Draft Performance Work Statement.docx

SPM Portfolio Integration Services Support Date June 6, 2024

VA-24-0002285

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Office of Information Technology Software Products Management, Portfolio Integration (SPM/PI)

SPM Portfolio Integration Services Support

Date June 19, 2024

VA-24-0002285

PWS Version Number: 1.3

Contents

BACKGROUND

The mission of the Department of Veterans Affairs (VA) Office of Information and Technology (OIT) Software Products Management (SPM) is to design, deliver, maintain, and harden software assets across VA through portfolios including Corporate Services, Health Services, Benefits and Memorials, and Financial Technology. SPM accomplishes its mission by continually increasing efficiency, reducing technical debt, and modernizing offerings to support VA’s priorities and enhance the Veteran experience. SPM employs product line management best practices to speed the delivery of products and services to VA’s workforce and the Nation’s Veterans.

The SPM is organized into six units – one of the units is the Portfolio Integration Office (SPM/PIO) unit which is responsible for governance, oversight, and technical support across all Portfolios and Product Lines within SPM which have enterprise-wide impacts. This team supports the full product life cycle within the DevSecOps environment. SPM serves as a crucial element in meeting the goals of building accessible and quality IT software solutions. Within the SPM/PI is the Special Projects (SP) Team which handles End-of-Life (EOL) Unauthorized Software, U.S. Space Force, and Social Security Number Reduction (SSNR).

The Contractor shall include, at a minimum provides support for assistance to all development projects requiring Portfolio Integration support for SharePoint, Enterprise Risk Management, MS Power Apps, End-of-Life (EOL) support and other special projects requiring attention outside of the Portfolio management. This includes Reports on VA’s compliance with the providing metrics and data to OMB and GAO. SPM has mandate for meeting the requirement for eliminating Technical Debt from its OIT systems by way of procurement, day to day use of, maintenance and/or developed by the VA. The SPM Portfolio Integration Office services eight (8) core functions, Service Management, Governance, Risk and Compliance, Process Improvement, 508 Compliance, Enterprise Testing, Software Testing, Metrics Tracking and Configuration Management. Technical Debt exposes the VA to security vulnerabilities, congressional investigations risk due to non-compliance of Federal law as well as lawsuits arising from accessibility complaints. Decreases VAs accessibility risk for security risks, the accessibility of systems and applications availability to veterans and employees use of Information and Communication Technology by increasing their ability to access Medical Records, Benefits information, appointment services, etc., through mobile and web technology.

The work performed in this Performance Work Statement (PWS) shall assist in meeting the mission for SPM Portfolio Integration to provide value to SPM by serving as a central cross-portfolio coordinating body that captures and enables best practices aligned with the "VA way," leading the cross-portfolio planning, organizing, in the six core functions as well as tracking of SPM mandated special projects. This alleviates the VA Portfolio Products Managers from taking on intricate details of special projects and focus on their current path of delivering high quality products to our VA stakeholders and customers.

In addition, this program group provides ongoing oversight, coordination, and tracking of cross-portfolio special projects across all Products and Product Lines ensuring VA compliance.

APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. 44 U.S.C. § 3541-3549, “Federal Information Security Management Act (FISMA) of 2002”

2. “Federal Information Security Modernization Act of 2014”

3. Federal Information Processing Standards (FIPS) Publication 140-2, “Security Requirements for Cryptographic Modules”

4. 10 U.S.C. § 2224, "Defense Information Assurance Program"

5. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974.”

6. Public Law 109-461, Veterans Benefits, Health Care, and Information Technology Act of 2006, Title IX, Information Security Matters

7. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”

8. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, https://www.va.gov/vapubs/index.cfm

9. VA Handbook 0710, “Personnel Security and Suitability Program,” May 2, 2016, https://www.va.gov/vapubs/index.cfm

10. VA Directive and Handbook 6102, “Internet/Intranet Services,” August 5, 2019

11. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and Guidelines,” January 18, 2017

12. Office of Management and Budget (OMB) Circular A-130, “Managing Federal Information as a Strategic Resource,” July 28, 2016

13. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed Services (CHAMPUS)”

14. NIST SP 800-66 Rev. 1, “An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule,” October 2008

15. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended, January 18, 2017

16. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

17. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021

18. VA Handbook 6500, “Risk Management Framework for VA Information Systems VA Information Security Program,” February 24, 2021

19. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI),” March 12, 2019

20. VA Handbook 6500.5, “Incorporating Security and Privacy into the System Development Lifecycle,” March 22, 2010

21. VA Handbook 6500.6, “Contract Security,” March 12, 2010

22. VA Handbook 6500.8, “Information System Contingency Planning,” April 6, 2011

23. VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018

24. VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017

25. OIT Process Asset Library (PAL), https://www.va.gov/process/ . Reference Process Maps at https://www.va.gov/process/maps.asp and Artifact templates at https://www.va.gov/process/artifacts.asp

26. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

27. VA Directive 6507, “REDUCING THE USE OF SOCIAL SECURITY NUMBERS,” November 20, 2008

28. VA Handbook 6507.1, “Acceptable Uses of the SOCIAL SECURITY NUMBER (SSN) and the VA SSN REVIEW BOARD,” July 30, 2015

29. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014

30. VA Handbook 6508.1, “Procedures for Privacy Threshold Analysis and Privacy Impact Assessment,” July 30, 2015

31. VA Handbook 6510, “VA Identity and Access Management,” January 15, 2016

32. VA Directive and Handbook 6513, “Secure External Connections,” October 12, 2017

33. VA Directive 6300, “Records and Information Management,” September 21, 2018

34. VA Handbook, 6300.1, “Records Management Procedures, “March 24, 2010

35. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020)

36. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015

37. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” March 24, 2014

38. OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005

39. Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance, December 2, 2011, (NOTE: Part A of the FICAM Roadmap and Implementation Guidance, v2.0, was replaced in 2015 with an updated Architecture

40. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

41. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019

42. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008

43. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (Public Law 110–140), December 19, 2007

44. Section 104 of the Energy Policy Act of 2005, (Public Law 109–58), August 8, 2005

45. Executive Order 13834, “Efficient Federal Operations,” dated May 17, 2018

46. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 2, 2001

47. VA Directive 0058, “VA Green Purchasing Program,” July 19, 2013

48. VA Handbook 0058, “VA Green Purchasing Program,” July 19, 2013

49. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

50. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

51. “Veteran Focused Integration Process (VIP) Guide 4.0,” January 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

52. VA Memorandum “Proper Use of Email and Other Messaging Services,” January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

53. “DevSecOps Product Line Management Playbook” version 2.0, May 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

54. NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020

55. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol Version 6 (IPv6),” November 19, 2020

56. Information Technology Management, as amended, 40 U.S.C. Subtitle III

SCOPE OF WORK

The Contractor shall include, at a minimum provide assistance to enterprise business and technical IT support services i.e. business and technical analysis, program and project management, IT architectural design, to assist in reaching SPM/PI’s mission and goals of SPM Portfolio Integration provides governance, oversight, and technical support across all Portfolios and Product Lines within SPM and have enterprise-wide impacts. This team supports the full product life cycle within the DevSecOps environment. SPM serves as a crucial element in meeting the goals of building accessible and quality IT software solutions to their desired outcomes. As the PIO strives for continuous improvement in VAs accessibility risk for security risks, the accessibility of systems and applications availability to veterans and employees use of “Information and Communication Technology” by increasing their ability to access Medical Records, Benefits information, appointment services, etc., through mobile and web technology. This includes Reports on VA’s compliance with the providing metrics and data to OMB and GAO.

The following five (5) principles that are foundation of PIO support:

1 Cross-portfolio organization

· Synchronizing guidelines and initiatives that are cross-portfolio in nature and that would benefit from a central coordinator.

2 Product team empowerment

· Processes, enable operational and engineering excellence, and foster alignment and autonomy.

3 Flexible scaling model

· Effectively scaling teams up and down to meet needs and requirements of time-bound, cross-portfolio special projects

4 Lean and efficient solutions

· Enabling the most efficient solutions to optimize ease and modernization of future product development.

5 Orientation towards education, awareness, and capability building.

· Disseminating and demonstrating modern IT principles to teams across OIT while balancing need for adherence to best practices

PERFORMANCE DETAILS

PERFORMANCE PERIOD

The Period of Performance (PoP) shall be 12 months from date of award, with four 12-month option periods and eight Optional Tasks. The overall POP shall not exceed 60 months.

There are eleven (11) Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, four are set by date:

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

PLACE OF PERFORMANCE

Tasks under this PWS shall be performed at Contractor facilities. The Contractor shall identify the Contractor’s place of performance in their proposal submission.

TRAVEL

The Government does not anticipate any travel under this effort.

SPECIFIC TASKS AND DELIVERABLES

The Contractor shall perform the following:

PROJECT MANAGEMENT (FFP)

CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall include, at a minimum deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, timeline, and tools to be used in execution of the contract. The CPMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks, and resource support. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPMP shall be concurred upon and updated in accordance with Addendum B of the contract. The Contractor shall update and maintain the VA PM approved CPMP throughout the PoP.

Deliverable:

A. Contractor Project Management Plan

REPORTING REQUIREMENTS

The Contractor shall provide the COR with Weekly Progress Reports in electronic form in Microsoft Word and Project formats. The report shall include detailed instructions/explanations for each required data element, to ensure that data is accurate and consistent. These reports shall reflect data as of the last day of the preceding Weekly reporting period.

The Weekly Progress Reports shall cover all work completed during the reporting period and work planned for the subsequent reporting period. The report shall also identify any problems that arose and a description of how the problems were resolved. If problems have not been completely resolved, the Contractor shall provide an explanation including their plan and timeframe for resolving the issue. The Contractor shall monitor performance against the CPMP and report any deviations. It is expected that the Contractor will keep in communication with the COR and OIS Leadership between Weekly Progress Reports as needed so that issues that arise are transparent to both parties to prevent escalation to risks.

The Weekly Progress Report shall include the following data elements:

a. Overarching Project Name and PWS Name

b. Overall high-level assessment of Contractor progress and related outcomes

c. All work in-progress completed during the reporting period, presented in a user-friendly format for program management.

d. Identification of any programmatic issues uncovered during the reporting period; highlight those areas with a high probability of impacting schedule, cost, or performance goals.

e. Explanations for any unresolved issues, including possible solutions and any actions required of the Government and/or Contractor to resolve or mitigate any identified issue, including a plan and timeframe for resolution.

f. Status on previously identified issues, actions taken to mitigate the situation and/or progress made in rectifying the situation.

g. Work planned for the subsequent reporting period.

h. Current schedule overlaid on initial schedule showing any delays or advancement in schedule of key communication activities.

i. Current schedule overlaid on initial schedule showing any delays or advancement in schedule of project deliverables.

j. Workforce staffing data showing all Contractor personnel performing on the effort during the current reporting period. After the initial labor baseline is provided, each Weekly Progress Report shall identify any changes in staffing, identifying each person who was added to or removed from the contract.

k. Original schedule of deliverables and Contractor progress towards meeting each deliverable.

Deliverable:

A. Weekly Progress Report

TECHNICAL KICKOFF MEETING

A technical kickoff meeting shall be held within 10 days after contract award. The Contractor shall coordinate the date, time, and location (can be virtual) with the Contracting Officer (CO), as the Post-Award Conference Chairperson, the VA PM, as the Co-Chairperson, the Contract Specialist (CS), and the COR. The Contractor shall provide a draft agenda and Technical Kickoff Briefing Slides to the CO and VA PM at least five (5) calendar days prior to the meeting. Upon Government approval of a final agenda, the Contractor shall distribute to all meeting attendees. During the kickoff-meeting, the Contractor shall present, for review and approval by the Government, the details of the intended approach, work plan, and project schedule for each effort via a Microsoft Office PowerPoint presentation. At the conclusion of the meeting, the Contractor shall update the presentation with a final slide entitled “Summary Report” which shall include notes on any major issues, agreements, or disagreements discussed during the kickoff meeting and the following statement “As the Post-Award Conference Chairperson, I have reviewed the entirety of this presentation and assert that it is an accurate representation and summary of the discussions held during the Technical Kickoff Meeting for the Technical and Business Management Support for Social Security Number (SSN) Reduction.” The Contractor shall submit the final updated presentation to the CO for review and signature within three (3) calendar days after the meeting. The Contractor shall also work with the CS, the Government’s designated note taker, to prepare and distribute the meeting minutes of the kickoff meeting to the CO, COR, and all attendees within three (3) calendar days after the meeting. The Contractor shall obtain concurrence from the CS on the content of the meeting minutes prior to distribution of the document.

Deliverable:

A. Technical Kickoff Briefing Slides

PRIVACY & HIPAA TRAINING

The Contractor shall submit Talent Management System (TMS) training certificates of completion for VA Privacy and Information Security Awareness and Rules of Behavior and Health Insurance Portability and Accountability Act (HIPAA) training and provide signed copies of the Contractor Rules of Behavior in accordance with Section 9, Training, from Appendix C of the VA Handbook 6500.6, “Contract Security”.

Deliverables:

A. VA Privacy and Information Security Awareness and Rules of Behavior Training Certificate B. VA HIPAA certificate of completion C. Signed Contractor Rules of Behavior

ONBOARDING SUPPORT

The Contractor shall manage the onboarding process for VA access and to individual system/environment access for all Contractor staff supporting this contract. The Contractor shall collect signed rules of behavior documents, signed non-disclosure agreements, training certificates, applications for access to VA information systems, TMS, PIV card requests and other onboarding related information for assigned projects, and provide secure storage for these electronic files, in accordance with National Archives and Records Administration (NARA) and VA guidance. The Contractor shall provide the files and information to VA PM, COR, or other VA staff, to support VA’s onboarding process for granting access to VA systems. The Contractor shall submit access requests, including TMS applications, PIV card applications, remedy tickets, and electronic Contractor Access Request Forms (eCARFs) in accordance with VA onboarding processes. The Contractor shall monitor the submission of the artifacts and follow up with Contractors to assure that all artifacts submitted are complete and correct. The Contractor shall also track VA system access requests, for assigned projects, to completion. The Contractor shall document all findings in the Weekly Onboarding Status Report.

Deliverable:

A. Weekly Onboarding Status Report

Support for meeting Portfolio Integration Service SUPPORT FUNCTIONS (FFP) The Contractor shall, at a minimum, provide support assistance to all development projects requiring Portfolio Integration support for automation, governance / risk / compliance, i.e., enterprise risk management, MS Power Apps, maintaining SharePoint sites, i.e., SPM dashboards and metrics, striving towards Best Practices i.e., Problem Management/MIM Processes, Other assignments, i.e., review of project narratives and Technical Reference Management (TRM) reviews, and provide program level support for all related projects when required. End-of-Life (EOL) support, IPv6 as well as other special projects requiring attention outside of the main Portfolios management. This includes Reports on VA’s compliance with the providing metrics and data to Office of Management and Budget (OMB) and Government Accounting Office (GAO) the following areas:

· Drive decision making

· Oversee program strategy & execution, approve escalated decisions

· Continuous support for software configuration management

· Create progress tracking mechanisms

Deliverable:

A. Project Status Report

Support for Portfolio Integration Transition Roadmap The Contractor shall include, at a minimum, assist SPM Portfolio Integration in developing a roadmap to achieve IT Enterprise Goals for executing an overall program timeline. This roadmap should include major milestones for further continuation and a more agile Portfolio Integration Office (PIO). Assisting in this program timeline PIO to continue to provide cross portfolio related services; i.e., program and project management of special projects pertaining to enterprise level implementations, as they come in, recommendations in industry related automation, enterprise-wide risk mitigation strategies to the SPM portfolios and their customers. The services support for this contract will contribute to the building of an Excel tracking tool to aid establishing, activation, tracking, metric reporting in “To-Be”

• Clarity and direction via the dissemination of "best practices" and active support for working in a Product Management environment to assist the SPM portfolios

• Templatization and standardization of portfolio dashboards and metrics reporting processes for productive use in portfolio diagnostics and planning

• A clear playbook for the timely and effective completion of cross portfolio activities and VA enterprise type of requirements extending across the various portfolios within special projects

“As-Is”

• Limited sharing of best practices, knowledge, and guidelines among SPM portfolios

• Inconsistent data reporting across portfolios that complicates oversight and obscures performance, i.e. erroneous information that slows down production

• Slow or unstructured scoping and execution of special projects with cross portfolio implications meeting PIO’s mission. Additionally, assistance in creating an office staffing plan and an overall change management communications plan will need to be developed to ensure a smooth organizational transition. Below is sample:

This should include but not limited to: Cycle Times for processes, First-Time Fix Rate: This KPI measures the percentage of times a problem or issue is resolved on the first attempt, On-Time Delivery: This KPI measures the percentage of releases or deliveries that are completed on time without errors, Defect Rate: This KPI measures the percentage of defective products or services that require rework.

Deliverable:

A. PIO Transition Roadmap

SPM PERFORMANCE MEASURES PROGRAM

The SPM Performance Measurement Program establishes processes and mechanisms to enable SPM to evaluate gains in efficiencies and process improvements over time. Data is tracked and trended throughout the fiscal year (and against prior fiscal years) and used to evaluate SPM’s performance in several key areas:

The Contractor shall include, at a minimum, assist in the development of a methodology and a data tracking trends report capturing these performance measuring methodologies to better track data for metrics reporting.

Deliverable:

A. Tracking Data Trends Methodology B. Data Tracking Trends Report

0. SERVICE MANAGEMENT, BEST PRACTICES AND GUIDANCE

The Contractor shall include, at a minimum, assist the PIO in the establishment and definitions of guidelines, best practices for cross-portfolio (enterprise-wide) activities, management processes, procedures, SOPs, and VA policies in accordance with the "VA way". The VA-Way is Veteran Centric; thereby creating an Enterprise-wide Cross-Portfolio Plan of Best Practices. Assist in promoting and upholding best practices in line with contributing to the success of following areas:

· Coordinate embedded expertise across portfolios (e.g., Centers of Excellence (CoEs) and chapters)

· Support stand-up of CoEs, oversee coordination of cross-portfolio chapters

· Establish communication channels and strong link to CoEs and chapters

· Own knowledge repository and expertise for cross-portfolio domains

· Provide a consistent, program wide view of PIO implementation progress, issues, and interdependencies.

· Coordinate implementation activities, ensure plan stays on track

· Drive down the frequency of major incidents and improve incident response through proactive measures and immediate action

Portfolio Planning and Oversight

· Develop and facilitate unified portfolio reviews and reporting processes (e.g., quarterly business reviews, version description documents)

· Standardize and templatize dashboards and management systems promote transparency and accountability

· Provide awareness of key portfolio metrics, for example the metrics that the portfolios have assigned themselves to include measuring the influence and value add that cross-portfolio management adds to the day-to-day portfolio operations, management of risks and how risks are trending over time, customer and end-user experiences, project success rate, project completion rate, customer satisfaction rate, acceptance/rejection rate within this report. The report is given to SPM leadership, provide resources to portfolios where needed

· Aggregate data to provide enterprise view

· Provide data-driven intervention and support for product teams in need

Deliverable:

Enterprise-wide Cross-Portfolio Plan of Best Practices

SUPPORT FOR SPECIAL PROJECTS (T&M)

The Contractor shall include, at a minimum assist in creating a methodology that lean towards normalization of relevant EOL data between various repositories on VA dashboards and SharePoint sites for SPM’s Critical Systems. Assist in building the End-of-Life Technology Product Lifecycle (ETPL) that consist of research and identification of EOL Technology that is able to quickly determine when a piece of software or tool is beyond the limits of normal support; sniff, track and prevent the addition of any out of support application or tool, and continuous monitoring of any future attempts to add out of support software that will contribute to the success of the following:

· Plan, coordinate, track, and communicate around new, time-bound cross-portfolio projects:

· Drive stand-up and coordination of PMO for large-scale, complex projects

· Coordinate with portfolios, business customers, and VA stakeholder groups throughout special project lifecycle

· Support consistent onboarding for special project teams

· Track and monitor project(s) progress, inform SPM leadership:

· Proactively survey environment for incoming special projects

· Manage stakeholder communications

· Broadcast change communications messaging

· Provide technical analysis support for integrated logistics support, i.e. supplying recommendations for support tools to assist in implementing cross-portfolio implementations, such as the one by Azure; and tools such as Site Reliability Engineering (SRE) tools for optimum reliability engineering as other SRE Best Practices.

Deliverables:

A. Product Management (ETPL) Methodology Plan B. SRE Reliability Tools Plan

Optional Task #1 - SPM PERFORMANCE MEASURES PROGRAM (T&M) If VA exercise this Optional Task the Contractor shall provide (may be exercised up to 5 times over the life of the contract) additional support for the SPM Performance Measurement Program to establish the processes and mechanisms that enable SPM to evaluate gains in efficiencies through data quality and process improvements over time. This is done by analyzing the process of collecting specific related data points in order to better understand customer behavior and make data-driven business decisions. Data is tracked and trended throughout the fiscal year (and against prior fiscal years) and used to evaluate SPM’s performance in several key areas, which include by not limited to: the processes of collecting data points in order to better understand customer behavior and make data-driven business decisions on the influence of cross-portfolio’s involvement across the following:

The Contractor shall include, at a minimum, assist by making recommendations for the development of performance measuring methodologies for creating an optimum cross-portfolio performance tool for bettering track data and metrics reporting. Examples: What types of trends should we observe? Are there certain types of data that are triggers when performance is declining or causing bottlenecks in production across the portfolios? And are we getting the best out of our cross-portfolio production and adding value to the process?

Deliverable:

A. A Cross-Portfolio Performance Measuring Report Optional Task #2 - SERVICE MANAGEMENT, BEST PRACTICES AND GUIDANCE (T&M) If VA exercise this Optional Task the Contractor shall include, at a minimum, provide (may be exercised up to 5 times over the life of the contract) a Enterprise Wide Product Management” Plan to assist the PIO in the establishment and definitions of guidelines, best practices for good enterprise-wide management, processes, and policies in accordance with the "VA way". The “VA- Way” is Veteran Centric. Assist in promoting and upholding best practices in line with contributing to the success of following areas:

· VA Microsoft Power Platform CoE

· VA Power Apps CoE

Portfolio Planning and Oversight

Deliverable:

A. Enterprise-Wide Product Management” Plan B. Knowledge Repository for Cross Portfolio of Terms and Processes

Optional Task #3 - SUPPORT FOR SPECIAL PROJECTS (T&M) If VA exercise this Optional Task the Contractor shall include, at a minimum (may be exercised up to 5 times over the life of the contract) assist and support in the creation and maintenance of a 5 functioning Special Projects sub-group consisting of Business Analysis, Technology and Data Analysis, Data Research and Data Governance as well as Program Management and Communication and Risk Management methodologies that lean towards normalization of relevant EOL data between repositories for SPM’s Critical Systems. Assist in building the End-of-Life Technology Product Lifecycle (ETPL) that will contribute to the success of the following:

· Plan, coordinate, track, and communicate around new, time-bound cross-portfolio projects:

· Drive stand-up and coordination of PMO for large-scale, complex projects

· Support development of standard operating procedures

· Coordinate with portfolios, business customers, and VA stakeholder groups throughout special project lifecycle

· Track and monitor project progress, inform SPM leadership:

· Proactively survey environment for incoming special projects

· Manage stakeholder communications.

· Broadcast change communications messaging

· Provide technical analysis support for integrated logistics support and reliability engineering.

Deliverables:

A. Product Management (ETPL) Methodology Plan B. SRE Reliability Tools Plan Optional TASK #4 - TRANSITION OUT SUPPORT (T&M) If this Optional Task is exercised, the Contractor shall provide (may be exercised up to 5 times over the life of the contract) transition out support for a PoP of three months. This Optional Task may be exercised up to one time at any time during base or option periods.

The Contractor shall include, at a minimum provide a Transition Out Plan which covers the last three months of the current contract. The Transition Out Plan shall be provided to the Government at least four months prior to the contract effective end date. The Contractor shall provide outgoing Transition Out Support from the current Contractor to a follow-on Contractor or Government entity. The Transition Out Support shall include formal and informal coordination with staffs and management of both Government and successor Contractor. Transition Out Support shall also include delivery of all artifacts, plans, policies, procedures, metrics, products, statistics, and processes developed under this contract.

The Transition Out Support shall include, at a minimum:

1. Coordination with Government representatives.

2. Review, evaluation, and transition of current support services.

3. Transition of historic data to new Contractor system.

4. Transition of accounts, permissions, locations, architecture, configuration, and dataflows associated with any repositories in use.

5. Transfer of all information and historical artifacts regarding hardware and software warranties, maintenance agreements and licenses and applicable expiration information.

6. Transfer of all business and/or technical documentations.

7. Complete an orientation program to introduce Government personnel, programs, and the outgoing Contractor's team, tools, methodologies, and business processes to the successor Contractor team.

8. Disposition of Contractor purchased Government-owned assets.

9. Transfer of GFE and Government-furnished Information (GFI) and GFE inventory management assistance to the Government.

10. Turn-in all Government keys, ID/access cards and security codes.

The Contractor shall include, at a minimum also produce a list of all assets associated with the contract three months prior to the end of this contract. This list shall include all software assets, specification of support environments, tools; hardware and software licenses, warranties, and maintenance agreements; documentation, and any other assets that must be maintained throughout the asset lifecycle. The finalized asset list shall be compared against VA Inventory Records and shall be signed by the VA PM and the Receiving Organization to indicate acceptance once validated. The Contractor shall provide the Asset List of all assets as part of the Transition Out Plan.

Deliverable:

A. Transition Out Plan

GENERAL REQUIREMENTS

ENTERPRISE AND IT FRAMEWORK

VA TECHNICAL REFERENCE MODEL

The Contractor shall support the VA enterprise management framework. In association with the framework, the Contractor shall comply with OIT Technical Reference Model (VA TRM). The VA TRM is one component within the overall Enterprise Architecture (EA) that establishes a common vocabulary and structure for describing the information technology used to develop, operate, and maintain enterprise applications. Moreover, the VA TRM, which includes the Standards Profile and Product List, serves as a technology roadmap and tool for supporting OIT. Architecture & Engineering Services (AES) has overall responsibility for the VA TRM.

FEDERAL IDENTITY, CREDENTIAL, AND ACCESS MANAGEMENT (FICAM)

The Contractor shall ensure Commercial Off-The-Shelf (COTS) product(s), software configuration and customization, and/or new software are Personal Identity Verification (PIV) card-enabled by accepting HSPD-12 PIV credentials using VA Enterprise Technical Architecture (ETA), https://www.ea.oit.va.gov/EAOIT/VA_EA/Enterprise_Technical Architecture.asp, and VA Identity and Access Management (IAM) approved enterprise design and integration patterns, https://www.oit.va.gov/library/recurring/edp/index.cfm. The Contractor shall ensure all Contractor delivered applications and systems comply with the VA Identity, Credential, and Access Management policies and guidelines set forth in VA Handbook 6510 VA Identity and Access Management, VA Handbook 0735 Homeland Security Presidential Directive 12 (HSPD-12) Program, and align with the Federal Identity, Credential, and Access Management Roadmap and Implementation Guidance v2.0.

The Contractor shall ensure all Contractor delivered applications and systems provide user authentication services compliant with the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-63-3, VA Handbook 6500 Appendix F, “VA System Security Controls”, and VA IAM enterprise requirements for direct, assertion-based authentication, and/or trust-based authentication, as determined by the design and integration patterns. Direct authentication at a minimum must include Public Key Infrastructure (PKI) based authentication supportive of PIV card and/or Common Access Card (CAC), as determined by the business need.

The Contractor shall ensure all Contractor delivered applications and systems conform to the specific Identity and Access Management PIV requirements set forth in the Office of Management and Budget (OMB) Memoranda M-05-24, M-19-17, and NIST Federal Information Processing Standard (FIPS) 201-2. OMB Memoranda M-05-24 and M-19-17 can be found at: https://www.whitehouse.gov/wp-content/uploads/2019/05/M-19-17.pdf respectively. Contractor delivered applications and systems shall be on the FIPS 201-2 Approved Product List (APL). If the Contractor delivered application and system is not on the APL, the Contractor shall be responsible for taking the application and system through the FIPS 201 Evaluation Program.

The Contractor shall ensure all Contractor delivered applications and systems support:

1. Automated provisioning and are able to use enterprise provisioning service.

2. Interfacing with VA’s Master Person Index (MPI) to provision identity attributes, if the solution relies on VA user identities. MPI is the authoritative source for VA user identity data.

3. The VA defined unique identity (Secure Identifier [SEC ID] / Integrated Control Number [ICN]).

4. Multiple authenticators for a given identity and authenticators at every Authenticator Assurance Level (AAL) appropriate for the solution.

5. Identity proofing for each Identity Assurance Level (IAL) appropriate for the solution.

6. Federation for each Federation Assurance Level (FAL) appropriate for the solution, if applicable.

7. Two-factor authentication (2FA) through an applicable design pattern as outlined in VA Enterprise Design Patterns.

8. A Security Assertion Markup Language (SAML) implementation if the solution relies on assertion-based authentication. Additional assertion implementations, besides the required SAML assertion, may be provided as long as they are compliant with NIST SP 800-63-3 guidelines.

9. Authentication/account binding based on trusted Hypertext Transfer Protocol (HTTP) headers if the solution relies on Trust based authentication.

10. Role Based Access Control.

11. Auditing and reporting capabilities.

12. Compliance with VIEWS 00155984, PIV Logical Access Policy Clarification https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896.

The required Assurance Levels for this specific effort are Identity Assurance Level 3, Authenticator Assurance Level 3, and Federation Assurance Level 3.

INTERNET PROTOCOL VERSION 6 (IPV6)

The Contractor solution shall support Internet Protocol Version 6 (IPv6) based upon the memo issued by the Office of Management and Budget (OMB) on November 19, 2020 (https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-07.pdf). IPv6 technology, in accordance with the USGv6 Program (https://www.nist.gov/programspro jects/usgv6-program/usgv6-revision-1), NIST Special Publication (SP) 500-267B Revision 1 “USGv6 Profile” (https://doi.org/10.6028/NIST.SP.500-267Br1), and NIST SP 800-119 “Guidelines for the Secure Deployment of IPv6” (https://doi.org/10.6028/NIST.SP.800-119), compliance shall be included in all IT infrastructures, application designs, application development, operational systems and sub-systems, and their integration. In addition to the above requirements, all devices shall support native IPv6 and dual stack (IPv6 / IPv4) connectivity without additional memory or other resources being provided by the Government, so that they can function in a mixed environment. All public/external facing servers and services (e.g., web, email, DNS, ISP services, etc.) shall support native IPv6 and dual stack (IPv6 / IPv4) users and all internal infrastructure and applications shall communicate using native IPv6 and dual stack (IPv6 / IPv4) operations.

TRUSTED INTERNET CONNECTION (TIC)

The Contractor solution shall meet the requirements outlined in Office of Management and Budget Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative“ (https://www.whitehouse.gov/wp-content/uploads/2019/09/M-19-26.pdf), VA Directive 6513 “Secure External Connections”, and shall comply with the TIC 3.0 Core Guidance Documents, including all Volumes and TIC Use Cases, found at the Cybersecurity & Infrastructure Security Agency (CISA) (https://www.cisa.gov/publication/tic-30-core-guidance-documents). Any deviations must be approved by the VA TIC 3.0 Working Group at vaoisesatic30team@va.gov.

STANDARD COMPUTER CONFIGURATION

The Contractor IT end user solution that is developed for use on standard VA computers shall be compatible with and be supported on the standard VA operating system, currently Windows 10 (64bit), Edge (Chromium based), and 365 Apps for enterprise. Applications delivered to VA and intended to be deployed to Windows 10 workstations shall be delivered as a signed .msi package with switches for silent and unattended installation and updates shall be delivered in signed .msp file formats for easy deployment using Microsoft Endpoint Configuration Manager (CM) VA’s current desktop application deployment tool. Signing of the software code shall be through a vendor provided certificate that is trusted by VA using a code signing authority such as Verizon/Cybertrust or Symantec/VeriSign. The Contractor shall also ensure and certify that their solution functions as expected when used from a standard VA computer, with non-admin, standard user rights that have been configured using the United States Government Configuration Baseline (USGCB) and Defense Information Systems Agency (DISA) Secure Technical Implementation Guide (STIG) specific to the particular client operating system being used.

VETERAN FOCUSED INTEGRATION PROCESS (VIP) AND PRODUCT LINE MANAGEMENT (PLM)

The Contractor shall support VA efforts IAW the updated Veteran Focused Integration Process (VIP) and Product Line Management (PLM). The major focus of the new VIP is on Governance and Reporting and is less prescriptive, with a focus on outcomes and continuous delivery of value. Product Line Management (PLM) is a framework that focuses on delivering functional products that provide the highest priority work to customers while delivering simplified, reliable, and practical solutions to the business, medical staff, and our Veterans. The VIP Guide is a companion guide to the PLM Playbook and can be found at: https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371 and the PLM Playbook can be found at https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946. The PLM Playbook pivots from project-centric to product-centric delivery and contains descriptive practices that focuses on outcomes. The PLM Playbook contains a set of “plays” that implement Development, Security, and Operations (DevSecOps) principles and processes such as automated development, continuous integration/continuous delivery, and release on demand. The PLM Playbook details how product lines implement Lean-Agile principles, methods, practices, and techniques through levels of maturity. VIP and PLM are the authoritative processes that IT projects must follow to ensure development and delivery of IT products.

PROCESS ASSET LIBRARY (PAL)

The Contractor shall perform their duties consistent with the processes defined in the OIT Process Asset Library (PAL). The PAL scope includes the full spectrum of OIT functions and activities, such as VIP project management, operations, service delivery, communications, acquisition, and resource management. PAL serves as an authoritative and informative repository of searchable processes, activities or tasks, roles, artifacts, tools and applicable standards and guides to assist the OIT workforce, Government and Contractor personnel. The Contractor shall follow the PAL processes to ensure compliance with policies and regulations and to meet VA quality standards. The PAL includes the contractor onboarding process consistent with Section 6.2.2 and can be found at https://www.va.gov/PROCESS/artifacts/maps/process_CONB_ext.pdf. The main PAL can be accessed at www.va.gov/process.

AUTHORITATIVE DATA SOURCES

The VA Enterprise Architecture Repository (VEAR) is one component within the overall EA that establishes the common framework for data taxonomy for describing the data architecture used to develop, operate, and maintain enterprise applications. The Contractor shall comply with the department’s Authoritative Data Source (ADS) requirement that VA systems, services, and processes throughout the enterprise shall access VA data solely through official VA ADSs where applicable, see below. The Information Classes which compose each ADS are located in the VEAR, in the Data & Information domain. The Contractor shall ensure that all delivered applications and system solutions support:

1. Interfacing with VA’s Master Person Index (MPI) (formerly the Master Veteran Index (MVI)) to provision identity attributes, if the solution relies on VA user identities. MPI is the authoritative source for VA user identity data.

2. Interfacing with Capital Asset Inventory (CAI) to conduct real property record management actions if the solution relies on real property records data. CAI is the authoritative source for VA real property record management data.

3. Interfacing with electronic Contract Management System (eCMS) for access to contract, contract line item, purchase requisition, offering vendor and vendor, and solicitation information above the micro-purchase threshold, if the solution relies on procurement data. ECMS is the authoritative source for VA procurement actions data.

4. Interfacing with HRSmart Human Resources Information System to…