Attachment 0001_PWS_GCAM_RFI Posting_draft.pdf

PERFORMANCE WORK STATEMENT (PWS)DEPARTMENT

OF VETERANS AFFAIRS

Office of Information & Technology Software Product Management (SPM)

Corporate (CORP) Portfolio SecVA, Congressional & Legal Affairs (SCLA) Product Line

General Counsel Agile Modernization (GCAM)

Date: 07/3/2024

VA-24-00085756

PWS Version Number: 1.0

Contents

CONTENTS

1. BACKGROUND

2. APPLICABLE DOCUMENTS

3. SCOPE OF WORK

4. PERFORMANCE DETAILS

4.1. PERFORMANCE PERIOD

4.2. PLACE OF PERFORMANCE

4.3. TRAVEL

4.4. CONTRACT TYPE

5. SPECIFIC TASKS AND DELIVERABLES

5.1. PROJECT MANAGEMENT

5.1.1. CONTRACTOR PROJECT MANAGEMENT PLAN

5.1.2. REPORTING REQUIREMENTS

5.1.3. RISK MANAGEMENT

5.1.4. CONFIGURATION MANAGEMENT

5.1.5. PRIVACY & HIPAA TRAINING

5.1.6. TECHNICAL KICKOFF MEETING

5.1.7. ONBOARDING

5.2. HUMAN CENTERED DESIGN (HCD)

5.3. APPLICATION PERFORMANCE MONITORING AND ALERTING

5.3.1. DELIVERABLE METRICS/SLAS

5.4. BUSINESS CAPABILITIES AND EXPECTED OUTCOMES

5.5. SOFTWARE DEVELOPMENT LIFECYCLE

5.5.1. AGILE REQUIREMENTS ELABORATION

5.5.2. BUILD AND DEVELOPMENT

5.6. ADDITIONAL SOFTWARE DEVELOPMENT LIFECYCLE ENHANCEMENTS

(OPTIONAL TASKS ONE THROUGH FIVE-OPTION PERIODS)

5.7. OPTION PERIOD ONE

5.8. OPTION PERIOD TWO

6. GENERAL REQUIREMENTS

6.1. ENTERPRISE AND IT FRAMEWORK

6.1.1. VA TECHNICAL REFERENCE MODEL

6.1.2. FEDERAL IDENTITY, CREDENTIAL, AND ACCESS MANAGEMENT

(FICAM)

6.1.3. INTERNET PROTOCOL VERSION 6 (IPV6)

6.1.4. TRUSTED INTERNET CONNECTION (TIC)

6.1.5. STANDARD COMPUTER CONFIGURATION

6.1.6. VETERAN FOCUSED INTEGRATION PROCESS (VIP) AND PRODUCT

LINE MANAGEMENT (PLM)

6.1.7. PROCESS ASSET LIBRARY (PAL)

6.1.8. AUTHORITATIVE DATA SOURCES

6.1.9. SOCIAL SECURITY NUMBER (SSN) REDUCTION

6.1.10. SOFTWARE AND LICENSING REQUIREMENTS

6.2. SECURITY AND PRIVACY REQUIREMENTS

6.2.1. POSITION/TASK RISK DESIGNATION LEVEL(S)

6.2.2. CONTRACTOR PERSONNEL SECURITY REQUIREMENTS

6.3. METHOD AND DISTRIBUTION OF DELIVERABLES

6.4. PERFORMANCE METRICS

6.5. FACILITY/RESOURCE PROVISIONS

6.6. GOVERNMENT FURNISHED PROPERTY AND GOVERNMENT FURNISHED

INFORMATION

ADDENDUM A – ADDITIONAL VA REQUIREMENTS, CONSOLIDATED

ADDENDUM B – VA INFORMATION AND INFORMATION SYSTEM SECURITY AND

PRIVACY LANGUAGE

1. BACKGROUND

The Department of Veterans Affairs (VA), Office of Information & Technology (OIT), Software Product Management (SPM) strives to provide high quality, effective, and efficient Information Technology (IT) services to those responsible for providing care to the Veterans at the point-of-care as well as throughout all the points of the Veterans’ health care in an effective, timely and compassionate manner. VA depends on Information Management/ Information Technology (IM/IT) systems to meet mission goals.

The VA OIT, Corporate (CORP) Portfolio delivers world-class, Veteran-centric capabilities that provide secure, seamless delivery of IT systems to VA corporate offices so these offices may efficiently and effectively provide benefits and services to Veterans and their families. Corporate Portfolio IT systems enable the delivery of services to Veterans by enabling technology to provide relevant internal, foundational information to the VA workforce. CORP Portfolio provides available, adaptable, secure, and cost-effective IT products and services to VA business offices, enabling VA staff to provide mission-critical support to the Nation’s Veterans.

Sec VA/Congressional/Legal Affairs (SCLA) - IT products for supporting the activities of Office of the Secretary of VA, Office of General Counsel and Congressional Liaison operations. It also includes products for enabling regulatory activities such as matter intake and tracking under the VA accountability and whistleblower's protection program.

SCLA is working with the Office of General Counsel (OGC) to modernize their legal automation workload system to improve performance and efficiency to benefit Veterans.

The tasks described in this Performance Work Statement (PWS) are required to support the ongoing operations, maintenance and enhancements for the products assigned to the SCLA Product Line.

2. APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. 44 U.S.C. § 3541-3549, “Federal Information Security Management Act (FISMA) of 2002”

2. “Federal Information Security Modernization Act of 2014”

3. Federal Information Processing Standards (FIPS) Publication 140-3, “Security Requirements for Cryptographic Modules”, March 22, 2019

4. FIPS Pub 199. “Standards for Security Categorization of Federal Information and Information Systems,” February 2004

5. FIPS Pub 200, “Minimum Security Requirements for Federal Information and

Information Systems,” March 2006

6. FIPS Pub 203-2, “Personal Identity Verification of Federal Employees and

Contractors,” January 2022

7. 10 U.S.C. § 2224, "Defense Information Assurance Program"

8. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

9. Public Law 109-461, Veterans Benefits, Health Care, and Information

Technology Act of 2006, Title IX, Information Security Matters

10. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”

11. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, https://www.va.gov/vapubs/index.cfm

12. VA Handbook 0710, “Personnel Security and Suitability Program,” May 2, 2016, https://www.va.gov/vapubs/index.cfm

13. VA Directive and Handbook 6102, “Internet/Intranet Services,” August 5,

14. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and Guidelines,” January 18, 2017

15. Office of Management and Budget (OMB) Circular A-130, “Managing Federal

Information as a Strategic Resource,” July 28, 2016

16. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed

Services (CHAMPUS)”

17. NIST SP 800-66 Rev. 1, “An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule,” October 2008

18. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended, January 18, 2017

19. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

20. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021

21. VA Handbook 6500, “Risk Management Framework for VA Information

Systems VA Information Security Program,” February 24, 2021

22. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI),” June 30, 2022

23. VA Handbook 6500.5, “Incorporating Security and Privacy into the System Development Lifecycle,” March 22, 2010

24. VA Handbook 6500.6, “Contract Security,” March 12, 2010 (Appendix C updated April 22, 2024)

25. VA Handbook 6500.8, “Information System Contingency Planning,” April 6,

26. VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018

27. VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017

28. OIT Process Asset Library (PAL), https://www.va.gov/process/ . Reference

Process Maps at https://www.va.gov/process/maps.asp and Artifact templates at https://www.va.gov/process/artifacts.asp

29. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

30. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014

31. VA Handbook 6510, “VA Identity and Access Management,” January 15, https://www.va.gov/vapubs/index.cfm https://www.va.gov/vapubs/index.cfm http://www.va.gov/vapubs http://www.va.gov/vapubs https://www.va.gov/process/ https://www.va.gov/process/maps.asp https://www.va.gov/process/artifacts.asp https://www.va.gov/trm/TRMHomePage.aspx

32. VA Directive and Handbook 6513, “Secure External Connections,” October 12, 2017

33. VA Directive 6300, “Records and Information Management,” September 21,

34. VA Handbook, 6300.1, “Records Management Procedures,“ March 24, 2010

35. NIST SP 800-37 Rev 2, “Risk Management Framework for Information

Systems and Organizations: A System Life Cycle Approach for Security and Privacy,” December 2018

36. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020)

37. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015

38. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-

12) Program,” March 24, 2014

39. OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005

40. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019

41. OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008

42. Federal Identity, Credential, and Access Management (FICAM) Architecture, June 30, 2023 (https://arch.idmanagement.gov/#what-is-the-ficam-architecture)

43. NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access,“ June 2018

44. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, “Digital Identity Guidelines,” updated March 02, 2020

45. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014

46. NIST SP 800-164, “Guidelines on Hardware-Rooted Security in Mobile

Devices (Draft),” October 2012

47. Draft National Institute of Standards and Technology Interagency Report

(NISTIR) 7981, “Mobile, PIV, and Authentication,” March 2014

48. VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland

Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

49. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

50. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

51. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents https://arch.idmanagement.gov/#what-is-the-ficam-architecture https://arch.idmanagement.gov/#what-is-the-ficam-architecture https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514 https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896 https://www.cisa.gov/publication/tic-30-core-guidance-documents

52. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019

53. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008

54. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (Public Law 110–140), December 19, 2007

55. Section 104 of the Energy Policy Act of 2005, (Public Law 109–58), August 8, 2005

56. Executive Order 13834, “Efficient Federal Operations,” dated May 17, 2018

57. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August

2, 2001

58. VA Directive 0058, “VA Green Purchasing Program,” July 19, 2013

59. VA Handbook 0058, “VA Green Purchasing Program,” July 19, 2013

60. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote

Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

61. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

62. “Veteran Focused Integration Process (VIP) Guide 4.0,” January 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

63. VA Memorandum “Proper Use of Email and Other Messaging Services,”

January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

64. “Product Line Transformation Playbook” version 3.1, August 2023 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

65. NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020

66. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol

Version 6 (IPv6),” November 19, 2020

67. Social Security Number (SSN) Fraud Prevention Act of 2017

68. Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23,

3. SCOPE OF WORK

The Contractor shall provide Scalable Agile Framework (SAFe) agile practices, or other suitable Agile technique (e.g., Scrum), to plan, manage, execute the work required to analyze, develop, test, and deploy a solution that meets the needs of the General Counsel Automated Workload System (GCLAWS) Government off the Shelf(GOTS) product consisting of the Records Management (RM) and Court of Appeals Law Group (CALG) products.

The Contractor shall follow the Scalable Agile Framework (SAFe) body of knowledge, or other suitable Agile technique (e.g., Scrum), using the Microsoft Azure DevOps (ADO) product hosted at the VA. Items such as, but not limited to, Epics, Features and Stories shall be documented within the ADO and .Net applications to manage the lifecycle of features and work items necessary for the Records Management and CALG products.

https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371 https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

4. PERFORMANCE DETAILS

4.1. PERFORMANCE PERIOD

The period of performance (PoP) shall consist of a 12-month base period from date of award plus two (2) 6-month option periods, and five Optional Tasks for additional software development lifecycle enhancements.

• Base period shall include MVP solution implementation for Record Management and CALG Customizations

• Option Period 1 shall include MVP enhancements for CALG and RM Products

• Option Period 2 shall include MVP Enhancements for CALG and RM Products

Any work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO). There are eleven (11) Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, five are set by date:

New Year's Day January 1 Juneteenth June 19 Independence Day July 4 Veterans Day November 11 Christmas Day December 25

If any of the above falls on a Saturday, then Friday shall be observed as a holiday.

Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

Martin Luther King's Birthday Third Monday in January Washington's Birthday Third Monday in February Memorial Day Last Monday in May Labor Day First Monday in September Columbus Day Second Monday in October Thanksgiving Fourth Thursday in November

4.2. PLACE OF PERFORMANCE

Efforts under this TO shall be performed at Contractor facilities. It is expected that this work will be primarily conducted during core business hours, which are defined as 8am to 5pm local time when applicable. The Contractor shall identify the Contractor’s place of performance in their proposal submission.

4.3. TRAVEL

The Government anticipates travel under this effort to perform the tasks associated with the effort, as well as to attend program-related meetings or conferences throughout the PoP. Include all estimated travel costs in your firm-fixed price line items. These costs will not be directly reimbursed by the Government.

The total estimated number of trips in support of the program related meetings for this effort is three (3) including one face-to-face Planning Interval (PI) meeting per year. Anticipated locations include the following, estimated at three days in duration not including travel days:

1. Northeast, e.g., Washington DC, 810 Vermont Ave

2. Southeast, e.g., St. Petersburg, Florida

3. Central, e.g., St. Louis, MO or Nashville, TN

Travel shall be in accordance with the Federal Travel Regulations (FTR) and requires advanced concurrence by the COR. Contractor travel within the local commuting area will not be reimbursed.

4.4. CONTRACT TYPE

The effort shall be proposed on a Firm Fixed Price (FFP) basis.

5. SPECIFIC TASKS AND DELIVERABLES

GCLAWS System Requirements

GCLAWS is the VA’s legal case/matter and accreditation management system allowing VA attorneys, managers, and legal support staff to perform legal workload management and administration of activities associated with it in more than 30 areas of law and Veteran supporting functions. Among those functions are ensuring legally sound claims appeals process, defending Secretary of VA adjudication of Veterans claims, collecting Revenue from Third Parties through Mass Litigation efforts, supporting the administration of Veterans Tort Claims, and tracking the accreditation status of Veteran Representatives. The system tracks and stores active or pending legal matters, claims to US Court of Appeals, Board of Veteran Appeals Decisions, and supports the collection of Medical Care Collections Funds from third parties that is sent to Medical Centers for the direct care of Veterans. For Veteran’s Tort Claims, GCLAWS supports the Law Group who has worked to reduce the wait time (in days) for an administrative decision. GCLAWS also supports VA’s Accreditation discipline and fees program by tracking Veterans attorneys, agents, representatives, and Veteran Service Organizations in pursuit of their VA benefit claims.

The GCLAWS is a set of custom developed applications and databases that integrate with each other that operates on premises in N-tier SQL Server 2016-based environment within the Capital Region Readiness Data Center (CRRC) in Martinsburg, WV. One (1) Microsoft Sql Server hosts 13 General Counsel databases and 3 system configuration databases plus SQL Reporting Services (SSRS) reporting database.

Databases are segmented by types of case work OR organization units within the OGC referred to as law groups or national practice groups. Databases are hosted within the VA Intranet as necessary by means of Windows Desktops using a custom application, browser, or a Microsoft Outlook extension. Database access is restricted to appropriate OGC and workforce members and limited VA workforce members. Application access is performed by NTLM Windows Active Directory Authentication using VA staff Personal Identity Verification cards (PIV).

1. VA custom-developed legacy Desktop Client is installed on 1000 OGC user workstations (operating system Windows 10).

2. VA custom-developed GCLAWS Outlook Add-In library is installed on OGC staff member workstations (operating system Windows 10).

3. VA custom-developed browser-based Web Services, User Interface and API, operate on Windows Server 2016 Standard and Internet Information Services (IIS) v10.0

Remote OGC users working from alternate locations (telework location, hotel on travel, etc.) use Government Furnished Equipment (GFE) laptop portables hosting Windows 7/10 OS. Remote Access to the VA Intranet and GCLAWS is performed via Cisco AnyConnect Secure Mobility Client (Remote Access Security Compliance Update Environment (RESCUE) PIV).

The current technology stack consists of the following:

• Angular v8

• Node.js v16.19

• Microsoft .NET v6/v8 (including SDK)

• Microsoft ASP.NET

• Microsoft Entity Framework (EF) Core

• Microsoft Internet Information Services (IIS) v10

• SQL Server 2016 (SQL) v13

• SQL reporting services 2016 (SSRS) v13

• Windows Server 2019

• Microsoft Visual Studio 2022

• Environments – Development, Test, Pre-Production, Production o Development/Test Tools include SQL Server Management Studio v19 Fortify State Code Analyzer Git Version Control Tools Postman Fiddler NswagStudio DevExpress/DevExtreme Smartbear TestComplete

All technology layers must be kept current with the VA Technical Reference Manual, a repository of approved software and technologies with divest states to give Product Owners and Managers time to upgrade their technologies.

Customizations

The customization work in this effort applies to the GCLAWS browser-based web application, the underlying API data access services and the physical relational databases. The work does not apply to the legacy desktop client application being deprecated or the GCLAWS Outlook Add-In Extension.

There are two areas of work effort the Contractor shall be responsible for: (1) Records Management, and (2) CALG.

1. The Records Management product entails system-wide features associated with a document lifecycle from creation through archival or deletion.

2. The CALG customizations support the litigation group representing the Secretary of the VA in all litigation brought before the Court of Appeals for Veterans Claims (CAVC) and the adjudication of Veterans’ claims for benefits while ensuring a legally sound and timely claims appeals process for Veterans.

The Records Management customizations ensure the case management system provides automatic case destruction, improved litigation preservation feature, improved account management and access control, improved security on records providing more granular control and protection from inappropriate access, and a new Notification Manager Service component for notifying users of significant events through channels such as Outlook or MS Teams.

1. The Auto Case Destruction feature ensures compliance with Federal Records Act, VA Directive 6300, and VA Directive 6371 and other applicable laws and that the legal records are not unnecessarily retained beyond their retention period pursuant to the applicable records control schedules. The system must produce documentation of records destruction pursuant to VA Directive 6371 that includes an audit trail of the deletion that does not include sensitive information or Personally Identifiable Information (PII). The enhancement must also ensure Permanent Records as defined in 36 C.F.R. 1220.14 by the National Archives and Records Administration (NARA) warrant preservation and are protected from destruction.

2. The Litigation Preservation feature places a litigation hold on relevant electronic data and facilitating compliance with legal obligations during litigation proceedings, reducing the risk of intentional or unintentional altering, tampering with or destruction of potential evidence that may be relevant to legal proceedings and associated legal consequences.

3. The Account Management and Access Control feature ensures adherence to access control policy, allow Information Systems Security Officers (ISSO) to audit/monitor access and controls, and define Account Managers with administrator-level functions to manage accounts and ensure compliance with VA Account Management policy.

4. The Record-level Security feature will contain improvements to ensure legal records are protected from inappropriate access, and

5. The Notification Manager Service feature will be a flexible component that ensures proper notification during significant events like the record destruction process using communication systems like Microsoft Outlook or Microsoft Teams channels.

CALG work supports customizations for three new legal case/matter work types Court of Veteran Appeals legal matter types including Court of Veterans Appeal, Writ, and Equal Access to Justice Act (EAJA). Dashboards and case record editors will require customization to support the litigation deadlines that drive the appeals and claims processes. Data migration from the legacy database to the standard GCLAWS database must occur to successfully migrate the CALG office to the modernized technology stack. The migration of those cases from the legacy system to the standard GCLAWS system is required to complete the modernization. The enhancements also include a new Calendaring module that will help VA Attorneys efficiently manage tasks, court deadlines and appointments and reduce the risk of serious legal consequences when deadlines are missed.

The GCLAWS Web User Interface (UI) application is built using Angular and compiled use Node.js. Node is not used as an execution environment on host production servers. This UI layer uses a multi-tenant style pattern seamlessly connecting the user to multiple databases for each organizational entity, e.g., Law Group, to which they have access. The Angular project file structure provides a solid foundation for management and is organized following standard practice with the following components: the src folder, app folder, assets folder, environments folder, nodemodules folder, and angular.json. The Angular project is compiled to a distribution folder which is deployed within an IIS environment.

The GCLAWS Web Application Programming Interface (API) application is built using ASP.NET and compiled with .NET. .NET run-time libraries are required in the execution environment on host servers. The ASP.NET project implements a REST API for all consumers including other VA systems and the GCLAWS Web and Outlook Application components. The ASP.NET project file structure also provides a solid foundation for management using Single Responsibility Principle and a controller layer, service layer, and repository layer. The repository layer uses Entity Framework core as the data access technology. There are two projects to maintain: API v1 and API v2. API v1 secures access to database resources using Windows Authentication and is a traditional monolithic application model providing multiple APIs as a single unit. APIv2 secures access with API keys and Windows Authentication for different types of consumers and implements a microservice architecture model with each API organized as an independent deployable service with its own code base, however the database repositories are still considered monolithic.

The GCLAWS Database is built on the Microsoft SQL Server Relational Database Management System (DBMS). In the production environment, one SQL Server hosts 11 instances of the GCLAWS physical database model, one GCLAWS CALG database model, one Core database model hosting user, permission, and IT infrastructure across those databases, and several other support databases for SSRS services or aggregation and maintenance. Changing the GCLAWS database model means deploying that change to all twelve (12) instances. A single GCLAWS database hosts approximately 350 tables of legal/case information. It is estimated another 50-60 tables will be required to support the Records Management and CALG enhancements within this performance work statement. The database model will be managed with a Visual Studio SQL Database Project (*.sqldbproj) so it can be source controlled and changes promoted across branches, compiled and deployed by the Azure DevOps Pipeline.

SQL Server Service Agents are used to run nightly jobs, integrity checks, and garbage collection. Each of the 11 GCLAWS “Standard” Databases are configured to use SQL Server FileStream technology for storing binary large object (BLOB), e.g., file attachments, outside of the SQL Server master database file(s) (*.mdf) and within a folder on the host file system. This is a feature managed automatically by the SQL RDMS and not the application developers.

All source code is hosted in Azure DevOps Server within either Team Foundation Version Control (TFVC) or Git repository. Occasional updates to the VA’s Github repository for the GCLAWS project is necessary for major release versions. Although vulnerability scanning is performed automatically in the VA’s Github repository, the project teams must periodically run application security testing and software composition analysis with tools like Fortify Static Code Analyzer (SCA) and remediate findings within the Agile Planning Interval (PI) or prior to a formal review. The Contractor shall support at a minimum, one annual reviews for compliance (additional reviews for major versions as necessary) by VA Office of Information Security (OIS) Software Assurance (SwA) Program Office, required to ensure VA app developers adhere to VA requirements and compliance while maintaining a VA Authority To Operate (ATO).

GCLAWS is currently being migrated from on-prem host to an Azure Cloud Infrastructure-as-a-Service (IAAS) environment implementing the VA Cloud-First Policy that is articulated in VA Directive 6517, Cloud Computing Services, and support the goals of the Executive Director for EPMO Application Management and SecVA/Congressional/Legal Affairs (SCLA) Product Line. The migration is at the beginning of the Provisioning stage of Cloud implementation requiring provisioning of all server resources, VMs and network, etc.

This is a migration of Application software, web services, and databases on 10 servers from CRRC on-prem to the Azure Cloud subscription utilizing the IAAS architecture to containerize the application and web front end, and standard Azure servers to implement SQL Server server instances for each of the 3 environments. The Records Management and CALG customizations and enhancements will at some point during the period of performance require changes to the environment architectures of the Records Management and CALG products. Azure Pipelines will need configured to build containers and release artifacts to the Azure Cloud IAAS hosting environments, initially at first in parallel with on-prem hosting environment and then eventually stand-alone in the cloud environment. The Contractor will be required to support these environmental changes, when they occur.

The Contractor shall utilize SAFe, or other suitable Agile technique (e.g., Scrum), with the ADO product to create the Epics, Features, and Stories necessary to develop and deploy the Records Management and CALG products. To drive a development cadence, the contractor shall utilize Planning Intervals (PI) to ensure iterations are defined with meaningful business outcomes, features with dependencies are identified, risks and issues are uncovered, and milestones or events are understood. Stories from the PI will be entered into ADO team backlog for iteration planning and delivery of increments noted in the PI planning session.

The Contractor shall be prepared to provide a team with the expertise in SAFe, or other suitable Agile technique (eg: Scrum), and ADO to ensure efficient and effective product, feature, and story builds are defined within the Sprint duration (2 weeks). Epics, features and stories will be reviewed and approved by the VA designated Product Owner(s) (POs).

Stories will be reviewed by the POs after the required description and acceptance criteria are completed. Use of Gherkin format is recommended and desired, in stories, when describing user behavior associated with the Records Management and CALG products. Once Stories are approved, the Contractor shall develop, test and, once passing unit and integration tests, shall be deployed to the User Acceptance Test (UAT) environment for client review. Before deployment to production, a final set of tests, such as, but not limited to regression tests, shall be conducted by the Contractor to confirm the item meets or exceeds quality parameters and will function in production as expected. The Contractor shall ensure their team has the requisite skill levels required to support these goals. Expertise in the knowledge areas of (but not limited to) SAFe, ADO, software development, software testing, and product/project management are required to successfully analyze, develop, test, deploy, and complete the Records Management and CALG products.

5.1. PROJECT MANAGEMENT

5.1.1. CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, timeline, and tools to be used in execution of the contract. The CPMP should take the form of both a narrative and graphic format (MS Project), such as a Gantt Chart, that displays the schedule, milestones, risks, and resource support. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPMP shall be concurred upon and updated in accordance with Section B of the contract. The Contractor shall update and maintain the VA PM approved CPMP throughout the PoP.

Deliverable:

A. Contractor Project Management Plan

5.1.2. REPORTING REQUIREMENTS

The Contractor shall provide the COR with Weekly Progress Reports in electronic form in Microsoft Word and Microsoft Project formats. The report shall include detailed instructions/explanations for each required data element, to ensure that data is accurate and consistent. These reports shall reflect data as of the last day of the preceding Week.

The Weekly Progress Reports shall cover all work completed during the reporting period and work planned for the subsequent reporting period. The report shall also identify any problems that arose and a description of how the problems were resolved. If problems have not been completely resolved, the Contractor shall provide an explanation including their plan and timeframe for resolving the issue. The report shall also include an itemized list of all Information and Communication Technology (ICT) deliverables and their current Section 508 conformance status. The Contractor shall monitor performance against the CPMP and report any deviations. It is expected that the Contractor will keep in communication with VA accordingly so that issues that arise are transparent to both parties to prevent escalation of outstanding issues.

Deliverable:

A. Weekly Progress Report

5.1.3. RISK MANAGEMENT

The Contractor shall conduct risk management of all work performed under this TO and provide input to the product Risk Management Registry within the ADO environment.

Deliverable:

A. ADO Risk and Issues Registry

5.1.4. CONFIGURATION MANAGEMENT

The Contractor shall utilize the ADO environment along with the .Net environment to control and monitor the list of items being planned, developed and deployed. In addition, the Contractor shall use of the Service Now (SNOW) system within the VA to document the product system configuration throughout the PoP.

Deliverable:

A. Product Configuration

5.1.5. PRIVACY & HIPAA TRAINING

The Contractor shall submit Talent Management System (TMS) Training Certificates of completion for VA Privacy and Information Security Awareness, Rules of Behavior and Health Insurance Portability and Accountability Act (HIPAA) training. The Contractor shall provide signed copies of the Contractor Rules of Behavior in accordance with Section 4, Training, from the updated Appendix C of the VA Handbook 6500.6, “Contract Security”.

The Contractor shall submit status of VA Privacy and Information Security Awareness training for all individuals engaged on the TO.

Deliverables:

A. TMS Training Certificates B. Signed Contractor Rules of Behavior

5.1.6. TECHNICAL KICKOFF MEETING

The Contractor shall hold a technical kickoff meeting within 15 business days after TO award. The Contractor shall present, for review and approval by the Government, the details of the intended approach, work plan, and project schedule for each effort. The Contractor shall specify dates, locations (in-person preferred but can be virtual), agenda (shall be provided to all attendees at least five calendar days prior to the meeting), and meeting minutes (shall be provided to all attendees within three calendar days after the meeting). The Contractor shall invite the Contracting Officer (CO), Contract Specialist (CS), COR, and the VA PM.

The Contractor shall deliver the kick-off meeting package 5 (five) days after the kickoff meeting. The package shall include a work planning and delivery approach, milestone schedule, and constraints.

5.1.7. ONBOARDING

The Contractor shall manage the onboarding of their staff. Onboarding includes steps to obtain a VA network and email account, complete training, initiate background investigations, and gain physical and logical access, which may include elevated privileges to the necessary development and test environments for the various systems to be enhanced.

A single Contractor Onboarding POC shall be designated by the Contractor that tracks the onboarding status of all Contractor personnel. The Contractor Onboarding POC shall be responsible for accurate and timely submission of all required VA onboarding paperwork to the COR. The Contractor shall be responsible for tracking the status of all their staff’s onboarding activities and report the status at the staff level during onboarding status meetings. The Contractor shall provide an Onboarding Status Report weekly for any staff with outstanding onboarding requests for review by the COR, VA PM and Product Manager.

A. Onboarding Status Report

5.2. HUMAN CENTERED DESIGN (HCD)

Human-centered design (HCD) is an approach to interactive systems development that aims to make systems usable and useful by focusing on the users, their needs, and requirements, and by applying human factors, usability knowledge, and techniques.

This approach enhances effectiveness and efficiency, improves user satisfaction, accessibility, and sustainability.

The Contractor shall utilize HCD principles as part of all product development and operations efforts. While engaging in the following HCD activities, the Contractor shall:

1. Follow the United States Digital Service value: “Design with users, not for them.”

2. Provide expert guidance on user experience (UX) design direction and strategy; and

3. Create and maintain documentation for all activities, recommendations, and decisions.

At the start of work on a new or existing Epic, conduct a product development kick-off meeting with government Product Owner and designated stakeholders to establish desired outcomes.

User Research As part of user research, the Contractor shall:

A. Facilitate discovery activities, to include generative research with users and business stakeholders, an assessment of current related features, a content review, an information architecture review, an accessibility review, a business process review; and collection of any available data and analytics and provide in a User Research Checklist. The following Checklist provides additional details on these requirements: (https://department-of-veterans-affairs.github.io/va-digital-service-handbook/delivery/research-and-discovery/checklist)

B. Partner with other VA Product Teams building a new feature to GCLAWS to ensure that the new tool or service fits into the existing structure.

C. Conduct formative and contextual user research studies to understand users’ goals, needs, journeys, and pain points with respect to the Records Management and CALG product. Apply insights from user research studies to define minimum viable product (MVP) functionality, including epics and user stories, as well as operational, business, functional, technical, data, and integration requirements.

D. As part of the overall product test strategy, conduct routine, iterative usability testing on Records Management and CALG, to continually improve the user experience and to inform content, information architecture, design, functionality, and accessibility. Iteratively apply insights gathered to inform design and development.

https://department-of-veterans-affairs.github.io/va-digital-service-handbook/delivery/research-and-discovery/checklist https://department-of-veterans-affairs.github.io/va-digital-service-handbook/delivery/research-and-discovery/checklist

E. Before releasing to production, conduct User Acceptance Testing (UAT) on new features, content reviews of existing Records Management and CALG content, Information Architecture (IA) reviews for global navigation and design reviews of existing patterns and User Interface (UI) elements to identify and make modifications to accommodate the new features of the GCLAWS product, while maintaining a positive user experience

F. The Contractor shall create a User Experience (UX) Research Plan and Summary for each user research study, which shall include a research write-up documenting research question, hypotheses, methodology, recruiting needs, synthesis, and next steps.

Content & Design As part of design, the Contractor shall:

A. Employ design process management by breaking designs into small, bite-sized implementations and collecting data from each deployment to inform priorities and decisions in the next iteration.

B. Write and edit plain language content for the Records Management and CALG Development Teams. See https://design.va.gov for the style guide.

C. Ensure consistency and continuity in GCLAWS information architecture, including URL schema, page layout, menus and navigation, user flows, and search engine optimization. Work with all VA Product Teams to incorporate new Records Management and CALG features, both authenticated and unauthenticated content and tools, into the Information Architecture Document of GCLAWS product.

D. Craft, test, and deploy design deliverables, including wireframes, low- and high-fidelity prototypes, or interactive web forms to facilitate usability testing and agile development of the Records Management and CALG product. As appropriate, create and update prototypes to conduct facilitated demos or usability testing to elicit feedback for improvements to the design.

E. Develop designs that adhere to VA’s application of the U.S. Web Design System, available on https://design.va.gov . If the Contractor determines a need for a new pattern, the Contractor shall collaborate with GCLAWS Product Manager (PM)/COR to design that pattern.

F. Support and comply with all UX guidelines and standards as defined by the VA, currently at https://department-of-veterans-affairs.github.io/va-digital-service-handbook/

Product Lifecycle Activities The Contractor shall support HCD activities for the Records Management and CALG product throughout its lifecycle by engaging in the following activities:

A. Conduct discovery activities on existing Records Management and CALG legacy systems as well as internal and external business process flows and functions.

Work closely with VA customers to understand their needs and how those needs map to VA capabilities. Collect available data, user feedback, and VA stakeholder feedback and capture in a Discovery Report.

https://design.va.gov/ https://design.va.gov/ https://department-of-veterans-affairs.github.io/va-digital-service-handbook/ https://department-of-veterans-affairs.github.io/va-digital-service-handbook/

B. Maintaining a product roadmap that includes comprehensive list of the Records Management and CALG product functionality that needs to be built or updated and prioritization of these based on Discovery that has happened, as well as product KPIs. These product’s Key Performance Indicators (KPIs) shall be established in concert with the VA Product Owner and key stakeholders, as well evaluation KPI methodologies. All KPIs shall be designed to allow the team to effectively and objectively evaluate the product against user needs throughout the life of the product.

C. Participate in VA stakeholder meetings, some of which will be in-person at VA facilities, to plan building and integrating the services and change management activities including but not limited to managing agendas, minutes, action items, and collaboration tool management meetings.

D. Mock proposed Records Management and CALG functions to receive feedback from potential consumers and iterate on designs quickly prior to beginning software development.

Deliverables:

A. User Research Checklist B. User Experience Research Plan and Studies C. Information Architecture Document D. Discovery Report E. Product Plan/Roadmap and KPIs

CONTINUOUS REPORTING

User Test documentation is to be delivered in a continuous elaboration throughout the development and deployment of the Release Management and CALG products. Section

5.3 discusses the testing timeframes and artifacts required.

Epics, Stories and Wireframes are to be delivered in a continuous elaboration throughout the development and deployment of the Release Management and CALG products. Section 5.3 discusses work products and their respective timeframes for delivery.

5.3. APPLICATION PERFORMANCE MONITORING AND ALERTING

As part of GCLAWS Development and Operations, the Contractor shall utilize Application Performance Monitoring (APM) strategies for application health develop metrics that that will be monitored throughout the contract.

The Contractor shall provide an Application Monitoring Plan that defines how metrics will be monitored throughout the performance of the requirements, including the automated testing tools and automated Service Level Agreement (SLA) testing scripts that shall be used. The Contractor shall provide the Application Monitoring Plan to the VA PM/COR for review and approval. Upon approval, the Contractor shall implement application monitoring IAW the approved plan and establish an Application Dashboard that provides real time performance metrics to all program stakeholders.

The Contractor APM processes shall:

1. Ensure that custom software components can be instrumented to support a VA approved performance monitoring standard (e.g., Open Tracing)

2. Produce and maintain documentation describing data flow through the application, focusing on how and when the application passes/accepts data to/from other systems or end users.

3. Ensure that all workflows and actions identified during the HCD process are distinctly mapped/measured in the monitoring environment.

4. Monitor system, network, application, database logs, and performance metrics via VA approved VAEC/Cloud Service Provider (CSP) monitoring tools and ensure that code and logic changes are accurately reflected in the monitoring tools.

5. Work with the VA to instrument all significant data paths; or instrument all significant data paths themselves using VA approved monitoring tools.

6. Utilize monitoring plugins and agents to monitor numerical metrics provided by external services, servers, or equipment to collect more in-depth metrics.

7. Work with the VA to establish performance thresholds for the application; integrate those into the monitoring tools.

8. Establish robust and reliable alerting and escalation paths for performance violations (e.g., text, PagerDuty); parties directly responsible for the application as well as the VA should be made aware of performance issues immediately when detected.

9. Write and monitor synthetic monitoring scripts for VA infrastructure and applications.

10. Perform postmortems of any outages occurred, including root cause analysis and steps to prevent future outages and provide Postmortem Reports accordingly.

The Contractor shall document the progress of the products in the Weekly Progress Report support performance metrics including but not limited to number of issues reported, problem type identification, % resolved, time for resolution, priority, severity, etc. as agreed to with the PM/COR. The Contractor shall provide a Records Management and CALG Response Time Monitoring Report, appended to the Weekly Progress Report, that provides Records Management and CALG response time frames at the 50th, 75th, 95th, and 99th percentiles for each Records Management and CALG product.

A. Application Monitoring Plan/Dashboard B. Postmortem Reports C. Product Response Report

5.3.1. DELIVERABLE METRICS/SLAS

The Contractor shall ensure all Records Management and CALG Service Level Agreements, as defined below, are met, and that the Records Management and CALG function correctly.

Service Availability: All deployed services shall be available and functional to serve user requests at no less than 99.9% availability. Services that are faulted due to an external entity shall have trouble tickets logged with the responsible party, with all outage time attributable to this team until the ticket is logged with the responsible entity. An automated test, IAW the approved Application Monitoring Plan, with an execution frequency of no more than 300 seconds, and the logged reports of execution, including timing details, of that test shall be provided in the Metrics Report. Any faulted services attributed to an external entity shall include a record of the trouble ticket that was issued to the responsible party. This record shall include the time that it was filed, and if resolved, the time of resolution. Any maintenance window outages due to upstream or downstream maintenance shall include a record of the notification that was distributed to VA Stakeholders, and the time which the record was distributed.

Service Reachability: Services on this platform shall be reachable by internal and external entities no less than 99.9% of the time. All required routing and proxying services are correctly functioning and forwarding traffic. Services that are faulted due to an external entity shall have trouble tickets logged with the responsible party, with all outage time attributable to this team until the ticket is logged with the responsible entity.

Services that are unavailable due to upstream maintenance must have an outage notification to all VA stakeholders prior to the maintenance window for attribution to the upstream team. The Contractor shall have access to the Government’s published maintenance windows times and dates upon award. An automated test, IAW the approved Application Monitoring Plan, and the logged reports of execution, including timing details, of that test shall be provided in the Weekly Progress report in a section titled Metrics.

Development Environment Availability: The Records Management and CALG products shall be available in the staging environment during normal VA business hours (7 am – 9 pm EST). An external entity shall be able to log into the environment, execute build and deploy jobs in the development enclave, and observe the results of those jobs with no less than 99.0% availability. An automated test, IAW the approved Application Monitoring Plan, and the logged reports of execution, including timing details, of that test shall be provided in the Weekly Progress report in a section titled Platform Metrics .

The Contractor shall provide a Records Management and CALG Weekly Progress Report which shall capture data as specified in the Deliverable Metrics/SLAs.

5.4. BUSINESS CAPABILITIES AND EXPECTED OUTCOMES

There exists a set of features…