Draft Performance Work Statement .docx

Cloud and Infrastructure Advisory Services

<VA-23-00031837>

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Office of Information & Technology Infrastructure Operations (IO) Application Hosting Cloud Edge Solutions (ACES)

Cloud and Infrastructure Advisory Services

Date: February 02, 2023

<VA-23-00031837>

PWS Version Number: <0.02>

Contents

BACKGROUND

The Department of Veterans Affairs (VA) was established as an independent agency on July 21, 1930. The Department’s mission is to serve America’s Veterans and their families with dignity and compassion, and to be their principal advocate in ensuring that they receive medical care, benefits, social support, and lasting memorials promoting the health, welfare, and dignity of all Veterans in recognition of their service to this Nation.

The mission of VA’s Office of Information & Technology (OIT) is to provide seamless, unified Veteran experience through the delivery of state-of-the-art technology and to collaborate with business partners to create the best experience for all Veterans. As part of VA’s IT modernization efforts, the enterprise is following a “cloud smart” policy by migrating and implementing systems and applications in the VA Enterprise Cloud (VAEC).

In December 2021, the OIT Infrastructure Operations (IO) Division, to further progress its Cloud and Infrastructure IT modernization efforts, established the Application Hosting and Cloud Edge Solutions (ACES) office to centralize and integrate the planning, execution, management, and oversight of cloud and infrastructure initiatives As part of ACES, the Enterprise Cloud Solutions Office (ECSO) manages and oversees VA’s delivery, operation, and enhancement of cloud computing capabilities to meet evolving business needs and requirements. ECSO is responsible for establishing, operating, maintaining, and optimizing the VAEC and providing General Support Services (GSS) and deploying and sustaining VAEC operational tools necessary to drive the assessment, planning, migration, implementation, and operations and sustainment of systems and applications to the cloud.

ECSO enables the execution of the VA Cloud Strategy and the realization of VA’s cloud goals and objectives by establishing and maintaining enterprise level contracts for obtaining the contractor support services and products the enterprise needs to transition to the cloud.

Since the establishment of ECSO in 2018, VA has been leading the Federal Government in adopting a “smart cloud” policy to successfully migrate and implement systems and applications in the cloud. This award winning, highly recognized program, has, to date, successfully migrated and/or implemented approximately 300 production systems and applications within its VAEC. This is a mission critical part of VA’s IT Enterprise Platform Eco-System and a VA priority for IT modernization.

Therefore, VA requires cloud and infrastructure advisory support services support to drive engineering and operational excellence outcomes, including the following:

· Establish and mature standardized cloud and infrastructure assessment, planning, migration, development, implementation and deployment approaches, processes, and tools to plan, execute and manage cloud and infrastructure IT modernization efforts.

· Assess and evaluate cloud, on-prem and hybrid-based solutions to address prioritized, infrastructure capability needs.

· Develop, optimize, and maintain VA cloud and infrastructure architectures and designs by leveraging emerging technologies (such as containerization, cloud native techniques, and automation), enhancing existing VA services and tools, and incorporating lessons learned to improve resiliency, and optimize cost and performance

· Provide program and project process re-engineering support to establish monitor, track, and report on the progress on infrastructure operations projects to improve service delivery

· Assist VA in planning cloud and infrastructure projects and validating their successful completion and make recommendations to improve resiliency and optimize cost and performance.

· Provide program and project, and technical training and coaching to assist VA in organically building modern cloud and infrastructure operations expertise and management capabilities.

· Drive engineering and operational excellence outcomes across ACES platforms and hosted applications/systems by leveraging emerging technologies (such as containerization, cloud native techniques, AIOps, and automation), financial operations (FinOps), lessons learned, and best practices.

APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

A. 44 U.S.C. § 3541-3549, “Federal Information Security Management Act (FISMA) of 2002” B. “Federal Information Security Modernization Act of 2014” C. Federal Information Processing Standards (FIPS) Publication 140-3, “Security Requirements for Cryptographic Modules” D. Federal Information Processing Standards (FIPS) Publication 140-2, “Security Requirements for Cryptographic Modules” E. FIPS Pub 199. “Standards for Security Categorization of Federal Information and Information Systems,” February 2004 F. FIPS Pub 200, “Minimum Security Requirements for Federal Information and Information Systems,” March 2006 G. FIPS Pub 201-2, “Personal Identity Verification of Federal Employees and Contractors,” August 2013 H. 10 U.S.C. § 2224, "Defense Information Assurance Program" I. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974” J. Public Law 109-461, Veterans Benefits, Health Care, and Information Technology Act of 2006, Title IX, Information Security Matters K. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964” L. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, https://www.va.gov/vapubs/index.cfm M. VA Handbook 0710, “Personnel Security and Suitability Program,” May 2, 2016, https://www.va.gov/vapubs/index.cfm N. VA Directive and Handbook 6102, “Internet/Intranet Services,” August 5, 2019 O. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and Guidelines,” January 18, 2017 P. Office of Management and Budget (OMB) Circular A-130, “Managing Federal Information as a Strategic Resource,” July 28, 2016 Q. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed Services (CHAMPUS)” R. NIST SP 800-66 Rev. 1, “An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule,” October 2008 S. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended, January 18, 2017 T. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004 U. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021 V. VA Handbook 6500, “Risk Management Framework for VA Information Systems VA Information Security Program,” February 24, 2021 W. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI),” March 12, 2019 X. VA Handbook 6500.5, “Incorporating Security and Privacy into the System Development Lifecycle,” March 22, 2010 Y. VA Handbook 6500.6, “Contract Security,” March 12, 2010 Z. VA Handbook 6500.8, “Information System Contingency Planning,” April 6, 2011 AA. VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018 AB. VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017 AC. OIT Process Asset Library (PAL), https://www.va.gov/process/ . Reference Process Maps at https://www.va.gov/process/maps.asp and Artifact templates at https://www.va.gov/process/artifacts.asp AD. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx) AE. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014 AF. VA Handbook 6508.1, “Procedures for Privacy Threshold Analysis and Privacy Impact Assessment,” July 30, 2015 AG. VA Handbook 6510, “VA Identity and Access Management,” January 15, 2016 AH. VA Handbook, 6300.1, “Records Management Procedures,“ March 24, 2010 AI. VA Directive 6300, “Records and Information Management,” September 21, 2018 AJ. VA Handbook, 6300.1, “Records Management Procedures, “ March 24, 2010 AK. NIST SP 800-37 Rev 2, “Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy,” December 2018 AL. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020) AM. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015 AN. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” March 24, 2014 AO. OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005 AP. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019 AQ. OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008 AR. Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance, December 2, 2011, (NOTE: Part A of the FICAM Roadmap and Implementation Guidance, v2.0, was replaced in 2015 with an updated Architecture (https://arch.idmanagement.gov/#what-is-the-ficam-architecture) AS. NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access,“ June 2018 AT. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, “Digital Identity Guidelines,” updated March 02, 2020 AU. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014 AV. NIST SP 800-164, “Guidelines on Hardware-Rooted Security in Mobile Devices (Draft),” October 2012 AW. Draft National Institute of Standards and Technology Interagency Report (NISTIR) 7981, “Mobile, PIV, and Authentication,” March 2014 AX. VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514) AY. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514) AZ. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896 BA. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents BB. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019 BC. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008 BD. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (Public Law 110–140), December 19, 2007 BE. Section 104 of the Energy Policy Act of 2005, (Public Law 109–58), August 8, 2005 BF. Executive Order 13834, “Efficient Federal Operations,” dated May 17, 2018 BG. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 2, 2001 BH. VA Directive 0058, “VA Green Purchasing Program,” July 19, 2013 BI. VA Handbook 0058, “VA Green Purchasing Program,” July 19, 2013 BJ. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 BK. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103 BL. “Veteran Focused Integration Process (VIP) Guide 4.0,” January 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371 BM. VA Memorandum “Proper Use of Email and Other Messaging Services,” January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 BN. “DevSecOps Product Line Management Playbook” version 2.0, May 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946 BO. NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020 BP. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol Version 6 (IPv6),” November 19, 2020 BQ. Social Security Number (SSN) Fraud Prevention Act of 2017 BR. Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23, 2018 BS. VA Enterprise Cloud Technical Reference Guide, Version 1.3 July 2018 BT. VA Enterprise Cloud Lifecycle Framework Master Guide, Version 2.5, June1, 2022 BU. Use of the VA Enterprise Cloud (VAEC) to Host Applications Memorandum, October 29, 2019 BV. VA Directive 6066, “Protected Health Information (PHI) And Business Associate Agreements Management”, September 2, 2014 BW. VA Directive 6066, “Protected Health Information (PHI) And Business Associate Agreements Management”, September 2, 2014

SCOPE OF WORK

In order to drive engineering and operational excellence outcomes, the Contractor shall provide assessment, analysis, architecture, design, planning and validation, process re-engineering, and communications support for the specific tasks and deliverables defined in this PWS’ paragraph 5.0 in accordance with VA and cloud and infrastructure standards, policies, and guidelines cited in paragraph 2.0.

· Process Re-Engineering Support – Support VA’s establishment, maturation, and adoption of program and project management capabilities for governing, planning, managing, delivering, and adopting cloud, on-prem, and hybrid. (5.2)

· Program and Project Communications - Provide communications, stakeholder engagement, and outreach support to ensure relevant, timely information is conveyed to the right stakeholders. (5.3)

· Architecture and Design Support – Ongoing development and refinement of VA architectures, designs, and operating models/plans to support the VA in delivering, managing, operating, and continuously improving the VA’s enterprise cloud computing and infrastructure capabilities by leveraging emerging technologies (such as containerization, cloud native techniques, and automation), enhancing existing VA services and tools, and incorporating lessons learned to improve resiliency, and optimize cost and performance. (5.4)

· Infrastructure Unified Intake Process Support – Provide analysis and assessment support for the Infrastructure Unified Process. (5.5)

· Cloud Migration and Implementation Analysis, Architecture and Design – Provide cloud intake and analysis, architecture, and design, and planning support to migrate and deploy systems and application to VA Enterprise Cloud (VAEC) and other ACES infrastructure and platforms leveraging emerging technologies (such as containerization, cloud native techniques, and automation), enhancing existing VA services and tools, and incorporating lessons learned to improve resiliency, and optimize cost and performance. (5.6) Optional Tasks 1 to 4 provides VA with the ability to obtain contractor transition support, training support, and any additional professional support services during the base period and option periods.

· Additional Professional Services Support – Provide optional professional service support to increase capacity and modify resourcing. (5.7.1)

· Additional Professional Services Support – Provide optional professional service support to perform professional services to achieve specific objectives within a VA defined time frame. (5.7.2)

· Training – Provide training support develop and execute cloud and infrastructure training programs. (5.7.3)

· Contractor Transition Out support – Provide contractor transition out support prior to the end of this Contract. (5.7.4) The Contractor shall participate in VA’s cloud intake and migration process to provision cloud services and tools to enable application teams to access all VAEC General Support Services (GSS) and VAEC operational tools; and to build new applications in and migrate legacy applications to the VAEC.

The Contractor shall also provide subject matter expert labor to provide additional services in support of the VA’s cloud strategy to ECSO and other areas of Infrastructure Operations (IO) as described in paragraph 5.0 below. The Contractor shall support varying workloads across each PWS support area defined in PWS section 5.0 that includes VAEC and special purpose platforms, interfaces with internal and external VA and non-VA systems and expands to include the cloud edge and other infrastructure modernization efforts. The Contractor shall also provide subject matter expert labor to provide additional services in support of the VA’s cloud strategy to ECSO and VA teams as described in paragraph 5.0 below.

To accomplish the above, VA seeks a contractor that is flexible and able to work in a highly dynamic DevSecOps environment, takes initiative, makes recommendations to VA leadership, follows VA direction and in order to provide state of the art, expert analysis, engineering, planning, provisioning, deployment, migration, operations support services that enable VA’s to deliver world class cloud capability and services using industry best practices provide innovative services to Veterans and VA staff and protect VA data. Given the unique role, the Contractor shall work cooperatively, share knowledge with VA and non-VA government teams and other contractors to facilitate mutual success.

The VA seeks a contractor able to quickly staff up and maintain expert level resources in order understand the all aspects of the VAEC architecture and operational state and assume the various responsibilities described in paragraph 5 without any disruption to VA’s demanding migration schedule or the production operations of the systems and applications hosted in the VAEC and its specialized platforms and then work with VA leadership to continuously mature the work done under this contract ensure VA OIT continues to deliver world class service. As part of continuous improvement, the VA expects and welcomes expert input from the Contractor. However, the VA is not seeking, novel and/or proprietary systems, methods, practices or otherwise interested in significant changes to its approach.

ORDER TYPE

The effort shall be on a Hybrid contract type. This Contract is comprised of a combination of Firm Fixed Price (FFP) and Time and Materials (T&M) base support areas and optional tasks that will be exercised as needed.

FFP:

· Contractor Program Management (paragraph 5.1) including establishment of Contractor Foundation Teams resourced to satisfy base level of support for each Foundation Team working (paragraph 5.2 – 5.6)

Optional T&M capacity:

· Process Re-Engineering Support (paragraph 5.2)

· Program and Project Communications (paragraph 5.3)

· Architecture and Design Support (paragraph 5.4)

· Infrastructure Unified Intake Process Support (paragraph 5.5)

· Cloud Migration and Implementation Analysis, Architecture, Planning, and Enhancements Support (paragraph 5.6)

Additionally, this Contract includes three optional tasks (paragraph 5.7)

· Optional Task 1.0 – Additional Professional Services Support (T&M)

· Optional Task 2.0 – Additional Professional Services Support (FFP)

· Optional Task 3.0 – Training Support (FFP)

· Optional Task 4.0 - Contractor Transition Out Support (FFP)

PERFORMANCE DETAILS

PERFORMANCE PERIOD

The Performance of Period (PoP) shall consist of a 12-month base period, with four (4), 12-month option periods.

Any work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO).

There are eleven (11) Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, five are set by date:

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

PLACE OF PERFORMANCE

Efforts under this Contract shall be performed at Contractor’s facilities which shall be required to be located within the contiguous 48 United States. Work may be performed at remote locations with prior concurrence from the VA. Contracting Officer’s Representative (COR).

TRAVEL

Travel is on a cost reimbursable, no fee basis. Travel shall be in accordance with the Federal Travel Regulations and requires advanced concurrence by the Contracting Officer’s Representative (COR). The Contractor shall obtain prior approval from VA Program Manager and/or Project Manager requiring support before submitting a formal travel request to the COR. Each Contractor invoice shall include copies of all receipts that support the travel costs claimed in the invoice.

Local travel within a 50-mile radius from the Contractor’s facility is considered the cost of doing business and will not be reimbursed. This includes travel, subsistence, and associated labor charges for travel time.

The total estimated number of trips in support of the program related meetings for this effort is for two trips per period of performance (base period and option period). Anticipated locations include the following, estimated at <please enter duration of trips> days in duration:

· Eatontown, NJ

· Washington, DC

· Austin, TX Travel shall be in accordance with the Federal Travel Regulations (FTR) and requires advanced concurrence by the COR. Contractor travel within the local commuting area will not be reimbursed.

Virtual meetings should be considered and be maximized when possible.

SPECIFIC TASKS AND DELIVERABLES

CONTRACTOR PROGRAM MANAGEMENT

The Contractor shall provide Program Management and Project Management support, as detailed below, in compliance with VA management policies, standards, and guidelines. The Contractor shall identify to the VA Program Manager (PgM) and VA COR a Contractor Program Manager (PgM) that shall be the primary contact point for all contractor programmatic plans, risks, issues, concerns, deliverables, schedules, and status.

This Contractor designee shall oversee the Contractor’s execution of the support defined in this PWS. This Contractor Program Manager shall act as VA’s senior point of contact and coordinate with other contractor staff to ensure that the support provided satisfies performance and schedule requirements and is performed within cost constraints, prioritize resources, and resolve any issues and concerns.

All recommendations, strategies and methodologies, plans, or deliverables developed or updated in support of the execution of the Contract must be submitted for review and approval by the VA PgM and COR. No work shall start on the execution until approved by VA.

All proposed changes shall be reviewed and approved through the VA designated change management governing body (e.g., VAEC Contract OIT Change Control Process and the ECSO, Change Control Board (CCB), Technical Release Board (TRB), and Production Release Board (PRB)). The Contractor shall submit change requests in accordance with above processes using the VA designated tools that defines the proposed change, impacts (contractor support, schedule, resource plan, costs). The Contractor shall not commence performance of any tasks or changes without first receiving approval to proceed. Any work performed to support changes without prior approval from VA shall be at the cost of the Contractor.

The Contractor shall continuously monitor the performance, schedule, and cost of performing the support work, and report any risks or deviation.

The Contractor shall respond to all VA program and project management queries related to project support, schedule, and resources. The Contractor shall provide project related ad hoc updates, briefings and or briefing support as requested. The Contractor shall maintain all project work products and deliverables provided during the execution of this PWS in a VA designated tools/repositories.

CONTRACTOR PROGRAM MANAGEMENT PLAN

The Contractor shall deliver and maintain a Contractor Program Management Plan (CPMP) that lays out the Contractor’s high-level approach, dependencies, assumptions, schedule, and resources (staff and tools) to be used in the execution of the task order. The CPMP shall describe how the Contractor plans to execute each individual support area and provide cross-cutting support to ensure integrated and synchronized service delivery. The purpose of the CPMP is to provide a tool to allow VA to effectively manage this Contract as defined by VA PgM and COR in the PWS paragraph Sections 5.0 (Specific Tasks and Deliverables).

The CPMP shall define the overall approach as well as the staff on-boarding plan for each specific support task and delivery of support task deliverable artifacts in the execution of this task order.

Additionally, the CPMP shall include a Resource Plan (RP) broken down by PWS paragraph 5, The Resource Plan shall include for each individual contractor staff member the specific support task(s), role, labor category, on boarding requirements, risks, and percent time allocation (e.g., full time or part time). The Contractor shall identify which individuals or vacant positions are full time and which individuals are part-time.

The CPMP shall be delivered in the form of both a narrative and graphic format within fifteen (15) days of the Contract award. The CPMP shall define the overall approach as well as the staff on-boarding plan for each specific support task and delivery of support task deliverable artifacts, Quarterly Program Management Reviews and in the execution of this task order.

All billable time under this task order must be associated with approved VA task tracked in on or more VA tracking system as designated by the VA PgM and COR. Contractor invoicing shall include and be reportable by this assigned VA task reference number. The Contractor shall obtain VA PgM and COR approval for all resources prior to beginning onboarding, No work shall start execution until the Contractor has received appropriate VA approval based on the nature of the work and applicable VA process(es) as they exist and evolve over time in accordance with the design and intent of each process. Examples include but are not limited to the IO Change Management Processes that include but not limited to the ECSO Change Control Board (CCB), ECSO Technical Release Board (TRB), and the ECSO Production Release Board (PRB). The Contractor shall submit artifacts and utilize appropriate VA tools as required by each applicable process Any work performed without prior approval from VA shall be at the cost of the Contractor.

Deliverables:

A. Contractor Program Management Plan and Quarterly Updates

ESTABLISHMENT OF CONTRACTOR FOUNDATION TEAMS

The Contractor shall establish Contractor Foundation Teams comprised of dedicated full time technical management and subject matter experts (SME) labor that shall perform support services as defined in in this PWS throughout the life of the contract as a standalone team or as an element of a larger VA Fusion Team of other VA FTE or contractors. A senior Contractor Team Lead shall be assigned to each Contractor Foundation Team and shall coordinate with the Contractor PgM to provide daily oversight and management of the Contractor’s delivery based on direction set by the responsible VA Team Lead designated by the VA PgM.

At the beginning of each period of performance (base and option periods), the Contractor shall assist VA in developing a Workplan for each Foundation Team to validate the support services to be provided and define service delivery approach and timelines. The VA Team Leads shall provide guidance and direction to the Foundation Teams to elaborate support requirements, prioritize, and perform the support services. The Contractor Work Plans shall include a summary of the prioritized support requirements, VA defined objectives, a detail RP, planned work products, and deliverables schedule for each support area. The Contractor shall maintain the Workplans throughout the duration of the period of performance to ensure it reflect all VA approved changes.

At the beginning of each POP each Contractor Foundation Team shall be resourced by the Contractor with dedicated, skilled full-time contractor resources to support the base level of support. The Contractor shall ensure the appropriate contractor personnel resources have the specific skill sets to meet each Foundation Teams desired/unique support requirements.

The Contractor shall provide dedicated resources to support each area to the greatest extent possible. In the event that part-time or matrixed resources is recommended, then the Contractor shall obtain approval from the VA PgM and COR prior to the specific resource starting work. The Contractor shall increase, decrease, or modify its Contractor Resource Plan at VA’s request to respond to changing needs. All changes shall be approved through the IO designated governing body. These Foundation Teams shall be fixed for the duration of the contract unless otherwise mutually agreed by the VA PgM, COR, VA Team Leads, and the Contractor Team Lead.

Table 1 defines the base configuration that each Foundation Team shall be resourced to initially provide the base level of support. The Foundation Teams shall be fixed for the duration of the contract unless otherwise mutually agreed by the VA PgM, COR, VA Team Leads, and the Contractor Team Lead.

Table 1 - Base Configuration for Contractor Foundation Teams

· Coordinate across all Foundation Teams

5.2 Process Re-Engineering Support

and

5.3 Program and Project Communications

· Assist VA in operationalizing the SOPs prioritized above

· Recommend and implement process improvement opportunities

· Execute ECSO Communications Plan (annually updated)

5.4 Architecture and Design Support

and

5.6.3 Cloud Solutions Architecture and Design Support

· Develop solutions architecture and design for approximately eight (8) systems and applications per month

· Develop approximately eight (8) Migration and Implementation Packages per month

(Note: Base level support for performing the Contractor Transition Out Support (paragraph 5.7) will be required of all Foundation Teams) All changes to the base level of support or the work to be performed by the Foundation Teams shall be reviewed and approved through the VA designated governing body.

The Contractor shall ensure all contractor resources assigned to the Foundation Teams satisfy VA defined qualifications, and roles and responsibilities. Any proposed changes to the Foundation Team shall be reviewed and approved by the IO Change Management Processes.

The Contractor shall adjust resource levels (including labor category and skills mix) for approved changes that may include adding or decreasing resources for a specific Foundation Team or adding new Foundation Teams. These changes include but not limited to increasing, decreasing, and making changes to the labor category mix of a Foundation Team. The use of Part-Time SME shall be permissible at the discretion of the VA Team Lead. Optional Task 2 (paragraph 5.8.2) may be exercised by VA to add additional support services (or capacity) for the fixed Foundation Teams or setup optional Foundation Teams.

CONDUCT CONTRACTOR KICK-OFF MEETING

The Contractor shall hold a Contractor Program Kick-Off Meeting within ten (10) days after Contract award, to establish an understanding between VA and the Contractor of project approach, major tasks/actions, and schedule for key milestones and deliverables. The Contractor shall present the Kick-Off Meeting deck, for review and approval by the Government and a draft Contractor Program Management Plan (CPMP) that details the intended approach for providing the support services defined in this Contract.

The Contractor shall specify dates, locations (can be virtual), agenda (shall be provided to all attendees at least five calendar days prior to the meeting), and meeting minutes (shall be provided to all attendees within three calendar days after the meeting). The Contractor shall invite the Contracting Officer (CO), Contract Specialist (CS), COR, and VA PgM at minimum, to the Contractor Program Kick-Off Meeting.

During the Kick-Off Meeting the Contractor shall work with the VA PgM, COR, and VA leadership to confirm the support services and workload required during the base period. The Contractor shall provide an updated CPMP at the conclusion of the meeting to the VA PgM and COR for approval that reflects the outcome of the Kick-Off Meeting. Additionally, the Contractor shall provide a Kick-Off Meeting Summary within three (3) days of the conclusion of this Meeting that highlights all decisions (including changes to the CPMP), risks/issues, and actions made during the meeting.

Deliverables:

A. Contractor Program Kick-Off Meeting Brief B. Contractor Program Kick-Off Meeting Summary

CONDUCT CONTRACTOR ONBOARDING AND OFFBOARDING

VA’s Contractor Onboarding and Offboarding Process ensures that the Contractor satisfied all VA contractor onboarding and offboarding guidelines and requirements and are eligible and have the government furnished information, government furnished equipment, and physical and logical access necessary to complete the Contract.

The Contractor shall assign a Contractor Onboarding and Offboarding Coordinator that will act as the single point of contact for the VA COR and work with all contractor staff to ensure the contractor staff has satisfied onboarding/offboarding requirements.

The Contractor shall perform the following tasks:

A. On-boarded all contractor staff who will be eligible for billable time under this contract.

B. As part of the RP, identify Contractor staff roles and specific support areas; determine Contractor onboarding requirements; gather and provide required onboarding forms and applications; ensure onboarding requirements are satisfied; and monitor and track onboarding status.

C. Notify the VA COR 15 days prior to the individual’s desired start date and provide all VA onboarding forms and certificates. All exceptions shall be submitted in writing to VA COR for approval with justification and a target date for completing VA onboarding requirements.

D. Responsible for requesting and completing background investigations that shall be at the Contractor’s cost. The Contractor shall complete all background investigation request process and required forms to be identified by the VA COR.

E. Complete VA Mandatory training such as VA Privacy and Information Security Awareness and Health Insurance Portability and Accountability Act (HIPAA) training and submit all Talent Management System (TMS) training completion certificates. All Contractor staff shall ensure training is renewed in accordance with specific compliance requirements to be defined by the VA COR.

F. Provide signed copies of the Contractor Rules of Behavior in accordance with Section 9, Training, from Appendix C of VA Handbook 6500.6, “Contract Security”. Failure to complete the mandatory annual training and sign the Rules of Behavior annually, within the timeframe required, is grounds for suspension or termination of all physical or electronic access privileges and removal from work on the effort until the training and documents are complete.

G. Within 48 hours of starting work on the task, the Contractor shall submit status of VA Privacy and Information Security Awareness and HIPAA training, and Rules of Behavior for all Contractor individuals engaged on the task. The Contractor shall re-complete VA Privacy and Information Security training annually and provide certificates and Rules of Behavior, 15 prior to the VA mandatory date.

H. Delivery within 10 days of task order award and provide weekly updates in a Contractor Onboarding and Offboarding Report which will be ongoing addendum to the RP to VA COR that tracks for each Contractor staff the overall onboarding/offboarding status (e.g., eligibility to start work on task, access to specific environments/systems/applications/data), BI level/status, PIV Card Status (and expiration date), Privacy and Security Training and Rules of Behavior sign date and next required training date, and any risks/issues. The Contractor Onboarding Coordinator shall report weekly updates to the VA COR of all new Contractor personnel, changes in status of existing personnel, and all issues with an action plan and timeline to resolve.

I. Ensure all individual Contractor personnel complete the VA Offboarding Process and satisfy the guidelines and requirements before concluding work for this Contract. This includes return to the VA COR all VA credentials (e.g., PIV card) from employees upon separation from the Contract. The Contractor Onboarding and Offboarding Coordinator shall coordinate to ensure that VA’s Offboarding process is completed to include the return or disposal of government furnished equipment and property.

J. Provide a Security Point of Contact as part of its program management organization to oversee all aspects of program level administrative security in accordance with VA requirements per delivery schedule. The Contractor shall demonstrate comprehensive and effective risk management processes in association with its services that are consistent with NIST Special Publication 800161 – “Supply Chain Risk Management Practices for Federal Information Systems and Organizations”. The Contractor shall support VA in verifying and reporting that VA security requirements are documented in the contract between cloud service providers and VA.

K. At VA’s request, the Contractor shall provide signed non-disclosure agreements (NDA) if specific Contractor staff is required to provide acquisition related support. Signed NDAs shall be provided prior to initiating engagement and support of acquisition support.

L. Notify the VA PgM and COR of any staff offboarding at least two (2) weeks prior to conclusion of the individual’s support. The Contractor shall provide a transition plan that defines the approach for transitioning; activities including knowledge transfer and training; risks and mitigation plans; dependencies and operational impacts; and schedule. All transition plans shall be approved by the VA PgM and COR.

Deliverables:

A. Signed Contractor Rules of Behavior (per individual contractor employee) B. Weekly Contractor Onboarding/Offboarding Status Reports

CONTRACTOR PROGRESS REPORTING

To maximize cost efficiency, contractor shall utilize VA designated tools to record and manage progress and provide requested information as part of regular work under this Task Order as directed by the VA PgM and COR for each given support task.

The Contractor shall deliver an automated Monthly Progress Updates on overall program status in a form directed by the VA PgM that reflect data as of the last day of the preceding Month. Information may include for each support task area but is not limited to:

· Highlight Significant accomplishments (1 page or less)

· Highlight Priority Task for upcoming Month (1 page or less)

· Highlight Significant milestones/deadlines/actionable

· Highlight Significant risks and any mitigation plans

· Updated Staff Roster (Offers Out, Onboarding, Onboard, Offboarding, Offboarded (to date))

· PO Spend Report (planned vs. actual costs)

· Updated CPMP (including latest Resource Plan)

· Any deviations from the latest, VA approved CPMP The Contractor shall use to the great extent possible existing VA reporting tool(s) deliver the report.

In addition to the above stated progress updates, the Contractor shall conduct Quarterly Contractor Program Review Meetings (PMR) to discuss the status of the contract, schedule, risks, and any issues encountered, throughout the PoP. The Contractor shall provide the VA PgM and COR with a Quarterly Contractor Program Review Briefing, ten (10) business days prior to the scheduled Quarterly Review to address the information to be discussed during the quarterly in-process review meetings. This briefing shall include a review of program status and health, latest approved CPMP, summary of proposed and approved changes since the last Quarterly, and risks/issues.

The briefing shall include an overview of the Performance Scorecard (as defined in 7.4below) action plans to address Performance Scorecard items that did not receive a satisfactory rating. The Contractor shall provide Quarterly PMR meeting minutes detailing all meeting discussions and action items within three (3) business days of each meeting. These Quarterly PMR shall be conducted via VA approved virtual meeting applications or systems. Any in-person attendance shall be approved by the VA PgM and COR.

Deliverables:

A. Monthly Progress Updates B. Quarterly PMR Review Briefings and Updated Performance Scorecard Snapshot

PROCESS RE-ENGINEERING SUPPORT

The Contractor shall support VA’s establishment and maturation of program and project management capabilities, leveraging, enhancing, and expanding upon existing and new ACES Standard Operating Procedures (SOPs), processes, standards, and guidelines. This shall include, but not be limited to, performance management, risk management, change management, reporting, quality management, monitoring, and reporting, and meeting management capabilities. The Contractor shall ensure alignment with VA management policies, guidelines and requirements and use existing ECSO reporting tools (where possible) to provide support. All new SOPs or changes shall be reviewed and approved through the VA designated governing body.

The Contractor shall provide process re-engineering support that includes but not limited to:

A. Recommending and assisting VA in operationalizing new or enhanced management capabilities and processes required to oversee, manage, and drive VA’s transition to the cloud. The Contractor shall annually assess current program management processes and assist in implementing VA approved, improvement strategies to establish and mature processes and procedures using stakeholder feedback, lessons learned, and best practices.

B. Developing or refining and assisting VA in operationalizing cloud and infrastructure program and project management SOPs.

C. Developing or refining, and updating responsible, accountable, consulted, and informed (RACI) charts and process flow diagrams for each SOP.

D. Developing and executing implementation strategies to support new and enhanced SOPs, processes, and tools. The Contractor shall develop or refine process documents, artifacts, and communications.

E. Developing or refining adoption strategies for implementing new or updated VAEC standards, processes, guidelines, and cloud policies. The Contractor shall work with stakeholder organizations to assist VA to build awareness and knowledge on how to adopt. The Contractor shall develop or refine documents, artifacts, and communications.

F. Refining and maintaining ECSO process repository or tool in alignment with the ECSO Document Management Plan. The Contractor shall maintain the VAEC Process Repository and ensure the latest documents are easily accessible to the appropriate users.

Deliverables:

A. ECSO Standard Operating Procedures (and Updates)

PROGRAM AND PROJECT COMMUNICATIONS

The Contractor shall provide strategic communications support to ensure relevant, timely information is conveyed to the right stakeholders. This includes but is not limited to:

A. Providing inputs to develop ECSO Communications Plan that defines the program’s approach to developing, reviewing, and distributing relevant information.

B. Providing communications support to execute the VA approved, ECSO Communications Plan. The Contractor shall develop and distribute at VA’s request, relevant, timely communications for target stakeholders in alignment with this Plan.

C. Establishing or enhancing and maintaining ECSO and VAEC communications channels such as the SharePoint sites, info email boxes, frequently answered questions (FAQs), and newsletters. The Contractor shall develop, refine, and update communications documents and artifacts (e.g., briefings, videos).

D. Developing VAEC welcome packages, standard VAEC and ECSO program and strategic overviews (e.g., VAEC Lifecycle Management Framework (VLMF) Overview, VAEC Strategy, VAEC At-A-Glance), and other cloud program and technical documents, artifacts, and content (e.g., SharePoint Site, Newsletters).

E. Gathering and provide input to assist VA in responding to data inquiries and data calls. The Contractor shall monitor and track all requests. The Contractor shall coordinate closure of data inquiries and data calls.

F. Gathering or assisting VA in developing VAEC documents and artifacts to support audits for stakeholders such as the Office of Inspector General (OIG) and General Accounting Office (GAO).

G. Refining and implementing a ECSO Document Management Plan that defines a standardized document management approach, processes, and tools needed to manage program and project documents and artifacts. The Contractor shall enhance and maintain the ECSO Document Management Repository.

H. Providing input to support VA’s annual review and update of these plans and assist VA in executing the communications plans.

I. Coordinating and facilitating information sharing sessions that includes but not limited to Lunch and Learns, Brown Bags and Communities of Interest meetings to build awareness and knowledge on cloud topics.

Deliverables:

A. Updated ECSO Document Management Plan

ARCHITECTURE AND DESIGN SUPPORT

The Contractor shall provide architecture and design support for cloud and infrastructure projects leveraging emerging technologies (such as containerization, cloud native techniques, and automation), enhancing existing VA services and tools, and incorporating lessons learned to improve resiliency, and optimize cost and performance that includes but not limited to:

A. Further developing, refining, and maintaining the VAEC Architecture. (5.4.1) B. Conducting capability assessment to identify and validate capability needs and propose implementing or enhancing cloud…