Draft PWS OMEGA- RFI.docx

Onboarding, Management, Engineering, Governance, and Assurance Services

VA-24-00010954

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Office of Information & Technology Office of Information Technology/Product Engineering/Digital Transformation Center

Onboarding, Management, Engineering, Governance, and Assurance Services

(OMEGA)

Date: 3/18/2024

TAC- 24-00010954

Task Order PWS Version Number: 5.2

Contents

BACKGROUND

The mission of the Department of Veterans Affairs (VA) Office of Information and Technology (OIT), Program Engineering Services (PES), Digital Transformation Center (DTC) is to establish VA-wide Digital Modernization Initiatives which can be supported and delivered via Product Delivery and Lifecycle Management methodologies to transform VA by tapping into emerging technologies, connecting developers with VA data, and making Human Centered Design (HCD) the method of how all VA products are designed.

DTC established a modern digital experience for VA Enterprise needs such as the acceleration/adoption of Software-as-a-Service (SaaS), Platform-as-a-Service (PaaS), Application Programing Interface (API), and emerging technologies to modernize service and solution delivery through adoption of software development (Dev), security (Sec), and Information Technology (IT) operations (Ops) (DevSecOps), Product Line Management (PLM), and Industry Best Practices/Standards. DTC programs have delivered and manage best-in-class product services and solution capabilities leveraging specialized and diversified skill sets for the VA Enterprise Digital Modernization Initiatives to include Federal Multi-Tenancy Enclaves.

The DTC Ecosystem is a persistent collaboration of platform management, program management teams, and system integrators (SI) across the entire capability delivery lifecycle with centralized enterprise platform management with quality approval gates assuring the SI’s delivery of high-quality low code/no code (LCNC) solutions. As outlined in Figure 1 below, the SI teams are represented as the Product Delivery team in blue focused on delivering solutions within the DTC Capability Delivery Lifecycle Management. While DTC Platform Management Team tasks and activities in red are responsible for the governance, operations, and maintenance services of the underlying DTC LCNC products and platforms that hosted Product Delivery team solutions. DTC success is measured and validated through the incremental and iterative delivery of business and technology capabilities driving modernization efforts.

As part of VA’s digital modernization, SaaS is a strategic application delivery model. A SaaS Product is hosted on a cloud infrastructure outside the security boundary of VA and is provided to the Cloud Service Customer (CSC) over the internet. The CSC uses the SaaS offering via a thin-client interface, such as a web-browser or a program interface. The CSC subscribes to the SaaS offering and is only responsible for limited application configuration settings. The Cloud Service Provider (CSP) offering the application is responsible for management of the application, safeguarding of data stored or processed by the application, and all elements of the underlying infrastructure.

To qualify as SaaS for use at VA (as defined in Attachment 1), and to align with Federal Risk and Authorization Management Program (FedRAMP) requirements, the hosting for the offering must conform to the National Institute of Standards and Technology (NIST) 800-145 definition of Cloud Computing and thus contain following key characteristics:

· On-Demand Self-Service: The CSP fully automates the provisioning of both the customer interface and the underlying cloud components of the SaaS offering. In some cases, the CSP may provision internal resources manually, while providing the CSC an automated interface to request and track the service.

· Broad Network Access: The SaaS capabilities are available over the internet or over a network that is available from all access points the CSC requires. The SaaS offering is accessible through common platforms (e.g., mobile phones, tablets, laptops, and workstations).

· Resource Pooling: The computing infrastructure supporting the SaaS offering is shared among more than one CSC using a multi-tenant model, and resources are dynamically assigned depending on customer demand.

· Rapid Elasticity: Computing capabilities are automatically provisioned and released in a manner that scales with customer demand. In some cases, the scaling of resources may not be fully automated, but it should be fast enough to support the needs of the CSC, which the CSC would have to define.

· Measured Service: Resource usage, such as storage, processing, bandwidth, and user activity are measured and reported on in a manner that is relevant to the SaaS offering.

The SaaS offering shall be hosted within the continental United States and data stored, processed, and/or transmitted within the offering shall remain within the United States. CSPs shall be aware of FedRAMP and ready to partner with VA through the SaaS FedRAMP Authorization process.

To further accelerate the adoption of VA’s Cloud First, Cloud Smart, and other policies and directives, VA sponsors Hybrid and Managed Solutions in addition to the SaaS application delivery model referenced above. A Hybrid Solution is comprised of both SaaS and on-premise components which shall adhere to both SaaS and VA Enterprise Cloud established policies. A Managed Solution is defined as a single-tenant product not hosted within the VA Network. The mission of the VA is to provide benefits and services to Veterans of the United States. In meeting these goals, OIT strives to provide high quality, effective, and efficient IT services to those responsible for providing care to the Veterans at the point-of-care as well as throughout all the points of the Veterans’ health care in an effective, timely, and compassionate manner. VA depends on Information Management/Information Technology systems to meet mission goals.

The DTC technology ecosystem continues maturing into a modular ecosystem comprised of reusable solution and technology components that optimize reusability, accelerates solutions delivery, and reduces product delivery and operations costs. Modular solution architecture and design is composed of underlying modules and functional components, where each modular component provides a standalone service or value functionally distinct and independent from other software modules or functional components. Each modular component is partitioned ensuring that each component is solvable, modifiable, and compilable without requiring the whole software system to be recompiled. Modular solution architecture and design further enables and ensures that underlying distinct functionality leveraged as part of the overall software application design provides a unified, consistent user experience that is standardized across the enterprise.

In support of VA systems modernization and the agency’s mandate to move to the cloud, this effort seeks to provide LCNC product and platform onboarding, management, engineering support, governance, and assurance (OMEGA) services to enable, manage, operate, and sustain the underlying DTC technology ecosystem including modular and reusable technology components supporting VA Enterprise modernization initiatives.

APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. 44 U.S.C. § 3541-3549, “Federal Information Security Management Act (FISMA) of 2002”

2. “Federal Information Security Modernization Act of 2014”

3. Federal Information Processing Standards (FIPS) Publication 140-2, “Security Requirements for Cryptographic Modules”

4. FIPS Pub 199. “Standards for Security Categorization of Federal Information and Information Systems,” February 2004

5. FIPS Pub 200, “Minimum Security Requirements for Federal Information and Information Systems,” March 2006

6. FIPS Pub 201-2, “Personal Identity Verification of Federal Employees and Contractors,” August 2013

7. 10 U.S.C. § 2224, "Defense Information Assurance Program"

8. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

9. Public Law 109-461, Veterans Benefits, Health Care, and Information Technology Act of 2006, Title IX, Information Security Matters

10. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”

11. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, https://www.va.gov/vapubs/index.cfm

12. VA Handbook 0710, “Personnel Security and Suitability Program,” May 2, 2016, https://www.va.gov/vapubs/index.cfm

13. VA Directive and Handbook 6102, “Internet/Intranet Services,” August 5, 2019

14. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and Guidelines,” January 18, 2017

15. Office of Management and Budget (OMB) Circular A-130, “Managing Federal Information as a Strategic Resource,” July 28, 2016

16. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed Services (CHAMPUS)”

17. NIST SP 800-66 Rev. 1, “An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule,” October 2008

18. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended, January 18, 2017

19. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

20. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021

21. VA Handbook 6500, “Risk Management Framework for VA Information Systems VA Information Security Program,” February 24, 2021

22. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI),” March 12, 2019

23. VA Handbook 6500.5, “Incorporating Security and Privacy into the System Development Lifecycle,” March 22, 2010

24. VA Handbook 6500.6, “Contract Security,” March 12, 2010

25. VA Handbook 6500.8, “Information System Contingency Planning,” April 6, 2011

26. VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018

27. VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017

28. OIT Process Asset Library (PAL), https://www.va.gov/process/ . Reference Process Maps at https://www.va.gov/process/maps.asp and Artifact templates at https://www.va.gov/process/artifacts.asp

29. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

30. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014

31. VA Handbook 6508.1, “Procedures for Privacy Threshold Analysis and Privacy Impact Assessment,” July 30, 2015

32. VA Handbook 6510, “VA Identity and Access Management,” January 15, 2016

33. VA Directive and Handbook 6513, “Secure External Connections,” October 12, 2017

34. VA Directive 6300, “Records and Information Management,” September 21, 2018

35. VA Handbook, 6300.1, “Records Management Procedures,“ March 24, 2010

36. NIST SP 800-37 Rev 2, “Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy,” December 2018

37. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020)

38. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015

39. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” March 24, 2014

40. OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005

41. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019

42. OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008

43. Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance, December 2, 2011, (NOTE: Part A of the FICAM Roadmap and Implementation Guidance, v2.0, was replaced in 2015 with an updated Architecture (https://arch.idmanagement.gov/#what-is-the-ficam-architecture)

44. NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access,“ June 2018

45. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, “Digital Identity Guidelines,” updated March 02, 2020

46. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014

47. NIST SP 800-164, “Guidelines on Hardware-Rooted Security in Mobile Devices (Draft),” October 2012

48. Draft National Institute of Standards and Technology Interagency Report (NISTIR) 7981, “Mobile, PIV, and Authentication,” March 2014

49. VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

50. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

51. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

52. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

53. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019

54. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008

55. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (Public Law 110–140), December 19, 2007

56. Section 104 of the Energy Policy Act of 2005, (Public Law 109–58), August 8, 2005

57. Executive Order 13834, “Efficient Federal Operations,” dated May 17, 2018

58. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 2, 2001

59. VA Directive 0058, “VA Green Purchasing Program,” July 19, 2013

60. VA Handbook 0058, “VA Green Purchasing Program,” July 19, 2013

61. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

62. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

63. “Veteran Focused Integration Process (VIP) Guide 4.0,” January 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

64. VA Memorandum “Proper Use of Email and Other Messaging Services,” January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

65. “DevSecOps Product Line Management Playbook” version 2.0, May 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

66. NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020

67. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol Version 6 (IPv6),” November 19, 2020

68. Social Security Number (SSN) Fraud Prevention Act of 2017

69. Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23, 2018

70. SaaS Product Catalog - DigitalVA Product Marketplace https://digital.va.gov/marketplace/saas-catalog/

71. DTC Standard Operating Procedures: https://confluence.devops.va.gov/display/VAExternal/Digital+Transformation+Center+Homepage

72. VA Cloud First Strategy - VA Directive 6517 https://www.va.gov/vapubs/viewPublication.asp?Pub_ID=852&FType=2

73. Cloud Security Technical Reference Architecture, June 2022 Version 2.0 https://www.cisa.gov/sites/default/files/2023-02/cloud_security_technical_reference_architecture_2.pdf

74. FedRAMP Authorization Act, December 23, 2022

75. VA SaaS Definition - Attachment 1

76. DTC Process - How to Submit a Request to Move a Module to Sustainment - Attachment 2

77. Product Warranty and Permanent Sustainment Procedures – Attachment 3

78. DTC System Integrator SLAs - Attachment 4

79. Existing Digital Transformation Center O&M Solutions - Attachment 5

80. DTC Current Platform as a Service Offerings – Attachment 6

81. DTC Incident Management Plans/Processes/Checklists/Templates – Attachments 7-10

SCOPE OF WORK

The Contractor shall create, maintain, enforce, analyze and update the Standards and Governance established by the current DTC. The Contractor shall provide technical and operational support to the DTC for SaaS, PaaS, and emerging technologies. The Contractor shall also provide governance, operations, and maintenance services to support all aspects of the DTC including project management, security and compliance, platform governance, platform management, solution governance, engineering, license management, solution sustainment, platform sustainment, product and technology adoption and socialization, and end user support. The Contractor shall adhere to all established Service Level Agreements as specified in this PWS.

PERFORMANCE DETAILS

PERFORMANCE PERIOD

The Period of Performance (PoP) shall consist of one 12-month base period, four 12-month option periods, and 25 Optional Tasks.

Any work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO).

There are eleven (11) Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, five are set by date:

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

PLACE OF PERFORMANCE

Efforts under this effort shall be performed at Contractor facilities and work may be performed at remote locations with prior concurrence from the Contracting Officer’s Representative (COR). The Contractor shall identify the Contractor’s place of performance in their Proposal Summary Volume submission. For specific meeting types, including user requirements sessions and other key meetings which are best accomplished at Government facilities. The Government will schedule meeting rooms as necessary. No work under this contract shall take place outside the United States

The Contractor shall be responsible for ensuring all Contractor personnel are located and conduct work within the following locations: Continental United States (CONUS); District of Columbia (DC); Alaska; Hawaii; and Puerto Rico/ US Virgin Islands. Contractor personnel may only utilize IP addresses available in the aforementioned locations to access the VA network. Contractor personnel may only utilize VA provided Virtual Privacy Networks (VPNs) software or remote access services such as Citrix CAG, to access VA networks and content requiring additional security controls and access privileges. Contractor personnel may not utilize external VPN software, connections, or endpoints to access the VA network or VA provided VPN. If Contractor personnel is outside of permitted locations, the Contractor shall be responsible for all resources necessary to remedy the incident including remediation of damages arising from work performed by Contractor provided personnel, under the auspices of this contract.

TRAVEL

The Government anticipates travel to perform the tasks associated with the effort to attend program-related meetings and user requirement sessions throughout the PoP.

Travel shall be proposed on a Cost-Reimbursable basis. Travel shall be in accordance with the Federal Travel Regulations (FTR) and requires advanced concurrence by the COR. Contractor travel within the local commuting area will not be reimbursed.

SPECIFIC TASKS AND DELIVERABLES

The Contractor shall follow established and emerging DTC policies, frameworks, and procedures while maintaining process and service SLAs applied across all requirements and deliverables in 5.0 and all sub-paragraphs. The Contractor shall maintain all SLAs as outlined in Attachment 4.

PROJECT MANAGEMENT

CONTRACTOR PRODUCT AND PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Product and Project Management Plan (CPPMP) that lays out the Contractor’s approach, timeline, and tools to be used in execution of this TO effort. The CPPMP shall take the form of both a narrative and graphic format that displays the product and/or project delivery timeline and targets for each prioritized capability, including a sprint forecast of target products/projects capabilities are in the upcoming sprints, target delivery of capability with sprint confidence metric, milestones, changes to target delivery with reason in plain language, risks, and resource support. The CPPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPPMP shall be concurred upon and updated in accordance with Section B of the TO. The Contractor shall update and maintain the VA Product Manager (PM) approved CPPMP throughout the PoP.

Deliverable:

A. Contractor Product and Project Management Plan

REPORTING REQUIREMENTS

The Contractor shall provide the COR, the Contract Project Manager, and the DTC Directors with a Monthly Progress Report to include, at minimum, the following information:

1. Key accomplishments

2. License Management savings

3. Labor Cost Avoidance from Reuse Implementations

4. SaaS/PaaS/Reuse/Integration deliveries

5. Authority to Operate (ATO) decisions granted by type.

6. Number of new FedRAMP In-Process designations issued.

7. Number of new FedRAMP Authorizations granted.

8. DTC Product Marketplace additions and/or removals

9. Number of new SaaS/PaaS/Reuse/Integration Requests

10. Number of Active SaaS/PaaS/Reuse/Integration Requests

11. Number of SaaS/PaaS/Reuse/Integration Requests in Assessment Pipeline

12. Number of Requests in Process by Phase, by assigned resource(s)

13. Average processing time by Phase, by assigned resource(s)

14. Number of Supported Users to date.

15. SaaS/PaaS/Reuse/Integration Deliveries from previous month and forecasts for the fiscal year

16. Number of SaaS/PaaS/Reuse/Integration Cancelled Requests

17. Delivery and Processing time of onboarding new PaaS platforms

18. Delivery and Processing time of onboarding new SaaS products

19. Delivery and Processing time of onboarding new PaaS modules

20. Platform Health Monitoring and Reporting data and trends

21. Delivery and Processing time of product, platform, and module security authorization updates

22. Number of SaaS/PaaS/Reuse/Integration Products Delivered to Date within current Fiscal Year and cumulative to date.

23. Delivery and Processing time trends for aforementioned information and additional metrics requested by Contract Project Manager.

24. DTC support tools (DTC Product Portfolio, Service Manager Pro, Jira, or other VA-approved DTC tracking and management tools) data completeness and quality report.

25. DTC Workstream priorities and progress made during the previous month.

26. Progress details on ATO / FedRAMP authorizations in progress.

The Monthly Progress Report shall include detailed instructions/explanations for each required data element, to ensure that data is accurate and consistent. The report shall reflect data as of the last business day of the preceding period. The Monthly Progress Report shall cover all work completed during the reporting period and work planned for the subsequent reporting period for each project. The Monthly Progress Report shall identify any problems that arose and give a description of how the problems were resolved. If problems have not been completely resolved, the Contractor shall provide an explanation including its plan and timeframe for resolving the issue(s). The Monthly Progress Report shall also include an itemized list of all documents and electronic deliverables. The Contractor shall monitor performance against the CPPMP and report any deviations in the next Monthly Progress Report. The Contractor shall ensure regular communication with the VA PM so that issues that arise are transparent to both parties to prevent escalation of outstanding issues. The Contractor shall also provide the data and reporting content to the VA PM to support management level reporting. Throughout a product lifecycle, the Contractor shall ensure data records contain the necessary elements for analysis and tracking, is meaningful, accurate and appropriate for a given product lifecycle phase.

Deliverable:

A. Monthly Progress Report

WEEKLY ACTIVITY REPORT

The Contractor shall provide a Weekly Activity Report detailing all SaaS and PaaS deliveries from the previous week (to include the associated Product Request (PR) number, description of the product, and importance to VA/Veterans), Production Releases from the previous week (to include the impacted modules), expected deliveries for the next week, and any risks and dependencies on a weekly basis. Any new risk or dependency shall be communicated and escalated to the DTC Federal Platform Lead(s) within 24 hours of the issue discovery. This report shall include details on all risks and dependencies discovered during the previous week, identification of any new risks or dependencies encountered, and an update on previously identified risks and dependencies. This report shall be delivered to the VA COR, VA Project Manager and POCs responsible for updating the DTC Veteran Affairs Product-line Management Accountability and Reporting System (VA PARS) Dashboard.

Deliverable:

A. Weekly Activity Report

TECHNICAL KICKOFF MEETING

The Contractor shall hold a Technical Kickoff Meeting within 10 days after contract award between Contractor, COR, Contract PM, and VA DTC Directors. The Contractor shall coordinate the date, time, and location (can be virtual) with the CO, the VA PM, the Contract Specialist (CS), and the COR. The Contractor shall provide a draft Kickoff Meeting Agenda (via email) to the CO, CS, COR, and VA PM at least five calendar days prior to the meeting. Upon Government approval of a final Kickoff Meeting Agenda, the Contractor shall distribute to all meeting attendees (via email). During the Technical Kickoff Meeting, the Contractor shall present Kickoff Meeting Power Point Presentation for review and approval by the Government within seven days after contract award. The presentation shall include details of the intended approach, work plan, and project schedule for each effort. At the conclusion of the meeting, the Contractor shall update the presentation with a final slide entitled “Summary Report” which shall include notes on any major issues, agreements, or disagreements discussed during the Technical Kickoff Meeting. The Contractor shall submit the final updated Kickoff Meeting Power Point Presentation to the CO, CS, and COR for review three calendar days after the meeting. The Contractor shall prepare and distribute the Kickoff Meeting Minutes to the CO, CS, COR, and all attendees within three calendar days after the meeting.

Deliverables:

A. Kickoff Meeting Agenda B. Kickoff Meeting Power Point Presentation C. Kickoff Meeting Minutes

TRAINING

PRIVACY TRAINING

The Contractor shall submit Talent Management System (TMS) Training Certificates of completion for VA Privacy and Information Security Awareness and Rules of Behavior and provide signed copies of the Contractor Rules of Behavior in accordance with Section 9, Training, from Appendix C of the VA Handbook 6500.6, “Contract Security” which can be found at Addendum B of this PWS.

The Contractor shall track the status of VA Privacy and Information Security Awareness and Rules of Behavior training for all individuals engaged on each Level of Effort (LoE) under the contract. The status reporting shall identify a single Contractor Security Point of Contact (POC), the names of all personnel engaged on each LOE under the contract, their initial training date for VA Privacy and Information Security and Rules of Behavior training, and their next required training date. This information shall be submitted as part of the Contractor’s CPPMP. The training referenced above is required to be renewed annually.

Deliverable:

A. TMS Training Certificates (VA Privacy and Information Security Awareness and Rules of Behavior)

ELEVATED PERMISSIONS TRAINING

The Contractor shall ensure that all personnel have completed all required training prior to giving any elevated permissions to production or pre-prod environments as deemed by the VA’s Security regulations. The Contractor shall provide Elevated Permissions Training Documentation to allow Contractor staffs to work in FedRAMP environment.

Deliverable:

A. Elevated Permissions Training Documentation

ONBOARDING\OFFBOARDING

The Contractor shall manage the onboarding and offboarding of its staff. Onboarding shall include steps to obtain a VA network and email account, complete training, initiate background investigations, and gain physical and logical access to the Contractor’s facility, which may include elevated privileges to the necessary development and test environments for the various systems to be enhanced.

Offboarding shall include steps to work with VA DTC staff to promptly remove VA network and email account along with removing physical and logical access, which will include removing privileges to the necessary development and test environments for the various systems.

The Contractor shall provide a security clearance report with up-to-date information on all staff members security clearance status including date of re-certification and their expiration dates.

A single Contractor Onboarding POC shall be designated by the Contractor who tracks the onboarding and offboarding status of all Contractor personnel. The Contractor Onboarding\Offboarding POC shall be responsible for accurate and timely submission of all required VA onboarding\offboarding paperwork to the COR or his/her designee. The Contractor shall be responsible for tracking the status of all its staff’s onboarding \offboarding activities. The Contractor shall provide an Onboarding\Offboarding Status Report bi-weekly which includes updates for all in-process staff, security clearance status for all staff members, and any staff with outstanding onboarding\offboarding requests for review by the COR and his/her designee. The Onboarding\Offboarding Status Report shall include a column reflecting the DTC Federal Platform Lead that each Contractor personnel will be supporting.

Deliverable:

A. Onboarding\Offboarding Status Report

PROJECT MANAGEMENT AND OVERSIGHT/KEY PERSONNEL

The Contractor shall provide resources that have the requisite skills and experience required to perform the tasks within the PWS. The Contractor agrees that the personnel identified below, as key to supporting this effort, shall not be removed from the effort, replaced, or added without a compelling reason and without written notification to the CO/COR/PM.

The Contractor shall provide Contractor support personnel and subcontractors who have the required educational background, experience, security clearance, and access authorization or combination thereof to meet the labor category descriptions for the required PWS tasks.

The Contractor shall participate in DTC work groups as requested by the VA DTC Directors.

If any change to the Key Personnel assigned to the labor categories identified below becomes necessary (initial staffing, substitutions, or additions), the Contractor shall immediately notify the CO/CS/COR/PM in writing. The proposed replacement personnel shall be of at least substantially equal ability and qualifications as the individual(s) currently performing in that category and that the proposed replacement meets or exceeds the qualifications designated for that Key Personnel position. The substitution or replacement of the personnel shall not occur within the first six months after the date of award unless there are extenuating circumstances agreed to by the DTC Director.

The Contractor agrees that it has a contractual obligation to mitigate the consequences of the loss of Key Personnel. The Contractor shall promptly secure any necessary replacements in accordance with (IAW) this PWS section. Failure to replace a member of the Key Personnel pursuant to this clause and without a break in performance of the labor category at issue shall be considered a condition endangering contract performance and may provide grounds for termination for default.

All Contractor personnel shall be available on VA Teams and respond to VA emails within 24 hours of receipt. All business done in support of DTC OMEGA shall be conducted from VA issued accounts, once credentials are received. All artifacts generated in support of DTC OMEGA shall be stored on a VA-approved repository.

The labor categories below are identified as Key Personnel. The Contractor shall provide Key Personnel that meet the corresponding requirements identified in the Labor Description column below:

Program Manager (Senior Program Manager)

· Shall oversee all functions, personnel, and contract deliverables of the DTC Center of Excellence (COE). This resource shall have at least three years’ experience in managing enterprise Salesforce, Microsoft Power Platform, Pega, or Appian platform delivery solutions.

· This resource shall have at least 15 years of demonstrated experience managing large IT enterprise projects with 10 team members or more.. This resource shall be a Certified Administrator and shall have a post baccalaureate degree.

Platform Architect (Lead Architect Platform - PaaS/SaaS)

· Shall be a Salesforce, Microsoft Power Platform, Pega, Appian or any approved DTC Ecosystem vendor platform Certified Technical Architect (CTA) credential, Certified Application Architect, or a Certified System Architect.

· Shall have extensive experience (at least five+ years) and depth of understanding of experience with large scale Low Code/No Code (LC/NC) platform deployments.

Software/System Architect, Senior (Lead Architect - (Integration)/Emerging Tech)

· Shall have all the certifications listed below.

· MuleSoft Certified Developer - Integration and API Associate, MuleSoft Certified Developer - Integration Professional, MuleSoft Certified Platform Architect, MuleSoft Certified Integration Architect.

Business Process Expert (PaaS/SaaS/IT SME - Product Manager)

· Shall have a minimum of at least two of the following Salesforce Design Certifications: Certified Identity and Access Management Designer, Certified Data Architecture and Management Designer Certified Sharing and Visibility Designer, Certified Development Lifecycle and Deployment Designer, Certified Integration Architecture Designer. The resource shall also be a Salesforce Certified Administrator.

· Shall have a minimum of two mid-level Industry Recognized certifications for each respective PaaS CoE ecosystem platforms (listed in Attachment 6) for which PaaS CoE the resource is assigned to.

· Shall have extensive experience (at least five+ years) and depth of understanding of all other PaaS CoE ecosystem platforms and experience with large scale PaaS platforms deployments. The resource will oversee the PaaS CoE architecture from a technical perspective, lead and manage a Tier 2/Tier 3 Support and Sustainment team.

Project Manager (Project Manager/PSL)

· Shall have a minimum of Associate’s + four years’ experience, Bachelor’s + two years’ experience, or five-years’ experience of relevant project management experience can be substituted in lieu of a degree of project management managing multiple concurrent LCNC product and platform focused projects across various and asynchronous delivery lifecycle phases with individual project value over $5 million dollars each.

· One Entry level industry recognized cloud/cyber certification is required, Certificate of Cloud Security Knowledge (CCSK), Security+, Systems Security Certified Practitioner (SSCP), etc.

· Written communications to provide actionable project plans, roadmaps, executive briefings focusing on outcome and impact.

· Verbal communication skills to clearly articulate project deliverables, timeline constraints, action items, next steps, escalation levers, and blockers to customers, support members, and third-party participants.

Developer (Technical Configurator)

· Bachelor’s degree in computer science, Information Technology, or a related field

· Minimum of two years of professional experience working with low-code/no-code platforms

· Proficiency (Certified) in one or more popular low-code/no-code platforms such as Salesforce, Microsoft Power Apps, Pega, or Appian

· Strong problem-solving skills and the ability to translate business requirements into technical solutions

Developer, Senior (Senior LCNC Platform Engineer)

· Bachelor’s degree in computer science, Information Technology, or a related field

· At least 4 years of work experience in software development and implementation

· Experience of leading a team with at least 5 members

· Deep understanding of application design, development, support, and enhancement lifecycle

· Strong track record working as a technical lead to perform process analysis, gather business requirements, and develop/configure digital applications.

· Experience working in software development life cycle (Agile) across all phases including design, development, testing, implementation, deployment, maintenance.

Business Analyst, Senior (IT Business Relationship Liaison) (Project Management/PSL Resource Manager)

· Associates+ four years’ experience, Bachelor’s +two years’ experience, five years’ experience can be substituted in lieu of a degree for managing relationships across diverse audiences from technology partners, customers, end users, executive leadership, and vendors to objectively communicate project deliverables, expectations, and contingencies.

· One industry recognized cloud/cyber certification is required. CCSK, Security+, SSCP, etc.

· One industry recognized project management certification is preferred.

· Communicate the requirements, feedback, and status of target solution delivery.

· Communicate timeline considerations, escalation levers, deliverable contingencies, and completion goals.

· Verbal communication maturity to understand your audience and communicate appropriately based on the context, role, rank, and requirements from a varied potential audience base.

· Witten communication maturity to understand your audience and communicate appropriately based on the context, role, rank, and requirements from a varied potential audience base. Must be able to clearly articulate dependencies in plain language with a call to action.

· Strategize across audiences by applying knowledge of business architecture and LCNC system of system engineering to identify, manage, and resolve solution delivery risks, future requirements, and prioritization change management.

· Leverage agile best practices to dynamically manage multiple projects with work in progress that may have external dependencies.

Functional Area Expert II (Security Lead) (Security Team Resource Manager)

· Shall have five+ experience and depth of understanding Platform Security requirements and experience with NIST security requirements on large scale deployments.

· Shall possess a current Certified Information Systems Security Professional (CISSP), no substitutions will be accepted.

· Minimum of 7 years of experience with the following:

· Expertise in the FedRAMP Program methodology, understanding and working knowledge of Third-party Assessor Organization (3PAO) assessments for cloud service providers and cloud service offerings. Understanding and working knowledge interpreting 3PAO assessment findings for vulnerabilities, customer responsibility, and continuous monitoring activities.

· Responsible for all tasks related to cloud security actions required to accomplish Risk Management Framework (RMF) workflows including but not limited to tasks associated with the ATO and security/privacy documentation.

· Expertise to define requirements for use case onboarding of SaaS and PaaS solutions following an ATO.

· Competent to manage multiple projects through the entire RMF lifecycle including decommissioning after product sunset occurs.

· Expertise in developing repeatable templates to leverage to answer hybrid and customer responsible security controls and ensuring total team compliance in leveraging necessary templates and tools.

· Expertise in training and managing a team of security professionals to execute against a significant volume of work in progress leveraging agile best practices.

· Responsible to support audit findings, remediation activities, and documentation gaps as well as train others against best practices to achieve maximum ATO duration.

· At least five years of hands-on experience training, leading, and managing a team. At least 3 years of hands-on experience managing performance and team standards including collecting input from customers and adjusting expectations as needed.

Functional Area Expert I (FedRamp Lead Technical SME)

· Minimum of seven years of experience with the following:

· Expertise in the FedRAMP Program methodology, understanding and working knowledge of Third-party Assessor Organization (3PAO) assessments for cloud service providers and cloud service offerings. Understanding and working knowledge interpreting 3PAO assessment findings for vulnerabilities, customer responsibility, and continuous monitoring activities.

· Shall have at least two industry recognized certificates. CISSP preferred. Other acceptable certificates include Security+, Certified Information Security Manager (CISM), GIAC Security Essentials Certification (GSEC), CCSK.

· Expertise in reviewing FedRAMP Security documentation for completion, gaps, vulnerabilities, and identifying remediations that may be required.

· Expertise in developing Plans of Actions and Milestones (POA&M) for cloud services.

· Demonstrated understanding of current cloud deployment best practices and governing policy such as NIST, FIPS, RMF, FedRAMP, etc.

· Expertise in developing repeatable templates to leverage to answer hybrid and customer responsible security controls and ensuring total team compliance in leveraging necessary templates and tools.

· Expertise in training and managing a team of security professionals to execute against a significant volume of work in progress leveraging agile best practices.

· Responsible to support audit findings, remediation activities, and documentation gaps as well as train others against best practices to achieve maximum ATO duration.

CyberSecurity Engineer (CyberSecurity Engineer)

· Associate’s +four years’ experience, Bachelor’s+ two years’ experience, five years’ experience can be substituted in lieu of a degree

· Shall have at least 1 industry recognized certificate. May include Security+, CISM, GSEC, CCSK, etc.

· Responsible for operational oversight, configuration, and delivery of security controls as outlined across various assessment and authorization (A&A) requirements.

· Communicate the security requirements, feedback, and status of target solution delivery across various audience inclusive of DTC, OIS, vendor, GSA teams.

· Comply with VA OIS’ guidance and direction.

· Manage DTC delivery and completion of security authorization requirements.

· Collaborate across audiences by applying knowledge of security architecture and LCNC security authorization controls and protocols to identify, manage, and resolve solution delivery risks, future security requirements, and prioritization change management.

· Be able to identify when additional expertise and/or support will be required to assist a VA customer in satisfactorily responding to end user controls.

· Develop processes, SOPs, AUPs, and other end user guides to ensure customer responsible controls are meeting security best practice standards.

Release Manager (Release Manager)

· Shall have extensive experience (five+ years) and depth of understanding of an enterprise level platform and application release synchronous and on-demand (Continuous integration/continuous delivery (CI/CD) release cycles for a diverse technology platform and product ecosystem with large scale deployments.

· Responsible for all releases to production. For each identified platform, release managers, at least one must be a Certified Development Lifecycle and Deployment Designer.

Customer Service Manager (End User Support Manager)

· Shall lead…