MTS PWS - 10_1_24- RFI.pdf

Information Technology (IT) Modernization Tool Suite (MTS)

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Office of Information & Technology (OIT) Office the Chief Technology Officer (OCTO)

Date 10/1/2024

VA-XX-XXXXXXXX

PWS Version Number: 1.1

Contents

1.0 BACKGROUND

2.0 APPLICABLE DOCUMENTS

3.0 SCOPE OF WORK

3.1 ORDER TYPE

4.0 PERFORMANCE DETAILS

4.1 PERFORMANCE PERIOD

4.2 PLACE OF PERFORMANCE

4.2.1 TRAVEL OR SPECIAL REQUIREMENTS

5.0 SPECIFIC TASKS AND DELIVERABLES

5.1 PROJECT MANAGEMENT

5.1.1 CONTRACTOR PROJECT MANAGEMENT PLAN

5.1.2 REPORTING REQUIREMENTS

5.1.3 ONBOARDING

5.1.4 TECHNICAL KICK-OFF MEETING

5.1.5 PRIVACY AND HIPAA TRAINING

5.2 EMERGING TECHNOLOGIES AND INNOVATION SUITE SOLUTION

5.3 IT Modernization Tool Suite (MTS)

5.4 Modernization Tool Suite SUPPORT

5.4.1 PRODUCT SUPPORT

5.4.2 ROADMAP AND STRATEGY PLANNING

5.4.3 PROGRAMMATIC & TOOL METRICS

5.4.4 GOVERNANCE OF MTS

5.4.5 LICENSE/SUBSCRIPTION/USAGE MANAGEMENT

5.4.6 QUALITY ASSESSMENT AND MANAGEMENT

5.4.7 CONTRACT CONSOLIDATION AND REVIEW

5.4.8 USER AND TECHNICAL DOCUMENTATION

5.4.9 TRAINING PROGRAM

5.4.10 INTAKE / ONBOARDING PROCESS

5.4.11 CUSTOMER (EXTERNAL) SERVICE LEVEL AGREEMENTS (SLA)

5.4.12 HELP DESK SUPPORT

5.4.13 IT MTS (INTERNAL) SERVICE LEVEL AGREEMENTS (SLAs)

5.4.14 ESCALATION TIMES BETWEEN TIERS

5.4.15 AFTER ACTION REPORTING

5.4.16 TREND ANALYSIS

5.4.17 USER ACCOUNT SECURITY CONTROL

5.4.18 METADATA/STRUCTURE DEVELOPMENT

5.4.19 CONFIGURATION MANAGEMENT

5.4.20 SOFTWARE IMPLEMENTATION AND MIGRATION PLAN

5.4.21 ATO

5.4.22 IMPLEMENTATION

5.4.23 DATA MIGRATION

5.4.24 INTEGRATION

5.4.25 OFF-BOARDING PROCESS

5.4.26 DECOMMISSIONING

6.0 GENERAL REQUIREMENTS

6.1 ENTERPRISE AND IT FRAMEWORK

6.1.1 VA TECHNICAL REFERENCE MODEL

6.1.2 FEDERAL IDENTITY, CREDENTIAL, AND ACCESS MANAGEMENT

(FICAM)

6.1.3 INTERNET PROTOCOL VERSION 6 (IPV6)

6.1.4 TRUSTED INTERNET CONNECTION (TIC)

6.1.5 STANDARD COMPUTER CONFIGURATION

6.1.6 PROCESS ASSET LIBRARY (PAL)

6.1.7 AUTHORITATIVE DATA SOURCES

6.1.8 SOCIAL SECURITY NUMBER (SSN) REDUCTION

6.1.9 POSITION/TASK RISK DESIGNATION LEVEL(S)

6.1.10 CONTRACTOR PERSONNEL SECURITY REQUIREMENTS

6.2 METHOD AND DISTRIBUTION OF DELIVERABLES

6.3 PERFORMANCE METRICS

6.4 FACILITY/RESOURCE PROVISIONS

6.5 GOVERNMENT FURNISHED PROPERTY

ADDENDUM A – ADDITIONAL VA REQUIREMENTS, CONSOLIDATED

ADDENDUM B – VA INFORMATION AND INFORMATION SYSTEM SECURITY AND

PRIVACY LANGUAGE

1.0 BACKGROUND

In 2017, the Department of Veterans Affairs (VA) Office of the Chief Technology Officer (OCTO) partnered with VA Central Office and all three VA Administrations to identify a vision statement for enhancing VA’s digital presence for Veterans. That vision is known as the Digital Modernization Vision and is supported by a group of VA executives known as the Digital Modernization Council. This council is chaired by the Chief Technology Officer.

The VA Digital Modernization Vision defined in July 2017:

VA will deliver self-service tools on par with top private sector companies and will have the best online experience in the Federal Government. Every digital service will be customized to the individual using it. Interacting with VA digital services will feel like navigating TurboTax, not filling out a form.

The work described in this PWS directly supports VA OCTO, the Office of the Chief Architect, the VA Innovation Unit and the Office of the Chief Artificial Intelligence Officer.

VA OCTO has three North Star goals:

1/ Increase the usage and throughput of VA services 2/ Decrease the time Veterans spend waiting for an outcome 3/ Increase the quality and reliability of VA services

In addition to these north stars, the team that runs VA.gov (OCTO-Digital Experience Portfolio) has a vision and mission that describes its idea of the state of the world and role in making it happen.

Our Vision: Every Veteran is guaranteed access to self-service benefits and accurate data.

Our Mission: Continuously deliver high-quality digital experiences for the benefit of all Veterans and their families.

As part of VA’s digital modernization journey OCTO and VA’s Innovation Unit have worked with a significant number of internal and external teams to help rationalize and modernize the tooling used in their applications. This has led to a Tool Suite of modern cloud-based applications, managed as a single solution, addressing the urgent need to decommission and modernize legacy applications and ensure VA is using the most appropriate, modern, and secure tools available to provide world-class support to our Nation’s Veterans.

2.0 APPLICABLE DOCUMENTS

In the performance of the tasks associated with this PWS, the Contractor shall comply with the following:

1. FEDERAL INFORMATION SECURITY MODERNIZATION ACT OF 2014”

2. FEDERAL INFORMATION PROCESSING STANDARDS (FIPS) PUBLICATION

140-3, “SECURITY REQUIREMENTS FOR CRYPTOGRAPHIC MODULES”

MARCH 2019

3. FIPS PUB 199. STANDARDS FOR SECURITY CATEGORIZATION OF

FEDERAL INFORMATION AND INFORMATION SYSTEMS, FEBRUARY 2004

4. FIPS PUB 200, MINIMUM SECURITY REQUIREMENTS FOR FEDERAL

INFORMATION AND INFORMATION SYSTEMS, MARCH 2016

5. FIPS PUB 201-3, “PERSONAL IDENTITY VERIFICATION (PIV) OF FEDERAL

EMPLOYEES AND CONTRACTORS,” JANUARY 2022

6. VA DIRECTIVE AND HANDBOOK 6102, “INTERNET AND INTRANET

SERVICES,” AUGUST 2019

7. 36 C.F.R. PART 1194 “ELECTRONIC AND INFORMATION TECHNOLOGY

ACCESSIBILITY STANDARDS,” JULY 1, 2003

8. VA DIRECTIVE 6500, “VA CYBERSECURITY PROGRAM” FEBRUARY 2021

9. VA HANDBOOK 6500, “RISK MANAGEMENT FRAMEWORK FOR VA

INFORMATION SYSTEMS: VA INFORMATION SECURITY PROGRAM,”

FEBRUARY 2021

10. VA HANDBOOK 6500.5, “INCORPORATING SECURITY AND PRIVACY IN

SYSTEM DEVELOPMENT LIFECYCLE”, MARCH 22, 2010

11. ONE-VA TECHNICAL REFERENCE MODEL (TRM) (REFERENCE AT

HTTPS://WWW.VA.GOV/TRM/TRMHOMEPAGE.ASPX)

12. FEDERAL IDENTITY, CREDENTIAL, AND ACCESS MANAGEMENT (FICAM)

ARCHITECTURE JUNE 2023 VERSION 3.3

13. TRUSTED INTERNET CONNECTIONS (TIC) 3.O JULY 2020

14. OMB MEMORANDUM M-19-26, “UPDATE TO THE TIC INITIATIVE"

SEPTEMBER 2019

15. OFFICE OF INFORMATION SECURITY (OIS) VAIQ #7424808

MEMORANDUM, “REMOTE ACCESS”, JANUARY 15, 2014,

HTTPS://WWW.VOA.VA.GOV/DOCUMENTLISTPUBLIC.ASPX?NODEID=28

16. VA MEMORANDUM, “PERSONAL IDENTITY VERIFICATION (PIV) LOGICAL

ACCESS POLICY CLARIFICATION JULY 2019

17. VA MEMORANDUM, “PROPER USE OF EMAIL AND OTHER MESSAGING

SERVICE JANUARY 2018

18. VA MEMORANDUM “UPDATED VA INFORMATION SECURITY RULES OF

BEHAVIOR FOR ORGANIATIONAL USERS FOR FISCAL YEAR 2024, (VIEWS

#710343126)”, SEPTEMBER 2023,

HTTPS://WWW.VOA.VA.GOV/DOCUMENTLISTPUBLIC.ASPX?NODEID=28

19. THE U.S. DIGITAL SERVICES PLAYBOOK (HTTPS://PLAYBOOK.CIO.GOV/)

20. THE AGILE MANIFESTO AGILE MANIFESTO FOR SOFTWARE

DEVELOPMENT | AGILE ALLIANCE

21. TWELVE PRINCIPLES OF AGILE SOFTWARE 12 PRINCIPLES BEHIND THE

AGILE MANIFESTO | AGILE ALLIANCE

https://www.va.gov/trm/TRMHomePage.aspx https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 https://playbook.cio.gov/ https://playbook.cio.gov/) https://www.agilealliance.org/agile101/the-agile-manifesto/ https://www.agilealliance.org/agile101/the-agile-manifesto/ https://www.agilealliance.org/agile101/12-principles-behind-the-agile-manifesto/ https://www.agilealliance.org/agile101/12-principles-behind-the-agile-manifesto/

3.0 SCOPE OF WORK

The Contractor shall aid with the management of the IT MTS, including the procurement of certain tools, management of licensing for both tools procured under this and through other contracts, as well as several open source tools while providing the VA with innovation management, identification, research, testing, configuration, deployment, migration, integration, implementation, training, mentoring, support and operational maintenance as needed for the adoption of the IT MTS for use by VA Staff, business units and project teams to deliver features on systems that capitalize on various technology stacks and are hosted on the various platforms and hosting environments.

The Contractor shall support the identification and tracking of proper licensing for the following categories of tools: Development, Pre-Production and Production.

The Contractor shall support the proper licensing and tracking for cloud hosting, on-premises services, Software as a Service (SaaS), and Hybrid solutions.

The Contractor shall aid with the development and tracking of metrics covering software

Performance, Security, Usage, and licensing.

The Contractor shall provide a variety of reports at the respective 14-day, 21-day, and

30-day marks in accordance with the sections of the PWS. This shall include reports on current software tools usage to assist VA in developing and implementing strategies for cost avoidance as part of maturing VA’s toolset.

The Contractor shall provide VA with coaching and mentoring for using IT MTS including how to implement various agile methodologies as determined appropriate for each project, and for identifying systems to replace existing legacy applications using different platforms and utilizing the tools best suited for each systems technology stack, platform, and hosting environment.

The Contractor shall provide VA with support, coaching, demonstrations and documentation with respective business units, systems, and applications in regard to any and all tools which fall under the purview of the ITMTS. Capitalizing on agile methodologies appropriate for the various platforms and by utilizing the tools best suited for the system technology stack, platform and hosting environment.

The Contractor shall also support the on-boarding of additional tools as needed by the VA team to support VA’s modernization journey. The Contractor shall provision users to the tools to include granting, changing, and removing access. The Contractor shall integrate the tools that make up IT MTS so that information is transferred between the tools and so that each integrates with VA’s single sign-on solution(s) when appropriate.

The Contractor shall also advise the VA on current industry standards and emerging tools, applications, or bundled applications that may fulfill future Development, Security, and Operations (DevSecOps) needs and which can be utilized on the various VA platforms and hosting environments.

The Contractor shall be responsible for the initial and existing IT MTS Authorities to Operate (ATOs), continuous monitoring and updating of the required documentation to ensure VA maintains its Accreditation Approval.

The Contractor shall support the on-boarding process of tools to IT MTS. The contractor shall aid with the provisioning of the hosting environment(s), provisioning of users, audit reporting of known configurations, modification of environment (s) to ensure cost effectiveness based on the hosting model, and where applicable granting, changing, and removing access of users.

The Contractor shall aid with the accountability of licensing, personnel, and device management where applicable.

The Contractor shall aid with the interoperability of IT MTS within the VA ecosystem to ensure proper and adequate communication between required systems supporting

Configuration Management Database (CMDB), Data Lake, data repositories, dashboards, and metric systems.

The Contractor shall support compliance with the Authentication and Authorization process for access and Risk Management Framework for all tools that comprise IT MTS and new emerging technologies being tested under this effort.

3.1 ORDER TYPE

The effort shall be proposed on a Time and Materials (T&M) basis.

4.0 PERFORMANCE DETAILS

4.1 PERFORMANCE PERIOD

The period of performance (PoP) for the effort shall be one (1) 12-month Base Period, with four (4) 12-month Option Periods and one additional 6-month option period in accordance with Federal Acquisition Regulation (FAR) 52.217-8 Option to Extend Services.

Any work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO).

There are eleven (11) Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, four are set by date:

New Year's Day January 1

Juneteenth June 19 Independence Day July 4 Veterans Day November 11 Christmas Day December 25

If any of the above falls on a Saturday, then Friday shall be observed as a holiday.

Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

Martin Luther King's Birthday Third Monday in January Washington's Birthday Third Monday in February Memorial Day Last Monday in May Labor Day First Monday in September Columbus Day Second Monday in October Thanksgiving Fourth Thursday in November

4.2 PLACE OF PERFORMANCE

Tasks under this PWS shall be performed at Contractor facilities. The Contractor shall identify the Contractor’s place of performance in their proposal submission.

4.2.1 TRAVEL OR SPECIAL REQUIREMENTS

The Government anticipates travel under this effort to perform the tasks associated with the effort, as well as to attend program-related meetings or conferences throughout the PoP. Contractors may be required to perform additional site-visits (Continental United States only) to government and non-government facilities to conduct user research or stakeholder engagement.

The total estimated number of trips in support of the program, anticipated locations, estimated duration of trips and estimated number of persons is as follows:

Round Trip Location Number of Trips of Persons of Days

Washington, DC 4 4 3

Salt Lake City, UT 2 4 3

Austin, TX 2 4 3

St. Petersburg, FL 2 4 3

Atlanta, GA 1 4 3

Eatontown, NJ 1 4 3

Travel will be considered a separate CLIN and will be reimbursed on a Time and Materials basis. All travel must be in accordance with the Federal Travel Regulations and requires advanced approval by the Contracting Officer’s Representative (COR).

Contractor travel within the local commuting area will not be reimbursed.

5.0 SPECIFIC TASKS AND DELIVERABLES

The Contractor shall perform the following:

5.1 PROJECT MANAGEMENT

5.1.1 CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, timeline and tools to be used in execution of this Task Order (TO) effort. The CPMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks and resource support. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPMP shall be concurred upon and updated in accordance with Section B of the TO. The Contractor shall update and maintain the VA Program Manager (PM) approved CPMP throughout the PoP.

Deliverable:

A. Contractor Project Management Plan

5.1.2 REPORTING REQUIREMENTS

The Contractor shall provide the COR with Monthly Progress Reports in electronic form in Microsoft Word and Project formats. The report shall include detailed instructions/explanations for each required data element, to ensure that data is accurate and consistent. These reports shall reflect data as of the last day of the preceding month.

The Monthly Progress Reports shall cover all work completed during the reporting period and work planned for the subsequent reporting period. The report shall also identify any problems that arose and a description of how the problems were resolved.

If problems have not been completely resolved, the Contractor shall provide an explanation including their plan and timeframe for resolving the issue. The report shall also include an itemized list of all Electronic and Information Technology deliverables and their current Section 508 conformance status. The Contractor shall monitor performance against the Monthly Status Report and report any deviations. It is expected that the Contractor shall keep in communication with VA accordingly so that issues that arise are transparent to both parties to prevent escalation of outstanding issues.

Reports shall include:

a) Project Name

b) Overview and description of the TO

c) Overall high-level assessment of TO progress

d) All work in-progress and completed during the reporting period

e) Identification of any TO related issues uncovered during the reporting period and especially highlight those areas with a high probability of impacting schedule, cost or performance goals and their likely impact on schedule, cost, or performance goals

f) Explanations for any unresolved issues, including possible solutions and any actions required of the Government and/or Contractor to resolve or mitigate any identified issue, including a plan and timeframe for resolution

g) Status on previously identified issues, actions taken to mitigate the situation and/or progress made in rectifying the situation

h) Work planned for the subsequent two reporting periods, when applicable.

i) Provide expenditures based upon your proposed spend plan

j) Workforce staffing data showing all Contractor personnel performing on the effort by task during the current reporting period along with status of their background investigation/VA clearance and biographies. After the initial labor baseline is provided, each Monthly Status Report shall identify any changes in staffing identifying each person who was added to the TO or removed from the TO

k) Original schedule of deliverables at the start of each sprint and the corresponding deliverables made during the current reporting period

l) Cost analysis (Earned Value Management of the contract data, Burn Down Charts, etc.)

m) Commercial Off-The-Shelf (COTS) acquired, number of licenses purchased, number of licenses used, expiration date of those licenses

The Contractor shall communicate with VA so that issues that arise are transparent to both parties to prevent escalation of outstanding issues.

For each T&M task, indicate:

a) Summary of work performed

b) Expenditures for the reporting period, to include prime labor and each subcontractor identified separately

c) Contract Line Item Number expenditure

d) Burn rate

e) Percentage of work completed

A. Monthly Status Report

5.1.3 ONBOARDING

The Contractor shall manage the onboarding of their staff. The Contractor shall coordinate with Program Management Office (PMO) support for assistance with and facilitation of Onboarding resolutions. Onboarding includes steps to obtain VA network access, test account access (9957 submission (or equivalent)) and email account, complete training, initiate background investigations, and gain physical and logical access, which may include elevated privileges to the necessary development and test environments required.

A primary and alternate Contractor Onboarding Point of Contact (POC) shall be designated by the Contractor that tracks the onboarding status of all Contractor personnel and interfaces with PMO Support staff and/or VA. The Contractor Onboarding POC shall be responsible for accurate and timely submission of all required VA onboarding paperwork to the COR. Seven (7) days following project kickoff meeting, the Contractor shall be responsible for presenting the status of all their staff’s onboarding activities to the COR, Program Manager (PM) and/or PMO support delegate.

The Contractor shall perform the following tasks for all team members:

1. The Contractor shall collect/submit signed rules of behavior documents, signed non-disclosure agreements, training certificates, applications for access to VA information systems, PIV card requests and other related information, for all Team members, and maintain these documents securely at contractor’s expense and produce them upon request by VA COR, PM or PMO support delegate.

2. The Contractor shall provide the documents, files and information to VA PM, COR or IT staff for review/approval/signature, when needed/requested to support VA’s onboarding process for granting access to VA systems.

3. The Contractor shall prepare and submit access requests, including Talent

Management System (TMS) applications, PIV card applications, and electronic Contractor Access Request Forms/9957s or equivalent. After receipt of a favorable Special Agreement Check (SAC) determination, and COR approval, request VA user accounts for all team members (for e-mail and remote access).

4. The Contractor shall monitor the submission of the artifacts and follow up with contractors to assure that all artifacts submitted are complete and correct.

The Contractor shall track/report VA system access requests, for assigned Product Team’s, to completion.

5. Specifically, the Contractor shall track and report on the status of Team on-boarding of personnel as follows:

i. Upon COR approval, in collaboration with Project PMO team, contact

VA's Security Investigations Center (SIC) requesting the SAC and Office of Personnel Management (OPM) background investigation status documentation by e-mail and-or by telephone.

ii. Upon COR approval, in collaboration with Project PMO team, request VA access for the subject using the intranet-based Computer Access Request site that resides inside of the VA network. Provide all information to complete the on-line version of a Computer Access Request Form and upload the required certificates as Portable Document Format (PDF) files: Contractor Rules of Behavior, Non- Disclosure Agreement, Training Certificates, and the proof of SAC approval (the SAC approval can be an e-mail from the SIC or a report from the SIC). Notify the COR that the form is ready for approval, signature, and submission.

iii. Coordinate with the TMS so that all Contractor personnel are listed under the proper supervisor [COR] and that contract start-end dates are accurate in TMS.

iv. Provide a Resource Management Report, as a section of the Contractor Staff Roster listed as a deliverable in subparagraph 6.1.10 of this PWS, in the form of a spreadsheet that lists all personnel currently and formerly assigned across all Product Team’s (VA and contractors). The spreadsheet shall contain, at a minimum, name, city nearest to work location, telephone, alternate e-mail, background investigation initiation and completion dates, a log of e-pas requests and role. This spreadsheet shall reside on a VA SharePoint site in a location specified by the COR.

The Contractor shall ensure Monthly Reports and Rosters include details on the onboarding status of all contractor employees supporting this effort.

5.1.4 TECHNICAL KICK-OFF MEETING

The Contractor shall conduct a kick-off meeting with the VA PM, COR, CO, and Contract Specialist. The meeting shall be held within 10 business days after contract award. The kick-off meeting shall be virtual via MS Teams. The Contractor shall propose an agenda for VA COR approval three days prior to the meeting. The Contractor shall provide meeting minutes capturing discussion, agreements, and action items resulting from the kick-off meeting. The kick-off meeting shall address post award topics and shall present the Contractor’s draft plans and approach for meeting PWS requirements.

5.1.5 PRIVACY AND HIPAA TRAINING

The Contractor shall submit status of VA Privacy and Information Security Awareness training for all individuals engaged on the task. The status reporting shall identify; a single Contractor Security Point of Contract, the names of all personnel engaged on the task, their initial training date for VA Privacy and Information Security training, and their next required training date. This information shall be submitted as part of the Monthly Status Report.

The Contractor shall submit for all employees, TMS training certificates of completion for VA Privacy and Information Security Awareness training initially and annually thereafter. The Contractor shall also provide for all employees VA Privacy and Information Security Awareness Signed Rules of Behavior initially and annually thereafter, and VA Health Insurance Portability and Accountability Act (HIPAA) Certificate of Completion initially and annually thereafter in accordance with Section 4, Training, from Appendix C of the VA Handbook 6500.6, “Contract Security”.

Deliverables:

A. TMS Training Certificates of Completion for VA Privacy and Information Security Awareness Training

B. VA Privacy and Information Security Awareness Signed Rules of Behavior C. VA HIPAA Certificate of Completion

5.2 EMERGING TECHNOLOGIES AND INNOVATION SUITE SOLUTION

The Contractor shall manage a suite of emerging technology tools that improve operational efficiency, support data analysis, develop/pilot machine learning tools and other artificial intelligence solutions, and other emergent technologies throughout the PoP. This shall include the procurement of certain tools, management of licensing for any tools procured under this and through other contracts, providing VA with the training, migration, mentoring, configuration, integration, support, and operations/maintenance as needed for the piloting of new tools for use by VA employees to improve services to Veterans, provide greater access to care, or provide better healthcare outcomes. Any products requested or provided beyond those included in the final award shall require approval of the COR and/or Product Owner for MTS.

The Contractor shall also be required to consistently review industry best practices and emerging technologies for additional toolchains that enable continuous integration, delivery, deployment, performance monitoring, incident alerts and reporting, and operations. This will generally include the Contractor researching potential options for an alternative tool either based on a gap they discover as part of their support or at the request of the MTS PM. The Contractor shall detail for Government review how the tool will meet any associated salient characteristics, and may include demonstrations or small pilots of the new technologies for review by appropriate VA stakeholders. Upon VA PM and COR approval, the Contractor shall procure the additional tools, provide all of the support detailed below including supporting the VA ATO process, and integrate the solution into the appropriate VA operations and sustainment organization. This support will need to take into consideration continuous changes, changing technologies, and future toolchain product innovations.

5.3 IT MODERNIZATION TOOL SUITE (MTS)

The Contractor shall provide an IT MTS to support software development and operations teams across VA (both contractor staff as well as internal VA development teams). The IT MTS tools shall support project teams whose systems use different technology stacks spanning a mix of hosting solutions including VA data centers, the VA Enterprise Cloud, or third-party (e.g. SaaS). The IT MTS is made up of products which are listed in the table below, products which have been procured by VA under separate contracts, and the open-source tools listed in the table below. The Contractor is responsible for supporting the process to obtain and maintain an ATO for any tool that does not already have one, managing licenses, migrating data, and configuring each of the tools that make up MTS. Additionally, for SaaS products that require a Federal Risk and Authorization Management Program (FedRAMP) approval (https://www.fedramp.gov/) the Contractor shall support internal VA FedRAMP related processes, to include working directly with Original Equipment Manufacturers (OEM), to successfully achieve FedRAMP approval and shall ensure no tool is utilized by a VA team until FedRAMP has been granted. The Contractor shall coordinate with other contractors and vendors as necessary to support the IT MTS’ successful operation and maturation. In addition, as the number of teams utilizing IT MTS increases, the Contractor shall purchase necessary additional licenses/subscriptions/usage to meet the increasing demand (those tools that are not procured by this Vendor are either Open Source or Enterprise Agreements, and thus will not require additional licenses/subscriptions/usage provided under this contract to support the expansion of IT MTS). This shall include ensuring the VA PM and COR approve of the expansion in advance of any new licenses or subscriptions, or any other increase in usage, is procured.

Additionally, for IT MTS to mature, automation (to support script testing and code validation, performance monitoring, incident alerting and reporting, as well as to perform configuration, repository, and baseline audits) is essential. Thus, support for IT MTS will require organic growth, including identifying additional tools that meet future teams’ business requirements and that provide business value by removing the constraints of currently used tools. Often these constraints include a lack of integration requiring teams to utilize separate stove-piped systems. Accordingly, success is defined as the ability for personnel to perform their functions (e.g. testing, coding, validation, etc.)

within the tools provided without “work-a-round” solutions to fill the gaps with the current tool sets. The migration of data, to include normalization of data types, fields, and attributes between the tools should contribute to the automation process mentioned above.

Accordingly, the Contractor shall consistently review industry best practices and emerging technologies for additional toolchains that enable continuous integration, delivery, deployment, performance monitoring, incident alerts and reporting, and operations. Accordingly, the Contractor shall recommend additional products that will https://www.fedramp.gov/ improve VA’s DevSecOps practices, which VA anticipates on at least a yearly basis throughout the PoP, to ensure the solution reflects modern technologies and industry best practices. The Contractor shall ensure all current or future tools are fully integrated (in accordance with Sections 5.4.18 – 5.4.24 below) and that information flows seamlessly through the DevSecOps life cycle with minimal manual intervention. The Contractor shall support quarterly sessions with VA reps to discuss emerging needs and tools to meet those needs.

The Contractor shall need to work in concert with VA stakeholders to continually align with customers and other stakeholders on what’s being built and the best tools, including Project Portfolio Management tools (ServiceNow, JIRA, etc.) for the job. This support will need to take into consideration continuous changes driven by development discoveries, evolving customer needs, changing technologies, and future toolchain product innovations.

The Contractor shall procure (only specific tools), and provide installation, configuration, and application and technical support of the following VA OIT OCTO Architecture and Engineering Services (AES) approved tools. These are estimates based on current usage, but are subject to change based on the evolving nature of VA’s requirements:

Application Quantity

The following brand name or equal products (meeting the salient characteristics found in Attachment 0002) shall be provided on a T&M basis throughout the Period of Performance

Alteryx OIG Server 1

Cloudera IaaS 1

Jira ScriptRunner 1

MiniOrange 1

License Capture tool (new) 250

TwistLock 400

Cloudera CDP 7

Jira DTE - VA TIL 1,000

TAM & Jira Align 1

AlteryX Bundle 2

SD Elements 25

JRebel 5

Databricks1 1

MongoDB 1

Aqua Security 70

SAS JMP Pro 1

IntelliJ IDEA 50

Stata 2

DigiCert (External URL Certs) 10

Cloudera IaaS 8

Jira ScriptRunner 1

Mural Enterprise 1000

Jira Data Center & Confluence 15,000

Specific applications to be acquired at time of award are listed above, however, new tools may be acquired, as approved by COR/PM, within the 11 phases of the DevSecOps lifecycle as listed below, providing at a minimum the salient characteristics for currently used tool(s) within the same phase as listed in Attachment XX are met by the new tool:

Planning – Activities that aid with time, cost, quality, risk, and issue tracking.

Development – Requirement to source code.

Build – Compiling, modification, and application packaging of services and microservices to include artifacts.

Test – Detection of coding errors, vulnerabilities, integration, functional, system testing / errors, regression, acceptance, performance, and security validation.

Release – Digitally signed and verified to have passed build, testing, security scans and approvals to operate.

Delivery – Artifacts delivered to a support repository, environment provisioned and ready for operations.

Deployment – Confirmed approval of features, devices, systems, applications, delivered to the production environment.

Operation – Scaling, load balancing, performance, availability, and operational risk are addressed.

Monitor – Collecting and assessing of critical information for metrics, audit, reporting, problem identification and trend analysis.

Feedback – After actions, lessons learned, and continuous improvement.

Security – Monitoring, and protection of system or applications.

5.4 MODERNIZATION TOOL SUITE SUPPORT

5.4.1 PRODUCT SUPPORT

The Contractor shall provide IT MTS product support to VA OIT OCTO AES Advanced Tools users on agile project management, Continuous Integration/Continuous Delivery (CI/CD) change management, configuration management, build management and documentation management concepts and functions available in these tools. The Contractor shall provide training to VA OIT OCTO AES Tools’ users on business and functional requirements gathering, business process analysis, functional analysis, and technical analysis requirements concepts and functions available in these tools. The Contractor shall provide product support to VA OIT OCTO AES Advanced Tools users on information modeling concepts and functions available in these tools. The Contractor shall support the Architecture and Engineering Services Tools product line in order to implement an integrated development environment utilizing the IT MTS. The Contractor shall provide training to VA OIT OCTO AES Tools users in building test frameworks, manual and automated test case writing, test script programming, and test management concepts and functions available in these tools. The Contractor shall support the integration of individual test procedures into an integrated desktop testing tool suite. The Contractor shall provide product support to VA OIT OCTO AES Tools users on dashboard and reporting concepts as well as the functions and concepts available in these tools.

5.4.2 ROADMAP AND STRATEGY PLANNING

The Contractor shall aid with the development and maintenance of the overall IT MTS strategy. The Contractor shall aid with the development of roadmap briefings on IT MTS that provide details of the design, implementation, updating, and introduction of any changes per the OEM provider over the proceeding 12 to 18 months. The Contractor shall aid with the research of tools which align to the 11 phases of the DevSecOps lifecycle, as stated above in the “Minimum requirements and salient characteristics for new tools“, which MTS supports.

The Contractor shall aid with the drafting of memorandums and policies for announcement concerning the IT MTS.

The Contractor shall aid with the Unified System Registry (USR) onboarding systems and applications.

5.4.3 PROGRAMMATIC & TOOL METRICS

The Contractor shall aid with the gathering and reporting of required metrics to support the IT MTS. The Contractor shall create a unified dashboard that displays real time metrics to be obtained from all tools within the IT MTS. The Contractor shall aid with the development of metrics covering areas such as costing, licensing, hosting cost, hosting locations, availability, performance, security, storage, access, development specific to individual tools within the IT MTS. The Contractor shall aid with the review of IT MTS metrics quarterly and implement any changes within the following two sprints.

Even in situations where displaying a system’s metric data in the dashboard is not a feasible solution, the Contractor shall ensure any information that would normally be included in that Dashboard be included as an appendix to the Monthly Report.

5.4.4 GOVERNANCE OF MTS

The Contractor shall aid with the development, maintenance, and implementation of a Governance Process for the IT MTS. The Contractor shall work with various VA business units to aid with the Governance Process over IT MTS including, but not limited to the transference of tools to a different VA Business unit, and collaboration with any existing or created governance committee(s). Governance requirements may differ between tools and the Contractor shall ensure they provide a Process that can accommodate those differences.

5.4.5 LICENSE/SUBSCRIPTION/USAGE MANAGEMENT

For licenses/subscription/usage procured under this contract, the Contractor shall provide and protect license server administration, license key configuration, and licensing data in order to manage the provision of Tools’ licenses/subscriptions/usage to end user’s environments and devices. Licenses owned by VA are for concurrent usage and are hosted on a central server and automatically available upon user installation of the tool’s software.

The Contractor shall follow Industry best practices in regard to each identified licensing structure to protect license key information from unauthorized use of others in and outside of VA. The Contractor shall perform license protection to include configuration of license server access rights; protection and preservation of all loadable license key files; proper use of the license information; license auditing; verification and reporting;

coordination with manufacturers on license administration; administrative procedures delegated via manufacturer; customer account management procedures; and protection of that delegated access from other individuals. The Contractor shall perform management of the license server to include installation, scripting, monitoring, and reporting availability and status of licenses.

Management of the license information shall also include proper handling based on industry best practices in regard to the particular software to include all paper and electronic files containing license configuration and entitlement information. The Contractor shall work with VA operations to assist in providing the capability to access the tools through remote access inside the VA network.

The Contractor shall maintain a License/Subscription Inventory that defines and maintains a list of all current software licenses or SaaS subscriptions. All acquired tool licenses, subscriptions, and entitlements shall be received, cataloged, secured, activated, and monitored using compliance and reporting tools resident on the license servers as directed by the VA PM. The Contractor shall perform daily licensing monitoring to ensure that license/subscription contention is actively assessed, and license shortages are predicted and minimized. The Contractor shall provide a Dashboard, accessible via the web, detailing the License Inventory for all tool’s licenses/subscriptions that comprise IT MTS.

The Contractor shall monitor and evaluate problems associated with license/subscription management, tool vendor licensing, end user agreements and restrictions to discover risks and inadequacies, determine the need for expansion, enhancement or revision; and to ensure the reliable provision of licensing services.

All software licenses procured by the Contractor on behalf of VA shall be transferred to the Government at the end of the period of performance.

The Contractor shall account for various licenses procured through various means which makes up the IT MTS to create a unified dashboard for all items included in the Inventory which shall contain items such as, but not limited to:

1. License type

a. Server

b. Client

c. Devices - Load balance, routers, switches, etc.

d. End User

e. Per Seat

f. Enterprise - what all entails the enterprise for accountability

g. Cloud Service Provider

i. Government environment

ii. Government Lab environment

iii. Commercial Environment

iv. Commercial lab environment

h. On-Premise

i. SaaS

2. Procurement tracking

a. License Cost

b. Cost per License

c. Total License count

d. Total License used

e. Total Licenses to be reclaimed

f. Contract Start Date

g. Contract end Date

The Contractor shall obtain approval from the VA PM and COR on any add-ons or activation of modules, features, licenses, consumption, and/or subscriptions not previously approved to be utilized.

The Contractor shall develop and maintain a Management Standard Operating Procedure (SOP) concerning licenses.

The Contractor shall assist in License Management service support to recommend, monitor, analyze, and report on all licensing within the IT MTS to include the contract, terms/conditions, usage, and utilization compliance and cost impact assessments.

The Contractor shall coordinate with other VA contractors to ensure proper recording of license use under other VA licensing contract vehicles and enterprise agreements.

Deliverables:

A. License Inventory Dashboard

5.4.6 QUALITY ASSESSMENT AND MANAGEMENT

The Contractor shall aid with the Quarterly review of user accounts, devices, and accountable items in which any license has been deployed and hosting models in which the licensing are incurring cost.

The Contractor shall aid with the review of data connections to ensure the VA Ecosystems are receiving the proper information from any Tool within the IT MTS.

The Contractor shall aid with the review of data connections to ensure all tools within the IT MTS are properly receiving data from various VA Ecosystem tools or services.

5.4.7 CONTRACT CONSOLIDATION AND REVIEW

The Contractor shall aid with the research and reviewing of existing VA contracts in which a tool may have been procured to aid with the determination of:

1. Should this tool be considered for enterprise deployment

2. How many existing contracts are within the VA concerning the tool or similar tools

3. Impacts of consolidating contracts

4. Benefits of consolidation contracts to include volume level discounting by the

OEM

5.4.8 USER AND TECHNICAL DOCUMENTATION

The Contractor shall provide technical analysis and writing services to provide written Installation Guides or User Procedures for each product in the assigned product line(s).

The Contractor shall reuse, rather than recreate, any OEM training materials.

Whenever practicable, the Contractor shall provide technical tool administration and user procedural documentation, usage policy, configuration illustration which enable the tool implementation team and a customer project team to understand their implementation of the tools, the expectations, and requirements for use of the tools, the best practices and mandatory procedures governing the tools, and the rules of behavior for proper use of access granted to the tools. The Contractor shall assess service request tickets quarterly to determine critical problem areas of tool functionality or procedures that frequently elicit questions or problems and as necessary author procedural help documents to resolve often recurring user difficulties. Historically, the Contractor has provided one (1) Installation Guide for each of the products listed in this PWS, and 40 User Procedures that address specific tool usage topics. The Contractor shall coordinate with the VA PM to identify needs for creation, editing, review, and promulgation of analysis documents and user/training/orientation materials. All new additions of tool versions shall require the Contractor to update documentation for users.

Deliverables:

A. Installation Guides B. User Procedures

C. Tool Administration Procedures D. Procedural Help Documents

5.4.9 TRAINING PROGRAM

The Contractor shall provide virtual training via Microsoft Teams-based to project teams regularly, prior to and after projects on-board into the new tools. The Contractor shall be responsible for developing a Class Training Schedule, Training Announcement, Instructional Material, class facilitation, and for capturing Student Registration and Attendance Data. The Contractor shall coordinate with the VA Information Technology Workforce Development (ITWD) team to place training event information and student attendance data into the VA TMS. The Contractor shall provide a training environment that is free from distractions that would disrupt training events.

Deliverables:

A. Class Training Schedule B. Training Announcement C. Instructional Material D. Student Registration and Attendance Data

5.4.10 INTAKE / ONBOARDING PROCESS

The Contractor shall aid with the development of the onboarding process to ensure understanding of the tool's capabilities, functionality, structure, and accountability are properly identified for accurate billing, dashboarding and reporting's.

5.4.11 CUSTOMER (EXTERNAL) SERVICE LEVEL AGREEMENTS (SLA)

The Contractor shall work with the VA Service Level Management business unit to ensure that every supporting tool and system/application is represented with an official SLAs to be provided to respective business units with the VA in support of the system/application.

Minimum scope of the SLA shall consist of:

1. Service Level Agreement Duration

2. Requested Service Level

3. Service Level Scope

4. Service Description

5. Identified Stakeholders

6. Stakeholders Roles and Responsibilities

5.4.12 HELP DESK SUPPORT

For the purpose of this TO, the following Tiered Support levels shall be implemented.

The support hours shall cover the 12 hours 08:00-20:00 Eastern Time, in support of nationwide coverage during operational hours:

Tier 1 Support Initial Triage of a Help Desk Request

Tier 2 Support Internal Subject Matter Expert Engaged/Professional Services

Tier 3 Support Internal Subject Matter Experts, Business Unit Subject Matter Experts Engaged

Tier 4 Support Product Manufacturer/OEM Support/Engineering Engaged

The Contractor shall provide Tier 1, Tier 2, and Tier 3 tool user customer help desk/support for the IT MTS Tools product lines, with escalation to the respective OEM and/or business unit within VA, while monitoring of the problem, providing status reports, continual escalation to the tool’s manufacturer and VA Manager when necessary.

Tier 1 - Service Desk attempts to collect as much information and diagnostics about the incident as possible, and even resolves the issue on the spot, if possible.

Tier 2 - Staff with greater technical skills than those of Tier 1. They ensure higher level technical skill sets for incident diagnosis and resolution.

Tier 3 - Technical group that possess specific knowledge required, e.g. network support, voice support, database support, hardware maintenance to, if needed interact with OEM, to resolve the issue.

Tier 4 - Product Manufacturer/OEM Vendor in which the tool is represented shall be engaged.

5.4.13 IT MTS (INTERNAL) SERVICE LEVEL AGREEMENTS (SLAs)

The Contractor shall aid with the development of the SLAs to support Professional services and VA Business unit requirements necessary to support the goals and outcomes of each unit utilizing a tool within IT MTS.

5.4.14 ESCALATION TIMES BETWEEN TIERS

All times quotes reflect lapsed time since contact was made with the help desk during support coverage hours stated above.

1 – Critical: Production services, tool down or major malfunction resulting in an inoperative condition. Users unable to reasonably perform their normal functions. The specific functionality is mission critical to the business and the situation is considered an emergency.

2 – Major: Critical loss of service capabilities or performance resulting in high number of users unable to perform their normal functions. Inconvenient workaround or no workaround exists. The environment is usable but severely limited.

3 – Minor: Moderate loss of service capabilities or performance resulting in multiple users impacted in their normal functions. Convenient workaround exists/minor performance degradation/not impacting production.

4 – Notification: Minor loss of Services or assistance with functionality capability, how-to questions. The issue consists of "how to" questions, installation and configuration inquiries, enhancement requests, or documentation questions.

Severity Code 1 - Critical 2 - Major 3 – Minor 4 – Notification Request(s)

TIER 1:

Response to Customer

15 minutes 1 hour 2 hours 4 hours

Time to resolution / Escalation to TIER 2 and VA Manager Notification of issue

30 minutes 2 hours 8 hours 48 hours

TIER 2:

Response to Customer

60 minutes 60 minutes 60 minutes

Escalation to

TIER 3

2 hours 4 hours 16 hours

Time to resolution / Escalation to

TIER 3

8 hours 16 hours 48 hours

Escalation to

TIER 4

2 hours 4 hours 16 hours

Time to resolution / Escalation to

TIER 4

48 hours 48 hours 48 hours

If tier 3 cannot resolve the issue they will escalate to OEM. The Contractor shall provide response to all user-reported questions and requests regarding application software, systems and/or database content and availability. Service requests range from requests to download software media, questions about tool-based procedure, inquiries about planned upgrades to creation of new user accounts, modifying a user’s role, to tool-based workspace implementations and tool to perform data migrations.

Customer questions and problems shall be processed through mandatory VA OIT OCTO AES, specifically ServiceNow (although other solutions may be used in the future) tools and processes to create, update, and complete individual Customer Support Service Requests and Problem Reports. The Contractor shall use the VA OIT OCTO AES tool and repository to create and maintain service tickets and tool, phone calls, and meetings. The Contractor shall record all status and resolution data on problems reported in the VA required service ticketing system (currently Jira & ServiceNow) for constant monitoring of problem resolution status.

The current MTS platform contains approximately 23 products of different levels of usage and approximately 6,000 user accounts diversified among 3-5 high use tools, 4-5 moderately use or specialty tools and 1-2 tools that include all users as a help desk tool for the purpose of submitting service requests.