IATDR_PWS_v1.0_6-3-2026.pdf

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Office of Information & Technology (OIT) Infrastructure Operations (IO)

Data Center and Cloud Engineering (DCCE)

Infrastructure Automation Technical Debt Reduction (IATDR) Program

Date: May 18, 2026

VA-26-00026979

PWS Version Number: 1.0 (Pre-Request for Information (RFI) draft)

TABLE OF CONTENTS

1.0 BACKGROUND

2.0 APPLICABLE DOCUMENTS

3.0 SCOPE OF WORK

4.0 PERFORMANCE DETAILS

4.1 PERFORMANCE PERIOD

4.2 PLACE OF PERFORMANCE

4.3 TRAVEL

5.0 SPECIFIC TASKS AND DELIVERABLES

5.1 PROJECT MANAGEMENT

5.1.1 CONTRACTOR PROJECT MANAGEMENT PLAN

5.1.2 REPORTING REQUIREMENTS

5.2 PLATFORM ENGINEERING AND DEPLOYMENT

5.2.1 PLATFORM INSTALLATION AND CONFIGURATION

5.2.2 ENTERPRISE INTEGRATION

5.2.3 ECOSYSTEM ORCHESTRATION

5.2.4 PLATFORM MAINTENANCE

5.2.5 ACCEPTANCE TESTING

5.3 AUTOMATION ARCHITECTURE AND STANDARDS DEVELOPMENT

5.4 INFRASTRUCTURE AUTOMATION ENABLEMENT

5.5 MODULE AND BLUEPRINT FACTORY

5.6 AUTOMATION GOVERNANCE

5.7 KNOWLEDGE TRANSFER AND TRAINING

5.8 AUTHORITY TO OPERATE (ATO) AND RISK MANAGEMENT FRAMEWORK

(RMF) 24

5.9 ADDITIONAL TEAM ONBOARDING (OPTIONAL TASK 1)

5.10 ADDITIONAL TRAINING SESSIONS (OPTIONAL TASK 2)

5.10.1 ADDITIONAL PLATFORM OPERATOR TRAINING (OPTIONAL TASK 2.1)

5.10.2 ADDITIONAL AUTOMATION DEVELOPER TRAINING (OPTIONAL TASK

2.2) 26

5.10.3 ADDITIONAL PLATFORM ADMINISTRATOR TRAINING (OPTIONAL

TASK 2.3)

5.11 TRANSITION TO GOVERNMENT (OPTIONAL TASK 3)

5.12 OPTION PERIODS

6.0 GENERAL REQUIREMENTS

6.1 ENTERPRISE AND IT FRAMEWORK

6.1.1 VA TECHNICAL REFERENCE MODEL

6.1.2 ZERO TRUST – VA CRITICAL SECURITY CONTROLS

6.1.3 FEDERAL IDENTITY, CREDENTIAL, AND ACCESS MANAGEMENT

(FICAM)

6.1.4 INTERNET PROTOCOL VERSION 6 (IPv6)

6.1.5 TRUSTED INTERNET CONNECTION (TIC)

6.1.6 STANDARD COMPUTER CONFIGURATION

6.1.7 VETERAN FOCUSED INTEGRATION PROCESS (VIP) AND PRODUCT

LINE MANAGEMENT (PLM)

6.1.8 PROCESS ASSET LIBRARY (PAL)

6.1.9 AUTHORITATIVE DATA SOURCES

6.1.10 SOCIAL SECURITY NUMBER (SSN) REDUCTION

6.1.11 SOFTWARE AND LICENSING REQUIREMENTS

6.1.12 GENERATIVE ARTIFICIAL INTELLIGENCE REQUIREMENTS

6.1.13 SOURCE CODE HARMONIZATION AND REUSE IN INFORMATION

TECHNOLOGY (SHARE IT Act)

6.1.14 SECURE SOFTWARE DEVELOPMENT

6.2 SECURITY AND PRIVACY REQUIREMENTS

6.2.1 POSITION/TASK RISK DESIGNATION LEVEL(S)

6.2.2 CONTRACTOR PERSONNEL SECURITY REQUIREMENTS

6.3 METHOD AND DISTRIBUTION OF DELIVERABLES

6.4 PERFORMANCE METRICS

6.5 FACILITY/RESOURCE PROVISIONS

6.6 GOVERNMENT FURNISHED

6.6.1 GOVERNMENT FURNISHED PROPERTY

6.6.2 GOVERNMENT FURNISHED INFORMATION

6.7 SHIPMENT OF HARDWARE OR EQUIPMENT

6.8 KEY PERSONNEL AND STAFFING REQUIREMENTS

6.8.1 KEY PERSONNEL

6.8.2 NON-KEY PERSONNEL

6.8.3 STAFFING AND CONTINUITY REQUIREMENTS

6.9 DATA RIGHTS AND INTELLECTUAL PROPERTY

ADDENDUM B – VA INFORMATION AND INFORMATION SYSTEM SECURITY/

PRIVACY LANGUAGE

1.0 BACKGROUND

The Department of Veterans Affairs (VA), Office of Information & Technology (OIT), Infrastructure Operations (IO), Data Center and Cloud Engineering (DCCE) division strives to provide high quality, effective, and efficient Information Technology (IT) services to those responsible for providing care to the Veterans at the point-of-care as well as throughout all the points of the Veterans' health care in an effective, timely and compassionate manner. VA depends on Information Management/Information Technology (IM/IT) systems to meet mission goals.

VA currently operates a complex hybrid enterprise environment spanning on-premises data centers, private cloud infrastructure, and public cloud environments through the VA Enterprise Cloud (VAEC). Over the past decade, infrastructure teams across the enterprise have independently developed thousands of ad-hoc automation scripts, adopted inconsistent infrastructure-as-code and configuration management automation usage patterns, relied on manual execution paths for infrastructure changes, and created duplicative automation logic across organizational boundaries. These conditions represent accumulated infrastructure automation technical debt that increases outage risk, security exposure, labor cost, and time-to-delivery for critical Veteran-facing services.

The Infrastructure Automation Technical Debt Reduction (IATDR) Program will establish an on-premises, enterprise automation control plane that standardizes, governs, and operationalizes infrastructure automation. This capability will enable repeatable, auditable, and policy-governed provisioning and configuration of infrastructure platforms across VA's hybrid environment, reducing configuration drift, improving compliance posture, and accelerating infrastructure delivery in support of VA's mission to serve Veterans.

The IATDR Program directly supports VA's ongoing enterprise infrastructure modernization initiatives, including enterprise virtualization modernization, enterprise storage consolidation, and data center transformation efforts. Establishing a centralized automation control plane is a foundational prerequisite for executing these programs at enterprise scale with consistency, auditability, and governance. This effort is conducted under the authority of the Clinger Cohen Act (40 U.S.C. Section 11101 and Section 11103) and is subject to oversight under the Federal Information Technology Acquisition Reform Act (FITARA).

2.0 APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. “Federal Information Security Modernization Act of 2014”

2. Federal Information Processing Standards (FIPS) Publication 140-3, “Security Requirements for Cryptographic Modules”, March 22, 2019

3. FIPS Pub 199. “Standards for Security Categorization of Federal Information and Information Systems,” February 2004

4. FIPS Pub 200, “Minimum Security Requirements for Federal Information and

Information Systems,” March 2006

5. FIPS Pub 201-3, “Personal Identity Verification of Federal Employees and

Contractors,” January 2022

6. 10 U.S.C. § 2224, "Defense Information Assurance Program", as amended

7. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

8. Public Law 109-461 (P.L. 109-461), Veterans Benefits, Health Care, and

Information Technology Act of 2006, as amended, Title IX, Information Security Matters

9. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”, as amended

10. VA Directive 0710, “Personnel Vetting Program,” September 8, 2025, https://www.va.gov/vapubs/index.cfm https://www.va.gov/vapubs/index.cfm

11. VA Handbook 0710, “Personnel Vetting Program,” September 8, 2025, https://www.va.gov/vapubs/index.cfm

12. VA Directive 6102, “Internet/Intranet Services,” August 5, 2019

13. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and Guidelines,” as amended

14. Office of Management and Budget (OMB) Circular A-130, “Managing Federal

Information as a Strategic Resource,” July 28, 2016

15. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed

Services (CHAMPUS)”, as amended

16. NIST SP 800-66 Rev. 2, “Implementing the Health Insurance Portability and

Accountability Act (HIPAA) Security Rule: A Cybersecurity Resource Guide,” February 2024

17. 45 C.F.R Parts 160 and 164, Subparts A and E, the Standards for Privacy of Individually Identifiable Health Information (“Privacy Rule”); and 45 C.F.R.

Parts 160 and 164, Subparts A and C, the Security Standard (“Security Rule”); as amended

18. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended

19. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

20. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021 (see VA

NOTICE 24-18, dated September 27, 2024, “Update to VA Directive 6500 Cybersecurity Program”, and VA Notice 25-07, dated 3/18/25, “Amending VA Directive 6500 to incorporate M-24-15”)

21. VA Handbook 6500, “Risk Management Framework for VA Information Systems VA Information Security Program,” February 24, 2021 (see VA Notice 25-01, dated October 15, 2024, “Update to VA Handbook 6500 Risk Management Framework for VA Information Systems VA Information Security Program”, and VA Notice 25-06, dated 3/18/25, “Amending VA Directive 6500 to incorporate M-24-15”, VA Notice 25-16, dated September 15, 2025, “Amending VA Handbook 6500 to Replace Enterprise Mission Assurance Support Services Tool With Office of Information Technology Governance Risk Compliance Tool, and VA Notice 25-17, dated September 22, 2025, “Rescission Of Office Of Information Security (OIS) Deputy Assistant Secretary (DAS) Memorandum – Requirements of Proper Plan of Action and Milestones (POA&M) Completion)

22. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI),” June 30, 2023

23. VA Handbook 6500.6, “Contract Security,” March 12, 2010 (see VA Notice 24-12, dated April 22, 2024, “Update to VA Handbook 6500.6, Contract Security, Appendix C VA Information and Information System Security/Privacy Language For Inclusion Into Contracts, As Appropriate”)

24. VA Handbook 6500.8, “Information System Contingency Planning,” March 25, 2025

25. VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018 (see VA NOTICE 25-10, dated June 9, 2025, “Use of Personally Owned Mobile Devices Policy Amendment of Department of Veterans Affairs https://www.va.gov/vapubs/index.cfm http://www.va.gov/vapubs http://www.va.gov/vapubs

Handbook 6500.10”, and VA Notice 25-15, dated August 22, 2025, “Update to VA Handbook 6500.10 Mobile Device Security Policy”)

26. VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017

27. OIT Process Asset Library (PAL), OIT Process Asset Library.

28. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

29. VA Directive 6508, “Implementation of Privacy Threshold Analysis and

Privacy Impact Assessment,” October 15, 2014

30. VA Directive 6510, “VA Identity, Credential and Access Management,”

September 3, 2024

31. VA Handbook 6510, “VA Identity, Credential and Access Management,”

September 27, 2024

32. VA Directive and Handbook 6513, “Secure External Connections,” October

12, 2017

33. VA Directive 6300, “Records and Information Management,” September 21,

34. VA Handbook, 6300.1, “Records Management Procedures,“ March 24, 2010

35. NIST SP 800-37 Rev 2, “Risk Management Framework for Information

Systems and Organizations: A System Life Cycle Approach for Security and Privacy,” December 2018

36. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020)

37. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015

38. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-

12) Program,” March 24, 2014

39. OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005

40. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019

41. OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008

42. Federal Identity, Credential, and Access Management (FICAM) Architecture, June 30, 2023 (FICAM Architecture (idmanagement.gov))

43. NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access,“ June 2018

44. NIST SP 800-63 Rev 4, 800-63A-4, 800-63B-4, 800-63C-4, “Digital Identity Guidelines,” August 1, 2025

45. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014

46. VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland

Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514) https://digital.va.gov/process-asset-library/ https://www.va.gov/trm/TRMHomePage.aspx https://www.idmanagement.gov/arch/#:~:text=FICAM%20is%20the%20federal%20government%E2%80%99s%20enterprise%20approach%20to,identity%20processes%2C%20practices%2C%20policies%2C%20and%20information%20security%20disciplines.

https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514

47. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

48. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

49. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

50. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019

51. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008

52. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (P.L. 110–140), December 19, 2007

53. Section 104 of the Energy Policy Act of 2005, (P.L. 109–58), August 8, 2005

54. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August

2, 2001

55. Executive Order 14148, “Initial Rescissions of Harmful Executive Orders and

Actions,” dated January 20, 2025

56. VA Directive 0057, “VA Environmental Management Program,” October 25,

57. OIS VAIQ #7424808 Memorandum, “Remote Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

58. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

59. “Veteran Focused Integration Process (VIP) Guide 4.0,” March 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

60. VA Memorandum “Proper Use of Email and Other Messaging Services,”

January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

61. “Product Line Management Transformation Playbook” version 3.1, August 2023, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

62. NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020

63. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol

Version 6 (IPv6),” November 19, 2020

64. Social Security Number (SSN) Fraud Prevention Act of 2017

65. Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23,

66. C.F.R Title 15 Part 7, “Securing the Information and Communications

Technology and Services (ICTS) Supply Chain”, as amended

67. Executive Order 14028, “Executive Order on Improving the Nation's

Cybersecurity,” May 12, 2021, https://bidenwhitehouse.archives.gov/briefing-room/presidential-actions/2025/01/16/executive-order-on-strengthening-and-promoting-innovation-in-the-nations-cybersecurity/

68. OMB Memorandum M-22-09, “Moving the U.S. Government Toward Zero Trust Cybersecurity Principles”, January 26, 2022, https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf.

https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896 https://www.cisa.gov/publication/tic-30-core-guidance-documents https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371 https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946 https://bidenwhitehouse.archives.gov/briefing-room/presidential-actions/2025/01/16/executive-order-on-strengthening-and-promoting-innovation-in-the-nations-cybersecurity/ https://bidenwhitehouse.archives.gov/briefing-room/presidential-actions/2025/01/16/executive-order-on-strengthening-and-promoting-innovation-in-the-nations-cybersecurity/ https://bidenwhitehouse.archives.gov/briefing-room/presidential-actions/2025/01/16/executive-order-on-strengthening-and-promoting-innovation-in-the-nations-cybersecurity/ https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf

69. NIST SP 800-52 Revision 2, “Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations

70. OMB M-26-05, “Adopting a Risk-based Approach to Software and Hardware Security,” January 23, 2026

71. OMB M-21-31, “Improving the Federal Government’s Investigative and Remediation Capabilities Related to Cybersecurity Incidents,” August 27,

72. NIST SP 800-88 Revision 1 “Guidelines for Media Sanitization,” December

73. CISA Binding Operational Directive (BOD) 19-02: “Vulnerability Remediation Requirements of Internet-Accessible Systems,” April 29, 2019, BOD 19-02:

Vulnerability Remediation Requirements for Internet-Accessible Systems |

CISA

74. CISA BOD 22-01: “Reducing the Significant Risk of Known Exploited Vulnerabilities,” November 3, 2021, BOD 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities | CISA

75. CISA BOD 23-01: Improving Asset Visibility and Vulnerability Detection on Federal Networks.” Cybersecurity & Infrastructure Security Agency (CISA), BOD 23-01: Improving Asset Visibility and Vulnerability Detection on Federal Networks | CISA

76. VA Directive 6550, Pre-Procurement Assessment and Implementation of Medical Devices/Systems, June 03, 2019

77. VA Memorandum, “VA Security Controls,” January 17, 2025, https://www.voa.va.gov/DocumentView.aspx?DocumentID=5010

78. E.O. 13960, “Promoting the Use of Trustworthy Artificial Intelligence in the Federal Government,” December 3, 2020

79. E.O. 14319, “Preventing Woke AI in the Federal Government,” July 23, 2025

80. OMB Memorandum M-25-21, “Accelerating Federal Use of AI through

Innovation, Governance, and Public Trust,” April 3, 2025

81. OMB Memorandum M-25-22, “Driving Efficient Acquisition of Artificial

Intelligence in Government,” April 3, 2025

82. OMB Memorandum M-26-04, “Increasing Public Trust in Artificial Intelligence

(AI) Through Unbiased AI Principles,” December 11, 2025

3.0 SCOPE OF WORK

The Contractor shall provide a commercial software platform and associated professional services to establish, operate, and mature a centralized enterprise infrastructure automation control plane for the Department of Veterans Affairs. The scope encompasses the delivery, installation, configuration of a commercial automation orchestration and governance platform deployed on premises within VA data center infrastructure, as well as achieving and maintaining VA Authority to Operate (ATO), performing ongoing maintenance, and integrating the platform with VA's existing enterprise identity, secrets management, logging, monitoring, and change management systems. The Contractor shall also develop and maintain reference architectures, automation standards, policy taxonomies, and reusable automation building blocks;

https://www.cisa.gov/news-events/directives/bod-19-02-vulnerability-remediation-requirements-internet-accessible-systems https://www.cisa.gov/news-events/directives/bod-19-02-vulnerability-remediation-requirements-internet-accessible-systems https://www.cisa.gov/news-events/directives/bod-19-02-vulnerability-remediation-requirements-internet-accessible-systems https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities https://www.cisa.gov/news-events/directives/bod-23-01-improving-asset-visibility-and-vulnerability-detection-federal-networks https://www.cisa.gov/news-events/directives/bod-23-01-improving-asset-visibility-and-vulnerability-detection-federal-networks https://www.voa.va.gov/DocumentView.aspx?DocumentID=5010 https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-21-Accelerating-Federal-Use-of-AI-through-Innovation-Governance-and-Public-Trust.pdf https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-22-Driving-Efficient-Acquisition-of-Artificial-Intelligence-in-Government.pdf https://www.whitehouse.gov/wp-content/uploads/2025/12/M-26-04-Increasing-Public-Trust-in-Artificial-Intelligence-Through-Unbiased-AI-Principles-1.pdf?_bhlid=c0113a16495d987bc33f63e3dccf35c28d6bfd15 provide enablement services to ensure VA infrastructure teams’ ability to adopt standardized automation practices; deliver governance services including guardrail definition, metrics reporting, and change alignment across the enterprise; and conduct structured knowledge transfer to ensure VA Government personnel can independently operate and evolve the platform. The program does not seek to replace existing automation engines, virtualization, container, or cloud platforms; rather, it will orchestrate, standardize, and govern the usage of these existing tools through a unified control plane. The Contractor shall provide a commercial automation platform licensing sized to the planning estimate of 128,000 managed endpoints and the associated professional services.

4.0 PERFORMANCE DETAILS

4.1 PERFORMANCE PERIOD

The Period of Performance (PoP) shall be 12 months from date of award, with four , 12-month option periods. The overall POP shall not exceed 60 months. Any work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO). (If required, the CO may designate the Contractor to work during holidays and weekends)

There are 11 Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, five are set by date:

New Year's Day January 1 Juneteenth June 19 Independence Day July 4 Veterans Day November 11 Christmas Day December 25

If any of the above falls on a Saturday, then Friday shall be observed as a holiday.

Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

Martin Luther King's Birthday Third Monday in January Washington's Birthday Third Monday in February Memorial Day Last Monday in May Labor Day First Monday in September Columbus Day Second Monday in October Thanksgiving Fourth Thursday in November

In addition, January 20 every fourth year is Inauguration Day, a holiday for Federal employees in the Washington, DC, Maryland, and Virginia commuting area in accordance with 5 U.S.C. Section 6103(c). Work performed remotely outside that commuting area is not affected.

4.2 PLACE OF PERFORMANCE

Tasks under this PWS shall be performed primarily at Contractor facilities (remote). The Contractor shall identify the Contractor's place of performance in their proposal submission. Contractor personnel may be required to work on-site at VA facilities for platform installation, integration activities, knowledge transfer sessions, and critical incident response, with prior concurrence from the Contracting Officer's Representative (COR). VA facilities where on-site work may be required include VA data center locations in the continental United States.

4.3 TRAVEL

The Government anticipates travel under this effort to perform the tasks associated with the effort, as well as to attend program-related meetings or conferences throughout the PoP. Include all estimated travel costs in your firm-fixed price line items. These costs will not be directly reimbursed by the Government.

The total estimated number of trips in support of the program related meetings for this effort is 12 per year. Anticipated locations include the following, estimated at three to five days in duration:

VA data center facilities’ locations include:

1. Austin Information Technology Center (AITC) in Austin, Texas

2. Philadelphia Information Technology Center (PITC) in Philadelphia, Pennsylvania 3.

The four VA Trusted Internet Connection (TIC) gateway locations include:

1. Chicago, Illinois (GWN)

2. Sterling, Virginia (GWE)

3. Dallas, Texas (GWS)

4. Santa Clara, California (GWW)

Trips are estimated to be distributed primarily between the Austin and Hines data centers with the remainder distributed across the other listed facilities.

Travel shall be in accordance with the Federal Travel Regulations (FTR) and requires advanced concurrence by the COR. Contractor travel within the local commuting area will not be reimbursed.

5.0 SPECIFIC TASKS AND DELIVERABLES

The Contractor shall perform the following:

5.1 PROJECT MANAGEMENT

5.1.1 CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor's approach, timeline, and tools to be used in execution of the contract. The CPMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks, and resource support. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPMP shall be concurred upon and updated in accordance with Section B of the contract. The Contractor shall update and maintain the VA Program Manager (PM) approved CPMP throughout the PoP.

The Contractor shall deliver the initial baseline CPMP early in the Period of Performance and update it monthly thereafter as specified in the Schedule for Deliverables.

Deliverable:

A. Contractor Project Management Plan

5.1.2 REPORTING REQUIREMENTS

The Contractor shall provide the COR with Monthly Progress Reports in electronic form in Microsoft Word format, with Microsoft Project schedule exports embedded as PDF or image where schedule visuals are required. The report shall include detailed instructions/explanations for each required data element, to ensure that data is accurate and consistent. These reports shall reflect data as of the last day of the preceding Month.

The Monthly Progress Reports shall cover all work completed during the reporting period and work planned for the subsequent reporting period. The report shall also identify any problems that arose and a description of how the problems were resolved. If problems have not been completely resolved, the Contractor shall provide an explanation including their plan and timeframe for resolving the issue. The report shall also include an itemized list of all Information and Communication Technology (ICT) deliverables and their current Section 508 conformance status. The Contractor shall monitor performance against the CPMP and report any deviations. It is expected that the Contractor will keep in communication with VA accordingly so that issues that arise are transparent to both parties to prevent escalation of outstanding issues.

The Contractor shall hold a Monthly Teleconference with the COR and VA Project Manager to coincide with the release of each Monthly Progress Report. The teleconference shall provide an opportunity to walk through the report, surface issues, align on the next month of work, and capture any direction from the Government. The Contractor shall publish meeting minutes within five (5) calendar days after each teleconference.

The Contractor shall establish its preferred cadence of the Teleconference timeframe that is required with the VA, as the above requirement shall be considered monthly, at a minimum. The Progress Report shall remain Monthly.

A. Monthly Progress Report

5.2 PLATFORM ENGINEERING AND DEPLOYMENT

The Contractor shall deploy, configure, integrate, and maintain the automation control plane platform within VA's on-premises data center infrastructure as described in Sections 5.2.1 through 5.2.5.

5.2.1 PLATFORM INSTALLATION AND CONFIGURATION

The Contractor shall install and configure the automation control plane platform in a high-availability configuration across VA-designated on-premises infrastructure. The platform shall support horizontal scalability without requiring an external vendor-managed control plane. Deployment shall utilize at least one of the following methods:

virtual appliance deployment, virtual machine deployment within the container platform, or container orchestration operator deployment. The platform shall be configured to support a minimum of 200 human users and unlimited non-human identities including service accounts and automation runners. Licensing shall not include per-run or per-worker fees. The Contractor shall provide Platform Architecture Document that serves as the engineering reference for the automation control plane and provides the Government with the high-availability topology, sizing, scaling, integration interfaces, licensing model mapping, and minimum compute baseline.

The licensing model the Contractor selects shall accommodate the commercial licensing unit appropriate to the proposed platform, expressed in managed nodes, workspaces, managed endpoints, or other vendor-published licensing units, and shall not impose per-run or per-worker fees regardless of the selected unit. The Contractor shall describe in the Platform Architecture Document how the proposed licensing unit maps to the Government's planning estimate of managed infrastructure endpoints set forth below.

The Government shall provide as Government Furnished Information the compute and storage infrastructure required to host the platform, sized to the Contractor's documented minimum specifications for the proposed platform, including dedicated database compute and storage. The Contractor shall publish the minimum compute baseline in the Platform Architecture Document within thirty calendar days following contract award and shall update that baseline whenever the Contractor's published platform requirements change.

A. Platform Architecture Document

5.2.2 ENTERPRISE INTEGRATION

The Contractor shall integrate the platform with the following Government-Furnished capabilities:

1. Identity Management

a. The Platform shall integrate with VA's enterprise identity provider for authentication, Role-Based Access Control (RBAC), and group mapping.

2. Secrets Management

a. The Platform shall integrate with VA's enterprise secrets management, privileged access management, certificate management, and key management systems, with all credential injection performed at runtime only.

3. Source Control

a. The Platform shall integrate with VA's enterprise source control platform for repository-driven automation with branch-based workflows and commit-to-execution traceability.

4. Change Management

a. The Platform shall integrate with VA's enterprise IT service management platform for configurable approval workflows supporting separation of code author, approver, and executor roles. Approval workflows shall include pre-execution approval, peer review of automation changes prior to promotion to production, and immutable change log records linked to the corresponding IT service management ticket reference for each automation execution.

5. Monitoring and Logging

a. The Platform shall export immutable execution logs to VA's enterprise log aggregation and application performance monitoring platforms.

5.2.3 ECOSYSTEM ORCHESTRATION

The platform shall orchestrate automation interacting with the following infrastructure ecosystems:

1. VA Enterprise Cloud (VAEC) environments for cloud provisioning;

2. Legacy virtualization platforms;

3. Enterprise container and virtualization platforms for containerized and virtualized workloads;

4. Enterprise compute management platforms;

5. Infrastructure-as-code (IaC) and configuration management platforms as automation execution engines; and legacy orchestration tools.

5.2.4 PLATFORM MAINTENANCE

The Contractor shall perform ongoing platform maintenance including upgrades, patching, performance tuning, capacity planning, and incident response throughout the PoP. The Platform Health Report shall be submitted on a monthly cadence as set forth in the Schedule for Deliverables. The Platform Architecture Document is the engineering reference for the automation control plane and provides the Government with the high-availability topology, sizing, scaling, integration interfaces, licensing model mapping, and minimum compute baseline. The Security Integration Design Document describes how the platform integrates with VA identity, secrets management, certificate management, and logging services, and provides the Government with the credential flow, control mappings, and security boundaries needed to support the Authority to Operate. The Platform Health Report is a monthly status of platform availability, capacity, performance, patch level, open incidents, and upcoming maintenance, and provides the Government with the operational picture needed to manage risk and plan changes.

Deliverables:

A. Platform Health Report

5.2.5 ACCEPTANCE TESTING

The Contractor shall conduct platform acceptance testing prior to authorization to operate against any VA production system. The Contractor shall demonstrate that the platform meets the integration and functional checks called out in the Platform Architecture Document and the Security Integration Design Document. Upon successful demonstration, the Contractor shall deliver a Platform Acceptance Memorandum signed by the VA Contracting Officer documenting completion of acceptance testing. The Contracting Officer's Representative (COR) shall provide a written recommendation of acceptance to the Contracting Officer based on the demonstration described in this Section, and the Contracting Officer shall sign the Platform Acceptance Memorandum.

The Contractor shall not begin any Production Authority to Operate push and any production change activity until the acceptance memorandum is signed by the Contracting Officer.

A. Platform Acceptance Memorandum

5.3 AUTOMATION ARCHITECTURE AND STANDARDS DEVELOPMENT

The Contractor shall establish the governance framework, reference architectures, and technical standards that govern all infrastructure automation executed through the platform.

The Contractor shall develop and maintain reference architectures for infrastructure provisioning across VA's hybrid environment including on-premises and VA Enterprise Cloud environments and shall provide an associated Reference Architecture Document.

The Reference Architecture Document is the authoritative technical blueprint for infrastructure automation across VA on-premises and VA Enterprise Cloud environments. It provides the Government with the patterns, integration designs, and data domain models that all team level automation work shall conform to. The Contractor shall define and publish automation coding standards, naming conventions, repository structure templates, and code review guidelines. The Contractor shall provide an Automation Standards and Policy Taxonomy Document that is the rule book for how automation is written, reviewed, secured, and operated. It provides the Government with the coding standards, naming conventions, repository structure, code review criteria, policy as code taxonomy, and state and drift management standards used to govern the platform. The Contractor shall develop a policy taxonomy for policy-as-code enforcement, including pre-execution policy checks using the platform's native policy engine, and shall author custom policies aligned with VA security requirements, FedRAMP controls, and VA Directive 6500. The Contractor shall also define state management and drift detection standards, including desired state tracking, drift reporting thresholds, and automated remediation patterns. The Contractor shall maintain a living standards document updated quarterly to reflect lessons learned and evolving VA requirements. The Contractor's state management approach shall use a controlled storage mechanism for the platform's authoritative state and configuration data that provides concurrent write locking, encryption at rest, encryption in transit, and an immutable audit trail of all changes to that data.

Deliverables:

A. Reference Architecture Document B. Automation Standards and Policy Taxonomy Document

5.4 INFRASTRUCTURE AUTOMATION ENABLEMENT

The Contractor shall enable VA infrastructure teams to adopt the standardized automation platform and practices.

The Contractor shall work directly with VA domain infrastructure engineering teams to migrate existing ad-hoc automation scripts and manual processes to the standardized platform. This includes bootstrapping Git repositories for each team following the defined reference architecture and coding standards, coaching team members on automation patterns, Git-based workflows, policy-as-code practices, and platform usage, and providing hands-on support during initial pipeline development and validation for each team. The Contractor shall track and report team adoption metrics in a monthly Adoption Metrics Report including pipeline count, execution frequency, manual versus automated provisioning ratios, and time-to-provision improvements, classification of automation execution failures into platform execution failures versus automation content failures, and time-to-onboard new device types, server platforms, or automation workflows as a measure of platform extensibility.

The Contractor shall develop and execute a Team Onboarding Plan to successfully onboard a minimum of ten (10) VA infrastructure teams to the platform within the base year of the Period of Performance, with additional waves of ten (10) teams in each option period exercised, for a planning ceiling of fifty (50) teams across the full Period of Performance if all four option periods are exercised. Additional team onboarding beyond this base scope is available through Optional Task 1 in Section 5.9.

Definition of an onboarded team. For acceptance under this PWS and surveillance under the Quality Assurance Surveillance Plan (QASP), a team is onboarded only when all of the following are objectively demonstrated and recorded: (1) user accounts are in place; (2) required training is complete; (3) the team has its own platform workspace; (4) role-based access control and policy guardrails are configured and enforced for that workspace; (5) at least one end-to-end pipeline has executed successfully against a real automation target, not a sandbox simulation; and (6) the team-specific operational scope is documented in a signed operating playbook. The Contractor, as part of their Team Onboarding Plan, shall provide evidence to VA for approval, that all six conditions required for each onboarded Team to be considered onboarded has been met for each team onboarded.

The Contractor shall develop a Migration and Coexistence Plan that addresses the transition from existing automation tooling to the standardized platform. The plan shall include a legacy script inventory covering Bash, PowerShell, Python, and other ad hoc automation in use today, target conversion criteria for each script type, coexistence rules describing how the new platform operates alongside legacy tools during the transition, and the data migration approach for existing data center inventory systems, configuration management databases, and spreadsheet-based asset tracking. The Contractor shall update the Migration and Coexistence Plan as legacy systems are retired during the Period of Performance.

Deliverables:

A. Adoption Metrics Report B. Team Onboarding Plan C. Migration and Coexistence Plan

5.5 MODULE AND BLUEPRINT FACTORY

The Contractor shall develop, test, publish, and maintain reusable infrastructure automation building blocks.

The Contractor shall develop and maintain a catalog of reusable infrastructure-as-code modules for common infrastructure provisioning patterns such as compute, storage, networking, security groups, and load balancers across the full range of VA hybrid infrastructure environments. The Contractor shall similarly develop and maintain a catalog of reusable configuration management collections for configuration management, compliance enforcement, and operational tasks. All modules and collections shall include documentation, input validation, policy compliance checks, unit tests, and integration tests. The Contractor shall publish modules to the platform's module registry with semantic versioning and maintain a Module Catalog documenting all available modules, their supported platforms, input parameters, and usage examples. Each module shall pass automated linting against a tool appropriate to the module language, shall achieve a minimum unit test coverage threshold to be set in the Automation Standards and Policy Taxonomy Document, and shall pass continuous integration policy and quality gates before promotion to the production module registry.

The platform shall model the following infrastructure data domains natively or through certified extensions: data center infrastructure management including racks, power, and cabling; IP address management; server and compute inventory; storage systems;

circuit management; and device lifecycle. The Contractor shall describe in the

Reference Architecture Document how each data domain is represented in the platform and how existing VA inventory and configuration management databases are mapped or migrated to that representation.

The Contractor shall measure and report synchronization accuracy between the platform’s modeled infrastructure state and the live infrastructure state, and shall classify and remediate material divergence in accordance with the drift detection thresholds set forth in Section 6.4. Synchronization accuracy results shall be summarized in the monthly Module Catalog updates and rolled up into the Adoption Metrics Report.

A. Module Catalog

5.6 AUTOMATION GOVERNANCE

The Contractor shall provide dedicated automation governance capability to establish and maintain the governance framework ensuring enterprise-wide consistency, compliance, and continuous improvement of infrastructure automation.

The Contractor shall define and enforce automation guardrails including mandatory policy checks, approval requirements, and execution constraints and provide in an Automation Governance Framework Document. The Automation Governance Framework Document is the foundational governance artifact for the program and provides the Government with the guardrails, approval workflows, exception process, roles and responsibilities, and escalation paths used to govern automation across the enterprise. It is the document the Government uses to hold both VA teams and the Contractor accountable for consistent automation practice.

The Contractor shall establish and report on Key Performance Indicators (KPIs) in a monthly KPI Dashboard and Governance Report for automation maturity, including the percentage of infrastructure provisioned through the platform, configuration drift rates, mean-time-to-provision, policy compliance rates, and module reuse rates. The Contractor shall facilitate change alignment between the IATDR Program, VA Enterprise Architecture, VA Security Operations, and domain infrastructure teams. The Contractor shall conduct Quarterly Governance Reviews with the following Government participants at a minimum to assess: the VA Program Manager (chair), the Contracting Officer's Representative (COR), the Director of Data Center and Cloud Engineering or designee, and at least one representative each from VA Enterprise Architecture and VA Security Operations. The reviews assess program health, adoption progress, and strategic alignment, and shall manage exception processes for teams requiring temporary deviations from automation standards. The Contractor shall provide a Quarterly Governance Review Briefing Read Ahead Package prior to each briefing consisting of the slide deck associated with each briefing plus a short cover memo that lists the topics for the session, a Key Performance Indicator summary for the prior quarter, and a one page rollup of the decisions the Government will be asked to make at the briefing.

Deliverables:

A. Automation Governance Framework Document B. KPI Dashboard and Governance Report C. Quarterly Governance Review Briefing Read Ahead Package

5.7 KNOWLEDGE TRANSFER AND TRAINING

The Contractor shall conduct structured knowledge transfer activities to ensure VA Government personnel develop the capability to independently operate, maintain, and evolve the automation control plane and associated practices.

The Contractor shall provide an associated written Knowledge Transfer Plan that includes, but is not limited to training (scope, audience, modalities, frequency, readiness assessments with completion criteria), etc., and execute against that plan throughout the PoP. The Contractor shall develop and deliver instructor led, virtual, quarterly training sessions across three role based tracks: a Platform Operator track covering platform use, troubleshooting, and routine operations; an Automation Developer track covering automation development, module authoring, and policy as code practices; and a Platform Administrator track covering platform administration, upgrade procedures, and integration maintenance. The Contractor shall create and maintain comprehensive Training Materials and Operational Documentation as the complete set of instructional content, runbooks, troubleshooting guides, and administrator reference materials used to operate and evolve the platform. It provides the Government with self-service reference content that VA staff use independently after the live training is over. The Contractor shall provide Knowledge Transfer Session Reports that captures topics covered, attendees, knowledge gaps identified, and follow-ups, delivered after each formal training session. The Contractor, as part of their Knowledge Transfer Plan, shall conduct a formal transition readiness assessment at least 90 days prior to the end of each performance period and shall provide an associated Transition Readiness Assessment Report following each assessment.

Each training session shall be planned for up to 25 students for each type of training.

Sessions shall default to virtual delivery, with in person delivery at the discretion of the Contracting Officer's Representative when the topic calls for hands on lab work. Travel for any in person sessions shall be funded through the Travel section of this Performance Work Statement.

Training shall be organized into role-based tracks for platform operators, automation developers, and platform administrators, with content tailored to the responsibilities of each role. Where applicable training entitlements are already covered under the existing applicable Government Enterprise License Agreement, the Contractor shall coordinate with the Contracting Officer's Representative to leverage those entitlements before sourcing equivalent commercial training.

The Contractor shall record all training sessions and provide Training Session Recording and Slide Deck after the completion of each training serving as the post session archive of each formal training event and provides the Government with the recordings and slide content for staff who could not attend live and for ongoing onboarding of new VA personnel.

Additionally, The Contractor shall ensure that independent operation is demonstrated, not asserted, and is accepted by VA. The Government will accept the independence outcome as accepted only on the success of both of the following observed demonstrations:

VA personnel’s ability to perform a major-version platform upgrade with the Contractor in observe-only mode

A VA lead chairs a successful governance review with the Contractor in observe-only mode.

Both demonstrations are pass or fail and the Contractor shall record and provide the results in the Transition Readiness Assessment Report.

Deliverables:

A. Knowledge Transfer Plan B. Training Materials and Operational Documentation C. Knowledge Transfer Session Reports D. Transition Readiness Assessment Reports E. Training Session Recording and Slide Deck

5.8 AUTHORITY TO OPERATE (ATO) AND RISK MANAGEMENT

FRAMEWORK (RMF)

The Automation Control Plane Platform will reside on VA’s internal network and integrate with production identity, secrets management, and infrastructure management systems. Accordingly, the platform must obtain an Authority to Operate (ATO) through VA’s Risk Management Framework (RMF) process in accordance with NIST SP 800-37 Rev. 2 and VA Handbook 6500 before operating in a production capacity on the VA network.

The Contractor shall be responsible for preparing all RMF documentation required to support the ATO process, including but not limited to the System Security Plan (SSP), Security Assessment Report (SAR), Plan of Action and Milestones (POA&M), hardware and software inventory, network architecture diagrams, data flow diagrams, and boundary definitions. The Contractor shall coordinate with the VA Information System Security Officer (ISSO) and Information System Security Manager (ISSM) assigned to this effort throughout the authorization process.

The Contractor shall submit the initial ATO package to the VA ISSO no later than forty-five (45) calendar days after contract award. The Government acknowledges that the ATO authorization decision is a Government responsibility and that the timeline for ATO approval is not solely within the Contractor’s control. However, the Contractor shall be responsible for timely submission of complete and accurate documentation, prompt response to Government requests for information or remediation during the assessment process, and implementation of all security controls required by the VA as a condition of authorization.

The Contractor shall not connect the platform to VA production systems, process VA data, or execute automation against VA production infrastructure until a valid ATO has been granted. Development, staging, and integration testing activities may proceed in isolated environments prior to ATO, subject to ISSO concurrence. The Contractor shall maintain the ATO throughout the Period of Performance, including supporting Annual Security Control Assessments and continuous monitoring requirements by providing Annual Security Assessment Support Documentation

The Annual Security Assessment Support Documentation serves as the yearly evidence package that supports continuous monitoring and the Annual Security Control Assessment under the Risk Management Framework. It provides the Government with refreshed control evidence, updated Plan of Action and Milestones items, vulnerability scan results, and any change records needed to maintain the ATO throughout the Period of Performance.

T…