DRAFT PWS ICAMP DTS.docx

ICAMP Technical Development & Support

VA-25-00048422

PERFORMANCE WORK STATEMENT (PWS)DRAFT

DEPARTMENT OF VETERANS AFFAIRS

Office of Information & Technology Performance Reporting iCAMP Technical Development & Support

Date: February 20, 2025

VA-25-00048422

PWS Version Number: 1.0

Contents

BACKGROUND

The Department of Veterans Affairs (VA), Office of Information Technology (OIT), strives to provide high quality, effective, and efficient Information Technology (IT) services to those responsible for providing care to the Veterans at the point-of-care as well as throughout all the points of the Veterans’ health care in an effective, timely and compassionate manner. VA depends on Information Management/Information Technology (IM/IT) systems to meet mission goals.

The Performance Reporting team provides development, operations, and maintenance support for the custom in-house developed Information Central Analytics and Metrics Platform (ICAMP) information system.

ICAMP is an authoritative data warehouse, consolidating multiple trusted sources of record to deliver secure data reporting solutions, enhancing agency-wide initiatives.

In addition, ICAMP is used to track and record project related data in the form of various reporting products which are used by VA executives, Portfolio Directors, and staff to assist in the governance process of VA’s IT investments to achieve their intended outcomes on-time and within budget, while also meeting Veterans’ needs.

This Task Order (TO) provides for a combination of services that will include software development, operations, and maintenance, testing software solutions, technical writing, product support, and information security for ICAMP. It also provides activities to sustain development, pre-production/User Acceptance Testing (UAT), and production systems of ICAMP and its databases and their scheduled upgrades and sustainment. Backlog refinement and prioritization are continued throughout the TO and shall be managed throughout the period of performance (PoP).

APPLICABLE DOCUMENTS

In the performance of the tasks associated with this PWS, the Contractor shall comply with the following:

1. 44 U.S.C. § 3541-3549, “Federal Information Security Management Act (FISMA) of 2002”

2. “Federal Information Security Modernization Act of 2014”

3. Federal Information Processing Standards (FIPS) Publication 140-2, “Security Requirements for Cryptographic Modules”

4. FIPS Pub 199. “Standards for Security Categorization of Federal Information and Information Systems,” February 2004

5. FIPS Pub 200, “Minimum Security Requirements for Federal Information and Information Systems,” March 2006

6. FIPS Pub 201-2, “Personal Identity Verification of Federal Employees and Contractors,” August 2013

7. 10 U.S.C. § 2224, "Defense Information Assurance Program"

8. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

9. Public Law 109-461, Veterans Benefits, Health Care, and Information Technology Act of 2006, Title IX, Information Security Matters

10. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”

11. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, https://www.va.gov/vapubs/index.cfm

12. VA Handbook 0710, “Personnel Security and Suitability Program,” May 2, 2016, https://www.va.gov/vapubs/index.cfm

13. VA Directive and Handbook 6102, “Internet/Intranet Services,” August 5, 2019

14. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and Guidelines,” January 18, 2017

15. Office of Management and Budget (OMB) Circular A-130, “Managing Federal Information as a Strategic Resource,” July 28, 2016

16. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed Services (CHAMPUS)”

17. NIST SP 800-66 Rev. 1, “An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule,” October 2008

18. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended, January 18, 2017

19. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

20. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021

21. VA Handbook 6500, “Risk Management Framework for VA Information Systems VA Information Security Program,” February 24, 2021

22. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI),” March 12, 2019

23. VA Handbook 6500.5, “Incorporating Security and Privacy into the System Development Lifecycle,” March 22, 2010

24. VA Handbook 6500.6, “Contract Security,” March 12, 2010

25. VA Handbook 6500.8, “Information System Contingency Planning,” April 6, 2011

26. VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018

27. VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017

28. OIT Process Asset Library (PAL), https://www.va.gov/process/ . Reference Process Maps at https://www.va.gov/process/maps.asp and Artifact templates at https://www.va.gov/process/artifacts.asp

29. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

30. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014

31. VA Handbook 6508.1, “Procedures for Privacy Threshold Analysis and Privacy Impact Assessment,” July 30, 2015

32. VA Handbook 6510, “VA Identity and Access Management,” January 15, 2016

33. VA Directive and Handbook 6513, “Secure External Connections,” October 12, 2017

34. VA Directive 6300, “Records and Information Management,” September 21, 2018

35. VA Handbook, 6300.1, “Records Management Procedures, “ March 24, 2010

36. NIST SP 800-37 Rev 2, “Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy,” December 2018

37. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020)

38. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015

39. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” March 24, 2014

40. OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005

41. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019

42. OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008

43. Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance, December 2, 2011, (NOTE: Part A of the FICAM Roadmap and Implementation Guidance, v2.0, was replaced in 2015 with an updated Architecture (https://arch.idmanagement.gov/#what-is-the-ficam-architecture)

44. NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access, “ June 2018

45. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, “Digital Identity Guidelines,” updated March 02, 2020

46. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014

47. NIST SP 800-164, “Guidelines on Hardware-Rooted Security in Mobile Devices (Draft),” October 2012

48. Draft National Institute of Standards and Technology Interagency Report (NISTIR) 7981, “Mobile, PIV, and Authentication,” March 2014

49. VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

50. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

51. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

52. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

53. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019

54. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008

55. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

56. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

57. “Veteran Focused Integration Process (VIP) Guide 4.0,” January 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

58. VA Memorandum “Proper Use of Email and Other Messaging Services,” January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

59. “DevSecOps Product Line Management Playbook” version 2.0, May 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

60. NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020

61. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol Version 6 (IPv6),” November 19, 2020

62. Social Security Number (SSN) Fraud Prevention Act of 2017 Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23, 2018

63. Attachment 008 - VA Enterprise Cloud Technical Reference Guide, Version 2022 v2.0_Redacted

64. Attachment 009 - Process Asset Library (PAL) System Configuration Management Plan Template

65. Exhibit 300 Guidance: https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense.com%2Fv3%2F__https%3A%2Fwww.itdashboard.gov%2FSubmission_Overview.pdf__%3B!!May37g!L-5V2HFkmnBNQfox6R6qSHoTnOz2DNNnjpxECUQUbZspmYQZoKBIq83FaA4yOHoONz_SifDAmgfUm5pSV0MVB56PkVicFZw%24&data=05%7C02%7C%7C450615002df74a611ea308dc121a7272%7Ce95f1b23abaf45ee821db7ab251ab3bf%7C0%7C0%7C638405152110604781%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=zx8l9F6R%2BGvsulZdwOvCdLKIYlVPJRkixpePVKQa2js%3D&reserved=0

66. IT Collect API Documentation (gsa.github.io)

67. VA Directive 6004, Configuration, Change and Release Management Programs (https://www.va.gov/vapubs/search_action.cfm?dType=1) Authorization Requirements for eMASS SOP (https://www.va.gov/vapubs/search_action.cfm?dtype=1)

68. OIT Brand System (va.gov)

SCOPE OF WORK

The Contractor shall provide enhancements and Subject Matter Expertise (SME) to the existing ICAMP system using Agile application development working in virtual cloud hosted environments [e.g. Test, Training, Development, Production], application support services, complete system backlog items called stories, Application Programming Interface (API) development to integrate with other systems within the VA environment, software testing including automated testing, requirements gathering and analysis, user/stakeholder research, technical writing, develop training material and application demonstrations.

The Contractor shall maintain ICAMP system components to include fixing design and programmatic defects, improving capabilities, and related functionality in support of the user community, stakeholders, and Performance Reporting team.

The Contractor shall provide virtual system/server support work in collaboration with and under the direction of the Federal team in support of cloud environment management for the series of application servers, database servers, web servers, their virtual environments in their testing, training, staging and production platform environments. The Contractor shall provide implementation and support for ICAMP as described herein. The Contractor shall provide Operations and Maintenance (O&M) support for the information system, to include vulnerability remediation in the virtual environment, and all other support services provided in this PWS within the PoP, as shown below in Table 1.

ICAMP is hosted on-premises, in the VA Enterprise Cloud (VAEC), Amazon Web Services (AWS) and/or Azure environment and shall be maintained in accordance with Department of Veteran Affairs approved Technical Reference Model (TRM).

The Contractor shall provide technical application development and support services, data engineering, installation, configuration, troubleshooting, database administration, API development, commercial off the shelf (COTS) application support, platform/infrastructure support and user administration for ICAMP. The Contractor shall provide virtual system/server support for the containerized application and its virtual test, development, sandbox, and production platform environments. The Contractor shall provide vulnerability remediation in the virtual environment, and all other support services provided in this PWS within the PoP.

All documentation created by the Contractor shall use OIT approved templates.

TABLE 1: Application Support

ORDER TYPE

The effort shall be proposed Firm Fixed Price (FFP) basis.

PERFORMANCE DETAILS

PERFORMANCE PERIOD

The PoP shall be 12 months from date of award, with three 12-month option periods.

PLACE OF PERFORMANCE

Tasks under this PWS shall be performed at Contractor facilities. The Contractor shall identify the Contractor’s place of performance, including all remote employees in their proposal submission.

TRAVEL

There is no expected travel with this effort.

SPECIFIC TASKS AND DELIVERABLES

Services include configuration and installation of ICAMP enhancements to a production level in the test, development, sandbox, and production environments located in the VAEC. These services also include integration with multiple application data sources, ETL (extract, transport, load), API development, and ICAMP infrastructure development and support (Azure cloud, PowerPlatform, Windows servers, Windows Databases).

The Contractor shall perform the following:

PROJECT MANAGEMENT [SCRUM MASTER]

The Contractor shall provide a certified Scrum Master with at least five (5) years of experience facilitating scrum teams using Agile project management through the course of the project, facilitate and manage all Agile ceremonies. The Scrum Master is identified as a key role. Contractor shall provide statements of qualification for individuals in key role(s). The Scrum Master shall be responsible for facilitating Agile ceremonies and discussions among scrum team members, including the Product Owner/Information System Owner/Program Manager. The Scrum Master is responsible for coaching the scrum team on the Agile framework and communicating scrum team updates and impediments to stakeholders. The Scrum Master shall ensure that all team updates reported at each scrum ceremony are captured. The Scrum Master shall ensure that all impediments reported are captured, escalated as appropriate, and tracked to resolution. Scrum Master Role activities include, but are not limited to, the following:

· Facilitate Scrum Meetings: The Contractor shall coordinate and facilitate scrum meetings, such as, Sprint planning, Backlog Refinement, Sprint Reviews and Sprint Retrospectives.

· Team Performance and Metrics: The Contractor shall work with product leadership and the ICAMP team to define relevant metrics that are formulated and utilized for meeting project objectives.

· Team Coaching and Coordination: When appropriate, the Scrum Master shall plan and coordinate trainings and coaching for the ICAMP team on the Scrum processes.

· The Scrum Master serves the Product Owner, ensuring the Product Owner knows how to arrange the Product Backlog to maximize value.

The Contractor shall hold monthly or by-weekly virtual management meetings with both Contractor and VA leadership as a forum for regular communication per Agile cadence and Sprint schedules. The Contractor shall present accomplishments for the past Agile sprint, recommendations and ideas for process improvement, and any other program related topics agreed upon by both parties.

CONTRACTOR PROJECT MANAGEMENT PLAN AND TECHNICAL ROADMAP

The Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, timeline, and tools to be used in execution of the contract. The CPMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks, and resource support. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPMP shall be concurred upon and updated in accordance with Section B of the contract. The Contractor shall update and maintain the VA Program Manager (PM) approved CPMP throughout the PoP.

The Contractor shall maintain a technical roadmap for ICAMP using VA-authorized tools such as DevOps. The ICAMP Technical Roadmap shall depict how the Contractor intends to manage the innovations needed to launch new functionality or services that satisfy customers' needs, while also supporting the enterprise's strategy. It shall also show the connection between bottom-up project realities and the organization's top-down vision and strategy, and it shall lay out a sequence of projects or tasks that enable innovation in the next two to three product life cycles. The technical roadmap shall identify innovation opportunities that may materialize as the organization changes.

Deliverables:

A. Contractor Project Management Plan B. ICAMP Product Technical Roadmap

REPORTING REQUIREMENTS

The Contractor shall report on performance metrics. The performance metrics defined below shall include such measures as sprint/release success rates, defect resolutions, and end user satisfaction.

The Contractor shall produce and deliver electronic real-time dashboards providing functionality to filter metrics by daily, weekly, monthly, quarterly, and annually. These dashboards will be generated from existing data sources, including:

· Auto-generated from the VA customer service request system,

· The tools-based data for this program, and

· Server monitoring tools and observations.

The real-time dashboards shall, at a minimum, include the following data elements, which shall be retrieved from multiple different data sources and aggregated to produce the on-demand electronic reports:

a. Status of all customer service, problem, user support, defect resolutions and incident reporting by product title (ServiceNow dashboard).

b. Status of all user accounts requests by product title (ServiceNow data- shall be on dashboard).

c. Status of all approved change orders to the application platform by product title (ServiceNow change management dashboard data).

d. Status of all issues and risks by product title (Product risk registry)

e. Status of sprint/release success rates (DevOps and/or ServiceNow Change records)

f. Status of end user satisfaction (surveys both in the Enterprise ticketing tool – ServiceNow – and SharePoint)

The Contractor shall use VA-authorized tools (e.g., Jira, GitHub, or similar) and products in scope of this TO (as shown in the above list) along with applicable server reports to collect and disseminate the data to be provided in this PWS. This real-time dashboard will not be the only means of communication between the Contractor, Contracting Officer Representative (COR), and the VA PM. The Contractor shall continuously monitor performance and describe any deviation from the CPMP to the COR and VA PM during routine, regular communications.

Deliverable:

A. Real-time dashboards

TECHNICAL KICKOFF MEETING

A technical kickoff meeting shall be held within ten (10) calendar days after TO award. The Contractor shall coordinate the date, time, and location [can be virtual] with the Contracting Officer (CO), as the Post-Award Conference Chairperson, the VA PM, as the Co-Chairperson, the Contract Specialist (CS), and the COR. The Contractor shall provide a draft agenda to the CO and VA PM at least five (5) calendar days prior to the meeting. Upon Government approval of a final agenda, the Contractor shall distribute to all meeting attendees. During the kickoff-meeting, the Contractor shall present, for review and approval by the Government, the details of the intended approach, work plan, and project schedule for each effort via a Microsoft Office PowerPoint presentation. At the conclusion of the meeting, the Contractor shall update the presentation with a final slide entitled “Summary Report” which shall include notes on any major issues, agreements, or disagreements discussed during the kickoff meeting and the following statement:

“As the Post-Award Conference Chairperson, I have reviewed the entirety of this presentation and assert that it is an accurate representation and summary of the discussions held during the Technical Kickoff Meeting for the Technical Development & Support effort.”

The Contractor shall submit the final updated presentation to the CO for review and signature within three (3) calendar days after the meeting. The Contractor shall also work with the CS, the Government’s designated note taker, to prepare and distribute the meeting minutes of the kickoff meeting to the CO, COR, and all attendees within three (3) calendar days after the meeting. The Contractor shall obtain concurrence from the CS on the content of the meeting minutes prior to distribution of the document.

CHANGE ENABLEMENT, RELEASE AND MANAGEMENT

The Contractor shall be responsible for compliance with VA Directive 6004, Configuration, Change, and Release Management Programs, which provides department-wide standards established in accordance with Federal Information Security Management Act (FISMA) (P.L. 107-347, Title III of the E-Government Act), December 2022, related VA Directive and Handbook 6500, Information Security Program, and Office of Information Technology (OIT) Authorization Requirements Standard Operating Procedures (SOP).

The Contractor shall work with Information System Owners (ISO) to meet ATO requirements which includes completion of a System Configuration Management Plan (SCMP). In addition to complying with VA Directive 6004, the Contractor shall comply with Configuration Management System (CMS) Discovery and Service Mapping requirements, which includes, but is not limited to; providing associated system design documents or appropriate contacts for system design and technical information necessary to conduct discovery and mapping activities. Provisions must be made between the responsible vendor and VA Product team on coordination of all system changes.

The Contractor shall comply with the ICAMP Change Enablement SOP. Change Requests are required to be submitted in the VA Change Control system.

References:

VA Directive 6004, Configuration, Change and Release Management Programs VA Directive and Handbook 6500, Information Security Program Authorization requirements for eMASS SOP Process Asset Library (PAL) system configuration management plan

Deliverables:

A. System Configuration Management Plan B. Change Requests

APPLICATION DEVELOPMENT AND SUPPORT

ICAMP:

The Contractor shall provide software development, software defect remediation and enhancements, installation, configuration, communications, application and technical support, and testing throughout the full software development lifecycle (SDLC). The Contractor shall provide developer(s) with at least five (5) years of experience in Data Integration Development and Support, utilizing Project Management principles. Contractor developers preferred to have knowledge, skills and expertise on VA DevOps CI/CD practices and VA information security policies, procedures, and regulations. Contractor shall provide statements of qualification for individuals in key role(s). Data Integration Development and Platform Support activities include, but are not limited to, the following:

The Contractor shall adhere to VA-established product upgrades and system maintenance implemented by this TO. This includes all security engineering requirements compliance in support of VA Authority to Operate (ATO) sustainment, Multi-Factor Authentication compliance, Elevated Privileges compliance and other security requirements applicable to this implementation.

The Contractor shall be familiar with current and emerging technologies, COTS products, services, programming languages and processes required to deliver 508 conformant high-quality products.

The Contractor shall provide subject matter expertise with a minimum five (5) years’ experience for the following applications, application frameworks and development tools: but not limited to, e.g. PowerPlatform, Kubernetes, MUI Premium, Azure, Azure DevOps, Windows Server, Azure Cloud, SQL Server and Management Tools, Visual Studio, Visual Studio Code, Azure CLI.

The Contractor personnel shall also have the same amount of experience with the following programming languages and libraries.

The Contractor shall coordinate with the Performance Reporting Government team on gathering application requirements, performing development, and supporting Office of Information Technology (OIT) submissions as requested or required by VA. Software developed shall be 508 conformant, Personal Identity Verification (PIV) compliant, per Homeland Security Presidential Directive (HSPD) 12 and Executive Order 14028.

The Contractor shall provide full application lifecycle support, including implementation and continuous sustainment and technical support (upgrades) for ICAMP. The Contractor shall provide support for capabilities [modeling] engineering design to improve data interoperability, integrity, and quality for new systems and initiatives. The Contractor shall perform maintenance tasks also which include maintaining system/software engineering, integration activities, system security, program lifecycle documentation, application documentation, and database documentation required for continued software support and requirements management.

The Contractor shall deliver all code free of configuration or sensitive data.

The Contractor shall work with Agency stakeholders and technology professionals to properly understand business requirements and perform requirements development techniques as appropriate to accomplish the iterative elicitation, analysis, and specification of requirement statements that accurately and completely express needs. Using requirement development techniques including but not limited to direct elicitation from customer/user interaction such as interviews and requirements building workshops, participation in business process modeling activities, mining existing system functionality, use cases and scenarios.

The Contractor will facilitate processes to decompose high-level business and system requirements to derive technical, performance, functional, non-functional, design, interface, and/or physical requirements at the project level. Define system features, authoring user stories, and establishing acceptance criteria. Using VA approved tools, maintain bi-directional traceability between all requirements and the original business requirements and drivers. Interface with enterprise requirements managers to determine whether additional enterprise requirements (e.g. security, privacy, Section 508 conformance, Enterprise Architecture [EA], Government private cloud, etc.) are applicable to ICAMP.

The Contractor shall develop and execute automated testing for ICAMP using VA approved processes and tools to the maximum extent possible. Testing shall include unit, smoke, regression, 508 conformance, connectivity, functional/black box, negative, integration, performance and load, and User Acceptance Testing (UAT) to test 100% of functionality delivered following industry best practices. The Contractor shall create a Master Test Plan, individual release test plans, test scripts and test reports documenting the testing conducted.

The Contractor shall perform continual process improvement by implementing Application Programming Interfaces (APIs), data integration and focusing on the User Experience (UX)/Customer Experience (CX) to ensure that the products being developed are intuitive and user-friendly.

ICAMP

The Contractor shall provide installation, configuration, communications, application, and technical support for ICAMP.

The Contractor shall provide technical product support and if unable to resolve the Contractor is responsible for escalation to the vendor for remediation. During PI events issues must be resolved within two hours; issues that cannot be resolved by the Contractor within this timeframe shall be escalated to the vendor.

The Contractor shall provide the equivalent to senior level DevOps Engineer, with a minimum of five (5) years’ experience, to meet the required level of effort in support of version upgrades, integrations, and deployments within the VA ecosystem.

The Contractor shall provide full application lifecycle support, including continuous sustainment (patching) and technical support (e.g., patching, upgrades) for VA’s implementation ICAMP.

The Contractor shall provide project updates in VA approved tools (e.g.,DevOps, ServiceNow, Jira). The resources shall provide support including, but not limited to remediation of scan results, custom script deployments, and/or any technical change within the vendor’s control that will enable successful ICAMP implementation.

The Contractor shall perform product integration and testing for the application. Testing shall include 508 conformance, connectivity, load, functional, and integration following industry best practices. The Contractor shall create test plans, test scripts, and test reports.

The Contractor shall perform data migration as required.

Deliverables:

A. ICAMP Requirements Specification Documents B. ICAMP Master Test Plans C. ICAMP Release Test Plans, Test Scripts, Test Reports

HELP DESK SUPPORT

For the purposes of this TO, the following Tiered Support levels shall be implemented:

The Contractor shall provide help desk support coverage Monday through Friday, excluding Federal Holidays, from 6AM – 7PM Eastern time.

Estimated volume of VA-approved ticketing system requests is between 100 and 200 per month.

TABLE 2: ESCALATIONS TIMES BETWEEN TIERS

All times provided reflect lapsed time since contact was made with the help desk during support coverage hours stated above.

Definitions of Severity Codes:

• Critical: End user cannot perform their work functions. End user needs resolution immediately. One or more critical deliverables are being prevented from being worked on or delivered. Patient safety issue will or has resulted. PHI/PII data was accidentally entered into the system. A security breach or violation has occurred or is imminent. A system outage has occurred, and end users are unable to use the application(s). A system defect has been identified and shall or can only be corrected by the vendor.

• Serious: End user cannot perform one or more of their key work functions. End user requires a resolution, but not immediately. One or more deliverables are being prevented from being worked on or delivered. The end user cannot access the application(s). A system defect may have been identified and needs to be escalated to the vendor to confirm/address.

• Moderate: End user cannot perform one or more work functions, but a workaround is available. One or more deliverables may be delayed or impacted if a resolution is not determined.

IT Help Desk ticket handling (management)

The Contractor shall use the OIT-approved enterprise ticketing tool and repository to create and maintain service ticket and problem report data and shall interact with customers through the service tickets, phone calls, meetings, and other VA communication and collaboration tools as directed. The Contractor shall record all status and resolution data on problems reported in the VA required service ticket system for constant monitoring of problem resolution status.

The Contractor shall ensure help desk tickets (issues, incidents, request for change) are assigned to the appropriate Assignment Group within three (3) business hours of Help Desk receipt. This improves timely communication and coordination in addressing the customer’s request, improving resolution times, and avoiding needless wait times.

The Contractor shall triage the help desk ticket queue first on a severity basis, followed by submission date/time (e.g. first in, first out). The Contractor shall focus on resolution of priority tickets first then work tickets in the order in which they were received.

The Contractor shall utilize VA-provided tools to diagnose database and application problems, and repair, re-configure or replace defects as indicated. The Contractor shall perform troubleshooting methodology to include the identification of operational issues and root causes, research and testing of solutions, documentation of findings (e.g., root cause analysis), evaluation of options, development of alternatives, and justification of recommendations.

The Contractor shall facilitate daily fifteen (15) minute Help Desk ticket triage/resolution (SCRUM) meetings.

The Contractor shall provide dashboard content that shall include at minimum, but not limited to, the number of tickets received, the percentage of tickets completed, the timeframe in which they were completed (number of business days), the support technician to whom they were assigned and how many tickets that technician has resolved in the month, and reopened tickets. The dashboard will also be used to report change management metrics such as the number of normal, standard, and emergency changes, the number of internally identified defects and enhancements, the number of accepted and rejected changes, and the number of out of cycle changes identified to restore user functionality between sprints.

The Contractor shall identify trends by analysis of support tickets in the OIT-approved enterprise ticketing tool as well as emails to the Application Support Team mail group and Instant Messages (IMs) in Teams to individuals on the support or development team. The Contractor shall compile an electronic report of their findings and analysis.

The Contractor shall maintain the real-time dashboard in the OIT-approved enterprise ticketing tool that displays these requested metrics. The dashboards shall be able to be viewed at user-defined intervals, such as daily, weekly, monthly, quarterly, annually. The dashboards shall be updated at the direction of the Government. The content described above and listed below shall be available via the dashboards.

· The number of product tickets by application

· First contact resolution rate

· Backlog of open tickets to include aging

· Ticket resolution time

· The number of reopened tickets

· Closed/unresolved tickets by individual product support technician

· Number of Normal Changes which the Change Advisory Board (CAB reviews)

· Number of Standard Changes

· Number of Emergency Changes

· Internally Identified Enhancements/Defects

· Change Acceptance Rate

· Number of Out of Cycle Changes

Deliverables:

A. Product Support Ticket Dashboard B. Root Cause Analysis Reports C. Problem Trend Analysis Reports

ICAMP Platform Support The Contractor shall provide the following deliverables for the successful deployment and ongoing maintenance of ICAMP Platform.

These include the production and publishing of Architecture & Physical/Logical diagrams, Testing & Quality Assurance Reports, Infrastructure as Code and Deployment Automation scripts, Logging, Monitoring, and Alerting configurations, Security and Compliance Reports, Release Notes for APIs, and Developers Guide.

Each deliverable follows a structured timeline based on current ICAMP Agile Biweekly Sprint Schedule:

-Initial drafts are created well in advance (6-8 weeks before deployment), -Internal review feedback is incorporated (4-6 weeks prior) -Final versions are completed (2-4 weeks before launch).

-Developer guides and configurations are reviewed real-time and updated as needed during deployment lifecycle to ensure they remain accurate and effective.

1. Architecture & Physical/Logical diagrams of the ICAMP system – Architecture & Physical Diagrams illustrate the system’s components. Logical Diagrams illustrate the functions of the system.

Testing & Quality Assurance Reports – Testing reports document the process and results of evaluating software to ensure it meets specified requirements. Quality assurance reports focus on the overall process improvements and adherence to standards to ensure product quality.

Infrastructure as Code and Deployment Automation – Infrastructure as Code (IaC) automates the provisioning and management of infrastructure through code, ensuring consistency and reducing manual errors. Deployment automation streamlines the release process, enabling faster and more reliable software deployments.

Application Programming Interface (API) documentation, Logging, Monitoring and Alerting configuration management – Logging, monitoring, and alerting for APIs ensure real-time tracking, performance analysis, and prompt issue detection.

Security and Compliance Reports and monitoring of Infrastructure – Per TRM, 508, VA-6500.

Developers Guide (ICAMP only) – Detailed documents that accompany a new software release, outlining new features, enhancements, bug fixes, and any known issues.

DATA INTEGRATION and REPORT DEVELOPMENT The Contractor shall provide developer(s) with at least five (5) years of experience in Data Integration Development and Support, utilizing Project Management principles.

Contractor developers preferred to have knowledge, skills and expertise on VA DevOps CI/CD practices and VA information security policies, procedures, and regulations

Contractor shall provide statements of qualification for individuals in key role(s). Data Integration Development and Platform Support activities include, but are not limited to, the following:

· Design, develop, and maintain scalable data integration solutions that meet business requirements and align with the organization's architectural standards.

· Collaborate with cross-functional teams to gather and analyze data requirements for integration projects.

· Design, develop and maintain platform System Design and infrastructure using Azure and on premises Windows servers, storage, and databases.

· Create and maintain detailed documentation of data integration processes, data models, and mappings, to include the creation and maintenance of an ICAMP data dictionary.

· Develop and implement ETL (Extract, Transform, Load) processes, data pipelines, and workflows using integration tools and programming languages.

· Ensure data quality and integrity by implementing data validation, cleansing, and error-handling procedures.

· Optimize data integration performance by conducting regular system tests and troubleshooting any issues that arise.

· Monitor data integration systems to ensure they function correctly and efficiently and provide ongoing support and maintenance.

· Stay current with emerging data integration technologies and methodologies to continuously improve integration solutions.

· Facilitate data migration efforts, including the extraction of data from legacy systems and the loading of data into new systems or platforms.

· Collaborate with data architects and database administrators to ensure that data integration projects align with data governance and security policies.

Deliverables:

A. Provide daily SCRUM updates B. Provide end of Sprint accomplishments C. Provide end of Sprint demonstrations

CLOUD INFRASTRUCTURE AND DEVELOPER Support The contractor shall provide cloud infrastructure engineers and developers with at least five (5) years of experience in Cloud Infrastructure Development, Security and Support, utilizing industry-standard DevOps and Project Management principles.

Contractor developers are preferred to have knowledge, skills and expertise in cloud best practices, security polices and compliance frameworks particularly those relevant to VA information security policies and procedures.

The contract shall provide statements of qualifications for individuals in key role(s). These activities include but are not limited to:

Design, develop and maintain scalable cloud infrastructure solution aligning with organizational architectural and security standards.

Collaborate with cross-functional teams to integrate and optimize cloud services, deployment automation and continuous monitoring strategies.

Implement Infrastructure as Code (IaC) to automate provisioning, configuration management and infrastructure deployments.

Develop and maintain security access and control diagrams/matrices ensuring compliance with industry best practices.

Optimize infrastructure performance via continuous monitoring logging and alerting.

Monitor cloud infrastructure to ensure operational efficiency, redundancy and reliability.

Maintain and clean up decommissioned infrastructure, data and code in accordance with proper infrastructure lifecycle management.

Ensure compliance with security, disaster recover and backup policies via planning and implementation.

API development and documentation, supporting integration with cloud or other services.

Create and manage standard operating procedures (SOPs) for cloud environments, define operational workflows for security best practices.

Stay current with emerging cloud technologies including Artificial Intelligence (AI), and other methodologies to improve system performance and security.

Deliverables:

A. Provide daily SCRUM updates B. Provide end of Sprint accomplishments C. Provide end of Sprint demonstrations

ICAMP LICENSE MANAGEMENT

The Contractor shall provide and protect licensing system administration, license key configuration, and licensing data to manage the provision of ICAMP licenses to end users.

The Contractor shall follow procedures to protect license key information from unauthorized use of others in and outside of VA. The Contractor shall perform license protection to include configuration of licensing system access rights; protection and preservation of all loadable license key files; proper use of the license information; license auditing, verification, and reporting; coordination with manufacturers on license administration; administrative procedures delegated via manufacturer; customer account management procedures; and protection of that delegated access from other individuals. The Contractor shall perform management of the licensing system to include installation, scripting, monitoring, and reporting availability and status of licenses. Management of the license information shall also include proper handling of all paper and electronic files containing license configuration and entitlement information. The Contractor shall work with VA operations to assist in providing the capability to access the tools through remote access inside the VA network.

The Contractor shall maintain a License Inventory of all ICAMP licenses, via an automated solution. All VA-acquired tool licenses and entitlements shall be received, cataloged, secured, activated, and monitored using compliance and reporting tools resident on the licensing systems as directed by VA. The Contractor shall perform daily licensing monitoring via automated solution to ensure that license contention is actively assessed, and license shortages are predicted and minimized. The Contractor shall provide a License Usage Report via automated solution that reflects patterns of demand for hosted licenses. The Contractor shall conduct analysis of software license utilization to provide advance notification when an established threshold is reached triggering a notification to the Government for additional licenses procurement.

The Contractor shall monitor and evaluate problems associated with license management, tool vendor licensing, end user agreements and restrictions to discover risks and inadequacies, determine the need for expansion, enhancement, or revision; and to ensure the reliable provision of licensing services.

Deliverables:

A. License Inventory B. License Usage Report

USER AND TECHNICAL DOCUMENTATION

The Contractor shall provide a technical writer with a minimum of three (3) years of relevant experience creating documents in a Government environment. The Contractor shall utilize VA templates and style guides in the production of all documentation. By analyzing historical customer ticketing information, the Sr. Technical Writer shall proactively address issues related to documentation improvements. The Contractor shall author quarterly identified problem trend analysis reports to address often recurring user difficulties. Documentation previously developed shall be incrementally updated.

The Contractor shall provide incremental documentation through sprint cycles that results in full technical and end-user documentation or configuration for all software development efforts and product releases with all information necessary to document processes, procedures, code artifacts, and/or policies that were implemented in the creation of the development work.

The Contractor shall coordinate with VA to identify needs for creation, editing, review, and promulgation of product User Guides, Operations and Maintenance Guides to include Deployment, and Installation, Backout, and Rollback Plan, Standard Operating Procedures (SOPs), documentation of any manual processes and manual calculations, Database Schemas, end user communications as needed and technical documentation. All new versions of products may require the Contractor to create/update documentation.

Deliverables:

Each deliverable follows a structured timeline based on current ICAMP Agile Biweekly Sprint Schedule:

-Initial drafts are created well in advance (6-8 weeks before deployment), -Internal review feedback is incorporated (4-6 weeks prior) -Final versions are completed (2-4 weeks before launch).

-Developer guides and configurations are reviewed real-time and updated as needed during deployment lifecycle to ensure they remain accurate and effective.

Product User Guides - These provide instructions for the customer on how to use specific products on the ICAMP Platform.

Operations and Maintenance Guide - Detailed instructions for on-going management and upkeep of systems and infrastructure. Operations and Maintenance Guide includes procedures for Deployment and Installation, Back-out, and Rollback Plan.

Standard Operating Procedures (SOPs) - Detailed, written instructions that outline how to perform a process consistently and correctly that are designed to achieve uniformity in the performance of specific functions.

Documentation of any manual processes and manual calculations Database Schemas - Data Catalog and Data Dictionary Administrative Account Records – internal access controls document.

INSTRUCTIONAL MATERIAL

The Contractor shall serve as subject-matter experts to work with the Office of People Readiness team to produce innovative ideas and deliver knowledge, create content, and provide on-demand and/or live training to ICAMP product users following the Customer Experience (CX) methodology while working in collaboration with the Customer Experience Specialist [Federal position].