DRAFT Performance Work Statement_VLM.docx

Veterans Legacy Memorial (VLM)

VA-26-00004977

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Office of Information & Technology Product Delivery Services Benefits and Memorials Memorial Benefits and Services

Veterans Legacy Memorial (VLM)

Date: 08/01/2025

VA-26-00004977

PWS Version Number: 1.0

DRAFT

Contents

BACKGROUND

The Department of Veterans Affairs (VA), Office of Information & Technology (OIT), Product Delivery Services (PDS), Benefits and Memorials (BAM), Memorials and Benefits Services (MBS) strives to provide high quality, effective, and efficient Information Technology (IT) services to those responsible for providing care to the Veterans at the point-of-care as well as throughout all the points of the Veterans’ health care in an effective, timely and compassionate manner. VA depends on Information Management/Information Technology (IM/IT) systems to meet mission goals.

National Cemetery Administration (NCA) is enhancing the interactive online memorialization solution designed to honor the service and sacrifice of our Nation’s Veterans. This digital memorial space, named the Veterans Legacy Memorial (VLM) powered by Keeper Software, allows visitors to honor, cherish, share, and pay their respects to Veterans interred and inurned at VA national cemeteries. The VLM platform aims to preserve the legacy of those Veterans by commemorating and sharing their stories.

VLM is a publicly available website that enables virtual memorialization of the millions interred and inurned at VA national cemeteries, serving as a mechanism to keep the memory of Veterans alive. This platform provides a new and unprecedented service to allow survivors and family members to grieve and memorialize their Veterans digitally. It also presents an academic opportunity as it should be designed to allow researchers, amateurs, students, and professionals to share historical and educational information about Veterans and the cemeteries themselves, some of which date back to the Civil War.

APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. OMB Guidance M-16-21: Federal Source Code Policy: Achieving Efficiency, Transparency, and Innovation through Reusable and Open Source Software

2. VA Memorandum “Ethical Principles for Access to and Use of Veteran Data (VIEWS 01256748)”, June 24, 2020

3. The Agile Manifesto http://agilemanifesto.org/

4. The U.S. Digital Services Playbook https://playbook.cio.gov/

5. The TechFAR Hub https://techfarhub.cio.gov/

6. VA UX Style Guide https://www.va.gov/web/standards/styles.cfm

7. VA Digital Services Handbook Research and Discovery Checklist https://department-of-veterans-affairs.github.io/va-digitial-service-handbook/delivery/research-and-discovery/checklist

8. The Digital Analytics Program https://digitial.gov/dap/

9. VA Design System https://design.va.gov/

10. United States Web Design System https://designsystem.digital.gov/

11. VA Developer Portal https://developer.va.gov/

12. SAFe® for Lean Enterprises 5.0: https://www.scaledagileframework.com/safe-for-lean-enterprises/

13. VA DEVSECOPS Tools DOTS Tools Information - Dept of Veterans Affairs-External - MAX Federal Community

14. MyVA Stye Guide for Websites VA Web Governance | Web Governance | Veterans Affairs

15. Attachment A – VA Product Line Accountability and Reporting System (PARS) User Guide

16. Attachment B – VA Product Line Management (PLM) Playbook V2.0, May 2021

17. Attachment C – Ethical Principles for Access to and Use of Veteran Data

18. “Federal Information Security Modernization Act of 2014”

19. Federal Information Processing Standards (FIPS) Publication 140-2, “Security Requirements for Cryptographic Modules”

20. FIPS Pub 199. “Standards for Security Categorization of Federal Information and Information Systems,” February 2004

21. FIPS Pub 200, “Minimum Security Requirements for Federal Information and Information Systems,” March 2006

22. FIPS Pub 201-2, “Personal Identity Verification of Federal Employees and Contractors,” August 2013

23. 10 U.S.C. § 2224, "Defense Information Assurance Program"

24. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

25. Public Law 109-461, Veterans Benefits, Health Care, and Information Technology Act of 2006, Title IX, Information Security Matters

26. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”

27. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, https://www.va.gov/vapubs/index.cfm

28. VA Handbook 0710, “Personnel Security and Suitability Program,” May 2, 2016, https://www.va.gov/vapubs/index.cfm

29. VA Directive and Handbook 6102, “Internet/Intranet Services,” August 5, 2019

30. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and Guidelines,” January 18, 2017

31. Office of Management and Budget (OMB) Circular A-130, “Managing Federal Information as a Strategic Resource,” July 28, 2016

32. NIST SP 800-66 Rev. 1, “An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule,” October 2008

33. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended, January 18, 2017

34. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

35. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021

36. VA Handbook 6500, “Risk Management Framework for VA Information Systems VA Information Security Program,” February 24, 2021

37. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI),” March 12, 2019

38. VA Handbook 6500.5, “Incorporating Security and Privacy into the System Development Lifecycle,” March 22, 2010

39. VA Handbook 6500.6, “Contract Security,” March 12, 2010

40. VA Handbook 6500.8, “Information System Contingency Planning,” April 6, 2011

41. VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018

42. VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017

43. OIT Process Asset Library (PAL), https://www.va.gov/process/ . Reference Process Maps at https://www.va.gov/process/maps.asp and Artifact templates at https://www.va.gov/process/artifacts.asp

44. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

45. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014

46. VA Handbook 6508.1, “Procedures for Privacy Threshold Analysis and Privacy Impact Assessment,” July 30, 2015

47. VA Handbook 6510, “VA Identity and Access Management,” January 15, 2016

48. VA Directive and Handbook 6513, “Secure External Connections,” October 12, 2017

49. VA Directive 6300, “Records and Information Management,” September 21, 2018

50. VA Handbook, 6300.1, “Records Management Procedures,“ March 24, 2010

51. NIST SP 800-37 Rev 2, “Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy,” December 2018

52. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020)

53. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015

54. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” March 24, 2014

55. OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005

56. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019

57. OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008

58. Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance, December 2, 2011, (NOTE: Part A of the FICAM Roadmap and Implementation Guidance, v2.0, was replaced in 2015 with an updated Architecture (https://arch.idmanagement.gov/#what-is-the-ficam-architecture)

59. NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access,“ June 2018

60. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, “Digital Identity Guidelines,” updated March 02, 2020

61. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014

62. NIST SP 800-164, “Guidelines on Hardware-Rooted Security in Mobile Devices (Draft),” October 2012

63. Draft National Institute of Standards and Technology Interagency Report (NISTIR) 7981, “Mobile, PIV, and Authentication,” March 2014

64. VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

65. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

66. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

67. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

68. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019

69. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008

70. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (Public Law 110–140), December 19, 2007

71. Section 104 of the Energy Policy Act of 2005, (Public Law 109–58), August 8, 2005

72. Executive Order 13834, “Efficient Federal Operations,” dated May 17, 2018

73. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 2, 2001

74. VA Directive 0058, “VA Green Purchasing Program,” July 19, 2013

75. VA Handbook 0058, “VA Green Purchasing Program,” July 19, 2013

76. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

77. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

78. “Veteran Focused Integration Process (VIP) Guide 4.0,” January 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

79. VA Memorandum “Proper Use of Email and Other Messaging Services,” January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

80. “DevSecOps Product Line Management Playbook” version 2.0, May 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

81. NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020

82. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol Version 6 (IPv6),” November 19, 2020

83. Social Security Number (SSN) Fraud Prevention Act of 2017

84. Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23, 2018

SCOPE OF WORK

The Contractor shall enhance and maintain the managed solution hosted at the VA Enterprise Cloud (VAEC) for VLM. The Contractor shall:

1. Develop, enhance, integrate, deploy, and maintain the VLM platform

2. Provide development, configuration, professional technical consulting services along with licensing and maintenance for the Keeper Commercial off-the-Shelf (COTS) solution and the VLM applications as required by the VA.

3. Ensure the VLM Platform is developed for compatibility with the latest versions of Google Chrome, Microsoft Edge, and Apple OS Safari. The Contractor shall ensure full testing of VLM functionality on mobile friendly displays ensuring full functionality on most current versions of Android and Apple iOS devices.

4. Provide Operations and Maintenance (O&M) support for VLM.

ORder type The effort shall be proposed on a hybrid Firm Fixed Price (FFP) and Time-and-Materials (T&M) basis.

PERFORMANCE DETAILS

PERFORMANCE PERIOD

The PoP shall be twelve (12) months from date of award, with two (2) 12-month option periods.

There are eleven (11) Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, four are set by date:

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

PLACE OF PERFORMANCE

Tasks under this PWS shall be performed at Contractor facilities. The Contractor shall identify the Contractor’s place of performance in their proposal submission.

TRAVEL

The Government anticipates travel to perform the tasks associated with the effort, as well as to attend program-related meetings or conferences throughout the PoP.

The total estimated number of trips in support of the program related meetings for this effort is six (6), estimated at five (5) days in duration.

Travel shall be in accordance with the Federal Travel Regulations (FTR) and requires advanced concurrence by the COR. Contractor travel within the local commuting area will not be reimbursed.

SPECIFIC TASKS AND DELIVERABLES

Application Performance monitoring and alerting As part of VLM Development and Operations, the Contractor shall utilize Application Performance Monitoring strategies for application health and performance and develop product performance metrics that will be monitored throughout the contract.

The Contractor shall provide an Application Monitoring Plan that defines how metrics will be monitored throughout the performance of the requirements, including the automated testing tools and automated Service Level Agreement (SLA) testing scripts that shall be used. The Contractor shall provide the Application Monitoring Plan to the VA PM/COR for review and approval. Upon approval, the Contractor shall implement application monitoring IAW the approved plan and establish an Application Dashboard that provides real time performance metrics to all program stakeholders.

The Contractor APM processes shall:

1. Ensure that custom software components can be instrumented to support a VA approved performance monitoring standard (e.g. OpenTracing).

2. Produce and maintain documentation describing data flow through the application, focusing on how and when the application passes/accepts data to/from other systems or end users.

3. Ensure that all workflows and actions identified during the HCD process are distinctly mapped/measured in the monitoring environment.

4. Monitor system, network, application, database logs, and performance metrics via VA approved VAEC/Cloud Service Provider (CSP) monitoring tools and ensure that code and logic changes are accurately reflected in the monitoring tools.

5. Work with VA to instrument all significant data paths; or instrument all significant data paths themselves using VA approved monitoring tools.

6. Utilize monitoring plugins and agents to monitor numerical metrics provided by external services, servers, or equipment to collect more in-depth metrics.

7. Work with VA to establish performance thresholds for the application; integrate those into the monitoring tools.

8. Establish robust and reliable alerting and escalation paths for performance violations (e.g. text, PagerDuty); parties directly responsible for the application as well as the VA should be made aware of performance issues immediately when detected.

9. Write and monitor synthetic monitoring scripts for VA infrastructure and applications.

10. Perform postmortems of any outages occurred, including root cause analysis and steps to prevent future outages and provide Postmortem Reports accordingly.

The Contractor shall document in the Monthly Status Report support performance metrics including but not limited to: number of issues reported, problem type identification, % resolved, time for resolution, priority, severity, etc. as agreed to with the VA PM/COR. The Contractor shall provide a VLM Response Time Monitoring Report, appended to the Monthly Status Report, that provides VLM response time frames at the 50th, 75th, 95th, and 99th percentiles.

Deliverable:

A. Application Monitoring Plan/Dashboard B. Postmortem Reports C. Product Response Report

Deliverable Metrics/SLA The Contractor shall ensure all VLM Service Level Agreements, as defined below, are met, and that VLM functions correctly.

Service Availability: All deployed services shall be available and functional to serve user requests at no less than 99.9% availability. Services that are faulted due to an external entity shall have trouble tickets logged with the responsible party, with all outage time attributable to this team until the ticket is logged with the responsible entity. An automated test, IAW the approved Application Monitoring Plan, with an execution frequency of no more than 300 seconds, and the logged reports of execution, including timing details, of that test shall be provided in the Metrics Report. Any faulted services attributed to an external entity shall include a record of the trouble ticket that was issued to the responsible party. This record shall include the time that it was filed, and if resolved, the time of resolution. Any maintenance window outages due to upstream or downstream maintenance shall include a record of the notification that was distributed to VA stakeholders, and the time which the record was distributed.

Service Reachability: Services on this platform shall be reachable by internal and external entities no less than 99.9% of the time. All required routing and proxying services are correctly functioning and forwarding traffic. Services that are faulted due to an external entity shall have trouble tickets logged with the responsible party, with all outage time attributable to this team until the ticket is logged with the responsible entity. Services that are unavailable due to upstream maintenance must have an outage notification to all VA stakeholders prior to the maintenance window for attribution to the upstream team. The Contractor shall have access to the Government’s published maintenance windows times and dates upon award. An automated test, IAW the approved Application Monitoring Plan, and the logged reports of execution, including timing details, of that test shall be provided in the Metrics Report.

Development Environment Availability: VLM shall be available in the staging environment during normal VA business hours (7am – 9pm EST). An external entity shall be able to log into the environment, execute build and deploy jobs in the development enclave, and observe the results of those jobs with no less than 99.0% availability. An automated test, IAW the approved Application Monitoring Plan, and the logged reports of execution, including timing details, of that test shall be provided in the Platform Metrics Report.

The Contractor shall provide a VLM Monthly Status Report which shall capture data as specified in the Deliverable Metrics/SLA.

Human centered design (HCD) The Contractor shall utilize Human Centered Design (HCD) principles as part of all product development and operations efforts. While engaging in the following HCD activities, the Contractor shall:

1. Follow the United States Digital Service value: “Design with users, not for them”;

2. Provide expert guidance on user experience (UX) design direction and strategy; and

3. Create and maintain documentation for all activities, recommendations, and decisions.

At the start of work on a new or existing VLM, conduct a product development kick-off meeting with government Product Owner and designated stakeholders to establish desired outcomes.

User Research As part of user research, the Contractor shall

A. Facilitate discovery activities, to include generative research with users and business stakeholders, an assessment of current related features, a content review, and information architecture review, an accessibility review, a business process review; and collection of any available data and analytics and provide in a User Research Checklist. The following Checklist provides additional details on these requirements: (https://department-of-veterans-affairs.github.io/va-digital-service-handbook/delivery/research-and-discovery/checklist).

B. Partner with other VA Product Teams to ensure that the new tool or service fits into the existing structure.

C. Conduct formative and contextual user research studies to understand users’ goals, needs, journeys, and pain points with respect to VLM. Apply insights from user research studies to define minimum viable product (MVP) functionality, including epics and user stories, as well as operational, business, functional, technical, data, and integration requirements.

D. As part of the overall product test strategy, conduct routine, iterative usability testing on VLM to continually improve the user experience and to inform content, information architecture, design, functionality, and accessibility. Iteratively apply insights gathered to inform design and development.

E. Before releasing to production, conduct user acceptance testing on new features, content of reviews of existing VLM content, Information Architecture (IA) reviews for global navigation and design reviews of existing patterns and User Interface (UI) elements to identify and make modifications to accommodate the new VLM, while maintaining a positive user experience.

F. The Contractor shall create a User Experience (UX) Research Plan and Summary for each user research study, which shall include a research write-up documenting research questions, hypotheses methodology, recruiting needs, synthesis, and next steps.

Content & Design A. Employ design process management by breaking designs into small, bite-sized implementations and collecting data from each deployment to inform priorities and decisions in the next iteration.

B. Write and edit plain language content for VLM Development Teams. See https://design.va.gov for the style guide.

C. Ensure consistency and continuity in VLM information architecture, including URL schema, page layout, menus and navigation, user flows, and search engine optimization. Work with all VA Product Teams to incorporate new VLM, both authenticated and unauthenticated content and tools, into the Information Architecture Document of VLM.

D. Craft, test, and deploy design deliverables, including wireframes, low- and high-fidelity prototypes, or interactive web forms to facilitate usability testing and agile development of VLM. As appropriate, create and update prototypes to conduct facilitated demos or usability testing to elicit feedback for improvements to the design.

E. Develop designs that adhere to VA’s application of the U.S. Web Design System, available on https://design.va.gov. If the Contractor determines a need for a new pattern, the Contractor shall collaborate with VLM PM/COR to design that pattern.

F. Support and comply with all UX guidelines and standards as defined by the VA, currently at https://department-of-veterans-affairs.github.io/va-digitial-service-handbook/.

Product Lifecycle Activities The Contractor shall support HCD activities for the VLM throughout its lifecycle by engaging in the following activities:

A. Conduct discovery activities on existing VLM as well as internal and external business process flows and functions. Work closely with VA customers to understand their needs and how those needs map to VA capabilities. Collect available data, user feedback, and VA stakeholder feedback and capture in a Discovery Report.

B. Maintaining a product roadmap that includes a comprehensive list of the VLM functionality that needs to be built or updated and prioritization of these based on Discovery that has happened, as well as product KPIs. These product’s Key Performance Indicators (KPIs) shall be established in concert with the VA Product Owner and key stakeholders, as well as evaluation KPI methodologies. All KPIs shall be designed to allow the team to effectively and objectively evaluate the product against user needs throughout the life of the product.

C. Participate in VA stakeholder meetings to plan building and integrating the services and change management activities including but not limited to managing agendas, minutes, action items, and collaboration tool management meetings.

D. Mock proposed VLM to receive feedback from potential consumers and iterate on designs quickly prior to beginning software development.

Deliverables:

A. User Research Checklist B. User Experience Research Plan and Studies C. User Test Documentation D. Information Architecture Document E. Discovery Report F. Product Plan/Roadmap and KPIs

PROJECT MANAGEMENT

CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, timeline, and tools to be used in execution of the contract. The CPMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks, and resource support. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPMP shall be concurred upon and updated in accordance with Section B of the contract. The Contractor shall update and maintain the VA PM approved CPMP throughout the PoP.

Deliverable:

A. Contractor Project Management Plan

REPORTING REQUIREMENTS

The Contractor shall provide the COR with a Monthly Progress Report in electronic form in Microsoft Word and Project formats. The report shall include detailed instructions/explanations for each required data element, to ensure that data is accurate and consistent. These reports shall reflect data as of the last day of the preceding Month.

The Monthly Progress Report shall cover all work completed during the reporting period and work planned for the subsequent reporting period. The report shall also identify any problems that arose and a description of how the problems were resolved. If problems have not been completely resolved, the Contractor shall provide an explanation including their plan and timeframe for resolving the issue. The report shall also include an itemized list of all Information and Communication Technology (ICT) deliverables and their current Section 508 conformance status. The Contractor shall monitor performance against the CPMP and report any deviations. It is expected that the Contractor will keep in communication with VA accordingly so that issues that arise are transparent to both parties to prevent escalation of outstanding issues.

Deliverable:

A. Monthly Progress Report

Technical Kickoff Meeting A technical kickoff meeting shall be held within 10 days after TO award. The Contractor shall coordinate the date, time, and location (can be virtual) with the Contracting Officer (CO), as the Post-Award Conference Chairperson, the VA PM, as the Co-Chairperson, the Contract Specialist (CS), and the COR(s). The Contractor shall provide a draft agenda to the CO and VA PM at least five (5) calendar days prior to the meeting. Upon Government approval of a final agenda, the Contractor shall distribute to all meeting attendees.

During the kickoff meeting, the Contractor shall present, for review and approval by the Government, the details of the intended approach, work plan, and project schedule via a Microsoft Office PowerPoint presentation. At the conclusion of the meeting, the Contractor shall update the presentation with a final slide entitled “Summary Report” which shall include notes on any major issues, agreements, or disagreements discussed during the kickoff meeting and the following statement: “As the Post-Award Conference Chairperson, I have reviewed the entirety of this presentation and assert that it is an accurate representation and summary of the discussions held during the Technical Kickoff Meeting for the Veterans Legacy Memorial Project.” The Contractor shall submit the final updated presentation to the CO and VA PM for review and signature within three calendar days after the meeting. The Contractor shall also work with the CS, the Government’s designated note taker, to prepare and distribute the meeting minutes of the kickoff meeting to the CO, COR(s), and all attendees within three calendar days after the meeting. The Contractor shall obtain concurrence from the CS on the content of the meeting minutes prior to distribution of the document.

VA Mandatory Training The Contractor and VA Project Manager (PM) shall determine which team members require access to the VA network and Jira/GitHub. All personnel that require access shall complete all the required VA Talent Management System (TMS) training courses prior to Kickoff meeting. The Contractor shall work with its respective point of contact, to obtain access to TMS to complete the mandatory training courses.

As an action under the Continuous Readiness and Information Security Program (CRISP) VA’s Assistant Secretary for Information and Technology issued a memorandum requiring all VA Government and contract staff to complete information security awareness and applicable role-based training. The Contractor shall submit Talent Management System (TMS) Training Certificates of completion for VA Privacy and Information Security Awareness (PISA), Rules of Behavior (ROB), Health Insurance Portability and Accountability (HIPAA), and Role-Based trainings. The Contractor shall provide signed copies of the Contractor Rules of Behavior in accordance with Section 9, Training, from Appendix C of the VA Handbook 6500.6, “Contract Security.”

Deliverables:

A. TMS Training Certificates for all Mandatory Training B. Signed Contractor Rules of Behavior

Onboarding The Contractor shall manage the onboarding of its staff. Onboarding shall include steps to obtain a VA network and email account, complete training, initiate background investigations, and gain physical and logical access, which may include elevated privileges to the necessary development and test environments for the various systems to be enhanced.

A single Contractor Onboarding Point of Contact (POC) shall be designated by the Contractor who tracks the onboarding status of all Contractor personnel. The Contractor Onboarding POC shall be responsible for accurate and timely submission of all required VA onboarding paperwork to the COR or his/her onboarding designee. The Contractor shall be responsible for tracking the status of all their staff’s onboarding activities and providing it in an Onboarding Status Report.

Deliverables:

A. Onboarding Status Report

Configuration Management The Contractor shall:

1. Identify the standard and unique aspects of configuration management to be performed and establish a Configuration Management (CM) Plan which meets VA OIT CM requirements. The Contractor shall account for CM activities and standards for each product. The initial baseline CM Plan shall be concurred upon and updated in accordance with Section B of the TO. The Contractor shall implement, update, and maintain the VA approved CM Plan throughout the PoP. As the Contractor updates the document, differences from the prior version shall be highlighted (i.e. “track changes”).

2. Provide any recommended configuration items that are not in the Configuration Management Plan to be added to the plan and to be placed under configuration and change control. The Contractor shall identify types of configuration items pertaining to each product to be placed under configuration management. Based on VA EPMO requirements, the CM Plan, and the unique needs or nature of each product or component, the Contractor shall determine the components within each product that must be under configuration control.

3. Coordinate with quality assurance, product development, testing, intake, schedule, risk and defect management, vendors, customers, and business stakeholder teams for configuration management.

4. Audit build packages and release candidates for compliance to configuration standards in compliance with VA configuration management for production releases.

5. Ensure software and/or software releases and patches are managed using continuous integration and industry DevOps tools (i.e. Jira, GitHub, Slack, etc.). Use of designated VA approved tools and repositories for all software source code and electronic artifact configuration and version management shall be required. The Contractor shall manage change, activity, issue, action, risk, and other product data as prescribed by VA standards and processes. If assigned a product using tools that are being deprecated, the Contractor shall assist the VA Tools Team in migrating products using Change and/or Configuration Management tools.

6. Ensure that all product software and non-software artifacts are versioned correctly according to VA standards and follow a build/release promotion versioning approach which identifies all major, minor, and update changes to the components.

7. Create Project and Product Artifacts baselined and versioned in the CM repository in order to allow the tool to show active and past histories of the check-ins and check-outs of all software components, data, and software product engineering documents. Maintain all baselines of software, software builds, and electronic artifacts in the repository, labeling updates and versions according to CM procedures.

8. Develop, verify, and submit with all project build deliverables, a Version Description Document that addresses the manifest of the contents of all software builds.

9. Establish and maintain status reporting on change and configuration management activity, and ensure records and artifacts are filed and updated daily.

Deliverables:

A. Configuration Management Plan B. Version Description Document

Architecture Support The Contractor shall update and maintain VLM Component Architecture Documentation to include a VLM Component Architecture Report. The Contractor shall review all applications and software for compliance to VA Enterprise Architecture. The Contractor shall report compliance issues between the implemented and/or to be implemented applications and software deliveries and the VA Enterprise Architecture in a VLM Architecture Compliance Report, which shall include technical approaches for the correction of any VA TRM non-compliance with the VLM and component Product architectures.

The Contractor shall participate in the Architecture Review Board (ARB) where design reviews are conducted, and architectural considerations are addressed as needed. The Contractor shall document system dependencies and provide changes to any existing VLM and component product architectures or create, or update, new or existing VLM component architecture. The Contractor shall work with VA enterprise architects and participate in architecture review sessions to maintain and improve architectural runway. The Contractor shall develop and deliver Logical Data Models and Business Process Models. In the Logical Data Models and Business Process Models, the Contractor shall define and communicate shared technical and architectural visions and ensure the systems are fit for their intended purpose. The Contractor shall participate in Architecture Synchronization to ensure consistency in how emerging designs and tradeoffs are managed across the Portfolio Solutions, allowing frequent opportunities to steer implementation approaches without becoming a source of delays.

As the Contractor updates the documents, differences from the prior version shall be highlighted (i.e. “track changes”).

Deliverables:

A. VLM Component Architecture Documentation B. Component Architecture Report C. Logical Data Models and Business Process Models

Risk Management The Contractor shall conduct Risk Management and document and track risks and issues utilizing Jira Software, or any future VA approved risk management tool. The Contractor shall submit new risks to the VA OIT PM within three days of risk discovery and update and maintain through the risk/issue lifecycle. The Contractor shall participate in weekly risk reviews and provide additional information regarding the risk/issue as requested.

Data Calls and Reporting Requests The Contractor shall:

1. Provide Data Call Reports in response to data calls from the COR for any system or process that is involved in the delivery of Contractor services within the given timeframe provided at receipt of the request. These requests may differ in form and substance to support Governmental Accountability Office audits, Office of Inspector General (OIG) audits, and Legislative and/or VA Executive Brief requests. The request for these data calls are solicited on an ad-hoc basis, which may surge to a maximum of three per week and which may overlap in occurrence. Historically, there have been 10 data calls per quarter. VA will provide any specified templates for these data calls/reports upon task order award.

2. Provide any requested customer-specific information that is integral to the delivery of services, including the configuration of Contractor core infrastructure and other Contractor managed resources. One example of responding to data calls and reporting requests is cooperation with the VA OIG in the areas of facilities access, audits, security incident notification, and hosting location. Specifically, for any required OIG cooperation, the Contractor (and any Subcontractors) shall:

a. Fully cooperate with all audits, inspections, investigations, or other reviews conducted by or on behalf of the CO or the agency OIG as described in paragraph 1. Full cooperation includes, but is not limited to, prompt disclosure (per agency policy) to authorized requests of data, information, and records requested in connection with any audit, inspection, investigation, or review, making employees of the Contractor available for interview by auditors, inspectors, and investigators upon request, and providing prompt access (per agency policy) to Contractor facilities, systems, data, and personnel to the extent the auditors, inspectors, and investigators reasonably believe necessary to complete the audit, inspection, investigation, or other review.

b. Preserve such data, records, logs, and other evidence which are reasonably necessary to conduct a thorough investigation of any computer security incident. A computer security incident (as defined by NIST SP 800-61, Computer Security Incident Handling Guide), includes but is not limited to those constituting an actual or potential threat or hazard to the integrity, availability, or confidentiality of agency information in the possession or under the control of the Contractor (or Subcontractor), or to the function of information systems operated by the Contractor (or Subcontractor) in the performance of this Order.

c. Promptly notify the designated agency representative in the event of any computer security incident as described in paragraph (c) above. This notification requirement is in addition to any other notification requirements which may be required by law or this Order. Established Federal agency timeframes for reporting security incidents to the United States Computer Emergency Readiness Team (US-CERT), although not exhaustive, serve as a useful guideline for determining whether reports under this paragraph are made promptly. (See NIST SP 800-61, Computer Security Incident Handling Guide, Appendix J).

d. Provide to the requestor (CO, a representative of the CO, or the agency OIG) Government data, information, or records under the control of or in the possession of the Contractor pursuant to this task order, which the Agency, including the OIG, may request in furtherance of other audits, inspections, investigations, reviews, or litigation in which the Agency or the OIG is involved. Requests for production under this paragraph shall specify a deadline not less than 10 days for compliance which will determine whether response to the request has been made in a timely manner.

e. Include the substance of this paragraph, including this paragraph (e) in any subcontract which would require or otherwise result in Subcontractor employees having access to agency information in the possession or under the control of the Contractor (or Subcontractor), or access to information systems operated by the Contractor (or Subcontractor) in the performance of this Order.

f. Ensure that all services pertaining to this Order are performed within the United States of America, including the storage of agency data, information, and records under the control of or in possession of the Contractor pursuant to this Order.

Deliverable:

1. Data Call Report

VLM Operational support The Contractor shall provide system solution support activities which are associated with the on-going support related to the performance of routine, preventive, predictive, scheduled, and unscheduled actions aimed at preventing system/production failure (i.e., break/fix) and correcting software defects with the goal of increasing efficiency and reliability on a continuous basis. This support shall be provided for the solution and all associated components.

In support of these activities, the Contractor shall configure, maintain, test, and deploy maintenance releases applying the same life cycle tasks, as applicable. The Contractor shall provide licensing and maintenance of the Keeper COTS software to support the VLM solution. The Contractor shall provide technical documentation as a release package to include Product Production Source Code, Product Operations and Maintenance Manual, SLA Performance Assessment Report, and Sprint Review Report, and shall execute these life cycle processes throughout the period of performance to support the delivery of functionality.

Releases may occur after hours and/or during the weekend. As such, all deployment release packages shall be completely developed by the Contractor Subject Matter Expert (SME) and advisory and troubleshooting support shall be provided. For releases, Contractor support staff shall be identified and available should a problem arise.

All deliverables and release packages shall be input into Jira/Github.

Operations and Infrastructure Services The Contractor shall comprehensively support the operations, sustainment, maintenance, security, accessibility, performance, core services, technical standards, architectural compliance, operational capability testing, audits and reviews, integration with external systems, triage and resolution support of issues, monitoring, contingency, capacity planning, and recovery for its assigned Product.

The Contractor shall work in concert with Product Teams to achieve holistic and seamless DevSecOps product support in alignment with the VA PLM Playbook. Key Performance Indicator baselines shall be established at the beginning of an increment, and incremental improvement towards DevSecOps maturity shall be agreed upon at the beginning of the increment and measured at the end of the increment. Prior to each sprint, the Contractor and VA shall agree upon, in writing, a sprint cadence and a Definition of Done for the upcoming sprint increment, including required deliverables.

The Contractor shall use the VA’s implementation of Jira and GitHub or other VA Approved Toolsets. The Jira and GiHub Project/Product Data and Artifact Repositories will be used to provide a single authoritative project and product data and artifact repository. All product data and artifacts shall be managed in this data and artifact repository daily. The following checked out artifacts shall be checked back in daily:

1. Scheduled product sprints and backlog

2. Product Agile requirements

3. Product risks and issues

4. Product configurations and changes

5. Product test plans and execution

6. Product planning and engineering documentation

7. Linkages to correlate requirements to change orders to configurable items to risks, impediments, and issues to test cases and test results to show full traceability

The Contractor shall show all Agile requirements, changes, tests performed, and test results in approved VA project management tools to show evidence of code coverage and test coverage of all the requirements specified. This is required for VA to have high confidence in a fully documented, as evidenced by data in the tools, requirements traceability matrix.

The Contractor shall:

1. Perform all operation services and activities including performance and dashboard monitoring, job scheduling and execution, and backup and restore.

2. Meet or exceed Service Level Agreement (SLA) targets outlined in Section 5.4.9 of this PWS.

3. Provide support to keep all environments in an operational state including application/system hardware 24 hours per day, seven days per week, 365 days per year (24x7x365).

4. Support the uptime of systems operations 24x7x365.

5. Support software releases during the day and potentially nighttime hours and monitoring/maintenance activities periodically during weeknights. VA estimates that regularly scheduled releases will occur twice a month.

6. Provide a single telephone number that is forwarded to “On Call” team leads.

7. Troubleshoot, respond, and resolve issues to complete tickets escalated by the Help Desk.

8. Troubleshoot, respond, and resolve issues and associated tickets generated by automated alerts.

9. Provide the first line of defense for failed pipelines (production and non-production).

10. Detect, diagnose, and resolve issues and operational incidents within the SLA time frames defined in Section 5.4.9 of this PWS.

11. Support VA event management processes for critical and high priority incidents (including participation in Swift Action and Triage (SWATs) and publication of After-Action Reports).

12. Maintain incident metrics and supplementary data to detect patterns and trends and facilitate rapid diagnosis of previously observed incidents.

13. Manage and track software licenses and maintenance agreements.

14. Deploy and maintain automation to detect and generate alerts for lapses in system availability and material deviations from baseline system performance.

15. Provide continuous improvement of monitoring and alerting to detect new failure points.

16. Manage system performance and capacity for all products and platform components:

a. Establish a baseline for system performance and resource utilization.

b. Establish reserve capacity targets to accommodate spikes in real-time demand and organic growth.

c. Work with the VA OIT PM to identify “key” business transactions for monitoring / optimization purposes.

d. Formulate and execute strategies to maintain desired reserve capacity.

e. Conduct periodic reviews of current and forecast system performance and resource utilization.

f. Define criteria for identifying and prioritizing candidates for performance optimization (such as frequency of use, long response times, and high-resource utilization).

17. Identify upgrades, preventative and perfective refactoring for components of the as-is architecture, and emerging technologies apropos to the building, testing, deployment, monitoring,…