NCA EISS PWS for RFI.docx

NCA EISS DATA ENGINEERING SUPPORT

VA-26-00068264

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Office of Information & Technology (OIT) Office of Data Governance and Analytics (DGA)

NCA EISS DATA ENGINEERING SUPPORT

Date: June 25, 2026

VA-26-00068264

PWS Version Number: 1.0

Contents

BACKGROUND

The Department of Veterans Affairs (VA) Office of Information and Technology (OIT) is charged with supporting the National Cemetery Administration (NCA) modernization and enterprise data integration activities associated with the Enterprise Interment Services System (EISS) implementation, data reconciliation, governance, and operational process improvement. EISS supports spatially aware cemetery operations and planning activities that require coordination across NCA, OIT, and Department of War (DoW) stakeholders. The work is intended to improve data quality, strengthen cross-system interoperability, enhance operational efficiency, and support accurate, timely, and standardized information management across participating organizations in line with established OIT and VA products, frameworks and best practices.

These activities will support improved decision-making, reduced manual processing and data redundancy, increased traceability of person-level records, and more effective enterprise governance and oversight of NCA business operations and data assets. The effort will also support improved coordination of burial eligibility, operational planning, cemetery management, and related Veteran services through more integrated business processes, data reconciliation, and enterprise governance capabilities both within NCA and across the VA enterprise. The contractor shall leverage existing VA Office of Data Governance and Analytics DGA enterprise data management tools, standards, and governance processes, with all deliverables designed for compatibility with VA’s Palantir Foundry environment.

This PWS is intended to extend and apply existing VA DGA enterprise data management, business architecture, data engineering, and governance capabilities to the NCA EISS modernization effort. This effort shall coordinate with existing DGA enterprise data support activities, including data engineering, authoritative data source alignment, enterprise data standards, business architecture artifacts, Enterprise Information Model artifacts, Common Operating Platform capabilities, Palantir/Foundry data object development, and VA Data Governance Council-aligned governance processes. Deliverables produced under this effort shall be designed to be compatible and interoperable with VA's existing Palantir/Foundry environment where data objects, schemas, pipelines, metadata, lineage, dashboards, or analytic workflows are intended for enterprise reuse or integration.

This PWS is not intended to replace or duplicate existing DGA enterprise data engineering, business architecture, governance, or platform support. Rather, it applies those existing enterprise capabilities to the NCA-specific EISS use case, including cemetery operations, burial eligibility, interment scheduling, person-level record reconciliation, EISS MVP configuration, DoW/ANC coordination, and NCA data migration readiness.

APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. “Federal Information Security Modernization Act of 2014”

2. Federal Information Processing Standards (FIPS) Publication 140-3, “Security Requirements for Cryptographic Modules”, March 22, 2019

3. FIPS Pub 199. “Standards for Security Categorization of Federal Information and Information Systems,” February 2004

4. FIPS Pub 200, “Minimum Security Requirements for Federal Information and Information Systems,” March 2006

5. FIPS Pub 201-3, “Personal Identity Verification of Federal Employees and Contractors,” January 2022

6. 10 U.S.C. § 2224, "Defense Information Assurance Program", as amended

7. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

8. Public Law 109-461 (P.L. 109-461), Veterans Benefits, Health Care, and Information Technology Act of 2006, as amended, Title IX, Information Security Matters

9. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”, as amended

10. VA Directive 0710, “Personnel Vetting Program,” September 8, 2025, https://www.va.gov/vapubs/index.cfm

11. VA Handbook 0710, “Personnel Vetting Program,” September 8, 2025, https://www.va.gov/vapubs/index.cfm

12. VA Directive 6102, “Internet/Intranet Services,” August 5, 2019

13. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and Guidelines,” as amended

14. Office of Management and Budget (OMB) Circular A-130, “Managing Federal Information as a Strategic Resource,” July 28, 2016

15. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed Services (CHAMPUS)”, as amended

16. NIST SP 800-66 Rev. 2, “Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule: A Cybersecurity Resource Guide,” February 2024

17. 45 C.F.R Parts 160 and 164, Subparts A and E, the Standards for Privacy of Individually Identifiable Health Information (“Privacy Rule”); and 45 C.F.R. Parts 160 and 164, Subparts A and C, the Security Standard (“Security Rule”); as amended

18. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended

19. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

20. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021 (see VA NOTICE 24-18, dated September 27, 2024, “Update to VA Directive 6500 Cybersecurity Program”, and VA Notice 25-07, dated 3/18/25, “Amending VA Directive 6500 to incorporate M-24-15”)

21. VA Handbook 6500, “Risk Management Framework for VA Information Systems VA Information Security Program,” February 24, 2021 (see VA Notice 25-01, dated October 15, 2024, “Update to VA Handbook 6500 Risk Management Framework for VA Information Systems VA Information Security Program”, and VA Notice 25-06, dated 3/18/25, “Amending VA Directive 6500 to incorporate M-24-15”, VA Notice 25-16, dated September 15, 2025, “Amending VA Handbook 6500 to Replace Enterprise Mission Assurance Support Services Tool With Office of Information Technology Governance Risk Compliance Tool, and VA Notice 25-17, dated September 22, 2025, “Rescission Of Office Of Information Security (OIS) Deputy Assistant Secretary (DAS) Memorandum – Requirements of Proper Plan of Action and Milestones (POA&M) Completion)

22. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI),” June 30, 2023

23. VA Handbook 6500.6, “Contract Security,” March 12, 2010 (see VA Notice 24-12, dated April 22, 2024, “Update to VA Handbook 6500.6, Contract Security, Appendix C VA Information and Information System Security/Privacy Language For Inclusion Into Contracts, As Appropriate”)

24. VA Handbook 6500.8, “Information System Contingency Planning,” March 25, 2025

25. VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018 (see VA NOTICE 25-10, dated June 9, 2025, “Use of Personally Owned Mobile Devices Policy Amendment of Department of Veterans Affairs Handbook 6500.10”, and VA Notice 25-15, dated August 22, 2025, “Update to VA Handbook 6500.10 Mobile Device Security Policy”)

26. VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017

27. OIT Process Asset Library (PAL), OIT Process Asset Library.

28. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

29. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014

30. VA Directive 6510, “VA Identity, Credential and Access Management,” September 3, 2024

31. VA Handbook 6510, “VA Identity, Credential and Access Management,” September 27, 2024

32. VA Directive and Handbook 6513, “Secure External Connections,” October 12, 2017

33. VA Directive 6300, “Records and Information Management,” September 21, 2018

34. VA Handbook, 6300.1, “Records Management Procedures,“ March 24, 2010

35. NIST SP 800-37 Rev 2, “Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy,” December 2018

36. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020)

37. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015

38. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” March 24, 2014

39. OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005

40. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019

41. OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008

42. Federal Identity, Credential, and Access Management (FICAM) Architecture, June 30, 2023 (FICAM Architecture (idmanagement.gov))

43. NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access,“ June 2018

44. NIST SP 800-63 Rev 4, 800-63A-4, 800-63B-4, 800-63C-4, “Digital Identity Guidelines,” August 1, 2025

45. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014

46. VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

47. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

48. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

49. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

50. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019

51. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008

52. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (P.L. 110–140), December 19, 2007

53. Section 104 of the Energy Policy Act of 2005, (P.L. 109–58), August 8, 2005

54. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 2, 2001

55. Executive Order 14148, “Initial Rescissions of Harmful Executive Orders and Actions,” dated January 20, 2025

56. VA Directive 0057, “VA Environmental Management Program,” October 25, 2022

57. OIS VAIQ #7424808 Memorandum, “Remote Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

58. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

59. “Veteran Focused Integration Process (VIP) Guide 4.0,” March 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

60. VA Memorandum “Proper Use of Email and Other Messaging Services,” January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

61. “Product Line Management Transformation Playbook” version 3.1, August 2023, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

62. NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020

63. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol Version 6 (IPv6),” November 19, 2020

64. Social Security Number (SSN) Fraud Prevention Act of 2017

65. Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23, 2018

66. C.F.R Title 15 Part 7, “Securing the Information and Communications Technology and Services (ICTS) Supply Chain”, as amended

67. Executive Order 14028, “Executive Order on Improving the Nation's Cybersecurity,” May 12, 2021, https://bidenwhitehouse.archives.gov/briefing-room/presidential-actions/2025/01/16/executive-order-on-strengthening-and-promoting-innovation-in-the-nations-cybersecurity/

68. OMB Memorandum M-22-09, “Moving the U.S. Government Toward Zero Trust Cybersecurity Principles”, January 26, 2022, https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf.

69. NIST SP 800-52 Revision 2, “Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations

70. OMB M-26-05, “Adopting a Risk-based Approach to Software and Hardware Security,” January 23, 2026

71. OMB M-21-31, “Improving the Federal Government’s Investigative and Remediation Capabilities Related to Cybersecurity Incidents,” August 27, 2021

72. NIST SP 800-88 Revision 1 “Guidelines for Media Sanitization,” December 2014

73. CISA Binding Operational Directive (BOD) 19-02: “Vulnerability Remediation Requirements of Internet-Accessible Systems,” April 29, 2019, BOD 19-02: Vulnerability Remediation Requirements for Internet-Accessible Systems | CISA

74. CISA BOD 22-01: “Reducing the Significant Risk of Known Exploited Vulnerabilities,” November 3, 2021, BOD 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities | CISA

75. CISA BOD 23-01: Improving Asset Visibility and Vulnerability Detection on Federal Networks.” Cybersecurity & Infrastructure Security Agency (CISA), BOD 23-01: Improving Asset Visibility and Vulnerability Detection on Federal Networks | CISA

76. VA Directive 6550, Pre-Procurement Assessment and Implementation of Medical Devices/Systems, June 03, 2019

77. VA Memorandum, “VA Security Controls,” January 17, 2025, https://www.voa.va.gov/DocumentView.aspx?DocumentID=5010

78. E.O. 13960, “Promoting the Use of Trustworthy Artificial Intelligence in the Federal Government,” December 3, 2020

79. E.O. 14319, “Preventing Woke AI in the Federal Government,” July 23, 2025

80. OMB Memorandum M-25-21, “Accelerating Federal Use of AI through Innovation, Governance, and Public Trust,” April 3, 2025

81. OMB Memorandum M-25-22, “Driving Efficient Acquisition of Artificial Intelligence in Government,” April 3, 2025

82. OMB Memorandum M-26-04, “Increasing Public Trust in Artificial Intelligence (AI) Through Unbiased AI Principles,” December 11, 2025

SCOPE OF WORK

The Contractor shall provide the labor, expertise, and management necessary to execute the tasks described in Section 5.0 over a six (6) month period of performance. The estimated levels of effort provided in Section 5.0 are for planning purposes; the Contractor shall propose a staffing approach, schedule, and work plan that addresses the requirements within the required period of performance. Tasks may be performed concurrently where dependencies allow.

The contract shall provide enterprise data management, business architecture, data engineering, and governance support services for the NCA EISS modernization effort. Services shall include data reconciliation, source system assessment, business process analysis, data model development, Enterprise Information Model alignment, dashboard and reporting requirements, configuration support, and coordination with DoW stakeholders for cemetery operations, burial eligibility, interment scheduling, and person-level record reconciliation.

The Contractor shall use existing VA DGA enterprise capabilities, tools, standards, and artifacts including data engineering practices, business architecture products, governance frameworks, and Palantir/Foundry platform capabilities, to the maximum extent possible. The Contractor shall not duplicate existing DGA data engineering, business architecture, governance, or platform artifacts. Where existing artifacts are insufficient for NCA EISS requirements, the Contractor shall document gaps, propose alternatives, and obtain Government approval prior to developing new solutions. All technical deliverables involving data models, data mappings, schemas, reconciliation logic, workflow requirements, dashboard requirements, configuration artifacts, or integration recommendations shall identify whether the deliverable is compatible with VA's existing Palantir/Foundry environment and shall document any gaps, assumptions, dependencies, or Government decisions required to achieve compatibility. Compatibility shall include, as applicable, alignment with existing Foundry data object patterns, ontology/entity definitions, source-to-target mappings, pipeline conventions, metadata, lineage, access controls, and exportable/open data formats.

PERFORMANCE DETAILS

PERFORMANCE PERIOD

The PoP shall be six (6) months from date of award.

Any work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contract Officer (CO).

There are 11 Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, five are set by date:

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

PLACE OF PERFORMANCE

Tasks under this PWS shall be performed at Contractor facilities. The Contractor shall identify the Contractor’s place of performance in their proposal submission.

There may be an occasional meeting at a Government facility. Any meetings at Government facilities will be in the Washington, DC area. The most frequent location would be 811 Vermont Ave NW. Access to a Government facility shall be limited to the minimum necessary for contract performance and is contingent upon completion of required onboarding, background investigation, training, Rules of Behavior, and security requirements identified in Section 6.2.2.

TRAVEL

The Government does not anticipate routine travel under this effort. Limited travel may be required only when approved in advance in writing by the COR. Local travel within a 50-mile radius from the Contractor’s facility is considered the cost of doing business and will not be reimbursed. Travel beyond a 50-mile radius must be pre-approved by the COR and performed in accordance with the Federal Travel Regulation. General and Administrative expenses will not be reimbursed.

SPECIFIC TASKS AND DELIVERABLES

The Contractor shall perform the following:

Tasks 5.2, 5.3, and 5.4 shall be executed in parallel where dependencies allow and iteratively refined as information becomes available. Task 5.5 shall use approved outputs from Tasks 5.2 through 5.4, and Task 5.6 shall operate throughout the period of performance to manage decisions, risks, dependencies, and artifact reuse.

PROGRAM IMPLEMENTATION AND SUPPORT (Estimated Level of effort (LOE): 1 Full time employee (FTE))

The Contractor shall provide project management support for EISS implementation and related modernization activities, including project planning, schedule management, stakeholder coordination, risk management, status reporting, and program oversight activities.

Within ten (10) calendar days of award, the Contractor shall develop and maintain a Project Management Plan (PMP) defining the approach, schedule, milestones, dependencies, staffing, communication methods, and risk management processes required to support execution of all tasks under this effort. The Contractor shall update the PMP monthly thereafter. The PMP shall identify predecessor/successor task dependencies and the Contractor shall notify the COR of any schedule constraint that could affect completion within the six-month period of performance."

The Contractor shall provide monthly status reports summarizing project activities, progress, risks, issues, dependencies, and planned activities to support coordination across NCA, OIT, DoW, and other stakeholders.

The Contractor shall track Palantir/Foundry compatibility dependencies as part of program execution when EISS deliverables are expected to connect to, reuse, or be consumed by VA enterprise data platform capabilities. Status reports shall identify compatibility decisions, blockers, risks, required Government inputs, and coordination actions with DGA platform and data owners.

The Contractor shall coordinate with existing DGA enterprise data support contractors and Government leads to identify applicable existing artifacts, data models, business architecture objects, data quality logs, governance standards, platform capabilities, and reusable technical patterns that may be reused or extended for the NCA EISS effort. The Contractor shall document reuse decisions, dependencies, risks, and required Government decisions in the PMP and monthly status reports.

Deliverables:

A. Project Management Plan (PMP) – due within ten (10) calendar days after award and updated monthly thereafter.

B. Monthly Status Report – due monthly by the fifth (5th) business day after the reporting month, unless otherwise directed by the COR C. Existing Artifact and Reuse Assessment – initial version due within fifteen (15) calendar days after award; updates due monthly or as directed by the COR COMPLETION OF AS-IS PROCESS MAPS AND GAP ANALYSIS (Estimated LOE: 4 FTE) The Contractor shall support the Government in documenting, analyzing, and validating current-state (“as-is”) business processes, workflows, data flows, and operational dependencies associated with NCA operations and EISS activities, including burial eligibility, interagency coordination, cemetery planning, and person-level records management workflows. Support shall be performed through Government-facilitated stakeholder interviews, working sessions, document reviews, process walkthroughs, and review of Government-provided or Government-authorized artifacts to identify process inefficiencies, manual workarounds, duplicative activities, and data management gaps.

The Contractor shall obtain and review Government-provided or Government-authorized EISS system documentation, configuration specifications, technical architecture artifacts, and related materials associated with the Department of War (DoW) / Arlington National Cemetery (ANC) deployment of EISS. The Government will facilitate access to DoW, ANC, EISS vendor, or other third-party materials when such access is required. The Contractor shall document how EISS modules are currently configured for ANC workflows, including eligibility determination, interment scheduling, records management, headstone and marker ordering, and reporting. In parallel, the Contractor shall develop a structured NCA operational requirements baseline through interviews with NCA headquarters and field operations staff, cross-referenced against existing Memorials Data Management System (MDMS) and Burial Operations Support System-Enterprise (BOSS-E) capabilities. This baseline shall serve as the comparative foundation for all gap analysis and configuration planning activities under this effort.

The Contractor shall develop business process maps depicting workflows, system interactions, decision points, handoffs, and data exchanges across participating organizations. The Contractor shall conduct a gap analysis comparing current-state processes to future-state operational objectives, enterprise data governance standards, and EISS functional requirements.

The Contractor shall collect, inventory, and conduct a structured functional assessment of Government-provided or Government-authorized EISS demonstration recordings, training guides, user manuals, walkthrough materials, configuration references, and other functional documentation provided by DoW, ANC, VA, or the EISS vendor. The Contractor shall document these findings in the EISS Functional Assessment Findings deliverable. The assessment shall map observed system behaviors, user interface/user experience (UI/UX) characteristics, and functional scope against NCA business functions and shall produce a consolidated list of open questions and functional concerns for vendor or Government follow-up.

The Contractor shall conduct a side-by-side comparison of ANC and NCA operational processes across all major business domains including eligibility intake, interment scheduling, burial execution, headstone and marker orders, records archival, and customer communications. Divergences shall be classified by severity. The Contractor shall additionally identify and document statutory and policy differences governing NCA versus DoW/ANC operations that affect EISS system configuration requirements. For each NCA operational requirement not supported by the current ANC configuration of EISS, the Contractor shall document: the specific gap, associated business impact, severity rating, and preliminary resolution path (configure, customize, or workaround). The Contractor shall translate identified gaps into a prioritized configuration change request list.

The Contractor shall identify opportunities for process optimization, standardization, automation, and improved data quality management in accordance to enterprise data management principles. The Contractor shall document findings, risks, constraints, dependencies, and recommended remediation actions to support modernization planning and future-state operational design. Process maps, system/data flow diagrams, and gap analysis findings shall identify data flows, system interactions, and process outputs that must be compatible with VA's Palantir/Foundry environment for enterprise integration, reuse, analytics, dashboarding, reporting, or operational workflow support. Where compatibility is not required, the Contractor shall document the rationale.

The Contractor shall identify and document existing DGA process maps, data flow diagrams, data quality findings, architecture artifacts, governance materials, and platform-specific assets that can be reused or extended for NCA EISS process mapping and gap analysis. Where new process maps or gap findings overlap with existing DGA materials, the Contractor shall document the reason new or modified artifacts are required.

Deliverables:

A. Current-state process maps, workflow documentation, and system/data flow diagrams – initial draft due within forty-five (45) calendar days after award; final due within ninety (90) calendar days after award B. Gap analysis report with findings, risks, constraints, and dependencies – initial draft due within sixty (60) calendar days after award; final due within ninety (90) calendar days after award C. Configuration Change Request List – initial version due within sixty (60) calendar days after award; updates due as new gaps are validated D. Recommendations for process improvement, future-state alignment, and stakeholder briefing materials – due within ninety (90) calendar days after award and updated as directed by the COR E. EISS Functional Assessment Findings Due within 60 Days after award.

BUSINESS ARCHITECTURE AND SYSTEMS INTEGRATION SUPPORT (Estimated LOE: 2 FTE) The Contractor shall provide business architecture and systems integration support to align NCA operational requirements, business capabilities, and enterprise data needs with EISS implementation activities.

Support shall include analysis of business functions, identification of integration points, and development of business and technical architecture artifacts to support interoperability across intake, case management, burial eligibility, and cemetery operations workflows, including coordination and synchronization of operational, geospatial, and person-level data across NCA, OIT, and DoW systems in alignment with existing enterprise data assets and principles.

The Contractor shall evaluate existing systems, interfaces, and data exchanges to identify integration dependencies, operational impacts, and opportunities to improve interoperability. The Contractor shall support development of conceptual and logical architectures that align business processes, data standards, and technology capabilities with enterprise objectives. Upon completion of as-is process mapping, gap analysis, business architecture documentation, and data reconciliation requirements validation, the Contractor shall produce a Unified Process Architecture document integrating all findings into a single authoritative reference for EISS NCA implementation. The document shall include: end-to-end future-state process maps, a logical and physical system architecture diagram, a RACI matrix aligned to EISS process domains, and a consolidated feature gap and data standards register. This document shall serve as the baseline for all subsequent EISS configuration, data migration, and implementation planning decisions.

The Contractor shall support coordination between NCA, OIT, and other stakeholders to document and address integration requirements, technical dependencies, and operational impacts. The Contractor shall also support implementation planning, governance coordination, and integration risk mitigation activities.

The Contractor shall align NCA EISS business architecture artifacts with existing DGA Enterprise Information Model artifacts, Business Architecture objects, Business Reference Model constructs, Common Operating Platform architecture patterns, and Palantir/Foundry data object patterns. The Unified Process Architecture Document shall identify all existing DGA artifacts, data objects, data standards, architecture products, governance materials, and platform capabilities incorporated into the NCA EISS baseline and shall explain any deviations from existing VA enterprise data architecture or governance standards. The document shall also include a Palantir/Foundry compatibility section that identifies required integrations, reusable data objects, ontology/entity alignment considerations, pipeline dependencies, access-control assumptions, and any configuration or data-model changes needed for the EISS effort to interoperate with VA's enterprise Palantir/Foundry environment.

Deliverables:

A. Business architecture documentation, including conceptual and logical architecture diagrams – initial draft due within ninety (90) calendar days after award; final due within one hundred twenty (120) calendar days after award B. System integration analysis, dependency assessments, and interoperability recommendations – initial draft due within ninety (90) calendar days after award; final due within one hundred twenty (120) calendar days after award C. Unified Process Architecture Document – (including enterprise artifact alignment and Palantir Foundry integration requirements) initial draft due within one hundred twenty (120) calendar days after award; final due within one hundred fifty (150) calendar days after award VALIDATION OF DATA RECONCILIATION REQUIREMENTS (Estimated LOE: 3 FTE) The Contractor shall support the Government in identifying, validating, and documenting data reconciliation requirements to improve person-level data consistency, accuracy, and traceability across NCA systems and processes, including reconciliation of burial eligibility, pre-needs records, service history, and related person-level records. The contractor shall align NCA data reconciliation efforts with enterprise data reconciliation best practices, including ensuring interoperability with established enterprise data assets. Support shall include assessment of current reconciliation practices, identification of data quality issues, and validation of business rules supporting authoritative records management.

The Contractor shall identify and inventory existing VA, NCA, and DoW data standards relevant to EISS, including VA Data Governance policies, NCA data dictionaries, applicable HIPAA and PII definitions, and OIT enterprise data standards. The inventory shall be delivered as a structured standards register/matrix and supporting narrative document identifying the standard, source, owner, applicability, conflicts, and recommended disposition. The Contractor shall use Government-provided or Government-authorized access to documentation, data extracts, repositories, and stakeholder working sessions. The Contractor shall determine which standards are authoritative, identify conflicts, and produce a draft EISS data governance framework document defining data ownership assignments, stewardship roles, and a change control process for data standards.

The Contractor shall analyze data discrepancies, duplicate records, incomplete data elements, and cross-system inconsistencies to assess impacts on operational workflows, reporting, and decision-making. The Contractor shall work with Government stakeholders to define reconciliation logic, validation criteria, exception handling procedures, and data stewardship responsibilities.

The Contractor shall compare how key data entities (e.g., Veteran, Next of Kin, Interment, Plot/Section/Grave, Eligibility Status, Headstone/Marker, and Reservation) are defined across VA and NCA systems and the EISS ANC configuration. The Contractor shall document definitional conflicts, overlapping fields, and missing attributes, and shall propose a canonical (unified) definition for each critical entity to serve as the standard for EISS data migration and configuration.

The Contractor shall document reconciliation requirements, recommended controls, and process improvements needed to support enterprise data quality objectives and reduce operational inefficiencies associated with inaccurate or inconsistent data, including duplicate submissions, process delays, and pre-need review activities. Data quality issue aggregation shall draw from all available sources including MDMS and BOSS-E system documentation or data exports, NCA field operations reports, prior OIT assessments, and any available audit findings.

The Contractor shall assess whether existing DGA Person, Veteran, Employee, and related business data objects, authoritative data standards, data quality rules, and data reconciliation patterns can be reused or extended to support NCA EISS person-level reconciliation, burial eligibility, pre-need records, service history, Next of Kin, Interment, Eligibility Status, Headstone/Marker, Reservation, and cemetery operations data entities. The assessment shall include compatibility with VA's Palantir/Foundry data object patterns and shall document how proposed canonical definitions, business rules, validation logic, and remediation recommendations would be implemented, consumed, or integrated in the Palantir/Foundry environment if selected by the Government.

Deliverables:

A. Data reconciliation requirements, business rules, and validation logic documentation – initial draft due within ninety (90) calendar days after award; final due within one hundred twenty (120) calendar days after award B. Authoritative Data Standards Inventory – initial register due within sixty (60) calendar days after award; final due within one hundred twenty (120) calendar days after award C. Data quality assessments, discrepancy analysis, and remediation recommendations – initial draft due within ninety (90) calendar days after award; final due within one hundred twenty (120) calendar days after award D. Draft Canonical Data Model Document – due within one hundred twenty (120) calendar days after award DEVELOPMENT OF AN MVP-ALIGNED DATA CONFIGURATION OF EISS FOR NCA (Estimated LOE: 2 FTE) The Contractor shall support the development and configuration of a Minimum Viable Product (MVP)-aligned data configuration for EISS in support of NCA operational requirements, including support for geospatially enabled cemetery operations, planning, and records management activities. Support shall include configuration planning, data mapping, data model alignment, and stakeholder coordination to ensure MVP functionality aligns with prioritized business capabilities and operational objectives.

All MVP configuration requirements, data mappings, business rules, validation logic, test artifacts, and implementation support documentation shall be structured to support compatibility with VA's existing Palantir/Foundry environment where EISS data will be reused for enterprise analytics, dashboards, workflow support, operational reporting, or data governance. The Contractor shall document this compatibility, including data object alignment, source-to-target mapping, pipeline/interface dependencies, and access-control gaps requiring Government decision, in a Palantir/Foundry Compatibility Assessment. The Contractor shall not assume Palantir/Foundry is the system of record for EISS unless directed by the Government; however, deliverables shall be interoperable with the Palantir/Foundry environment to support future integration and reuse.

The Contractor shall assist in defining required data elements, source-to-target mappings, entity relationships, business rules, workflow steps, validation rules, user roles, reporting requirements, integration dependencies, data quality checks, exception handling procedures, and configuration requirements necessary to support MVP deployment. The Contractor shall support source data validation, alignment with enterprise standards, and preparation of documentation required for testing, implementation, and operational transition.

The Contractor shall document current data entry, validation, correction, and maintenance processes, identifying manual processes, absent validation rules, and lack of automated quality controls. The Contractor shall evaluate EISS out-of-box data validation, deduplication, and curation automation capabilities against NCA requirements and shall produce an overall assessment of NCA's data readiness for migration to EISS, including a pre-migration data remediation roadmap with prioritized remediation actions and estimated effort.

The Contractor shall support iterative refinement activities based on stakeholder feedback, testing outcomes, and evolving operational requirements, including data configuration workshops, user demonstrations, issue tracking, and coordination of configuration dependencies across participating teams.

The Contractor shall ensure the MVP-aligned EISS data configuration is traceable to existing VA enterprise data standards, authoritative data sources, reusable DGA data objects, approved architecture patterns, and Government-approved reuse decisions. Where existing artifacts are insufficient, the Contractor shall document the gap, proposed configuration approach, business impact, and required Government decision.

Deliverables:

A. MVP configuration requirements, data mapping, and configuration artifacts including Palantir/Foundry Compatibility Assessment – initial draft due within one hundred twenty (120) calendar days after award; final due within one hundred fifty (150) calendar days after award.

B. Data Migration Readiness Report with Remediation Roadmap – due within one hundred fifty (150) calendar days after award C. Configuration traceability matrix to existing DGA artifacts, data standards, and reuse decisions – due with the final MVP configuration package ESTABLISHMENT OF JOINT NCA – OIT GOVERNANCE STRUCTURE (Estimated LOE: 1.5 FTE) The Contractor shall support the establishment and operationalization of a joint NCA–OIT governance structure to manage program scope, risks, priorities, dependencies, and cross-organizational decision-making associated with EISS implementation and related modernization efforts, including coordination of operational, technical, and data governance activities across NCA, OIT, and external stakeholders. and aligning governance activities under pre-established VA Data Governance Council where appropriate. The Government retains all decision-making authority. NCA shall serve as the business owner for NCA operational decisions, OIT shall serve as the technical owner for VA IT and architecture decisions, and the COR or designated Government lead shall resolve or escalate cross-organizational decisions in accordance with the approved governance charter.

The Contractor shall facilitate governance planning, stakeholder coordination, meeting management, and development of governance documentation to support effective program oversight and decision-making. The Contractor shall assist in defining governance roles, responsibilities, escalation procedures, decision authorities, communication protocols, and performance management approaches.

The Contractor shall support development of governance forums, working groups, integrated project tracking mechanisms, risk management processes, and issue resolution procedures. The Contractor shall also support preparation of executive status briefings, governance dashboards, decision logs, and action tracking artifacts. The Contractor shall maintain a Governance Risk and Decision Escalation Log capturing cross-organizational risks and issues requiring joint NCA-OIT decision-making, distinct from program-level risks tracked in the PMP, including escalation status, decision owner, and resolution timeline. The Contractor shall establish and maintain a mechanism to track cross-contract dependencies, decision authority assignments, and artifact reuse decisions affecting NCA EISS governance, including dependencies on other DGA-aligned contracts, platform support activities, and Government data owners. This tracking shall support the joint governance body's ability to identify blockers, escalate cross-organizational issues, and confirm reuse decisions are documented and current.

The Contractor shall align the joint NCA-OIT governance structure with existing DGA governance processes, VA Data Governance Council decision pathways, enterprise data stewardship roles, and established Government oversight mechanisms. Governance materials shall identify dependencies on existing DGA support contracts, platform support activities, data owners, and Government decision authorities.

Deliverables:

A. Governance framework, charter documentation, and roles/responsibilities matrix. Initial draft due within thirty (30) calendar days after award; final due within sixty (60) calendar days after award B. Governance Risk and Decision Escalation Log: initial version due within thirty (30) calendar days after award and updated at least monthly C. Governance meeting materials, due as required for governance meetings and executive reviews D. Cross-contract dependency, decision authority, and artifact reuse tracker. Initial version due within thirty (30) calendar days after award and updated monthly

GENERAL REQUIREMENTS

ENTERPRISE AND IT FRAMEWORK

VA TECHNICAL REFERENCE MODEL

The Contractor shall comply with the VA OIT Technical Reference Model (VA TRM). Compliance with the VA TRM is achieved by using only technologies and standards that are listed as approved for use in the VA TRM. The Contractor shall provide all necessary information requested by VA to ensure TRM approval is obtained prior to use on VA’s network.

ZERO TRUST – VA CRITICAL SECURITY CONTROLS

VA has established minimum mandatory security requirements and requires that any network connected software system or service must meet the VA Critical Security Controls as outlined in the VA Memorandum, “VA Security Controls”, https://www.voa.va.gov/DocumentView.aspx?DocumentID=5010. VA Critical Security Controls identify the minimum mandatory requirements that must be implemented across all VA enterprise infrastructure, cloud computing environments, information systems, networks, and specialized devices (medical devices/systems, special-purpose systems, and research scientific computing devices) that process, store, and/or transmit VA data. Effective July 1, 2025, the Contractor shall implement these VA Critical Security Controls, within any network connected software system or service prior to being authorized for use in the VA. This functional requirement is not negotiable, and Plan of Action & Milestones (POAM) will not be accepted in the event these controls cannot be implemented for new systems. Critical Security Controls are intended to increase VA’s security posture and provide security and privacy risk visibility into the VA network and is not a new requirement. The Contractor’s failure to maintain these VA Critical Controls after implementation will result in VA discontinuing the use of the system.

FEDERAL IDENTITY, CREDENTIAL, AND ACCESS MANAGEMENT (FICAM)

The Contractor shall ensure Commercial Off-The-Shelf (COTS) product(s), software configuration and customization, and/or new software are Personal Identity Verification (PIV) card-enabled by accepting HSPD-12 PIV credentials using VA Enterprise Architecture (EA), and VA Identity and Access Management (IAM) approved Enterprise Technology Guidelines (ETG). The Contractor shall ensure all Contractor delivered applications and systems comply with the VA Identity, Credential, and Access Management policies and guidelines set forth in Executive Order 14028, VA Handbook 6510 VA Identity and Access Management, VA Handbook 0735 Homeland Security Presidential Directive 12 (HSPD-12) Program, CISA Binding Operational Directive 23-01, and align with the Federal Identity, Credential, and Access Management Roadmap and Implementation Guidance v2.0.

The Contractor shall ensure all Contractor delivered applications and systems provide user authentication services compliant with the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-63-4, VA Handbook 6500, and VA IAM enterprise requirements for direct, assertion based authentication, and/or trust based authentication, as determined by the ETGs. Direct authentication at a minimum must include Public Key Infrastructure (PKI) based authentication supportive of PIV card and/or Common Access Card (CAC), as determined by the business need.

The Contractor shall ensure all Contractor delivered applications and systems conform to the specific Identity and Access Management PIV requirements set forth in the Office of Management and Budget (OMB) Memoranda M-05-24, M-19-17, M-22-09, and NIST Federal Information Processing Standard (FIPS) 201-3. Contractor delivered applications and systems shall be on the FIPS 201 Approved Product List (APL). If the Contractor delivered application and system is not on the APL, the Contractor shall be responsible for taking the application and system through the FIPS 201 Evaluation Program.

The Contractor shall ensure all Contractor delivered applications and systems support:

1. Automated provisioning and are able to use enterprise provisioning service.

2. Interfacing with VA’s Master Person Index (MPI) to provision identity attributes, if the solution relies on VA user identities. MPI is the authoritative source for VA user identity data.

3. The VA defined unique identity (Secure Identifier [SEC ID] / Integrated Control Number [ICN]).

4. Multiple authenticators for a given identity and authenticators at every Authenticator Assurance Level (AAL) appropriate for the solution.

5. Identity proofing for each Identity Assurance Level (IAL) appropriate for the solution.

6. Federation for each Federation Assurance Level (FAL) appropriate for the solution, if applicable.

7. Two-factor authentication (2FA) through an applicable Technology Guideline as outlined in VA ETG.

8. A Security Assertion Markup Language (SAML) implementation if the solution relies on assertion-based authentication. Additional assertion implementations, besides the required SAML assertion, may be provided as long as they are compliant with NIST SP 800-63-4 guidelines.

9. Authentication/account binding based on trusted Hypertext Transfer Protocol (HTTP) headers if the solution relies on Trust based authentication.

10. Role Based Access Control.

11. Auditing and reporting capabilities.

12. Compliance with VIEWS 00155984, PIV Logical Access Policy Clarification https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896.

The required Assurance Levels for this specific effort are Identity Assurance Level 3, Authenticator Assurance Level 3, and Federation Assurance Level 3.

INTERNET…