BTT SaaS Replacement RFI - Draft PWS 3.4.25.pdf

PERFORMANCE WORK STATEMENT

DEPARTMENT OF VETERANS AFFAIRS

Office of Information & Technology Information Technology Budget and Finance

Budget and Acquisition Management Software as a

Service Solution and Maintenance

Date: 3/4/2025 36C10A25Q0031

Draft PWS Version Number: 1.0

Budget and Acquisition Management (SaaS) Solution and Maintenance

VA-25-00054832

1.0 BACKGROUND

The Department of Veterans Affairs (VA), Office of Information & Technology (OIT), Information Technology Budget and Finance (ITBF) strives to provide high quality, effective, and efficient Information Technology (IT) services to those responsible for providing care to the Veterans at the point-of-care as well as throughout all the points of the Veterans’ health care in an effective, timely and compassionate manner. VA depends on Information Management/Information Technology (IM/IT) systems to meet mission goals.

OIT requires the capability to manage the Congressional appropriations and its acquisitions to enhance financial and acquisition data tracking, transparency, and traceability across OIT portfolios and investments. This capability reinforces OIT’s commitment to effective fiscal management while adhering to the stringent requirements set forth by federal oversight bodies.

2.0 APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement (PWS), the Contractor shall comply with the following:

1. 44 U.S.C. § 3541-3549, “Federal Information Security Management Act (FISMA) of 2002”

2. “Federal Information Security Modernization Act of 2014”

3. Federal Information Processing Standards (FIPS) Publication 140-2, “Security Requirements for Cryptographic Modules”

4. FIPS Pub 199. “Standards for Security Categorization of Federal Information and Information Systems,” February 2004

5. FIPS Pub 200, “Minimum Security Requirements for Federal Information and

Information Systems,” March 2006

6. FIPS Pub 201-2, “Personal Identity Verification of Federal Employees and

Contractors,” August 2013

7. 10 U.S.C. § 2224, "Defense Information Assurance Program"

8. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

9. Public Law 109-461, Veterans Benefits, Health Care, and Information

Technology Act of 2006, Title IX, Information Security Matters

10. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”

11. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, https://www.va.gov/vapubs/index.cfm

12. VA Handbook 0710, “Personnel Security and Suitability Program,” May 2, 2016, https://www.va.gov/vapubs/index.cfm

13. VA Directive and Handbook 6102, “Internet/Intranet Services,” August 5,

14. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and Guidelines,” January 18, 2017 https://www.va.gov/vapubs/index.cfm https://www.va.gov/vapubs/index.cfm http://www.va.gov/vapubs http://www.va.gov/vapubs

15. Office of Management and Budget (OMB) Circular A-130, “Managing Federal Information as a Strategic Resource,” July 28, 2016

16. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed Services (CHAMPUS)”

17. NIST SP 800-66 Rev. 1, “An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule,” October 2008

18. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended, January 18, 2017

19. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

20. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021

21. VA Handbook 6500, “Risk Management Framework for VA Information

Systems VA Information Security Program,” February 24, 2021

22. VA Handbook 6500.2, “Management of Breaches Involving Sensitive

Personal Information (SPI),” March 12, 2019

23. VA Handbook 6500.5, “Incorporating Security and Privacy into the System

Development Lifecycle,” March 22, 2010

24. VA Handbook 6500.6, “Contract Security,” March 12, 2010

25. VA Handbook 6500.8, “Information System Contingency Planning,” April 6,

26. VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018

27. VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017

28. OIT Process Asset Library (PAL), https://www.va.gov/process/ . Reference

Process Maps at https://www.va.gov/process/maps.asp and Artifact templates at https://www.va.gov/process/artifacts.asp

29. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

30. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014

31. VA Handbook 6508.1, “Procedures for Privacy Threshold Analysis and Privacy Impact Assessment,” July 30, 2015

32. VA Handbook 6510, “VA Identity and Access Management,” January 15,

33. VA Directive and Handbook 6513, “Secure External Connections,” October 12, 2017

34. VA Directive 6300, “Records and Information Management,” September 21,

35. VA Handbook, 6300.1, “Records Management Procedures,“ March 24, 2010

36. NIST SP 800-37 Rev 2, “Risk Management Framework for Information

Systems and Organizations: A System Life Cycle Approach for Security and Privacy,” December 2018

37. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020)

38. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015 https://www.va.gov/process/ https://www.va.gov/process/maps.asp https://www.va.gov/process/artifacts.asp https://www.va.gov/trm/TRMHomePage.aspx

39. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-

12) Program,” March 24, 2014

40. OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005

41. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019

42. OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008

43. Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance, December 2, 2011, (NOTE: Part A of the FICAM Roadmap and Implementation Guidance, v2.0, was replaced in 2015 with an updated Architecture (https://arch.idmanagement.gov/#what-is-the-ficam-architecture)

44. NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access,“ June 2018

45. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, “Digital Identity Guidelines,” updated March 02, 2020

46. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014

47. NIST SP 800-164, “Guidelines on Hardware-Rooted Security in Mobile

Devices (Draft),” October 2012

48. Draft National Institute of Standards and Technology Interagency Report

(NISTIR) 7981, “Mobile, PIV, and Authentication,” March 2014

49. VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland

Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

50. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

51. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

52. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

53. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019

54. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008

55. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (Public Law 110–140), December 19, 2007

56. Section 104 of the Energy Policy Act of 2005, (Public Law 109–58), August 8, 2005

57. Executive Order 13834, “Efficient Federal Operations,” dated May 17, 2018

58. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August

2, 2001

59. VA Directive 0058, “VA Green Purchasing Program,” July 19, 2013 https://arch.idmanagement.gov/#what-is-the-ficam-architecture https://arch.idmanagement.gov/#what-is-the-ficam-architecture https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514 https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896 https://www.cisa.gov/publication/tic-30-core-guidance-documents

60. VA Handbook 0058, “VA Green Purchasing Program,” July 19, 2013

61. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote

Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

62. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

63. “Veteran Focused Integration Process (VIP) Guide 4.0,” January 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

64. VA Memorandum “Proper Use of Email and Other Messaging Services,”

January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

65. “DevSecOps Product Line Management Playbook” version 2.0, May 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

66. NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020

67. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol

Version 6 (IPv6),” November 19, 2020

68. Social Security Number (SSN) Fraud Prevention Act of 2017

69. Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23,

3.0 SCOPE OF WORK

The VA requires a comprehensive Software as a Service (SaaS) solution, to include maintenance, for budget formulation, execution, and acquisition management and oversight functions of the VA OIT Programming, Planning, Budget, and Execution (PPBE) process. The solution needs to enhance financial and acquisition data tracking, transparency, and traceability across OIT portfolios and investments.

The SaaS solution must provide the following functions and capabilities to OIT:

• SaaS platform capability with application solution.

• Implementation including software installation, testing, and deployment support.

• Training support shall be available through the duration of the contract period of performance.

• Help Desk support.

• Service and support including technical support and Service Level Agreements (SLAs).

• Installation of software upgrades, patches, and releases.

4.0 PERFORMANCE DETAILS

4.1 PERFORMANCE PERIOD

The Period of Performance (PoP) shall be 12 months from date of award, with four 12-month option periods.The overall Period of Performance shall not exceed 60 months.

https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371 https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

There are eleven (11) Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, five are set by date:

New Year's Day January 1 Juneteenth June 19 Independence Day July 4 Veterans Day November 11 Christmas Day December 25

If any of the above falls on a Saturday, then Friday shall be observed as a holiday.

Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

Martin Luther King's Birthday Third Monday in January Washington's Birthday Third Monday in February Memorial Day Last Monday in May Labor Day First Monday in September Columbus Day Second Monday in October Thanksgiving Fourth Thursday in November

4.2 PLACE OF PERFORMANCE

Tasks under this PWS shall be performed at Contractor facilities. The Contractor shall identify the Contractor’s place of performance in their proposal submission.

Work may be performed at remote locations with prior approval of the Program Manager (PM). The Contractor shall maintain onsite presence during normal Monday through Friday business hours. After-business-hours, emergency, and pre-approved scheduled work may be performed at remote locations with prior approval of the VA program manager as stated in this PWS.

4.3 TRAVEL

The Government does not anticipate travel for this requirement.

5.0 SPECIFIC TASKS AND DELIVERABLES

5.1 PROJECT MANAGEMENT

5.1.1 CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, timeline, and tools to be used in execution of the task order. The CPMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks, and resource support including onboarding of staff. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPMP shall be concurred upon and updated in accordance with Section 5.1.1 of the task order. The Contractor shall update and maintain the VA Project Manager (PM) approved CPMP throughout the PoP.

The Contractor shall develop a detailed work plan as a part of the PMP and briefing for the VA project team and Contracting Officer’s Representative (COR) to present the Contractor's strategy for performing the work required in this PWS. The Contractor's plan shall be responsive to this PWS and shall describe the approach to be used for each aspect of the PWS.

The Contractor shall prepare and provide a risk management plan, as a part of the PMP. Included in the plan, the Contractor shall prepare and maintain a risk register for this project, which identifies and tracks operational and development risks, status, and mitigation strategies. The risk register shall be updated weekly with the current status of risks, and within two business days following the realization of a risk (i.e., when a risk occurs operationally) or the implementation of a risk mitigation action.

The Contractor shall create a Quality Assurance Monitoring Program (QAMP) plan to detail how the Contractor plans to monitor the quality of the SaaS system. The QAMP Plan shall specifically address how the Contractor will monitor updates to the SaaS application administration data and application enhancements to maintain SaaS system integrity.

The Contractor shall attend a virtual Post Award Conference with the Program and Project Managers. This conference shall cover the Contractor’s approach to task order performance, the Project Management Plan, contract staffing and key personnel, and the Risk Management Plan. This meeting shall include the COR, Contracting Officer, and Contract Specialist. The Contractor shall observe the acquisition and budgetary nature of this information involved in performing this task order and shall:

1. Prevent disclosure of budgetary information to which it has access.

2. Prevent disclosure of any acquisition and contractual information to which it has access.

3. Require its staff assigned to and those with access to information involved in this task to sign non-disclosure statements provided by the Government.

Deliverable:

A. Contractor Project Management Plan

B. QAMP

5.1.2 SCHEDULE MANAGEMENT

The Contractor shall create and maintain an Integrated Project Schedule (IPS) that depicts the full scope of the project and deliverables. The IPS shall include defined activities and all applicable Universal Project Milestones (UPM) for identifying and documenting discrete events necessary to complete the project. The Contractor shall identify task dependencies, estimate task durations, and assign required resources to each task. Any changes to the project schedule shall be reported in the Monthly Progress Report IAW PWS paragraph 5.1.3. The IPS shall clearly identify the critical path for the project. The Contractor shall obtain the necessary data and update the IPS at minimum monthly, or more frequently as required, for generating schedule reports that depict planned versus actual program, product/project performance and critical path.

A. Integrated Project Schedule and Updates

5.1.3 REPORTING REQUIREMENTS

The Contractor shall provide the COR with Monthly Progress Reports in electronic form in Microsoft Word and Project formats. The report shall include detailed instructions/explanations for each required data element, to ensure that data is accurate and consistent. These reports shall reflect data as of the last day of the preceding Month.

The Monthly Progress Reports shall cover all work completed during the reporting period and work planned for the subsequent reporting period. The report shall also identify any problems that arose and a description of how the problems were resolved. If problems have not been completely resolved, the Contractor shall provide an explanation including their plan and timeframe for resolving the issue. The report shall also include an itemized list of all Information and Communication Technology (ICT) deliverables and their current Section 508 conformance status. The Contractor shall monitor performance against the CPMP and report any deviations. It is expected that the Contractor will keep in communication with VA accordingly so that issues that arise are transparent to both parties to prevent escalation of outstanding issues.

Monthly reports shall include the following items:

1. Description of actions completed in the reporting period.

2. Description of actions planned for the next reporting period.

3. Status of activities as represented on the project plan for this task order.

4. Current assessment of risks and recommendations on risk mitigation.

5. Recommendations for future activities and changes to plans, milestones, schedules, and resources.

6. Program accomplishments and relevant statistics.

The Contractor shall conduct virtual weekly project management meetings with the Government to review system operations and maintenance, updates, risks, design and processing problems, and all other factors that affect daily system operations and future system upgrades and enhancements.

A. Monthly Progress Report

5.1.4 RISK MANAGEMENT

The Contractor shall prepare and deliver a Risk Management Plan (RMP) to the Government for approval. The objectives of the RMP are to identify, address, and mitigate risks before they become threats to success or major sources of rework. The Contractor shall also be responsible for:

• Implementing a structured and systematic approach to recognizing risks.

• Analyzing and evaluating risks by identifying the risk sources, impact, and owner, in addition to the probability of the risk occurring.

• Identifying, assessing, and presenting a range of risk response options, including mitigation strategies and solutions to the Government.

• Soliciting input, comments, and guidance from the Government.

• Monitoring and reviewing the implemented risk response options to evaluate whether the risk response achieved the intended result.

• Supporting and participating in risk status reviews/Program Level Risk

Management Board as directed by the COR.

• Provide information, recommendations, and support to the Program Level Risk

Process.

Deliverables:

A. Risk Management Plan B. Risk Management Report (included in Monthly Progress Report)

5.1.5 KICK-OFF MEETING

Within one business day of the task order award, the Contractor shall contact the COR to request a kick-off meeting. The kick-off meeting will be held at the Government site no later than 10 business days from the date of issuance of the cpmtract/order. The Contractor’s Project Manager (Contractor PM), the key personnel, and core team shall attend the meeting. The Contractor must be prepared to discuss the following:

• A high-level management approach that addresses the scope, resources, project assumptions, constraints, task objectives, key milestones, Contractor’s project organization and Contract administration, delivery schedule, and deliverables.

• A high-level work plan for all activities that addresses on- and off-site personnel support expected by month.

• Contractor’s high-level approach, schedule, and methodology to implementing planned software upgrades during the task order period of performance.

• Contractor’s high-level approach and methodology to any new development and implementation efforts.

• Contractor’s high-level approach and methodology to address risks, security, staffing/ resource issues including any sub-contractors.

• Contractor’s high-level approach and methodology to identify and address changes to include application/software, hosting, upgrades and database communications, and Configuration Management issues.

• Identification of Key Personnel, Responsible, Accountable, Consulted, and Informed, and discuss Staffing/Resource Planning at the Technical Kickoff Meeting.

A. Meeting Agenda B. Briefing Slides C. Meeting Minutes

5.1.6 PRIVACY & HIPAA TRAINING

The Contractor shall submit status of VA Privacy and Information Security Awareness training for all individuals engaged on the task. The status reporting shall identify; a single Contractor Security Point of Contract, the names of all personnel engaged on the task, their initial training date for VA Privacy and Information Security training, and their next required training date. This information shall be submitted as part of the Monthly Progress Report.

The Contractor shall submit Talent Management System (TMS) training certificates of completion for VA Privacy and Information Security Awareness training. The Contractor shall also provide VA Privacy and Information Security Awareness Signed Rules of Behavior, and VA Health Insurance Portability and Accountability Act (HIPAA) Certificate of Completion in accordance with Section 9, Training, from Appendix C of the VA Handbook 6500.6, “Contract Security”.

Deliverables:

A. TMS Training Certificates of Completion for VA Privacy and Information Security Awareness Training B. VA Privacy and Information Security Awareness Signed Rules of Behavior C. VA HIPAA Certificate of Completion

5.2 COMMERICAL-OFF-THE-SHELF (COTS) SAAS SOLUTION

OIT requires a robust Budget Formulation (BF), Budget Execution, and Acquisition Management software and services solution. This solution will enable OIT to enhance its financial stewardship by promoting greater efficiency, traceability, and transparency in budgeting and acquisition processes, ensuring improved data controls, and aligning with federal financial regulations. By streamlining these critical functions, ITBF will support OIT in making more informed financial decisions, improving transparency, and driving accountability across all phases of the IT budget lifecycle. The following capabilities are key to reinforcing OIT’s commitment to effective fiscal management while adhering to the stringent requirements set forth by federal oversight bodies:

Maintain system, data, and process integration across ITBF Directorates and PPBE workstreams and activities.

Maintain system and data interoperability with existing VA solutions that support current processes and associated guidance. For example, for Planning the solution shall support the Annual Integrated Planning Guide (AIPG) and meet evolving VA and OIT and VA Strategic Goals and Objectives. For Multi-Year Programming (MYP), the solution shall support the MYP guidance.

ITBF is seeking a comprehensive solution that supports effective system change management and control. The vendor will provide processes for planning and assessment, stakeholder engagement, and risk management to ensure smooth implementation of changes, including those related to data and funding. The solution should include features for continuous monitoring and evaluation, robust documentation and compliance, and effective data governance. Additionally, the solution shall demonstrate a change control process that will present changes to a change control board (CCB) for decision.

The solution shall maintain system and data integrity to a common budget hierarchy ensuring consistency and accuracy across financial operations. This practice supports effective budgeting, reporting, and decision-making by aligning all financial data and processes to a standardized structure. Vendors must ensure their solutions facilitate this alignment, providing robust features that enable data management, validation, and compliance with established budget hierarchies.

The solution must demonstrate compliance with the Federal Financial Management Improvement Act (FFMIA) for financial systems to ensure that the solution adheres to federal accounting standards, federal financial management system requirements, and the U.S. Standard General Ledger at the transaction level. This compliance enhances the accuracy, reliability, and timeliness of financial information, supporting effective decision-making and accountability. Vendors must ensure their solutions facilitate adherence to these standards, providing robust documentation, audit trails, and reporting capabilities to meet FFMIA requirements along with other laws and regulations referenced in the PWS.

5.2.1 BUDGET FORMULATION CAPABILITIES

OIT requires a solution that ensures the formulation and reporting of the OIT Congressional Budget Justification aligns with the VA strategic goals and performance standards and meets all Office of Management and Budget (OMB) requirements and Congressional mandates.

• Create datasets that captures up to seven fiscal years ahead and up to seven fiscal years prior to the budget year (including budget requests, enacted, and reported obligations), allowing for strategic budgetary decisions and planning projections.

• Create/Modify/View records and lines to formulate dollars down to the Sub- Project Activity level, with budget structure, strategic alignment, and categorical information required for Congressional submission as well as OMB Submission and Passback. This shall include entry and tracking of Full-Time Equivalent (FTE) by organization and by IT investment.

• Track all changes made to any field on a BF header record or line with version control, authorized user who made the change, and date of change to maintain complete traceability from start to end of cycle.

• Establish data linkage between Planning Programming Budgeting Execution workstreams and across funding years using a Unique Identifier (UID) to facilitate proper tracking of budget lines between OIT Service Lines ensuring traceability and alignment of funding profiles.

• Ability to update and manage budget structure and display different views of the dataset within the solution. For example, a “hide” and an “archive” function which would enable users to temporarily hide/archive specific sections as needed.

• Analyze and compare budget structure changes across fiscal years to consistency between budgetary values.

• Analyze and compare OMB Submission and President’s Budget amounts from previous and current Budget Year.

• Manage budget scenario builds.

• Incorporate support for the 1:N prioritization.

• Support bulk data uploads to Create/Modify records and lines and narratives from MS Excel spreadsheet.

• A repository for all budget line narratives that can be uploaded and updated in real-time so that changes in justifications between years can be more accurately tracked.

• The ability to create drop down selections for specific sections of budget lines to ensure a space-saving, user-friendly way to structure data consistently, enhancing navigation and maintaining a clean, organized interface.

5.2.1.1 BUDGET FORMULATION REPORTING AND ANALYTICS

The solution shall have reporting mechanisms for federal executives and managers to monitor budget formulation and reporting activities. The solution must be able to, but not be limited to, do the following requirements:

• Ability to create and/or link charts and tables and/or diagrams between different budget formulation products for multiple data streams and budget years.

• Be able to populate/upload and track FTE by Organization and capture FTE by IT investments.

• Develop and maintain standardized reports that can be easily understood by various OIT and VA stakeholders.

• Ability to add complex queries/formulas and data analytical features to better organize and sift through data.

• Ability to export budget data as raw data as well as custom layouts that summarize, sort, reorganize, group, count, total, or average data like MS Excel pivot tables.

5.2.2 EXECUTION CAPABILITIES

The Office of Information Technology (OIT) requires a solution that ensures the approved OIT IT budget is executed efficiently, tracking all expenditures, obligations, and adjustments in line with authorized programs and funding levels.

5.2.2.1 BUDGET OPERATING PLAN

The Office of Information and Technology (OIT) requires a solution to support budget execution responsibilities that includes establishing a phased acquisition level Budget Operating Plan (BOP) leveraging MYP/BF data that allows for management of budget execution actions.

Budget Line Item

• Allow for planned dollars for the upcoming Execution year to be laid out by month at various levels of granularity.

• Include the ability to intake and leverage data from MYP/BF and integrate with the accounting system of record which is a Momentum based product.

• Support the creation of a BOP baseline by denoting approved funding for the Execution vs planned and unfunded requirements.

• Align granular level Budget Line Items to acquisition processes and artifacts such as Requisitions and Purchase Order, Requisition Package records, and iFAMS Documents to compare planned, committed, and obligated dollars.

• Connect spend plan items to relevant Budget Formulation items that share key budget structure fields and from which the target value was generated.

• Create snapshots of budget operating plan data at a specific point in time that can be viewed and reported on comparing to current live data.

5.2.2.2 FUNDING CHANGE REQUESTS

• Support a process that facilitates workflows and needed data for funding change requests to the established BOP.

• Support tracking and traceability of Budget Line Items to include but not limited to systems control, upward and downward adjustments, and changes/impacts to Budget Operating Plan.

5.2.2.3 UNFUNDED REQUIREMENT (UFR) TRACKING

• Support the inclusion of Unfunded Requirements in the established BOP as needed to drive the VA Mission.

5.2.2.5 EXECUTION REPORTING AND ANALYTICS

The solution shall have reporting mechanisms for federal executives and managers to monitor budget execution and spending patterns. The solution must be able to, but not be limited to, do the following requirements:

• Contain standardized reports for budget execution that can be easily understood by non-financial stakeholders.

• Allow monthly, quarterly, and annual financial reports on obligations and expenditures.

• Include dashboard reporting tools for real-time financial oversight and monitoring (i.e. planned, committed, obligated)

• Provide tool for variance analysis between planned and actual expenditures, highlighting significant deviations.

• Contain reporting capabilities for unobligated funds, reallocations, and any significant changes or risks to budget performance.

• Ensure reports align with Government Performance and Results Act (GPRA) and the Federal Budget.

• Develop a solution to track FTE budget plan and execution by organization or other high-level categories. This would include tracking of FTE by project, organization, Program, etc. This will allow managers to be able to capture the total life-cycle cost of a particular project.

5.2.3 ACQUISITION MANAGEMENT AND COMPLIANCE

The Contractor shall provide a comprehensive acquisition management and reporting tool that has end-to-end functionality for data collection, processing, analysis, and visualization. The acquisition management tool must support the entire procurement lifecycle—from acquisition planning through contract award and closeout that sync real-time status updates with planned, committed, and obligated funding lines. To support maximum adaptability, it must provide flexible business rules, configurable workflows, and an end-to-end electronic file of pre- and post-award documentation.

5.2.3.1 DATA ACQUISITION AND INTEGRATION

The contractor shall provide a solution with the following data acquisition and integration support:

• Real-time and batch data collection options.

• Automated data ingestion and synchronization.

• Data validation and error handling mechanisms.

5.2.3.2 ACQUISITION TRACKING AND MONITORING

The contractor shall provide a solution with tracking functionality to include but not limited to the following:

• Unique identifier assignment for each acquisition project.

• Status tracking with customizable workflow stages.

• Automated email alerts and notifications for key milestones.

• Multi-stakeholder point-of-contact information.

• Contractual details (such as periods of performance, contract order numbers, milestone dates, etc.).

• Historical data logging and audit trails.

• Search capabilities that allow users to search for specific records using different fields (i.e. Description, creator, acquisition unique identifier, etc.).

5.2.3.3 DATA PROCESING AND MANAGEMENT

The contractor shall provide a solution with the following data processing and management capabilities:

• Data cleansing, deduplication, and normalization.

• Custom tagging and categorization for easy filtering.

• Role-based access controls and permissions.

• Compliance with industry standards and data security protocols.

• Configurable workflows and approval processes.

• Integration with third-party business intelligence tools.

5.2.3.4 IT ACQUISITION COMPLIANCE SUPPORT

The contractor shall provide a solution that supports the Department’s acquisition compliance with the Federal Information Reform Act (FITARA) and Office of Management and Budget (OMB) Memorandum 15-14, Management and Oversight of Federal Information Technology. The solution must be able to meet the following requirements:

• An automated process that allows all VA Administrations and Staff Offices to submit requests for approval of IT equipment/software acquisitions.

• Handling up to 10,000 records per year.

• Allow requests to be submitted and viewed through multiple fiscal years to include the year of execution.

• Restrict editing fields after submission.

• Provide an “undo” function to reverse an error by any approved user for the record.

• Generate an “Approval Document” (Initial and Final) in printable form (PDF).

• Provide an Approval Ledger to track Approval History and reviewer comments.

• Provide a Change History Repository.

• Send out automated email notifications to all users to accomplish a required action.

• Send out automated notifications reminders to users based on specified periods of time.

• Delete/cancel unwanted requests.

• Edit/modify a request after approval.

• Fillable request form that routes for reviews and approvals

• Ability to customize approval routing to different approvers based on dollar thresholds (approvals must be able to route through a minimum of 10 approvers).

5.2.3.5 ACQUISITION REPORTING AND ANALYTICS

• Customizable dashboards with real-time metrics.

• Predefined and ad-hoc reporting capabilities.

• Data visualization tools (charts, graphs, trend analysis).

• Export options (PDF, Excel, CSV, API integration).

5.2.4 USER ACCESS AND PERMISSIONS MANAGEMENT

The Contractor shall provide a solution that implements Role Based Access Control (RBAC) with secure user authentication.

• Support Single Sign-ON (SSO) with PIV.

• Users must be assigned roles based on job responsibilities.

• Each role must have predefined access rights to different system resources.

• Support for assigning multiple roles to a user.

• System must maintain an Access Control List (ACL) that includes but is not limited to:

o Access Control List should be configurable by system administrators.

o Logs should include identity of the user, timestamps, and actions performed.

o User assigned roles and designated approver information should be traceable.

o Provide tools for administrators to view, audit, and adjust user permissions easily.

5.2.5 SYSTEM CAPABILITIES

The Contractor shall provide interfaces and data exchanges between the solution and various applications used throughout OIT. The Contractor shall provide system documentation to include:

1. Identification of Interfaces which may include Operation Concepts (systems involved, volume, frequency, etc.), System Diagrams (hardware, communication, software, user interaction, etc.).

2. Interface definition: Define what must done to interface to an existing system, i.e., specific file formats, timing, data mapping, etc.

The solution shall integrate and share data with the following VA systems, including but not limited to:

• Integrated Financial and Acquisition Management System (iFAMS)- The VA OIT accounting system of record.

• Financial Management System (FMS) via Corporate Data Warehouse (CDW)- The VA legacy core accounting system of record, FMS is no longer compliant with OMB Circulars and there is no way to bring it into compliance. The VA is in the process of migrating to iFAMS. The solution shall integrate with both FMS and iFAMS until the VA has completed migration.

• Forecast of Opportunities and Requirements Center for Excellence Application (FORCE). A Department of Veterans Affairs contract management system of record.

• Integrated Funds Control, Accounting, and Procurement (iFCAP) via CDW- A VA database of procurement information that automates the creation, approval, and payment of VA Forms 1358 and 2237 used by VA offices that have not migrated to iFAMS. The system shall integrate with iFCAP until the VA has completed the migration to iFAMS.

• Decision Lens – The OIT integrated planning software used to bolster financial scenario building and decision-making capabilities.

The solution that is currently in use by VA OIT maintains the following system capabilities. The estimates provided are based on current system capacity and business processes.

Current

(FY25)

FY26

Growth Expected

FY27

Growth Expected

FY28

Growth Expected

FY29

Growth Expected

FY30

Growth Expected

Users, total 5,000 5,300 5,600 5,900 5,200 6,500

Users, regular (2+ times per week)

395 425 450 475 500 525

Users, concurrent

215 225 240 250 260 275

Reports, static (created by developers)

11 11 12 12 12 13

Reports, static (saved by users)

Saved: 4

Number of Runs:

Saved: 4

Run: 400

Saved: 4

Run: 400

Reports, ad hoc templates

20 20 21 21 22 22

Reports, ad hoc (created/

Saved:

4,699

Save:

5,000

Save:

5,400

Save:

5,700

Save:

6,000

Save:

6,400 saved by users)

Schedule d: 281

Runs:

49,652

Schedule:

Runs:

51,000

Schedule:

Runs:

55,000

Schedule:

Runs:

60,000

Schedule:

Runs:

62,000

Schedule:

Runs:

65,000

Dashboard components

11 11 11 11 11 11

Database Tables

444 460 480 500 520 540

Interfaces with related applications

6 6 6 7 7 7

Power BI Data Models

4 4 5 5 6 6

Power BI Reports (SAIC built and maintained)

8 17 25 31 36 40

Power BI Reports Total

13 22 32 40 47 53

Data accurate as of 02/25/2025

5.2.6 IMPLEMENTATION AND DEPLOYMENT

During the base period, the Contractor shall complete requirements sessions with the VA OIT business customer, users, and OIT staff (hereinafter “VA Team”) to properly understand and refine business requirements for implementation. The outcome shall be a review of VA business customer needs.

Deliverables:

A. Requirements Session Meeting Notes

5.2.6.1 DESIGN

The Contractor shall ensure that the design includes software configurations, interface specifications, screen and report designs, and security control specifications. The design document shall reflect the physical, functional, and operational architecture of the Contractor’s solution including constraints to functionality and any gaps. The system/software information shall be captured in the System/Software Design Document (SDD). The SDD shall address the following:

1. Establish the system architecture to include key interfaces between the cloud application and VA systems.

2. Include design considerations for security and audit procedures, archival of historical data, data migration and data handling criteria, scheduling, disaster recovery, and quality assurance factors.

3. Identify, define, and design capacity and performance requirements and any associated limitations. Specifically, coordinate with the Government to identify limitations and considerations during the design phase.

4. Apply VA standards complying with security requirements, enterprise architecture, data standardization, format, transmission, and storage in adherence with VA standards identified in the One-VA Technical Reference Model (TRM).

A. System Design Document (SDD)

5.2.6.2 CONFIGURATION & IMPLEMENTATION

The Contractor shall provide application configuration services that are consistent with its standard implementation and deployment methodology. The Contractor shall configure the application to meet all VA’s requirements as stipulated in this PWS. The Contractor shall provide guidance on alternative approaches to minimize future customizations of the application. The Contractor shall perform all configuration of the systems prior to deployment. The Contractor shall prepare a Change and Configuration Management Plan in accordance with all applicable regulatory policy and guidance.

The Change and Configuration Management Plan shall contain all information relevant to defining and modifying the application from the initial baseline configuration and subsequent re-baselining activities.

A. Change and Configuration Management Plan

5.2.6.3 PROVIDE NETWORK CONNECTIVITY

The Contractor’s hosted cloud environment shall have established and approved direct access to the VA Trusted Internet Connection (TIC) 2.0 Gateway Connection by the Kick-Off Meeting (within 10 days of award). Connectivity between the Cloud Service Provider (CSP) and the VA TIC shall comply with TIC Reference Architecture Document Version 2.0. The Contractor shall not send or receive data to the VA network without an approved Authority to Operate (ATO) from the VA. Any deployment outside of the VA firewall is subject to VA TIC 2.0 Gateway Connection requirements for communication with other VA systems within the VA Firewall.

The Contractor shall provide network solutions for connectivity between the primary and secondary site, subject to Federal Information Processing Standard (FIPS)-140-2 certification of equipment and configurations and the criteria set forth by the System Security Plan (SSP).

The Contractor shall deliver the following network functionality:

1. Provide network connectivity that complies with FIPS 140-2, Section 1, Table 1, up to and including Security Level 3.

2. The Contractor solution shall support Internet Protocol Version 6 (IPv6) in accordance with the directive issued by the Office of Management and Budget (OMB) on September 28, 2010, IPv6 technology, in accordance with the USGv6:

“Technical Infrastructure for IPv6 Adoption” and the NIST SP 800 series applicable compliance shall be included in all IT infrastructures, application designs, application development, operational systems and sub-systems, and their integration. In addition to the above requirements, all devices shall support dual stack connectivity without additional memory or other resources being provided by the Government, so that they can function in a mixed environment. All public/external facing servers and services (e.g. web, email, DNS, ISP services, etc.) shall support native IPv6 users, and all internal infrastructure and applications shall communicate using native IPv6 operations.

3. All user connectivity to the cloud hosting environment shall be through the TIC gateway. Role Holders shall not be capable of accessing the Case Management System or background investigation data through an internet connection direct to the cloud that bypasses the TIC gateway.

4. The Contractor shall provide a Service Level Agreement (SLA) document identifying the expected availability of the application. Availability of 99.9 percent is required, with a maximum amount of unplanned downtime per year not to exceed 8 hours.

5.2.6.4 IMPLEMENTATION REVIEW AND SOFTWARE ADOPTION

1. “Go live:” Where appropriate, the Contractor team and the VA core team shall designate a date or time by which the SaaS solution will be fully implemented into the process, including the replacement and retirement of any existing spreadsheets or systems. Following successful completion of the implementation, the Contractor shall update and finalize software configuration, materials, manuals, and user guides, and make final, formal delivery to VA. The Contractor shall support and coordinate the release with the technical staff and resolve issues and ensure that deployment is completed as planned.

2. Implementation Review: The Contractor team and the VA core team shall conduct an evaluation of the quality of the implementation and deployment and capture the value realized using the SaaS software. The teams will also discuss the next steps and improvements, outlining a plan to ensure full adoption of the SaaS software.

3. Documentation: The Contractor shall provide a Post Implementation Report and a Post Deployment Report. The Post Implementation Report shall include the expected outcomes as specified in the Implementation Plan, reports on variances from that plan and then asks for recommendations and how they will be used, as well as lessons learned. The Post Deployment Report shall include a comparison for actual versus expected levels of performance and support, a review of product support, product improvements incorporated, and configuration control. If any issues that affect system performance are detailed in the Post Implementation Report or the Post Deployment Report, the Contractor shall also provide a Software Remediation Plan. The Plan shall include a list of the steps to be taken to address the issue, who will be responsible for each step, a timeline for completing each step, methodologies for measuring progress and determining when the remediation project is complete.

A. Post Implementation Report

5.2.7 TRAINING

The Contractor shall provide user training. The Contractor shall update the existing, computer-based training modules for the solution as needed with each release to ensure training information reflects the current version of all system modules. The training modules shall be electronically addressed to end users of the system and to management and executive level users. The training packages shall be succinct, clear, and shall be tested on knowledgeable users prior to release to new users. The Contractor shall develop and provide training documentation to include a training guide, user materials, and quick reference cards to be used during training. These materials shall be made available to all users electronically. The Contractor shall modify training instruction and documentation as system updates and enhancements are implemented.

Deliverables:

A. Updated Computer-Based Training Modules B. User Manuals C. Quick Reference Card for users

5.2.8 HELP DESK

The Contractor shall provide all tiers of Help Desk support for all system issues for the solution users, program office, and VA system administrators. On a call-back basis, the Contractor shall provide a central point of contact for system and end-user related problems submitted via email, telephone, and/or voice mail.

The Help Desk shall be staffed from 8 AM Eastern Standard Time (EST) to 5 PM EST on all federal workdays. Additionally, the Help Desk shall provide email support from 5 PM to 8 PM EST. The Contractor shall respond to Help Desk calls within 15 minutes by telephone, and within 30 minutes by email between 5 PM - 8 PM EST. During times when budget reviews are not occurring, the Contractor shall respond to database downtime issues within one working hour, and on-going database support within eight working hours. Work includes answering questions on and resolving programming errors, updating, and maintaining reference tables, network problems, user access, password reset, and creating reports.

The Contractor shall provide a Help Desk Coverage Plan that details how the Contractor will meet the Help Desk requirements. For historical purposes, this activity required approximately four thousand six hundred (4,600) hours per year in the current system. The Contractor shall provide a description of help desk actions, number of help desk inquiries by type, average and extreme times dedicated to resolution, number of unresolved actions, and risks to the help desk program in the Monthly Progress Report.

Deliverable:

A. Help Desk Coverage Plan B. Toll-Free Help Desk Phone Number

5.2.9 OPERATIONS AND MAINTENANCE DAILY SUPPORT

The Contractor shall provide the following operations and maintenance services for the solution:

1. Maintain the operational availability of the SaaS.

2. Maintain the security of the SaaS.

3. Maintain SaaS application administration data.

The Contractor shall maintain the operational application, including troubleshooting of all aspects of the SaaS applications, database, and supporting infrastructure to determine the causes of any application errors or degradation of systems performance.

The Contractor shall also maintain operational coordination with VA entities which provide server and network support for the SaaS infrastructure, as directed by the COR.

The Contractor shall assist VA with contingency planning and testing activities for the SaaS.

The Contractor shall maintain the configuration of the application for operation on VA servers and maintain the security of the operational application. The Contractor shall identify and communicate in writing via email to the COR any infrastructure updates or changes which are necessary to comply with VA security requirements identified in VA Directive 6500, such as installation of database or operating system patches. The Contractor shall submit a summary of communications in the Monthly Progress Report.

The Contractor shall support the SaaS application data administration operations and maintenance functions including: