OIT VCS IT Support Contract v1 PWS draft.docx

Veterans Canteen Service (VCS) IT Support Services

<VA-XX-XXXXXXXX>

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Office of Information & Technology Product Delivery Service (PDS) Corporate Portfolio Service Acquisition and Property Management Product Line (APM PL)

Veterans Canteen Service (VCS) IT Support Services

Date: September 16, 2026

<VA-XX-XXXXXXXX>

PWS Version Number: 0.1

Contents

BACKGROUND

The Mission of the Department of Veterans Affairs (VA), Office of Information and Technology (OIT), Product Delivery Service (PDS), is to enable exceptional experiences for Veterans and those who serve them, through the delivery of transformative, resilient, and trustworthy IT products. Within OIT PDS, the Corporate Portfolio Acquisition and Property Management (APM) Product Line delivers world class, Veteran-centric capabilities that provide secure, seamless delivery of acquisition support systems, construction management systems and Veterans Canteen Service (VCS) IT systems to VA so that the business offices that these IT systems support can execute on their missions and ultimately deliver services to VA employees, Veterans and their families.

The Veterans Canteen Service (VCS) was statutorily established on August 7, 1946, under 38 U.S.C. Ch. 78 to provide America’s Veterans enrolled in VA’s healthcare system, their families, survivors, caregivers, and VA employees with reasonably priced merchandise and services essential to their comfort, health, and wellbeing. VCS operates over two hundred retail stores, cafés and coffee shops across the country.

VCS relies on a wide array of IT components including the VCS Automated Information System (VCS-AIS), which is a system of systems, the VCS Point of Sale (VCS-POS) system, and the VCS Mobile Device Management (VCS-MDM) system, which includes handheld scanners, portable printers and the applications to manage them. In addition to these three primary systems, that are also other smaller, but no less important VA IT systems and applications (e.g. VendMax, SharePoint, etc.) that complete the VCS IT landscape. These systems facilitate efficient inventory management, enabling timely stock replenishment and ensuring product availability. Point-of-sale systems enhance transaction speed and accuracy while integrating with the financial management system to maintain accountability and transparency. Together, these IT components enable daily canteen operations at more than 200 VA locations.

The APM Product Line (PL) manages many of VCS’s essential IT systems. These systems are in a constant state of change. While some system components are in deep sustainment, others are undergoing major enhancement and modernization efforts. Systems supporting VCS may be added or removed throughout the life of the contract.

Below is a summary of the current major VCS IT system components:

Veterans Canteen Service – Automated Information System (VCS AIS) AIS is a system of systems. The primary AIS systems managed for VCS are Financial, Retail, Employee Payroll Deduction (EPD), and NETePAY - a system that performs EPD Card functionality for the Point of Sale.

Veterans Canteen Service – Point of Sale (VCS POS) The VCS Point of Sale (VCS POS) system functions as a non-customer facing, point-of-service (payment) application. VCS employees process sales and/or retail transactions with POS commercial-off-the-shelf (COTS) software applications that reside on the cash register. Its connection to the canteen registers and kiosks for sales allows VCS to analyze sales data for trends.

Veterans Canteen Service – Mobile Device Management (VCS MDM) This product manages the hundreds of handheld scanners and portable printers used by Canteen stores nationwide. The MDM system is hosted in the VA Enterprise Cloud (VAEC) and contain multiple COTS applications: Ivanti Avalanche is a COTS mobile device management (MDM) application used to maintain the mobile operating system/applications, and product inventory/price files on the handheld inventory scanners. Zebra Printer Profile Manager Enterprise (PPME) is a COTS device management application used to maintain the portable printer configuration and print templates. The handheld inventory scanners run several mobile business applications including an Inventory Management (SIM) app which connects to the VCS Oracle Retail, Accounting, and Procurement (RAP) system (part of VCS AIS) and is hosted at the Austin Information Technology Data Center (AITC).

Veterans Canteen Service – SharePoint (VCS SP) VCS has a SharePoint system used extensively for its knowledge base, collaboration tools, and other purposes. This system is vital as VCS runs the majority of its processes and applications on it. VCS will be migrating to SharePoint Online in the near future.

APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. 44 U.S.C. § 3541-3549, “Federal Information Security Management Act (FISMA) of 2002”

2. “Federal Information Security Modernization Act of 2014”

3. Federal Information Processing Standards (FIPS) Publication 140-2, “Security Requirements for Cryptographic Modules”

4. FIPS Pub 199. “Standards for Security Categorization of Federal Information and Information Systems,” February 2004

5. FIPS Pub 200, “Minimum Security Requirements for Federal Information and Information Systems,” March 2006

6. FIPS Pub 201-2, “Personal Identity Verification of Federal Employees and Contractors,” August 2013

7. 10 U.S.C. § 2224, "Defense Information Assurance Program"

8. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

9. Public Law 109-461, Veterans Benefits, Health Care, and Information Technology Act of 2006, Title IX, Information Security Matters

10. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”

11. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, https://www.va.gov/vapubs/index.cfm

12. VA Handbook 0710, “Personnel Security and Suitability Program,” May 2, 2016, https://www.va.gov/vapubs/index.cfm

13. VA Directive and Handbook 6102, “Internet/Intranet Services,” August 5, 2019

14. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and Guidelines,” January 18, 2017

15. Office of Management and Budget (OMB) Circular A-130, “Managing Federal Information as a Strategic Resource,” July 28, 2016

16. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed Services (CHAMPUS)”

17. NIST SP 800-66 Rev. 1, “An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule,” October 2008

18. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended, January 18, 2017

19. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

20. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021

21. VA Handbook 6500, “Risk Management Framework for VA Information Systems VA Information Security Program,” February 24, 2021

22. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI),” March 12, 2019

23. VA Handbook 6500.5, “Incorporating Security and Privacy into the System Development Lifecycle,” March 22, 2010

24. VA Handbook 6500.6, “Contract Security,” March 12, 2010

25. VA Handbook 6500.8, “Information System Contingency Planning,” April 6, 2011

26. VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018

27. VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017

28. OIT Process Asset Library (PAL), https://www.va.gov/process/ . Reference Process Maps at https://www.va.gov/process/maps.asp and Artifact templates at https://www.va.gov/process/artifacts.asp

29. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

30. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014

31. VA Handbook 6508.1, “Procedures for Privacy Threshold Analysis and Privacy Impact Assessment,” July 30, 2015

32. VA Handbook 6510, “VA Identity and Access Management,” January 15, 2016

33. VA Directive and Handbook 6513, “Secure External Connections,” October 12, 2017

34. VA Directive 6300, “Records and Information Management,” September 21, 2018

35. VA Handbook, 6300.1, “Records Management Procedures,“ March 24, 2010

36. NIST SP 800-37 Rev 2, “Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy,” December 2018

37. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020)

38. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015

39. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” March 24, 2014

40. OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005

41. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019

42. OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008

43. Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance, December 2, 2011, (NOTE: Part A of the FICAM Roadmap and Implementation Guidance, v2.0, was replaced in 2015 with an updated Architecture (https://arch.idmanagement.gov/#what-is-the-ficam-architecture)

44. NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access,“ June 2018

45. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, “Digital Identity Guidelines,” updated March 02, 2020

46. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014

47. NIST SP 800-164, “Guidelines on Hardware-Rooted Security in Mobile Devices (Draft),” October 2012

48. Draft National Institute of Standards and Technology Interagency Report (NISTIR) 7981, “Mobile, PIV, and Authentication,” March 2014

49. VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

50. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

51. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

52. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

53. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019

54. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008

55. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (Public Law 110–140), December 19, 2007

56. Section 104 of the Energy Policy Act of 2005, (Public Law 109–58), August 8, 2005

57. Executive Order 13834, “Efficient Federal Operations,” dated May 17, 2018

58. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 2, 2001

59. VA Directive 0058, “VA Green Purchasing Program,” July 19, 2013

60. VA Handbook 0058, “VA Green Purchasing Program,” July 19, 2013

61. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

62. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

63. “Veteran Focused Integration Process (VIP) Guide 4.0,” January 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

64. VA Memorandum “Proper Use of Email and Other Messaging Services,” January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

65. “DevSecOps Product Line Management Playbook” version 2.0, May 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

66. NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020

67. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol Version 6 (IPv6),” November 19, 2020

68. Social Security Number (SSN) Fraud Prevention Act of 2017

69. Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23, 2018

SCOPE OF WORK

The Contractor shall furnish qualified personnel with demonstrable expertise in project management, software sustainment, system development, and cybersecurity. All personnel shall perform assigned duties in strict adherence to all applicable Department of Veterans Affairs (VA) system compliance requirements and shall employ industry recognized best practices to ensure the effective, secure, and reliable support of VA information technology. The Contractor shall provide these services in support of sustainment activities, enhancements to existing systems, modernization of existing systems, and the sustainment and development of new systems or new functionality as required by the Government.

Most VCS IT system components are considered critical. Critical components are defined as components with a significant impact on the office or unit and can cause a complete work stoppage when issues occur, requiring immediate service to resolve the problem. Non-critical components are defined as components that have low/no impact and users can still perform work functions when issues occur, and issues can be addressed the next business day. Critical components may require support 24x7/365, while non-critical components may require support from 6:00 AM to 10:00 PM ET, Monday through Friday except for federal holidays.

Contractor personnel shall maintain a work schedule that coincides with the schedule of the APM PL Project Managers that they support. It is expected that work will be primarily conducted during core business hours which are defined as 8am to 5pm local time. However, when necessary, Contractor personnel may be required to provide services outside the normal hours. These occasions will be infrequent and will require services to be performed after core hours, evenings, weekends (Saturday and Sunday) and/or holidays. Some examples of recurring Contractor support required outside of normal business hours include monthly maintenance for the Continuous Readiness in Information Security Program (CRISP), biweekly Employee Payroll Deduction (EPD) validation, system upgrades, and application patching. Unplanned critical production incidents occurring outside of core business hours shall require Contractor support.

Table 1: DevSecOps Tools Currently in Use

· Amazon Cloudwatch

· Amazon Web Services

· Insights

· Azure Boards

· Azure DevSecOps

· Azure Pipelines

· Azure Test Plans

· C#

· COBOL

· Confluence

· CSS

· Docker (Enterprise)

· Git GitHub

· GitHub Actions

· GitHub Code QL

· HTML

· Java

· JavaScript

· JAWS

· Jira

· Jira Align

· Jira Cloud

· Job control language (JCL)

· Maven

· Microsoft Azure Gov

· Microsoft Threat Modeling Tool

· MS Office

· MS Power BI

· MS Teams

· MSSQL

· Mural

· Nessus

· .NET

· Node.JS

· Oracle (PL-SQL)

· SAS

· Selenium

· ServiceNow

· SharePoint

· SoapUI

· Elastic

· Typescript

· Visual Studio

· XRAY

Table 2: Architecture Tools Currently in Use

· Amazon AWS

· Angular Command Line Interface (CLI)

· Apache Server

· AppDynamics

· Application Monitoring Tools such as but not limited to AppDynamics

· Application Scanning Tools such as but not limited to CodeQL

· Artificial Intelligence

· ASP.net Controls

· Automated Resources Manager

· Avalanche

· Azure DevOps Server

· BeanStore

· BI Publisher

· Big Fix Enterprise

· Big Fix Remote

· Business/Vision Analytics

· C#

· CA-7 Batch Processing

· Cascading Style Sheets (CSS)

· CentrifyDC

· CICS, IDMS, TSO/ISPF

· Citrix Virtual Apps and Desktops (CVAD)

· Classic ASP

· Client/Server Architecture

· Cloud Computing (e.g. AWS and Azure)

· COBOL 75, 85 and newer releases as appropriate

· Connectrix Manager

· Data Distribution

· DB2

· DYL-260/280

· Electronic Data Interchange

· Electronic Payroll Deduction

· ENDEVOR

· Enterprise Output Solution 360

· GitHub

· GitLab Community Edition (CE)

· Hibernate

· International Business Machines (IBM)Message Queue (MQ)

· Java

· Java Enterprise Edition (Java EE)

· Java Enterprise Edition SDK (Software Development Kit)

· Java Runtime Environment (JRE) – Oracle

· Java Script

· Jenkins Continuous Integration Server

· Jira

· Job Control Language (JCL)

· KixTart (Kickstart)

· Linux RHEL

· Machine Learning

· Mainframe Systems Analysis

· Microsoft .NET Framework

· Microsoft Active Server Pages (ASP).NET Core

· Microsoft Azure

· Microsoft Internet Information Services (IIS)

· Microsoft Structured Query Language

· Microsoft Structured Query Language (SQL) Server

· Microsoft Visual Studio

· Microsoft Windows Server

· MS SharePoint

· HTML

· IBM Installation Manager

· IBM Mainframe – Z/OS

· IBM Middleware/WRS Stack

· International Business Machines (IBM) Hypertext Transfer Protocol (HTTP) Server

· XML

· Mulesoft AnyPoint Platform

· Net Electronic Payment (NETePay)

· NetCOBOL

· NetEpay (DataCap)

· Nintex

· Node.js

· OKTA

· Oracle Analytics Publisher (Oracle BI Publisher)

· Oracle Application Express (APEX)

· Oracle Business Intelligence (OBIEE)/Oracle Analytics Server (OAS)

· Oracle Business Intelligence Enterprise Edition (OBIEE)

· Oracle Client

· Oracle cloud hosted COTS CRM system

· Oracle Database

· Oracle Database Management System

· Oracle E-Business Suite Financials

· VendMAX

· Vision Bean Store Point-of-Sale (POS)

· Vision Central Management

· Vision Store Management

· Visual Studio Code (VS Code)

· Web Services (e.g. REST, SOAP)

· Webforms.aspx

· WebLogic

· WebLogic Server

· WebSphere Application Server (WAS)

· Workload Agent

· Workload Analyzer

· ws_ftp (Ipswitch)WSS30

· Zebra Enterprise Connector

· Zebra PPME

The DevSecOps Tools and Architecture Tools detailed in the tables above will change throughout the life of the contract as enhancement and modernization efforts are implemented.

PERFORMANCE DETAILS

PERFORMANCE PERIOD

The Period of Performance (PoP) shall be one (1) 12-month base period, four (4) 12-month option periods plus four (4) optional tasks, if exercised.

The base period, and each option year, if exercised, shall consist of project management and IT sustainment, operations and management (O&M) services, and program and project management support as defined in tasks 5.1, 5.2, and 5.3.

Task 5.1.7 Scoping Additional Efforts shall be used to develop detailed Execution Plans (EPs). EPs will be developed for sustainment of newly transitioned IT components, enhancements and modernization of existing components, and development of new components in accordance with 5.4 Optional Task One – Additional VCS IT Support. The duration of each EP shall not exceed 12 months. EPs may run consecutively or concurrently with other EPs, option periods, or optional tasks.

Task 5.5 Optional Task Two - Surge Support (T&M) will be Time and Material and shall provide a rapid‑response mechanism for short‑duration, urgent, and limited‑scope services when it is not possible at the time of authorization to estimate accurately the extent or duration of the work or to anticipate costs with reasonable confidence. It shall be ordered only when fixed‑price or EP‑based approaches are not practicable.

Task 5.6 Optional Task Three - ShopVCS eCommerce Website may be exercised multiple times consecutively throughout the life of the contract. Each time the option is exercised, the period of performance (PoP) will be twelve (12) months.

Task 5.7 Optional Task Four - Transition Out may be exercised one time for a 60-day period of performance.

Any work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO).

There are eleven (11) Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, four are set by date:

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

PLACE OF PERFORMANCE

Tasks under this PWS shall be performed at Contractor facilities. The Contractor shall identify the Contractor’s place of performance in their proposal submission.

TRAVEL

The Government encourages the Contractor to maximize its use of teleconferencing and video conferencing for meetings. The Government anticipates no travel associated with this effort throughout the PoP.

SPECIFIC TASKS AND DELIVERABLES

The Contractor shall perform the following:

PROJECT MANAGEMENT

CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, timeline, and tools to be used in execution of the contract. The CPMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks, and resource support. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPMP shall be concurred upon and updated in accordance with Section B of the contract. The Contractor shall update and maintain the VA PM approved CPMP throughout the PoP. The Contractor shall monitor performance against the CPMP and report any deviations. It is expected that the Contractor will keep in communication with VA accordingly so that issues that arise are transparent to both parties to prevent escalation of outstanding issues.

Deliverable:

A. Contractor Project Management Plan

REPORTING REQUIREMENTS

The Contractor shall provide the Contracting Officer’s Representative (COR) with Monthly Progress Reports. These reports shall reflect data as of the last day of the preceding month. The report shall cover all work completed during the reporting period and work planned for the next two reporting periods in addition to responding with status of critical issues and/or enterprise-wide mandated changes.

The report shall address the following data elements for each supported product:

1. High-level schedule and milestones for the current reporting period (i.e., the prior month) through two months in the future.

2. Itemized list of all Information and Communication Technology (ICT) deliverables and their current Section 508 conformance status. If for any reason a deliverable cannot be delivered on time, the Contractor shall provide a written explanation to the COR three (3) days prior to the due date. This written transmittal shall include a firm commitment of when the work will be completed. This transmittal to the COR shall cite reasons for the delay and the impact on the overall project.

3. Identification of any issues that arose and a description of how the issues were resolved. If issues have not been completely resolved, the Contractor shall provide an explanation including their plan and timeframe for resolving the issue.

4. List of all new risks since the last reporting period indicating probability and impact to schedule, cost, and performance as well as trigger dates, and mitigation plans.

5. Epics or similar work completed and in-progress.

6. Contractor staffing status and training completion artifacts (see section 5.1.4) with changes from prior month highlighted.

7. Authority to Operate (ATO) and Risk Management Framework (RMF) status.

The Contractor shall provide detailed input on all supported activities using OIT approved tools and processes including:

1. Support Operation Management Reviews (OMRs) and Program Management Reviews (PMRs) by preparing briefing materials and providing status updates during OMR/PMR meetings. These meetings typically occur monthly.

2. Provide updates into the OIT project management repository (e.g., VA PARS). These updates typically occur weekly.

3. Review and make updates to VA Systems Inventory (VASI). These updates typically occur bi-annually or any time a significant infrastructure or technology stack change is made to a product.

4. Support data calls and requests for ad-hoc documentation. These requests occur approximately 2-3 times per month.

The Contractor shall maintain a VA-hosted location to share contract deliverables and communicate progress, risks, and issues.

Deliverable:

A. Monthly Progress Report

ONBOARDING AND OFFBOARDING

The Contractor shall manage the onboarding of its staff on this contract. Onboarding includes steps to obtain a VA Personal Identity Verification (PIV) card, network and email accounts, completion of VA mandatory training, initiation of background investigations, and gaining physical and logical access. In addition, the Contractor shall identify individuals which may require elevated privileges to VA information systems. After review between the Contractor and VA COR, a decision will be made as to the necessity of obtaining Government Furnished Equipment (GFE) for the onboarding staff. If approved, Contractor shall follow the appropriate steps to obtain the equipment.

A single Contractor Onboarding Point of Contact (POC) shall be designated by the Contractor that tracks the onboarding status of all Contractor personnel. The Contractor Onboarding POC shall be responsible for alerting the COR of any new Contractor personnel as soon as the individual is assigned and providing accurate and timely submission of all required VA onboarding paperwork to the VA COR. All VA onboarding paperwork shall be stored in the deliverables folder in the COR-designated VA SharePoint site or equivalent tool. The Contractor Onboarding POC shall be responsible for tracking the status of all their staff’s onboarding activities to include the names of all personnel engaged on the task, their initial training date for VA Privacy and Information Security training, and their next required training date.

The Contractor shall manage the offboarding process for VA access and to individual system/environment access for all Contractor staff. The Contractor shall prepare all forms necessary for termination of access to VA information systems, in accordance with VA guidance. The Contractor shall assist in confirming whether the GFE equipment, associated documentation, and PIV card has been returned to the proper receiving authorities in accordance with VA policy.

MANDATORY TRAINING

The Contractor shall submit Talent Management System (TMS) training certificates of completion for VA Privacy and Information Security Awareness and Rules of Behavior and Health Insurance Portability and Accountability Act (HIPAA) training and provide signed copies of the Contractor Rules of Behavior in accordance with Section 9, Training, Appendix C of the VA Handbook 6500.6, “Contract Security”.

Contractor employees shall be required to complete VA training courses before receiving access to VA information systems. Contractor employees who have completed these VA training courses within a specified time and have furnished certificates will not be required to re-take the training courses. The Contractor shall collect and store copies of training certificates as evidence of completion.

The Contractor shall provide a copy of their training roster and employee training certificates to indicate the staff that have completed training in the Monthly Status Report.

The Contractor and VA leads shall determine which team members require access to the VA network and VA approved toolset. All Contractors that require access shall complete all required VA Talent Management System (TMS) training courses within 14 days of the identification of the access need. The Contractor shall work with its respective point of contact to obtain access to TMS to complete the mandatory courses.

Contractor employees requiring access to VA information systems shall complete the appropriate VA TMS role-based training courses. Required courses may include, but are not limited to:

1. TMS 3197: Information Security Role-Based Training for IT Specialist

2. TMS 3867205: Training for Elevated Privileges for System Access

3. TMS 3867207: Information Security Role-Based Training for System Owners

4. TMS 1016925: Information Security Role-Based Training for Software Developers

5. TMS 1357076: Information Security and Privacy Role-Based Training for System Administrators

6. TMS 1357084: Information Security Role-Based Training for Data Managers

7. TMS 1357083: Information Security Role-Based Training for Network Administrators

8. TMS 64899: Information Security Role-Based Training for IT Project Managers

Deliverable:

A. Signed Contractor Rules of Behavior

TECHNICAL PROFICIENCY/KEY PERSONNEL

The Contractor shall provide personnel that are fully trained, educated, and experienced in their assigned technical field of expertise and maintain technical proficiency and currency throughout the duration of the contract. All technical team members are required to have technical expertise in modern software development tools, cloud technologies, and VA DevSecOps tools (See Section 3.0).

There are key methodologies, technologies, frameworks, and toolsets critical to the successful development, modernization, and sustainment of the IT products supported by this contract, including Agile methodology and Project Management Institute Project Management Body of Knowledge. As such, the Contractor shall provide "Key Personnel" qualified in the roles listed below:

1. Project Manager: Manages day-to-day project activities, monitors progress, addresses issues, and communicates with various team members and stakeholders.

2. Scrum Master: Facilitates the Scrum process, ensures that the team adheres to Agile practices and principles, and removes impediments to the team's progress. The Scrum Master acts as a coach and servant leader for the Scrum team, helping them improve their performance and efficiency.

3. Technical Leads/Architects: Oversees the technical aspects of the project, providing guidance on architecture, design, and implementation of the software solutions. Ensures that technologies are compliant to Technical Reference Model (TRM) lifecycles and OIT enterprise-wide mandates.

4. Cloud Architect/Engineer: Designs, implements, and manages the cloud infrastructure that supports the software application. Ensures that the cloud environment is scalable, secure, and cost-effective.

5. Lead Business Analyst: Gathers and analyzes requirements from stakeholders, ensuring that the software meets business needs. The BA also acts as a liaison between the business stakeholders and the technical team.

The Contractor agrees that key personnel shall not be removed, diverted, or replaced from work without approval of the CO/COR. Any personnel the Contractor offers as substitutes shall have the ability and qualifications equal to or better than the key personnel that are being replaced. All requests for approval of substitutions in personnel shall be submitted to the CO/COR within 30 calendar days prior to making any change in key personnel. The request shall be written and provide a detailed explanation of the circumstances necessitating the proposed substitution.

COORDINATION AND COOPERATION

The Contractor and its subcontractors may be required to work with other Government Contractors (firms working with the Government under other contracts) to accomplish the services specified in this PWS. The Contractor shall provide full cooperation with all Contractors working for and on behalf of VA. The Contractor is not authorized to provide guidance, direction and/or approval of any other Contractor’s work activities, work products, or deliverables; VA provides the final direction and/or approval.

SCOPING ADDITIONAL EFFORTS

At any time during the PoP, there may be a need to; 1) transition support of an existing VCS IT component to APM product line, 2) develop a new solution to support VCS, or 3) enhance or modernize an existing VCS IT component. Any changes to the APM product line’s IT support for VCS will be supported by this contract through the exercise of 5.3 OPTIONAL TASK ONE – ADDITIONAL VCS IT SUPPORT.

This Contractor shall work collaboratively with the Government to define the requirements, identify any issues, and provide a Rough Order Magnitude (ROM) and/or an Execution Plan (EP) for the individual effort. The Government anticipates that the scoping of individual efforts should require no more than 10 business days to complete. The Contractor shall document ROM and EP status metrics in the Monthly Status Report.

The Government anticipates that each Execution Plan (EP) may require different sized support teams. The Contractor shall be prepared to provide teams of 2 people (extra-small team), 3-4 people (small team), 5-6 people (medium team), 7-8 people (large team) and 9-10 people (extra-large team) as part of the EP and provide pricing accordingly for both critical and non-critical services. It may be necessary for the Contractor to provide multiple teams for the same effort to provide the required level of services. The Contractor shall provide technical project management for all efforts.

Some efforts will need to be phased in throughout the year. Accordingly, the Contractor shall provide monthly pricing, excluding weekends and holidays, to allow the Government to obtain services of teams for less than the full period of performance in either the base year or any of the option years. When developing the Contractor Execution Plan, the period of performance shall not exceed 12 months for each time the Optional Task is exercised.

Once the requirements are determined by both parties, the following steps shall apply:

1. The Contractor shall submit an EP that contains the appropriate labor categories, the proposed or suggested team size, additional deliverables if necessary, and the schedule to include milestones to meet the VA requirements.

2. The Government will evaluate the Contractor’s EP and, if necessary, discuss any revisions.

3. The Contractor shall indicate the manner and extent it will use shared resources to accomplish the Optional Task.

4. Upon agreement of the scope of the EP, the COR will collaborate with the CO, who will issue a modification to commence work.

A. Contractors Execution Plan

TRANSITION IN

The Contractor shall perform all activities necessary to maintain continuity and assume full responsibility for the services in this PWS through a phased ramp-up during a transition-in period of 60 calendar days.

The Contractor shall:

1. Overlap with incumbent contractors to conduct structured knowledge transfer and observe live operations and support responsibilities for all VCS IT components. Shadowing shall include events such as backlog ceremonies, release planning, incident triage, and sustainment routines.

2. Complete all onboarding steps per section 5.1.3 and 5.1.4 and obtain approved access to all necessary system components and tools (e.g. Jira, GitHub, Continuous Authorization & Monitoring [CAM], ServiceNow etc.).

3. Conduct a comprehensive operational and system discovery to establish a baseline of current conditions.

4. Determine the status of all supported components, identify existing risks and issues, and evaluate partnering system or operational impacts that may affect service continuity and performance.

5. Review and refine continuity procedures to prevent service gaps for components designated as critical, consistent with section 5.2 methodology and incident management expectations.

6. Review of existing program documentation.

7. Engage in regularly scheduled meetings, and as approved or coordinated by the COR, shadow incumbent contractors and activities that will result in the successor Contractor gaining an understanding of the business objectives, processes, tools and requirements related to this PWS.

SUSTAINMENT, OPERATIONS, AND MAINTENANCE SUPPORT

The Contractor shall provide sustainment, operations, and maintenance support for VCS IT components supported by the APM PL, which currently includes the following:

VCS-AIS:

1. Oracle eBusiness Suite (on-premises): General Ledger (GL), Accounts Payable, Fixed Assets (FA), Accounts Receivables (AR), Access Management, Concurrent Manager Tool Oracle Retail (isolated and on-premises): Sub-components include Retail Management System, Store Inventory Management (SIM), Retail Sales Audit (ReSA), Retail Invoice Matching (ReIM), Retail Data Warehouse (RDW), Retail Price Management (RPM), Retail Extract Transition and Load (RETL), and Retail Integration Bus (RIB). Important Note: The legacy on-premises Oracle Retail solution is in the process of being modernized and migrated to the commercial Oracle Retail Software-as-a-Service (SaaS) solution. The separate acquisition effort is expected to begin in 2027 and take approximately 14-18 months to complete. The Contractor shall provide support with interface migration changes and workflows related to the SaaS migration effort.

2. Veteran Canteen Applications (VCA)

3. Employee Payroll Deduction (EPD)

4. NETePay

5. Debt Management (TOPS)

6. Electronic Card (E-Card)

7. VCS Website

8. Data Analytics

9. Oracle Business Intelligence (OBIEE), Oracle Analytics Server (OAS), Oracle Analytics, Oracle Publisher (BI Publisher), Oracle Apex

10. Custom Application using .NET Core MVC, Microsoft SQL Server

11. Batch (e.g. Automated scripts and Mainframe CA-7 Job Scheduler)

12. Unidirectional, bidirectional, internal and external Interfaces using Amazon S3 Buckets, Oracle Retail SaaS Interfaces to OIT internal systems

VCS-POS:

1. POS Backend: Sub-components include Task Management, Vision Channel Manager, IBM Web Server Bean Store, Extract Transform and Load, IBM Message Queue, Backoffice, Estate Manager, Network Deployment Manager, IBM WebSphere Application Server (WAS). Important Note: Contract support currently limited to the backend POS system hosted at the VA Data Center. The Contractor is not responsible for maintenance of till hardware and BeanStore client software.

2. All interfaces to and from VCS-POS

VCS-MDM:

1. Contractor support for VCS-MDM is currently limited to cybersecurity support (see section 5.2.10) and the interface between the VCS-MDM and VCS-AIS only. Important Note: The Contractor is not responsible for maintenance of mobile device hardware (i.e. inventory scanners, portable label printers and vending machine adapters).

VCS Contractor Timecard SharePoint Instance:

The Contractor shall provide network and server support for the SharePoint systems, associated database, and on-premise storage. The Contractor shall ensure the SharePoint is fully functioning and meeting the needs of VCS staff. The Contractor shall provide a VCS Contractor Timecard Workflows Design and Topology Document which shall include:

1. A narrative description of the overall design.

2. A high-level network topology diagram which identifies all SharePoint workflows, forms, and connectivity.

3. Individual workflow topology diagrams for each VCS SharePoint solution.

4. A listing of servers and other physical components of the VCS SharePoint system.

5. A narrative description of the overall design of the VCS SharePoint system.

The Contractor shall be able to perform the tasks in this section with required knowledge of the following software products and capabilities listed below.

1. SharePoint 2013

2. SharePoint MS 365

3. Permissions creation, editing, troubleshooting, and organizing group roles

4. SQL Servers and SQL Database management

5. Cloud architecture and security issues around storing data on the cloud.

6. Pro-actively anticipate problems VCS Knowledge Center Instance:

The VCS SharePoint System otherwise known as the VCS Knowledge Center is a web based platform which resides on the VHAV15WEB01.V15.MED.VA.GOV server, which is utilized as a centralized hub for VCS business operations to store policies and procedures, share communication updates, financial and inventory reporting, data entry, call ticket submission, training, and application links. The SharePoint solution uses Power Apps, asp.net forms, Nintex, and HTML coding to populate, navigate, and display the information.

The Contactor shall support the following components:

1. SharePoint Designer - Software used to create build/customize SharePoint sites and applications

2. PowerBI - Business analytics server

3. Ninetex - Software used to create business workflows.

4. SharePoint Workflows - Tool in SharePoint to create process workflows, i.e. email notifications, signature collections, status tracking.

The Contractor shall provide a VCS Knowledge Center Workflows Design and Topology Document. This document shall include:

1. A narrative description of the overall design of the VCS SharePoint network.

2. A high-level VCS SharePoint network topology diagram which identifies all SharePoint workflows, forms, and connectivity.

3. Individual workflow topology diagrams for each VCS SharePoint solution.

4. A listing of servers and other physical components of the VCS SharePoint system.

5. A narrative description of the overall design of the VCS SharePoint system.

The Contractor shall update the reporting asp.net Webform’s source code, which is accessible through SharePoint.

The Contractor shall be able to perform the tasks in this section with required knowledge of the following software products and capabilities listed below.

1. SharePoint 2013

2. SharePoint MS365

3. Nintex Workflows creation, editing, and troubleshooting

4. Permissions creation, editing, troubleshooting, and organizing group roles

5. Automated processes and scripting – writing html code and JavaScript to enhance websites, SharePoint, and digital communication.

6. HTML creation, editing, and troubleshooting i.e. email blasts and templates

7. PowerApps workflows creation, editing, and troubleshooting

8. Windows operating systems as well as Power BI, PowerShell, and Office 365

9. Cloud architecture and security issues around storing data on the cloud.

10. Custom Web Applications

11. Pro-actively anticipate problems

The composition of VCS IT components supported by the APM PL will change during the life of this contract. Components listed above may be decommissioned, replaced through modernization with improved systems utilizing different technologies, or enhanced through updates to existing systems. The Contractor shall provide sustainment, operations, and maintenance support for all VCS IT components as specified by the Government at any given time, including any newly implemented systems or technologies resulting from modernization or enhancements.

The Contractor shall manage all artifacts associated with the above activities in accordance with VA standards, utilizing VA-designated tools including Jira, GitHub, ServiceNow Continuous Authorization & Monitoring (CAM) and ServiceNow (SNOW).

Deliverables:

A. VCS Contractor Timecard Workflows Design and Topology Document B. VCS Knowledge Center Workflows Design and Topology Document

METHODOLOGY AND WORKING PRINCIPLES

The Contractor shall deliver IT services that use DevOps techniques that embrace Continuous Integration / Continuous Delivery (CI/CD). The Contractor shall deliver secure and tested modern application designs using automated testing frameworks.

The Contractor shall:

1. Deliver high-quality, functional products that are measured by user feedback from surveys, research, etc.

2. Incorporate Agile methodologies and ceremonies into work, such as (but not limited to) sprint planning, daily scrum, sprint review, sprint retrospective, backlog grooming, and estimating activities.

3. Actively involve users in the design of all solutions. Incorporate best practices for modern user research and usability testing, such as (but not limited to) creating user personas, problem space definitions, affinity maps, user flow diagrams, wireframes, information architecture diagrams, design prototypes, user research plans, conversation guides, and user research synthesis.

4. Maintain a consistent look, feel, and voice across user facing sites and services.

5. Incorporate robust accessibility principles into design, development and testing for all applications to deliver high-quality digital experiences to users of assistive devices.

6. Protect user information with best-in-class security, given the constraints of the environment.