Draft PWS RFI Veteran Experience Services (VES) Product Development.docx

PERFORMANCE WORK STATEMENT (PWS) DEPARTMENT OF VETERANS AFFAIRS

Office of Information & Technology Product Engineering Service (PES) Veteran Experience Services (VES)

VA Contact Center Experience Modernization (VCCEM) Date: 10/09/2024 Contract Number:

Task Order PWS Version Number: 1.0

VES Product Development PWS

Contents

1.0 BACKGROUND

The mission of the Department of Veterans Affairs (VA) Office of Information & Technology (OIT), Product Engineering Service (PES) is to ensure that Veterans receive seamless access to benefits and proactive care using modern digital solutions. This is done by using Software as a Service (SaaS), low-code, and a shared delivery infrastructure with highly differentiated products. In meeting these goals, OI&T strives to provide high quality, effective, and efficient Information Technology (IT) services to those responsible for providing care to the Veterans at the point-of-care as well as throughout all the points of the Veterans’ health care in an effective, timely and compassionate manner. VA depends on Information Management/Information Technology (IM/IT) systems to meet mission goals.

The Veteran Experience Services Portfolio is focused on delivering products that enhance Veterans’ relationship with VA by leveraging state of the art technologies to provide seamless access to VA benefits and services through multiple contact channels and our digital Veteran facing products.

The VA follows a DevSecOps software engineering methodology. DevSecOps is a culture-based software engineering approach that aims at unifying software development, security, and software operation, and mandates collaboration between the business and the IT organizations that develop, deliver, and manage applications for that business. The new culture will enable project teams to utilize self-service and have more autonomy with the approach used to meet customer needs.

Scaled Agile Framework (SAFe) is a proven approach that will allow VA to deliver solutions to customers faster and more efficiently using Lean, Agile and DevOps principles, practices and processes. DevOps will improve the experience of OI&T customers, enable OI&T to deploy new systems and update existing systems more quickly and frequently, and will lower costs by leveraging industry best practices and innovation.

2.0 APPLICABLE DOCUMENTS

The Contractor shall comply with the following documents in the performance of this effort:

1. 44 U.S.C. § 3541-3549, “Federal Information Security Management Act (FISMA) of 2002”

2. “Federal Information Security Modernization Act of 2014”

3. Federal Information Processing Standards (FIPS) Publication 140-2, “Security Requirements for Cryptographic Modules”

4. FIPS Pub 199. “Standards for Security Categorization of Federal Information and Information Systems,” February 2004

5. FIPS Pub 200, “Minimum Security Requirements for Federal Information and Information Systems,” March 2006

6. FIPS Pub 201-2, “Personal Identity Verification of Federal Employees and Contractors,” August 2013

7. 10 U.S.C. § 2224, “Defense Information Assurance Program”

8. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

9. Public Law 109-461, Veterans Benefits, Health Care, and Information Technology Act of 2006, Title IX, Information Security Matters

10. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”

11. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, https://www.va.gov/vapubs/index.cfm

12. VA Handbook 0710, “Personnel Security and Suitability Program,” May 2, 2016, https://www.va.gov/vapubs/index.cfm

13. VA Directive and Handbook 6102, “Internet/Intranet Services,” August 5, 2019

14. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and Guidelines,” January 18, 2017

15. Office of Management and Budget (OMB) Circular A-130, “Managing Federal Information as a Strategic Resource,” July 28, 2016

16. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed Services (CHAMPUS)”

17. NIST SP 800-66 Rev. 1, “An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule,” October 2008

18. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended, January 18, 2017

19. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

20. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021

21. VA Handbook 6500, “Risk Management Framework for VA Information Systems VA Information Security Program,” February 24, 2021

22. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI),” March 12, 2019

23. VA Handbook 6500.5, “Incorporating Security and Privacy into the System Development Lifecycle,” March 22, 2010

24. VA Handbook 6500.6, “Contract Security,” March 12, 2010

25. VA Handbook 6500.8, “Information System Contingency Planning,” April 6, 2011

26. VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018

27. VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017

28. OIT Process Asset Library (PAL), https://www.va.gov/process/ . Reference Process Maps at https://www.va.gov/process/maps.asp and Artifact templates at https://www.va.gov/process/artifacts.asp

29. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

30. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014

31. VA Handbook 6508.1, “Procedures for Privacy Threshold Analysis and Privacy Impact Assessment,” July 30, 2015

32. VA Handbook 6510, “VA Identity and Access Management,” January 15, 2016

33. VA Directive and Handbook 6513, “Secure External Connections,” October 12, 2017

34. VA Directive 6300, “Records and Information Management,” September 21, 2018

35. VA Handbook, 6300.1, “Records Management Procedures,“ March 24, 2010

36. NIST SP 800-37 Rev 2, “Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy,” December 2018

37. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020)

38. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015

39. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” March 24, 2014

40. OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005

41. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019

42. OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008

43. Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance, December 2, 2011, (NOTE: Part A of the FICAM Roadmap and Implementation Guidance, v2.0, was replaced in 2015 with an updated Architecture (https://arch.idmanagement.gov/#what-is-the-ficam-architecture)

44. NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access,“ June 2018

45. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, “Digital Identity Guidelines,” updated March 02, 2020

46. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014

47. NIST SP 800-164, “Guidelines on Hardware-Rooted Security in Mobile Devices (Draft),” October 2012

48. Draft National Institute of Standards and Technology Interagency Report (NISTIR) 7981, “Mobile, PIV, and Authentication,” March 2014

49. VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

50. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

51. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

52. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

53. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019

54. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008

55. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (Public Law 110–140), December 19, 2007

56. Section 104 of the Energy Policy Act of 2005, (Public Law 109–58), August 8, 2005

57. Executive Order 13834, “Efficient Federal Operations,” dated May 17, 2018

58. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 2, 2001

59. VA Directive 0058, “VA Green Purchasing Program,” July 19, 2013

60. VA Handbook 0058, “VA Green Purchasing Program,” July 19, 2013

61. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

62. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

63. “Veteran Focused Integration Process (VIP) Guide 4.0,” January 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

64. VA Memorandum “Proper Use of Email and Other Messaging Services,” January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

65. “DevSecOps Product Line Management Playbook” version 2.0, May 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

66. NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020

67. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol Version 6 (Ipv6),” November 19, 2020

68. Social Security Number (SSN) Fraud Prevention Act of 2017

69. Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23, 2018

3.0 SCOPE OF WORK

The Contractor shall provide Product Development support for critical and non-critical applications and products in the VRM Product Line listed below. Support includes software development (Dev), product security management (Sec), and information-technology operations (Ops) and maintenance services for all products listed in this task order in accordance with Sections 5.1 through 5.4. The Contractor shall also provide product and delivery management, systems architecture design, user research/feedback, user experience strategy, interaction design, Accessibility analysis and mitigation of defects, integration support, and data analytics to build and continuously improve new and existing Veteran experience solutions.

Currently the portfolio uses many different technologies for this work including Microsoft (MS) Dynamics 365 (D365), Salesforce, and other custom development platforms. This is not an exhaustive list and may change throughout the life of the task order based on modernization, decommissioning, streamlining, or creation of products within the portfolio.

Critical Applications:

1. Veterans Experience Integration Solution (VEIS)

2. VA Health Connect

3. Veterans Crisis Line (chat and CRM)

Non-Critical Applications:

1. Unified Desktop Optimization CRM (UDO)

2. Veterans Outreach Interaction and Communication Engine (VOICE) CRM

3. Patient Advocate Tracking System Replacement (PATS-R)

4. Ask VA (AVA)

5. Community Care CRM (CommCare)

6. VET-HOME CRM

7. Member Services CRM

8. Education Call Center CRM

9. Women’s Veterans Call Center CRM

10. Center for Development and Civic Engagement Portal (CDCEP)

11. VA Customer Experience Service Recovery Platform (VACXSRP)

12. VA Privacy Service Customer Support

13. User Management Tool

14. Omnichannel Live Agent Chat

15. Omnichannel Authentication

16. Voicebot

4.0 PERFORMANCE DETAILS

4.1 PERFORMANCE PERIOD

The Period of Performance (PoP) shall consist of a 12-month base period and four 12- month option periods and two Optional Tasks. The overall PoP shall not exceed 60 months.

There are eleven (11) Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, four are set by date:

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

4.2 PLACE OF PERFORMANCE

Tasks under this PWS shall be performed at Contractor facilities. The Contractor shall identify the Contractor’s place of performance in their proposal submission. It is expected that this work will be conducted during core business hours, unless specified otherwise. For specific meeting types, including user requirements sessions and other key meetings which are best accomplished at Government facilities, the Government will schedule meeting rooms as necessary.

4.3 TRAVEL OR SPECIAL REQUIREMENTS

The Government anticipates travel to perform the tasks associated with the effort, as well as to attend program-related meetings or conferences throughout the PoP. Travel shall be in accordance with the Federal Travel Regulations and requires advanced concurrence by the COR. Contractor travel within the local commuting area will not be reimbursed by the Government.

The total estimated number of trips in support of the program related meetings for this effort is 10. Anticipated locations include the following, estimated at 5 days in duration:

1. Washington D.C.

1. Atlanta, GA

1. Denver, CO

1. Austin, TX

5.0 SPECIFIC TASKS AND DELIVERABLES

The Contractor shall perform the following:

5.1 PROJECT MANAGEMENT

5.1.1 CONTRACTOR PRODUCT AND PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, timeline, and tools to be used in execution of the contract. The CPMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks, and resource support. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPMP shall be concurred upon and updated in accordance with Section B of the contract. The Contractor shall update and maintain the VA PM approved CPMP throughout the PoP.

Deliverable:

A. Contractor Product and Project Management Plan

5.1.2 REPORTING REQUIREMENTS

The Contractor shall provide the COR with a Monthly Progress Report using a modern, automated tool approved by the COR. The report shall include detailed instructions/explanations for each required data element, to ensure that data is accurate and consistent. The report shall reflect data as of the last business day of the preceding period.

The Monthly Progress Report shall cover all work completed during the reporting period and work planned for the subsequent reporting period for each project. The report shall also identify any problems that arose and a description of how the problems were resolved. If problems have not been completely resolved, the Contractor shall provide an explanation including their plan and timeframe for resolving the issue. The report shall also include an itemized list of all documents and electronic deliverables. The Contractor shall monitor performance against the CPPMP and report any deviations in the next report. It is expected that the Contractor shall l keep in communication with VA accordingly so that issues that arise are transparent to both parties to prevent escalation of outstanding issues. The Contractor shall also provide the data and reporting content to support management level reporting. If the Contractor is proposing a specific tool such as Smartsheet, the associated licensing shall be included in the cost of the proposal.

Deliverable:

A. Monthly Progress Report

5.1.3 TECHNICAL KICKOFF MEETING

A technical kickoff meeting shall be held within ten days after TO award. The Contractor shall coordinate the date, time, and location (can be virtual) with the Contracting Officer (CO), as the Post-Award Conference Chairperson, the VA PM, as the Co-Chairperson, the Contract Specialist (CS), and the COR. The Contractor shall provide a draft agenda to the CO and VA PM at least five calendar days prior to the meeting. Upon Government approval of a final agenda, the Contractor shall distribute to all meeting attendees. During the kickoff-meeting, the Contractor shall present, for review and approval by the Government, the details of the intended approach, work plan, and project schedule for each effort via a Microsoft Office PowerPoint presentation. At the conclusion of the meeting, the Contractor shall update the presentation with a final slide entitled “Summary Report” which shall include notes on any major issues, agreements, or disagreements discussed during the kickoff meeting and the following statement, “As the Post-Award Conference Chairperson, I have reviewed the entirety of this presentation and assert that it is an accurate representation and summary of the discussions held during the Technical Kickoff Meeting for the contract.” The Contractor shall submit the final updated presentation to the CO for review and signature within three (3) calendar days after the meeting. The Contractor shall also work with the CS, the Government’s designated note taker, to prepare and distribute the meeting minutes of the kickoff meeting to the CO, COR and all attendees within three calendar days after the meeting. The Contractor shall obtain concurrence from the CS on the content of the meeting minutes prior to distribution of the document.

Deliverables:

A. Kick-Off Meeting Draft Agenda B. Kick-Off Meeting Presentation C. Kick-Off Meeting Minutes

5.1.4 PRODUCT MANAGEMENT AND OVERSIGHT/KEY PERSONNEL

The Contractor shall provide resources that have the requisite skills and experience required to perform the tasks within the PWS. The Contractor agrees that the personnel identified below, as key to supporting this effort, shall not be removed from the TO effort, replaced or added to the TO without a compelling reason and without written notification to the Contracting Officer (CO).

It is the responsibility of the Contractor to provide Contractor support personnel and subcontractors who have the required educational background, experience, security clearance, and access authorization or combination thereof to meet the labor category descriptions under this task order for the required PWS tasks.

If any change to the Key Personnel assigned to the labor categories identified below becomes necessary (initial staffing, substitutions or additions), the Contractor shall immediately notify the CO/COR/PM in writing, accompanied by the resume, if applicable, of the proposed replacement personnel who shall be of at least substantially equal ability and qualifications as the individual(s) currently performing in that category and that the proposed replacement meets or exceeds the qualifications designated for that Key Personnel position. It is expected that substitution or replacement of the personnel will not occur within the first six (6) months after date of TO award.

The Contractor agrees that it has a contractual obligation to mitigate the consequences of the loss of Key Personnel and shall promptly secure any necessary replacements in accordance with (IAW) this PWS section. Failure to replace a Key Personnel pursuant to this clause and without a break in performance of the labor category at issue shall be considered a condition endangering contract performance and may provide grounds for default termination.

All Contractor team members shall possess demonstrated proficiency on modern VA tools such as Slack, Zenhub, Jira, Confluence, Salesforce, Pega, Fortify, Copado, Jenkins, Prometheus, PagerDuty and GitHub.

The labor categories below are identified as Key Personnel. Key Personnel must meet the corresponding requirements identified in the Labor Description column below:

· Expertise in managing entire agile software development lifecycle for a program of at least ten million dollars up to and including production delivery and some phase of post-delivery/warranty support.

· Expertise as a program manager accountable for delivery for at least 10 software products with a duration of greater than one year.

· Demonstrated success with delivering digital products.

Minimum Education Level

· Masters

Degree In

· Business Administration, Business Management, Computer Science, Information Systems, Information Resource Management, Industrial Engineering, Operations Research or related fields.

Minimum Experience

· 10 years

Substitutions

· A minimum of 5 years of relevant experience may be substituted for education

· Demonstrated knowledge and use of modern software development and Dev/Ops tools including GitHub and implementation of a Dev/Ops pipeline in a cloud environment.

· Chief Architect or Senior Engineer on a production system in one of the VAEC CSP Vendors Clouds

· Experience as a Software Engineer for at least one project in one of the VAEC’s Cloud Service Provider (CSP) Vendors Clouds.

Minimum Education Level

· Bachelors

Degree In

· Business Administration, Business Management, Computer Science, Information Systems, Information Resource Management, Industrial Engineering, Operations Research or related fields.

Minimum Experience

· 7 years

Substitutions

· Certifications in relevant technology plus a minimum of 7 years of relevant experience or a minimum of 10 years of relevant experience may be substituted for education

· NA

· Expertise running a 24x7x365 Software based System for at least 6 months.

· Expertise with oversight of an operations team of at least 5 people for at least one year.

· Expertise in Incident Management for a software-based system.

· Expertise with oversight of a team running a trouble ticket system.

· Demonstrated success using modern DevOps methods and tools including automated testing tools and monitoring tools.

· Demonstrated ability to drive frequent release cycles (daily/weekly).

Minimum Education Level

· Bachelors

Degree In

· Business Administration, Business Management, Computer Science, Information Systems, Information Resource Management, Industrial Engineering, Operations Research or related fields.

Minimum Experience

· 5 years

Substitutions

· Certifications in relevant technology plus a minimum of 5 years of relevant experience or a minimum of 7 years of relevant experience may be substituted for education

· Expertise using qualitative and quantitative research with both staff and the public— to design humane workflows that support staff in meeting the needs of the public they serve. Demonstrated experience working with complex data models and processes.

· Expertise in designing mock-ups, click-through, or coded prototypes, identifying opportunities to streamline interactions in the context of organizational needs.

· Expertise in balancing technical and experiential tradeoffs— and clearly communicating approach with conceptual diagrams, and visual interface designs.

· Expertise in creating key contextual design deliverables that connect the dots between research findings and UI designs.

· Expertise working with stakeholders in an iterative fashion, using human centered design principles, to break complex problems into smaller testable steps. At least five (5) years.

Minimum Education Level

· Bachelors

Degree In

· Business Administration, Business Management, Computer Science, Information Systems, Information

Resource Management, Industrial Engineering, Operations Research or related fields.

Minimum Experience

· 3 years

Substitutions

· Certifications in relevant UX Software plus a minimum of 3 years of relevant experience; or a minimum of 5 years of relevant experience may be substituted for education

· communication and coordination of activities between all teams, external and internal clients, and contract stakeholders pertaining to team products and product delivery to end-users.

Minimum Education Level

· Bachelors

Degree In

· Business Administration, Business Management, Computer Science, Information Systems, Information Resource Management, Industrial Engineering, Operations Research or related fields.

Minimum Experience

· 5 years

· A minimum of 8 years of relevant experience may be substituted for education

5.2 CAPABILITY LIFECYCLE MANAGEMENT

The Contractor shall follow the core functions of Software Development Lifecycle Management (SDLC) utilizing established agile frameworks, such as SAFe and other emerging innovative frameworks, to deliver a broad range of solutions. The Contractor shall follow test-driven development methodology to provide systems and software engineering, web services development, and software release and change management services. The Contractor shall continuously improve all new and existing solutions by implementing configurations, capabilities and enhancements, bug fixes, monitoring, testing and evaluation, business intelligence and application performance monitoring analytics, and support activities, while collaborating closely with the VA stakeholder and VA Line of Business throughout the development process. The Contractor shall configure, develop, maintain, test, and deploy business and technology feature releases. Teams for this effort shall be composed of an evolving mix of technical and operational skill sets across agile frameworks as required to meet the necessary stage of the capability development lifecycle management and technical nature of the capability. The Contractor shall adjust deliverables and repository tool updates to match the nature of the capability and/or SDLC frameworks.

The Contractor shall adhere to core design principles, including minimizing custom code, maximizing re-usability, and adherence to VA Policies and standards and governance.

5.2.1 AGILE REQUIREMENTS ELICITATION AND ELABORATION

The Contractor shall create Prioritized Program Epic Backlog and Prioritized Product Team Backlog and complete continuous and iterative backlog grooming sessions to gather, elicit, understand and elaborate agile business requirements. Agile requirements shall be represented across various issue types, such as epics and associated user stories, dependencies, and defects. The Contractor shall ensure that all agile requirements are linked and mapped to epics ensuring traceability and transparency from backlogs to Sub-product product increment (PI) and Product PI Roadmaps. An epic should represent one capability type deliverable within one PI unless IAW Section

5.2.4. PI Roadmap and Planning paragraph Backlog grooming and prioritization are continuous and iterative throughout the PoP and shall be facilitated by the Contractor.

Elaboration sessions shall include participants from the business customer, OI&T and system SMEs, as well as end-user participation, where appropriate, ensuring requirements meet both business customer and end-user requirements. Due to the severity and urgency of defects, the Contractor shall facilitate ad-hoc sessions aligned to the solution’s operational support model supporting Hotfix releases. The Contractor shall document and manage all agile requirement elaboration and elicitation activity, such as capability requirements, strategic stakeholder decisions, scope limitations, exception approvals, manual workarounds, and solution customizations in a VA approved repository. The Contractor shall distribute agile requirement elaboration and elicitation activity documentation to key stakeholders per direction of VA stakeholders. The program epic and product team backlog serves as the primary authoritative requirements source for all capabilities and solutions to be delivered. The outcome of these sessions shall be a complete review and agreement of decomposed, groomed, and executable program epics and user stories containing:

a) Business use case and requirements

b) Human Centered Design requirements, such as

a. End-user requirements and research

b. Mock-ups

c. Wireframes

d. Screen flows

e. Navigation

f. Taxonomy

g. Prototypes

c) Functional requirements

d) Compliance requirements, such as

a. Section 508

b. FedRAMP Authorization

c. Health Insurance Portability and Accountability Act (HIPAA)

d. Office of National Coordinator (ONC) 21st Century Cures Act Final Rule

e. Authority to Operate (ATO)

f. Authority to Connect (ATC)

g. Privacy Impact Assessment (PIA)

h. Privacy Threshold Analysis (PTA)

e) Non-functional requirements, such as

a. Security features and controls

b. Reliability

c. Performance

d. Maintainability

e. Scalability

f. Identity and access management

g. Usability

f) Requirements visualizations, such as

a. Story maps

b. Business process flows

g) Blockers, such as

a. Dependencies

b. Risks

c. Impediments,

h) Business rules

i) Business intelligence and reporting requirements

j) Configurations with change management

k) Acceptance criteria with clearly defined and testable pass/fail criteria

l) Testing scenarios and requirements

m) Measurable success metrics and requirements for business and technology impacts.

The Contractor shall ensure all agile requirements are:

1. Stored in a VA approved repository.

2. Decomposed, groomed, and executable IAW Section 5.2.4 PI Roadmap and Planning unless directed otherwise by the VA team.

3. Fully linked to program epics.

4. Maintained at a minimum of four weeks of groomed, ready-to-work agile requirements per team; and,

5. Execute a Requirements Package accordingly that includes all target agile requirements including content, attachments, links, and artifacts IAW Section 5.2.1.A – 5.2.1.L, Agile Requirements Elicitation and Elaboration.

6. Classify requirements as follows:

a. New Feature

b. Enhancement Feature

c. Non-Functional

d. Technology Investment

e. Defect requirement

In addition, the Contractor shall ensure that defects are mapped back to the original agile requirement.

Deliverables:

A. Prioritized Program Epic Backlog (in JIRA) B. Prioritized Product Team Backlog (in JIRA)

5.2.2 SOLUTION ARCHITECTURE & ENGINEERING

The Contractor shall create a Solution Architecture Package supporting and IAW Section 5.2.1, Agile Requirements Elicitation and Elaboration and Section 5.2.4, Product Increment (PI) Roadmap and Planning that includes the architectural design, requirements, and management of business, system, platform, application, and data for each value stream, program epic and associated agile requirements. The architecture framework shall be approved by VA stakeholders. In addition, the Contractor shall support agile requirements IAW Section 5.2.1, Agile Requirements Elicitation and Elaboration. The Contractor shall update and distribute the solution architecture IAW with Section 5.2.1, Agile Requirements Elicitation and Elaboration. The Contractor shall document any potential technology-based blocker impacting future solution delivery in the appropriate agile requirement IAW Section 5.2.1, Agile Requirements Elicitation and Elaboration.

The Contractor shall:

1. Support and coordinate with VA to ensure configuration and alignment of all required environments. The Contractor shall work with VA to ensure required specifications are provided no later than 30 days prior to environment need date.

2. Support non-functional and compliance requirements.

3. Provide support for the initial design and technical analysis.

4. Develop a prioritized program and product team backlog of architectural/platform requirements.

5. Create and maintain enterprise architecture, designs, and strategies in an iterative manner over the course of sprints and PIs.

6. Optimize solution reusability in the development of architecture patterns and solution delivery.

Deliverable:

A. Solution Architecture Package

5.2.3 PRODUCT INCREMENT (PI) ROADMAP AND PLANNING

The Product Increment (PI) roadmap is the scope of prioritized work targeted and committed by each solution to be completed in the agreed upon PI timeframe. Each solution shall have a roadmap defined as the Sub-product PI Roadmap. All Sub-product PI Roadmaps shall aggregate to a create an Agile Release Train (ART) PI Roadmap and Product PI Roadmap. The ART PI Roadmap is a self-organizing collection of agile teams delivering business and technology impacts pertaining to the same value stream. The Product PI Roadmap represents all solutions across value streams. PI roadmap delivery timeframes are not to exceed (NTE) three - month delivery cycles, unless otherwise directed by VA stakeholders. Each Sub-product PI Roadmap shall deliver at least one business capability type and one technology capability type to production, unless otherwise approved by the VA stakeholders. A program epic should represent one capability type deliverable within one PI unless otherwise approved by VA. Each sub-product PI roadmap shall outline, at minimum, the prioritized program epics targeted for delivery in the PI, the capability type, business and technology impact, value stream, agile estimation to complete and deliver solutions, estimated delivery date and delivery confidence metric, sequence of work, identifying dependencies and fostering cross-team and cross-ART collaboration .

The Contractor shall complete the proposed Sub-product PI Roadmap at least five days prior to the start of the PI Planning session. The Contractor shall coordinate, manage, and facilitate the planning session at the direction of VA stakeholders. The Contractor shall obtain approval of Sub-product PI Roadmaps, ART PI Roadmaps, and Product PI Roadmaps from VA stakeholders at the conclusion of the PI Planning session. The approved roadmaps serve as the primary authoritative source for all prioritized capabilities and solutions to be delivered. Planning for the next PI roadmap and Planning session will occur during the execution of current Sub-product and Product PI IAW Section 5.2.1, Agile Requirements Elicitation and Elaboration. Changes to roadmap priorities after the planning session shall be reviewed and approved by VA stakeholders in consideration to impact and cost of delay (CoD) of Work In Progress (WIP) and new emerging priorities.

The Contractor shall:

1. Coordinate, manage and facilitate the PI Planning sessions across solutions

2. Develop proposed Subproduct PI Roadmaps for each solution

3. Obtain approval of prioritize scope of work at the conclusion of PI Planning sessions

4. Develop, maintain and execute approved PI roadmaps

Deliverables:

A. Sub-product PI Roadmap B. ART PI Roadmap C. Product PI Roadmap

5.2.4.0 TEAM PLANNING

The Contractor shall analyze the prioritized and refined agile requirements IAW Section 5.2.1, Agile Requirements Elicitation and Elaboration and Section 5.2.3, PI Roadmap and Planning to develop the associated tasks and work items that captures the technical design, agile estimation, and Definition of Done. The Contractor shall propose and obtain approval of any combination of Scrum and Kanban frameworks to manage, execute, and deliver solutions from VA stakeholders. The Contractor shall create a Sprint Plan or Kanban board for Sub-product PI Roadmaps.

Agile estimation of work shall be represented by story points utilizing the Fibonacci scale (1,2,3,5,8,13,21, etc.). For agile estimation, no agile requirement should exceed one business week to complete unless the requirement cannot be decomposed into smaller consumable components. Any estimated item exceeding this guidance needs to be called out as a blocker in the Sprint Plan and/or Kanban board. The Contractor shall determine the Sprint capacity or Kanban WIP limits based on velocity and team capacity assuring 100% utilization. The Contractor shall reserve 20% of WIP limits and 20% of story point capacity per team for technology capabilities unless otherwise directed by VA. The Contractor shall adhere to the Scrum delivery framework-based teams and/or the Kanban delivery framework-based teams.

For Scrum framework-based teams, the Contractor shall initiate Sprint Planning at the beginning of each sprint. The Contractor shall:

1. Create and prioritize the scrum team backlog unless otherwise directed by VA.

2. Identify, develop, and document the design and associated tasks IAW Section

5.2.3 Solution Architecture & Engineering to complete for agile requirement and meet the Sprint Definition of Done.

3. Identify, develop and document any additional testing events required for the Sprint that are in addition to acceptance criteria.

4. Link the agile requirement with all Sprint IDs associated to complete it.

5. Create the Sprint Plan at the conclusion of the Sprint Planning. The Sprint Plan shall be tailored to the scope of the sprint and shall include, at a minimum, business and technology impact, Scrum team backlog, detailed design, blockers, team velocity, Sprint capacity and utilization, Definition of Done, test plan and additional test events. The Sprint Plan shall be approved by VA stakeholders prior to the start of sprint execution.

For Kanban framework-based teams, the Contractor shall manage, execute, and deliver work in a prioritized on-demand sequence. The Contractor shall:

1. Create and prioritize the Kanban team backlog unless otherwise directed by VA.

2. Identify, develop, and document the design and associated tasks IAW Section 5.2.3, Solution Architecture & Engineering to complete for agile requirement and meet the Definition of Done.

3. Identify, develop and document any additional testing events required for the requirement that are in addition to the acceptance criteria.

4. Create a Point-In-Time Kanban Board Planning Report displaying current WIP and team backlog IAW Section 5.2.4 PI Roadmap and Planning.

Deliverable:

A. Sprint Plan/Point-in-Time Kanban Board Planning Report

5.2.4.1 AGILE EXECUTION

The Contractor shall document, validate, and execute the team design and testing tasks and requirements IAW Section 5.2.4.1 Team Planning, Section 5.2.3 Solution Architecture & Engineering and Section 5.2.1 Agile Requirements Elicitation and Elaboration. The Contractor shall document all execution activity in VA approved repositories and fully link all execution activity to the appropriate agile requirement.

Execution activity shall include work items, throughput management, designs, source code, test cases and results, features, capabilities, system services, risks, issues, impediments, and retrospectives. The Execution testing approach and scope shall include the following testing types as required:

a. Unit;

b. Functional;

c. Accessibility;

d. System;

e. Reliability;

f. Usability;

g. Interoperability;

h. Regression;

i. Security;

j. Performance.

The Contractor shall enable the automated build, test, and deployment pipeline of solutions IAW with DevSecOps, a set of best practices that combines software development (Dev), security (Sec), and IT operations (Ops).

The Contractor shall:

1. Execute the design and associated tasks to complete the agile requirement and meet the Definition of Done.

2. Execute test plan and any additional testing events, as required.

3. Develop, manage, schedule, and deliver automated testing capabilities enabling continuous integration and continuous deployment (CI/CD).

4. Develop, manage, schedule, and deliver a CI/CD pipeline of agile requirements. Automated build tools shall be approved by VA.

5. Facilitate and participate in daily team review sessions (typically 15 minutes) to discuss the team’s progress, impediments and daily plans.

6. Facilitate, participate, and document minutes of twice weekly VA stakeholder review session to communicate progress, impediments, and delivery confidence metrics across all teams. Additional sessions may be requested by VA stakeholders.

7. Document and manage team’s throughput through the following iterative reports:

a. Sprint Burn Down Charts documenting planned vs actual agile estimated metric values in comparison to velocity and capacity

b. Cumulative Flow Diagram

c. Kanban Bi-weekly Report documenting actual agile estimated values through various lifecycle stages compared to WIP Limits

d. Scrum Velocity Charts

e. Kanban WIP Limit Charts

8. Coordinate, facilitate, execute, and document the team demonstrations via the Capability Demonstration and VA stakeholder approval of completed agile requirements, acceptance criteria, and definition of done.

9. Initiate and participate in iterative team and capability release retrospectives and baseline and recalibrate team velocity and/or WIP limits performance, discuss lessons learned, and identify opportunities to implement process improvements for solution delivery and quality.

Deliverables:

A. Sprint Burn Down Charts B. Kanban Bi-Weekly Report C. Cumulative Flow Diagrams D. Scrum Velocity Charts E. Kanban WIP Limits Charts F. Capability Demonstration

5.2.5 TESTING

The Contractor shall follow SAFe agile, TDD methodology to provide regression, sprint and build testing for D365 applications. The Contractor shall provide automated testing through Robotic Process Automation (RPA) with UiPath. The Contractor shall conduct sprint and build testing as follows:

5.2.5.1 Regression, Sprint and Build Testing

The Contractor shall adopt Agile best practices for integration testing into each Agile sprint and build. The Contractor shall conduct these tests as applicable throughout the product lifecycle using industry best practices of continuous integration methods and automated regression testing utilities approved in the TRM.

The Contractor shall provide a Build Test Plan following the templates and data requirements for each test appropriate to each phase of development. The Contractor shall provide Test Results in the approved repository which is the final piece of data that completes the Requirements Traceability Matrix (RTM). The Contractor shall create automated test scripts, conduct testing (to include, at a minimum, unit, development, performance, security, Section 508, functional and integration) and document results in the Test Report.

The Contractor shall provide technical support for security, accessibility, performance, technical standards, architectural compliance, user acceptance and initial operational capability tests, audits, and reviews. Security scanning is done by multiple methods and is done multiple times throughout the course of a project with methods such as infiltration testing, Web Application Security Assessment (WASA), static code analysis tools , etc. Accessibility reviews are performed through a variety of tool based and manual reviews, able to scan web applications and other technologies used for user interfaces. Performance testing is done through load testing and technical analysis of capacity planning data submitted by the project team. Architectural compliance assessments are done through submission of design materials to confirm compliance within the enterprise architecture.

The Contractor shall ensure all test and compliance review planning and execution details are included in the Build Test Plan. The testing and compliance results must be entered and maintained in the Repository and under version control. The Contractor shall ensure that results of all assessments of the project performed by the Contractor or by VA offices are consolidated into the Repository for planning and status reporting.

When a defect is identified during testing, the Contractor shall log it in a VA approved Repository, selecting the appropriate severity level. The Contractor shall provide information to recreate the defect for purposes of analysis and remediation. The Contractor shall prioritize the defect in the sprint backlog which shall be reviewed by the project team and approved by the VA PM/PO. Based on the priority, the defect could be entered into the current sprint or entered into the backlog.

The Contractor shall ensure the Repository data is updated daily so VA stakeholders can access accurate and timely status.

DELIVERABLES

A. Build Test Plan B. Test Results C. Test Reports D. Requirements Traceability Matrix

5.2.6 PRODUCT DEPLOYMENT

The PI roadmap capability may be deployed continuously and iteratively during the PI. The Contractor is not required to wait until the end of the PI delivery cycle to deploy a capability.

The contractor shall be responsible for the deployment and release of all VRM products, including custom solutions, Microsoft Dynamics 365, and Salesforce products.

The Contractor shall develop and execute a Deployment Plan that includes Pre and Post deployment steps (including timeline and responsible party), and back-out and rollback procedures as documented in a Deployment Installation & Backout Guide to be utilized when doing the deployments. The Deployment Plan, as well as the capabilities, components, and configurations being added/changed, shall be tested by the Contractor in a rehearsal deployment in a pre-production environment.

Each PI shall contain a Capability End-to-End (E2E) Deployment Test Plan and Results for each business and technology capability optimizing capability delivery and quality assurance while minimizing defects across solutions and value streams. The Contractor shall document the program epic test plans, scope of testing, approach, and appropriate testing types, such as unit, functional, accessibility, system, reliability, usability, interoperability, regression, security, and performance. The Contractor shall utilize standard test automation and additional testing scenarios, as required, to validate critical business and technology functionality and continuity. Testing may include the end-user community, when appropriate and available.

The Contractor shall prepare Release Notes and a Version Description Document (VDD) to document the changes in functionality being deployed, in terms that are understandable by the target user personas.

The Contractor shall deploy the product to the target audience in the production environment. Contractor support shall include one (1) or more technicians, as requested by the VA stakeholders, to attend meetings with the customer to document, research and resolve technical issues after successful release to production. Technicians shall create, groom, and deliver agile requirements for validated defects IAW with Section 5.2.1 Agile Requirements Elicitation and Elaboration and Section 5.2.4.1, Team planning.

The Contractor shall utilize the CI/CD pipeline and test automation to promote capability delivery through necessary pre-production environments into production. The Contractor shall document and manage all deployment artifacts, including Source Code, in a VA approved repository.

Deliverables:

A. Deployment Plan B. Deployment Installation & Backout Guide C. Capability E2E Deployment Test Plan and Results D. Release Notes E. Version Description Document F. Source Code

5.2.7 PRODUCT FEEDBACK AND DATA COLLECTION

Gathering product feedback for IT software products involves actively seeking input from various stakeholders, including end-users, Veterans, and other relevant parties. This feedback can be collected through diverse channels, such as surveys, user interviews, usability testing, support ticket analysis, and operational data from the product itself.