Enterprise Management Framework The Enterprise Management Framework (EMF) provides an enterprise-wide view of VA IT systems comprised of tools, reports, databases, dashboards, and analytics. EMF enables OI&T to view the health and performance of systems and provides intelligent analysis and trending that enables proactive enterprise system management. Performance, availability, user experience and reliability of IT service delivery is improved as OI&T is able to make strategic, operational and investment decisions based on real-time information.

EMF supports a unified enterprise service management model including release management, configuration management, change management, and incident management aligned with industry standard IT Infrastructure Library (ITIL) service management best practices. The EMF Federated Data Repository (FDR) includes the implementation of a foundational component. The EMF FDR is a national repository that collects enterprise IT management data from VA Managed Data Repositories (MDRs) and integrates with existing VA monitoring and performance systems.

Additional frameworks may be specified in individual task orders.

Authoritative Data Sources The VA Enterprise Architecture Repository (VEAR) is one component within the overall Enterprise Architecture (EA) that establishes the common framework for data taxonomy for describing the data architecture used to develop, operate, and maintain enterprise applications. The Contractor shall comply with the department’s Authoritative Data Source (ADS) requirement that VA systems, services, and processes throughout the enterprise shall access VA data solely through official VA ADSs where applicable, see below. The Information Classes which compose each ADS are located in the VEAR, in the Data & Information domain. The Contractor shall ensure that all delivered applications and system solutions support:

1. Interfacing with VA’s Master Veteran Index (MVI) to provision identity attributes, if the solution relies on VA user identities. MVI is the authoritative source for VA user identity data.

2. Interfacing with Capital Asset Inventory (CAI) to conduct real property record management actions, if the solution relies on real property records data. CAI is the authoritative source for VA real property record management data.

3. Interfacing with electronic Contract Management System (eCMS) for access to contract, contract line item, purchase requisition, offering vendor and vendor, and solicitation information above the micro-purchase threshold, if the solution relies on procurement data. ECMS is the authoritative source for VA procurement actions data.

4. Interfacing with HRSmart Human Resources Information System to conduct personnel action processing, on-boarding, benefits management, and compensation management, if the solution relies on personnel data. HRSmart is the authoritative source for VA personnel information data.

5. Interfacing with Vet360 to access personal contact information, if the solution relies on VA Veteran personal contact information data. Vet360 is the authoritative source for VA Veteran Personal Contact Data.

6. Interfacing with VA/Department of Defense (DoD) Identity Repository (VADIR) for determining eligibility for VA benefits under Title 38, if the solution relies on qualifying active duty military service data. VADIR is the authoritative source for Qualifying Active Duty military service in the VA.

Development Methodologies The Contractor may support a Service-Oriented Architecture (SOA) that is a flexible set of design principles used during the phases of systems development and integration which will be specified at the task order level. The deployed SOA-based architecture will be deployed on a secure, scalable, interoperable and dynamic platform that has the end to end visibility and manageability from application services to the networking components level and that can be used within multiple domains.

For VA specific task orders, the Contractor shall support VA efforts IAW the Veteran Focused Integration Process (VIP). VIP is a Lean-Agile framework that services the interest of Veterans through the efficient streamlining of activities that occur within the enterprise. The VIP Guide can be found at https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371. The VIP framework creates an environment delivering more frequent releases through a deeper application of Agile practices. In parallel with a single integrated release process, VIP will increase cross-organizational and business stakeholder engagement, provide greater visibility into projects, increase Agile adoption and institute a predictive delivery cadence. VIP is now the single authoritative process that IT projects must follow to ensure development and delivery of IT products

For VA specific task orders, the Contractor shall perform their duties consistent with the processes defined in the OIT Process Asset Library (PAL). The PAL scope includes the full spectrum of OIT functions and activities, such as VIP project management, operations, service delivery, communications, acquisition, and resource management. PAL serves as an authoritative and informative repository of searchable processes, activities or tasks, roles, artifacts, tools and applicable standards and guides to assist the OIT workforce, Government and Contractor personnel. For VA specific Task Orders, the Contractor shall follow the PAL processes to ensure compliance with policies and regulations and to meet VA quality standards. The PAL includes the contractor onboarding process consistent with Section 6.2.2 and can be found at https://www.va.gov/PROCESS/artifacts/maps/process_CONB_ext.pdf. The main PAL can be accessed at www.va.gov/process.

The Contractor shall use an incremental development methodology such as Agile unless otherwise specified at the task order level.

Integrated Product Teams The Contractor may be required to serve as a member of, or provide Subject Matter Expertise to Integrated Product Teams (IPTs) or Integrated Business Teams (IBTs) within VA. Their role(s) will be identified in individual Task Orders. IPTs and IBTs are cross-functional teams that work collaboratively to develop strategies and approaches to meet particular objectives. IPTs and IBTs bring together the principal stakeholders and focus efforts on establishing critical elements of all phases of the acquisition lifecycle.

Quality Assurance If a Contractor is required to develop a significant portion of any mission critical systems/software product under this contract, the Contractor may be required to demonstrate they, or the Subcontractor performing the task, are operating at a specified Carnegie Mellon Software Engineering Institute, Capability Maturity Model® Integration (CMMI) for Development (CMMI-DEV) level; CMMI for Acquisition (CMMI-ACQ) level; CMMI for Services (CMMI-SVC) level; and/or International Organization for Standardization and International Electrotechnical Commission (ISO/IEC) 20000, Institute of Electrical and Electronics Engineers (IEEE) 1012, or ISO 9001:2008, ITIL 2011).

If required at the Task Order level, the rating of CMMI Level III or below shall be stated as well as the date of the rating, the identification of the rating organization, the projects/divisions that were evaluated as part of the evaluation and the rating achieved by the specific business unit the Contractor is proposing on systems/software efforts. The Government reserves the right to validate the systems/software developers' process assertions and representations by conducting an evaluation by VA or a third party or appraisals of the Contractor's organization and Subcontractors using commonly accepted Industry/Government validation practices.

Transition and Orientation Support The Contractor shall perform transition and orientation services (e.g. develop Phase-In/Phase-Out Transition Plan) to insure continuity of services as specified in the individual Task Order. Transition and orientation support may include transitioning support services to Government or Contractor personnel.

Government Inspection and Oversight The Contractor shall cooperate with authorized Government offices in the areas of facilities access, audits, security incident notification, and hosting location.

Specifically, the Contractor (and any Subcontractors) shall:

a. Provide the CO, designated representative of the CO, and representatives of authorized Government offices, full and free physical and remote/logical access to the Contractor's (and Subcontractors') facilities, installations, operations documentation, databases, and personnel used for contract hosting services. This access shall be provided to the extent required to carry out audits, inspections, device scanning utilizing Government prescribed tools, investigations, or other reviews to ensure compliance with contractual requirements for IT and information security, and to safeguard against threats and hazards to the integrity, availability, and confidentiality of agency information in the possession or under the control of the Contractor (or Subcontractor)

b. Fully cooperate with all audits, inspections, investigations, or other reviews conducted by or on behalf of the CO or other authorized Government offices as described in subparagraph (a). Full cooperation includes, but is not limited to, prompt disclosure (per agency policy) to authorized requests of data, information, and records requested in connection with any audit, inspection, investigation, or review, making employees of the Contractor available for interview by auditors, inspectors, and investigators upon request, and providing prompt access (per agency policy) to Contractor facilities, systems, data and personnel to the extent the auditors, inspectors, and investigators reasonably believe necessary to complete the audit, inspection, investigation, or other review. The Contractor's (and any Subcontractors') cooperation with audits, inspections, investigations, and reviews conducted under this clause will be provided at no additional cost to the Government

c. Preserve such data, records, logs and other evidence which are reasonably necessary to conduct a thorough investigation of any computer security incident. A computer security incident (as defined in NIST SP 800-61, Computer Security Incident Handling Guide), including but not limited to, those constituting an actual or potential threat or hazard to the integrity, availability, or confidentiality of agency information in the possession or under the control of the Contractor (or Subcontractor), or to the function of information systems operated by the Contractor (or Subcontractor) in the performance of this contract

d. Promptly notify the designated agency representative in the event of any computer security and privacy incident as described in paragraph (c) above. This notification requirement is in addition to any other notification requirements which may be required by law or this contract. Established Federal agency timeframes for reporting security and privacy incidents to the United States Computer Emergency Readiness Team (US-CERT), although not exhaustive, serve as a useful guideline for determining whether reports under this paragraph are made promptly. (See NIST SP 800-61, Computer Security Incident Handling Guide, Appendix J)

e. Provide to the requestor (CO, a representative of the CO, or authorized Government offices) Government data, information, or records under the control of or in the possession of the Contractor pursuant to this contract, which the Agency or authorized Government offices, including the Office of Inspector General, may request in furtherance of other audits, inspections, investigations, reviews or litigation in which the Agency or other authorized Government offices are involved in the form specified at the task order level. Requests for production under this paragraph shall specify a deadline not less than 10 days for compliance which will determine whether response to the request has been made in a timely manner. Unless expressly provided otherwise elsewhere in this contract, the production of data, information, or records under this paragraph will be at no additional cost to the Government

f. Include the substance of this Section, including this paragraph (f) in any subcontract which would require or otherwise result in Subcontractor employees having access to agency information in the possession or under the control of the Contractor (or Subcontractor), or access to information systems operated by the Contractor (or Subcontractor) in the performance of this contract

g. Ensure that all hosting services pertaining to this contract are performed within the United States of America, including the storage of agency data, information, and records under the control of or in the possession of the Contractor pursuant to this contract

TECHNICAL FUNCTIONAL AREAS

Individual Task Orders may encompass more than one functional area listed below. Further functional area details are described to provide greater insight into the complexity and uniqueness of some potential Task Order requirements covered by this PWS. Functional area requirements are not mutually exclusive and may apply across multiple functional areas. Efforts to be performed by the Contractor under this contract are of such a nature that they may create a potential organizational conflict of interest as contemplated by Subpart 9.5 of the Federal Acquisition Regulation (FAR). Contractor personnel may be required to sign a non-disclosure agreement.

Program Management, Strategy, Enterprise Architecture and Planning Support The Contractor shall provide Program and Project Management, monitoring and analysis, strategy, enterprise architecture and planning support on an enterprise or individual project level. Program Management support is critical to the organization achieving strategic goals and fulfilling mission requirements within programmatic constraints.

Strategy and Planning The Contractor shall provide services that facilitate strategic decisions for an organization with respect to its current and future IT structure and program integration. This includes conducting a systematic assessment and redesign of the key technologies, business processes, activity-based costing and organizational structures; streamlining processes, properly aligning the organization to reflect the way work gets done, and deploying proven supporting technologies where appropriate. The outcome of future studies and assessments may contribute to an overarching IT strategy, aligned with business goals, objectives, and healthcare and benefits initiatives that leverage innovation to define new opportunities for success. The outcome of studies and assessments may also serve as a critical input into designing a set of metrics, which are measurable objectives related to the overall IT strategy and operations. All recommendations and plans must comply with Federal legislation and be consistent with Federal policy, standards, and guidelines such as: the Government Performance and Results Act, Clinger-Cohen, the Federal Activities Inventory Reform Act, the Paperwork Elimination Act, among others.

Standards, Policy, Procedure and Process Development, and Implementation Support The Contractor shall provide support in the development/and or evaluation of new Standards, Policy Directives, Operating Procedures, Processes and/or assessments on their impacts when implemented.

Requirements Development and Analysis Support The Contractor shall provide requirements development support as required by individual Task Orders. Requirements associated with iterative methodologies may occur at any phase of the development lifecycle. Therefore, requirements definition shall be structured to meet the incremental delivery needs of a particular project or program. Requirements support may include, but is not limited to:

A. Enterprise analysis B. Business and Application architecture C. Business Process Reengineering D. Feasibility studies E. Requirements planning and management F. Requirements gathering G. Use Case development H. Agile requirements methods I. Requirements analysis J. Change management K. Peer Reviews L. Solution Assessment and Validation M. Business Process Modeling and workflow management

1.1.1.3 Requirements Packages

The Contractor shall provide requirements package support that may include, but is not limited to:

A. Assistance in developing Statements of Objectives, Statements of Work, PWSs, Performance Specifications, Rough Orders of Magnitude (ROM), cost estimates, Quality Assurance Surveillance Plans, and associated acquisition documentation B. Technical advice and assistance regarding proposal evaluation C. Market research, evaluation, and recommendations of technical alternatives

Technology Refresh and Configuration Reviews The Contractor shall perform technology refresh and configuration reviews to include any structure or process for realizing innovations that provides for business or technical changes. Technology refresh allows for upgrading technology or improving processes as well as helping enterprises move their businesses forward by adopting formal procedures to manage business and technical innovations. Technology refresh ensures new innovations are reviewed and adopted as required. The Contractor shall provide appropriate domain specific recommendations commensurate with unique organizational requirements.

Studies and Analyses The Contractor shall perform studies and analyses. Such studies/analyses may include, but are not limited to logistics/supportability, engineering, financial, operational, business processes, healthcare and benefits systems and applications to include mobile applications, healthcare and benefits analytics, modernization of existing systems and applications (e.g. VistA), and interoperability and/or information sharing of healthcare and benefits systems across Federal agencies as well as public and private healthcare and benefits systems. The Contractor shall perform non-recurring engineering studies and analyses to evaluate the viability of potential solutions, alternatives to various technical issues and challenges, and emerging products or technology. The Contractor shall perform the evaluation of unproven technology applications and identification of potential risks. The development of pre-production or COTS-based prototypes may be required.

Program Management Support The Contractor shall provide program management support to accomplish the administrative, managerial, logistical, integration and financial aspects (Program, Planning, Budget and Execution (PPBE)) specified in individual task orders. The Contractor shall identify an individual as the primary contact point for all programmatic issues/concerns/status. The Contractor may be required to provide subject matter expertise to coach, mentor and/or consult with Government Program Managers to plan and execute the processes prescribed by industry and government best practices consistent with organizational policies and procedures as specified in individual Task Orders. For VA specific task orders, the Contractor shall support VA efforts IAW VIP that enables a flexible program/project management process that allows VA to deliver usable and useful products centered on the needs of users, through more frequent releases. VIP provides the processes, practices, and guidance for delivering high-quality; secure IT capabilities through a deep embrace of Agile methodologies and principles. The Contractor shall support project management functions and reporting which include, but are not limited to:

A. Project Planning B. Schedule Management C. Financial Management D. Earned Value Management (EVM) E. Quality Management F. Resource Management G. Requirements Management H. Communications Management I. Project Change Management J. Organizational Change Management K. Risk Management L. Performance Management M. Knowledge Management (KM)

Product Data The Contractor shall review, develop and/or submit Product Data that shall be identified in individual Task Orders as deliverables. Product Data may define configuration items, associated processes and procedures, and other items throughout the applicable life cycle. Various types of Product Data, include but are not limited to, engineering drawings, form, fit and function requirements, design documentation, specifications, software configuration documentation, software code, interface control documentation, Management/project Plans, reports and analyses, VIP artifacts, quality assurance provisions, and/or commercial item descriptions may be required. The Contractor may be required to apply Computer-Aided Design (CAD), and Computer Automated Engineering (CAE) methods/systems to support concurrent design integration with manufacturing and logistics considerations.

IT Services Management Support The Contractor shall be responsible for recommending and supporting the development of IT service management plans, practices, infrastructures and systems utilizing industry best practices such as Information Technology Infrastructure Library (ITIL) to minimize negative impact on the IT enterprise. IT services management includes, but is not limited to:

A. Change Management B. Release Management C. Configuration Management D. Incident Management E. Problem Management F. Service Desk Management G. Availability Management H. Capacity Management I. Event Management J. Data & Storage Management K. Service Level Agreements (SLA)

Development Toolkits The Contractor shall be responsible for recommending and supporting the utilization of development toolkits (e.g. IBM Rational ClearCase).

Systems/Software Engineering The Contractor shall provide engineering expertise to analyze system concept, system design and interoperability, and provide recommendations for optimization. The Contractor shall review and analyze development, production, and system support proposals. The Contractor shall conduct trade-off/best technical approach analyses including cost estimation and cost benefit (e.g. Return on Investment (ROI)), analysis of alternatives, engineering studies, develop System Engineering Plans (SEPs), design plans, and technical reports as specified in the individual task order.

The Contractor shall provide systems/software engineering support for any or all phases of the system/software lifecycle to include Acquisition Strategy, Requirements Development, Requirements Management, Use Case Development, Risk Management, Architecture Design, Performance Engineering, Capacity Planning, System/Software Development, Test and Evaluation, and Sustainment. Requirements Development associated with iterative methodologies may occur at any phase of the development lifecycle. Therefore, requirements definition shall be structured to meet the incremental delivery needs of a particular project or program.

During the lifecycle process, software engineering support includes, but is not limited to software system reliability assessments, participation on governance boards and IPTs. The Contractor shall ensure the dependencies, interoperability, availability, reliability, maintainability and performance of the system as a whole within government provided guidelines specified in the individual task order.

The Contractor shall provide Business Process Modeling (BPM) to include clinical and benefits workflows and Business Process Reengineering (BPR) support to system/software engineering efforts. This includes developing activity and process models for analysis of requirements and identification of improvement opportunities. BPM may be a requirement for some software development projects.

Design and Development The Contractor shall provide services with respect to all aspects and life-cycle phases which includes, but are not limited to planning, programming, requirements analysis, design, coding and unit testing, system integration testing, implementation, maintenance and updating of systems, applications, and/or services. This includes, but is not limited to healthcare and benefits information processing, payroll processing, financial management systems, decision support systems, and workflow management systems. The Contractor shall be fully cognizant of the implications of the VA strategic plan.

Architecture Development The Contractor may support the enhancement of Enterprise Architectures and associated Technical Reference Models, as well as the development of Business Line Architectures and Solution Architectures. The Contractor may be involved in enterprise architecture assessments as well as infrastructure assessments. The Contractor may support the development of strategies and governance processes for architectures.

The Contractor may:

A. Develop process and data models derived from the VA Strategic Plan.

B. Develop the architecture, common infrastructure and services needed to support systems development (e.g. VistA, SOA, Open Source products) C. Use common infrastructure and services to minimize the effort required to deliver new functional capabilities at a lower cost D. Retire older systems and build new systems that are scalable and extensible by building them based on reusable services on commodity IT products E. Conduct audits/assessments of the architectures and/or infrastructure

IT Service Management Implementation The Contractor shall implement IT service management plans, practices, infrastructures and systems utilizing industry best practices such as ITIL and to minimize negative impact on the IT enterprise. IT services management includes, but is not limited to:

A. Change Management B. Release Management C. Configuration Management D. Incident Management E. Problem Management F. Service Desk Management G. Availability Management H. Capacity Management I. Event Management J. Data & Storage Management

Enterprise Application/Services The Contractor shall perform requirements analysis, system analysis, development and implementation support for core functional business and support applications and services, process re-engineering and adaptation of IT solutions in support of environments internal and external to the organization. Application support may include, but not limited to advanced collaboration capabilities, workflow, business process modeling, business process modeling translation, system modeling and simulation, software development, executive dashboards, enterprise search and discovery, project management and scheduling tools and applications and advanced multi-media support for training and marketing requirements.

Cloud Computing The Contractor may be required to create and implement a cloud computing solution. The Contractor may also be required to support an existing cloud computing environment. Cloud computing is a delivery model for IT services based on the Internet, typically involving the provision of dynamically scalable and often virtualized resources as a service over the Internet. Cloud computing delivers common business applications online which are accessed from a web browser, while the software and data are stored on servers. These applications are broadly divided into the following categories, but are not limited to Infrastructure as a Service (IaaS), Software as a Service (SaaS), Utility Computing, Web Services, Platform as a Service (PaaS), Managed Service Providers (MSP), Service Commerce, and Internet Integration.

Web Application Design and Development The Contractor shall provide services for evaluation, planning, requirements analysis, design, coding and unit testing, system integration testing, implementation, deploying, providing service to, maintaining or updating a web-based application or web-enabling a current system.

Mobile Application Design and Development The Contractor shall provide services for evaluation, planning, requirements analysis, design, coding and unit testing, system integration testing, implementation, deploying, providing service for distributing, maintaining or updating a mobile application.

Human-Computer Interaction The Contractor shall provide services related to analysis, design, evaluation, implementation, and testing of interactive and wearable computing systems for human use to include, but is not limited to telehealth, natural language processing, and 508 compliance.

System/Software Integration The Contractor shall provide systems/software integration support to include planning, updating architecture models, interoperability specifications and analysis, system interface specifications, service definitions, and segmented architecture for the transition, integration, and implementation of IT systems.

Modeling and Simulation The Contractor shall provide the personnel, equipment, tools and facilities necessary to model, simulate, and/or analyze IT services, systems, networks and other infrastructure or IT components in operation in the computing environment or under development. The Contractor may be required to model, simulate, or predict performance based on variables such as network latency, end-user device performance, and system-component upgrades. Modeling and simulation support may also include creating prototype implementations or developing mathematical models, as well as biomedical modeling and simulation. The level and type of modeling and simulation support required will be specified in the individual task order.

Informatics Services The Contractor shall provide the following informatics services to include, but is not limited to assisting in the evaluation, analysis and recommendation of potential improvements and technology insertions, particularly in the areas of e-business technologies and architectures, health sciences, benefits management, collaboration tools and software, exchanging information and integrating systems and using data and KM. The Contractor shall develop, recommend, and implement KM strategies, policies, procedures, and best practices. The Contractor shall analyze and estimate the impact, operational effect, and supportability that the new technology will have on the existing processes, lifecycle cost, schedule, tradeoffs, interoperability, performance, suitability and other salient characteristics. The Contractor shall design, develop, implement, and maintain information management structures, systems and applications. In addition, the Contractor shall analyze new requirements and existing systems to determine and identify separable functions that are common across systems and potentially can be accommodated by COTS software, or alternatively by custom developed software. The Contractor shall conduct software engineering assessments on business process support systems to provide evaluation of modifiability, portability, reusability, performance and other quality areas. The Contractor shall also develop guidelines to include system/software architecture, software development processes, management indicators/quality metrics, requirements specifications and documentation standards. Data architecture repository and data architecture services are also included.

Engineering and Technical Documentation The Contractor shall prepare and/or revise/update Engineering, User and Technical Documentation, Reports, and Manuals for existing or newly developed projects, software applications or systems.

Current System and Data Migration These systems are in various stages of the lifecycle from Concept Exploration through and including Production, Deployment and system decommissioning. The migration of current systems and corresponding data to a common and enforced architecture within the VA Network is the goal. Software engineering, data management, and Database Architecture support is required from the Contractor in the areas of computer resource management, analysis of technical documentation, participation in technical reviews, evaluation of test plans, system and integration testing, applicability studies and analysis of common software, and in the decommissioning of current systems.

Development Toolkit Support The Contractor shall provide services that may include, but are not limited to acquisition and installation, administration, and maintenance of development toolkits (e.g. IBM Rational ClearCase).

Software Technology Demonstration and Transition The Contractors shall provide demonstrations and transition support for advanced software technologies. This functional area involves evaluating existing and emerging software technology products against the needs of current system development and support efforts, demonstrating specific technologies in the context of supported systems, and transitioning effective technology solutions into use. Current technology areas of focus for VA include software architectures, databases, web-based applications, mobile applications, telehealth, enterprise solutions, wireless, and security. This mission is a critical aspect of VA's ability to improve and advance its software engineering capability.

Test & Evaluation (T&E) The Contractor shall provide T&E support in all phases of the systems/software development life cycle, to include preparation of test plans and procedures, design tests cases, conduct tests, witness tests and provide technical support, coordinate test plans IAW appropriate regulations, and analyze/evaluate/document test results.