Draft PWS Oracle Retail Upgrade and SIM Migration.pdf

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Veterans Canteen Service (VCS)

Oracle Retail Upgrade and Store Inventory Management (SIM) Migration

Date: March 26, 2025

VA-25-00055285

PWS Version Number: 1.0

Contents

1.0 BACKGROUND

2.0 APPLICABLE DOCUMENTS

3.0 SCOPE OF WORK

4.0 PERFORMANCE DETAILS

4.1 PERFORMANCE PERIOD

4.2 PLACE OF PERFORMANCE

4.3 TRAVEL

5.0 SPECIFIC TASKS AND DELIVERABLES

5.1 PROJECT MANAGEMENT

5.1.1 CONTRACTOR PROJECT MANAGEMENT PLAN

5.1.2 REPORTING REQUIREMENTS

5.1.3 TECHNICAL KICKOFF MEETING

5.1.4 IMPLEMENTATION PLANNING

5.2 VCS SYSTEMS UPGRADE ASSESSMENTS

5.3 VCS RETAIL UPGRADE AND SIM MIGRATION

5.3.1 ORACLE RETAIL UPGRADE

5.3.2 ORACLE SIM MIGRATION

5.3.3 CUSTOM-BUILT COMPONENTS

5.3.4 SERVER ENVIRONMENTS

5.4 HANDHELD DEVICE REPLACEMENTS

5.5 SYSTEM TRAINING

5.6 INTERFACE INTEGRATION

5.7 SYSTEM CONFIGURATION

5.8 SYSTEM TESTING

5.9 HELP DESK SERVICES

5.10 SYSTEM DEPLOYMENT

5.11 OPERATIONS & MAINTENANCE

5.12 DEVICE INVENTORY MANAGEMENT

5.13 ASSESSMENT, AUTHORIZATION, AND CONTINUOUS MONITORING ... 25

5.13.1 IF THE SOLUTION IS FEDRAMP AUTHORIZED BUT NOT VA

AUTHORIZED:

5.14 DEVICE INVENTORY OPTIONAL TASKS (FFP)

5.14.1 HANDHELD SCANNER UNITS (OPTIONAL TASK ONE)

5.14.2 LABEL PRINTER UNITS (OPTIONAL TASK TWO)

5.14.3 VENDMAX DEVICES (OPTIONAL TASK THREE)

5.14.4 ADDITIONAL SITE DEVICE EXPANSION (OPTIONAL TASK FOUR) .. 27

5.15 TRANSITION OUT SUPPORT (OPTIONAL TASK FIVE)

5.16 OPTION PERIOD ONE

5.17 OPTION PERIOD TWO

5.18 OPTION PERIOD THREE

5.19 OPTION PERIOD FOUR

6.0 GENERAL REQUIREMENTS

6.1 ENTERPRISE AND IT FRAMEWORK

6.1.1 VA TECHNICAL REFERENCE MODEL

6.1.2 FEDERAL IDENTITY, CREDENTIAL, AND ACCESS MANAGEMENT

(FICAM)

6.1.3 INTERNET PROTOCOL VERSION 6 (IPV6)

6.1.4 TRUSTED INTERNET CONNECTION (TIC)

6.1.5 STANDARD COMPUTER CONFIGURATION

6.1.6 VETERAN FOCUSED INTEGRATION PROCESS (VIP) AND PRODUCT

LINE MANAGEMENT (PLM)

6.1.7 PROCESS ASSET LIBRARY (PAL)

6.1.8 AUTHORITATIVE DATA SOURCES

6.1.9 SOCIAL SECURITY NUMBER (SSN) REDUCTION

6.1.10 SOFTWARE AND LICENSING REQUIREMENTS

6.2 SECURITY AND PRIVACY REQUIREMENTS

6.2.1 POSITION/TASK RISK DESIGNATION LEVEL(S)

6.2.2 CONTRACTOR PERSONNEL SECURITY REQUIREMENTS

6.3 METHOD AND DISTRIBUTION OF DELIVERABLES

6.4 PERFORMANCE METRICS

6.5 FACILITY/RESOURCE PROVISIONS

6.6 GOVERNMENT FURNISHED PROPERTY

6.7 SHIPMENT OF HARDWARE OR EQUIPMENT

7.0 ADDENDUM A – ADDITIONAL VA REQUIREMENTS, CONSOLIDATED

8.0 ADDENDUM B – VA INFORMATION AND INFORMATION SYSTEM

SECURITY/PRIVACY LANGUAGE

1.0 BACKGROUND

Established in 1946 (Public Law 636, 79th Congress), the Veterans Canteen Service’s (VCS) mission is “to provide America’s Veterans, enrolled in the VA’s Health Care System, their families, caregivers, VA employees, volunteers, and visitors, reasonably priced merchandise and services essential to their comfort and well-being.” VCS is a non-appropriated, governmental, and retail-centric organization operating within the Department of Veterans Affairs (VA), Veterans Health Administration (VHA). VCS’s Central Office (VCSCO) is based in Saint Louis, Missouri (MO). VCS operates approximately 220 PatriotStore (retail), PatriotCafé (food), and PatriotBrew (Coffee) stores, which are located in VA Medical Centers, Community-Based Outpatient Clinics (CBOC), Outpatient Clinics (OPC), and VBA offices throughout the United States and its territories. VCS’s business operations include retail, food, coffee, and vending services.

Over 49,000 different products are sold by VCS, and over 40 million customers make purchases of food, coffee, and retail merchandise at the canteens each year.

VCS operations nationwide rely on retail IT systems that need to meet the current VA IT Security requirements. VCS needs two key systems upgraded/modernized to include the Oracle Retail System and the Oracle Retail Store Inventory Management (SIM) system. Modernizing the SIM system includes replacing all Handheld Scanners (~450), Portable Label Printers (~275), Vending Machine to VendMAX Interface Devices (~200), and associated Peripherals (e.g. cradles, cords, etc.).

2.0 APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. 44 U.S.C. § 3541-3549, “Federal Information Security Management Act (FISMA) of 2002”

2. “Federal Information Security Modernization Act of 2014”

3. Federal Information Processing Standards (FIPS) Publication 140-2, “Security Requirements for Cryptographic Modules”

4. FIPS Pub 199. “Standards for Security Categorization of Federal Information and Information Systems,” February 2004

5. FIPS Pub 200, “Minimum Security Requirements for Federal Information and

Information Systems,” March 2006

6. FIPS Pub 201-2, “Personal Identity Verification of Federal Employees and

Contractors,” August 2013

7. 10 U.S.C. § 2224, "Defense Information Assurance Program"

8. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

9. Public Law 109-461, Veterans Benefits, Health Care, and Information

Technology Act of 2006, Title IX, Information Security Matters

10. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”

11. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, https://www.va.gov/vapubs/index.cfm https://www.va.gov/vapubs/index.cfm

12. VA Handbook 0710, “Personnel Security and Suitability Program,” May 2, 2016, https://www.va.gov/vapubs/index.cfmhttp://www.va.gov/vapubs

13. VA Directive and Handbook 6102, “Internet/Intranet Services,” August 5,

14. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and Guidelines,” January 18, 2017

15. Office of Management and Budget (OMB) Circular A-130, “Managing Federal Information as a Strategic Resource,” July 28, 2016

16. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed Services (CHAMPUS)”

17. NIST SP 800-66 Rev. 1, “An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule,” October 2008

18. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended, January 18, 2017

19. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

20. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021

21. VA Handbook 6500, “Risk Management Framework for VA Information

Systems VA Information Security Program,” February 24, 2021

22. VA Handbook 6500.2, “Management of Breaches Involving Sensitive

Personal Information (SPI),” March 12, 2019

23. VA Handbook 6500.5, “Incorporating Security and Privacy into the System

Development Lifecycle,” March 22, 2010

24. VA Handbook 6500.6, “Contract Security,” March 12, 2010

25. VA Handbook 6500.8, “Information System Contingency Planning,” April 6,

26. VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018

27. VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017

28. OIT Process Asset Library (PAL), https://www.va.gov/process/ . Reference

Process Maps at https://www.va.gov/process/maps.asp and Artifact templates at https://www.va.gov/process/artifacts.asp

29. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

30. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014

31. VA Handbook 6508.1, “Procedures for Privacy Threshold Analysis and Privacy Impact Assessment,” July 30, 2015

32. VA Handbook 6510, “VA Identity and Access Management,” January 15,

33. VA Directive and Handbook 6513, “Secure External Connections,” October 12, 2017

34. VA Directive 6300, “Records and Information Management,” September 21,

35. VA Handbook, 6300.1, “Records Management Procedures,“ March 24, 2010 https://www.va.gov/vapubs/index.cfm http://www.va.gov/vapubs https://www.va.gov/process/ https://www.va.gov/process/maps.asp https://www.va.gov/process/artifacts.asp https://www.va.gov/trm/TRMHomePage.aspx

36. NIST SP 800-37 Rev 2, “Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy,” December 2018

37. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020)

38. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015

39. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-

12) Program,” March 24, 2014

40. OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005

41. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019

42. OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008

43. Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance, December 2, 2011, (NOTE: Part A of the FICAM Roadmap and Implementation Guidance, v2.0, was replaced in 2015 with an updated Architecture (https://arch.idmanagement.gov/#what-is-the-ficam-architecture)

44. NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access,“ June 2018

45. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, “Digital Identity Guidelines,” updated March 02, 2020

46. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014

47. NIST SP 800-164, “Guidelines on Hardware-Rooted Security in Mobile

Devices (Draft),” October 2012

48. Draft National Institute of Standards and Technology Interagency Report

(NISTIR) 7981, “Mobile, PIV, and Authentication,” March 2014

49. VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland

Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

50. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

51. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

52. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

53. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019

54. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008 https://arch.idmanagement.gov/#what-is-the-ficam-architecture https://arch.idmanagement.gov/#what-is-the-ficam-architecture https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514 https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896 https://www.cisa.gov/publication/tic-30-core-guidance-documents

55. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (Public Law 110–140), December 19, 2007

56. Section 104 of the Energy Policy Act of 2005, (Public Law 109–58), August 8, 2005

57. Executive Order 13834, “Efficient Federal Operations,” dated May 17, 2018

58. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August

2, 2001

59. VA Directive 0058, “VA Green Purchasing Program,” July 19, 2013

60. VA Handbook 0058, “VA Green Purchasing Program,” July 19, 2013

61. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote

Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

62. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

63. “Veteran Focused Integration Process (VIP) Guide 4.0,” January 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

64. VA Memorandum “Proper Use of Email and Other Messaging Services,”

January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

65. “DevSecOps Product Line Management Playbook” version 2.0, May 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

66. NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020

67. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol

Version 6 (IPv6),” November 19, 2020

68. Social Security Number (SSN) Fraud Prevention Act of 2017

69. Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23,

3.0 SCOPE OF WORK

The Contractor shall upgrade the existing Oracle Retail System Version 13 to the on-prem Version 19C to include any required data migration and system integration to meet VA IT security requirements and ensure system functionality and interoperability is maintained. The Oracle Retail System Version 19C does not include an Oracle-supported SIM module. The Contractor shall migrate the existing on-prem SIM module to the latest Oracle SIM Software as a Service (SaaS) Version to include any required data migration and system integration to meet VA IT security requirements and ensure system functionality and interoperability is maintained. The Contractor shall deliver non-brand specific replacement for VCS’s existing Handheld Scanners, Portable Label Printers, and Vending Machine to VendMAX Interface Devices, and associated Peripherals (e.g. cradles, cords, etc.) that are utilized by and connected to the SIM system. The Contractor shall also provide a mobile device management solution to maintain, upgrade, configure, and track all mobile scanner and printer devices.

The Contractor shall perform an assessment to determine what will be required to complete the system upgrades/modernizations. The contractor shall complete the implementation of the upgrades and provide maintenance and sustainment of the systems throughout the Period of Performance (PoP).

https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371 https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

3.1 ORDER TYPE

The effort shall be proposed on a Firm-Fixed Price (FFP) basis.

4.0 PERFORMANCE DETAILS

4.1 PERFORMANCE PERIOD

The Period of Performance (PoP) shall be 12 months with four 12-month option periods and five Optional Tasks, if exercised by the VA. The total Task Order (TO) Period of Performance shall not exceed 60 months, inclusive of all options.

Any work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO).

There are eleven (11) Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, four are set by date:

New Year's Day January 1 Juneteenth June 19 Independence Day July 4 Veterans Day November 11 Christmas Day December 25

If any of the above falls on a Saturday, then Friday shall be observed as a holiday.

Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

Martin Luther King's Birthday Third Monday in January Washington's Birthday Third Monday in February Memorial Day Last Monday in May Labor Day First Monday in September Columbus Day Second Monday in October Thanksgiving Fourth Thursday in November

4.2 PLACE OF PERFORMANCE

Tasks under this PWS that shall be performed at Contractor facilities to include development, configuration, implementation, and testing of the systems prior to deployment to the VCS testing facility for government acceptance testing.

The Contractor shall identify the Contractor’s place of performance location in their proposal. Work may be performed at remote locations with prior concurrence from the Contracting Officer’s Representative (COR).

4.3 TRAVEL

The Government does not anticipate any travel under this effort.

5.0 SPECIFIC TASKS AND DELIVERABLES

5.1 PROJECT MANAGEMENT

5.1.1 CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall manage, plan, govern, coordinate, execute, and report on all tasks and activities performed under this TO. The Contractor shall provide management, ensure compliance, measure performance, and report on program activities throughout the contract PoP. The Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, timeline, and tools to be used in execution of the contract. The CPMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks, and resource support. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPMP shall be presented at the kick-off meeting and concurred upon with the VA and Contractor and updated in accordance with Section B of the contract.

The Contractor shall update and maintain the VA PM approved CPMP throughout the PoP.

Deliverable:

A. Contractor Project Management Plan

5.1.2 REPORTING REQUIREMENTS

The Contractor shall provide the COR with Monthly Progress Reports 30 days after contract award and every 30 days thereafter, in electronic form in Microsoft Word and Project formats. The report shall include detailed instructions/explanations for each required data element, to ensure that data is accurate and consistent. These reports shall reflect data as of the last day of the preceding month.

The Monthly Progress Reports shall cover all work completed during the reporting period and work planned for the subsequent reporting period. The report shall also identify any problems that arose and a description of how the problems were resolved. If problems have not been completely resolved, the Contractor shall provide an explanation including their plan and timeframe for resolving the issue. The reports shall include status of the Authority to Operate (ATO) and FedRAMP approvals. The report shall also include an itemized list of all Information and Communication Technology (ICT) deliverables and their current Section 508 conformance status. The Contractor shall monitor performance against the CPMP and report any deviations. It is expected that the Contractor will notify VA within 24 hours of any problems/issues that arise to ensure communication remains transparent to both parties to prevent escalation of outstanding problem/issues.

Deliverable:

A. Monthly Progress Report

5.1.3 TECHNICAL KICKOFF MEETING

A technical kickoff meeting shall be held within 10 calendar days after TO award. The Contractor shall coordinate the date, time, and location (can be virtual). The VA COR/PM, Contracting Officer (CO) and Contract Specialist (CS) shall attend virtually The Contractor shall provide a draft Kickoff Meeting Agenda to the CO and VA PM at least five calendar days prior to the meeting. Upon Government approval of a final agenda, the Contractor shall distribute to all meeting attendees. During the kickoff meeting, the Contractor shall present, for review and approval by the Government, the details of the intended approach, work plan, and project schedule for each effort via a Microsoft Office PowerPoint presentation. At the conclusion of the meeting, the Contractor shall update the presentation with a final slide entitled “Summary Report” which shall include notes on any major issues, agreements, or disagreements discussed during the kickoff meeting. The Contractor shall submit the final updated presentation to the CO for review and signature within three calendar days after the meeting. The Contractor shall also work with the CS and the Government’s designated note taker, to prepare and distribute the Meeting Minutes of the kickoff meeting to the CO, COR and all attendees within three calendar days after the meeting. The Contractor shall obtain concurrence from the CS on the content of the meeting minutes prior to distribution of the document.

Deliverable:

A. Kickoff Meeting Agenda B. Kickoff Meeting Minutes C. Kickoff Meeting Agenda and Meeting Minutes

5.1.4 IMPLEMENTATION PLANNING

The Contractor shall develop, maintain, and execute an Implementation Plan that defines the implementation approach and details the actions that must be performed by both the Contractor and VA to prepare for system upgrades, acceptance testing, user training, nationwide phased rollout, rollout status monitoring, and completion of the rollout phase.

The Implementation Plan shall be delivered three business days after the completion of the Upgrade Assessment and shall include all implementation and deployment processes and activities (prior to, during, and after), migration of data, test strategy and testing, setup and configuration procedure, inventory of information technology (IT) assets, implementation checklist, risk assessment, key dependencies, and schedule.

The Contractor shall coordinate and obtain Government agreement to the hardware delivery schedules shall be coordinated and mutually agreed upon with the Government. As part of the Implementation Plan, the Contractor shall develop and execute a Phased Rollout Plan, that defines the approach and action plans to prepare VA stakeholders to receive and operate the upgraded systems. This includes improving stakeholder engagement, outreach, and communications. Updates to the plan shall be completed as required throughout the performance of this task order.

Within three business days of the completion of each implementation phase, the Contractor shall provide an Implementation Summary Report that summarizes the implementation and deployment, describes implementation results, lessons learned, open issues, corrective action, and improvement opportunities. The Contractor shall resolve all outstanding issues or concerns prior to the systems transitioning into sustainment.

Deliverables:

A. Implementation Plan B. Implementation Summary Report

5.2 VCS SYSTEMS UPGRADE ASSESSMENTS

The Contractor shall complete an assessment to determine the steps needed to upgrade the current Oracle Retail on-prem system to the upgraded Oracle Retail version 19C and to migrate the current Oracle SIM on-prem system to the latest Oracle SIM SaaS version. The assessment shall include the selection of a non-brand specific replacement for each of VCS’s existing Handheld Scanners, Printers, Vending Machine to VendMAX Interface Devices, and associated Peripherals that shall seamlessly integrate into the Oracle SIM system once migrated to the Cloud version. Attachment A provides high level descriptions of the Oracle Retail System Modules, Reporting Modules, Retail User Account Management, Retail Interfaces, Retail Scripts and Platform/Server Types/Environments to use as reference.

The Assessment Phase shall include the following activities:

1. Assessment Kickoff: As a team develop agreed upon objectives, scope, and key deliverables.

2. Current Process Review: Evaluate existing operations and workflows to ensure thorough understanding.

3. Retail and SIM Customizations: Identify and evaluate any customizations in the current Retail and SIM implementation.

4. Implementation Phase: Design high-level implementation strategy in collaboration with stakeholders.

5. Technical Integration: Evaluate the current architecture, assess integration touchpoints and identify key technical requirements for the upgrade.

6. Future Supportability: Evaluate current and future state of Retail and SIM systems to ensure long-term maintainability and alignment with VCS support capabilities.

At the completion of the assessment, the contractor shall create and deliver to the VA a System Upgrade Assessment Report within 30 days after award. The System Upgrade Assessment Report shall contain the following:

1. High-level program timeline for upgrades

2. Defined responsibilities for Contractor/VA

3. Plan for system integration and implementation

4. Plan for migrating and validating data, system functionality and interoperability

5. Plan for assessing risks and remediation

Deliverables:

A. System Upgrade Assessment Report

5.3 VCS RETAIL UPGRADE AND SIM MIGRATION

Based on the results of the System Upgrade Assessment Report, the Contractor shall upgrade the following systems as outlined below to include any required integration to meet VA IT security requirements and through testing ensure system functionality and interoperability is maintained prior to System Deployment.

5.3.1 ORACLE RETAIL UPGRADE

For the Oracle Retail Upgrade, the Contractor shall upgrade the current on-premises Oracle Retail System from version 13 to version 19c to meet VA IT security requirements. The following components shall be included in this upgrade:

1. Oracle Retail Management System (RMS)

2. Oracle Retail Invoice Matching (ReIM)

3. Oracle Retail Price Management (RPM)

4. Oracle Retail Sales Audit (RESA)

5. Oracle Retail Data Warehouse (RDW)

6. Oracle Business Intelligence Enterprise Edition (OBIEE) / Oracle Analytics

Server (OAS)

7. Oracle Retail Integration Bus (RIB)

8. Oracle Retail Extract, Transform, and Load (RETL)

The Contractor shall ensure all Retail Components are migrated to the upgraded Retail system ensuring they maintain existing functionality and interoperability as required prior to system deployment.

5.3.2 ORACLE SIM MIGRATION

The Oracle Retail System Version 19C does not include an Oracle-supported SIM module. The Contractor shall migrate the current Oracle SIM on-premises system which is near end of life to the latest Oracle SaaS SIM version. As part of the migration the Contractor shall ensure any required data is migrated to the SaaS version and ensure the SaaS version is integrated with required systems ensuring system functionality and interoperability is maintained along with meeting VA IT security requirements.

The Contractor shall provide an MDM application for the devices that provides the ability to update daily price information enabling VCS to produce labels in an offline environment. The MDM application shall be capable of managing network certificates that are required for connection to the VA Wi-Fi network.

The Contractor shall ensure all SIM Components are migrated to the new SIM system ensuring they maintain existing functionality and interoperability as required prior to system deployment.

5.3.3 CUSTOM-BUILT COMPONENTS

The Retail on-premises upgrade and SIM SaaS migration effort shall also require the Contractor to modify and/or create many custom-built components including:

1. Interfaces

2. Extract, Transform and Load (ETL) scripts (more than 1,000 Korn shell scripts)

3. Reporting modules

4. Electronic Data Interchange (EDI) connections/transfers

5. Automated/scripted file transfers

6. Mainframe CA-7 Job Scheduler Scripts

7. End-user/account management interfaces

The Contractor shall ensure through testing all custom-built components are migrated to the new system and ensure they are fully functional and interoperable as required prior to system deployment.

5.3.4 SERVER ENVIRONMENTS

The Contractor shall upgrade four (4) separate server environments. The current Oracle Retail database and application reside on the same application servers. As part of the upgrade process, the Contractor shall move the database and applications to separate servers to comply with VA IT policy and best practices. The Contractor shall provide VA the hardware specifications required for the Oracle Upgrade, so VA OIT IT technical team can provide and update/upgrade the servers with any additional hardware required.

The Contractor shall establish system monitoring and dashboard content to properly monitor system performance and reliability in coordination with the OIT monitoring team.

5.4 HANDHELD DEVICE REPLACEMENTS

The handheld devices are an integral part of the store’s retail inventory management and shall be capable of enabling store personnel to easily manage daily retail inventory operations, reduce time spent on time-consuming tasks. The VCS currently has approximately 450 scanners, 275 label printers, and 200 vending machine adapters, including backup stock, that are being utilized by the canteens. For the Handheld device replacements, the Contractor shall provide non-brand specific replacements for VCS’s existing mobile inventory/price management solution, inclusive of all required hardware to include scanners, label printers, vending machine to VendMAX interface devices and associated peripherals to include labels for the printers, for VCS to perform in-store inventory management processes and capture and transmit vending machine data to the existing on-prem VendMAX system. The solution shall minimize manual data entry and re-entry, reduce paper, and maximize automation including barcode scanning, inventory transaction management, item and shelf label creation and maintenance and vending machine sales data exchange. The devices shall be compatible with the Oracle inventory management system for the purpose of doing stock counts, receiving and compatible with the VCS offline application to print shelf and item labels, if the capability is not natively provided by Vendor solution. The devices shall be compatible with the existing on-prem VendMax application to facilitate Data Exchange (DEX) between the vending machines and VendMax.

The handheld scanners shall:

1. Be fully compatible with the Oracle SIM System

2. Be capable of capturing and exchanging vending machine data into VendMax application and the SIM system

3. Integrate with Bluetooth DEX fob and/or wired DEX cable for data exchange.

a. Vending machine connections utilize a ¼” Bluetooth fob or a cable with a standard ¼” plug connection and a minimum length of 40”.

4. Have the ability to load and operate multiple applications on one device

5. Operate in Wi-Fi and non-Wi-Fi environments

6. Be capable to run in “off-line” mode to store information that can be downloaded at a later time (for example, store and forward)

6. Have the capability to authenticate devices and applications with a VA PIV card

(internal or external PIV reader). Shall have multi-factor authentication and administration security controls to ensure appropriate functionality to end users when authenticated.

7. Be at a minimum FIPS 140-2 compliant and NIST certified. It is anticipated that FIPS 140-3 compliance will be required no later than September 21, 2026.

The label printers shall:

1. Be completely wireless with Wi-Fi and Bluetooth connection capability.

2. Print on demand up to 4” wide labels at a rate of 250 labels per day.

3. Allow VCS business users to create custom labels.

4. Provide the capability to produce labels in color and black and white.

5. Have rechargeable lithium-ion batteries, battery charger cradles and USB PC cords.

The printer labels shall be direct thermal labels with permanent adhesive, black mark sensing for label accuracy and perforated between each label. The Contractor shall deliver 1-3 boxes (36 rolls/350 labels per roll) as directed by VCSCO based on location as the initial quantities. All labels shall fit the printer provided by the Contractor.

Contractor shall become Electronic Data Interchange (EDI) compliant. The following are EDI transactions that VCS utilizes:

850 Purchase Order Required for all suppliers currently receiving manual orders from VCS through faxed or emailed purchase orders.

810 Electronic Invoicing Required for all VCS suppliers 997 Inbound/Outbound Functional

Acknowledgement Required for all VCS suppliers

856 Advanced Shipping Notice (ASN) including UCC-128 Bar Code label

Required for all VCS suppliers

812 Electronic Credit/Debit Required for all VCS suppliers 855 Purchase Order Acknowledgement – change notification Required for all VCS suppliers

860 Purchase Order change – initiated by the buyer

Required for all VCS suppliers

The Contractor shall also provide a mobile device management solution that is capable of maintaining, updating, configuring, and tracking all mobile devices.

5.5 SYSTEM TRAINING

The Contractor shall provide virtual instructor led train-the-trainer User and IT support/system administrator training that enables VA to train other users on how to use or provide IT support for the upgraded systems.

The IT support/system administration training shall include all necessary topics for VA IT system administrators to maintain the upgraded Oracle on-premises systems at VA locations to include product updates, system backups, troubleshooting scenarios, system administration back-end system infrastructure content that encompasses all records, data and table configuration, and cause and effect implications to end user actions.

The User training shall include a comprehensive overview of the upgraded systems including at a minimum system functionality, user interface/user operability and ease of navigation of the systems, interfaces, features, critical configuration functions and operating requirements.

The Contractor shall provide a Training Plan 10 business days before the start of system testing that describes the Contractor’s training approach to satisfying the training requirements of this section. The Training Plan shall include a draft Training Schedule which shall also be delivered prior to the start of system testing. The Contractor shall update/finalize the draft training schedule with the VA as the training dates become solidified. The Contractor’s training schedule shall implement a phased approach to virtually training up to 100 VCS employees including training events for IT system administrators and training events for system users. The Contractor shall provide Training Materials for each training session 10 business days prior to the scheduled training session including any updated training materials. Training Materials shall include, but are not limited to, training presentations, user guides, training manuals, participant guides, activity sheets, and activity guides. When there are any new changes/updates to the systems (such as software version updates delivery, system function updates, and system configuration changes) the Contractor shall ensure effected Training Materials and user guides are updated prior to the next scheduled training sessions to ensure users are receiving the most up to date information during the training event. The Contractor shall record all training sessions for future reuse by VA and deliver them within five business days after training session has been completed.

Deliverables:

A. Training Plan and Training Schedule B. Training Materials C. Recorded Initial Training Session

5.6 INTERFACE INTEGRATION

The Contractor shall maintain the existing Retail and SIM system interfaces with the multiple internal and externals systems during the upgrade/migration. The contractor shall provide technical subject matter expertise to ensure the existing interfaces with multiple internal and external systems are maintained during the system upgrade/migration. The Contractor shall coordinate with the internal Government resource on all required configurations or protocol documentation and develop any required Application Programming Interfaces (API). Any changes to these interfaces regarding data transmission upon completion shall be continuously maintained by the Contractor. The Contractor shall obtain all necessary approvals for connectivity, such as but not limited to, any Change Control Board required processes and completion of any appropriate documentation necessary for interfaces under VA governance/authority.

Pertinent information and API documentation will be provided to the Contractor by VA OIT to ensure understanding for the implementation of reliable and secure connections to the APIs. The Contractor shall identify all the system inputs and outputs in order to interface with existing internal and external systems prior to implementation to be reviewed by the Government for approval. The Contractor shall implement the interfaces and comply with VA’s networking policies on the ports/protocols that are allowed.

The systems shall interface at the minimum with the following internal and external systems:

1. Oracle Financials version 12.2.11 and higher

2. VendMAX version 5.0.13.6 and higher

3. US Foods®

4. VCS Point of Sale Software Application Flooid version 3.107 and higher

5. St. Paul Software (SPS) Commerce Electronic Data Interchange or equivalent

6. Oracle Analytics Server/OBIEE (Custom Reports)

7. CA7/Control-M (Batch Scripts)

8. RTLog Archiving

9. VA Email System (system generated emails)

5.7 SYSTEM CONFIGURATION

The Contractor shall provide data migration from the Retail Data Warehouse (RDW), which is located on-premises and maintains sales and inventory information from the retail merchandising system. The Contractor shall also provide data migration from other storage areas within VA data repositories to the new environments including the existing retail application database and Electronic Data Interchange (EDI) Pre- Processor database used for validating EDI810 and inbound invoices.

The Contractor shall provide and maintain Retail and SIM Data Mapping documentation describing data flow through the applications, interface connections, and all data requirements for input/output into VCS systems, focusing on how and when the application passes/accepts data to/from other systems or end users. The Retail/SIM Data Mapping documentation shall be delivered 3 business days after the completion of the Upgrade Assessment and updated as required through system deployment.

The Contractor shall develop, maintain, and execute the Data Migration Plan that defines the data migration approach, processes and activities (prior to, during, and after), test strategy, setup and configuration procedures, data migration checklist, risk assessment, key dependencies, and schedule. The Contractor shall validate that the data has been successfully migrated as defined in the Data Migration Plan. The Data Migration Plan shall be delivered 3 business days after the completion of the Upgrade Assessment and updated as required through system deployment.

The Contractor shall evaluate, analyze, validate, and organize data before combining, reconciling, and migrating to the new hosting environment. The Contractor shall migrate the entire legacy environment to the new environment in a non-disruptive fashion, with zero downtime or interruptions to the customer.

The Contractor shall provide information and documentation to support operational and production readiness reviews and go-no-go decisions. The Contractor shall execute corrective actions to address gaps and provide all required data and prepare supporting documents/artifacts for the reviews.

A. Retail and SIM Data Mapping B. Data Migration Plan

5.8 SYSTEM TESTING

The Contractor shall test utilizing an Agile approach with incremental testing. The Contractor shall verify/validate the system and its components function properly to demonstrate the upgraded system operates, functions, and interoperates with partner systems as it did prior to the upgrade/migration. Testing shall ensure the systems are fully operable, interoperable with all required interfaces outlined in PWS Section 5.6, all data is successfully migrated including custom-built components, and in compliance with Section 508 Standards.

The Contractor shall develop a Test Strategy including test scripts that encompasses its testing approach within its testing environment for VCS review and approval. The Test Strategy shall be delivered 10 business days prior to the initial scheduled test event and updated as required throughout system testing. Testing shall include but is not limited to unit, system, reliability, interoperability, security, volume performance, load, installation, back-out, and rollback testing. The Test Strategy shall cover the entire testing approach and shall include Contractor User Acceptance Testing (CUAT), VCS Initial Operating Capability (IOC) testing, User Acceptance Testing (UAT), and the approach to remediation of issues.

The Contractor shall maintain all test environments ensuring all software and/or firmware is updated to the latest versions and any bugs within the system are fixed prior to starting any testing event. The Contractor shall update the latest test environment configuration to include the latest software/firmware versions and bug fixes prior to the start of each testing event.

The Contactor shall utilize their established VCS test environment hosted at their test facility for the CUAT. The Contractor shall conduct testing within its test environment. All test plan data including final testing scripts, test results, and release notes shall be provided to VCS as CUAT Test Results within 3 business days after completion of each CUAT test event.

The Contractor shall support VCS during their IOC testing within the VCS St. Louis, MO test environment. The Contractor shall ensure the optimal test environment is setup ensuring the test environment mirrors the final deployed environment. The Contractor shall assist the government test team as required throughout the testing event. The Contractor shall provide testing tools that include user prompts to guide the use of the application so that minimal technical support is needed by the user. The Contractor shall troubleshoot and resolve any issues that arise during IOC testing.

Upon completion of IOC testing, the Contractor shall support VCS with their UAT. The Contractor shall develop a UAT Test Plan to include test cases and assist with the collection of test results. The UAT Test Plan shall be delivered 10 business days prior to the scheduled test event. During VCS UAT the Contractor shall demonstrate all required data has been successfully migrated. Successful migration shall include demonstration that all legacy data has successfully been migrated to the new systems, validating data integrity, demonstrate that all data is accessible, and validating performance meets requirements. The Contractor shall review all UAT test results and verify them with VCS. The Contractor shall develop and deliver to VCS within 3 business days after completion of each test event a UAT Test report to include all test results and an action plan to resolve defects and issues identified during the UAT phase. The Contractor shall review all action plans with VCS for approval and provide progress updates.

Upon review, VCS will identify the criticality of the defects and prioritize the timing for the Contractor to remediate the issue. The Contractor shall resolve all defects in accordance with the timeline below and coordinate with the Government to troubleshoot issues:

1. Critical issues shall be remediated within two weeks.

2. High issues shall be remediated within three weeks.

3. Medium issues shall be remediated within four weeks.

4. Low issues shall be remediated within six weeks.

In the event the Contractor cannot resolve test defects within their environment, the Contractor shall connect virtually or go on-site to support defect resolution with Government personnel.

Deliverables:

A. Test Strategy B. CUAT Test Results C. UAT Test Plan D. UAT Test Report

5.9 HELP DESK SERVICES

The Contractor shall provide Help Desk support starting with the first system deployment. The Contractor shall provide help desk support for all of the products and services provided in accordance with this PWS. The Contractor shall provide help desk support for all users during the deployments at each canteen location and continue providing Help Desk support as needed throughout the contract PoP. The Contractor shall meet with VA project leads at least weekly to provide status of all known issues.

The Contractor shall capture any defects and issues identified during deployment for each site location. The Contractor shall take corrective actions for the defects and issues upon VA approval.

The Contractor shall provide Help Desk support services and technical support during normal business hours Monday through Friday 6:00 a.m. Eastern Standard Time (EST) to 8:00 p.m. EST throughout the PoP. A self-service portal shall be provided 24/7 and monitored Monday through Friday 6:00 a.m. EST to 8:00 p.m. EST.

An incident/trouble ticket number shall be provided to all users requesting support. The Contractor shall maintain an electronic record of each support request received, current status, actions taken, and final resolution. The Contractor shall not collect, store, or transmit VA sensitive information while performing this task.

The Contractor shall manage Help Desk request fulfillment, access management, and planned and preventive maintenance along with providing input and technical support to VA help/service desks on all layers until resolution.

Incidents shall be categorized as the following:

1. Critical = System outage (Application or Service)

2. High = Customer work stoppage

3. Medium = Work around is available. Resolution scheduled when resources are available.

4. Low = Convenience vs. Function (All other issues)

Table below provides the incident priorities and the required response times for each.

The Contractor shall ensure the response times for each incident priority is met:

Priority Incident Type

Incident Type Definition Target Communication interval (Service-Level Target)

Target Resolution Timeframe (Service- Level Target)

P1 Critical

A Critical incident has 1st priority for resolution. An incident is Critical when the systems is inoperable or there is an outage preventing use of the system.

Within 15 minutes of known outage, for initial notification.

Hourly updates notifications and final notifications when service restoration is confirmed.

4 hours from escalation to Major Incident by Incident Manager to return to acceptable service

Priority Incident Type

Incident Type Definition Target Communication interval (Service-Level Target)

Target Resolution Timeframe (Service- Level Target)

P2 High

A High incident has 2nd priority for resolution. An incident is High when the customer is at a work stoppage and the functionality of the application, service or hard-ware is impacted.

Within 15 minutes of known outage, for initial notification.

Updates notifications every 2 hours and final notifications when service restoration is confirmed.

8 hours from escalation to Major Incident by Incident Manager to return to acceptable service

P3 Moderate

A Moderate incident has 3rd priority for resolution. An incident is Moderate when there is a work around available, and the resolution of the issue is scheduled when higher priority tickets are resolved, and resources are available.

Within 12 hours of known outage, for initial notification. Daily update notifications and final notifications when service restoration is confirmed.

4 business days

P4 Low

A Low incident has last or lowest priority for resolution. An incident is Low when there is issue with convenience versus function or all other issues that do not fall under the higher priorities.

Within 24 hours of known outage, for initial notification.

Update notifications every 72 hours and final notifications when service restoration is confirmed.

business days

The Contractor shall provide a Monthly Help Desk Report covering the help desk activities for the entire month. This report shall include the number of trouble tickets received (cumulative from start of the contract as well as total for specific reporting period), number resolved (cumulative from the start of the contract as well as total for reporting period), the total number of trouble tickets still outstanding (with an explanation of resolution progress and when VA can expect the resolution to be completed and any issues related to the resolution), and the monthly percentage of trouble tickets outstanding for more than two business days (and why they are outstanding). The Monthly Help Desk Report shall be delivered by the third business day of following monthly reporting period.

Deliverable:

A. Monthly Help Desk Report

5.10 SYSTEM DEPLOYMENT

The Contractor shall execute the Phased Rollout Plan described within the VCS approved Implementation Plan delivered under PWS Section 5.1.4 beginning one day after VCS approves the systems for deployment. The Contractor shall coordinate with the Government which VCS site locations will be included in each deployment phase and validate all actions that must be performed by both the Contractor and VA prior to the deployment have been completed, the Contractor shall ensure each site location is prepared for the systems to be deployed at their respective site.

Within 3 business days of the completion of each site deployment, the Contractor shall provide a Deployment Summary Report that details the system configuration, any defects or issues that were found and resolved, explanation for any unresolved issues, and any lessons learned that need to be addressed in preparation for the next deployment.

A. Deployment Summary Report

5.11 OPERATIONS & MAINTENANCE

The Contractor shall provide Operations and Maintenance (O&M) support for VCS Systems upgraded, migrated, modified and procured during this effort starting with the first deployed system and throughout the contract PoP. The Contractor shall provide an Account Manager or equivalent to lead all O&M efforts and be the Contractor’s primary point of contact for VA CORs and VCS management. O&M support shall include all upgrade releases, modifications to software/firmware, periodic updates, firmware, drivers, bug fixes, patches, hotfixes, and related documentation such as Release Notes.

The Contractor shall utilize the VA’s ticketing system (currently ServiceNow) to manage all changes. The Contractor shall perform any system backups, replication and archiving of data. Any software upgrade shall be tested in both the Contractor and VCS’ test environment prior to release in the operational environment. If at any time following installation, the system becomes inoperable or requires maintenance, whether discovery is by the Contractor or VA, the Contractor shall provide necessary patches as outlined below to ensure its continuous operation, in accordance with the functionalities, capabilities, and requirements. VA OI&T Infrastructure Operations (IO) provides the necessary hardware infrastructure.