Data Access Services System Software Services - DAS4 - for RFI 19Jul2024.pdf

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Office of Information & Technology

Product Engineering Service (PES)

Data Access Services System Software Services (DAS4) Date: 19 July 2024

VA-24-TBD

Task Order PWS Version Number: 1.0

*Please be advised that any hyperlinks contained within this document, if any, are for convenience purposes, only. Due to the dynamic nature of hyperlinks and the information accessed through or imbedded therein, it is incumbent upon the Contractor to ensure that all information required to successfully complete the requirements established herein is independently located, verified for accuracy, and confirmed to be the most up-to-date version available, prior to use.

Contents

1.0 BACKGROUND 5

2.0 APPLICABLE DOCUMENTS 6

3.0 SCOPE OF WORK 10

4.0 PERFORMANCE DETAILS 10

4.1 PERFORMANCE PERIOD 10

4.2 ORDER TYPE 11

4.3 PLACE OF PERFORMANCE 11

4.4 TRAVEL OR SPECIAL REQUIREMENTS 11

4.5 GOVERNMENT FURNISHED PROPERTY 12

4.6 PERSONNEL REQUIREMENTS 12

5.0 SPECIFIC TASKS AND DELIVERABLES 16

5.1 PROJECT MANAGEMENT 16

5.1.1 CONTRACTOR PROJECT MANAGEMENT PLAN 16

5.1.2 TECHNICAL KICKOFF MEETING 17

5.1.3 ONBOARDING STATUS 17

5.1.4 PRIVACY, HIPAA, AND ELEVATED PRIVILEGES TRAINING 18

5.1.5 REPORTING REQUIREMENTS 19

5.1.6 OFFBOARDING STATUS 20

5.1.7 CONFIGURATION MANAGEMENT 20

5.1.8 SCHEDULE MANAGEMENT 21

5.1.9 RISK MANAGEMENT 21

5.1.10 INCIDENT REPORTING 22

5.2 OPERATIONS AND MAINTENANCE (O&M) 22

5.2.1 PRODUCTION OPERATIONS 23

5.2.1.1 PRODUCTION OPERATIONS SUPPORT 23

5.2.1.2 RELEASE AND MAINTENANCE ACTIVITIES 25

5.2.1.3 MAJOR INCIDENT MANAGEMENT SUPPORT 25

5.2.2 INFRASTRUCTURE MANAGEMENT 25

5.2.2.1 SYSTEMS ADMINISTRATION 25

5.2.2.2 DATABASE ADMINISTRATION 26

5.2.2.3 PRODUCTION PERFORMANCE 26

5.2.2.4 ENVIRONMENT MANAGEMENT 27

5.2.2.5 ENVIRONMENT MONITORING AND ANALYTICS 28

5.2.2.6 ENVIRONMENT CONFIGURATION SUPPORT 28

5.2.3 BUILD AND RELEASE 29

5.2.3.1 BUILD, DEPLOYMENT AND RELEASE SUPPORT 29

5.2.3.2 CONTINUOUS INTEGRATION 30

5.2.3.3 CODE PROMOTION 30

5.2.4 SECURITY AND COMPLIANCE 31

5.2.4.1 AUTHORITY TO OPERATE COMPLIANCE SUPPORT 31

5.2.4.2 ASSESSMENT AND AUTHORIZATION 32

5.2.4.3 CONTINUITY OF OPERATIONS AND DISASTER RECOVERY 33

*Please be advised that any hyperlinks contained within this document, if any, are for convenience purposes, only. Due to the dynamic nature of hyperlinks and the information accessed through or imbedded therein, it is incumbent upon the Contractor to ensure that all information required to successfully complete the requirements established herein is independently located, verified for accuracy, and confirmed to be the most up-to-date version available, prior to use.

5.2.4.4 SOLUTION ARCHITECTURE AND DATA ARCHITECTURE 33

5.2.4.5 DOCUMENTATION UPDATES 34

5.3 OPERATIONS & MAINTENANCE (O&M) SERVICES (OPTIONAL TASKS 1-6) 34

5.3.1 O&M SERVICES – SMALL: STRATEGIC PLANNING SERVICES (OPTIONAL

TASK 1) 35

5.3.2 O&M SERVICES – SMALL: CLOUD ARCHITECTURE SERVICES

(OPTIONAL TASK 2) 35

5.3.3 O&M SERVICES – MEDIUM: SOFTWARE BUILD AND RELEASE SERVICES

(OPTIONAL TASK 3) 36

5.3.4 O&M SERVICES – MEDIUM: SOFTWARE ARCHITECTURE SERVICES

(OPTIONAL TASK 4) 36

5.3.5 O&M SERVICES – MEDIUM O&M SCRUM TEAM (OPTIONAL TASK 5)

5.3.6 O&M SERVICES - LARGE O&M SCRUM TEAM (OPTIONAL TASK 6) 36

5.4 SOFTWARE DEVELOPMENT SERVICES (Optional Tasks) 36

5.4.1 DEVELOPMENT SERVICES (OPTIONAL TASKS 7-12) 36

5.4.1.1 DEVELOPMENT SERVICES – SMALL: STRATEGIC PLANNING SERVICES

(OPTIONAL TASK 7) 37

5.4.1.2 DEVELOPMENT SERVICES – SMALL: CLOUD ARCHITECTURE SERVICES

(OPTIONAL TASK 8) 38

5.4.1.3 DEVELOPMENT SERVICES – MEDIUM: SOFTWARE BUILD AND RELEASE

SERVICES (OPTIONAL TASK 9) 38

5.4.1.4 DEVELOPMENT SERVICES – MEDIUM: SOFTWARE ARCHITECTURE

SERVICES (OPTIONAL TASK 10) 38

5.4.1.5 DEVELOPMENT SERVICES – MEDIUM DEVELOPMENT SCRUM TEAM

(OPTIONAL TASK 11) 38

5.4.1.6 DEVELOPMENT SERVICES – LARGE DEVELOPMENT SCRUM TEAM

(OPTIONAL TASK 12) 38

5.4.2 RESOURCE PLANNING 38

5.4.3 INTAKE AND REQUIREMENTS 39

5.4.3.1 INTAKE 39

5.4.3.2 REQUIREMENTS 39

5.4.4 ARCHITECTURE 40

5.4.4.1 SOLUTION ARCHITECTURE 40

5.4.4.2 INNOVATIONS 40

5.4.4.3 DATA ARCHITECTURE 41

5.4.5 PROGRAM INCREMENT (PI) PLANNING 41

5.4.6 SPRINT PLANNING 42

5.4.7 SPRINT EXECUTION 43

5.4.8 SPRINT TESTING 43

5.4.8.1 TEST DATA 44

5.4.8.2 SPRINT EXECUTION 44

5.4.8.3 BUILD ASSEMBLY TESTING 45

5.4.9 RELEASE AND DEPLOYMENT 45

5.5 OUTGOING TRANSITION SUPPORT (OPTIONAL TASK 7) 46

*Please be advised that any hyperlinks contained within this document, if any, are for convenience purposes, only. Due to the dynamic nature of hyperlinks and the information accessed through or imbedded therein, it is incumbent upon the Contractor to ensure that all information required to successfully complete the requirements established herein is independently located, verified for accuracy, and confirmed to be the most up-to-date version available, prior to use.

1.0 GENERAL REQUIREMENTS 47

6.1 ENTERPRISE AND IT FRAMEWORK 47

6.1.1 VA TECHNICAL REFERENCE MODEL 47

6.1.2 FEDERAL IDENTITY, CREDENTIAL, AND ACCESS MANAGEMENT

(FICAM) 47

6.1.3 INTERNET PROTOCOL VERSION 6 (IPV6) 49

6.1.4 TRUSTED INTERNET CONNECTION (TIC) 49

6.1.5 STANDARD COMPUTER CONFIGURATION 49

6.1.6 VETERAN FOCUSED INTEGRATION PROCESS (VIP) AND PRODUCT LINE

MANAGEMENT (PLM) 50

6.1.7 PROCESS ASSET LIBRARY (PAL) 50

6.1.8 AUTHORITATIVE DATA SOURCES 51

6.1.9 SOCIAL SECURITY NUMBER (SSN) REDUCTION 52

6.2 SECURITY AND PRIVACY REQUIREMENTS 52

6.2.1 POSITION/TASK RISK DESIGNATION LEVEL(S) 52

6.2.2 CONTRACTOR PERSONNEL SECURITY REQUIREMENTS 53

6.3 METHOD AND DISTRIBUTION OF DELIVERABLES 55

6.4 PERFORMANCE METRICS 55

6.5 FACILITY/RESOURCE PROVISIONS 56

6.6 GOVERNMENT FURNISHED PROPERTY 57

6.7 SHIPMENT OF HARDWARE OR EQUIPMENT 59

SECTION 508 – ELECTRONIC AND INFORMATION TECHNOLOGY (EIT) STANDARDS

6.7.1 SECTION 508 INFORMATION AND COMMUNICATION TECHNOLOGY (ICT)

STANDARDS 60

6.7.2 COMPATIBILITY WITH ASSISTIVE TECHNOLOGY 60

6.7.3 ACCEPTANCE AND ACCEPTANCE TESTING 61

6.8 ORGANIZATIONAL CONFLICT of INTEREST 61

1.0 ADDENDUM A – ADDITIONAL VA REQUIREMENTS, CONSOLIDATED 61

FIGURES

Table 1: Federal Holiday by Date Table 2: Federal Holidays by Day Table 3: Personnel Requirements Table 4: Tools and Technology Table 5: Tier Level Support Table 6: O&M Scrum Team Sizes Table 7: Development Scrum Team Sizes

*Please be advised that any hyperlinks contained within this document, if any, are for convenience purposes, only. Due to the dynamic nature of hyperlinks and the information accessed through or imbedded therein, it is incumbent upon the Contractor to ensure that all information required to successfully complete the requirements established herein is independently located, verified for accuracy, and confirmed to be the most up-to-date version available, prior to use.

BACKGROUND

The Department of Veterans Affairs (VA), Office of Information & Technology (OIT), Product Engineering Service (PES), Veterans Experience Services (VES) Pillar maintains a vision to provide positive outcomes for Veterans and their families through the enablement of a data-driven VA culture that continuously improves the delivery of world-class benefits and services. PES VES manages a complex portfolio of products that support the increasing demand for data to meet the Department’s obligations to the Veteran community.

Veterans’ Health Administration (VHA) research initiatives, Veterans Benefits

Administration (VBA) Compensation and Pension Claims initiatives, OIT modernization initiatives, and legislative mandates like the Sergeant First Class (SFC) Heath Robinson Honoring our Promise to Address Comprehensive Toxics (PACT) Act are increasing the demand for data transfer across VA systems and with external partners in order to provide Veterans with the benefits and services they deserve, while also proving critical to the achievement of the Department’s goals. For these important efforts to be successful, PES VES must continue to sustain and evolve the Data Access Services (DAS) system, ensuring that the tools, best practices and supporting architecture continually evolve to meet the needs and expectations of OIT’s technical product teams. Furthermore, evolving the platform and maintaining high availability of this critical system’s essential products and services is increasingly important to PES VES’ contribution to achieving the VA’s mission.

DAS is a system of middleware applications that is responsible for the transport of

Veterans health, benefits, or administrative data between partner systems that are generally categorized into two groups: producers - systems that provide the data, and can be external or internal to VA; and consumers - systems that require the data, and may also be internal or external to VA.

DAS provides a common access mechanism for data related to Veterans’ electronic record information which is stored in and outside of VA. The DAS system is authorized to store Veteran data transported between producer and consumer systems. The five petabytes (5 PB) of Cloud Storage in DAS for our various dataflows and audit data including more than six-hundred terabytes (600 TB) for the National Precision Oncology Program (NPOP) dataflow, ninety terabytes (90 TB) for the Service Treatment Record (STR) dataflow, and forty terabytes (40 TB) for the Disability Benefits Questionnaire dataflow (DBQ) is primarily stored using the MongoDB NoSQL database product, but DynamoDB, MySQL and Amazon Web Services (AWS) Simple Storage Services (S3) are used where their attributes are a better match for the requirements of the dataflow than MongoDB.

*Please be advised that any hyperlinks contained within this document, if any, are for convenience purposes, only. Due to the dynamic nature of hyperlinks and the information accessed through or imbedded therein, it is incumbent upon the Contractor to ensure that all information required to successfully complete the requirements established herein is independently located, verified for accuracy, and confirmed to be the most up-to-date version available, prior to use.

DAS is essential to VA’s ability to execute its mission and provide Veterans with access to the full continuum of services and benefits they have earned. There are currently twenty-six (26) dataflows active in production, servicing approximately fifty (50+) partner systems, creating more than two million transactions daily. DAS sets the foundation for sharing information within VA and between VA and its external partners. DAS delivers a wide range of integrally linked, complementary capabilities that enable information sharing throughout VA and with its partners, including but not limited to:

• Department of Defense (DoD) Defense Health Agency (DHA)

• VA Office of Electronic Health Records Modernization Integration Office (OEHRM

IO) and its contracted external partner Oracle Health

• VA Health Connect Customer Relationship Management (VAHC CRM)

• VA Community Care (CC) and their contracted external Third-Party

Administrators and CC Network partners

• Veterans Benefits Management System (VBMS) and their contracted external partners

• Veterans’ Health Administration NPOP and their contracted external partners

• Affordable Care Act (ACA) reporting for the Centers for Medicare/Medicaid

Services (CMS)

The DAS system is fully hosted in the VA GovCloud – predominately in AWS but also with a smaller presence in Azure. A broad description of the AWS infrastructure footprint includes multiple AWS accounts for discrete Development, Testing and Production environments – each operating both modern Cloud Native Services (CNS)-based DAS applications (and their respective AWS pipelines) as well as “classic” Amazon Elastic Compute Cloud (EC2) based applications; one hundred (100+) EC2-based systems running DAS on-premise MongoDB Database systems and DAS platform services (for VA customers); all systems running across multiple Availability Zones (AZ) for full redundancy in all layers. The current Azure infrastructure footprint runs on less than a dozen Azure Virtual Machines (VMs) as a subset of the DAS “classic” applications. The DAS code base has been nearly completely migrated from legacy Government custom code to cloud-based tools and services but does have a small portion of code with Simple Object Access Protocol (SOAP) interfaces and Java Message System (JMS) Queues utilizing WebLogic, while we work with partner systems to modernize older dataflows that rely on these technologies.

A unique subcomponent of the DAS system is the DAS single-point-of-entry (SPOE).

In simplest terms the DAS SPOE can be thought of as an HL7 and HTTPS proxy to streamline transaction flow between VA systems and Cerner or between Cerner and external systems. There are currently sixteen (16) VA systems connected to Oracle Health through the DAS SPOE.

APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following: *

*Please be advised that any hyperlinks contained within this document, if any, are for convenience purposes, only. Due to the dynamic nature of hyperlinks and the information accessed through or imbedded therein, it is incumbent upon the Contractor to ensure that all information required to successfully complete the requirements established herein is independently located, verified for accuracy, and confirmed to be the most up-to-date version available, prior to use.

44 U.S.C. § 3541-3549, “Federal Information Security Management Act (FISMA) of 2002”

“Federal Information Security Modernization Act of 2014” Federal Information Processing Standards (FIPS) Publication 140-2, “Security

Requirements for Cryptographic Modules” FIPS Pub 199. “Standards for Security Categorization of Federal Information and

Information Systems,” February 2004 FIPS Pub 200, “Minimum Security Requirements for Federal Information and

Information Systems,” March 2006 FIPS Pub 201-2, “Personal Identity Verification of Federal Employees and

Contractors,” August 2013 10 U.S.C. § 2224, "Defense Information Assurance Program" 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974.”

Public Law 109-461, Veterans Benefits, Health Care, and Information Technology

Act of 2006, Title IX, Information Security Matters 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964” VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, https://www.va.gov/vapubs/index.cfm VA Handbook 0710, “Personnel Security and Suitability Program,” May 2, 2016, https://www.va.gov/vapubs/index.cfm VA Directive and Handbook 6102, “Internet/Intranet Services,” August 5, 2019 36 C.F.R. Part 1194 “Information and Communication Technology Standards and

Guidelines,” January 18, 2017 Office of Management and Budget (OMB) Circular A-130, “Managing Federal

Information as a Strategic Resource,” July 28, 2016 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed Services

(CHAMPUS)”

NIST SP 800-66 Rev. 1, “An Introductory Resource Guide for Implementing the

Health Insurance Portability and Accountability Act (HIPAA) Security Rule,” October 2008

Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended, January 18, 2017

Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004 VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021 VA Handbook 6500, “Risk Management Framework for VA Information Systems VA

Information Security Program,” February 24, 2021 VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal

Information (SPI),” March 12, 2019 VA Handbook 6500.5, “Incorporating Security and Privacy into the System

Development Lifecycle,” March 22, 2010 VA Handbook 6500.6, “Contract Security,” March 12, 2010 VA Handbook 6500.8, “Information System Contingency Planning,” April 6, 2011 VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018 VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017 OIT Process Asset Library (PAL), https://www.va.gov/process/ .

https://www.va.gov/vapubs/index.cfm https://www.va.gov/vapubs/index.cfm https://www.va.gov/process/

*Please be advised that any hyperlinks contained within this document, if any, are for convenience purposes, only. Due to the dynamic nature of hyperlinks and the information accessed through or imbedded therein, it is incumbent upon the Contractor to ensure that all information required to successfully complete the requirements established herein is independently located, verified for accuracy, and confirmed to be the most up-to-date version available, prior to use.

Reference Process Maps at https://www.va.gov/process/maps.asp and Artifact templates at https://www.va.gov/process/artifacts.asp

One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014

VA Handbook 6508.1, “Procedures for Privacy Threshold Analysis and Privacy Impact Assessment,” July 30, 2015

VA Handbook 6510, “VA Identity and Access Management,” January 15, 2016 VA Directive and Handbook 6513, “Secure External Connections,” October 12, 2017 VA Directive 6300, “Records and Information Management,” September 21, 2018 VA Handbook, 6300.1, “Records Management Procedures, “March 24, 2010 NIST SP 800-37 Rev 2, “Risk Management Framework for Information Systems and

Organizations: A System Life Cycle Approach for Security and Privacy,” December 2018

NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020)

VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015

VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” March 24, 2014

OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005

OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019

OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008

Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance, December 2, 2011, (NOTE: Part A of the FICAM Roadmap and Implementation Guidance, v2.0, was replaced in 2015 with an updated Architecture (https://arch.idmanagement.gov/#what-is-the-ficam-architecture)

NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access, “June 2018

NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, “Digital Identity Guidelines,” updated March 02, 2020

NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014 Draft National Institute of Standards and Technology Interagency Report (NISTIR)

7981, “Mobile, PIV, and Authentication,” March 2014 VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland

Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514) https://www.va.gov/process/maps.asp https://www.va.gov/process/artifacts.asp https://www.va.gov/trm/TRMHomePage.aspx https://arch.idmanagement.gov/#what-is-the-ficam-architecture https://arch.idmanagement.gov/#what-is-the-ficam-architecture https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514

*Please be advised that any hyperlinks contained within this document, if any, are for convenience purposes, only. Due to the dynamic nature of hyperlinks and the information accessed through or imbedded therein, it is incumbent upon the Contractor to ensure that all information required to successfully complete the requirements established herein is independently located, verified for accuracy, and confirmed to be the most up-to-date version available, prior to use.

IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019

OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008

Sections 524 and 525 of the Energy Independence and Security Act of 2007, (Public Law 110–140), December 19, 2007

Section 104 of the Energy Policy Act of 2005, (Public Law 109–58), August 8, 2005 Executive Order 13834, “Efficient Federal Operations,” dated May 17, 2018 Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 2, 2001 VA Directive 0058, “VA Green Purchasing Program,” July 19, 2013 VA Handbook 0058, “VA Green Purchasing Program,” July 19, 2013 Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote

Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103 “Veteran Focused Integration Process (VIP) Guide 4.0,” January 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371 VA Memorandum “Proper Use of Email and Other Messaging Services,” January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 “DevSecOps Product Line Management Playbook” version 2.0, May 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946 NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020 OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol Version

6 (IPv6),” November 19, 2020 Social Security Number (SSN) Fraud Prevention Act of 2017 Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23, 2018 FedRAMP Authorization Act, December 23, 2022 VA SaaS Definition - Attachment 1 Scrum Alliance Scrum Guide https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896 https://www.cisa.gov/publication/tic-30-core-guidance-documents https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371 https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946 https://dvagov.sharepoint.com/sites/TeamROUS/Shared%20Documents/General/Draft%20Documents/Scrum%20Alliance%20Scrum%20Guide

*Please be advised that any hyperlinks contained within this document, if any, are for convenience purposes, only. Due to the dynamic nature of hyperlinks and the information accessed through or imbedded therein, it is incumbent upon the Contractor to ensure that all information required to successfully complete the requirements established herein is independently located, verified for accuracy, and confirmed to be the most up-to-date version available, prior to use.

SCOPE OF WORK

The Contractor is required to offer a comprehensive range of services for the DAS system, including software sustainment and maintenance services; Operations and Maintenance (O&M) for all environments; production and non-production environment support and provisioning; project/product management;

architecture, innovations, and solution development; coordination with partners;

software integration; software testing; release management; technical support;

content management; systems engineering; software development, modernization, and enhancements; security and Authority To Operate (ATO);

intake and requirements elaboration; schedule management; risk management;

meeting facilitation; and documentation. These services shall support current VA OIT processes and adhere to the DevOps and Agile methodologies. Agile processed and frameworks utilized may vary by team and may include Scrum, Kanban, and the Scaled Agile Framework (SAFe). Some product teams may employ a tailored or hybrid approach based on the previously listed frameworks and methodologies.

Additionally, the Contractor must adhere to VA 6500 policies, Service Level

Agreements (SLAs), and ATO requirements. The contractor may be called upon to evolve legacy code through proposing solutions that utilize cloud-native tools and services and highly resilient design patterns, adoption of Low Code/No Code (LCNC) solutions built upon approved VA OIT platforms.

For the Base Period and all Option Periods exercised, the Contractor must provide scrum teams to complete the O&M services as detailed in PWS 5.2 and all subsections. Any additional O&M or Development teams needed throughout the task order period of performance will be addressed by exercising optional tasks for additional scrum teams as described in PWS 5.3 and 5.4, including their subsections.

PERFORMANCE DETAILS

4.1 PERFORMANCE PERIOD

The Period of Performance (PoP) shall consist of one twelve (12) month base period, four (4) twelve (12) month option periods, and twelve (12) Optional Tasks.

The overall PoP shall not exceed 60 months.

Any work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO).

There are eleven (11) Federal holidays set by law (USC Title 5 Section 6103) that

VA follows:

*Please be advised that any hyperlinks contained within this document, if any, are for convenience purposes, only. Due to the dynamic nature of hyperlinks and the information accessed through or imbedded therein, it is incumbent upon the Contractor to ensure that all information required to successfully complete the requirements established herein is independently located, verified for accuracy, and confirmed to be the most up-to-date version available, prior to use.

Under current definitions, five (5) are set by date:

New Year's Day January 1 Juneteenth June 19 Independence Day July 4 Veterans Day November 11 Christmas Day December 25

Table 1: Federal Holiday by Date If any of the above falls on a Saturday, the preceding Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, the following Monday shall be observed as a holiday.

The other six (6) are set by a day of the week and month:

Martin Luther King's Birthday Third Monday in January Washington's Birthday Third Monday in February Memorial Day Last Monday in May Labor Day First Monday in September Columbus Day Second Monday in October

Table 2: Federal Holidays by Day

4.2 ORDER TYPE

The effort shall be proposed on a Firm Fixed Price (FFP) basis with a Cost Reimbursable (CR) line item for travel.

4.3 PLACE OF PERFORMANCE

The work to be performed under this Task Order (TO) shall be performed at

Contractor furnished facilities and work may be performed at remote locations with prior concurrence from the Contracting Officer’s Representative (COR).

Work shall be conducted during core business hours of 8:00 am - 5:00 pm EST, unless specified otherwise. For specific meeting types, including user requirements sessions and other key meetings which are best accomplished at Government facilities, the Government will schedule meeting rooms as necessary. No work under this TO shall take place outside the United States. If required, all travel will be pre-approved by the COR.

4.4 TRAVEL OR SPECIAL REQUIREMENTS

The Government anticipates travel to perform the tasks associated with the effort to attend program-related meetings and user requirement sessions throughout the PoP.

Travel shall be proposed on a Cost-Reimbursable basis. There will be two (2) trips of twenty (20) people yearly traveling to Washington DC, and four (4) trips of four

(4) people or less per year to various U.S. destinations. Travel shall be in accordance with the Federal Travel Regulations (FTR) and requires advanced

*Please be advised that any hyperlinks contained within this document, if any, are for convenience purposes, only. Due to the dynamic nature of hyperlinks and the information accessed through or imbedded therein, it is incumbent upon the Contractor to ensure that all information required to successfully complete the requirements established herein is independently located, verified for accuracy, and confirmed to be the most up-to-date version available, prior to use.

concurrence by the COR. Contractor travel within the local commuting area will be reimbursed according to the FTR Local travel policies.

4.5 GOVERNMENT FURNISHED PROPERTY

The Government has multiple remote access solutions available to include Citrix

Access Gateway (CAG), Site-to-Site Virtual Private Network (VPN), and

RESCUE VPN.

The Government’s issuance of Government Furnished Equipment (GFE) is limited to

Contractor personnel requiring direct access to the network to: development environments; install, configure and run Technical Reference Model (TRM) approved software and tools (e.g., Oracle, Fortify, Eclipse, SoapUI, WebLogic, LoadRunner); upload/download/ manipulate code, run scripts, and apply patches;

configure and change system settings; check logs, troubleshoot/debug, and test/Quality Assurance.

When necessary, the Government will furnish desktops or laptops, for use by the

Contractor to access VA networks, systems, or applications to meet the requirements of this PWS. The overarching goal is to determine the most cost-effective approach to providing needed access to the VA environment coupled with the need to ensure proper Change Management principles are followed.

Contractor personnel shall adhere to all VA system access requirements for on-site and remote users in accordance with VA standards, local security regulations, policies, and rules of behavior. GFE shall be approved by the COR and Program Manager on a case-by-case basis prior to issuance.

Based upon the Government assessment of remote access solutions and requirements of this TO, the Government estimates that the following GFE will be required by this TO:

1. Up to seventy (70) developer-grade laptops.

Up to thirty (30) standard grade laptops.

The Government will not provide IT accessories including, but not limited to Mobile

Wi-Fi hotspots/wireless access points, additional or specialized keyboards or mice, laptop bags, extra charging cables, extra Personal Identity Verification (PIV) card readers, peripheral devices, or additional Random Access Memory (RAM). The Contractor is responsible for providing these types of IT accessories in support of the TO as necessary and any VA installation required for these IT accessories shall be coordinated with the COR.

4.6 PERSONNEL REQUIREMENTS

The Contractor shall provide personnel with requisite skillsets to support the following functional areas for all products:

*Please be advised that any hyperlinks contained within this document, if any, are for convenience purposes, only. Due to the dynamic nature of hyperlinks and the information accessed through or imbedded therein, it is incumbent upon the Contractor to ensure that all information required to successfully complete the requirements established herein is independently located, verified for accuracy, and confirmed to be the most up-to-date version available, prior to use.

Functional Area Skillset Production

Operations/Sustainment Amazon Cloud Services Cloud Architecture

Amazon Cloud Subject Matter Expertise

Automation Engineering Azure Cloud Architecture Build & Release Management Cloud Application Administration Cloud Services Engineering Configuration Build Management Cybersecurity Data Analysis Data Architecture Database Administration Database Architecture DevOps Engineering Engineering Management HealthConnect Administration Infrastructure Management Integration Specialist IRIS Administration

IV&V

Load & Performance Testing Partner Integration Schedule Management Scrum Master Software Architecture Sustainment Management System Administration System Architecture System Maintenance Engineering Technical Asset Management Technical Business Analysis Technical Project Analysis Technical Project Management Technical Risk Management Technical Writing Test Management

Development Amazon Cloud Services Cloud Architecture

Amazon Cloud Subject Matter Expertise

Azure Cloud Architecture

*Please be advised that any hyperlinks contained within this document, if any, are for convenience purposes, only. Due to the dynamic nature of hyperlinks and the information accessed through or imbedded therein, it is incumbent upon the Contractor to ensure that all information required to successfully complete the requirements established herein is independently located, verified for accuracy, and confirmed to be the most up-to-date version available, prior to use.

Cybersecurity Engineering Management

IV&V

Infrastructure Architecture Load & Performance Testing Partner Integration Release Management Scrum Master Schedule Management Software Code Development Solution Architecture System Architecture Technical Asset Management Technical Project Analysis Technical Project Management Technical Risk Management Technical Writing Test Management Unit Testing

Table 3: Personnel Requirements

The Contractor shall provide personnel with expertise in the following implementation patterns, technologies, and methodologies: (all version numbers below and current)

Tool/Technology Version Number Apache CXF 3.5.x Apache Maven 3.9.x Apache Tomcat 8.5.x, 9.x AWS Amazon Web Services IaaS/SaaS AWS API Gateway IaaS/SaaS AWS Cloud Formation IaaS/SaaS AWS CloudTrail IaaS/SaaS AWS CloudWatch IaaS/SaaS AWS CodeBuild IaaS/SaaS AWS CodeCommit IaaS/SaaS AWS Elastic Load Balancer IaaS/SaaS AWS ElastiCache IaaS/SaaS AWS Glacier IaaS/SaaS AWS Lambda IaaS/SaaS Docker Desktop 4.x.x

*Please be advised that any hyperlinks contained within this document, if any, are for convenience purposes, only. Due to the dynamic nature of hyperlinks and the information accessed through or imbedded therein, it is incumbent upon the Contractor to ensure that all information required to successfully complete the requirements established herein is independently located, verified for accuracy, and confirmed to be the most up-to-date version available, prior to use.

Git 2.x.x Grafana k6 10.x HP Fortify Static Code Analyzer (SCA) 23.2.x Intersystems IRIS for Health 2022.1.0.209.0.22699 Jenkins Server 2.x Jetbrains IntelliJ 2023.x Jetbrains WebStorm 2023.x Jetty 12.0.x JUnit 5.x McAfee Web Gateway 9.2.x, 10.0.x Mocha 10.x Mongo Atlas MongoDB Enterprise Advanced 6.0.x MongoDB Ops-Manager 6.0.x Mulesoft Mule Runtime 4.4.x NextGen Mirth Connect 4.5.0 Nginx 1.24.x Node Package Manager (NPM) 9.x Node.js 18.x Node.js Express 4.17.x, 4.18.x Node.js Restify 11.x Open Web Application Security Project

(OWASP) Enterprise Security Application Programming Interface (ESAPI) for Java Enterprise Edition (Java EE) 2.2.0.x

Oracle Java SE 8 (aka 1.8)

11 (aka 1.11) Prometheus 2.x Python 3.12.x RedHat Ansible 2.11.12 RedHat Ansible Tower 3.4.x RedHat Enterprise Linux (RHEL) 7.x, 8.x Ruby on Rails 7.0.x S3 Browser x.

Secure Computer Remote Terminal (CRT) 9.5.x SmartBear ReadyAPI 3.x.x Sonatype Nexus Server 3.67.x Spring Framework 5.x Studio 3T for MongoDB 2023.x

*Please be advised that any hyperlinks contained within this document, if any, are for convenience purposes, only. Due to the dynamic nature of hyperlinks and the information accessed through or imbedded therein, it is incumbent upon the Contractor to ensure that all information required to successfully complete the requirements established herein is independently located, verified for accuracy, and confirmed to be the most up-to-date version available, prior to use.

Tableau 2023.x VirtualBox 7.0.x

WebLogic JMS 12cR2 (12.2.x)14c

(14.1.x) Windows Enterprise, 10

Table 4: Tools and Technology

SPECIFIC TASKS AND DELIVERABLES

The Contractor is tasked with supplying the necessary resources for designing, configuring, developing, integrating, and implementing solutions based upon open, flexible, and scalable architectures reflective of the state of the industry.

This approach aims to provide the VA with modern, lower-complexity, modular solutions that are built upon cloud-native tools and services where possible and minimize vendor/technology lock-in. Proposed and implemented architectures may utilize Platform as a Service (PaaS) capabilities to minimize complexity, Software as a Service (SaaS) integrations, Application Program Interfaces (API) for integrations with partner/external systems, and support emerging digital modernization technologies. Compliance with the latest VA Directives, Policies, Guidebooks, and applicable Federal Regulations is required.

Integration and development shall adhere to a unified Software Development Life

Cycle (SDLC) process where able that is in line with VA Product Line Management (PLM) standards and OIT engineering and release management directives. All stages of analysis, design, construction, testing, and deployment, along with associated documentation, must follow these guidelines. Proposed solutions, lifecycle processes and designs may be subject to review.

The Contractor is expected to support VA’s continued adoption of principles that enable IT as a product. This includes integration of product thinking concepts to all aspects of the planning, development and delivery process including product planning activities such as backlog grooming and prioritization throughout each product’s life cycle.

5.1 PROJECT MANAGEMENT

5.1.1 CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, timeline, and tools to be used in execution of this TO effort. The CPMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks, and resource support. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPMP shall be concurred upon and updated

*Please be advised that any hyperlinks contained within this document, if any, are for convenience purposes, only. Due to the dynamic nature of hyperlinks and the information accessed through or imbedded therein, it is incumbent upon the Contractor to ensure that all information required to successfully complete the requirements established herein is independently located, verified for accuracy, and confirmed to be the most up-to-date version available, prior to use.

in accordance with Section B of the TO. The Contractor shall update and maintain the VA Program Manager (PM) approved CPMP throughout the PoP.

Deliverable:

A. Contractor Project Management Plan

5.1.2 TECHNICAL KICKOFF MEETING

A technical kickoff meeting shall be held within ten (10) days after TO award. The

Contractor shall coordinate the date, time, and location (can be virtual) with the Contracting Officer (CO), as the Post-Award Conference Chairperson, the VA PM, as the Co-Chairperson, the Contract Specialist (CS), and the COR. The Contractor shall provide a draft agenda (via email) to the CO, CS, COR, and VA PM at least five (5) calendar days prior to the meeting.

Upon Government approval of a final agenda, the Contractor shall distribute to all meeting attendees. During the kickoff-meeting, the Contractor shall present, for review and approval by the Government, the details of the intended approach, work plan, and project schedule for each effort via a Microsoft Office PowerPoint presentation. At the conclusion of the meeting, the Contractor shall update the presentation with a final slide entitled “Summary Report” which shall include notes on any major issues, agreements, or disagreements discussed during the kickoff meeting and the following statement “As the Post-Award Conference Chairperson, I have reviewed the entirety of this presentation and assert that it is an accurate representation and summary of the discussions held during the Technical Kickoff Meeting for the DAS4 effort,”.

The Contractor shall submit the final updated presentation to the CO for review and signature within three (3) calendar days after the meeting. The Contractor shall also work with the CS, the Government’s designated note taker, to prepare and distribute the meeting minutes of the kickoff meeting a to the CO, COR, and all attendees within three (3) calendar days after the meeting. The Contractor shall obtain concurrence from the CS on the content of the meeting minutes prior to distribution of the document.

Deliverables:

A. Draft Agenda B. Final Agenda C. Kickoff Meeting Power Point Presentation D. Meeting Minutes

5.1.3 ONBOARDING STATUS

*Please be advised that any hyperlinks contained within this document, if any, are for convenience purposes, only. Due to the dynamic nature of hyperlinks and the information accessed through or imbedded therein, it is incumbent upon the Contractor to ensure that all information required to successfully complete the requirements established herein is independently located, verified for accuracy, and confirmed to be the most up-to-date version available, prior to use.

The Contractor shall manage the onboarding of its staff on this TO. Onboarding includes steps to obtain a VA PIV card, network and email account, complete training, initiate background investigations, and gain physical and logical access.

In addition, the Contractor shall identify individuals which may require elevated privileges to the necessary development, test and/or production environments for the various systems to be enhanced. After review between the Contractor and VA COR(s), a decision will be made as to the necessity of obtaining GFE for the onboarding staff. If approved, Contractor shall follow the appropriate steps to obtain the equipment. A single Contractor Onboarding Point of Contact (POC) shall be designated by the Contractor that tracks the onboarding status of all Contractor personnel.

The Contractor Onboarding POC shall be responsible for accurate and timely submission of all required VA onboarding paperwork to the VA COR(s). All VA onboarding paperwork shall be stored on the deliverables folder in the COR designated VA SharePoint site or equivalent tool. The Contractor shall be responsible for tracking the status of all their staff’s onboarding activities to include the names of all personnel engaged on the task, their initial training date for VA Privacy and Information Security training, and their next required training date. The Contractor Onboarding POC shall also report the status at the staff level during onboarding status meetings. The Contractor shall provide an Onboarding Status Report for any staff with outstanding onboarding requests in the bi-Weekly Status Report (5.1.5).

A. Weekly Onboarding Status Report

5.1.4 PRIVACY, HIPAA, AND ELEVATED PRIVILEGES TRAINING

The Contractor shall submit Talent Management System (TMS) training certificates of completion for VA Privacy and Information Security Awareness and Rules of Behavior and Health Insurance Portability and Accountability Act (HIPAA) training and provide signed copies of the Contractor Rules of Behavior in accordance with Section 9, Training, from Appendix C of the VA Handbook 6500.6, “Contract Security”. The Contractor shall provide a copy of the Privacy, HIPAA, and Elevated Privileges Training Roster to indicate the staff that have and have not completed the training in the Bi-weekly Status Report (5.1.5).

A. VA Privacy and Information Security Awareness and Rules of Behavior Training

Certificate B. Signed Contractor Rules of Behavior C. VA Health Insurance Portability and Accountability Act (HIPAA) Training

Certificate

*Please be advised that any hyperlinks contained within this document, if any, are for convenience purposes, only. Due to the dynamic nature of hyperlinks and the information accessed through or imbedded therein, it is incumbent upon the Contractor to ensure that all information required to successfully complete the requirements established herein is independently located, verified for accuracy, and confirmed to be the most up-to-date version available, prior to use.

5.1.5 REPORTING REQUIREMENTS

The Contractor shall provide the COR with a Bi-weekly Status Report using a modern, automated tool. The report shall include detailed instructions/explanations for each required data element, to ensure that data is accurate and consistent. The report shall reflect data as of the last business day of the preceding period. The Progress Report shall cover all work completed during the reporting period and work planned for the subsequent reporting period for each project. The report shall also identify any problems that arose and a description of how the problems were resolved. If problems have not been completely resolved, the Contractor shall provide an explanation including their plan and timeframe for resolving the issue. The report shall also include an itemized list of all documents and electronic deliverables. The Contractor shall monitor performance against the VA PARS/CPMP and report any deviations. It is expected that the Contractor shall keep in communication with VA accordingly so that issues that arise are transparent to both parties to prevent escalation of outstanding issues. The Contractor shall also provide the data and reporting content to support management level reporting.

The Contractor shall show all Agile requirements, changes, tests performed and test results in approved project management tools (i.e., JIRA) to show evidence of code coverage and test coverage of all the requirements specified. This expectation will allow VA to have high confidence in a fully documented, as evidenced by data in the tools, requirements traceability matrix.

The Contractor shall track all risks in the VA approved project management tool utilized by the team they are supporting. This could include Jira, MS Project, or other industry standard tools. Risk identification should include impact statements including severity, likelihood of impact and a proposed mitigation strategy. Risk status should be reviewed an updated at least once per week.

Risks that are impactful to the product, the Pillar or Portfolio should be documented in the associated VA Product Line Accountability Reporting System (VA PARS) entry for the product/program.

Additionally, the Contractor shall produce a Partner Integration Report that identifies

Partner Systems that interface with each product. Partners are other VA OIT Product Teams and external consumers that integrate with products/platforms supported by the Contractor. This report shall include a summary description of each interface, current issues, planned updates, changes in status, impact to the partner if unavailable and dependencies with each Product. The initial copy of this report shall be delivered electronically within ninety (90) days of TO award and updated electronically for every sprint thereafter.

*Please be advised that any hyperlinks contained within this document, if any, are for convenience purposes, only. Due to the dynamic nature of hyperlinks and the information accessed through or imbedded therein, it is incumbent upon the Contractor to ensure that all information required to successfully complete the requirements established herein is independently located, verified for accuracy, and confirmed to be the most up-to-date version available, prior to use.

A. Bi-weekly Status Report B. Partner Integration Report

5.1.6 OFFBOARDING STATUS

The Contractor shall manage the offboarding process for VA access and to individual system/environment access for all project management, core team, development, and O&M Contractor staff. The Contractor shall prepare all forms necessary for termination of access to VA information systems, in accordance with VA guidance. The Contractor shall assist in confirming whether the GFE equipment, associated documentation, and PIV card has been returned to the proper receiving authorities in accordance with VA policy. The Contractor shall provide an Offboarding Status Report for any staff with outstanding offboarding requests in the Bi-Weekly Status Report (5.1.5). COR notification of fully offboarding Contractor shall be provided within twenty-four (24) hours of terminated employment clearly demonstrating all access and permissions have been disconnected.

5.1.7 CONFIGURATION MANAGEMENT

The Contractor shall update the Configuration Management Plan as required to reflect these requirements:

1. Identify the standard and unique aspects of Product Configuration Management

(CM) to be performed for each product by establishing a Product Configuration Management Plan which meets PES CM plan requirements. The Contractor shall reflect all CM required activities and standards in each project-level CM plan while determining the unique aspects of the project which require individualized procedures.

2. Deliver a Recommended List of Configuration Items to include documents, technical stories, compiled and uncompiled software, libraries, diagrams, and models to be placed under configuration and change control in the Configuration Management Plan (CMP). The Contractor shall identify types of configuration items pertaining to each product to be placed under configuration management.

Based on PES requirements, and the unique needs or nature of each project, the Contractor shall determine the components within each project that must be under configuration control.

3. Use GitHub or other VA specified tool and repository for all software source code and electronic artifact configuration and version management. The Contractor shall use JIRA and the specified tool to manage change, activity, issue, action, risk, and other project data as prescribed by VA standards and processes. If assigned a project using tools that are being deprecated, the Contractor shall

*Please be advised that any hyperlinks contained within this document, if any, are for convenience purposes, only. Due to the dynamic nature of hyperlinks and the information accessed through or imbedded therein, it is incumbent upon the Contractor to ensure that all information required…