Health Services DevSecOps Draft PWS 29June2021.docx

Health Services DevSecOps Support

VA-21-00044934

TRANSFORMATION TWENTY-ONE TOTAL TECHNOLOGY NEXT GENERATION (T4NG)

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Office of Information & Technology Enterprise Program Management Office (EPMO)

Health Services Development, Security, and Operations (DevSecOps) Support

Date: June 29, 2021

VA-21-00044934

Task Order PWS Version Number: 1.6

Contents

BACKGROUND

The mission of the Department of Veterans Affairs (VA), Office of Information and Technology (OIT), Enterprise Program Management Office (EPMO) is to provide Product Line Management (PLM), oversight, and overall leadership to software development projects, Commercial Off-The-Shelf (COTS), and Software as a Service (SaaS) implementations, and system maintenance to support VA business functions and deliver value. VA depends on Information Technology (IT) products and services to contribute to value streams in support of VA’s mission to care for and serve Veterans. In alignment with VA’s four strategic goals as well as OIT priorities, guiding principles, imperatives, and focus areas, OIT contributes value by providing high-quality, effective, and efficient IT services to those responsible for directly or indirectly providing care and services to Veterans.

The EPMO Health Services Portfolio team delivers health OIT products critical to addressing the needs of Veterans and health care providers. With a focus on quality IT delivery and VA health initiatives, the Health Services Portfolio team manages the entire Software Development Lifecycle (SDLC) process of health OIT products to create the best experience for all Veterans.

The Health Services Portfolio is currently composed of 11 product lines within three sub-portfolios: Health Next Generation, Legacy and Electronic Health Record Modernization, and Major Initiatives. Under Health Next Generation, there are four product lines, which are Telehealth and Scheduling, Community Care, Provider Systems, and Medical Research, Education, and Population Health. Under Legacy and Electronic Health Record Modernization, there are six product lines, which are Veterans Health Information System Technology Architecture (VistA) Office, Health Care Administration, Health Financial, Medical Devices, Electronic Health Record Modernization, and Clinical Ancillary. Under Major Initiatives is Supply Chain for VistA support. The composition and alignment of product lines may shift as the Health Services Portfolio continues to evolve.

Under the PLM model, VA teams are directly led and managed by product managers (formerly program managers) and operations managers (formerly project managers). In this Performance Work Statement (PWS), these VA managers are referred to as “VA lead(s).”

Within Health Services, the product lines and teams within each line require support to develop, test, deploy, and operate and maintain products and solutions to meet business needs across VA. Product backlogs provide descriptions of planned development and sustainment work.

VA employs a Development, Security, and Operations (DevSecOps) methodology and Scaled Agile Framework (SAFe) practices focused on bringing about business value through continuous delivery and improvement. The requirements identified in this PWS are intended to provide development, testing, deployment, and security and operations support for legacy, current, and future products or services in a DevSecOps lifecycle.

APPLICABLE DOCUMENTS

The Contractor shall comply with the following documents, in addition to the documents in Paragraph 2.0 in the T4NG Basic PWS, in the performance of this effort:

1. EPMO Product Line Management Playbook, Version 2.0, May 2021

2. Veteran-Focused Integration Process (VIP) Guide 4.0, March 2021

3. “VA Product (Line) Accountability and Reporting System (VA PARS) Guide 3.0”, December 2020

4. Federal Risk and Authorization Management Program (FedRAMP), “FedRAMP Standard Contractual Clauses”, June 2017

5. VA Enterprise Cloud (VAEC) Technical Reference Guide, Version 1.1 October 2017

6. Use of Cloud-Based Native Technologies and Approaches, April 10, 2018

7. DevSecOps Release Framework (DRF), Version 5.1, October 27,2020

8. Attachment A – First Party Lockbox High-Level Business Process Flow

9. Attachment B – Product List_Average Ticket Count

10. Attachment C - DevSecOps Tools and the Delivery Process

11. Attachment D - As-Is Intake Process for Health Product Support

12. Attachment E - Architecture Standard Operating Framework

13. Attachment F - Key Performance Indicators (KPIs) for DevSecOps Support/

14. Attachment G – Product Line Architecture (PLA) - VA Enterprise Architecture

SCOPE OF WORK

The Contractor shall provide shippable products, operations support, and security compliance for the Health Services Portfolio. A shippable product is defined as health services related software, code or interface that has been deployed to a production like environment, validated through testing, monitored for resiliency, and determined to be operable and available for customers. This support includes all development, testing, integration, architecture (with concurrence from enterprise and product line architecture), refactoring as needed, and all ongoing planned and unplanned operations and maintenance support to include predictive, preventative, corrective, and evolutionary through a cycle of Continuous Integration.

APPLICABILITY

This Task Order (TO) effort PWS is within the scope of paragraph(s) 4.1 Program Management, Strategy, Enterprise Architecture and Planning Support; 4.2 Systems/Software Engineering; 4.3 Software Technology Demonstration and Transition; 4.4 Test & Evaluation (T&E);

4.8 Operations and Maintenance (O&M); 4.9 Cyber Security; 4.10 Training; and 4.11 Information Technology Facilities of the T4NG Basic PWS.

ORDER TYPE

The effort shall be proposed on a Firm-Fixed Price (FFP) basis with a Cost Reimbursement line item for travel.

PERFORMANCE DETAILS

PERFORMANCE PERIOD

The Period of Performance (PoP) shall be 12 months from date of award, with four 12-month option periods and six optional tasks. The overall PoP shall not exceed 62 months.

PLACE OF PERFORMANCE

Efforts under this TO shall be performed at Contractor facilities. The Contractor shall identify the Contractor’s place of performance in their Task Execution Plan submission.

When travel is required, work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO) or the Contracting Officer’s Representative (COR).

TRAVEL OR SPECIAL REQUIREMENTS

The Government encourages the Contractor to maximize its use of teleconferencing and video conferencing for meetings.

The Government anticipates travel to perform the tasks associated with the effort, as well as to attend program-related meetings or conferences throughout the PoP.

The total estimated number of trips in support of the program related meetings for this effort is 115 trips over the life of the task order, with five people traveling for an average of five days per trip. Anticipated locations include, but are not limited to, the following:

1. Tampa, FL

2. Denver, CO

3. Washington, DC

4. Salt Lake City, UT

5. Austin, TX

Travel shall be in accordance with the Federal Travel Regulations (FTR) and requires advanced concurrence by the COR. The Contractor shall provide cost estimates with each travel request. Each Contractor invoice shall include copies of all receipts that support the travel costs claimed in the invoice. Contractor travel within the local commuting area will not be reimbursed. Also, not reimbursable are travel performed for personal convenience or daily travel to and from work at the Contractor’s facility.

CONTRACT MANAGEMENT

All requirements of Sections 7.0 and 8.0 of the T4NG Basic PWS apply to this effort. This TO shall be addressed in the Contractor’s Progress, Status and Management Report (CPSMR) as set forth in the T4NG Basic contract.

GOVERNMENT FURNISHED PROPERTY

The Government has multiple remote access solutions available to include Citrix Access Gateway (CAG), Site-to-Site Virtual Private Network (VPN), and RESCUE VPN.

The Government’s issuance of Government Furnished Equipment (GFE) is limited to Contractor personnel requiring direct access to the network to: development environments; install, configure, and run Technical Reference Model (TRM) approved software and tools (e.g., Oracle, Fortify, Eclipse, SoapUI, WebLogic, LoadRunner); upload/download/ manipulate code, run scripts, and apply patches; configure and change system settings; check logs, troubleshoot/debug, and test/QA.

When necessary, the Government will furnish desktops or laptops, for use by the Contractor to access VA networks, systems, or applications to meet the requirements of this PWS. The overarching goal is to determine the most cost-effective approach to providing needed access to the VA environment coupled with the need to ensure proper Change Management principles are followed. Contractor personnel shall adhere to all VA system access requirements for on-site and remote users in accordance with VA standards, local security regulations, policies, and rules of behavior. GFE shall be approved by the COR and Program Manager on a case-by-case basis prior to issuance.

Based upon the Government assessment of remote access solutions and requirements of this TO, the Government estimates that the following GFE will be required by this TO:

1. 75 standard laptops

2. 150 developer grade laptops

The Government will not provide IT accessories including but not limited to Mobile Wi-Fi hotspots/wireless access points, additional or specialized keyboards or mice, laptop bags, extra charging cables, extra Personal Identity Verification card readers, peripheral devices, or additional Random-Access Memory (RAM). The Contractor is responsible for providing these types of IT accessories in support of the TO as necessary and any VA installation required for these IT accessories shall be coordinated with the COR.

The Status of Government Furnished Equipment Report under the T4NG Basic Contract requirements is applicable to this TO and shall be delivered to the COR/VA Program Manager as required.

The Contractor will be provided access to Government Equipment such as servers, networks, and information. The Contractor shall comply with VA information security and privacy policies and procedures as described in Section 6.1 of the T4NG Basic PWS.

The Government will provide access to VA’s Jira/GitHub or other project/product repository(s) to provide appropriate Agile project/product application lifecycle management toolsets to track execution details after Contractor personnel complete the training as required in PWS Section 5.1.4. To access VA’s Jira/GitHub, the Contractor will require VA access. If the mandated toolset changes throughout the PoP of this TO, then the Government will provide access to the new toolset.

VA may provide VA-specific software as appropriate. The Contractor shall utilize VA provided accounts, document and requirements repositories and others as required for the configuration, storage, maintenance, and delivery of products. The Contractor shall comply with VA information security and privacy policies and procedures as described in Section 6.1 of the T4NG Basic PWS.

SECURITY AND PRIVACY

All requirements in Section 6.0 of the T4NG Basic PWS apply to this effort. Specific TO requirements relating to Addendum B, Section B.4 paragraphs j and k supersede the corresponding T4NG Basic PWS paragraphs, and are as follows,

j. The vendor shall notify VA within 24 hours of the discovery or disclosure of successful exploits of the vulnerability which can compromise the security of the Systems (including the confidentiality or integrity of its data and operations, or the availability of the system). Such issues shall be remediated as quickly as is practical, but in no event longer than two days.

k. When the Security Fixes involve installing third party patches (such as Microsoft OS patches or Adobe Acrobat), the vendor will provide written notice to VA that the patch has been validated as not affecting the Systems within 10 working days. When the vendor is responsible for operations or maintenance of the Systems, they shall apply the Security Fixes within two days.

It has been determined that protected health information (PHI) may be disclosed or accessed and a signed Business Associate Agreement (BAA) shall be required. The Contractor shall adhere to the requirements set forth within the BAA, referenced in Section D of the Request for Task Execution Plan (RTEP) and shall comply with VA Directive 6066.

POSITION/TASK RISK DESIGNATION LEVEL(S)

In accordance with VA Handbook 0710, Personnel Security and Suitability Program, the position sensitivity and the level of background investigation commensurate with the required level of access for the following tasks within the PWS are:

Position Sensitivity and Background Investigation Requirements by Task

The Tasks identified above, and the resulting Position Sensitivity and Background Investigation requirements identify the Background Investigation requirements for Contractor individuals based upon the tasks the particular Contractor individual will be working. The submitted Contractor Staff Roster must indicate the required Background Investigation Level for each Contractor individual based upon the tasks the Contractor individual will be working, in accordance with their submitted proposal.

RESOURCES

The Contractor shall provide resources with a blend of specific expertise operating and refining the SAFe for the enterprise to meet stakeholder expectations in terms of continuous improvements in quality, responsiveness, and consistency of releases. The Contractor shall adhere to industry standards.

The cross-functional team resources for the configuration, development of product enhancements, and underlying infrastructure support and maintenance necessary for the end to end functional performance to specifications of each solution delivered as part of this TO should consider the below info. Some of the other team roles/responsibilities in use include but are not limited to:

Table 1 Roles with Certifications

For Microsoft Azure Government (MAG) Azure Solutions Architect (Expert) or Azure DevOps Engineer (Expert) Pega Certified System Architect

For MAG Azure Solutions Architect (Associate) or Azure Developer (Associate) And International Information System Security Certification Consortium (ISC)2 (Certified Information System Security Professional)

Certified Information Security Manager (CISM) Global Information Assurance Certification (GIAC) Security Leadership Certification (GSLC)

Certified Information Systems Security Professional-Information Systems Security Engineering Professional (CISSP-ISSEP)

HealthShare Health Connect HL7 Interface Specialist Certification InterSystems IRIS Core Solutions Developer Specialist Certification

Microsoft Dynamics 365 Fundamentals

SPECIFIC TASKS AND DELIVERABLES

The Contractor shall perform the following tasks and provide the specific deliverables described below for each product/project initiated under this TO within the performance period stated in Section 4.1 of this PWS.

The Contractor shall adhere to VA policies and procedures to include the PLM Playbook, the VIP Guide or VA-approved Release Processes and adopt modern practices to continuously improve VA experiences through a combination of people, processes, and technology.

The Contractor shall provide cross-functional team resources for the configuration, development of product enhancements to include defect remediation and table maintenance, and underlying infrastructure support, and maintenance necessary for the end to end functional performance to specifications of each solution delivered as part of this TO.

The work defined in this PWS may require support outside of the normal work schedule, which is defined as Monday through Friday, 8am to 8pm Eastern Time, including weekends. The Contractor shall provide emergency contact information to enable the Government to contact the appropriate staff as needed.

The Contractor shall provide subject matter expertise in and utilize SAFe for product management to deliver iteratively and incrementally and regularly produce high quality results in a cost effective, timely, and highly collaborative manner via the DevSecOps value-driven lifecycle. This requires the Contractor to coordinate and maintain open lines of communication with VA interface development experts, other VA organizations, and multiple consumers within the contracts. The Contractor shall apply a DevSecOps approach that unifies software development, security, and operations; mandates collaboration across multiple IT functional divisions; prioritizes ongoing solution-oriented communication between the business and the IT organization; and develop, deliver, enhance, and manage applications and infrastructure for the business and supporting products.

The foundational structure for VA Agile development and product management can be found in the latest version of the VIP Guide. The VIP guide, and its associated VA PARS Dashboard, describes a schedule of product increments typically three months in length. For delivery of all project artifacts, the Contractor shall utilize VA-approved tools for managing project execution details and for the management and storage of artifacts using approved VIP/VA PARS and/or EPMO website templates. All tools used in the solution shall be VA Section 508 compliant as determined by tests performed by the VA Section 508 Office.

The Contractor shall adhere to VA policies and procedures to include, the PLM Playbook, VIP/VA PARS, or other VA approved Release Processes and adopt modern practices to continuously improve VA experiences through a combination of people, processes, and technology.

TASK ORDER MANAGEMENT

CONTRACTOR MANAGEMENT PLAN

The Contractor shall deliver a Contractor Management Plan (CMP) that lays out the Contractor’s approach, timeline, and tools to be used in execution of this TO effort. The CMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks, and resource support. The CMP shall also specify how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection and reporting requests as identified in this PWS. The initial baseline CMP shall be concurred upon and updated in accordance with Section B of the TO. The Contractor shall update and maintain the VA lead(s)-approved CMP throughout the PoP.

Deliverable:

A. Contractor Management Plan

REPORTING REQUIREMENTS

The Contractor shall use VA’s implementation of Jira, GitHub, or other VA-approved toolset to provide a single, authoritative Agile product lifecycle management tool to track execution details in a Product Data and Artifact Repository. All OIT product data and artifacts shall be required to be managed in this repository daily to synchronize work and ensure version control.

The Contractor shall utilize the VA-approved toolset to:

7. Input and manage product user guides and training materials

8. Input and manage linkages to correlate requirements to change orders to configurable items to risks, impediments, and issues to test cases and test results to show full traceability

The Contractor shall show all Agile requirements, changes, tests performed, and test results in the VA-approved toolset to show evidence of code coverage and test coverage of all the requirements specified. This will allow VA to have high confidence in a fully documented requirements traceability matrix.

TECHNICAL KICKOFF MEETING

A technical kickoff meeting shall be held within 10 days after TO award. The Contractor shall coordinate the date, time, and location (can be virtual) with the CO, as the Post-Award Conference Chairperson, the VA lead(s), as the Co-Chairperson, the Contract Specialist (CS), and the COR. The Contractor shall provide a draft agenda to the CO and VA lead(s) at least five calendar days before the meeting. Upon Government approval of a final agenda, the Contractor shall distribute to all meeting attendees.

During the kickoff-meeting, the Contractor shall present, for review and approval by the Government, the details of the intended approach, work plan, and project schedule for each effort via a Microsoft Office PowerPoint presentation.

At the conclusion of the meeting, the Contractor shall update the presentation with a final slide entitled “Summary Report,” which shall include notes on any major issues, agreements, or disagreements discussed during the kickoff meeting and the following statement “As the Post-Award Conference Chairperson, I have reviewed the entirety of this presentation and assert that it is an accurate representation and summary of the discussions held during the Technical Kickoff Meeting for the Health Services DevSecOps Support effort.”

The Contractor shall submit the final updated presentation to the CO for review and signature within three calendar days after the meeting. The Contractor shall also work with the CS, the Government’s designated notetaker, to prepare, finalize, and distribute CS-approved meeting minutes of the kickoff meeting to the CO, COR, and all attendees within three calendar days after the meeting. The Contractor shall obtain concurrence from the CS on the content of the meeting minutes prior to distribution of the document.

VA MANDATORY TRAINING

The Contractor and VA lead(s) shall determine which team members require access to the VA network and VA approved toolset. All Contractors that require access shall complete all required VA Talent Management System (TMS) training courses within 14 days of the identification of the access need. The Contractor shall work with its respective point of contact to obtain access to TMS to complete the mandatory courses.

As an action under the Continuous Readiness in Information Security Program (CRISP), VA's Assistant Secretary for Information and Technology issued a memorandum requiring all VA Government and contract staff to complete information security awareness and applicable role-based training. The Contractor shall submit TMS Training Certificates of completion for VA Privacy and Information Security Awareness (PISA), Rules of Behavior (ROB), Health Insurance Portability and Accountability Act (HIPAA), and role-based trainings. The Contractor shall provide signed copies of the Contractor Rules of Behavior in accordance with Section 9, Training, from Appendix C of the VA Handbook 6500.6, “Contract Security.”

The Contractor shall complete the appropriate VA TMS role-based training courses for all Contractors with required access to Elevated Privileges:

1. TMS ID 3197: Information Security Role-Based Training for IT Specialist (Web Based Training [WBT])

2. TMS ID 3867205: Training for Elevated Privileges for System Access (WBT)

3. TMS ID 3867207: Information Security Role-Based Training for System Owners (WBT)

4. TMS ID 1016925: Information Security Role-Based Training for Software Developers (WBT)

5. TMS ID 1357076: Information Security and Privacy Role-Based Training for System Administrators (WBT)

6. TMS ID 1357084: Information Security Role-Based Training for Data Managers (WBT)

7. TMS ID 1357083: Information Security Role-Based Training for Network Administrators (WBT)

8. TMS ID 64899: Information Security Role-Based Training for IT Project Managers (WBT)

The Contractor shall complete the following Agile training courses, and other emerging PLM and SAFe courses as necessary:

1. TMS ID 4533235: Product and Product Line Management: Creating and Managing the Product Back Log

2. TMS ID 4533231: Product and Product Line Management: Overview of Product Line Management

3. TMS ID 4551891: Introduction to Agile

4. TMS ID 4551982: Product Owner

The Contractor shall complete emerging training requirements for GitHub, Jira, or other VA-approved tools as appropriate or required.

Contractors who have completed these VA training courses within the past 12 or 24 months, depending on the training requirements, and have furnished training certificates to VA, will not be required to re-take the courses.

Deliverables:

A. TMS Training Certificates B. Signed Contractor Rules of Behavior

ONBOARDING/INPROCESSING

The Contractor shall manage the onboarding of its staff. Onboarding includes steps to obtain a VA PIV card, network and email account, complete training, initiate background investigations, and gain physical and logical access. In addition, the Contractor shall identify individuals who may require elevated privileges to the necessary development and test environments for the various systems to be enhanced. After review between the Contractor and VA COR, a decision will be made as to the necessity of obtaining GFE for the onboarding staff. If approved, the Contractor shall follow the appropriate steps to obtain the equipment.

A single Contractor Onboarding point of contact (POC) shall be designated by the Contractor that tracks the onboarding status of all Contractor personnel. The Contractor Onboarding POC shall be responsible to submit all required onboarding paperwork and required TMS certificates 48 hours from start date provided to the VA COR. The Contractor shall be responsible for tracking the status of all its staff onboarding activities to include the names of all personnel engaged on the task, their initial training date for VA Privacy and Information Security training, and their next required training date. The Contractor Onboarding POC and PM of the TO should communicate any issues with in-processing/onboarding of an incoming Contractor and shall follow-up with the VA POC of the status as required. The Contractor Onboarding POC shall also report the status at the staff level during onboarding status meetings. The Contractor shall provide a Weekly Onboarding Status Report for any staff with outstanding onboarding requests for review by the COR and VA PM.

To speed onboarding, VA may authorize the Contractor to use the Contractor’s tools for managing the work; however, at any point, VA can mandate that the Contractor move all the information housed in those tools to the approved VA toolset.

Deliverable:

A. Weekly Onboarding Status Report

PORTFOLIO AND PRODUCT LINE MANAGEMENT

The Contractor shall support the advancement of the maturity of the Health Services Product Lines through compliance with the DevSecOps process, SAFe implementation and/or other OIT initiatives. To complete this task, the Contractor shall provide a senior team of subject matter experts to support the integration and oversight of capabilities within the Product Line value stream through collaboration with relevant stakeholders and partners. Additionally, the Contractor shall support planning across interdependent systems to mitigate technical risk and improve integration with business processes and other VA products and enterprise services. As part of this task, the Contractor shall manage the following processes:

1. Assist in defining new application implementation requirements, to include the generation of Epics and translation to Features and User Stories which make up the Product Roadmap and Product Increment Plans while mitigating dependencies between them.

2. Consolidate requirements or sequencing to generate product line efficiencies.

3. Understand future state requirements for a successful implementation of new applications in VA and identify impacts to legacy or dependent systems.

4. Provide guidance on dependencies between implementation requirements within and outside the product to reduce risk as new capabilities are introduced and current systems are retired.

5. Identify and analyze the systems targeted for integration and the design and technologies needed to implement them.

6. Assist with database solutions and designs for data migrations for implementations at VA sites.

7. Provide product line and Health Services Portfolio-level analyses of risks and issues to identify trends and possible opportunities for responses and mitigations at and above the product line level.

8. Understand current and future state data flows, networking, cybersecurity, and infrastructure requirements.

5.2.1 SCHEDULE MANAGEMENT

The Contractor shall create, maintain, analyze, and report Solution Roadmaps and Release Train Schedules in the VA-approved toolset. The Contractor shall provide schedule updates within the VA-approved toolset on a weekly basis. The Contractor shall evolve the roadmap, iteratively maturing, until a minimum of four Product Increments are notionally prioritized and continually maintained.

Product Line support shall include management of patches to mitigate collisions in addition to the portfolio level tracking. The Health Portfolio Product Line tracking shall be planned/coordinated to ensure optimized sequencing of releases to avoid patch collisions.

Deliverables:

A. Solution Roadmaps B. Release Train Schedules

5.2.2 RISK MANAGEMENT

The Contractor shall conduct risk management of all work performed under this TO and provide input to the product Risk Management registry within the VA approved toolset.

The Contractor shall:

1. Comply with and/or create the Risk Management Plan (RMP) where one is not already established by VA.

2. Use VA-provided approved tool to create/update and actively manage a product risk register (also referred to as risk log) that identifies knowable circumstances that may have a negative impact on product success, describes potential impacts and asserts measures to either reduce/eliminate their impact. Risks determined by the VA PM shall also be documented in the VA PARS Dashboard and/or other OIT-approved tools.

3. Use the VA-approved tool to facilitate risk meetings and reviews.

4. Collaborate with product team to actively manage, size (level of effort), develop approved mitigations and plans of action and milestones (POAM) and assess/re-assess probability and severity of product risks and issues throughout the product lifecycle.

5. Assess the status of risks and provide a Weekly Risk Management Status Report to VA for inclusion in the larger Risk Management Registry. When new risks occur which could impact development, testing and deployment schedule, the Contractor shall notify the COR and VA PM via email within 24 hours. Email subject line shall read “{Product Name} Risk Alert Notification.”

6. Summarize the status of active risks and issues as determined by their risk score. Risk score calculations must be conducted in accordance with OIT policies and practices to enable analysis of risks and issues across products and product lines. This shall be reported in the Contract Management Plan, at critical decision points and as needed for periodic reviews, program monitoring communications and dashboard updates.

Deliverables:

A. Risk Management Plan B. Weekly Risk Management Status (in tool only)

CONFIGURATION MANAGEMENT

The Contractor shall:

1. Identify the standard and unique aspects of configuration management to be performed for each Agile Product Team (APT) by establishing a Product Configuration Management (CM) Plan (PCMP) which meets EPMO Website CM plan requirements. The Contractor shall reflect all CM required activities and standards in each product-level CM plan while determining the unique aspects of the product which require individualized procedures. The COR and VA PM will approve the PCMP.

2. Deliver a Recommended List of Configuration Items as part of the PCMP to be placed under configuration and change control. The Contractor shall identify types of configuration items pertaining to each product to be placed under configuration management. Based on EPMO requirements, and the unique needs or nature of each product, the Contractor shall determine the components within each product that must be under configuration control.

3. Use a VA-approved tool and repository for all software source code and electronic artifact configuration and version management. The Contractor shall use the VA-approved tool to manage change, activity, issue, action, risk, and other product data as prescribed by VA standards and processes. If assigned a product using tools that are being deprecated, the Contractor shall assist the VA Tools Team in migrating products using other Change and/or Configuration Management tools.

4. Ensure that all product software and non-software artifacts are versioned correctly according to VA standards and follow a build/release promotion versioning approach which identifies all major, minor, and update changes to the components.

5. Create Project and Product Artifacts baselined and versioned in the CM repository to allow the tool to show active and past histories of the check-ins and check-outs of all software components, data, and software project engineering documents. Maintain all baselines of software, software builds, and electronic artifacts in the repository, labeling updates and versions according to CM procedures.

6. Establish and maintain status reporting on change and configuration management activity and ensure VA approved tools data records and artifacts are filed and updated daily.

7. Develop and manage a CM process that supports all necessary changes for the project including changes to Definition of Done, Acceptance Criteria and any other items deemed necessary.

Deliverables:

A. Product Configuration Management Plan B. Version Description Document

WORK PLANS

To aid VA in effectively managing and prioritizing activities, the Contractor shall prepare a Monthly Work Plan that includes information on all activities underway each month. As optional tasks are exercised, the Contractor shall include them in the Monthly Work Plan.

Each Work Plan shall include the following information:

1. Project and specific activities

2. Overview and description of the activity

3. Overall high-level assessment of progress of the activity

4. All work in-progress and completed for the activity

5. Identification of any contract-related issues uncovered during the previous period and especially highlight those areas with a high probability of impacting schedule or performance goals and their likely impact on schedule or performance goals

6. Explanations for any unresolved issues, including possible solutions and any actions required of the Government and/or Contractor to resolve or mitigate any identified issue, including a plan and timeframe for resolution

7. Status on previously identified issues, actions taken to mitigate, and/or progress made in rectifying the situation

8. Work planned for the subsequent period

9. Current activity schedule overlaid on original activity schedule showing any delays or advancement in schedule

10. Workforce staffing data showing all Contractor personnel performing on the effort during the previous period. After the initial labor baseline is provided, each Work Plan Report shall identify any changes in staffing identifying each person who was added to the activity, removed, and/or moved from one program/project to another from the TO. This should also include any planned travel for the activity.

11. Original schedule of deliverables and the corresponding deliverables made during the previous period.

The Monthly Work Plan shall not be the only means of communication between the Contractor, COR, and the Product Manager to advise of performance/schedule issues and to develop strategies for addressing issues. The Contractor shall continuously monitor performance and report any deviation from the CMP or previous Work Plan to the COR and PM during routine, regular communications. The Contractor shall respond to all COR or PM queries related to project milestones and schedule within four business hours of receipt of written request.

Deliverable:

A. Monthly Work Plan

CONTINUOUS DELIVERY PIPELINE

As described in the Scaled Agile Framework (www.scaledagileframework.com), the four-part Continuous Delivery Pipeline consists of Continuous Exploration, Continuous Integration, Continuous Deployment, and Release on Demand. The Contractor shall implement and practice Continuous Exploration, Continuous Integration, Continuous Deployment, and Release on Demand activities during the development lifecycle as described in Sections 5.3 Continuous Delivery Pipeline through 5.6 Release on Demand.

The Contractor shall configure, develop, enhance, maintain, test, and deploy builds of each product on a continuous basis no shorter than two weeks but no longer than three months in duration throughout the base and option periods, if exercised, or as needed based on requirements. The Contractor shall provide deliverable packages/artifacts specified herein that meet documentation and code delivery requirements of activities specified in this PWS and are VIP/VA PARS/EPMO compliant. The Contractor shall leverage and reuse relevant content and pre-existing product documentation as appropriate to satisfy the content of package deliverables.

The Contractor shall utilize DevSecOps principles and SAFe practices in partnership with VA to continuously improve the Health Services Portfolio performance and customer satisfaction.

CONTINUOUS EXPLORATION

As described in the Scaled Agile Framework (www.scaledagileframework.com), Continuous Exploration is the first aspect in the four-part Continuous Delivery Pipeline of Continuous Exploration, Continuous Integration, Continuous Deployment, and Release on Demand. The Contractor shall implement and practice Continuous Exploration activities to drive innovation, alignment, and prioritization on what should be built to enable business capabilities with the optimum set of business functions that meets or exceeds the business needs. The Contractor shall continuously explore market and customer needs, technical requirements, define a vision for each Product and create an integrated view of prioritized work for all products being managed during the PoP. This integrated view, called a Product Increment Roadmap, should be viewable within a common backlog tool as a rollup of each Product Lines set of products, so that a single Product Line roadmap can be viewed independently or in aggregate in the same Product Increment Roadmap format.

The Contractor shall continuously elicit new business and technical needs, validate existing business and technical needs, and refine these needs and the associated business processes to establish prioritized features/sub-features/user stories with testable acceptance criteria. The Contractor shall ensure that all acceptance criteria are agreed to by the business stakeholders and are testable and automated to the maximum extent possible. The Contractor shall continuously manage the backlog of prioritized features in the Product Line backlog, including the architecture runway, product dependencies, and technical enabler features required to deliver the business value. The Contractor shall facilitate Product Increment Planning, both virtually and face-to-face, as the collaborative forum with business stakeholders to prioritize features for implementation and to kick off the Continuous Integration process. Following Continuous Integration, the Contractor shall implement and practice the Continuous Deployment cycle that pulls the features into production where they are validated and prepared for release using DevSecOps tools and processes as defined elsewhere in this PWS.

Each Product Line has multiple Product Teams supporting multiple products at varying stages of maturity. For example, some products are starting new development to enable new business capabilities, others are mature/stable products that require continuous monitoring and maintenance only, and others that need a modernization or decommissioning plan. The Contractor shall assist VA in developing a strategic approach to product delivery that includes integrating Product Line and product team backlogs and processes such that opportunities emerge for product consolidation centered on the business capability those products enable. The goal of product consolidation is to increase the speed of delivery in addition to overall performance and supportability while decreasing the overall complexity and logistical risk of solutions delivered. This includes architectural alignment and consolidation focused on reuse of components, integration via standards-based interfaces, and reduction in complexity in the delivered solution.

The initial focus of CE will be on four of the 11 Product Lines listed below:

1. Health Financial

2. Health Care Administration

3. Clinical Ancillary

4. Electronic Health Record Modernization

There are currently 170 products aligned to these four Product Lines. Products may fall outside of these initial four product lines, but are included in the 11 product lines that fall within Health Services Portfolio. Some products may not require support over the life of this TO. During the Continuous Exploration, projects and product lines that will be anticipated to start work shall be evaluated through an intake process and assessed with the Health Portfolio.

Attachment B provides a list of products that the Contractor should be prepared to support during the base period, again noting that not all will require support.

There are currently 339 registered products in the Health Services Portfolio that could potentially require support services. An estimated 20 new products may be supported in the base period and a total of 100 additional products that may be brought into the Health Services Portfolio over the life of the TO as part of the base tasks. In addition to products identified above, it is estimated that 115 existing products will be phased in during the base period, and placed on the TO via the optional task. Additional products may be taken in over the life of the TO during the Continuous Exploration/intake process.

The Contractor shall develop a Product Transition and Staffing Plan to support these products when needed. As described in Section 5.3.1.1 Product Line-Level Architecture, mapping of products to the Business Reference Model capabilities and functions and identifying incorrect mappings is one of the foundational Architecture artifacts that shall be delivered, which will ensure the solution is designed with traceability to business needs to ensure it delivers the right business value.

The Contractor shall complete an initial Backlog Grooming session with the VA team to properly understand and elaborate business Agile requirements, which may include creating or maintaining the backlog. The outcome of this session shall be a complete review of, and agreement to, the initial user stories, including user stories added as a result of Backlog Grooming by decomposing Epics into stakeholder needs, business requirements, business rules, requirements visualizations, and user story elaborations. The Contractor shall:

1. Ensure all Epics are included and executed as appropriate within the overall Agile Backlog Grooming effort. Provide analysis at the Feature level as required by the Government.

2. Populate the backlog during an initial planning session identifying all features the team considers relevant to building the product, and provide regular Backlog Status Reports for each Product Line. The backlog serves as the primary source for all product requirements and user stories, and the team shall prioritize the contents.

3. Establish initial Unit of measurement (e.g. Story Points) as the estimated relative complexity of user stories.

4. Facilitate any stakeholder briefings, meetings, and/or elicitation sessions.

5. Execute requirements reviews with stakeholders and record results of reviews using the VA Approved Tool, updating requirements data as a result of the reviews.

6. Identify non-production environment access that is needed 30 days prior to configuration start.

7. Input and maintain all Epics, stakeholder needs, visualizations, stories, and other sources of requirements information for functional and non-functional requirements in VA Approved Tools to comprise a Requirements Package. All requirements data is under change control and is fully linked to work items that show traceability to design changes, configurable items, test cases, and test results. The Contractor shall notify VA when a Requirements Package is Ready for Review and Approval.

Backlog Grooming and prioritization are continued throughout the product life cycle and shall be managed throughout the PoP.

Deliverables:

1. Product Increment Roadmap Product Transition and Staffing Plan

1. Backlog Status Report C. Notification that Requirements Package is Ready for Review and Approval

PRODUCT LINE-LEVEL ARCHITECTURE

The Contractor shall lead value stream Continuous Exploration and documentation in coordination with the portfolio for each of the products on which the Contractor is engaged. The Contractor shall be responsible for and support elaboration of epics into features and stories and manage cross-team risks and dependencies along with large initiative Agile product management. The Contractor shall provide a single source of truth in the form of To-be Architecture models, Architecture Diagrams, Solution Level Roadmaps, Solution Data Models, and User Research Artifacts regarding the intended and actual behavior of the solution following the Architecture Standard Operating Framework (ASOF), which implements SAFe best practices and defines architecture roles and responsibilities. The Health Financial Product Line ASOF (Attachment E) may be applied as the ASOF for this TO.