DRAFT PWS PTEMS 2.0 Oct 10 2023.docx

Product and Technology Ecosystem Management Services (PTEMS) 2.0

VA-24-00009536

PERFORMANCE WORK STATEMENT

DEPARTMENT OF VETERANS AFFAIRS

Office of Information & Technology Product Engineering Services Digital Transformation Center

Product and Technology Ecosystem Management Services (PTEMS) 2.0 Date: 10/10/2023

VA-24-00009536

PWS Version Number: 2.3

ContentsDRAFT

BACKGROUND

The mission of the Department of Veterans Affairs (VA) Office of Information and Technology (OIT), Program Engineering Services (PES), Digital Transformation Center (DTC) is to establish VA-wide Digital Modernization Initiatives which can be supported and delivered via Product Delivery and Lifecycle Management methodologies to transform VA by tapping into emerging technologies, connecting developers with VA data, and making Human Centered Design (HCD) the method of how all VA products are designed.

DTC established a modern digital experience for VA Enterprise needs such as the acceleration/adoption of Software-as-a-Service (SaaS), Platform-as-a-Service (PaaS), Application Programing Interface (API), and emerging technologies to modernize service and solution delivery through adoption of software development (Dev), security (Sec), and Information Technology (IT) operations (Ops) (DevSecOps), Product Line Management (PLM), and Industry Best Practices/Standards. DTC programs have delivered and manage best-in-class product services and solution capabilities leveraging specialized and diversified skill sets for the VA Enterprise Digital Modernization Initiatives to include Federal Multi-Tenancy Enclaves.

The DTC Ecosystem is a persistent collaboration of platform management, program management teams, and system integrators (SI) across the entire capability delivery lifecycle with centralized enterprise platform management with quality approval gates assuring the SI’s delivery of high-quality low code/no code (LCNC) solutions. As outlined in Figure 1 below, Product and Technology Ecosystem Management Services (PTEMS) as a System Integrator (SI) team is represented as the Product Delivery team in blue focused on delivering complex, large-scale solutions within the DTC Capability Delivery Lifecycle Management. While DTC Platform Management Team tasks and activities in red are out of scope for PTEMS, the red tasks and activities outlined in Figure 1 delineate the process interactions and gates between PTEMS and the DTC Platform Management Team. DTC success is measured and validated through the incremental and iterative delivery of business and technology capabilities driving modernization efforts.

As part of VA’s digital modernization, SaaS is a strategic application delivery model. A SaaS Product is hosted on a cloud infrastructure outside the security boundary of VA and is provided to the Cloud Service Customer (CSC) over the internet. The CSC uses the SaaS offering via a thin-client interface, such as a web-browser or a program interface. The CSC subscribes to the SaaS offering and is only responsible for limited application configuration settings. The Cloud Service Provider (CSP) offering the application is responsible for management of the application, safeguarding of data stored or processed by the application, and all elements of the underlying infrastructure.

In order to qualify as SaaS for use at VA (as defined in Attachment 1), and to align with Federal Risk and Authorization Management Program (FedRAMP) requirements, the hosting for the offering must conform to the National Institute of Standards and Technology (NIST) 800-145 definition of Cloud Computing and thus contain following key characteristics:

· On-Demand Self-Service: The CSP fully automates the provisioning of both the customer interface and the underlying cloud components of the SaaS offering. In some cases, the CSP may provision internal resources manually, while providing the CSC an automated interface to request and track the service.

· Broad Network Access: The SaaS capabilities are available over the internet or over a network that is available from all access points the CSC requires. The SaaS offering is accessible through common platforms (e.g., mobile phones, tablets, laptops, and workstations).

· Resource Pooling: The computing infrastructure supporting the SaaS offering is shared among more than one CSC using a multi-tenant model, and resources are dynamically assigned depending on customer demand.

· Rapid Elasticity: Computing capabilities are automatically provisioned and released in a manner that scales with customer demand. In some cases, the scaling of resources may not be fully automated, but it should be fast enough to support the needs of the CSC, which the CSC would have to define.

· Measured Service: Resource usage, such as storage, processing, bandwidth, and user activity are measured and reported on in a manner that is relevant to the SaaS offering.

The SaaS offering shall be hosted within the continental United States and data stored, processed, and/or transmitted within the offering shall remain within the United States. CSPs shall be aware of FedRAMP and ready to partner with VA through the SaaS FedRAMP Authorization process.

To further accelerate the adoption of VA’s buy first policy, VA sponsors Hybrid and Managed Solutions in addition to the SaaS application delivery model referenced above. A Hybrid Solution is comprised of both SaaS and on-premise components which shall adhere to both SaaS and VA Enterprise Cloud established policies. A Managed Solution is defined as a single-tenant product not hosted within the VA Network. The mission of the VA is to provide benefits and services to Veterans of the United States. In meeting these goals, OIT strives to provide high quality, effective, and efficient IT services to those responsible for providing care to the Veterans at the point-of-care as well as throughout all the points of the Veterans’ health care in an effective, timely, and compassionate manner. VA depends on Information Management/Information Technology systems to meet mission goals.

In support of VA systems modernization and the agency’s mandate to move to the cloud, this task order seeks to continue developing Product and Technology Ecosystem Management Services (PTEMS 2.0) PaaS/SaaS Applications to modernize VA mission specific case management solutions across the enterprise. The PTEMS solution will utilize a platform agnostic approach to provide VA with modern solutions to support PTEMS higher complexity, modular LCNC solutions that enables an innovative reusable service-focused software component architecture including PaaS functions/capabilities, SaaS integrations, APIs, and Digital modernization and emerging technology support.

PTEMS architecture will make configuring and customizing DTC PaaS and SaaS solutions easier to scale and faster to create, enabling innovation and accelerating time-to-market for new features.

Currently, DTC’s PaaS and SaaS Vendor platforms are identified as follows,

· Salesforce/MuleSoft

· Microsoft Power Platform/Microsoft Dynamics

· Pega

· Box

· Appian

These platforms are not limited to those listed above for future requirements as business requirements change.

VA DTC low code/no code platforms and extensible products enables accelerated delivery of new features and functionality while unifying the diverse and complex underlying VA system of system ecosystem. Enterprise large scale or monolithic low code/no code solutions offer several advantages for more complex enterprise level solution requirements with the following benefits to the DTC Program Ecosystem.

Comprehensive platform: Enterprise large scale low code/no code solutions often provide an all-in-one platform that encompasses various development and deployment capabilities. This eliminates the need to integrate multiple tools or platforms, simplifying the development process and reducing complexity.

Simplified deployment: Enterprise large scale low code/no code platforms often offer built-in deployment capabilities, allowing organizations to easily publish their large scale applications to the desired environment. This simplifies the deployment process and ensures compatibility with the platform's features and components.

Seamless collaboration: Enterprise large scale low code/no code solutions provide a centralized environment for collaboration among developers, business users, and stakeholders. This facilitates communication, knowledge sharing, and version control, enhancing collaboration across teams and streamlining the development lifecycle.

Standardization and consistency: Enterprise large scale solutions typically enforce a standardized development approach and coding conventions, ensuring consistency across large scale applications. This simplifies maintenance, improves code quality, and reduces the learning curve for new developers joining the team.

Ecosystem and community support: Enterprise large scale low code/no code platforms often have a well-established ecosystem and active community support. This means there are abundant resources, documentation, tutorials, and pre-built components available, enabling developers to leverage existing solutions and accelerate development.

Performance optimization: Enterprise large scale low code/no code platforms are designed to optimize performance and efficiency within a unified environment. Since all components are tightly integrated, developers can take advantage of built-in optimizations and performance-enhancing features without having to handle complex configurations or integrations.

Reduced complexity: Enterprise large scale solutions simplify the development process by providing a cohesive set of tools, features, and functionalities within a single environment. This reduces the learning curve for developers and enables them to focus on building large scale applications rather than managing complex infrastructure or integration challenges.

Lower maintenance overhead: Since enterprise large scale low code/no code platforms offer a consolidated environment, maintenance tasks such as updating components, managing dependencies, and ensuring compatibility are typically streamlined. This reduces the maintenance overhead and allows organizations to allocate resources more efficiently.

Vendor-provided scalability and reliability: Enterprise large scale solutions often come with built-in scalability and reliability features provided by the vendor. This eliminates the need for organizations to build and manage their own infrastructure for scaling and ensuring high availability, freeing up resources and simplifying operations.

APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. 44 U.S.C. § 3541-3549, “Federal Information Security Management Act (FISMA) of 2002”

2. “Federal Information Security Modernization Act of 2014”

3. Federal Information Processing Standards (FIPS) Publication 140-2, “Security Requirements for Cryptographic Modules”

4. FIPS Pub 199. “Standards for Security Categorization of Federal Information and Information Systems,” February 2004

5. FIPS Pub 200, “Minimum Security Requirements for Federal Information and Information Systems,” March 2006

6. FIPS Pub 201-2, “Personal Identity Verification of Federal Employees and Contractors,” August 2013

7. 10 U.S.C. § 2224, "Defense Information Assurance Program"

8. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

9. Public Law 109-461, Veterans Benefits, Health Care, and Information Technology Act of 2006, Title IX, Information Security Matters

10. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”

11. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, https://www.va.gov/vapubs/index.cfm

12. VA Handbook 0710, “Personnel Security and Suitability Program,” May 2, 2016, https://www.va.gov/vapubs/index.cfm

13. VA Directive and Handbook 6102, “Internet/Intranet Services,” August 5, 2019

14. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and Guidelines,” January 18, 2017

15. Office of Management and Budget (OMB) Circular A-130, “Managing Federal Information as a Strategic Resource,” July 28, 2016

16. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed Services (CHAMPUS)”

17. NIST SP 800-66 Rev. 1, “An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule,” October 2008

18. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended, January 18, 2017

19. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

20. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021

21. VA Handbook 6500, “Risk Management Framework for VA Information Systems VA Information Security Program,” February 24, 2021

22. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI),” March 12, 2019

23. VA Handbook 6500.5, “Incorporating Security and Privacy into the System Development Lifecycle,” March 22, 2010

24. VA Handbook 6500.6, “Contract Security,” March 12, 2010

25. VA Handbook 6500.8, “Information System Contingency Planning,” April 6, 2011

26. VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018

27. VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017

28. OIT Process Asset Library (PAL), https://www.va.gov/process/ . Reference Process Maps at https://www.va.gov/process/maps.asp and Artifact templates at https://www.va.gov/process/artifacts.asp

29. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

30. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014

31. VA Handbook 6508.1, “Procedures for Privacy Threshold Analysis and Privacy Impact Assessment,” July 30, 2015

32. VA Handbook 6510, “VA Identity and Access Management,” January 15, 2016

33. VA Directive and Handbook 6513, “Secure External Connections,” October 12, 2017

34. VA Directive 6300, “Records and Information Management,” September 21, 2018

35. VA Handbook, 6300.1, “Records Management Procedures,“ March 24, 2010

36. NIST SP 800-37 Rev 2, “Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy,” December 2018

37. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020)

38. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015

39. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” March 24, 2014

40. OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005

41. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019

42. OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008

43. Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance, December 2, 2011, (NOTE: Part A of the FICAM Roadmap and Implementation Guidance, v2.0, was replaced in 2015 with an updated Architecture (https://arch.idmanagement.gov/#what-is-the-ficam-architecture)

44. NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access,“ June 2018

45. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, “Digital Identity Guidelines,” updated March 02, 2020

46. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014

47. Draft National Institute of Standards and Technology Interagency Report (NISTIR) 7981, “Mobile, PIV, and Authentication,” March 2014

48. VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

49. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

50. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

51. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

52. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019

53. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008

54. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (Public Law 110–140), December 19, 2007

55. Section 104 of the Energy Policy Act of 2005, (Public Law 109–58), August 8, 2005

56. Executive Order 13834, “Efficient Federal Operations,” dated May 17, 2018

57. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 2, 2001

58. VA Directive 0058, “VA Green Purchasing Program,” July 19, 2013

59. VA Handbook 0058, “VA Green Purchasing Program,” July 19, 2013

60. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

61. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

62. “Veteran Focused Integration Process (VIP) Guide 4.0,” January 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

63. VA Memorandum “Proper Use of Email and Other Messaging Services,” January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

64. “DevSecOps Product Line Management Playbook” version 2.0, May 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

65. NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020

66. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol Version 6 (IPv6),” November 19, 2020

67. Social Security Number (SSN) Fraud Prevention Act of 2017

68. Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23, 2018

69. Digital Transformation Center (DTC) Standards https://github.com/department-of-veterans-affairs/va-salesforce-digital-transformation-center

70. FedRAMP Authorization Act, December 23, 2022

71. VA SaaS Definition - Attachment 1

72. Existing Product and Technology Ecosystem Management Services (PTEMS) - Attachment 2

73. DTC Process - How to Submit a Request to Move a Module to Sustainment - Attachment 3

74. DTC System Integrator SLAs - Attachment 4

Please be advised that any hyperlinks contained within this document, if any, are for convenience purposes, only. Due to the dynamic nature of hyperlinks and the information accessed through or imbedded therein, it is incumbent upon the Contractor to ensure that all information required to successfully complete the requirements established herein is independently located, verified for accuracy, and confirmed to be the most up-to-date version available, prior to use.

SCOPE OF WORK

The Contractor shall provide support for the delivery of enterprise large scale low code/no code high complexity solutions that enables an innovative reusable service-focused software and integration component architecture. The Contractor’s support shall include: capability delivery lifecycle management, enhancement/development delivery, configuration, additional enhancement/development delivery, PTEMS enhancements and development, PTEMS capability discovery, data management and lifecycle services, VA System of System Engineering and Modernization Support, IT operations and maintenance, existing PTEMS solutions operations and maintenance, business end user support, and transition.

PERFORMANCE DETAILS

PERFORMANCE PERIOD

The Period of Performance (PoP) shall consist of one 12-month base period, four 12-month option periods, and nine Optional Tasks.

Any work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO).

There are eleven (11) Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, four are set by date:

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

PLACE OF PERFORMANCE

A majority of the efforts under this contract shall be performed at Contractor facilities and work may be performed at remote locations with prior concurrence from the Contracting Officer’s Representative (COR). It is expected that this work shall be conducted during core business hours, unless specified otherwise. For specific meeting types, including user requirements sessions and other key meetings which are best accomplished at Government facilities, the Government will schedule meeting rooms as necessary. No work under this contract shall take place outside the United States.

0. TRAVEL

The Government anticipates travel to perform the tasks associated with the effort to attend program-related meetings and user requirement sessions throughout the PoP.

Travel shall be proposed on a Cost-Reimbursable basis. Travel shall be in accordance with the Federal Travel Regulations (FTR) and requires advanced concurrence by the COR. Contractor travel within the local commuting area will not be reimbursed.

SPECIFIC TASKS AND DELIVERABLES

The Contractor shall provide the resources necessary to design, configure, develop, integrate, and implement a platform agnostic approach. The Contractor shall provide VA with modern solutions to support lower complexity, modular LCNC solutions that enables an innovative reusable service-focused software component architecture including PaaS functions/capabilities, Software as a Service (SaaS) integrations, APIs, and Digital modernization and emerging technology support.

The Contractor shall perform the following:

PROJECT MANAGEMENT

CONTRACTOR PRODUCT AND PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Product and Project Management Plan (CPPMP) that lays out the Contractor’s approach, timeline, and tools to be used in execution of this TO effort. The CPPMP shall take the form of both a narrative and graphic format that displays the product and/or project delivery timeline and targets for each prioritized capability, including a sprint forecast of target products/projects capabilities are in the upcoming sprints, target delivery of capability with sprint confidence metric, milestones, changes to target delivery with reason in plain language, risks, and resource support. The CPPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPPMP shall be concurred upon and updated in accordance with Section B of the TO. The Contractor shall update and maintain the VA Product Manager (PM) approved CPPMP throughout the PoP.

Deliverable:

A. Contractor Product and Project Management Plan

REPORTING REQUIREMENTS

The Contractor shall provide Monthly Progress Report using a modern, automated tool. The report shall include detailed instructions/explanations for each required data element, to ensure that data is accurate and consistent. The Monthly Progress Report shall reflect data as of the last business day of the preceding period. The Monthly Progress Report shall cover all work completed during the reporting period and work planned for the subsequent reporting period for each project. The Monthly Progress Report shall also identify any problems that arose and give a description of how the problems were resolved. If problems have not been completely resolved, the Contractor shall provide an explanation including its plan and timeframe for resolving the issue(s). The Monthly Progress Report shall also include an itemized list of all documents and electronic deliverables. The Contractor shall monitor performance against the CPPMP and report any deviations in the next Monthly Progress Report. The Contractor shall ensure regular communication with the VA PM so that issues that arise are transparent to both parties to prevent escalation of outstanding issues. The Contractor shall also provide the data and reporting content to the VA PM to support management level reporting.

Deliverable:

A. Monthly Progress Report

WEEKLY ACTIVITY REPORT

The Contractor shall provide a Weekly Activity Report to include the PTEMS Program Brief detailing any risks and dependencies on a weekly basis. Any new risk or dependency shall be communicated and escalated to the DTC Platform Lead(s) within 24 hours of the issue discovery. This report shall include details on all risks and dependencies discovered during the previous week, identification of any new risks or dependencies encountered, and an update on previously identified risks and dependencies.

Deliverable:

A. Weekly Activity Report

TECHNICAL KICKOFF MEETING

A technical kickoff meeting shall be held within 10 days after contract award. The Contractor shall coordinate the date, time, and location (can be virtual) with the CO, the VA PM, the Contract Specialist (CS), and the COR. The Contractor shall provide a draft Kickoff Meeting Agenda (via email) to the CO, CS, COR, and VA PM at least five calendar days prior to the meeting. Upon Government approval of a final Kickoff Meeting Agenda, the Contractor shall distribute to all meeting attendees (via email). During the kickoff-meeting, the Contractor shall present Kickoff Meeting Power Point Presentation for review and approval by the Government. The presentation shall include details of the intended approach, work plan, and project schedule for each effort. At the conclusion of the meeting, the Contractor shall update the presentation with a final slide entitled “Summary Report” which shall include notes on any major issues, agreements, or disagreements discussed during the kickoff meeting. The Contractor shall submit the final updated Kickoff Meeting Power Point Presentation to the CO, CS, and COR for review three calendar days after the meeting. The Contractor shall prepare and distribute the Kickoff Meeting Minutes to the CO, CS, COR and all attendees within three calendar days after the meeting.

Deliverables:

A. Kickoff Meeting Agenda B. Kickoff Meeting Power Point Presentation C. Kickoff Meeting Minutes

TRAINING

PRIVACY TRAINING

The Contractor shall submit Talent Management System (TMS) Training Certificates of completion for VA Privacy and Information Security Awareness and Rules of Behavior and provide signed copies of the Contractor Rules of Behavior in accordance with Section 9, Training, from Appendix C of the VA Handbook 6500.6, “Contract Security” which can be found at Addendum B of this PWS.

The Contractor shall track the status of VA Privacy and Information Security Awareness and Rules of Behavior training for all individuals engaged on each Level of Effort (LOE) under the contract. The status reporting shall identify a single Contractor Security Point of Contact (POC), the names of all personnel engaged on each LOE under the contract, their initial training date for VA Privacy and Information Security and Rules of Behavior training, and their next required training date. This information shall be submitted as part of the Contractor’s CPPMP. The training referenced above is required to be renewed annually.

Deliverable:

A. TMS Training Certificates (VA Privacy and Information Security Awareness and Rules of Behavior)

ELEVATED PERMISSIONS TRAINING

The Contractor shall ensure that all personnel have completed all required training prior to giving any elevated permissions to production or pre-prod environments as deemed by the VA’s Security regulations. The Contractor shall provide Elevated Permissions Training Certificate.

Deliverable:

A. Elevated Permissions Training Certificate

ONBOARDING

The Contractor shall manage the onboarding of its staff. Onboarding shall include steps to obtain a VA network and email account, complete training, initiate background investigations, and gain physical and logical access, which may include elevated privileges to the necessary development and test environments for the various systems to be enhanced.

A single Contractor Onboarding POC shall be designated by the Contractor who tracks the onboarding status of all Contractor personnel. The Contractor Onboarding POC shall be responsible for accurate and timely submission of all required VA onboarding paperwork to the COR or his/her onboarding designee. The Contractor shall be responsible for tracking the status of all its staff’s onboarding activities. The Contractor shall provide an Onboarding Status Report bi-weekly which includes updates for all in-process staff, and any staff with outstanding onboarding requests for review by the COR and his/her onboarding designee.

Deliverable:

A. Onboarding Status Report

PRODUCT MANAGEMENT AND OVERSIGHT/KEY PERSONNEL

The Contractor shall provide resources that have the requisite skills and experience required to perform the tasks within the PWS. The Contractor agrees that the personnel identified below, as key to supporting this effort, shall not be removed from the effort, replaced or added without a compelling reason and without written notification to the CO.

The Contractor shall provide Contractor support personnel and subcontractors who have the required educational background, experience, security clearance, and access authorization or combination thereof to meet the labor category descriptions for the required PWS tasks.

If any change to the Key Personnel assigned to the labor categories identified below becomes necessary (initial staffing, substitutions, or additions), the Contractor shall immediately notify the CO/CS/COR/PM in writing. The proposed replacement personnel shall be of at least substantially equal ability and qualifications as the individual(s) currently performing in that category and that the proposed replacement meets or exceeds the qualifications designated for that Key Personnel position. The substitution or replacement of the personnel shall not occur within the first six months after the date of award.

The Contractor agrees that it has a contractual obligation to mitigate the consequences of the loss of Key Personnel and shall promptly secure any necessary replacements in accordance with (IAW) this PWS section. Failure to replace a member of the Key Personnel pursuant to this clause and without a break in performance of the labor category at issue shall be considered a condition endangering contract performance and may provide grounds for termination for default.

All Contractor team members shall possess demonstrated proficiency in the architecture, interoperability, integration, product delivery, and customization utilizing modern VA tools such as Slack, Zenhub, Jira, Confluence, Salesforce, Pega, Fortify, Copado, Jenkins, Prometheus, Microsoft Dynamics, Microsoft Power Platform, PagerDuty, and GitHub.

The labor categories below are identified as Key Personnel. Key Personnel must meet the corresponding requirements identified in the Labor Description column below:

· Expertise in managing entire agile software development lifecycle for a project of at least one million dollars up to and including production delivery and some phase of post-delivery/warranty support.

· Expertise as a product manager accountable for delivery for at least 10 software professionals with a duration of greater than one year.

· Demonstrated success with delivering digital products.

Minimum Education Level

· Bachelors

Degree In

· Business Administration, Business Management, Computer Science, Information Systems, Information Resource Management, Industrial Engineering, Operations Research or related fields.

Minimum Experience

· 3 years

Substitutions

· A minimum of 5 years of relevant experience may be substituted for education

· Demonstrated knowledge and use of modern software development and DevOps tools including GitHub and implementation of a DevOps pipeline in a cloud environment.

· Chief Architect or Senior Engineer on a production system in one of the Cloud Service Provider (CSP) Vendors Clouds

· Experience as a Software Engineer for at least one project in one of the CSP Vendors Clouds.

Minimum Education Level

· Bachelors

Degree In

· Business Administration, Business Management, Computer Science, Information Systems, Information Resource Management, Industrial Engineering, Operations Research, or related fields.

Minimum Experience

· 7 years

Substitutions

· Certifications in relevant technology plus a minimum of 7 years of relevant experience or a minimum of 10 years of relevant experience may be substituted for education.

· Demonstrated knowledge and use of modern software development and DevOps tools.

· Demonstrated success implementing and/or maintaining a customer support workflow, for all touch points including (but not limited to) managing new release communications, bug fixes, and support requests/questions.

Minimum Education Level

· High School or GED

Degree In

· Not Applicable (N/A)

Minimum Experience

· 3 years

· N/A

· Demonstrated release/delivery management on large-scale deployments for at least five (5) years.

· Demonstrated successful delivery of multiple large-scale deployments.

Minimum Education Level

· Bachelors

Degree In

· Business Administration, Business Management, Computer Science, Information Systems, Information Resource Management, Industrial Engineering, Operations Research, or related fields.

Minimum Experience

· 3 years

· A minimum of 5 years of relevant experience may be substituted for education.

· Expertise with user focused designs and workflows based off complex data models leveraging HCD market analysis, customer feedback and requirements, and user research analytics.

· Expertise in designing mock-ups and click-through prototypes, identifying streamlined User Interface (UI) opportunities incorporating emerging technology trends.

· Expertise in developing high-level requirements, conceptual diagrams, and visual interface designs.

· Expertise in creating key design deliverables specific to each product, such as scenarios and use-cases.

· Expertise with UI strategy and iterations with a focus on HCD for at least five (5) years.

Minimum Education Level

· Bachelors

Degree In

· Business Administration, Business Management, Computer Science, Information Systems, Information Resource Management, Industrial Engineering, Operations Research, or related fields.

Minimum Experience

· 5 years

· Certifications in relevant User Experience (UX) Software plus a minimum of 8 years of relevant experience; or a minimum of 5 years of relevant experience may be substituted for education.

· Expertise with usability engineering strategy and at least five (5) years of relevant UX software experience including relevant certifications.

· Expertise in establishing and maintaining the vision of the overall user experience across all creative disciplines leveraging human-centered design, information architecture, usability, and other applicable best practices.

· Expertise in aligning deliverables with overall user experience strategies optimizing overall customer and end-user experience across all engagement and interactions.

· Expertise across standard UX Software.

Minimum Education Level

· Bachelors

Degree In

· Business Administration, Business Management, Computer Science, Information Systems, Information Resource Management, Industrial Engineering, Operations Research, or related fields.

Minimum Experience

· 5 years

Substitutions

· Certifications in relevant UX software plus a minimum of 5 years of relevant experience or a minimum of 7 years of relevant experience may be substituted for education

· Assess, select, manage, and implement enterprise application components, and to ensure that the technical solution solves the business problem as an organic part of the organization’s operational and functional baseline.

· Focus on specific product or technology family on multiple platforms, which is supplemented with a clear understanding of the business requirements and related applications issues.

· Supports technical strategies that will improve productivity across functional areas within the organization.

· Educates others regarding product-specific best practices.

· Leads enterprise applications integration efforts and oversee the validation of associated work products.

· Provides work direction and guidance to other personnel; ensures accuracy of the work of other personnel, operates under deadlines, able to work on multiple tasks.

Minimum Education Level

· Master’s

Degree In

· Business Administration, Business Management, Computer Science, Information Systems, Operations Research, or related fields.

Minimum Experience

· 5 years

· A minimum of 8 years of relevant experience may be substituted for education.

· Conducts workflow analysis, technology assessments, and business-related studies to define business case plans and architecture strategies supporting long term sustainability and growth.

· The expert provides guidance and strategy for adoption of new technology products and processes optimizing developer, customer, and end-user experience.

Minimum Education Level

· Bachelors

Degree In

· Business Administration, Business Management, Computer Science, Information Systems, Operations Research, or related fields.

Minimum Experience

· 5 years

· Certifications in relevant UX software plus a minimum of 5 years of relevant experience OR a minimum of 7 years of relevant experience may be substituted for education.

· Communication and coordination of activities between all teams, external and internal clients, and contract stakeholders pertaining to team products and product delivery to end‐users.

Minimum Education Level

· Bachelors

Degree In

· Business Administration, Business Management, Computer Science, Information Systems, Information Resource Management, Industrial Engineering, Operations Research, or related fields.

Minimum Experience

· 5 years

· A minimum of 8 years of relevant experience may be substituted for education.

· Expertise in providing group facilitation, interviewing, training, and providing additional forms of knowledge transfer.

Minimum Education Level

· Master’s Degree

Degree In

· Business Administration, Business Management, Computer Science, Information Systems, Information Resource Management, Industrial Engineering, Operations Research, or related fields.

Minimum Experience

· 10 years acting as an Executive Level Advisor and Senior Functional Leader to apply process improvement and re-engineering methodologies and principles to conduct process modernization projects.

· A minimum of 12 years of relevant experience may be substituted for education.

CAPABILITY DELIVERY LIFECYCLE MANAGEMENT

The Contractor shall follow the core functions of Software Development Lifecycle Management (SDLC) utilizing established agile frameworks, such as the Scaled Agile Framework and other emerging innovative frameworks, in order to deliver a broad range of solutions. The Contractor shall follow a modular software design methodology to provide systems and software engineering, web services development, and software release and change management services. The Contractor shall continuously improve all new and existing solutions by implementing continual configurations, capabilities and enhancements, bug fixes, monitoring, testing and evaluation, business intelligence and application performance monitoring analytics, and support activities, while collaborating closely with the DTC Platform Lead(s), and VA product owners throughout the development process and solution delivery lifecycle. The Contractor shall configure, develop, maintain, test, and deploy business and technology feature releases. Contractor teams for this effort shall be composed of an evolving mix of technical and operational skill sets across agile frameworks as required to meet the necessary stage of the capability development lifecycle management and technical nature of the capability. The Contractor shall adjust deliverables and repository tool updates to match the nature of the capability and/or SDLC frameworks.

The Contractor shall adhere to core design principles, including minimizing custom code; leveraging modular software design; maximizing re-usability, and adherence to VA Policies and standards and governance.

AGILE REQUIREMENTS ELICITATION AND ELABORATION

The Contractor shall create a Prioritized Program Epic Backlog and Prioritized Product Team Backlog and complete continuous and iterative backlog grooming sessions to gather, elicit, understand, and elaborate agile business requirements. Agile requirements shall be represented across various issue types, such as epics and associated user stories, dependencies, and defects. The Contractor shall ensure that all agile requirements are linked and mapped to epics ensuring traceability and transparency from backlogs to Product Increment (PI) Roadmaps. An epic shall represent one modular function deliverable within one PI unless otherwise outlined IAW Section 5.2.4 Product Delivery Roadmap and PI Planning. The epics shall map to a program epic representing the end-to-end solution for the product deliverable. An epic can map to more than one program epic as the standalone modular function may be re-used across multiple product deliverables. The Delivery Roadmap and PI Planning task in Section 5.2.4 is the backlog grooming and prioritization tasks which are continuous and iterative throughout the PoP and shall be facilitated by the Contractor.

Elaboration sessions shall include participants from the business customer, OIT and system SMEs, as well as end-user participation, where appropriate, ensuring requirements meet both business customer and end-user requirements. Due to the severity and urgency of defects, the Contractor shall facilitate ad-hoc sessions aligned to the solution’s operational support model supporting hotfix releases. The Contractor shall document and manage all agile requirement elaboration and elicitation activity, such as capability requirements, strategic stakeholder decisions, scope limitations, exception approvals, manual workarounds, and solution customizations in a VA approved repository. The Contractor shall distribute agile requirement elaboration and elicitation activity documentation to key stakeholders per direction of DTC Platform Lead(s). The program epic and product team backlog serves as the primary authoritative requirements source for all PTEMS capabilities and solutions to be delivered. The outcome of these sessions shall be a complete review and agreement of decomposed, groomed, and executable program epics and user stories containing:

a) Business use case and requirements

b) User Centered Design requirements, such as

a. End-user requirements and research

b. Mock-ups

c. Wireframes

d. Screen flows

e. Navigation

f. Taxonomy

g. Prototypes

c) Functional requirements

d) Compliance requirements, such as

a. Section 508

b. FedRAMP Authorization

c. Health Insurance Portability and Accountability Act (HIPAA)

d. Office of National Coordinator (ONC) 21st Century Cures Act Final Rule

e. Authority to Operate (ATO)

f. Authority to Connect (ATC)

g. Privacy Impact Assessment (PIA)

h. Privacy Threshold Analysis (PTA)

e) Non-functional requirements, such as

a. Security features and controls

b. Reliability

c. Performance

d. Maintainability

e. Scalability

f. Identity and access management

g. Usability

f) Requirements visualizations, such as

a. Story maps

b. Business process flows

g) Blockers, such as

a. Dependencies

b. Risks

c. Impediments,

h) Business rules

i) Business intelligence and reporting requirements.

j) Configurations with change management

k) Acceptance criteria with clearly defined and testable pass/fail criteria.

l) Testing scenarios and requirements

m) Measurable success metrics and requirements for business and technology impacts.

The Contractor shall ensure all agile requirements are:

1. Stored in a VA approved repository.

2. Decomposed, groomed, and executable IAW Section 5.2.4 Product Delivery Roadmap and PI Planning unless directed otherwise by the VA team.

3. Requirements are linked to epics.

4. Epics are mapped to program epics;

5. Maintained at a minimum of four weeks of groomed, ready-to-work agile requirements per team; and,

6. Execute and provide a Requirements Package that includes all target agile requirements including content, attachments, links, and artifacts IAW Section 5.2.1.a – 5.2.1.m, Agile Requirements Elicitation and Elaboration.

7. Classify requirements as follows:

a. New Feature

b. Enhancement Feature

c. Non-Functional

d. Technology Investment

e. Defect

In addition, the Contractor shall ensure that defects are mapped back to the original agile requirement.

FTE support shall be comprised of the required Key Personnel listed below as well as any additional roles to meet the requirements based on the task outlined above.

Key Personnel:

· Product Manager IV

· User Experience Specialist VI

Deliverables:

A. Prioritized Program Epic Backlog B. Prioritized Product Team Backlog C. Requirements Package

USER CENTERED DESIGN (UCD)

The Contractor shall develop a UCD Research Plan that it will use for the proposed UCD approach and process identifying the types of questions that it will ask, collection mechanisms, and schedule of the UCD evaluations. During the UCD process, the Contractor shall leverage existing personas, or create new personas if none exist, which represent the users. A persona is a user archetype used to help guide decisions about product features, navigation interactions, and even visual design. In most cases, personas are synthesized from a series of ethnographic interviews with real people, and then captured in one to two page descriptions that include behavior patterns, goals, skills, attitudes, and environment, with a few fictional personal details to bring the persona to life.

The Contractor shall develop, manage, and execute UCD Research Plans in support of Section 5.2.1, Agile Requirements Elicitation and Elaboration.

The Contractor shall provide a UCD Proof-of-Concept, such as wireframe, screen flow, prototype, visual designs, and capability demonstration, based on Contractor-conducted UCD Research.