IMM PWS DRAFT.pdf

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Office of Supply Chain

Inventory Management Modernization

Date: April 24, 20026

VA-26-00056417

PWS Version Number: 1.0

Contents

1.0 BACKGROUND

2.0 APPLICABLE DOCUMENTS

3.0 SCOPE OF WORK

4.0 PERFORMANCE DETAILS

4.1 Contract/Order Type

4.2 Ordering Period

4.3 Hours Of Work

4.4 Place of Performance

4.5 TRAVEL

5.0 INVENTORY MANAGEMENT MODERNIZATION FUNCTIONAL AREAS

5.1 Project MANAGEMENT

5.1.1 CONTRACTOR PROJECT MANAGEMENT PLAN

5.1.2 SCHEDULE MANAGEMENT

5.1.3 RISK MANAGEMENT

5.1.4 DOCUMENT MANAGEMENT

5.1.5 SOLUTION MANAGEMENT SUPPORT

5.1.6 ONBOARDING/INPROCESSING

5.1.7 VA MANDATORY TRAINING

5.1.8 TRANSITION SUPPORT

5.2 Data Management

5.3 Standardized Business Processes and Enterprise Integration

5.4 Technology Modernization, Interoperability, and Hosting

5.5 Integrated Planning and Program Management

5.6 Demand Planning Alignment

5.7 Customer‑Centric Supply Chain Optimization

5.8 Product Standardization and Differentiation

5.9 Category Management

5.10 Real‑Time Performance Management and Industry‑Aligned Metrics

5.11 Analytics and Multi‑Level Decision Support

5.12 Continuous Improvement

5.13 Organizational Change Management (OCM) and Training

5.14 INVENTORY MANAGEMENT

5.14.1 MEDICAL SURGICAL SUPPLIES

5.14.2 TRACKING SYSTEMS, SCANNERS, AND PERIPHERALS

5.14.3 Advanced management and analytics features

5.14.4 PHARMACEUTICAL/BIOREADINESS

5.14.5 PROSTHETICS AND DURABLE MEDICAL EQUIPMENT (DME)

5.14.6 BENEFITS SUPPLIES

5.14.7 BURIAL SUPPLIES

5.14.8 SUPPLY CHAIN INVENTORY RISK MANAGEMENT

5.15 INVENTORY ORDER MANAGEMENT

5.16 WAREHOUSE MANAGEMENT SYSTEM (WMS)

5.17 SUPPLY CHAIN FINANCIAL MANAGEMENT

5.18 TECHNOLOGY & ARCHITECTURE (PLATFORM/CLOUD/INTEGRATION)

5.19 USER RESEARCH

5.20 PRODUCT LIFECYCLE ACTIVITIES

5.21 SOLUTION ARCHITECTURE PLANNING

5.22 MONITORING REQUIREMENTS FOR VA SYSTEMS

5.23 APPLICATION PERFORMANCE MONITORING AND ALERTING

5.24 NETWORK AND OPERATING SYSTEM PERFORMANCE MONITORING

5.25 TRAINING

5.26 TESTING

5.27 IT HELP DESK SUPPORT

5.28 SAAS ASSESSMENT, AUTHORIZATION, AND CONTINUOUS MONITORING

REQUIREMENTS

5.28.1 IF THE SOLUTION IS NOT FedRAMP AUTHORIZED:

5.28.2 IF THE SOLUTION IS FedRAMP AUTHORIZED BUT NOT VA

AUTHORIZED:

5.28.3 IF THE SOLUTION IS FedRAMP AUTHORIZED AND VA AUTHORIZED: . 45

5.29 VA ENTERPRISE CLOUD IMPLEMENTATION/MIGRATION

5.29.1 ARCHITECTURE AND DESIGN

5.29.2 IMPLEMENTATION/MIGRATION PLANNING

5.29.3 BUILD AND DEVELOPMENT

5.29.4 TESTING AND VALIDATION FOR MIGRATIONS

5.29.5 IMPLEMENTATION

5.29.6 OPERATE AND MAINTAIN

5.29.7 MONITOR PERFORMANCE AND REPORTING

5.30 Deployment, Transition, and HELP DESK

6.0 SERVICE LEVEL AGREEMENT AND CONTINUITY OF OPERATIONS PLAN

(COOP)

6.1 SERVICE LEVEL AGREEMENT

6.2 CONTINUITY OF OPERATIONS PLAN (COOP)

7.0 GENERAL REQUIREMENTS

7.1 ENTERPRISE AND IT FRAMEWORK

7.1.1 VA TECHNICAL REFERENCE MODEL

7.1.2 ZERO TRUST – VA CRITICAL SECURITY CONTROLS

7.1.3 FEDERAL IDENTITY, CREDENTIAL, AND ACCESS MANAGEMENT

(FICAM)

7.1.4 INTERNET PROTOCOL VERSION 6 (IPv6)

7.1.5 TRUSTED INTERNET CONNECTION (TIC)

7.1.6 STANDARD COMPUTER CONFIGURATION

7.1.7 VETERAN FOCUSED INTEGRATION PROCESS (VIP) AND PRODUCT

LINE MANAGEMENT (PLM)

7.1.8 PROCESS ASSET LIBRARY (PAL)

7.1.9 AUTHORITATIVE DATA SOURCES

7.1.10 SOCIAL SECURITY NUMBER (SSN) REDUCTION

7.1.11 SOFTWARE AND LICENSING REQUIREMENTS

7.1.12 GENERATIVE ARTIFICIAL INTELLIGENCE REQUIREMENTS

7.1.12.1 AI SYSTEM/LLM DEVELOPMENT AND OPERATION

DOCUMENTATION REQUIREMENTS

7.1.12.2 MONITORING, REPORTING, AND CORRECTIVE ACTION

7.1.12.3 AI MODEL UPDATES AND CHANGE DISCLOSURES

7.2 SOURCE CODE HARMONIZATION AND REUSE IN INFORMATION

TECHNOLOGY (SHARE IT Act)

7.3 SECURITY AND PRIVACY REQUIREMENTS

6.2.1 POSITION/TASK RISK DESIGNATION LEVEL(S)

7.3.1 CONTRACTOR PERSONNEL SECURITY REQUIREMENTS

7.4 METHOD AND DISTRIBUTION OF DELIVERABLES

7.5 Contract PERFORMANCE METRICS

7.6 FACILITY/RESOURCE PROVISIONS

7.7 GOVERNMENT FURNISHED PROPERTY

8.0 CONTRACT MANAGEMENT

8.1 Contractor Program Management

8.2 CONTACTING OFFICER’S REPRESENTATIVE (COR)

8.3 PRE-AWARD PROCEDURES

8.3.1 REQUEST FOR TASK EXECUTION (RTEP) PROCESS

8.3.2 TASK EXECUTION PLAN (TEP)

8.3.3 TEP EVALUATION

8.4 Issuance Of Task Orders

8.5 POST AWARD PROCEDURES

8.5.1 REQUEST FOR POST AWARD ACTION

8.5.2 REVISED TEP FOR POST AWARD ACTIONS

8.5.3 POST AWARD ACTION APPROVAL

8.6 Reporting And Meeting Requirements

8.6.1 REPORTING REQUIREMENTS

8.6.1.1 MONTHLY PROGRESS REPORT

8.6.1.2 STATUS OF GOVERNMENT FURNISHED EQUIPMENT (GFE)

REPORT

8.6.1.3 PERSONNEL CONTRACTOR MANPOWER REPORT

8.6.1.4 CONTRACTOR STAFF ROSTER

8.6.1.5 SMALL BUSINESS PARTICIPATION REPORT

8.6.1.6 VETERANS EMPLOYMENT CERTIFICATION REPORT

8.7 Meetings And Reviews

8.7.1 IDIQ CONTRACT KICKOFF

8.7.2 TASK ORDER KICKOFF MEETINGS

8.7.3 PROGRAM REVIEWS

8.8 Communications

A – ADDITIONAL VA REQUIREMENTS, CONSOLIDATED

ADDENDUM B – VA INFORMATION AND INFORMATION SYSTEM SECURITY/

PRIVACY LANGUAGE

1.0 BACKGROUND

The Department of Veterans Affairs (VA) is a large and complex civilian agency that provides care and services to Veterans and their families across three lines of business.

VHA delivers direct health care through the nation’s largest integrated health system, including clinical services, pharmacy operations, prosthetics, and facility logistics. VBA administers federally authorized benefits and services such as disability compensation, pension and fiduciary programs, education benefits, insurance, home loan guaranty, and Veteran Readiness and Employment, each relying on timely purchasing and inventory support for nationwide operations. NCA manages the national cemetery system, providing burial services and memorialization, and sustaining cemetery infrastructure and equipment with reliable supply and asset management. To meet mission needs across these lines of business, VA requires an integrated, modernized inventory and purchasing capability that delivers real‑time visibility, standardized controls, and coordinated supply readiness across all organizations and facilities.

These illustrative metrics describe VA’s operational scale:

7.5 million unique patients were treated by the VA as of September 30, 2025.

148 million outpatient visits, an increase of 7.98% above 2022 current estimate.

155 million outpatient prescriptions dispensed by VA PBM to an estimated

5.5 million unique Veterans.

160 million mail‑order prescriptions dispensed via CMOP, accounting for roughly

80% of all VA outpatient prescriptions, consistent with historical volume trends across seven automated fulfillment centers.

24 million outpatient prescriptions dispensed at VA medical facility pharmacies.

24.5 million prosthetic devices, items, and services delivered by PSAS.

Enterprise footprint of >1,300 health care facilities, including 172 VA medical centers and >1,100 outpatient clinics, serving >9.1 million enrolled Veterans.

6.6 million contract actions totaling $38.3 billion in FY 2025.

6.3 million micro‑purchase transactions totaling $4.0 billion via the Government

Purchase Card in FY 2025.

To support this scale today, VA primarily relies on legacy business capabilities provided through IFCAP and the IFCAP GIP sub‑package:

IFCAP provides enterprise governance for budget alignment, fund control, and purchasing. It delivers budget‑aware request and approval control, vendor stewardship and eligibility screening, execution of purchases under policy through purchase orders and purchase cards, use of delivery orders against existing contracts, and receiving and acceptance documentation that ties to financial obligation and payment. IFCAP roles and workflows establish accountability from request initiation through approval and receipt, with audit trails and standardized artifacts such as the electronic 2237 request. These capabilities underpin compliance with mandatory sources, contract terms, and fiscal reporting across facilities.

IFCAP GIP manages expendable inventory across VA facilities. It enforces par‑level management and reorder points within a Primary and Secondary inventory structure, supports barcode‑driven counts and perpetual transaction history, automates replenishment through repetitive item lists and due‑in/due‑out tracking, and exposes enterprise reports for stock status, emergency levels, and packaging or source discrepancies. GIP also supports point‑of‑use cabinet integration and operating room case carts and instrument kits, aligning inventory availability with clinical procedures and patient care.

Although foundational, the current IFCAP/GIP capabilities operate within station‑centric, roll‑and‑scroll VistA environments that constrain enterprise performance. The decentralized systems hinder master data management, enterprise visibility, and process standardization, while tight interdependencies on IFCAP complicate system replacement. Technical sprawl, including ad hoc dashboards, warehouse utilities, and standalone graphical interfaces deployed to supplement legacy systems increase inventory management cost and inconsistency. The architecture lacks uniform, real‑time interoperability, is not cloud‑native, and does not enforce enterprise master data standards, producing fragmented practices and uneven analytics across facilities.

These constraints translate into inconsistent business processes and recurring issues identified by GAO and OIG, including inaccurate inventory records, expired items, and weak facility‑level oversight, reinforcing the need for stronger controls and governance.

Accordingly, the FY 2026 to 2030 Supply Chain Transformation Plan calls for system modernization, process standardization, improved data stewardship, and secure integration with EHRM and FMBT/iFAMS, which together form the enterprise drivers for modernization.

Inventory Management Modernization (IMM) will replace VA’s legacy systems and consolidate disparate functions into a centralized, web-based, cloud‑ready enterprise capability for purchasing and inventory management. IMM will unify master data governance, purchasing, receiving, stocking, distribution, and point‑of‑use support so every facility and program operates from the same authoritative data, the same standardized workflows, and the same real‑time picture of supply readiness across VHA, VBA, and NCA.

2.0 APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. “Federal Information Security Modernization Act of 2014”

2. Federal Information Processing Standards (FIPS) Publication 140-3, “Security Requirements for Cryptographic Modules”, March 22, 2019

3. FIPS Pub 199. “Standards for Security Categorization of Federal Information and Information Systems,” February 2004

4. FIPS Pub 200, “Minimum Security Requirements for Federal Information and

Information Systems,” March 2006

5. FIPS Pub 201-3, “Personal Identity Verification of Federal Employees and

Contractors,” January 2022

6. 10 U.S.C. § 2224, "Defense Information Assurance Program", as amended

7. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

8. Public Law 109-461 (P.L. 109-461), Veterans Benefits, Health Care, and

Information Technology Act of 2006, as amended, Title IX, Information Security Matters

9. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”, as amended

10. VA Directive 0710, “Personnel Vetting Program,” September 8, 2025, https://www.va.gov/vapubs/index.cfm

11. VA Handbook 0710, “Personnel Vetting Program,” September 8, 2025, https://www.va.gov/vapubs/index.cfm

12. VA Directive 6102, “Internet/Intranet Services,” August 5, 2019

13. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and Guidelines,” as amended

14. Office of Management and Budget (OMB) Circular A-130, “Managing Federal

Information as a Strategic Resource,” July 28, 2016

15. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed

Services (CHAMPUS)”, as amended

16. NIST SP 800-66 Rev. 2, “Implementing the Health Insurance Portability and

Accountability Act (HIPAA) Security Rule: A Cybersecurity Resource Guide,” February 2024

17. 45 C.F.R Parts 160 and 164, Subparts A and E, the Standards for Privacy of Individually Identifiable Health Information (“Privacy Rule”); and 45 C.F.R.

Parts 160 and 164, Subparts A and C, the Security Standard (“Security Rule”); as amended

18. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended

19. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

20. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021 (see VA

NOTICE 24-18, dated September 27, 2024, “Update to VA Directive 6500 Cybersecurity Program”, and VA Notice 25-07, dated 3/18/25, “Amending VA Directive 6500 to incorporate M-24-15”)

21. VA Handbook 6500, “Risk Management Framework for VA Information Systems VA Information Security Program,” February 24, 2021 (see VA Notice 25-01, dated October 15, 2024, “Update to VA Handbook 6500 Risk Management Framework for VA Information Systems VA Information Security Program”, and VA Notice 25-06, dated 3/18/25, “Amending VA Directive 6500 to incorporate M-24-15”, VA Notice 25-16, dated September 15, 2025, “Amending VA Handbook 6500 to Replace Enterprise Mission Assurance Support Services Tool With Office of Information Technology Governance Risk Compliance Tool, and VA Notice 25-17, dated September 22, 2025, “Rescission Of Office Of Information Security (OIS) Deputy Assistant Secretary (DAS) Memorandum – Requirements of Proper Plan of Action and Milestones (POA&M) Completion)

22. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI),” June 30, 2023

23. VA Handbook 6500.6, “Contract Security,” March 12, 2010 (see VA Notice 24-12, dated April 22, 2024, “Update to VA Handbook 6500.6, Contract https://www.va.gov/vapubs/index.cfm https://www.va.gov/vapubs/index.cfm http://www.va.gov/vapubs http://www.va.gov/vapubs

Security, Appendix C VA Information and Information System Security/Privacy Language for Inclusion into Contracts, As Appropriate”)

24. VA Handbook 6500.8, “Information System Contingency Planning,” March 25, 2025

25. VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018 (see VA NOTICE 25-10, dated June 9, 2025, “Use of Personally Owned Mobile Devices Policy Amendment of Department of Veterans Affairs Handbook 6500.10”, and VA Notice 25-15, dated August 22, 2025, “Update to VA Handbook 6500.10 Mobile Device Security Policy”)

26. VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017

27. OIT Process Asset Library (PAL), OIT Process Asset Library.

28. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

29. VA Directive 6508, “Implementation of Privacy Threshold Analysis and

Privacy Impact Assessment,” October 15, 2014

30. VA Directive 6510, “VA Identity, Credential and Access Management,”

September 3, 2024

31. VA Handbook 6510, “VA Identity, Credential and Access Management,”

September 27, 2024

32. VA Directive and Handbook 6513, “Secure External Connections,” October

12, 2017

33. VA Directive 6300, “Records and Information Management,” September 21,

34. VA Handbook, 6300.1, “Records Management Procedures,“ March 24, 2010

35. NIST SP 800-37 Rev 2, “Risk Management Framework for Information

Systems and Organizations: A System Life Cycle Approach for Security and Privacy,” December 2018

36. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020)

37. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015

38. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-

12) Program,” March 24, 2014

39. OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005

40. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019

41. OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008

42. Federal Identity, Credential, and Access Management (FICAM) Architecture, June 30, 2023 (FICAM Architecture (idmanagement.gov))

43. NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access,“ June 2018 https://digital.va.gov/process-asset-library/ https://www.va.gov/trm/TRMHomePage.aspx https://www.idmanagement.gov/arch/#:%7E:text=FICAM%20is%20the%20federal%20government%E2%80%99s%20enterprise%20approach%20to,identity%20processes%2C%20practices%2C%20policies%2C%20and%20information%20security%20disciplines.

44. NIST SP 800-63 Rev 4, 800-63A-4, 800-63B-4, 800-63C-4, “Digital Identity Guidelines,” August 1, 2025

45. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014

46. VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland

Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

47. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

48. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

49. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

50. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019

51. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008

52. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (P.L. 110–140), December 19, 2007

53. Section 104 of the Energy Policy Act of 2005, (P.L. 109–58), August 8, 2005

54. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August

2, 2001

55. Executive Order 14148, “Initial Rescissions of Harmful Executive Orders and

Actions,” dated January 20, 2025

56. VA Directive 0057, “VA Environmental Management Program,” October 25,

57. OIS VAIQ #7424808 Memorandum, “Remote Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

58. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

59. “Veteran Focused Integration Process (VIP) Guide 4.0,” March 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

60. VA Memorandum “Proper Use of Email and Other Messaging Services,”

January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

61. “Product Line Management Transformation Playbook” version 3.1, August 2023, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

62. NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020

63. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol

Version 6 (IPv6),” November 19, 2020

64. Social Security Number (SSN) Fraud Prevention Act of 2017

65. Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23,

66. C.F.R Title 15 Part 7, “Securing the Information and Communications

Technology and Services (ICTS) Supply Chain”, as amended https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514 https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896 https://www.cisa.gov/publication/tic-30-core-guidance-documents https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371 https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

67. Executive Order 14028, “Executive Order on Improving the Nation's Cybersecurity,” May 12, 2021, https://bidenwhitehouse.archives.gov/briefing-room/presidential-actions/2025/01/16/executive-order-on-strengthening-and-promoting-innovation-in-the-nations-cybersecurity/

68. OMB Memorandum M-22-09, “Moving the U.S. Government Toward Zero Trust Cybersecurity Principles”, January 26, 2022, https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf.

69. NIST SP 800-52 Revision 2, “Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations

70. OMB M-26-05, “Adopting a Risk-based Approach to Software and Hardware Security,” January 23, 2026

71. OMB M-21-31, “Improving the Federal Government’s Investigative and Remediation Capabilities Related to Cybersecurity Incidents,” August 27,

72. NIST SP 800-88 Revision 1 “Guidelines for Media Sanitization,” December

73. CISA Binding Operational Directive (BOD) 19-02: “Vulnerability Remediation Requirements of Internet-Accessible Systems,” April 29, 2019, BOD 19-02:

Vulnerability Remediation Requirements for Internet-Accessible Systems |

CISA

74. CISA BOD 22-01: “Reducing the Significant Risk of Known Exploited Vulnerabilities,” November 3, 2021, BOD 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities | CISA

75. CISA BOD 23-01: Improving Asset Visibility and Vulnerability Detection on Federal Networks.” Cybersecurity & Infrastructure Security Agency (CISA), BOD 23-01: Improving Asset Visibility and Vulnerability Detection on Federal Networks | CISA

76. VA Directive 6550, Pre-Procurement Assessment and Implementation of Medical Devices/Systems, June 03, 2019

77. VA Memorandum, “VA Security Controls,” January 17, 2025, https://www.voa.va.gov/DocumentView.aspx?DocumentID=5010

78. E.O. 13960, “Promoting the Use of Trustworthy Artificial Intelligence in the Federal Government,” December 3, 2020

79. E.O. 14319, “Preventing Woke AI in the Federal Government,” July 23, 2025

80. OMB Memorandum M-25-21, “Accelerating Federal Use of AI through

Innovation, Governance, and Public Trust,” April 3, 2025

81. OMB Memorandum M-25-22, “Driving Efficient Acquisition of Artificial

Intelligence in Government,” April 3, 2025

82. OMB Memorandum M-26-04, “Increasing Public Trust in Artificial Intelligence

(AI) Through Unbiased AI Principles,” December 11, 2025

83. VA Enterprise Cloud Technical Reference Guide, Version 2.0, November 10, Additionally, the Government notes that familiarity with the following documents will be essential to the Contractor’s success. These documents can be found by utilizing the links for each report:

https://bidenwhitehouse.archives.gov/briefing-room/presidential-actions/2025/01/16/executive-order-on-strengthening-and-promoting-innovation-in-the-nations-cybersecurity/ https://bidenwhitehouse.archives.gov/briefing-room/presidential-actions/2025/01/16/executive-order-on-strengthening-and-promoting-innovation-in-the-nations-cybersecurity/ https://bidenwhitehouse.archives.gov/briefing-room/presidential-actions/2025/01/16/executive-order-on-strengthening-and-promoting-innovation-in-the-nations-cybersecurity/ https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf https://www.cisa.gov/news-events/directives/bod-19-02-vulnerability-remediation-requirements-internet-accessible-systems https://www.cisa.gov/news-events/directives/bod-19-02-vulnerability-remediation-requirements-internet-accessible-systems https://www.cisa.gov/news-events/directives/bod-19-02-vulnerability-remediation-requirements-internet-accessible-systems https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities https://www.cisa.gov/news-events/directives/bod-23-01-improving-asset-visibility-and-vulnerability-detection-federal-networks https://www.cisa.gov/news-events/directives/bod-23-01-improving-asset-visibility-and-vulnerability-detection-federal-networks https://www.voa.va.gov/DocumentView.aspx?DocumentID=5010 https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-21-Accelerating-Federal-Use-of-AI-through-Innovation-Governance-and-Public-Trust.pdf https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-22-Driving-Efficient-Acquisition-of-Artificial-Intelligence-in-Government.pdf https://www.whitehouse.gov/wp-content/uploads/2025/12/M-26-04-Increasing-Public-Trust-in-Artificial-Intelligence-Through-Unbiased-AI-Principles-1.pdf?_bhlid=c0113a16495d987bc33f63e3dccf35c28d6bfd15

• Government Accountability Office (GAO) Reports

• GAO-18-34 – “Veterans Affairs Contracting – Improvements in Buying Medical and Surgical Supplies Could Yield Cost Savings and Efficiency”, Report to Chairman, Committee on Veterans’ Affairs, US House of Representatives, dated November 2017.

(https://www.gao.gov/assets/gao-18-34.pdf)

• GAO-18-658 – “Pharmacy Inventory Management Could Benefit from System-Wide Oversight”, Report to the Subcommittee on Oversight and Investigations, Committee on Veteran’s Affairs, US House of Representatives, dated September 2018.

(https://www.gao.gov/assets/d18658.pdf)

• GAO-20-487 – “VA Acquisition Management – Actions Needed to Improve Management of Medical-Surgical Prime Vendor Program and Information Future Decisions”, Report to Congressional Requestors, dated September 2020. (https://www.gao.gov/assets/gao-20-487.pdf)

• GAO-21-105304 – “Veterans Affairs – Systems Modernization, Cybersecurity, and IT Management Issues Need to Be Addressed,” Testimony Before the Subcommittee on Technology Modernization, Committee on Veterans’ Affairs, US House of Representatives, Statement of Carol C. Harris, Director, Information Technology and Cybersecurity, dated July 1, 2021. (https://www.gao.gov/assets/gao-21-105304.pdf)

• GAO-22-105483 – “VA Acquisition Management – Fundamental Challenges Could Hinder Supply Chain Modernization Efforts If Not Addressed”, Testimony Before the Subcommittee on Oversight and Investigations and Subcommittee on Technology Modernization, Committee on Veterans’ Affairs, US House of Representatives, Statement of Shelby S. Oakley, Director, Contracting and National Security Acquisitions, dated November 18, 2021. (https://www.gao.gov/assets/gao- 22-105483.pdf)

• VA Office of Inspector General (OIG) Reports

• VAOIG-17-03718-240 – “Inadequate Oversight of the Medical/Surgical

Prime Vendor Program’s Order Fulfillment and Performance Reporting for Eastern Area Medical Centers”, VA OIG Office of Audits and Evaluations, dated December 17, 2019.(https://www.vaoig.gov/sites/default/files/reports/2019-12/VAOIG-17- 03718-240.pdf)

• VAOIG-19-06147-50 – “Inadequate Oversight of the Medical/Surgical Prime Vendor Program’s Distribution Fee Invoicing”, VA OIG Office of Audits and Evaluations, dated March 4, 2021 (https://www.vaoig.gov/sites/default/files/reports/2021-03/VAOIG-19- 06147-50.pdf)

• Assessment J (Supplies), prepared by McKinsey and Company, Inc., dated September 1, 2015. Assessment J report was conducted based on the Veterans Choice Act (Title II, Section 201) requires an independent review of how VA and VHA acquire and manage pharmaceuticals, medical and surgical supplies, and https://www.gao.gov/assets/gao-18-34.pdf https://www.gao.gov/assets/d18658.pdf https://www.gao.gov/assets/gao-20-487.pdf https://www.gao.gov/assets/gao-21-105304.pdf https://www.gao.gov/assets/gao-22-105483.pdf https://www.gao.gov/assets/gao-22-105483.pdf https://www.vaoig.gov/sites/default/files/reports/2019-12/VAOIG-17-03718-240.pdf https://www.vaoig.gov/sites/default/files/reports/2019-12/VAOIG-17-03718-240.pdf https://www.vaoig.gov/sites/default/files/reports/2021-03/VAOIG-19-06147-50.pdf https://www.vaoig.gov/sites/default/files/reports/2021-03/VAOIG-19-06147-50.pdf medical devices, including related distribution and inventory services. Medical equipment is excluded.

https://www.voa.va.gov/DocumentView.aspx?DocumentID=4970

• Commission on Care, Final Report, dated June 30, 2016. The Commission on Care The Commission on Care, created under Section 202 of the Veterans Access, Choice, and Accountability Act of 2014, was tasked with examining veterans’ access to VA health care and evaluating how the Veterans Health Administration should be organized, resourced, and positioned to deliver care effectively over the next 20 years.(https://www.voa.va.gov/DocumentView.aspx?DocumentID=4971

3.0 SCOPE OF WORK

This PWS defines the overarching requirements for the IMM solution. The Contractor shall provide a comprehensive, end‑to‑end solution that includes, but is not limited to, system integration, business process re-engineering, organizational change management, and training necessary to successfully deploy, integrate, adopt, and sustain the solution. The Contractor shall deliver a total Inventory Management modernization and transformation capability that encompasses all identified functional areas and the full spectrum of Inventory Management solution requirements. Task orders issued under this contract may include the acquisition of software and IT products when such products are necessary to fulfill the required solution. These services and related IT products may span the entire system life cycle, from initial development through long‑term sustainment. Services and deliverables provided under this contract shall be global in scope. The Contractor shall be prepared to deliver support and required products worldwide.

This PWS establishes general requirements, specific technical, functional, and performance requirements will be detailed within individual task orders. Functional area requirements are described in Section 5.0 and are not mutually exclusive. While some task order requirements may fall within a single functional area, many will span multiple areas to support the delivery of a full life cycle Inventory Management solution.

The VA requires a comprehensive modernization and transformation program that is supported by a Contractor serving as a transformation partner. The Contractor shall provide services that enable the VA to achieve the program’s objectives through an integrated approach, rather than solely delivering or deploying technology products. The modernization and transformation effort consists of three primary components, as outlined below:

(1) People:

The enterprise IMM effort will establish centralized accountability, training, and talent management, which when coupled with centralized systems and processes, is expected to have a positive compounding effect that improves operational efficiency and effectiveness. This involves implementing a robust Supply Chain management and training capability that utilizes a comprehensive organizational and individual change management process https://www.voa.va.gov/DocumentView.aspx?DocumentID=4970 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4971 with supporting training enablers to ensure that end users are fully capable of executing their functions.

(2) Process:

The enterprise IMM initiative will standardize business processes and transactions to promote operational efficiency and scalability, improving process maturity, management, and governance while minimizing or eliminating the use of non-standard or manual processes. This includes strengthening compliance by enhancing VA’s ability to meet federal regulations, improving automated controls, and mitigating long-standing audit deficiencies while avoiding any stop-gap compliance measures which do not address longer-term strategy, process compatibility, and benchmarking. A key aspect of process improvement will also involve addressing any organizational or structural deficiencies which bring undue challenges related to oversight, collaboration, efficiency, accountability, and program management.

(3) Technology:

The solution will incorporate the following principles and/or capabilities:

a) The Contractor shall rapidly deliver an easy‑to‑use, integrated, and intelligent enterprise Inventory Management and Order Management solution that enables swift user adoption across all VA environments. The Contractor shall develop and provide a deployment roadmap for Government approval that addresses all aspects of implementation— including people, process, and technology—and supports effective customer adoption and timely rollout of the proposed solution.

b) The Contractor shall optimize current and future inventory management capabilities to ensure rapid deployment of the proposed solution without disruption to ongoing operations. The Contractor shall integrate existing systems that are not slated for replacement and support the phased retirement of legacy systems in a manner that enables rapid, orderly, and non‑disruptive modernization. The Contractor shall lead the user community through all required transition activities to maintain a fully functional operational environment. In addition, the Contractor shall provide VA with a comprehensive modernization, integration, migration, and system‑replacement plan for Government review and approval.

c) The Contractor shall adhere to all applicable VA policies, including Scaled Agile Framework (SAFe) best practices and all Office of Information and Technology (OIT) security policies, to ensure compliant, secure, and standardized delivery of the solution.

d) VA requires delivery of an enterprise supply chain solution using Scaled Agile and High-Reliability Organization tenets utilizing an incremental plan that provides capabilities enterprise wide while avoiding “big bang” system implementation. The Contractor shall develop a deployment roadmap (part of the overall roadmap), for government approval, capturing the details of the capability deployments, to include explaining how sites with previously deployed capabilities will be updated to reflect new capabilities added in following waves. The Government envisions an initial task order to develop a more detailed plan, followed by another task order to create a pilot. After the completion of each task order, the Government reserves the right not to issue further task orders.

4.0 PERFORMANCE DETAILS

The Contractor shall provide and/or acquire the services, hardware, and software required by individual task orders pursuant to the general requirements specified below.

4.1 CONTRACT/ORDER TYPE

This is an Indefinite Delivery Indefinite Quantity (IDIQ) type contract. Orders may be issued on a Firm Fixed Price, Time and Material and/or Labor-Hour basis. In accordance with Federal Acquisition Regulation (FAR) Part 12.207(d) task orders may use award fee and performance or delivery incentives when the award fee or incentive is based solely on factors other than cost.

4.2 ORDERING PERIOD

The total ordering period is not to exceed 10 years and consists of a 5-year base period and a 5-year option period.

4.3 HOURS OF WORK

Hours of work shall be in accordance with individual task order requirements.

There are 11 Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, five are set by date:

New Year's Day January 1 Juneteenth June 19 Independence Day July 4 Veterans Day November 11 Christmas Day December 25

If any of the above falls on a Saturday, then Friday shall be observed as a holiday.

Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

Martin Luther King's Birthday Third Monday in January Washington's Birthday Third Monday in February Memorial Day Last Monday in May Labor Day First Monday in September Columbus Day Second Monday in October

Thanksgiving Fourth Thursday in November

4.4 PLACE OF PERFORMANCE

The place of performance shall be identified in individual task orders. Locations in the Enterprise will be Government or non-Government sites within the continental United States (CONUS) and/or outside the continental United States (OCONUS). Locations may include but are not limited to Federal, State, or VA, data centers, facilities, regional offices, benefits delivery centers, medical treatment facilities, health clinics and community care facilities as defined in individual task orders.

4.5 TRAVEL

Travel shall be in accordance with individual task order requirements. All travel shall be in accordance with the Federal Travel Regulations.

5.0 INVENTORY MANAGEMENT MODERNIZATION FUNCTIONAL AREAS

VA recognizes that the needs of its various supply chain user communities share more commonalities than differences. Therefore, the Contractor shall provide a unified “single pane of glass” view of supply chain system capabilities, offering a common entry point and presentation layer for all VA users. User access shall be role‑based and configurable to tailor system options, menus, reports, and approval authorities for specific user groups or individuals. The Contractor’s solution and engagement approach shall prioritize consistent and standardized process flows across all VA purchasing and inventory management functions. Core activities—such as ordering, receiving, managing, tracking, and delivering expendable and some non-expendable material— shall follow uniform workflows to ensure efficient and seamless integration with VA’s Financial Management System to improve operating budget management. VA’s desired end state is a modernized, Department‑wide inventory management and ordering environment.

Individual task orders may encompass more than one task area listed below. Further task details are described to provide greater insight into the complexity and uniqueness of some potential task order requirements covered by this PWS. Task area requirements are not mutually exclusive and may apply across multiple functional areas and multiple task orders. Efforts to be performed by the Contractor under this contract are of such a nature that they may create a potential organizational conflict of interest as contemplated by Subpart 9.5 of the Federal Acquisition Regulation (FAR). Contractor personnel may be required to sign a non-disclosure agreement

5.1 PROJECT MANAGEMENT

5.1.1 CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Project Management Plan (CPMP) to include a Communication Plan, Training Plan, and Change Management Plan that is congruent with existing IMM documentation (where applicable and specified in a Task Order) for each awarded Task Order that defines the Contractor’s approach, timeline and tools to be used in execution of the Task Order. The CPMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks and resource support. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the SOO. The initial baseline CPMP shall be accepted by the Government and the Contractor shall update and maintain the approved CPMP throughout the Task Order period of performance.

5.1.2 SCHEDULE MANAGEMENT

The Contractor shall create, maintain, analyze, and report schedules in a manner that is fully consistent with Scaled Agile Framework (SAFe) delivery while also meeting programmatic requirements for an Integrated Master Schedule (IMS). The Contractor shall produce an IMS for the IMM program that provides enterprise level visibility into major milestones, Program Increment (PI) boundaries, deployment waves, product roadmaps, dependencies, risks, and other elements necessary for Government oversight. The IMS shall be updated regularly and shall reflect the best available information at the time of update.

The Contractor shall ensure that the IMS is structured to align with Agile planning practices. The IMS is not required to provide fixed dates for Agile backlog items or user stories and shall not conflict with the iterative nature of SAFe delivery. Instead, the IMS shall capture time-phased activities at the feature, epic, capability, release, PI, or deployment level, along with all external dependencies, critical path items, integration points, and Government-directed milestones. The IMS shall serve as a coordination and transparency tool rather than a prescriptive task-level.

For each Task Order, the Contractor shall develop and maintain a Task Order schedule consistent with this approach. The Contractor shall also develop and maintain a Task Order oriented Work Breakdown Structure (WBS) that supports traceability of work to outcomes. The WBS shall be linked to the IMS and shall be organized to reflect value delivery, decomposition of epics and capabilities, and integration points with other VA systems and program teams.

5.1.3 RISK MANAGEMENT

The Contractor shall conduct risk management for each task order awarded. The Contractor shall provide input to the product Risk Management registry within the VA approved toolset maintained by VA and report risk tracked by task order in the Monthly Progress Report.

The Contractor shall:

1. Comply with and/or establish the Risk Management Plan (RMP) where one is not already established by VA. If already established, the contractor shall conduct a gap analysis and provide recommended updates to the RMP.

2. Use the VA-provided approved tool to create/update and actively manage a project and security risk register (also referred to as risk log) that identifies knowable circumstances that may have a negative impact on project success and describes the potential impacts and asserts measures to either reduce/eliminate their impact. Critical risks determined by the VA PM shall also be documented in the VA PARS Dashboard and/or other OIT-approved tools.

Risk items shall also include security risk data from security scans and outstanding plan of action and milestones (POA&M).

3. Use the VA-approved boards and tools to facilitate risk meetings and reviews.

4. Collaborate with project team(s) to actively manage, size (level of effort), develop approved mitigations and plans of action and milestones and assess/re-assess probability and severity of project risks and issues throughout the project lifecycle.

5. Continuously update risk for all task order activities in the VA approved toolset (currently Jira and eMASS) and risk register and link risk to their appropriate activities.

6. Participate in monthly cloud security continuous monitoring meetings for cloud applications that fall within your suite of capabilities.

5.1.4 DOCUMENT MANAGEMENT

The Contractor shall:

1. Use a VA-approved tool and repository for all documents and electronic artifacts and apply version control to each deliverable. If assigned tools are deprecated, the Contractor shall assist the VA Tools Team in migrating documents and electronic artifacts to the new tool.

2. Ensure that all artifacts are versioned correctly according to VA standards and follow a versioning approach which identifies all major, minor, and update changes to the components.

3. Based on VA requirements, and the unique needs or nature of each TO, the Contractor shall determine the components within each product that must be under configuration control. The Contract shall deliver a List of Configuration Items for each TO, including but not limited to configuration identification, configuration control, and configuration audit.

4. Ensure that all Document update cycles are captured in the IMS and are reviewed within their appropriate timelines and updated, if necessary, with proper version control with the review noted in the Revision History of the document.

5.1.5 SOLUTION MANAGEMENT SUPPORT

The Contractor shall comply with the VA DevSecOps process and supporting SAFe practices. To complete this task, the Contractor shall follow SAFe Ceremonies to ensure alignment and collaboration with relevant stakeholders and partners.

Additionally, the Contractor shall organize, in coordination with the government, Program Increment (PI) Planning across interdependent legacy systems, as required, to mitigate technical risk and improve rapid delivery of business value. As part of each TO, the Contractor shall provide expertise to help manage the following processes:

1. Consolidate requirements or sequencing to generate efficiencies.

2. Assist in defining process, governance, and solution implementation requirements, to include the generation of Epics, Features and User Stories while mitigating dependencies.

3. Collaborate with other Program Offices to gain an understanding of how future state requirements for a successful implementation of changes to the VA supply chain impacts legacy process or dependent systems.

4. Provide guidance/recommendations on handling dependencies between supply chain implementation requirements to reduce risk as new process, governance, or capabilities are delivered and legacy systems are retired.

5. The Contractor shall create operational and development Value Stream documentation for the Supply Chain Solution. The Operational and Development Value Streams will be used to ensure proper team structure and prioritization of capabilities using Weighted Shortest Job First (WSJF).

6. The Contractor shall organize and conduct meetings to produce products to support the Solution, Program Increment, and Team level. Epic, feature, and story backlogs shall be maintained, and relevant planning meetings executed.

The Government will set priority and approve the backlogs.

5.1.6 ONBOARDING/INPROCESSING

The Contractor shall manage the onboarding of its staff to VA. Onboarding includes steps to obtain a VA PIV card, network and email account, complete training, initiate background investigations, and gain physical and logical access to VA. In addition, the Contractor shall identify individuals who may require elevated privileges to the necessary development and test environments for the various systems to be enhanced.

After review between the Contractor and VA COR, a decision will be made as to the necessity of obtaining GFE for the onboarding staff. If approved, the Contractor shall follow the appropriate steps to obtain the equipment.

A single Contractor Onboarding point of contact (POC) for each task order shall be designated by the Contractor that tracks the onboarding status of all Contractor personnel. The Contractor Onboarding POC shall be responsible to submit all required onboarding paperwork, required TMS certificates 48 hours from start date provided to the VA COR and identified Government representative. The Contractor shall be responsible for tracking the status of all its staff’s onboarding activities to include the names of all personnel engaged on the task, their initial training date for VA Privacy and Information Security training, and their next required training date. The Contractor Onboarding POC and the Contractor task order PM shall communicate any issues with in-processing/onboarding of an incoming contractor and shall follow-up with the identified Government representative as required. The Contractor Onboarding POC shall also report the status of the staff level during onboarding status meetings. The Contractor shall provide an Onboarding Status Report weekly for any staff with outstanding onboarding requests for review by the identified Government representative.

5.1.7 VA MANDATORY TRAINING

The Contractor and identified Government representative shall determine which team members require access to the VA network and VA approved toolset. All Contractors that require access shall complete all the required VA Talent Management System (TMS) training courses within 14 days of the identification of the access need. The Contractor shall work with its respective point of contact, to obtain access to TMS to complete the mandatory training courses.

As an action under the Continuous Readiness in Information Security Program (CRISP), VA's Assistant Secretary for Information and Technology issued a memorandum requiring all VA government and contract staff to complete information security awareness and applicable role-based training. The Contractor shall submit TMS Training Certificates of completion for VA Privacy and Information Security Awareness, Rules of Behavior, Health Insurance Portability and Accountability Act, and Role-Based trainings. The Contractor shall provide signed copies of the Contractor Rules of Behavior IAW Section 9, Training, from Appendix C of the VA Handbook 6500.6, “Contract Security”.

The Contractor shall complete the appropriate VA TMS role-based training courses for all contractors with required access to Elevated Privileges:

• TMS ID 3197: Information Security Role-Based Training for IT Specialist (WBT)

• TMS ID 3867205: Training for Elevated Privileges for System Access (WBT)

• TMS ID 3867207: Information Security Role-Based Training for System Owners

(WBT)

• TMS ID 1016925: Information Security Role-Based Training for Software

Developers (WBT)

• TMS ID 1357076: Information_Security_Role-

Based_Training_for_System_Administrators (WBT)

• TMS ID 1357084: Information Security Role-Based Training for Data Managers

(WBT)

• TMS ID 1357083: Information Security Role-Based Training for Network

Administrators (WBT)

• TMS ID 64899: Information Security Role-Based Training for IT Project

Managers (WBT)

The Contractor shall complete the following Agile training courses, and other emerging Product Line Management and SAFe courses as required by the identified Government representative:

• TMS ID 4533235: Product and Product Line Management: Creating and Managing the Product Back Log

• TMS ID 4533231: Product and Product Line Management: Overview of Product Line Management

• TMS ID 4551891: Introduction to Agile

• TMS ID 4551982: Product Owner

The Contractor shall complete emerging training requirements for GitHub, Jira, or other VA approved tools as appropriate or required. Contractors who have completed these VA training courses within the past 12 or 24 months, depending on the training requirements, and have furnished training certificates to VA, will not be required to re-take the training courses.

5.1.8 TRANSITION SUPPORT

The Contractor shall recognize that the services under this contract are vital to the Government and must be continued without interruption, and that upon contract expiration a successor, either the Government or another contractor may continue them. The Contractor shall provide phase in training and exercise its best efforts and cooperation to affect an orderly and efficient transition to a successor.

The Contractor…