DRAFT PWS for RFI Health Agile Developement Services_1 2.26.24.pdf

PERFORMANCE WORK STATEMENT

TRANSFORMATION TWENTY-ONE TOTAL TECHNOLOGY NEXT

GENERATION (T4NG)

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Office of Information & Technology

Software Product Management

Health Agile Development Services

VA-24-00023686

TO PWS Version Number: 1.0

February 13, 2024

Health Agile Development Services VA-24-00023686

Contents

1.0 ........................................................................................................................ BACKGROUND

2.0 APPLICABLE DOCUMENTS

3.0 SCOPE OF WORK

3.1 APPLICABILITY

3.2 ORDER TYPE

4.0 PERFORMANCE DETAILS

4.1 PERFORMANCE PERIOD

4.2 PLACE OF PERFORMANCE

4.3 TRAVEL OR SPECIAL REQUIREMENTS

4.4 CONTRACT MANAGEMENT

4.5 GOVERNMENT FURNISHED PROPERTY

4.6 SECURITY AND PRIVACY

4.6.1 POSITION/TASK RISK DESIGNATION LEVEL(S)

5.0 SPECIFIC TASKS AND DELIVERABLES

5.1 PROJECT MANAGEMENT

5.1.1 CONTRACTOR PROJECT MANAGEMENT PLAN

5.1.2 REPORTING REQUIREMENTS

5.1.3 TECHNICAL KICKOFF MEETING

5.1.4 MANEGEMENT AND TECHNICAL UNITS

5.1.5 VA MANDATORY TRAINING

5.1.6 ONBOARDING

5.2 INTAKE PROCESS

5.3 SOFTWARE DEVELOPMENT LIFECYCLE (SDLC)

5.3.1 AGILE REQUIREMENTS ELABORATION

5.3.2 CONFIGURATION MANAGEMENT

5.3.3 SCHEDULE MANAGEMENT

5.3.4 RISK MANAGEMENT

5.3.5 HUMAN CENTERED DESIGN

5.3.5.1 USER RESEARCH

5.3.5.2 CONTENT AND DESIGN

5.3.6 APPLICATION PERFORMANCE MONITORING (APM) AND ALERTING

5.3.7 BUILD AND DEVELOPMENT

5.3.7.1 SOLUTION ARCHITECTURE PLANNING AND EXECUTION

5.3.7.2 BUILD PLANNING

5.3.7.3 SPRINT PLANNING

5.3.7.4 SPRINT EXECUTION

5.3.8 TESTING

5.3.9 508 COMPLIANCE TESTING

5.3.10 RELEASE SUPPORT

5.3.10.1 PRE-RELEASE SUPPORT

5.3.10.2 INITIAL OPERATING CAPABILITY SUPPORT

5.3.10.3 ASSESSMENT AND AUTHORIZATION (A&A) SUPPORT

5.3.10.4 RELEASE AND DEPLOYMENT SUPPORT

5.3.10.5 POST DEPLOYMENT SUPPORT (WARRANTY)

5.3.11 MIGRATION TO CLOUD ENVIRONMENT

5.4 MANAGEMENT AND TECHNICAL UNITS (OPTIONAL TASK ONE)

5.4.1 MANAGEMENT UNITS

5.4.2 TECHNICAL UNITS

5.5 TRANSITION SUPPORT (OPTIONAL TASK TWO)

6.0 GENERAL REQUIREMENTS

6.1 PERFORMANCE METRICS

6.2 SECTION 508 – ELECTRONIC AND INFORMATION TECHNOLOGY (EIT)

STANDARDS

6.2.1 COMPATIBILITY WITH ASSISTIVE TECHNOLOGY

6.2.2 ACCEPTANCE AND ACCEPTANCE TESTING

6.3 SHIPMENT OF HARDWARE OR EQUIPMENT

6.4 ENTERPRISE AND IT FRAMEWORK

6.5 ORGANIZATIONAL CONFLICT OF INTEREST

ADDENDUM B- VA INFORMATION AND INFORMATION SYSTEM SECURITY / PRIVACY

LANGUAGE

B.1 GENERAL

B.2 ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS

B.3 VA INFORMATION CUSTODIAL LANGUAGE

B.4 INFORMATION SYSTEM DESIGN AND DEVELOPMENT

B.5 INFORMATION SYSTEM HOSTING, OPERATION, MAINTENANCE, OR USE

B.6 SECURITY INCIDENT INVESTIGATION

B.7 LIQUIDATED DAMAGES FOR DATA BREACH

B.8 SECURITY CONTROLS COMPLIANCE TESTING

B.9 TRAINING

1.0 BACKGROUND

The mission of the Department of Veterans Affairs (VA), Office of Information & Technology (OI&T), Developmental, Security, and Operations Office (DSO) is to provide benefits and services to Veterans of the United States. In meeting these goals, OI&T strives to provide high quality, effective, and efficient Information Technology (IT) services to those responsible for providing care to the Veterans at the point-of-care as well as throughout all the points of the Veterans’ health care in an effective, timely and compassionate manner. VA depends on Information Management/IT systems to meet mission goals.

VA OI&T DSO, SPM, Health Portfolio delivers world-class, Veteran-centric capabilities that provide secure, seamless delivery of services to Veterans and their families. The Health Portfolio consists of a variety of products, programs, and projects that deliver Veteran-centric technology solutions that are available, adaptable, secure, and cost-effective.

The Health Portfolios projects and products are essential to the success of modernizing and providing seamless care to Veterans. The continual modernization and integration of the Health Portfolio products is necessary to provide an improved and unified healthcare system for Veterans, without the complexities of developing and maintaining technical architecture. This Task Order (TO) will provide development support to all Health Portfolio Programs; including but not limited to, Clinical Ancillary Products, Patient Care Services, Veterans Health Administration Finance, Health Informatics, and VistA Office. The primary goal of the development done under this TO is to enhancement existing Health Portfolio products or create new or replacement products. In addition to this work, the ongoing transition to the Cerner Electronic Health Record (EHR) may present unique requirements with regard to interoperability.

2.0 APPLICABLE DOCUMENTS

The Contractor shall comply with the following documents, in addition to the documents in Paragraph 2.0 in the T4NG Basic Performance Work Statement (PWS), in the performance of this effort:

1. Federal Risk and Authorization Management Program (FedRAMP), “FedRAMP Standard Contractual Clauses”, June 2017 (www.fedramp.gov/documents)

2. National Institute of Standards and Technology (NIST) Special Publication 800-37, Revision 1 (www.nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800- 37r1.pdf)

3. VA Enterprise Cloud (VAEC) Technical Reference Guide, Version 1.1 October 2017.

4. VA Cloud-First Policy, January 16, 2018.

5. Use of Cloud-Based Native Technologies and Approaches, April 10, 2018.

6. Current Health Product Backlog (Attachment A)

7. Current EHRM Interfaces (Attachment B)

8. VASQIP Transmission Management – Developer Process Guide (Attachment C) http://www.fedramp.gov/documents

3.0 SCOPE OF WORK

The Contractor shall provide project management, product management, requirements analysis/refinement, architecture, design (human centered design as appropriate), development, testing, release, warranty, integration, and documentation support for projects/products within the Health Portfolio.

The Contractor shall comply with any applicable VA/Veterans Health Administration (VHA) or other Government mandates, as necessary. The Contractor shall follow the Lifecycle described in Section 5.3, including all subparagraphs, of this PWS. The development cycle will require teams of various sizes and resources to meet the business needs which are subject to continuous evolution. Each product or project to be completed by this TO will be subject to an intake and evaluation process prior to award to properly identify scope, associated tasks, deliverables, and applicable staff size. Approval to proceed with each individual product or project will be provided by the Product Managers, Contract Officer Representative or their designees.

3.1 APPLICABILITY

This TO PWS is within the scope of the T4NG Basic PWS, paragraph(s) 4.1.3 Requirements Development and Analysis Support, 4.1.8 IT Services Management Support, 4.2 Systems/Software Engineering, 4.3 Software Technology Demonstration and Transition, 4.4 Test & Evaluation, 4.8.2 Application Support, 4.8.4 Security Management, 4.10 Training.

3.2 ORDER TYPE

The effort shall be proposed on a Firm Fixed Price (FFP) basis with a Cost Reimbursement (CR) line item for travel.

4.0 PERFORMANCE DETAILS

4.1 PERFORMANCE PERIOD

The period of performance (PoP) shall be 12-months from date of award, with four 12-month option periods and three optional tasks, if exercised. The overall PoP shall not exceed 62 months.

4.2 PLACE OF PERFORMANCE

Efforts under this TO shall be performed at Contractor facilities. The Contractor shall identify the Contractor’s place of performance in their Task Execution Plan submission.

When travel is required, work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO) or the Contracting Officer’s Representative (COR).

4.3 TRAVEL OR SPECIAL REQUIREMENTS

The Government encourages the Contractor to maximize its use of teleconferencing and video conferencing for meetings.

The Government anticipates travel to perform the tasks associated with the effort, as well as to attend program-related meetings or conferences throughout the PoP.

Travel and per diem shall be in accordance with the Federal Travel Regulations (FTR) and requires advanced concurrence by the COR. The Contractor shall provide cost estimates with each travel request. Each Contractor invoice must include copies of all receipts that support the travel costs claimed in the invoice. Local travel within a 50-mile radius from the Contractor’s normal duty location is considered the cost of doing business and will not be reimbursed. This includes travel, subsistence, and associated labor charges for travel time. Travel performed for personal convenience and daily travel to and from work at the Contractor’s facility will not be reimbursed. Travel, subsistence, and associated labor charges for travel time for travel beyond a 50-mile radius of the Contractor’s facility are authorized on a case-by-case basis and must be pre-approved by the COR.

The total number of trips in support of this effort for the entire PoP is estimated to be 20 trips, with five people traveling for an average of four days per trip.

Anticipated travel locations include the following:

1. Washington, DC

2. Austin, TX

4.4 CONTRACT MANAGEMENT

All requirements of Sections 7.0 and 8.0 of the T4NG Basic PWS apply to this effort. This TO shall be addressed in the Contractor’s Progress, Status and Management Report as set forth in the T4NG Basic contract.

4.5 GOVERNMENT FURNISHED PROPERTY

The Government has multiple remote access solutions available to include Citrix Access Gateway (CAG) and RESCUE VPN.

The Government’s issuance of Government Furnished Equipment (GFE) is limited to Contractor personnel requiring direct access to the network to: development environments; install, configure and run Technical Reference Model (TRM) approved software and tools (e.g., Oracle, Fortify, Eclipse, SoapUI, WebLogic, LoadRunner); upload/download/ manipulate code, run scripts, and apply patches; configure and change system settings; check logs, troubleshoot/debug, and test/QA.

When necessary, the Government will furnish desktops or laptops, for use by the Contractor to access VA networks, systems, or applications to meet the requirements of this PWS. The overarching goal is to determine the most cost-effective approach to providing needed access to the VA environment coupled with the need to ensure proper Change Management principles are followed. Contractor personnel shall adhere to all VA system access requirements for on-site and remote users in accordance with VA standards, local security regulations, policies, and rules of behavior. GFE shall be approved by the COR and Program Manager on a case-by-case basis prior to issuance.

Based upon the Government assessment of remote access solutions and requirements of this TO, the Government estimates that the following GFE will be required by this TO:

1. 300 of standard laptops

2. 150 of developer grade laptops

3. 50 iPhones

The Government will not provide IT accessories including but not limited to Mobile Wi-Fi hotspots/wireless access points, additional or specialized keyboards or mice, laptop bags, extra charging cables, extra Personal Identity Verification card readers, peripheral devices, or additional Random Access Memory (RAM). The Contractor is responsible for providing these types of IT accessories in support of the TO as necessary and any VA installation required for these IT accessories shall be coordinated with the COR.

The Status of Government Furnished Equipment Report under the T4NG Basic Contract requirements is applicable to this TO and shall be delivered to the COR/VA PM as required.

The Contractor shall be provided access to Government Equipment such as servers, networks, and information, as required.

The Government will provide access to VA’s development tools and environments on a project-by-project basis to ensure products, artifacts and data created during execution of this TO remain in a centralized, Government managed location.

VA may provide VA-specific software as appropriate. The Contractor shall utilize VA provided accounts, document and requirements repositories and others as required for the configuration, storage, maintenance and delivery of products.

4.6 SECURITY AND PRIVACY

All requirements in Section 6.0 of the T4NG Basic PWS apply to this effort. Specific TO requirements relating to Addendum B, Section B4.0 paragraphs j and k supersede the corresponding T4NG Basic PWS paragraphs, and are as follows,

j. The vendor shall notify VA within 24 hours of the discovery or disclosure of successful exploits of the vulnerability which can compromise the security of the Systems (including the confidentiality or integrity of its data and operations, or the availability of the system). Such issues shall be remediated as quickly as is practical, but in no event longer than 2 days.

k. When the Security Fixes involve installing third party patches (such as Microsoft OS patches or Adobe Acrobat), the vendor will provide written notice to VA that the patch has been validated as not affecting the Systems within 10 working days. When the vendor is responsible for operations or maintenance of the Systems, they shall apply the Security Fixes within 2 days.

It has been determined that protected health information may be disclosed or accessed and a signed Business Associate Agreement (BAA) shall be required. The Contractor shall adhere to the requirements set forth within the BAA, referenced in the Request for Task Execution Plan (RTEP) and shall comply with VA Directive 6066.

4.6.1 POSITION/TASK RISK DESIGNATION LEVEL(S)

In accordance with VA Handbook 0710, Personnel Security and Suitability Program, the position sensitivity and the level of background investigation commensurate with the required level of access for the following tasks within the PWS are:

Position Sensitivity and Background Investigation Requirements by Task:

Task Number Tier1 / Low Risk Tier 2 / Moderate

Risk Tier 4 / High Risk

5.1 5.2 5.3 5.4 5.5 5.6

The Tasks identified above and the resulting Position Sensitivity and Background Investigation requirements identify, in effect, the Background Investigation requirements for Contractor individuals, based upon the tasks the particular Contractor individual will be working. The submitted Contractor Staff Roster must indicate the required Background Investigation Level for each Contractor individual based upon the tasks the Contractor individual will be working, in accordance with their submitted proposal.

5.0 SPECIFIC TASKS AND DELIVERABLES

The Contractor shall perform PWS Sections 5.1 and 5.2 and all subsections (except 5.1.3) in the Base Period and each Option Period if exercised. Resources for PWS Section 5.3 will be acquired via PWS Section 5.5, Optional Task One Management and Technical.

The Contractor shall perform the following tasks and provide the specific deliverables described below for each product/project initiated under this TO within the performance period stated in Section 4.1 of this PWS.

The Contractor shall utilize a Scaled Agile Framework (SAFe) for project management to deliver iteratively & incrementally which regularly produces high quality results in a cost effective, timely, and highly collaborative. Incremental deliveries of viable products shall occur no less than 90 days apart unless otherwise approve by the COR. Sprint duration will be identified during product/project intake and shall be no shorter than 2 weeks and no longer that 4 weeks unless approved by the COR and VA Product Manager.

The Contractor shall adhere to VA policies and procedures to include the Product Line Management Playbook, Process Asset Library, VA-approved Release Processes, or successor policies and adopt modern practices to continuously improve VA experiences through a combination of people, processes, and technology.

VA will follow an intake process (PWS 5.2) when new products/applications/systems are added to the TO. VA will utilize available application/system related data as part of the intake process to determine the services and level of effort (LOE) required. The LOE per project/product will be determine during intake and will consist of a mix of Management and Technical Units, further detailed in PWS 5.1.4 and 5.5. The specific tasks and deliverables required by each product/project and identified in PWS 5.3 will be determined during intake. Backlog Grooming and prioritization are continued throughout the product life cycle and as such requirements and tasks as subject to change over the course of an individual effort. The Contractor shall not exceed the planned and procured LOE of a project after intake but shall adjust planned resource types or adjust staffing to surge or slow down velocity to accommodate project needs at the VA PM or VA CORs direction. In the event project demands exceed LOE after award, the Government can procure additional Management or Technical Units or request the vendor to proceed at the velocity dictated by the previously agreed LOE.

5.1 PROJECT MANAGEMENT

5.1.1 CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, timeline and tools to be used in execution of this TO effort. The CPMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks and resource support. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPMP shall be concurred upon by the COR and updated in accordance with Section B of the TO. The Contractor shall update and maintain the COR approved CPMP throughout the PoP.

Deliverable:

A. Contractor Project Management Plan

5.1.2 REPORTING REQUIREMENTS

The Contractor shall use VA’s approved application development tools to track execution details. The VA approved tools will be used to provide a single authoritative project and product data and artifact repository. All OI&T project data and artifacts will be required to be managed in these data and artifact repositories daily. All checked out artifacts shall be checked back in daily, and any data updated daily to synchronize work and ensure version control.

The Contractor shall utilize the VA approved toolset to:

1. Input and manage scheduled project/product sprints and backlog

2. Input and manage project/product Agile requirements

3. Input and manage project/product risks and issues

4. Input and manage project/product configurations and changes

5. Input and manage project/product test plans and execution

6. Input and manage project/product planning and engineering documentation

7. Input and manage project/product user guides and training materials

8. Input and manage linkages to correlate requirements to change orders to configurable items to risks, impediments, and issues to test cases and test results to show full traceability.

The Contractor shall show all Agile requirements, changes, tests performed and test results in the VA approved toolset to show evidence of code coverage and test coverage of all the requirements specified. This expectation will allow VA to have high confidence in a fully documented, requirements traceability matrix, as evidenced by data in the tools.

The Contractor shall maintain a Weekly Unit Utilization report that provides details on the status of project resources. Resources shall be considered delivered to an effort once a complete onboarding package has been delivered to the COR or in the case of resources transferring from another contract, when an account modification is initiated via Help Desk Ticket, VA On/Off Boarding Service, or successor process. The Weekly Unit Utilization report shall provide:

1. Resource Name

2. Role description with technical specialization if applicable

3. Assigned Products/Projects

4. Time percentage dedicated to each effort during the period.

5. Date resource joined each effort.

6. Resources with planned leave exceeding five consecutive business days, with dates

7. Resources working on other contracts, with contract title and associated time commitment.

The Contractor shall provide deliverable management support. Due to the large quantity of deliverables that can be generated from multiple efforts utilizing this TO the Contractor shall support the VA COR in the creation and management of a SharePoint based deliverable library and associated approval workflow. Additionally, the Contractor shall produce a Weekly Deliverable Schedule which shall identify deliverables submitted over the past week and anticipated for the preceding week. The Weekly Deliverable Schedule shall identify the associated project, deliverable date, deliverable POC, as well as any deliverables which are past due with associated reasoning for COR consideration and approval or rejection.

Deliverables:

A. Weekly Unit Utilization Report B. Weekly Deliverable Schedule

5.1.3 TECHNICAL KICKOFF MEETING

A technical kickoff meeting shall be held within 10 days after TO award. The Contractor shall coordinate the date, time, and location (can be virtual) with the CO, as the Post-Award Conference Chairperson, the VA PM, as the Co-Chairperson, the Contract Specialist (CS), and the COR. The Contractor shall provide a draft agenda to the CO and VA PM at least five (5) calendar days prior to the meeting. Upon Government approval of a final agenda, the Contractor shall distribute to all meeting attendees. During the kickoff-meeting, the Contractor shall present, for review and approval by the Government, the details of the intended approach, work plan, and project schedule for each effort via a Microsoft Office PowerPoint presentation. At the conclusion of the meeting, the Contractor shall update the presentation with a final slide entitled “Summary Report” which shall include notes on any major issues, agreements, or disagreements discussed during the kickoff meeting and the following statement “As the Post-Award Conference Chairperson, I have reviewed the entirety of this presentation and assert that it is an accurate representation and summary of the discussions held during the Technical Kickoff Meeting for the Health Integration and Modernization effort.” The Contractor shall submit the final updated presentation to the CO for review and signature within three calendar days after the meeting. The Contractor shall also work with the CS, the Government’s designated note taker, to prepare and distribute the meeting minutes of the kickoff meeting to the CO, COR and all attendees within three calendar days after the meeting. The Contractor shall obtain concurrence from the CS on the content of the meeting minutes prior to distribution of the document.

5.1.4 MANEGEMENT AND TECHNICAL UNITS

Staffing increments used in this TO will be Management Units and Technical Units. A unit shall be defined as the equivalent of 1 Full Time Employee (FTE) but can be composed of multiple part time contractors contributing the time equivalent of an FTE. An FTE is expected to provide services for approximately 160 hours a month. Management Units shall consist of management and administrative positions to include but not limited to Project Managers, Business Analysts, and Technical Writers. Technical Units shall consist of technical positions to include but not be limited to Software Developers, Testers, and Software Architects. All resources shall be Senior and Expert level and are expected to have the knowledge and skills to work independently with minimal startup/transition time. Under no circumstances can the FTE commitment be reduced in exchange for a superior or more expensive resources. Supplemental Attachment, Sample Labor Mix Supplemental 5.1.4 Reference, provides staffing details of the existing TO from which this TO may be assuming services.

5.1.5 VA MANDATORY TRAINING

All resources are required to have access to the VA network and shall complete all the required VA Talent Management System (TMS) training courses within 14 days of submitting an onboarding package. The Contractor shall work with its respective onboarding point of contact and COR, to obtain access to TMS to complete the mandatory training courses.

As an action under the Continuous Readiness in Information Security Program, VA's Assistant Secretary for Information and Technology issued a memorandum requiring all VA government and contract staff to complete information security awareness and applicable role-based training.

The Contractor shall submit TMS Training Certificates of completion for VA Privacy and Information Security Awareness and Rules of Behavior, Health Insurance Portability and

Accountability Act (HIPAA). If elevated privileges are required Role-Based trainings will be identified for completion prior to gaining additional access.

Deliverable:

A. TMS Training Certificates

5.1.6 ONBOARDING

The Contractor shall manage the onboarding and offboarding of its staff. Onboarding includes steps to obtain a VA PIV card, network and email account, complete training, initiate background investigations, and obtain GFE. In addition, the Contractor shall identify individuals which may require elevated privileges to the necessary development and test environments for the various systems to be developed or enhanced.

A single Contractor Onboarding point of contact (POC) shall be designated by the Contractor that tracks the onboarding status of all Contractor personnel. The Contractor Onboarding POC shall be responsible for accurate and timely submission of all required VA onboarding paperwork to the VA COR or applicable systems used for onboarding. The Contractor shall be responsible for tracking the status of all its staff’s onboarding activities to include the names of all personnel engaged on the task, commercial email address, phone numbers, immediate contract supervisor, onboarding milestone dates, and their initial training date for VA Privacy and Information Security training. The Contractor shall provide an Onboarding Status Report weekly for review by the COR, VA PM or Government designee.

A. Weekly Onboarding Status Report

5.2 INTAKE PROCESS

The Contractor shall assist VA with employing and refining an intake process that enables the collection, evaluation, and disposition of product/projects seeking services from this TO. The Contractor shall support VA by tracking proposed changes to the process and current intake tool which is a custom ServiceNow module. The Contractor shall receive request, analyze level of effort, coordinate meetings with requestors to clarify requirements and produce a Requirements Solution Proposal. The Requirements Solution Proposal shall identify the scope of the effort, high level objectives and requirements, any applicable deadlines and required dates of delivery, significant risks and impediments, the amount of Management and Technical Units required expected to meet the request, the resource types expected to be utilized over the course of the effort, and the applicable deliverables that will be created during the execution of the effort.

Requestors will evaluate the recommendation to discuss changes, clarifications, or costs that may necessitate an amended Requirements Solution Proposal. Initially we anticipate 10 recommendations will be needed over the first 5 months to transition projects from an existing contract with an estimated 1-3 occurring monthly thereafter.

Management and Technical Units should be employed in an Agile fashion, to staff up or down as needed over the course of the effort. Monthly billing shall reflect unit consumption during that specific PoP and should match the Weekly Component Utilization Report. In the event of transitioning resources as well as unexpected losses, the Contractor can round up partial units from .5 to 1 on a per-product basis.

In the event of unutilized Units at the end of a PoP, VA may extend the PoP of the associated effort or cancel the remaining units.

A. Requirements Solution Proposal

5.3 SOFTWARE DEVELOPMENT LIFECYCLE (SDLC)

Agile project management is evolutionary (iterative & incremental) which regularly produces high quality results in a cost effective, timely, and highly collaborative manner. This requires open lines of communication among all participants contributing to a project/program/portfolio that include multiple consumers within the contracts and with other VA offices/activities. The Contractor shall continuously support the iterative build and development methodology described within Section 5.3 and all subparagraphs to complete all epics and user stories identified in the backlog.

The Contractor shall design, configure, develop, enhance, maintain, test, and deploy builds of each Health product on a continuous basis no shorter than two weeks but no longer than three months in duration throughout PoP. The Contractor shall provide deliverables/artifacts specified herein that meet documentation and code delivery requirements of activities specified in this PWS and are VA policy compliant. The Contractor shall leverage and reuse relevant content and pre-existing product documentation as appropriate to satisfying the content of package deliverables.

5.3.1 AGILE REQUIREMENTS ELABORATION

The Contractor shall complete an initial Backlog Grooming session with the VA team to properly understand and elaborate business Agile requirements. The outcome of this session shall be a review of, and agreement to, the initial user stories, including user stories added as a result of Backlog Grooming by decomposing Epics into stakeholder needs, business requirements, business rules, requirements visualizations and user story elaborations. The Contractor shall facilitate Product Increment Planning, both virtually and face-to- face, as the collaborative forum with business stakeholders to prioritize features for implementation and to kick off the Continuous Integration process. All requirements shall be entered and maintained in the VA identified repository.

The Contractor shall:

a. Ensure all Epics are included and executed as appropriate within the overall Agile Backlog Grooming effort.

b. Populate the backlog during an initial planning session identifying all features the team considers relevant to building the product. The backlog serves as the primary source for all program requirements and user stories, and the team shall prioritize the contents.

c. Establish initial Unit of measurement (e.g. Story Points) as the estimated relative complexity of user stories.

d. Facilitate any stakeholder briefings, meetings and/or elicitation sessions.

e. Execute requirements reviews with stakeholders and record results of reviews using the

VA Approved Tool, updating requirements data as a result of the reviews.

f. Identify the non-production environment access that is needed 30 days prior to configuration start.

g. All Epics, stakeholder needs, visualizations, stories, and other sources of requirements information for functional and non-functional requirements are input and maintained in VA Approved Tool and delivered in a Requirements Package. All requirements data is under change control and is fully linked to work items that show traceability to design changes, configurable items, test cases and test results.

5.3.2 CONFIGURATION MANAGEMENT

1. Identify the standard and unique aspects of configuration management to be performed for each project by establishing a Product Configuration Management Plan (CMP) which meets DevSecOps Website CM plan requirements. The Contractor shall reflect all CM required activities and standards in each project-level CM plan while determining the unique aspects of the project which require individualized procedures. This includes updating and executing the CMP provided by VA. The COR and VA PM will approve the CMP.

2. Deliver a Recommended List of Configuration Items as part of the Product Configuration Management Plan, to be placed under configuration and change control. The Contractor shall identify types of configuration items pertaining to each product to be placed under configuration management. Based on policy requirements, and the unique needs or nature of each project, the Contractor shall determine the components within each project that must be under configuration control.

3. Use a VA approved tool and repository for all software source code and electronic artifact configuration and version management. The Contractor shall use the VA approved tool to manage change, activity, issue, action, risk, and other project data as prescribed by VA standards and processes. If assigned a project using tools that are being deprecated, the Contractor shall assist the VA Tools Team in migrating projects using other Change and/or Configuration Management tools.

4. Ensure that all project software and non-software artifacts are versioned correctly according VA standards and follow a build/release promotion versioning approach which identifies all major, minor, and update changes to the components.

5. Create Project and Product Artifacts baselined and versioned in the Configuration Management (CM) repository to allow the tool to show active and past histories of the check-ins and check-outs of all software components, data, and software project engineering documents. Maintain all baselines of software, software builds, and electronic artifacts in the repository, labeling updates and versions according to CM procedures.

6. Develop, verify and submit with all project build deliveries, a Version Description Document (VDD) that addresses the manifest of the contents of all software builds created for project releases outside the development environment.

7. Establish and maintain status reporting on change and configuration management activity and ensure VA approved tools data records and artifacts are filed and updated daily.

8. Develop and manage a CM process that supports all necessary changes for the project including changes to Definition of Done, Acceptance Criteria and any other items deemed necessary.

Deliverables:

A. Product Configuration Management Plan

B. VDD

5.3.3 SCHEDULE MANAGEMENT

The Contractor shall create, maintain, analyze, and report integrated schedules. The schedule shall at a minimum cover the current project/products PoP and incorporate details for the current build and sprint. The Contractor shall provide schedule updates prior to commencing each sprint.

Deliverable:

A. Integrated Master Schedule

5.3.4 RISK MANAGEMENT

The Contractor shall conduct risk management of all work performed under this TO and provide input to the product Risk Management registry within the VA approved toolset maintained by

VA.

1. Comply with and/or create the Risk Management Plan where one is not already established by VA.

2. Use VA approved tools to create/update and actively manage a project risk register (also referred to as risk log) that identifies knowable circumstances that may have a negative impact on project success and describes the potential impacts and asserts measures to either reduce/eliminate their impact.

3. Use the VA approved tools to facilitate risk meetings and reviews.

4. Collaborate with project team to actively manage, size (level of effort), develop approved mitigations and plans of action and milestones (POAM) and assess/re-assess probability and severity of project risks and issues throughout the project lifecycle.

5. Assess the status of its risks on a weekly basis and provide them to VA for inclusion in the larger Risk Management Registry and delivered within the Weekly Risk Management Status Report by project team. When new risks occur which could impact development, testing and deployment schedule, the Contractor shall notify the COR and VA PM via email within 24 hours. Email subject line shall read “{Project Name} Risk Alert Notification.”

6. The Contractor shall summarize the status of the top three active risks and issues as determined by their risk score. The risk score is determined by multiplying probability by severity using a scale of one to five for each; one is not likely/low severity and five is very likely/high severity respectively. This shall be reported in the Contractor Management Plan and as needed for periodic reviews, project quad charts (monthly) and critical decision points.

A. Risk Management Plan B. Monthly Risk Management Status Report

5.3.5 HUMAN CENTERED DESIGN

The Contractor shall utilize Human Centered Design (HCD) principles as part of all product development and operations efforts. While engaging in the following HCD activities, the Contractor shall:

1. Follow the United States Digital Service value: “Design with users, not for them.”;

2. Provide expert guidance on user experience design direction and strategy; and

3. Create and maintain documentation for all activities, recommendations, and decisions.

At the start of work on each new build, conduct a product development kick-off meeting with the Government Product Owner and designated stakeholders to establish desired outcomes.

5.3.5.1 USER RESEARCH

As part of user research, the Contractor shall:

1. Facilitate discovery activities, to include generative research with users and business stakeholders, an assessment of current related features, a content review, an information architecture review, an accessibility review, a business process review; and collection of any available data and analytics and provide in a User Research Checklist. The following Checklist provides additional details on these requirements: (https://department-of-veterans-affairs.github.io/va-digital-service-handbook/delivery/research-and-discovery/checklist)

2. Partner with other VA Product Teams to ensure that the new tool or service fits into the existing structure.

3. Conduct formative and contextual user research studies to understand users’ goals, needs, journeys, and pain points with respect to Health product development. Apply insights from user research studies to define minimum viable product (MVP) functionality, including epics and user stories, as well as operational, business, functional, technical, data, and integration requirements.

4. As part of the overall product test strategy, conduct routine, iterative usability testing to continually improve the user experience and to inform content, information architecture, design, functionality, and accessibility. Iteratively apply insights gathered to inform design and development.

5. Before releasing to production, conduct user acceptance testing on new features, content reviews of existing content, Information Architecture (IA) reviews for global navigation and design reviews of existing patterns and User Interface (UI) elements to identify and make modifications while maintaining a positive user experience.

5.3.5.2 CONTENT AND DESIGN

As part of the content and design, the Contractor shall:

1. Employ design process management by breaking designs into small, bite-sized implementations and collecting data from each deployment to inform priorities and decisions in the next iteration.

2. Write and edit plain language content. See https://design.va.gov for the style guide.

3. Ensure consistency and continuity in Health product information architecture, including

URL schema, page layout, menus and navigation, user flows, and search engine optimization. Work with all VA Product Teams to incorporate new, both authenticated and unauthenticated content and tools, into the Information Architecture Document to be included in the Solution Architecture Package (PWS Section 5.3.2.1 Product-Level Architecture) of Health products.

4. Craft, test, and deploy design deliverables, including Wireframes, low- and high-fidelity prototypes, or interactive web forms to be included in the Solution Architecture Package (PWS Section 5.3.2.1 Product-Level Architecture) to facilitate usability testing and agile development of health products. As appropriate, create and update prototypes to conduct facilitated demos or usability testing to elicit feedback for improvements to the design.

5. Develop designs that adhere to VA’s application of the U.S. Web Design System, available on https://design.va.gov. If the Contractor determines a need for a new pattern, the Contractor shall collaborate with PM/COR to design that pattern.

https://department-of-veterans-affairs.github.io/va-digital-service-handbook/delivery/research-and-discovery/checklist https://department-of-veterans-affairs.github.io/va-digital-service-handbook/delivery/research-and-discovery/checklist https://department-of-veterans-affairs.github.io/va-digital-service-handbook/delivery/research-and-discovery/checklist

6. Support and comply with all user experience guidelines and standards as defined by VA, currently at https://department-of-veterans-affairs.github.io/va-digital-service-handbook/

A. User Experience Design

5.3.6 APPLICATION PERFORMANCE MONITORING (APM) AND ALERTING

As part of Health Enterprise Development and Operations, the Contractor shall utilize Application Performance Monitoring strategies for application health and performance and develop product performance metrics that that will be monitored throughout the contract.

The Contractor shall provide an Application Monitoring Plan that defines how metrics will be monitored throughout the performance of the requirements, including the automated testing tools and automated Service Level Agreement (SLA) testing scripts that shall be used. The Contractor shall provide the Application Monitoring Plan to the VA PM/COR for review and approval.

Upon approval, the Contractor shall implement application monitoring IAW the approved plan and establish an Application Dashboard that provides real time performance metrics to all program stakeholders.

The Contractor APM processes shall:

1. Ensure that custom software components can be instrumented to support a VA approved performance monitoring standard.

2. Produce and maintain documentation describing data flow through the application, focusing on how and when the application passes/accepts data to/from other systems or end users.

3. Monitor system, network, application, database logs, and performance metrics via VA approved VAEC/Cloud Service Provider (CSP) monitoring tools and ensure that code and logic changes are accurately reflected in the monitoring tools.

4. Work with the VA to instrument all significant data paths; or instrument all significant data paths themselves using VA approved monitoring tools.

5. Utilize monitoring plugins and agents to monitor numerical metrics provided by external services, servers, or equipment to collect more in-depth metrics.

6. Work with the VA to establish performance thresholds for the application; integrate those into the monitoring tools.

7. Establish robust and reliable alerting and escalation paths for performance violations (e.g.

text, PagerDuty); parties directly responsible for the application as well as the VA should be made aware of performance issues immediately when detected

8. Write and monitor synthetic monitoring scripts for VA infrastructure and applications.

9. Perform postmortems of any outages occurred, including root cause analysis and steps to prevent future outages and provide Postmortem Reports accordingly.

The Contractor shall document in the Monthly Status Report support performance metrics including but not limited to: number of issues reported, problem type identification, % resolved, time for resolution, priority, severity, etc. as agreed to with the PM/COR.

https://department-of-veterans-affairs.github.io/va-digital-service-handbook/

A. Application Monitoring Plan B. Postmortem Reports

5.3.7 BUILD AND DEVELOPMENT

The Contractor shall continuously support the iterative release and configuration methodology to complete all epics and user stories identified in the backlog.

5.3.7.1 SOLUTION ARCHITECTURE PLANNING AND EXECUTION

The Contractor shall create a Solution Architecture Package that includes the initial business, systems, application, and data architectures for the new features and capabilities using an architecture framework, approved by the PM/COR. These documents shall be updated utilizing VA approved templates and VA approved tool when appropriate and approved by the VA COR/VA PM in each subsequent Sprint. Each subsequent update shall include a Changes Page, which specifies the updates made to the document for review and approval by the VA COR/VA PM. The Contractor shall also outline any initial gaps, questions or challenges that may hinder progress in future Builds or Sprints.

The Contractor shall:

1. Support the setup of all needed development and test environments as required to complete required build development and testing. Coordinate with VA to ensure alignment with all development and test environments. The Contractor shall work with VA to ensure required specifications are provided no later than 30 days prior to environment need date.

2. Support the VA Authority to Operate (ATO) to obtain/maintain approval, as required.

Required ATOs must be obtained prior to build release and ATO approval timelines, including all necessary security scanning and remediations, must be considered in build planning activities.

3. Develop and deliver automated build and automated publishing capabilities to schedule jobs and support continuous integration for every sprint. Automated build tools shall be in compliance with the approved list from the One-VA TRM and code shall be demonstrable and stable enough to be promoted to another environment without issue by evidence of the status of tests and results in the VA approved tool.

A. Solution Architecture Package

5.3.7.2 BUILD PLANNING

Backlog grooming and prioritization are continued throughout the product life cycle and shall be managed throughout the PoP. Development builds shall be three months or less. The Contractor shall develop and deliver a Build Plan in collaboration with the project team prior to beginning the build. The Build Plan is the scope of work which will be completed in the agreed upon build timeframe. Each build must end with a production release. Each build shall be no longer than three months in duration and shall be made up of individual sprints. Each build will be fully tested by end users and will end in a release to production. The Build Plan must be completed prior to the start of the three month build timeframe. After the build plan is approved and the team is ready to start the build, the three month or less build cycle will start. Planning for future builds will occur during the execution of current builds.

The Contractor shall maintain the product backlog, continuously, for each build, in every release and throughout the life of the PoP within the VA approved tool. All activity scheduled in each build and backlogs will be captured and have status showing all work items, changes, impediments, and retrospectives. All data and artifacts in the VA approved tool shall be fully linked to requirements data and test data.

The Contractor shall:

1. Facilitate review, elaboration, and prioritization of the backlog. This backlog grooming will occur continuously throughout the build to ensure the highest product priorities are being met.

2. Facilitate selection of prioritized items from the product backlog to be included in the next build with approval of VA COR/PM and incorporate those items into a Build Plan for posting to VA approved tool.

3. Conduct an Initial Design Review with stakeholders to ensure the design is technically and fiscally able to be completed during the build.

4. Provide support for identification of field sites, test environments, acceptance criteria, and ATO requirements.

5. Coordinate and validate Interconnection Security Agreement/Memorandum of Understanding (ISA/MOU) and Service Level Agreements (SLA) for partner dependencies that specifically highlight the commitment of partners to associated release.

The ISA specifies the technical and security requirement of the interconnection and the MOU defines the responsibilities of the participating organizations.

The Contractor shall provide a Build Test Plan to COR/PM for approval prior to initiating any development activities. This plan shall include both Contractor and VA testing activities, dependencies, and descriptions of the interfaces and interactions between solution components that are needed to test and validate. The Build Test Plan shall specify the types and scope of testing to be conducted during each product build (e.g. unit, functional, accessibility, system, reliability, usability, interoperability, regression, security, performance). The Contractor shall include testing related to non-functional requirements, (e.g. load, performance, installation, back-out, and rollback) in the Build Test Plan.

A. Build Plan B. Build Test Plan

5.3.7.3 SPRINT PLANNING

Once build planning is completed and accepted, the Contractor shall initiate Sprint Planning for the first Sprint of the release. All activity scheduled in each sprint and backlog will be captured and have status showing all work items, changes, impediments, and retrospectives. All data and artifacts in VA Approved Tool shall be fully linked to requirements data and test data.

The Contractor shall:

1. Initiate and participate in a Sprint Planning Meeting, at the beginning of each sprint. The Contractor shall update the Sprint Plan in the VA Approved Tool after the Sprint Planning.

2. Support, coordinate and provide input for the Sprint Acceptance Criteria in VA Approved Tool. The Sprint Acceptance Criteria shall be coordinated and approved for every sprint.

This task shall result in an Approved Sprint Plan.

3. In collaboration with the Business/Product Owner, take the approved prioritized, items identified from build planning and create and prioritize the sprint backlog.

4. Identify user stories and tasks to be completed within the sprint, the agreement of acceptance criteria for the sprint, and readiness to begin sprint.

5. Conduct a sprint design to understand what problem needs to be solved for each user story, understand critical business functions, test initial concepts, and look for objective feedback.