DRAFT ITSI Performance Work Statement FOR REVIEW ONLY 20241017.pdf

PERFORMANCE WORK

STATEMENT (PWS)

DEPARTMENT OF VETERANS

AFFAIRS

Office of Small and Disadvantaged

Business Utilization Shared Services Directorate

Information Technology Systems Integration (ITSI) Support

Services Contract

1.0 BACKGROUND

The Office of Small & Disadvantaged Business Utilization (OSDBU) provides numerous services for Veterans and Service-Disabled Veterans who seek to open or expand a business. OSDBU provides outreach and liaison support to businesses (small and large) and other members of the public and private sectors concerning Small Business Acquisition issues.

OSDBU monitors the Department of Veterans Affairs (VA) implementation and execution of the contract socioeconomic programs. OSDBU operates and maintains the Veterans Enterprise Management System (VEMS). VEMS is a collection of capabilities integrated with single-sign-on access. The VEMS backend is built on the Microsoft D-365 CRM platform, and the front end (the VetBiz Portal) utilizes Microsoft PowerApps Portals. This SaaS system is supported by Azure Services, located in the VA Enterprise Cloud (VAEC). VEMS is integrated with the VA Enterprise SharePoint online.

The requirements for increased levels of efficiency necessitate a continually evolving and expanding demand for information systems support. To meet these growing demands, OSDBU has established a unified team that offers reliable and effective technology solutions and services to enable OSDBU leadership and staff to serve Veterans and other key stakeholders to achieve mission success. The OSDBU Information Technology Systems Integration team (ITSI) responsibilities include balancing the Information Management and Information Technology (IM&IT) demands of the OSDBU directorates and the OSDBU leadership priorities to manage IT.

Additionally, the Department of Veterans Affairs (VA), Office of Information & Technology (OIT) utilizes the Enterprise Mission Assurance Support Service (eMASS) as its risk management framework. eMASS is a government-owned web-based application with a broad range of services for comprehensive, fully integrated cybersecurity management. Features include dashboard reporting, controls scorecard measurement, and the generation of a system security authorization package. eMASS provides an integrated suite of authorization capabilities and prevents cyber-attacks by establishing strict process control mechanisms for obtaining authorization decisions.

2.0 APPLICABLE DOCUMENTS

The Contractor shall comply with documents listed below. Additional documents may be listed in individual Task orders.

1. 44 U.S.C. § 3541-3549, “Federal Information Security Management Act (FISMA) of 2002”

2. “Federal Information Security Modernization Act of 2014”

3. Federal Information Processing Standards (FIPS) Publication 140-2, “Security Requirements for Cryptographic Modules”

4. FIPS Pub 199. “Standards for Security Categorization of Federal Information and Information Systems,” February 2004

5. FIPS Pub 200, “Minimum Security Requirements for Federal Information and Information Systems,” March 2006

6. FIPS Pub 201-2, “Personal Identity Verification of Federal Employees and Contractors,” August 2013

7. 10 U.S.C. § 2224, "Defense Information Assurance Program"

8. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

9. Public Law 109-461, Veterans Benefits, Health Care, and Information

Technology Act of 2006, Title IX, Information Security Matters

10. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”

11. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, https://www.va.gov/vapubs/index.cfm

12. VA Handbook 0710, “Personnel Security and Suitability Program,” May 2, 2016, https://www.va.gov/vapubs/index.cfm

13. VA Directive and Handbook 6102, “Internet/Intranet Services,” August 5,

14. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and Guidelines,” January 18, 2017

15. Office of Management and Budget (OMB) Circular A-130, “Managing Federal

Information as a Strategic Resource,” July 28, 2016

16. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed

Services (CHAMPUS)”

17. NIST SP 800-66 Rev. 1, “An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule,” October 2008

18. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended, January 18, 2017

19. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

20. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021

21. VA Handbook 6500, “Risk Management Framework for VA Information

Systems VA Information Security Program,” February 24, 2021

22. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI),” March 12, 2019

23. VA Handbook 6500.5, “Incorporating Security and Privacy into the System Development Lifecycle,” March 22, 2010

24. VA Handbook 6500.6, “Contract Security,” March 12, 2010

25. VA Handbook 6500.8, “Information System Contingency Planning,” April 6,

26. VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018

27. VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017

28. OIT Process Asset Library (PAL), https://www.va.gov/process/ . Reference

Process Maps at https://www.va.gov/process/maps.asp and Artifact templates at https://www.va.gov/process/artifacts.asp

29. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx) https://www.va.gov/vapubs/index.cfm https://www.va.gov/vapubs/index.cfm http://www.va.gov/vapubs http://www.va.gov/vapubs https://www.va.gov/process/ https://www.va.gov/process/maps.asp https://www.va.gov/process/artifacts.asp https://www.va.gov/trm/TRMHomePage.aspx

30. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014

31. VA Handbook 6508.1, “Procedures for Privacy Threshold Analysis and Privacy Impact Assessment,” July 30, 2015

32. VA Handbook 6510, “VA Identity and Access Management,” January 15,

33. VA Directive and Handbook 6513, “Secure External Connections,” October 12, 2017

34. VA Directive 6300, “Records and Information Management,” September 21,

35. VA Handbook, 6300.1, “Records Management Procedures,“ March 24, 2010

36. NIST SP 800-37 Rev 2, “Risk Management Framework for Information

Systems and Organizations: A System Life Cycle Approach for Security and Privacy,” December 2018

37. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020)

38. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015

39. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-

12) Program,” March 24, 2014

40. OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005

41. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019

42. OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008

43. Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance, December 2, 2011, (NOTE: Part A of the FICAM Roadmap and Implementation Guidance, v2.0, was replaced in 2015 with an updated Architecture (https://arch.idmanagement.gov/#what-is-the-ficam-architecture)

44. NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access,“ June 2018

45. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, “Digital Identity Guidelines,” updated March 02, 2020

46. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014

47. NIST SP 800-164, “Guidelines on Hardware-Rooted Security in Mobile

Devices (Draft),” October 2012

48. Draft National Institute of Standards and Technology Interagency Report

(NISTIR) 7981, “Mobile, PIV, and Authentication,” March 2014

49. VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland

Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514) https://arch.idmanagement.gov/#what-is-the-ficam-architecture https://arch.idmanagement.gov/#what-is-the-ficam-architecture https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514

50. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

51. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

52. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

53. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019

54. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008

55. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (Public Law 110–140), December 19, 2007

56. Section 104 of the Energy Policy Act of 2005, (Public Law 109–58), August 8, 2005

57. Executive Order 13834, “Efficient Federal Operations,” dated May 17, 2018

58. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August

2, 2001

59. VA Directive 0058, “VA Green Purchasing Program,” July 19, 2013

60. VA Handbook 0058, “VA Green Purchasing Program,” July 19, 2013

61. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote

Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

62. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

63. “Veteran Focused Integration Process (VIP) Guide 4.0,” January 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

64. VA Memorandum “Proper Use of Email and Other Messaging Services,”

January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

65. “DevSecOps Product Line Management Playbook” version 2.0, May 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

66. NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020

67. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol

Version 6 (IPv6),” November 19, 2020

68. Social Security Number (SSN) Fraud Prevention Act of 2017

69. Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23,

3.0 SCOPE OF WORK

The Contractor shall provide project management, technical support, business process re-engineering support, systems integration, governance, and life cycle support for various information technology systems supporting OSDBU's line of business. The systems include OSDBU's core business systems such as the VetBiz Portal, the VetBiz https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896 https://www.cisa.gov/publication/tic-30-core-guidance-documents https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371 https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

Stat (Goals Management, Predictive Analytics and Market Research system), Forecast of Opportunities (FCO), Event Management Software as a Service (EMSS), 2268NextGen and other applications being developed for the Veterans Enterprise Management System.

The Contractor shall provide IT expertise, technical knowledge, support personnel, and other related resources necessary to support the following areas:

1. IT Governance

2. Business process requirements definition

3. Microsoft Dynamic Customer-service Relationship Management (CRM) D365 administration and maintenance

4. Systems and User administration for all business systems as required

5. Cyber and systems security support

6. Lifecycle activities for software improvement, systems integration, and web/interface

7. Program and project management.

8. SharePoint development and maintenance

9. Portal development and maintenance

10. IT Technical Support

3.1 ORDER TYPE

The effort shall be proposed on a Firm Fixed Price (FFP) basis.

4.0 PERFORMANCE DETAILS

4.1 PERFORMANCE PERIOD

The Period of Performance (PoP) for this requirement shall be a 12-month base period with four (4) 12-month option periods and one optional task. Optional task is as follow:

a. Optional Task One “Phrase-Out Transition Support” This option may be exercised once during the duration of the contract in either the base or one of the option periods.

There are eleven (11) Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, four are set by date:

New Year's Day January 1 Juneteenth June 19 Independence Day July 4

Veterans Day November 11 Christmas Day December 25

If any of the above falls on a Saturday, then Friday shall be observed as a holiday.

Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

Martin Luther King's Birthday Third Monday in January Washington's Birthday Third Monday in February Memorial Day Last Monday in May Labor Day First Monday in September Columbus Day Second Monday in October Thanksgiving Fourth Thursday in November

Dates observed only by the District of Columbia as a holiday:

Inauguration day Monday January 20, 2025 Inauguration day Saturday January 20, 2029

If any of the holidays that are set by date falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if any of the dates falls on a Sunday, then Monday shall be observed as a holiday.

4.2 PLACE OF PERFORMANCE

Efforts under this requirement shall be performed at the Contractor facilities. The Contractor shall identify the Contractor’s place of performance in their Task Execution Plan submission.

4.3 TRAVEL

The Government does not anticipate travel associated with the task under this PWS.

4.4 RESERVED

5.0 SPECIFIC TASKS AND DELIVERABLES

The Contractor shall perform the following:

5.1 PROJECT MANAGEMENT

5.1.1 CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, timeline, and tools to be used in execution of the contract. The CPMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks, and resource support. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPMP shall be concurred upon and updated in accordance with Section B of the contract. The Contractor shall update and maintain the VA PM approved CPMP throughout the PoP.

Deliverable:

A. Contractor Project Management Plan (CPMP) B. CPMP Updates

5.1.2 REPORTING REQUIREMENTS

The Contractor shall provide the COR with Weekly Progress Reports in electronic form in Microsoft Word and Project formats. The report shall include detailed instructions/explanations for each required data element, to ensure that data is accurate and consistent. These reports shall reflect data as of the last day of the preceding week.

The Weekly Progress Reports shall cover all work completed during the reporting period and work planned for the subsequent reporting period. The report shall also identify any problems that arose and a description of how the problems were resolved. If problems have not been completely resolved, the Contractor shall provide an explanation including their plan and timeframe for resolving the issue. The report shall also include an itemized list of all Information and Communication Technology (ICT) deliverables and their current Section 508 conformance status. The Contractor shall monitor performance against the CPMP and report any deviations. It is expected that the Contractor will keep in communication with VA accordingly so that issues that arise are transparent to both parties to prevent escalation of outstanding issues.

Deliverable:

A. Weekly Progress Report

5.1.3 TECHNICAL KICKOFF MEETING

The Contractor shall hold a technical kickoff meeting within ten (10) days after contract award. The Contractor shall coordinate the date, time, and location (can be virtual) with the Contracting Officer (CO) as the Post-Award Conference Chairperson, the VA PM as the Co-Chairperson, the Contract Specialist (CS), and the COR. The Contractor shall provide a draft agenda to the CO and VA PM at least five (5) calendar days before the meeting. The Contractor shall distribute a final agenda to all meeting attendees upon government approval. During the kickoff meeting, the Contractor shall present, for review and approval by the Government, the details of the intended approach, work plan, onboarding schedule and project schedule for each effort via a Microsoft Office PowerPoint presentation.

The Contractor shall deliver the presentation with a final slide entitled "Summary Report," which shall include notes on any significant issues, agreements, or disagreements discussed during the kickoff meeting and the following statement: "As the Post-Award Conference Chairperson, I have reviewed the entirety of this presentation and assert that it is an accurate representation and summary of the discussions held during the Technical Kickoff Meeting for "Information Technology Systems Integration (ITSI) Support Services Contract." The Contractor shall submit the final updated presentation to the CO for review and signature within three (3) calendar days after the meeting.

The Contractor shall also work with the CS, the Government's designated note taker, to prepare and distribute the meeting minutes of the kickoff meeting to the CO, COR and all attendees within three (3) calendar days after the meeting. The Contractor shall obtain concurrence from the CS on the content of the meeting minutes before distribution of the document.

Deliverables:

A. Kickoff Agenda B. Kickoff Presentation/ final slide entitled “Summary Report” C. Kickoff Meeting Minutes

5.1.4 ONBOARDING

The Contractor shall manage the onboarding of its staff. Onboarding includes steps to obtain a VA PIV card, network and email account, complete training, initiate background investigations, and gain physical and logical access. In addition, the Contractor shall identify individuals that may require elevated privileges to the necessary development and test environments for the various systems to be enhanced. After review by the Contractor and VA, a decision will be made as to the necessity of obtaining GFE for the onboarding staff. If approved, Contractor shall follow the appropriate steps to obtain the equipment.

A single Contractor Onboarding point of contact (POC) shall be designated by the Contractor that tracks the onboarding status of all Contractor personnel. The Contractor Onboarding POC shall be responsible for accurate and timely submission of all required VA onboarding paperwork to the VA COR. The Contractor shall be responsible for tracking the status of all their staff’s onboarding activities to include the names of all personnel engaged on the task, their initial training date for VA Privacy and Information Security and role-based training, and their next required training date. The Contractor Onboarding POC shall also report the status at the staff level during onboarding status meetings. The Contractor shall provide an Onboarding Status Report weekly for any staff with outstanding onboarding requests for review by the COR, VA Program Manager and Project Manager.

A. Monthly Onboarding Status Report

5.1.5 KEY PERSONNEL

The Contractor shall be responsible for managing and overseeing the activities of all Contractor personnel, as well as subcontractor efforts, used in performance of this effort.

This effort demands a high level of technical proficiency. Contractor resources shall be identified, be PIV eligible and begin the onboarding process on day one of the TO, to include submission of all required security and PIV documentation in order to have access to the VA network.

The Contractor has a contractual obligation to mitigate the consequences of the loss of Key Personnel and shall promptly secure any necessary replacements in accordance with (IAW) this PWS section, with approval of the COR/PM and concurrence of the CO.

The Contractor shall suitably and timely replace Key Personnel who have been reassigned, terminated, or have otherwise become unavailable for the contract work, and be reasonably forthcoming about the need for such replacement. Failure to do so, or if the resultant reduction of productive effort would be so substantial as to impair the successful completion of the task order, may result in the task order being terminated by the CO for default or for the convenience of the Government, as appropriate. In addition, if the Contractor is found at fault for a delay or impairment to the contract work because of a loss of key personnel, the CO may elect to equitably decrease the contract price to compensate the Government for any resultant delay, loss, or damage.

The labor categories below are identified as Key Personnel. Key Personnel must meet the corresponding requirements identified in the Labor Description column below:

Key Personnel Positions Name System/Dev Ops Engineer Expert

CRM D365 System Admin

Cyber Security Expert

SharePoint Developer

D365 CRM Developer / Solution Architect

LCAT Minimum Technical Capabilities

Minimum Qualifications

System/Dev Ops Engineer Expert Computer and Information Systems Manager, Senior

Expertise providing the following:

• Azure Dev Ops

• Azure Cloud hosting

• Ability to support

ASP.NET, Microsoft Structured Query Language (SQL), .NET Core, SSL, and TLS

• Design, develop, and maintain scalable and stable Azure solutions.

• Automate tasks through scripting and other appropriate tools.

• Ensure security and compliance with Azure policies and procedures.

• Provide technical support and troubleshooting to resolve infrastructure-related issues.

• Collaborate with software developers to optimize application performance.

• Stay updated with the latest trends in Azure services and DevOps methodologies.

• Document and maintain Azure environment configurations and custom scripts.

Required Years of Experience:

8 -15 years of experience performing work relevant to the PWS task requirements.

Required Education:

Bachelor’s degree in computer science, Information Technology, Engineering, or a relevant field.

***Preferred certifications and years of experience can be substituted for education, only if requested.

Required Professional/Technical Expertise:

• Proven experience as an Azure

DevOps Engineer or similar role in cloud engineering.

• Expertise in Azure cloud services and DevOps practices.

• Experience with scripting languages.

• Understanding of network architectures and services (e.g., VPN, routing, firewall, etc.).

• Knowledge of container and orchestration services.

• Proficiency in using Git for version control.

Preferred Professional/Technical Expertise:

• Experience navigating the VA

OIT organization.

Microsoft Certified

1. Azure Developer Associate

2. Azure Fundamentals

Preferred Certifications:

• Microsoft Certified: Designing and Implementing Microsoft DevOps Solutions

Microsoft Certified

1. Azure Administrator Associate

2. DevOps Engineer Expert

CRM D365 System Admin Computer Systems Analyst, Senior

Expertise providing the following:

• Ability to Configure D365 elements, including custom entities, fields, views, model-driven apps, business process flows, workflows, and business rules.

• Ability to create dashboards and charts.

• Ability to integrate Power BI and CRM D365 dashboards.

• Ability to provide recommendations and identify critical issues and processing faults.

• Ability to perform testing on system changes and document dependencies.

4-8 years of experience performing work relevant to the PWS task requirements.

Required Education:

Associate degree in a field of study relevant to the PWS task requirements.

***Preferred certifications and years of experience can be substituted for education, only if requested.

Required Professional/Technical

Microsoft 365 Certified

1. Fundamentals

2. Azure Fundamentals

Microsoft 365 Certified:

1. Collaboration Communications

Systems Engineer Associate

2. Endpoint Administrator

Associate

3. Configure secure access to your workloads using Azure networking

4. Create and manage automated processes by using Power Automate

5. Information Protection and Compliance Administrator Associate

6. Azure Administrator Associate Cyber Security Expert Information Security Analyst, Senior

Expertise providing the following:

• Drafting documents required as evidence in the Risk Management Framework.

• Interpreting cyber security policies and their impact on information systems.

• Updating Risk Management Framework.

• Tracking POAMs for remediation.

• Managing Authorization to Operate (ATO) Process.

10-12 years of experience performing work relevant to the PWS task requirements.

Required Education:

Bachelor’s degree in computer science, Information Technology, Engineering, or a relevant field.

***Preferred Professional/Technical Expertise and years of experience can be substituted for education, only if requested.

Required Professional/Technical Expertise:

CompTIA Security+ certified (CySA+)

Preferred Professional/Technical Expertise:

• VA Experience attaining an

ATO.

• Enterprise Mission Assurance

Support Service (eMASS) experience.

• Certified Information Systems Security Professional (CISSP)

• Information Technology.

Infrastructure Library (ITIL) Foundation.

SharePoint Developer Software Developer, Systems Software, Senior

Expertise providing the following:

• Collaborate with business stakeholders to build apps that address their specific needs.

• Develop SharePoint sites utilizing SharePoint Online.

Required Years of Experience:

6-10 years of experience performing work relevant to the PWS task requirements.

Required Education:

Bachelor’s degree in computer science, Information Technology,

• Create automated forms and workflows using power apps/automate.

• Integrate SharePoint lists with Power BI.

• Maintain All OSDBU SharePoint sites, lists, apps, workflows and document repositories as required.

• Update all OSDBU SharePoint sites, lists, apps, workflows and document repositories as required.

Engineering, or a relevant field.

***Preferred certifications and years of experience can be substituted for education, only if requested.

Required Professional/Technical

• Experience with SharePoint

Online and InfoPath forms.

• Experience with PowerApps, Power Automate and Power BI.

• Experience in the collection and documentation of user's requirements, development of user stories.

• Experience with MS Teams and Office 365.

• Experience maintaining release schedules.

• Experience publishing, consuming, and using XML and/or JSON.

• Experience in SharePoint Designer, InfoPath, Web Parts, and workflow creation.

Preferred Professional/Technical

Microsoft SharePoint Certification

D365 CRM

Developer / Solution Architect Computer Systems Engineer/Architect, Senior

Expertise providing the following:

• Design, develop, and implement Dynamics 365 CRM solutions tailored to meet client requirements.

• Engage with stakeholders to scope, map out, and document business requirements, translating them into

Required Years of Experience:

6 – 10 years of experience performing work relevant to the PWS task requirements.

Required Education:

Bachelor’s degree in computer science, Information Technology, Engineering, or a relevant field.

***Preferred certifications and years of experience can be substituted for technical specifications.

• Provide consulting expertise in Dynamics 365 CRM for both internal and external client-facing roles, ensuring optimal solution delivery.

• Work cooperatively with cross-functional teams, including developers, consultants, and business analysts, to ensure successful project execution.

• Stay current with the latest developments in Dynamics 365 CRM and related technologies, providing guidance on best practices and industry standards.

• Familiarity with Power Platform (Power Apps, Power BI, Power Automate).

• Knowledge of Azure services and integration patterns.

education, only if requested.

Required Professional/Technical Expertise:

• Experience in both internal and external client-facing roles.

• Proficient in C# and JavaScript and SQL.

• Strong understanding of

Dynamics CRM architecture and customization.

• Experience with CRM integrations and data migration.

• Excellent problem-solving and communication skills

Microsoft Certified

1. Dynamics 365 Business Central Developer Associate

2. Power Platform Developer Associate

Microsoft Certified

1. Dynamics 365: Finance and

Operations Apps Developer Associate

2. Microsoft Certified: Azure Solutions Architect Expert

5.1.6 PROJECT COORDINATION

The Contractor shall conduct quarterly in-progress review meetings to discuss the status of all sub-tasks in this PWS, as well as schedules, risks, and any issues encountered throughout the PoP. The Contractor shall provide the COR with the agenda for quarterly in-progress review briefings via email at least one business day before the meeting, addressing the information to be discussed during the quarterly in-process review meeting. Upon completion of all quarterly in-progress review meetings, the Contractor shall provide quarterly in-progress meeting minutes detailing all meeting discussions and action items, and they shall provide a copy of the slide deck used in the briefing. These quarterly meetings shall be conducted via VA-approved virtual meeting applications or systems.

A. Quarterly In-Progress Review Briefing Slide Deck

B. Quarterly In-Progress Review Meeting Minutes

5.2 INFORMATION TECHNOLOGY (IT) GOVERNANCE SUPPORT

The Contractor shall provide IT governance support functions ensuring IT projects comply with VA standards, guidance, and directives. The Contractor shall support the activities and operating efficiency of OSDBU technical systems, development, and integration. The Contractor shall continuously identify deficiencies found within the OSDBU IT portfolio and provide a Written Corrective Actions Recommendations Report, which shall include the identification of the deficiency and the steps that need to be accomplished to resolve it entirely. The Contractor shall develop Standard Operating Procedures (SOPs) for the administration, operation, and maintenance of all OSDBU systems, including but not limited to user access procedures, trouble ticket procedures, continuity of operation procedures, systems administration procedures, IT governance procedures, change control procedures, requirements development procedures, SharePoint development, deployment, and system administration procedures.

The Contractor shall conduct impact analyses and submit an Impact Analysis Report for changes that have a direct or asymmetric impact on the Veterans Enterprise Management System (VEMS), of which the VetBiz Portal is the front door, applications (VetBiz Stat (Goals Management, Predictive Analytics and Market Research system), Forecast of Opportunities (FCO), Event Management Software as a Service (EMSS), 2268 Next Generation and any other system added to the OSDBU IT portfolio during the period of performance.

To accomplish this effort, the Contractor shall achieve full operational capability to support the requirements outlined below:

1. The Contractor shall provide technical support to enable OSDBU federal staff to evaluate and scrutinize all ongoing and planned projects, develop the OSDBU Portfolio Assessment Framework, and develop an updated Portfolio Assessment Framework.

2. The Contractor shall assess processes against proven practices (e.g., Veteran-focused Integration Process (VIP), Information Technology Infrastructure Library (ITIL), Capability Maturity Model Integration (CMMI), Agile Development Operations and other industry best practices).

3. The Contractor shall recommend improvements in processes and practices for managing the IT investment portfolio that serves as a foundation for a roadmap to OSDBU's success.

4. The Contractor shall provide technical support to enable OSDBU federal staff to develop a framework for recommending and communicating process changes, resource management, and value delivery.

5. The Contractor shall Identify strengths and weaknesses with the current tools and provide recommendations on the tools needed to support current and future business needs.

6. The Contractor shall Identify and assess organizational climate and major capabilities that must be in place to establish an OSDBU-wide IT Portfolio management framework.

7. The Contractor shall assess the current "as-is" state and recommend any required changes in a "to-be" state. This will be presented as the IT Portfolio As- Is and To-Be Assessment Report.

8. The Contractor shall provide a written report called the IT Portfolio Gap Analysis Report provides a recommended road map from the "to-be" state to the "as-is" state.

9. The Contractor shall develop a recommended IT Governance Strategy Support and Framework Report for approval by VA, ensuring IT efforts and resources are value-added and reflect best practices.

10. The Contractor shall provide technical support to enable OSDBU federal staff to develop and maintain a catalog of OSDBU web services, Service Level Agreements, service Artifacts, Service Descriptions, and a Service Registry.

11. The Contractor shall identify core services that are consistently required on OSDBU systems and document options for how these could be combined in a core services package that all current and future systems leverage to create an economy of scale for all IT activity.

12. The Contractor shall manage change request prioritization and incorporation into current/future development cycles using a change control register.

13. The Contractor shall utilize Azure Dev Ops (ADO) to manage backlog and provide a scrum master to manage the sprint process.

14. The Contractor shall provide technical support and develop and maintain Standard Operating procedures.

A. Written Corrective Actions Recommendations Report B. Impact Analysis Report C. IT Portfolio As-Is and To-Be Assessment Report D. IT Portfolio Gap Analysis Report E. IT Governance Strategy Support and Framework Report F. Change Control Register G. Standard Operating Procedures H. Monthly ADO Task Report by contract CLIN I. Technical Support J. Identify Core Services

5.3 BUSINESS PROCESS RE-ENGINEERING SUPPORT

To support Federal staff Business Process Re-engineering (BPR) efforts, the Contractor shall interpret complex information and support federal staff in producing engaging visualizations, defining functionality, and producing flowcharts, wireframes, and templates of the OSDBU information system, VEMS and the OSDBU SharePoint sites.

This technical support includes creating test cases for change management vetting, to-be process maps to support the evaluation of recommendations, root cause analysis reports to document emergent issues and make recommendations for changes, gap analysis reports to document the gaps or deficiencies between the current and desired state, conceptual models to provide visual representation of system design and ad-hoc reports to support process management.

The Contractor shall use Azure Development Ops, Jira, and Trello. The Contractor shall use Microsoft Teams, Cisco WebEx, OSDBU Event Management System and any other widely used video teleconferencing tool. The Contractor shall provide application and business planning, analysis, requirements, application design, testing, maintenance, and validation support for OSDBU's programmatic, administrative, business intelligence, and strategic business Applications.

The Contractor shall liaise with OSDBU directorates and ITSI to achieve full operational capability to support the requirements outlined below:

1. The Contractor shall create the information architecture and proposing interaction designs (both site maps and page-level wireframes) for Portals, websites and mobile applications.

2. The Contractor shall support business process modeling through research and analysis.

3. The Contractor shall review all documents on VEMS/VetBiz and OSDBU SharePoint (VIP, VetBiz Stat, FCO, EMSS, 2268NextGen and any other system added to the OSDBU IT portfolio during the period of performance.) and identify areas of improvement, analysis of current processes, data management, data quality assurance, and system testing.

4. The Contractor shall document recommendations on areas of improvement with To-Be Process Maps.

5. The Contractor shall provide a gap analysis report to assess the differences in performance between the system's current state and the recommended future state.

6. The Contractor shall document processes utilizing conceptual models.

7. The Contractor shall support implementation of system changes by providing test cases for use in User Acceptance Testing.

8. The Contractor shall participate in weekly Business Process Modeling sessions for at least five major projects per year, acting as a subject matter expert in sketch sessions.

9. The Contractor shall support process management and create ad-hoc reports to document recommendations and findings.

10. The Contractor shall perform analysis during cyclical processes.

11. The Contractor shall participate in root cause analysis to recommend product enhancements or other appropriate actions to improve productivity for the business units and ITSI.

A. Test Cases B. To-Be Process Maps C. Root Cause Analysis Report D. Gap Analysis Report E. Conceptual Models F. Ad-hoc Reports G. Flowcharts H. Wireframes I. Templates J. Attend Weekly Meetings K. Document processes

5.4 ACCREDITATION & AUTHORIZATION (A&A) ARTIFACTS

The Contractor shall maintain all existing A&A artifacts for the VEMS/VetBiz system and develop additional artifacts required to support modification or enhancements to the systems as required by VA Handbook 6500. The contractor shall develop all A&A document artifacts required to achieve an ATO for VEMS/VetBiz, VetBiz Stat, FCO, EMSS, 2268NextGen and any other system added to the OSDBU IT portfolio during the period of performance.

The Contractor shall work with VA personnel to facilitate the successful maintenance of the A&A process for OSDBU systems throughout the PoP. The Contractor shall establish a standardized process, set of activities, general task descriptions, and a management structure to verify, validate, implement, and maintain the security and privacy posture of the OSDBU system portfolio. The Contractor shall work through the completion of the A&A process to obtain an Authorization to Operate (ATO).

To accomplish this effort, the Contractor shall:

1. The Contractor shall establish a structured, repeatable, OSDBU-focused A&A process.

2. The Contractor shall Be Certified using Enterprise Mission Assurance Support Service (eMASS).

3. The Contractor shall utilize eMASS as the repository for all accreditation & authorization (A&A) artifacts.

4. The Contractor shall Liaise with VA OIT Information Security and Privacy Personnel to ensure OSDBU follows the most recent guidance.

5. The Contractor shall review all existing A&A artifacts to determine gaps and remedy non-compliance.

6. The Contractor shall develop a schedule documenting the critical tasks and key milestones for the A&A process.

7. The Contractor shall coordinate obtaining the required A&A designation for all OSDBU systems.

8. The Contractor shall develop and submit all required A&A document artifacts for VEMS and the VetBiz Portal (VIP, VetBiz Stat, FCO, EMSS, 2268NextGen) and any other system added to the OSDBU IT portfolio during the period of performance.

A. Accreditation & Authorization (A&A) Document Artifacts B. eMASS Reports and remediation plans C. Communicate with Stakeholders D. Review A&A artifacts E. Provide a Schedule of the A&A process

5.5 VEMS O&M SUPPORT AND SHAREPOINT SERVICE

The Contractor shall support OSDBU's existing systems, VEMS/VetBiz Portal and the OSDBU SharePoint portal, continuously improving collaboration, information communication, and operating efficiencies. The system portals are the primary platforms for OSDBU ITSI customers to access business services and directorate-specific functionality. The VEMS/VetBiz portal provides a single sign-on destination for Veteran entrepreneurs seeking business opportunities with the VA.

The Contractor shall support day-to-day site collections administration, site improvements, automated capabilities, metrics, and embedded performance tools to maximize self-service and efficiency. The Contractor shall create, test, and deploy solutions utilizing VA-maintained and hosted hardware and software resources including ASP.Net, C#, CRM D365, CSS, HTML, iDashboard, InfoPath, JavaScript, jQuery, Microsoft Azure SQL, Microsoft Forms, Microsoft Teams, Microsoft Visual Studio, North52, Power Apps, Power Query, PowerShell, PowerRest Power Pages, API, SharePoint Object model, SharePoint Online and the Microsoft Office Suite (Word, PowerPoint, VISIO, ACESS and Excel).

The Government estimates an average of 15 monthly SharePoint support requests, including bug fixes, site requests, solution requests, permissions, and enhancements.

The Government estimates an average of 115 monthly VEMS support requests, including bug fixes, site requests, solution requests, permissions, and enhancements.

The Contractor shall provide detailed requirements for review and approval by the VA PM before the commencement of the design phase.

The Contractor shall meet the below service levels for the resolution of each trouble ticket received:

a. Initial response due within 1 hour for critical- work stoppage (i.e., primary work functions lost with no workaround available);

b. 4 hours for high-work degradation (i.e., some work functions lost with no workaround available);

c. 8 hours for med-work degradation with a workaround available (i.e., some work functions are lost, but a temporary workaround is available);

d. 24 hours for low-impact minimal work degradation (i.e., some work functions reduced with no workaround required);

e. Follow-up responses will be due based on the needs of the issue.

1. The Contractor shall provide a Technical Analysis Report of all configuration changes and modifications necessary as a result of guidance provided by the ITSI Program Manager or to meet the needs to support system development and integration to enable OSDBU's business systems to meet mission requirements.

Trouble Ticket Tracking Report shall be produced from CRM D365 or another trouble ticket tool provided by the Government. The trouble ticket tracking system shall be updated in accordance with the service level agreements cited above.

2. The Contractor shall maintain a generated log of all technical issues, including the progress of unresolved issues elevated to OIT or third-party providers. The Contractor shall prepare a weekly Trouble Ticket Tracking Report to show the status of all open and resolved tickets from the previous week. The report shall include a summary description of the issues being reported, the total number of issues reported year to date, and an estimate of when remaining open tickets shall be resolved.

3. The Contractor shall provide the accepted solution to issues.

4. The Contractor shall work directly with OSDBU directorates to define and meet their requirements through the development, implementation and sustainment of CRM D365 solutions as follows:

a. Monitor CRM D365 solution deployment across OSDBU;

b. Work with IT Project Managers and Analysts to design and develop CRM

D365 solutions to address OSDBU business needs;

c. Research and analyze OSDBU CRM D365 procedural problems and provide recommendations for improvements and changes;

d. Identify opportunities and propose improvements to the CRM D365 environment to make the CRM D365 environment a more effective solution;

e. Provide OSDBU the appropriate CRM D365 solution design recommendations, develop business services infographics to enhance user experience, and incorporate information visualization based upon industry best practices;

f. Coordinate with Team Lead and OSDBU directors in standardizing and optimizing the way data/information is stored, secured, shared, and retrieved;

g. Provide post-installation support, configuration, security, operation, and maintenance of CRM D365, equipment, and software related to CRM D365;

h. Apply expert process innovation, guided by industry standards and lessons learned, for delivering process improvement that optimizes business functions;

i. Provide release management support to increase usability and solution longevity;

j. Synthesize complex or diverse information, collect and research data, and use experience to complement data, workflows, and procedures;

5. The Contractor shall work directly with clients to define and meet their requirements through the development, implementation, and sustainment of Power Apps/Power Pages solutions through:

a. Monitor Power Apps/Power Pages solution deployment across OSDBU;

b. Provide OSDBU the appropriate Power Apps/Power Pages solution design recommendations, develop business services infographics to enhance user experience, and incorporate information visualization based upon industry best practices;

c. Coordinate with the Team Lead and OSDBU directors in standardizing and optimizing the way data/information is stored, secured, shared, and retrieved;

d. Apply expert process innovation, guided by industry standards and lessons learned, for delivering process improvement that optimizes business functions;

e. Provide release management support to increase usability and solution longevity;

f. Synthesize complex or diverse information, collect and research data, and use experience to complement data, workflows, and procedures;

g. Work with IT Project Managers and Analysts to design and develop Power

i. Apps/Power Pages solutions to address OSDBU business needs;

h. Research and analyze OSDBU Power Apps/Power Pages procedural problems and provide recommendations for improvements and changes;

i. Identify opportunities and propose improvements to Power Apps/Power Pages to make the environment a more effective solution;

j. Configure applications on the VetBiz Portal to meet stakeholder requirements using the Microsoft Power Apps/Power Pages design tools and any other industry-standard software development kit (SDK);

k. Provide OSDBU the appropriate Power Apps/Power Pages solution design recommendations, develop business services infographics to enhance user experience, and incorporate information visualization based upon industry best practices;

l. Provide backup System Administrative support for information systems residents in the VetBiz Portal. Should become familiar with EMSS, VetBizStat, Forecast of Opportunities, 2268 Next Generation.

6. The Contractor shall work directly with clients to define and meet their requirements through the development, implementation and sustainment of OSDBU SharePoint solutions through:

a. Monitor SharePoint Portal Server performance, user access and solution deployment across OSDBU;

b. Implement SharePoint across OSDBU; act as SharePoint Subject Matter Expert (SME). Participate in planning and execution of tasks related to the evaluation of new SharePoint-based initiatives, third-party solutions and Integration with additional Enterprise Systems;

c. Develop, configure, and maintain SharePoint processes to support OSDBU business processes. Perform typical system administrative activities such as site creation, backup, restore and issue resolution;

d. Migrate OSDBU's SharePoint to any future version approved by VA;

e. Work with IT Project Managers and Analysts to design and develop

SharePoint solutions to address OSDBU business needs;

f. Research and analyze OSDBU SharePoint portal procedural problems and provide recommendations for improvements and changes;

g. Identify opportunities and propose changes to the SharePoint to make the

SharePoint environment a more effective solution;

h. Maintain industry knowledge of publishing, collaboration, information management concepts, and best practices and procedures for SharePoint solutions.

i. Provide technical guidance to the team in the technologies related to the support of an Enterprise SharePoint environment (understanding integration with Active Directory, Structured Query Language (SQL), Customer Relationship Management (CRM) D365, Microsoft (MS) Office, etc.);

j. Configure SharePoint to meet stakeholder requirements using the Microsoft SharePoint Designer, Power Apps design tools and any other industry-standard software development kit (SDK)

k. Provide technical support of InfoPath forms and related workflows, including communicating the location of form libraries, their purpose and their ability to provide first and second-line issue resolution;

l. Coordinate with the Team Lead and OSDBU directors in standardizing and optimizing the way data/information is stored, secured, shared, and retrieved;

m. Provide post-installation support, configuration, security, operation, and maintenance of SharePoint online equipment and software related to SharePoint online;

n. Apply expert process innovation, guided by industry standards and lessons learned, for delivering process improvement that optimizes business functions;

o. Provide release management support to increase usability and solution longevity;

p. Synthesize complex or diverse information, collect and research data, and use experience to complement data, workflows, and procedures;

7. The Contractor shall provide the COR/PM a weekly interactive status briefing slide deck that provides the status of each system. The weekly interactive status briefing slide deck should include specifics on bugs, fixes, changes, development and blockers.

8. The Contractor shall develop and maintain user help guides for…