DRAFT PWS - CMD Support.docx

TRANSFORMATION TWENTY-ONE TOTAL TECHNOLOGY NEXT GENERATION (T4NG)DRAFT

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Office of Information & Technology Product Delivery Service

Configuration Management Department Support Date: July 7, 2025

VA-26-00001389

PWS Version Number: 1.6

Disclaimer: The TAC accepts no liability for the completeness or correctness concerning the Information Technology content of this template. This template is a means to simply assist the requiring activity in developing their requirements. It is the Requiring Activity’s responsibility to ensure the correctness of all requirements within their final Performance Work Statement.

Contents

BACKGROUND

The Department of Veterans Affairs (VA), Office of Information & Technology (OIT), Configuration Management Department (CMD) supports the systems and product development work efforts that strive to provide high quality, effective, and efficient Information Technology (IT) services responsible for providing care to the Veterans at the point-of-care as well as throughout all the points of the Veterans’ health care in an effective, timely and compassionate manner. VA depends on Information Management/Information Technology (IM/IT) systems to meet mission goals. Tasks and deliverables under this effort are required to address issues related to the implementation of systems and product Configuration Management (CM) standards, guidance, frameworks, and automation utilities. This will include change management policies, baseline configurations, system and component inventories, and monitoring for changes to system settings and software within VA. The CMD work effort seeks to modernize targeted activities to develop secure CM automation utilities and frameworks leveraging processes, tools, and standards. These will be used to automate National Institute of Standards and Technology (NIST) CM and System Acquisition (SA) security control audits by the CMD and system and product development teams within the VA Software Factory Model for Continuous Integration/Continuous Delivery (CI/CD) pipelines. CMD seeks to standardize and provide guidance to leverage CM and testing automation to evolve capabilities that ensure system and product compliance with applicable Federal Information Security Management Act (FISMA) National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53 security controls and implementing NIST SP 800-128 requirements. In addition, CMD aims to ensure consistency throughout the system development lifecycle following and integrating CM holistically by collaborating across the entire CM stakeholder community within VA OIT.

APPLICABLE DOCUMENTS

In the performance of this effort, the Contractor shall comply with the following documents, in addition to the documents in Paragraph 2.0 in the T4NG Basic Performance Work Statement (PWS):

NIST SP 800-128, “Guide for Security-Focused Configuration Management of Information Systems” Product VA (https://product.va.gov/) CODE VA (https://code.va.gov/?limit=20) The Contractor shall also comply with CMD standards, process, and procedures documents as required for work completion. Documents will be made available as required.

Note: Hyperlinks contained within this document are provided for convenience only. Due to the dynamic nature of hyperlinks and the information accessed through or imbedded in them, it is incumbent upon the Contractor to ensure that all information required to successfully complete the requirements established herein is independently located, verified for accuracy and confirmed to be the most up-to-date version available prior to use.

SCOPE OF WORK

The Contractor shall provide CM support, including program and project management support, risk/issue management, system and product and program CM activities.

APPLICABILITY

This Task Order (TO) effort PWS is within the scope of paragraphs the following paragraphs of the T4NG Basic PWS:

4.1 Program Management, Strategy, Enterprise Architecture and Planning Support

4.1.3 Requirements Development and Analysis Support

4.2 Systems/Software Engineering

4.2.2 Architecture Development

4.2.9 System/Software Integration

4.2.12 Engineering and Technical Documentation

4.3 Software Technology Demonstration and Transition

4.4 Test and Evaluation

4.9.1 Information Assurance

4.9.2 Logical Security

ORDER TYPE

The effort shall be proposed on a Firm Fixed Price (FFP) basis.

PERFORMANCE DETAILS

PERFORMANCE PERIOD

The base period of performance (PoP) shall be 12 months from date of award, with three 12-month option periods, and one Optional Task. The overall PoP shall not exceed 48 months.

PLACE OF PERFORMANCE

Efforts under this TO shall be performed at Contractor facilities. The Contractor shall identify the Contractor’s place of performance in their Task Execution Plan submission.

TRAVEL OR SPECIAL REQUIREMENTS

The Government does not anticipate any travel needed to perform the tasks associated with the effort or to attend program-related meetings or conferences throughout the PoP.

CONTRACT MANAGEMENT

All requirements of Sections 7.0 and 8.0 of the T4NG Basic PWS apply to this effort. This TO shall be addressed in the Contractor’s Progress, Status and Management Report as set forth in the T4NG Basic contract.

GOVERNMENT FURNISHED PROPERTY

The Government has multiple remote access solutions available to include Citrix Access Gateway (CAG), Site-to-Site Virtual Private Network (VPN), and RESCUE VPN.

The Government’s issuance of Government Furnished Equipment (GFE) is limited to Contractor personnel requiring direct access to the network to: development environments; install, configure and run Technical Reference Model (TRM) approved software and tools (e.g., Oracle, Fortify, Eclipse, SoapUI, WebLogic, LoadRunner); upload/download/ manipulate code, run scripts, and apply patches; configure and change system settings; check logs, troubleshoot/debug, and test/QA.

When necessary, the Government will furnish desktops or laptops, for use by the Contractor to access VA networks, systems, or applications to meet the requirements of this PWS. The overarching goal is to determine the most cost-effective approach to providing needed access to the VA environment coupled with the need to ensure proper Change Management principles are followed. Contractor personnel shall adhere to all VA system access requirements for on-site and remote users in accordance with VA standards, local security regulations, policies and rules of behavior. GFE shall be approved by the COR and Program Manager on a case-by-case basis prior to issuance.

Based upon the Government assessment of remote access solutions and requirements of this TO, the Government estimates that the following GFE will be required by this TO:

Up to six developer-grade laptops The Government will not provide IT accessories including but not limited to Mobile Wi-Fi hotspots/wireless access points, additional or specialized keyboards or mice, laptop bags, extra charging cables, extra Personal Identity Verification card readers, peripheral devices, or additional Random Access Memory (RAM). The Contractor is responsible for providing these types of IT accessories in support of the TO as necessary and any VA installation required for these IT accessories shall be coordinated with the COR.

The Status of Government Furnished Equipment Report under the T4NG Basic Contract requirements is applicable to this TO and shall be delivered to the COR/VA PM as required.

SECURITY AND PRIVACY

All requirements in Section 6.0 of the T4NG Basic PWS apply. Addendum B requirements have been tailored to reflect the security and privacy requirements of this specific TO.

It has been determined that protected health information may be disclosed or accessed and a signed Business Associate Agreement (BAA) shall be required. The Contractor shall adhere to the requirements set forth within the BAA, referenced in Section D of the Request for Task Execution Plan (RTEP) and shall comply with VA Directive 6066.

POSITION/TASK RISK DESIGNATION LEVEL(S)

In accordance with VA Handbook 0710, Personnel Security and Suitability Program, the position sensitivity and the level of background investigation commensurate with the required level of access for the following tasks within the PWS are:

Table 1: Position Sensitivity and Background Investigation Requirements by Task

The Tasks identified above and the resulting Position Sensitivity and Background Investigation requirements identify, in effect, the Background Investigation requirements for Contractor individuals, based upon the tasks the particular Contractor individual will be working. The submitted Contractor Staff Roster must indicate the required Background Investigation Level for each Contractor individual based upon the tasks the Contractor individual will be working, in accordance with their submitted proposal.

SPECIFIC TASKS AND DELIVERABLES

The Contractor shall adopt a holistic approach (one that considers the big picture of CM at VA and understand how all the different elements, activities, and stakeholders are interconnected) in their support so that CMD can best establish CM standards, governance, guidance, and automation utilities. Additionally, the Contractor shall augment expertise of VA staff in developing guidance across the system development lifecycle to implement formal Configuration Management Plans (CMPs), processes, and procedures, encompassing Configuration Management, Change and Release Management with focus on access control, source code and baseline management, management of development/test environments, and ensuring system and product compliance with FISMA NIST SP 800-53. The Contractor shall also implement NIST SP 800-53 rev 5, particularly those related to CM and SA security controls, and apply automation techniques when appropriate and assigned by VA.

The Contractor shall perform the following.

PROJECT MANAGEMENT

CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, timeline and VA tools to be used in execution of this TO effort. The CPMP shall be in narrative-text form augmented by graphics and diagrams that convey schedule, milestones, and resource support. The CPMP shall include a Risk Management Plan that discusses how risks will be recorded, mitigated, and if needed escalated to issues for the VA PM and COR. The CPMP shall include how the Contractor will coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The CPMP shall include the following sections (detailed further in 5.2.1 through 5.2.4).

System and Product CM Training Plan CMD Communications Plan CMD CM-Automation Strategy CMD Environments Management Design and Plan The initial baseline CPMP shall be concurred upon and updated in accordance with Section B of the TO. The Contractor shall update and maintain the VA Program Manager (PM) approved CPMP throughout the PoP.

The Contractor Project Manager shall manage Contractor projects, ensuring work completion as agreed upon by and with input from the VA PM and COR. The Contractor shall notify the VA PM within one business day, by both email and telephone, when a critical path slip is anticipated or has occurred.

Deliverable:

A. Contractor Project Management Plan

ONBOARDING SUPPORT

The Contractor shall onboard the contract team within 30 business days of TO award and manage the onboarding process for VA access and for individual system/environment access for all Contractors.

REPORTING REQUIREMENTS

The Contractor shall provide the COR with Weekly Task Activities Reports in electronic form in Microsoft Word and Project formats. The reports shall include detailed instructions/explanations for each required data element, to ensure that data is accurate and consistent. These reports shall reflect data as of the last day of the preceding week.

Weekly Task Activities Reports shall:

Summarize work completed during the reporting period and work planned for the subsequent reporting period.

If a problem arises and the VA PM and the Contractor identify it as a risk, the Contractor shall open a Risk record in the Risk Register and provide an explanation of the problem, including their mitigation plan and timeframe for resolution.

Include an overview of performance against the CPMP and report deviations.

The Contractor shall report on a weekly basis in the CMD CMS toolset status to-date on assignments, levels of effort, resource hours, and dates. Currently, CM tracking, work completion, monitoring, and reporting are performed in the CMD Azure DevOps CMS instance. The Contractor shall track project information using this repository, unless otherwise determined by the VA PM.

The Contractor shall receive orientation and instructions on using CMD-mandated tools and repositories. The Contractor shall collect and report status data, assignment progress details, problem reporting, incident reporting, issue tracking, change tracking, requirements tracking, risk reporting, security and accreditation compliance, configuration management, and automation activities. The Contractor shall use VA tools and repositories effectively to optimize data generated in the tool for pre-programmed reports and online views instead of creating external documentation and deliverables independently of approved tools.

Communication is expected within one business day between the Contractor, the VA PM, and the COR for advising on performance/schedule issues and developing strategies to address them. The Contractor shall monitor work performance continuously and report issues and deviations from the CPMP to the COR and VA PM as needed or during regular communications.

Each quarter after CMD quarterly baseline activities are complete, the Contractor shall participate in quarterly program retrospectives to discuss approach for projects and address incoming requests for support. Retrospectives shall evaluate evolving directions, new and on-going risks (in a Quarterly Risk and Issue Report section), compare CPMP, departmental program requirements and support requests, and expected performance, then agree upon risk escalation process, targets for completion and quality. The Contractor shall be assigned action items resulting from retrospectives and unresolved issues and manage them to resolution. After each quarterly retrospective, the Contractor shall conduct reviews of project assignments and report their findings in a Quarterly Project Retrospective Report (QPRR) within the base and each option period. The QPRR shall include the following sections (detailed further in 5.2.1 through 5.2.4).

1. Quarterly baseline highlights and statistics (new assignments, active assignments, closed assignments; functional areas of assignments, organizational areas of assignments, and so on) CMS Audits and CM Assessments Overview CMD Governance and Guidance Overview CMD CMS Audits and CM Assessments Overview CMD CM Program Strategy and Governance Overview CMD Communications Overview CMD Emergency CM Analysis Findings Overview CMD CM Standards Findings Report Overview of CMD Assignment Activities CMD Support Completed Deliverables Report CMD Resource Requests Overview CMD CM-Automation Progress Report CMD Environments Management Report Deliverables:

A. Weekly Task Activities Report B. Quarterly Project Retrospective Report

PRIVACY TRAINING

The Contractor shall assure training completions and Talent Management System completion certificates for required security and privacy training. The Contractor shall ensure VA Privacy and Information Security Awareness and Rules of Behavior, leading to Health Insurance Portability and Accountability Act (HIPAA) completions and provide signed copies of the Contractor Rules of Behavior in accordance with Section 9, Training, from Appendix C of the VA Handbook 6500.6, “Contract Security.”

The Contractor shall also assure access to VA information is on a need-to-know basis and information is not disclosed outside of VA.

Deliverables:

A. VA Privacy and Information Security Awareness and Rules of Behavior Training Certificate B. VA HIPAA Certificates of Completion C. Signed Contractor Rules of Behavior

TECHNICAL KICKOFF MEETING

A Technical Kickoff (TKO) Meeting shall be held within 10 days after TO award. The Contractor shall coordinate the date, time, and location (can be virtual) with the Contracting Officer (CO), COR as the Post-Award Conference Chairperson, the VA PM as the Co-Chairperson, the Contract Specialist (CS), and the COR. The Contractor shall solicit VA PM and COR input then provide a draft agenda to the COR and VA PM for approval at least five calendar days prior to the meeting. Upon Government approval of a final agenda, the Contractor shall distribute to all meeting attendees. During the T TKO Meeting, the Contractor shall present, for review and approval by the Government, the details of the intended approach, work plan, and project schedule for each effort via a Microsoft Office PowerPoint presentation. At the conclusion of the meeting, the Contractor shall update the presentation with a final slide entitled “Summary Report” which shall include notes on any major issues, agreements, or disagreements discussed during the TKO Meeting and the following statement “As the Post-Award Conference Chairperson, I have reviewed the entirety of this presentation and assert that it is an accurate representation and summary of the discussions held during the TKO Meeting for the Configuration Management Support. The Contractor shall submit the final updated presentation to the COR for review and signature within three calendar days after the meeting. The Contractor shall also work with the Government’s representative to prepare and distribute the meeting minutes of the kickoff meeting to the CO, COR and all attendees within three calendar days after the meeting. The Contractor shall obtain concurrence from the COR on the content of the meeting minutes prior to distribution of the document.

RISK/ISSUE MANAGEMENT

The Contractor shall provide risk management support to identify, assess, and prioritize risks regarding work in progress. The Contractor shall:

1. Develop and maintain a Risk Management Plan for VA PM and COR approval. The Risk Management Plan shall be maintained within the Contractor Project Management Plan in accordance with PWS 5.1.1 and shall include Contractor’s approach to risk management, use of VA tool to capture risks and issues, risk management workflow, risk and issues records workflows, and details of a process that escalates known risks into issues and communicates such escalations to VA PM and COR within one business day.

Develop and maintain a Risk Register within VA’s tool to include:

1) Two record types: Risks and Issues

2) Risk or Issue Name

3) Probability of impact on TO schedule, cost, or performance goals

4) Impact on TO

5) Severity (Low, Medium, High)

6) Probability (Low, Medium, High)

7) Constraints (Low, Medium, High)

8) Response (Accept, Avoid, Mitigate, Transfer, Escalate)

9) Status (description of obstacles, impediments, actions underway to mitigate, and current state of risk including progress made in resolving them and explanations of unresolved risks including possible solutions and actions required of the Government and/or Contractor to resolve or mitigate, including a plan and timeframe for resolutions)

Develop and maintain a Risks and Issues Dashboard based on tool Risks and Issues data within VA’s tool As part of the QPRR, the Contractor shall develop and deliver a high-level overview Quarterly Risk and Issue Report for VA PM and COR approval in writing and to include mitigation strategies.

Collaborate with the VA PM, COR, and project stakeholders to prioritize, scope, and assess impacts and courses of action related to risks and issues. The Contractor shall inform the VA PM and applicable stakeholders of relevant risk management discussions, Contractor’s recommendations (to include mitigation and escalation recommendations), Contractor’s work to mitigate/resolve project risk and issues as they are identified. The Contractor shall summarize the status of significant risks and issues and their disposition as required in the CPMP.

KEY PERSONNEL

The Contractor shall provide resources that possess the skills, educational background, and work experiences (see PWS Labor Categories and Descriptions Table below) required to perform the tasks within the PWS. The Contractor agrees that the personnel identified below are key to supporting this effort. Personnel shall not be removed from the TO without written notification to and acknowledgement from the VA PM and Contracting Officer. Contractor resources shall be identified and begin the onboarding process on day one of the TO, to include submission of all required security and PIV documentation in order to have access to the VA network.

If any change to the Key Personnel assigned to the labor categories identified below becomes necessary (initial staffing, substitutions or additions), the Contractor shall immediately notify the CO/COR/PM in writing, accompanied by the resume, if applicable, of the proposed replacement personnel who shall be of at least substantially equal ability and qualifications as the individual(s) currently performing in that category and that the proposed replacement meets or exceeds the qualifications designated for that Key Personnel position. It is expected that substitution or replacement of the personnel will not occur within the first six (6) months after date of TO award.

Individuals hired to the contract are expected to have the required skills and hands-on experience detailed in the PWS Labor Categories and Descriptions Table below. Individual skills are also expected to be current and continuously evolving to meet VA needs as required. Team members shall possess expertise in implementing industry specialized and standard practices for system and product configuration management, solution architectures, software engineering, automation, and CI/CD to continuously evolve program, services, and support.

The labor categories below are identified for Key Personnel. Key Personnel must meet the requirements identified in the Labor Description column below:

Configuration Management Department Support VA-26-00001389

Table 2: PWS Labor Categories and Descriptions

Expertise with system development concepts—including system and product CM—and its various technologies, projects, and resources.

Expertise conducting business and technical analysis, including formal documentation and diagramming of processes.

Expertise in use of VA tools for strategic information planning, business process reengineering, and contracting-based program management practices such as General Services Administration (GSA)).

Expertise in analyze, scope, manage projects using full system development lifecycles (SDLCs) for automation, pipelines, testing, system and product CM, systems, and tools.

Expertise in develop organizational and technical projects for advancing major systems development efforts and IT initiatives. Implement changes that require transitioning from a current to a future state—and document, communicate, and define processes for this evolution.

Manage IT products/projects, including multiple complex, technical projects with integrated systems and processes.

Understand concepts of strategic information planning, business process reengineering, and GSA-based program management practices.

Support establishment, maintenance of Configuration Management System (CMS) toolsets to track configuration items (CIs), changes, and dependencies based upon CM policies, plans, and processes that align with stakeholder requirements, Scaled Agile Framework (SAFe), Institute of Electrical and Electronics Engineers (IEEE) 828, Information Technology Infrastructure Library (ITIL), NIST SP 800-53, and NIST SP 800-128 standards. Implement best CM practices within constraints of organizational directives, policies, and lifecycles, while minimizing overhead.

Identify, mitigate risks to the program early and manage within authorized cost, schedule, and performance constraints.

Certify as Project Management Professional (PMP) with Project Management Institute (or equivalent) Hands-on, direct experience managing system and development projects that include secure CM Minimum experience managing VA OIT contracts in which CM is utilized: 5 years

To successfully execute against and deliver for this TO, the Senior Software/Systems Architect Contractor must not only know how NIST SP 800-128 requirements and NIST SP 800-53 security controls inform system and product CM governance (an understanding of how the security controls constrain and protect federal OIT agencies are applied), but they must also have deep knowledge of and possess years of experience within the VA OIT workspace. In addition, experience with the following is highly desirable.

Support establishment, maintenance of CMS toolsets to track CIs, changes, and dependencies. Develop, implement, and maintain CM policies, plans, and processes that align with stakeholder requirements, SAFe, IEEE 828, ITIL, NIST SP 800-53, and NIST SP 800-128 standards. Possess a deep understanding of implementing best secure CM practices within constraints of organizational directives, policies, and lifecycles—while minimizing overhead.

Hands-on, expert-level performance in CM for large, complex systems and products, including multiple concurrent and parallel development efforts. Expertise includes working with source code and documents, branching/merging strategies, versioning, builds, authoritative source identification, baselines, traceability, repository management, and validation/verification/audits. Additionally, skilled in developing materials to assist others in performing technical work.

Support full system lifecycles, including inception and/or requirements/stories, traceability methods, and functional and physical auditing. Develop and document change management and other processes to create learning resources.

Expertise in the complete lifecycle of system and product CM, from CI inception through end of life. Skilled in integrating CM within the SDLC, development, and automation processes. Implement configuration and automation management tools, processes, and CI/CD methods, as well as expertise with CI/CD frameworks, automation testing, and Agile/Scrum methodologies.

Perform systems analysis including analyzing, documenting, diagramming, and presenting detailed technical and business information. Create materials for analyses, training, documentation, presentations, and reports. Document success in developing CM processes, architecture diagramming, solutions delivery, repository management, and implementing testing automation and CI/CD workflow processes.

Support organizational program definition, document/train for programs. Deliver support to technical and business customers, provide ad-hoc CM assistance. Coach/mentor product lines, project teams, and experienced project CMs.

Use, implement product management and configuration/lifecycle tools such as Jira, Azure DevOps, Git/GitHub, Jenkins, Selenium, ServiceNow, and a variety of open-source CI/CD and repository tools.

Socialize frameworks and practices using the CMD CMS toolset to develop and manage dashboards and reporting. Know CI/CD, automation, and cloud concepts, as well as tools and cloud services to provide support of them. Be proficient in aggregating data, implementing dashboards, and using communication applications.

Create big picture as well as detailed analysis for organizational programs.

Estimate and/or participate in estimating.

Strategize implementation alternatives for large systems programs and operations.

Minimum experience on VA OIT contracts in which CM is utilized: 7 years

To successfully execute against and deliver for this TO, the Senior Systems Engineer Contractor must not only know how NIST SP 800-128 requirements and NIST SP 800-53 security controls inform system and product CM governance (an understanding of how the security controls constrain and protect federal OIT agencies are applied), but they must also have deep knowledge of and possess years of experience within the VA OIT workspace.

In addition, experience with the following is highly desirable.

Knowledge of CI/CD automation within system and product development processes, including CM and testing.

Evaluate, design, develop, implement, maintain, and test systems and products.

Support CM, system and product development, and testing processes.

Expertise in framework design, systems and product development, pipeline structure/options, and automating processes, analyze systems and products to identify automation opportunities (including test execution). Document formal analyses as deliverables to be used by product development teams and management.

Expertise in system and product development and automation (with strong experience in systems engineering, integration, architecture, and Cloud services) to troubleshoot and spot technical and integration issues.

Implementing, use, and maintain repositories and databases such as Structured Query Language (SQL), Microsoft (MS) SQL, Oracle, Azure DevOps, and CMDB repositories.

Expertise in development/testing/automation tools and their implementation.

Expertise with scripting languages such as JavaScript, YAML, Perl, Ruby, Python, PHP, Groovy, Bash.

Expertise with IT industry CI/CD and open-source tools such as Jira, Azure DevOps, Selenium, Xray, Git, GitHub, Bash, Jenkins, OpenShift/Kubernetes, ServiceNow, Rancher, Docker, SonarQube, Terraform, Vagrant, JavaScript Object Notation (JSON), Maven, Gradle, and Another Neat Tool (ANT).

Expertise with open-source technologies and cloud services such as Amazon Web Services (AWS) and Microsoft Azure.

Analyze, document, diagram, present detailed technical and business information for further analyses, training, documentation, presentations, and reports. Expertise in CM functional, technical, and operational analysis and management. Develop processes, architecture diagrams, solutions delivery, and systems/operations management for implementations.

Support establishment and maintenance of CMS toolsets to track CIs, changes, and dependencies based on CM policies, plans, and processes that align with stakeholder requirements, SAFe, IEEE 828, ITIL, NIST SP 800-53, and NIST SP 800-128 standards. Understand how to implement best CM practices within constraints of organizational directives, policies, and lifecycles, while minimizing overhead.

Create big picture and details for organizational program analysis.

Estimate and/or participate in estimating and strategize implementation alternatives for large systems programs and operations.

Translate and/or document/diagram recommendations and deliverables for CM automation for incorporation into CI/CD pipelines.

Identify priorities, work independently and within teams, use team collaboration to devise complete solutions.

Demonstrate strong communications skills and experience to translate technical needs in plain language for greater understanding both in discussion and documentation.

Demonstrate proficiency in using desktop tools, such as MS Word, Excel, PowerPoint, and diagramming applications.

Minimum experience on IT contracts in which CM is utilized: 5 years

In addition, experience with the following is highly desirable.

Knowledge of CI/CD automation within system and product development processes, including CM and testing.

Understanding of how NIST SP 800-53 security controls and NIST SP 128 impact system and product development and sustainment activities.

Develop, implement, maintain, and test systems and products.

Support CM, system and product development, and testing processes.

Experience in system and product development and automation to troubleshoot and spot technical and integration issues.

Use and help maintain repositories and databases such as Structured Query Language (SQL), Microsoft (MS) SQL, Oracle, Azure DevOps, and CMDB repositories.

Expertise in development/testing/automation tools and their implementation.

Expertise with scripting languages such as JavaScript, YAML, Perl, Ruby, Python, PHP, Groovy, Bash.

Expertise with IT industry CI/CD and open-source tools such as Jira, Azure DevOps, Selenium, Xray, Git, GitHub, Bash, Jenkins, OpenShift/Kubernetes, ServiceNow, Rancher, Docker, SonarQube, Terraform, Vagrant, JavaScript Object Notation (JSON), Maven, Gradle, and Another Neat Tool (ANT).

Expertise with open-source technologies and cloud services such as Amazon Web Services (AWS) and Microsoft Azure.

Expert-level Power BI skillset that can be applied directly to automate CM activities.

Identify priorities, work independently and within teams, use team collaboration to devise complete solutions.

Demonstrate strong communications skills and experience to translate technical needs in plain language for greater understanding both in discussion and documentation.

Demonstrate proficiency in using desktop tools, such as MS Word, Excel, PowerPoint, and diagramming applications.

Minimum experience on VA OIT contracts in which CM is utilized: 5 years

In addition, experience with the following is highly desirable.

Familiarity with CI/CD automation within system and product development processes, including CM and testing.

Understanding of how NIST SP 800-53 security controls and NIST SP 128 impact system and product development and sustainment activities.

Develop, implement, maintain, and test systems and products.

Support CM, system and product development, and testing processes.

Experience in system and product development and automation to troubleshoot and spot technical and integration issues.

Use and help maintain repositories and databases such as Structured Query Language (SQL), Microsoft (MS) SQL, Oracle, Azure DevOps, and CMDB repositories.

Have experience in development/testing/automation tools and their implementation.

Expertise with scripting languages such as JavaScript, YAML, Perl, Ruby, Python, PHP, Groovy, Bash.

Expertise with IT industry CI/CD and open-source tools such as Jira, Azure DevOps, Selenium, Xray, Git, GitHub, Bash, Jenkins, OpenShift/Kubernetes, ServiceNow, Rancher, Docker, SonarQube, Terraform, Vagrant, JavaScript Object Notation (JSON), Maven, Gradle, and Another Neat Tool (ANT).

Expertise with open-source technologies and cloud services such as Amazon Web Services (AWS) and Microsoft Azure.

Expert-level Power BI skillset that can be applied directly to automate CM activities.

Identify priorities, work independently and within teams, use team collaboration to devise complete solutions.

Demonstrate strong communications skills and experience to translate technical needs in plain language for greater understanding both in discussion and documentation.

Demonstrate proficiency in using desktop tools, such as MS Word, Excel, PowerPoint, and diagramming applications.

Minimum experience on IT contracts in which CM is utilized: 3 years

In addition, experience with the following is highly desirable.

Experience implementing applicable NIST SP 800-53 security controls into system and product CM solutions.

Familiarity with supporting CI/CD automation within system and product development processes, including CM and testing.

Support CM, system and product development, and testing processes.

Possess Power BI skillset that can be applied directly to automate CM activities.

Apply experience in system and product development and automation to troubleshoot and spot technical and integration issues.

Minimum experience on IT contracts as a Configuration Manager Lead: 10 years Minimum experience on VA OIT contracts as CM Lead: 3 years

In addition, experience with the following is highly desirable.

An understanding of how NIST SP 800-53 security controls and NIST SP 128 impact system and product CM solutions.

Possess Power BI skillset that can be applied directly to automate CM activities.

Minimum experience on VA OIT contracts as a Configuration Manager: 5 years

All information reflects agreed upon qualifications, standards, accuracy, and completeness Information shall be accurately updated and maintained in designated VA systems. All individuals on the contract shall meet experience requirements for each labor category description.

CONFIGURATION MANAGEMENT DEPARTMENT OVERVIEW

The CMD supports systems and products in implementing CM standards, guidance, frameworks, and automation tools. CMD focuses on aligning CM responsibilities within system and product development to address Office of the Inspector General (OIG) Notice of Findings and Recommendations (NFRs) identified over the past decade. Based upon system- and product-CM expertise and experience implementing Configuration Management Systems within the constraints of the VA workspace, CMD delivers enterprise-wide guidance on system Configuration Management (CM) frameworks, tools, and automation that empowers portfolio, product line and development teams with IT modernization capabilities as part of their CM product assurance solutions--reducing time to delivery without compromising quality, reliability, or cybersecurity.

VA seeks to standardize and provide centralized governance that ensures system and product compliance with FISMA NIST SP 800-53 (specifically those having to do with CM and SA security controls) and implement NIST SP 800-128. Under the direction of the VA PM, the Contractor shall modernize targeted activities to develop CM policies, plans, processes, and monitoring methods/measures that align with VA standards and requirements and apply SAFe, IEEE 828, and ITIL concepts. The Contractor shall develop secure CM automation utilities and frameworks to automate NIST CM and SA security control audits for use by the CMD and system and product development teams within the VA Software Factory Model for CI/CD pipelines. The Contractor shall perform all CMD work in support of this TO from within, leveraging, or augmenting VA-provided tools. All artifacts produced and outcomes achieved shall be accurate, viable, actionable, and compatible with VA processes.

The Contractor shall capture assignment allocations, activities, deliverables, progress, successes and failures in CMD’s CMS records for reporting within the Contractors’ Assignments Status Dashboard and keep assignment records updated on a weekly basis. The Contractor shall assist the VA PM in identifying, recording, and prioritizing CM assignments including immediate, short-term, and long-term assignments.

ENTERPRISE SYSTEM AND PRODUCT CM POLICY SUPPORT

On-going CMD efforts aim to audit NIST SP 800-53 CM and SA security controls for use by CMD and system and product development teams, automate CM auditing, and make automated CM audit utilities available for enterprise-wide consumption from within the VA Software Factory Model for CI/CD pipelines. All enterprise program-level CM work performed in fulfillment of this TO take place within, leverage, or augment VA-provided tools. Automation of the CM audit for unauthorized changes will enable teams to perform the audit before deployment of product development code changes into production environments, empowering VA to close the gap on OIG Recommendation 23a/NFR 6.02 Detection of Unauthorized Changes. In addition, CMD aims to become involved in system, product, project intake to provide critical guidance that will enable teams to structure their CMS solutions completely and compliantly up-front, empowering VA OIT to close the gap on OIG Recommendation 17/NFR 6.01 Change Control Policy, Process, Implementation, training, Oversight The Contractor shall provide Enterprise-wide Program-Level Configuration Management support (in the form of CM governance expertise, CMD CM standards and guidance support, system and product CM support expertise, CM training, and communications support) to CMD, ensuring compliance with NIST SP 800-53 security controls and NIST SP 800-128 requirements.

The Contractor shall:

1. Engage in assigned committees, change boards, and work groups and contribute secure-CM expert knowledge to align and increase awareness of CMD and CM standards, governance, guidance, and automation tools. Enhance existing software CM, program policies, processes, and procedures to meet evolving needs to include systems and product CM. Collaborate with Integrated Project Teams (IPTs), individuals and teams within VA OIT to fulfill assignments.

Assist the VA in establishing a method for auditing CMSs and assessing effectiveness of CM procedure implementations and improve procedures based on audit results. Develop, document, and maintain a CMS Audit and CM Assessment Procedure and audit templates for tool-based data. Within the CMD CMS, create and track the schedule of CMS-Audits-and-CM-Assessment assignments. Maintain audit templates, audit activity decisions, tool-based data, and audit results. Generate and maintain on a weekly basis a CMS Audit and CM Assessment Dashboard within the CMD CMS toolset for VA PM review and approval. Summarize progress in a section of the QPRR called: CMS Audits and CM Assessments Overview.

Based on VA standards, policies, and governance, the Contractor shall evaluate system and product CM initiatives and objectives to improve CMD guidance, processes, automation tools, frameworks, templates, and artifacts--with a focus toward modernizing, streamlining/simplifying, and realigning.

i. With the goal of closing OIG “Recommendation 17/NFR 6.01 Change Control Policy, Process, Implementation, Training, Oversight” gaps, the Contractor shall conduct process implementation assessments against CMP templates, standards, governance, organizational policies, and guidance so that they can be improved continuously.

ii. The Contractor shall recommend maintenance for and improvements to CM products, requirements, standards, artifacts, templates, and workflows to implement a comprehensive CM discipline at predefined intervals (defined within the VA PAL CFG processes) throughout the SLDC.

iii. The Contractor shall update CM process supplementary/complementary artifacts and training materials as needed. Summarize progress in a section of the QPRR called: CMD Governance and Guidance Overview.

Conduct systems CM analyses. For each assignment, document in a System CM Analysis Report with diagrams and detailed technical and business information as they pertain to the VA workspace and its constraints.

iv. For functional, technical, tool, and operational analyses, the Contractor shall provide System CM Analysis Reports using architectural diagrams and high-level descriptions. The report shall include workflow engineering details and diagrams that document end-to-end details of CMS tool structures, diagrams of lower environments with details of promotional workflow, assessment of supporting CM processes, and additional relevant information. System CM Analysis Reports shall be comprehensive yet concise and clearly presented, maintained in agreed-upon VA delivery formats and source-controlled in CMD's CMS repositories.

Develop, maintain, and publish CM policies, processes, methods, supplements (e.g., handbooks, playbooks, training materials, templates, documents, scripts), and SDLC CM frameworks and supporting processes to update or complement existing policies and automation directions. Publish to various VA OIT enterprise points of consumption (CODE VA, VA OIT PAL, CM Framework, CMD SharePoint, CMD Wikis, and others) as applicable.

Using the CMS Audit and CM Assessment template(s), conduct CMS audits and CM process implementation assessments of systems, products, and projects to rank CM maturity and compliance, focusing on supporting system/product and artifact development and protecting the integrity of VA's OIT assets. Audit the following to verify compliance with CM frameworks: CMPs, repositories, procedures, secure system baselines, and Version Description Documents (VDDs). Document audit results in a CMS Audit and CM Assessment Action Plan--the result of which may reveal the need for teams to update or create a CMP. Results may also reveal the need for the Contractor to update the existing CMD CMP template or create and maintain new ones. CMS Audit and CM Assessment Action Plans should be comprehensive yet concise and clearly presented, maintained in agreed-upon VA delivery formats, and source-controlled in CMD's CMS repositories. Summarize progress in a section of the Quarterly Project Retrospective Report called: CMD CMS Audits and CM Assessments Overview.

l Develop, document and deliver training on system and product CM topics. Create needed System and Product CM Training Materials (how-to PDFs, PowerPoint presentations, videos, diagrams, and so on) and conduct instructional sessions in various formats including ad-hoc, one-on-one, group, Community of Practice (CoP) sessions, video micro-learning sessions, and presentations to be used as training courses. Create and maintain a System and Product CM Training Plan section within the CPMP. VA PM shall identify and scope COPs and training assignments as needed.

Coordinate and publish system and…