OMEGA 2.0 PWS -06252026- Draft.docx

Onboarding, Management, Engineering, Governance, and Assurance Services

VA-24-00010954

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Office of Information & Technology Digital Services Delivery (DSD) | Product Delivery Service (PDS) | Digital Product Services (DPS) Digital Transformation Center (DTC)

Onboarding, Management, Engineering, Governance, and Assurance Services

(OMEGA 2.0)

Date: 06/25/2026

TAC-26-00000000

Task Order PWS Version Number: 1.7

Contents

BACKGROUND

The mission of the Department of Veterans Affairs (VA) Office of Information and Technology (OIT), Program Engineering Services (PES), Digital Transformation Center (DTC) is to establish VA-wide Digital Modernization Initiatives which can be supported and delivered via Product Delivery and Lifecycle Management methodologies to transform VA by tapping into emerging technologies, connecting developers with VA data, and making Human Centered Design (HCD) the method of how all VA products are designed.

DTC established a modern digital experience for VA Enterprise needs such as the acceleration/adoption of Software-as-a-Service (SaaS), Platform-as-a-Service (PaaS), Application Programing Interface (API), and emerging technologies to modernize service and solution delivery through adoption of software development (Dev), security (Sec), and Information Technology (IT) operations (Ops) (DevSecOps), Product Line Management (PLM), and Industry Best Practices/Standards. DTC programs have delivered and manage best-in-class product services and solution capabilities leveraging specialized and diversified skill sets for the VA Enterprise Digital Modernization Initiatives to include Federal Multi-Tenancy Enclaves.

The DTC Ecosystem is a persistent collaboration of platform management, program management teams, and system integrators (SI) across the entire capability delivery lifecycle with centralized enterprise platform management with quality approval gates assuring the SI’s delivery of high-quality low code/no code (LCNC) solutions. As outlined in Figure 1 below, the SI teams are represented as the Product Delivery team in blue focused on delivering solutions within the DTC Capability Delivery Lifecycle Management; while DTC Platform Management Team tasks and activities in red are responsible for the governance, operations, and maintenance services of the underlying DTC LCNC products and platforms that hosted Product Delivery team solutions. DTC success is measured and validated through the incremental and iterative delivery of business and technology capabilities driving modernization efforts.

As part of VA’s digital modernization, SaaS is a strategic application delivery model. A SaaS Product is hosted on a cloud infrastructure outside the security boundary of VA and is provided to the Cloud Service Customer (CSC) over the internet. The CSC uses the SaaS offering via a thin-client interface, such as a web-browser or a program interface. The CSC subscribes to the SaaS offering and is only responsible for limited application configuration settings. The Cloud Service Provider (CSP) offering the application is responsible for management of the application, safeguarding of data stored or processed by the application, and all elements of the underlying infrastructure.

To qualify as SaaS for use at VA (as defined in Attachment 1), and to align with Federal Risk and Authorization Management Program (FedRAMP) requirements, the hosting for the offering must conform to the National Institute of Standards and Technology (NIST) 800-145 definition of Cloud Computing and thus contain following key characteristics:

· On-Demand Self-Service: The CSP fully automates the provisioning of both the customer interface and the underlying cloud components of the SaaS offering. In some cases, the CSP may provision internal resources manually, while providing the CSC an automated interface to request and track the service.

· Broad Network Access: The SaaS capabilities are available over the internet or over a network that is available from all access points the CSC requires. The SaaS offering is accessible through common platforms (e.g., mobile phones, tablets, laptops, and workstations).

· Resource Pooling: The computing infrastructure supporting the SaaS offering is shared among more than one CSC using a multi-tenant model, and resources are dynamically assigned depending on customer demand.

· Rapid Elasticity: Computing capabilities are automatically provisioned and released in a manner that scales with customer demand. In some cases, the scaling of resources may not be fully automated, but it should be fast enough to support the needs of the CSC, which the CSC would have to define.

· Measured Service: Resource usage, such as storage, processing, bandwidth, and user activity are measured and reported on in a manner that is relevant to the SaaS offering.

The SaaS offering shall be hosted within the continental United States and data stored, processed, and/or transmitted within the offering shall remain within the United States. CSPs shall be aware of FedRAMP and ready to partner with VA through the SaaS FedRAMP Authorization process.

To further accelerate the adoption of VA’s Cloud First, Cloud Smart, and other policies and directives, VA sponsors Hybrid and Managed Solutions in addition to the SaaS application delivery model referenced above. A Hybrid Solution is comprised of both SaaS and on-premise components which shall adhere to both SaaS and VA Enterprise Cloud established policies. A Managed Solution is defined as a single-tenant product not hosted within the VA Network. The mission of the VA is to provide benefits and services to Veterans of the United States. In meeting these goals, OIT strives to provide high quality, effective, and efficient IT services to those responsible for providing care to the Veterans at the point-of-care as well as throughout all the points of the Veterans’ health care in an effective, timely, and compassionate manner. VA depends on Information Management/Information Technology systems to meet mission goals.

The DTC technology ecosystem continues maturing into a modular ecosystem comprised of reusable solution and technology components that optimize reusability, accelerates solutions delivery, and reduces product delivery and operations costs. Modular solution architecture and design is composed of underlying modules and functional components, where each modular component provides a standalone service or value functionally distinct and independent from other software modules or functional components. Each modular component is partitioned ensuring that each component is solvable, modifiable, and compilable without requiring the whole software system to be recompiled. Modular solution architecture and design further enables and ensures that underlying distinct functionality leveraged as part LCNC of the overall software application design provides a unified, consistent user experience that is standardized across the enterprise.

In support of VA systems modernization and the agency’s mandate to move to the cloud, this effort seeks to provide LCNC product and platform onboarding, management, engineering support, governance, and assurance (OMEGA) services to enable, manage, operate, and sustain the underlying DTC technology ecosystem including modular and reusable technology components supporting VA Enterprise modernization initiatives.

In addition, OMEGA shall serve as DTC's enterprise governance, platform management, and assurance function for Artificial Intelligence (AI)-enabled capabilities that are native to, integrated with, or reusable across DTC SaaS, PaaS, LCNC, API, automation, and emerging technology environments. OMEGA governance includes AI intake screening, risk classification, standards management, reusable component cataloging, authorization evidence, release readiness, monitoring, issue escalation, sustainment controls, and lifecycle documentation.

OMEGA shall provide the control framework, approval gates, platform guardrails, enterprise architecture alignment, security and privacy assurance, and operational monitoring needed for responsible AI adoption across the DTC ecosystem.

APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. 44 U.S.C. § 3541-3549, “Federal Information Security Management Act (FISMA) of 2002”

2. “Federal Information Security Modernization Act of 2014”

3. Federal Information Processing Standards (FIPS) Publication 140-2, “Security Requirements for Cryptographic Modules”

4. FIPS Pub 199. “Standards for Security Categorization of Federal Information and Information Systems,” February 2004

5. FIPS Pub 200, “Minimum Security Requirements for Federal Information and Information Systems,” March 2006

6. FIPS Pub 201-2, “Personal Identity Verification of Federal Employees and Contractors,” August 2013

7. 10 U.S.C. § 2224, "Defense Information Assurance Program"

8. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

9. Public Law 109-461, Veterans Benefits, Health Care, and Information Technology Act of 2006, Title IX, Information Security Matters

10. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”

11. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, https://www.va.gov/vapubs/index.cfm

12. VA Handbook 0710, “Personnel Security and Suitability Program,” May 2, 2016, https://www.va.gov/vapubs/index.cfm

13. VA Directive and Handbook 6102, “Internet/Intranet Services,” August 5, 2019

14. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and Guidelines,” January 18, 2017

15. Office of Management and Budget (OMB) Circular A-130, “Managing Federal Information as a Strategic Resource,” July 28, 2016

16. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed Services (CHAMPUS)”

17. NIST SP 800-66 Rev. 1, “An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule,” October 2008

18. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended, January 18, 2017

19. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

20. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021

21. VA Handbook 6500, “Risk Management Framework for VA Information Systems VA Information Security Program,” February 24, 2021

22. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI),” March 12, 2019

23. VA Handbook 6500.5, “Incorporating Security and Privacy into the System Development Lifecycle,” March 22, 2010

24. VA Handbook 6500.6, “Contract Security,” March 12, 2010

25. VA Handbook 6500.8, “Information System Contingency Planning,” April 6, 2011

26. VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018

27. VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017

28. OIT Process Asset Library (PAL), https://www.va.gov/process/ . Reference Process Maps at https://www.va.gov/process/maps.asp and Artifact templates at https://www.va.gov/process/artifacts.asp

29. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

30. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014

31. VA Handbook 6508.1, “Procedures for Privacy Threshold Analysis and Privacy Impact Assessment,” July 30, 2015

32. VA Handbook 6510, “VA Identity and Access Management,” January 15, 2016

33. VA Directive and Handbook 6513, “Secure External Connections,” October 12, 2017

34. VA Directive 6300, “Records and Information Management,” September 21, 2018

35. VA Handbook, 6300.1, “Records Management Procedures,“ March 24, 2010

36. NIST SP 800-37 Rev 2, “Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy,” December 2018

37. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020)

38. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015

39. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” March 24, 2014

40. OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005

41. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019

42. OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008

43. Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance, December 2, 2011, (NOTE: Part A of the FICAM Roadmap and Implementation Guidance, v2.0, was replaced in 2015 with an updated Architecture (https://www.idmanagement.gov/arch/)

44. NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access,“ June 2018

45. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, “Digital Identity Guidelines,” updated March 02, 2020

46. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014

47. NIST SP 800-164, “Guidelines on Hardware-Rooted Security in Mobile Devices (Draft),” October 2012

48. Draft National Institute of Standards and Technology Interagency Report (NISTIR) 7981, “Mobile, PIV, and Authentication,” March 2014

49. VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

50. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

51. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

52. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

53. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019

54. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008

55. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (Public Law 110–140), December 19, 2007

56. Section 104 of the Energy Policy Act of 2005, (Public Law 109–58), August 8, 2005

57. Executive Order 13834, “Efficient Federal Operations,” dated May 17, 2018

58. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 2, 2001

59. VA Directive 0058, “VA Green Purchasing Program,” July 19, 2013

60. VA Handbook 0058, “VA Green Purchasing Program,” July 19, 2013

61. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

62. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

63. “Veteran Focused Integration Process (VIP) Guide 4.0,” January 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

64. VA Memorandum “Proper Use of Email and Other Messaging Services,” January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

65. “DevSecOps Product Line Management Playbook” version 2.0, May 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

66. NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020

67. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol Version 6 (IPv6),” November 19, 2020

68. Social Security Number (SSN) Fraud Prevention Act of 2017

69. Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23, 2018

70. SaaS Product Catalog - DigitalVA Product Marketplace https://digital.va.gov/marketplace/saas-catalog/

71. DTC Standard Operating Procedures https://confluence.devops.va.gov/x/KITjAg

72. VA Cloud First Strategy - VA Directive 6517 https://www.va.gov/vapubs/viewPublication.asp?Pub_ID=852&FType=2

73. Cloud Security Technical Reference Architecture, June 2022 Version 2.0 https://www.cisa.gov/sites/default/files/2023-02/cloud_security_technical_reference_architecture_2.pdf

74. OMB Memorandum M-25-21, Accelerating Federal Use of AI through Innovation, Governance, and Public Trust, February 2025

75. OMB Memorandum M-25-22, Driving Efficient Acquisition of Artificial Intelligence in Government, February 2025

76. NIST Artificial Intelligence Risk Management Framework (AI RMF 1.0), January 2023

77. NIST AI 600-1, Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile, July 2024

78. VA Chief Information Officer (CIO), Chief Artificial Intelligence Officer (CAIO), and VA-approved AI governance, inventory, acceptable use, and risk management guidance, as issued and updated

79. FedRAMP Authorization Act, December 23, 2022

80. VA SaaS Definition - Attachment 1

81. DTC Process - How to Submit a Request to Move a Module to Sustainment - Attachment 2

82. Product Warranty and Permanent Sustainment Procedures – Attachment 3

83. DTC System Integrator Service Level Agreements - Attachment 4

84. Existing Digital Transformation Center O&M Solutions - Attachment 5

85. DTC Current Platform as a Service Offerings – Attachment 6

86. DTC Incident Management Plans/Processes/Checklists/Templates – Attachments 7-10

SCOPE OF WORK

The Contractor shall create, maintain, and update the Standards and Governance established by the DTC. The Contractor shall elevate any non-compliance findings to the VA DTC Program Manager (PM). The Contractor shall provide technical and operational support to the DTC for SaaS, PaaS, and emerging technologies. The Contractor shall also provide governance, operations, and maintenance services to support all aspects of the DTC including project management, security and compliance, platform governance, platform management, solution governance, engineering, license management, solution sustainment, platform sustainment, product and technology adoption and socialization, and end user support. The Contractor shall also support DTC AI governance and assurance responsibilities by creating, maintaining, updating, and executing DTC AI standards, AI platform guardrails, AI use-case intake controls, AI risk classification processes, AI compliance evidence, AI monitoring, AI license and consumption reporting, AI lifecycle documentation, and AI non-compliance escalation to the VA PM, DTC leadership, and applicable VA governance authorities. The Contractor shall adhere to all established Service Level Agreements as specified in this PWS.

PERFORMANCE DETAILS

PERFORMANCE PERIOD

The Period of Performance (PoP) shall consist of one 12-month base period, four 12-month option periods, and 24 Optional Tasks.

Any work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO).

There are eleven (11) Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, five are set by date:

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

PLACE OF PERFORMANCE

Tasks under this effort shall be performed at Contractor facilities and work may be performed virtually at remote locations (i.e., home offices) with prior concurrence from the Contracting Officer’s Representative (COR). The Contractor shall identify the Contractor’s place of performance in their Proposal submission. For specific meeting types, including user requirements sessions and other key meetings which are best accomplished at Government facilities. The Government will schedule meeting rooms as necessary. For certain meeting types, such as DTC Program Increment (PI) Planning/Program Management Reviews (PMRs), the Contractor shall host quarterly/triannual events at their facilities (estimating 65+ attendees). No work under this contract shall take place outside the United States.

The Contractor shall be responsible for ensuring all Contractor personnel are located and conduct work within the following locations: Continental United States (CONUS); District of Columbia (DC); Alaska; Hawaii; and Puerto Rico/ US Virgin Islands. Contractor personnel may only utilize IP addresses available in the aforementioned locations to access the VA network. Contractor personnel may only utilize VA provided Virtual Privacy Networks (VPNs) software or remote access services such as Citrix CAG, to access VA networks and content requiring additional security controls and access privileges. Contractor personnel may not utilize external VPN software, connections, or endpoints to access the VA network or VA provided VPN. If Contractor personnel are outside of permitted locations, the Contractor shall be responsible for all resources necessary to remedy the incident including remediation of damages arising from work performed by Contractor provided personnel, under the scope of this contract.

TRAVEL

The Government anticipates travel to perform the tasks associated with the effort to attend program-related meetings, to perform testing, and user requirement sessions throughout the PoP.

Travel shall be proposed on a Cost-Reimbursable basis. Travel shall be in accordance with the Federal Travel Regulations (FTR) and requires advanced concurrence by the COR. Contractor travel within the local commuting area will not be reimbursed.

SPECIFIC TASKS AND DELIVERABLES

The Contractor shall follow established and emerging DTC policies, frameworks, and procedures while maintaining process and service SLAs applied across all requirements and deliverables in 5.0 and all sub-paragraphs. The Contractor shall maintain and adhere to all SLAs as outlined in Attachment 4. For all requirements and deliverables in Section 5.0 and all subparagraphs, AI-enabled capabilities include machine learning, generative AI, natural language processing, predictive analytics, intelligent automation, AI-assisted development or configuration, copilots, agents, model-based services, AI-enabled APIs, and AI-assisted platform operations. The Contractor shall ensure that AI-enabled capabilities follow DTC AI governance, VA security and privacy controls, human oversight requirements, logging, traceability, configuration management, release readiness, monitoring, and risk management before production use or sustainment acceptance.

PROJECT MANAGEMENT

CONTRACTOR PRODUCT AND PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Product and Project Management Plan (CPPMP) that lays out the Contractor’s approach, timeline, and tools to be used in execution of this TO effort. The CPPMP shall take the form of both a narrative and graphic format that displays the product and/or project delivery timeline and targets for each prioritized capability, including a sprint forecast of target products/projects capabilities are in the upcoming sprints, target delivery of capability with sprint confidence metric, milestones, changes to target delivery with reason in plain language, risks, and resource support. The CPPMP shall also include how the Contractor will coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPPMP shall be concurred upon and updated in accordance with Section B of the TO. The Contractor shall update and maintain the VA Product Manager (PM) approved CPPMP throughout the PoP. The CPPMP shall include an AI Governance Management Approach describing the Contractor's approach for AI governance roles and responsibilities, AI approval workflows, AI use-case inventory support, AI risk escalation, coordination with DTC Federal Platform Leads, coordination with CIO/CAIO governance authorities when required, reporting cadence, AI lifecycle evidence, and the tools/repositories used to manage AI governance artifacts.

Deliverable:

A. Contractor Product and Project Management Plan B. AI Governance Management Plan

REPORTING REQUIREMENTS

The Contractor shall provide the COR, the Contract Project Manager, and the DTC Directors with a Monthly Progress Report to include, at minimum, the following information:

1. Key accomplishments

2. License Management savings

3. Labor Cost Avoidance from Reuse Implementations

4. SaaS/PaaS/Reuse/Integration deliveries

5. Authority to Operate (ATO) decisions granted by type.

6. Number of new FedRAMP In-Process designations issued.

7. Number of new FedRAMP Authorizations granted.

8. DTC Product Marketplace additions and/or removals

9. Number of new SaaS/PaaS/Reuse/Integration Requests

10. Number of Active SaaS/PaaS/Reuse/Integration Requests

11. Number of SaaS/PaaS/Reuse/Integration Requests in Assessment Pipeline

12. Number of Requests in Process by Phase, by assigned resource(s)

13. Average processing time by Phase, by assigned resource(s)

14. Number of Supported Users to date

15. SaaS/PaaS/Reuse/Integration Deliveries from previous month and forecasts for the fiscal year

16. Number of SaaS/PaaS/Reuse/Integration Cancelled Requests

17. Delivery and Processing time of onboarding new PaaS platforms

18. Delivery and Processing time of onboarding new SaaS products

19. Delivery and Processing time of onboarding new PaaS modules

20. Platform Health Monitoring and Reporting data and trends.

21. Delivery and Processing time of product, platform, and module security authorization updates

22. Number of SaaS/PaaS/Reuse/Integration Products Delivered to Date within current Fiscal Year and cumulative to date.

23. Delivery and Processing time trends for aforementioned information and additional metrics requested by Contract Project Manager.

24. DTC support tools (DTC Product Portfolio, Service Manager Pro, Jira, or other VA-approved DTC tracking and management tools) data completeness and quality report

25. DTC Workstream priorities and progress made during the previous month.

26. Progress details on ATO / FedRAMP authorizations in progress

27. Number of AI-enabled SaaS/PaaS/Reuse/Integration requests received, approved, rejected, deferred, or pending governance review.

28. Number of AI use cases screened for high-impact, rights-impacting, safety-impacting, privacy, security, data sensitivity, or authorization considerations.

29. Status of AI use-case inventory records, AI risk classification determinations, AI approvals, exceptions, open findings, remediation actions, and escalations.

30. AI release readiness, AI monitoring, AI incident, AI drift, AI defects, AI service degradation, and AI rollback or disablement trends.

31. AI license, copilot, agent, model/API consumption, token, transaction, or other AI usage and cost transparency reporting, as applicable.

The Monthly Progress Report shall include detailed instructions/explanations for each required data element, to ensure that data is accurate and consistent. The report shall reflect data as of the last business day of the preceding period. The Monthly Progress Report shall cover all work completed during the reporting period and work planned for the subsequent reporting period for each project. The Monthly Progress Report shall identify any problems that arose and give a description of how the problems were resolved. If problems have not been completely resolved, the Contractor shall provide an explanation including its plan and timeframe for resolving the issue(s). The Monthly Progress Report shall also include an itemized list of all documents and electronic deliverables. The Contractor shall monitor performance against the CPPMP and report any deviations in the next Monthly Progress Report. The Contractor shall ensure regular communication with the VA PM so that issues that arise are transparent to both parties to prevent escalation of outstanding issues. The Contractor shall also provide the data and reporting content to the VA PM to support management level reporting. Throughout a product lifecycle, the Contractor shall ensure data records contain the necessary elements for analysis and tracking, and is meaningful, accurate and appropriate for a given product lifecycle phase.

Deliverable:

A. Monthly Progress Report B. AI Use Case Inventory and Risk Classification Register

WEEKLY ACTIVITY REPORT

The Contractor shall provide a Weekly Activity Report detailing all SaaS and PaaS deliveries from the previous week (to include the associated Product Request (PR) number, description of the product, and importance to VA/Veterans), Production Releases from the previous week (to include the impacted modules), expected deliveries for the next week, and any risks and dependencies on a weekly basis. Any new risk or dependency shall be communicated and escalated to the DTC Federal Platform Lead(s) within 24 hours of the issue discovery. This report shall include details on all risks and dependencies discovered during the previous week, identification of any new risks or dependencies encountered, and an update on previously identified risks and dependencies. This report shall be delivered to the VA COR, VA Project Manager, and POCs responsible for updating the DTC Veteran Affairs Product-line Management Accountability and Reporting System (VA PARS) Dashboard.

Deliverable:

A. Weekly Activity Report

TECHNICAL KICKOFF MEETING

The Contractor shall hold a Technical Kickoff Meeting within ten days after contract award, or applicable Optional Task exercise, between Contractor, COR, Contract PM, and VA DTC Directors. The Contractor shall coordinate the date, time, and location (can be virtual) with the CO, the VA PM, the Contract Specialist (CS), and the COR. The Contractor shall provide a draft Kickoff Meeting Agenda (via email) to the CO, CS, COR, and VA PM at least five calendar days prior to the meeting. Upon Government approval of a final Kickoff Meeting Agenda, the Contractor shall distribute to all meeting attendees (via email). During the Technical Kickoff Meeting, the Contractor shall present Kickoff Meeting Power Point Presentation. After the Technical Kickoff Meeting, the Contractor shall send the Kickoff Power Point Presentation for review and approval by the Government within three days after the Technical Kickoff Meeting. The presentation shall include details of the intended approach, work plan, and project schedule for each effort. At the conclusion of the meeting, the Contractor shall update the presentation with a final slide entitled “Summary Report” which shall include notes on any major issues, agreements, or disagreements discussed during the Technical Kickoff Meeting. The Contractor shall submit the final updated Kickoff Meeting Power Point Presentation to the CO, CS, and COR for review and approval three calendar days after the meeting. The Contractor shall prepare and distribute the Kickoff Meeting Minutes to the CO, CS, COR, and all attendees within three calendar days after the meeting.

Deliverables:

A. Kickoff Meeting Agenda B. Kickoff Meeting Power Point Presentation C. Kickoff Meeting Minutes

TRAINING

PRIVACY TRAINING

The Contractor shall submit Talent Management System (TMS) Training Certificates of completion for VA Privacy and Information Security Awareness and Rules of Behavior and provide signed copies of the Contractor Rules of Behavior in accordance with Section 9, Training, from Appendix C of the VA Handbook 6500.6, “Contract Security” which can be found at Addendum B of this PWS.

The Contractor shall track the status of VA Privacy and Information Security Awareness and Rules of Behavior training for all individuals engaged on each Level of Effort (LoE) under the contract. The status reporting shall identify a single Contractor Security Point of Contact (POC), the names of all personnel engaged on each LOE under the contract, their initial training date for VA Privacy and Information Security and Rules of Behavior training, and their next required training date. This information shall be submitted as part of the Contractor’s CPPMP. The training referenced above is required to be renewed annually.

Deliverable:

A. TMS Training Certificates (VA Privacy and Information Security Awareness and Rules of Behavior)

ELEVATED PERMISSIONS TRAINING

The Contractor shall ensure that all personnel have completed all required training prior to giving any elevated permissions to production or pre-prod environments as deemed by the VA’s Security regulations. The Contractor shall provide Elevated Permissions Training Documentation to allow Contractor staff to work in FedRAMP environment.

Deliverable:

A. Elevated Permissions Training Documentation

ARTIFICIAL INTELLIGENCE ACCEPTABLE USE AND GOVERNANCE TRAINING

The Contractor shall ensure personnel supporting OMEGA tasks complete AI acceptable use and governance training before receiving access to AI-enabled platform features, AI administrative capabilities, AI configuration tools, model/prompt/agent repositories, or AI monitoring dashboards. Training shall address approved AI tools, prohibited use, PII/PHI/SPI/CUI restrictions, prompt and data leakage risks, hallucination and output validation risks, human oversight, records management, accessibility, security incident reporting, and escalation procedures.

Deliverable:

A. AI Acceptable Use and Governance Training Documentation

ONBOARDING\OFFBOARDING

The Contractor shall manage the onboarding and offboarding of its staff. Onboarding shall include steps to obtain a VA network and email account, complete training, initiate background investigations, and gain physical and logical access to the Contractor’s facility, which may include elevated privileges to the necessary development and test environments for the various systems to be enhanced.

Offboarding shall include steps to work with VA DTC staff to promptly remove VA network and email account along with removing physical and logical access, which will include removing privileges to the necessary development and test environments for the various systems.

The Contractor shall provide a security clearance report, as part of the Onboarding\Offboarding Status Report with up-to-date information on all staff members security clearance status including date of re-certification and their expiration dates.

A single Contractor Onboarding/Offboarding POC shall be designated by the Contractor who tracks the onboarding and offboarding status of all Contractor personnel. The Contractor Onboarding\Offboarding POC shall be responsible for accurate and timely submission of all required VA onboarding\offboarding paperwork to the COR or his/her designee. The Contractor shall be responsible for tracking the status of all its staff’s onboarding\offboarding activities. The Contractor shall provide an Onboarding\Offboarding Status Report bi-weekly which includes updates for all in-process staff, security clearance status for all staff members, and any staff with outstanding onboarding\offboarding requests for review by the COR and his/her designee. The Onboarding\Offboarding Status Report shall include a column reflecting the DTC Federal Platform Lead that each Contractor personnel will be supporting.

Deliverable:

A. Onboarding\Offboarding Status Report

PROJECT MANAGEMENT AND OVERSIGHT/KEY PERSONNEL

The Contractor shall provide resources that have the requisite skills and experience required to perform the tasks within the PWS. The Contractor agrees that the personnel identified below, as key to supporting this effort, including any exercised Optional Tasks with specific key personnel identified, shall not be removed from the effort, replaced, or added without a compelling reason and without written notification to the CO/COR/PM.

The Contractor shall provide Contractor support personnel and subcontractors who have the required educational background, experience, security clearance, and access authorization or combination thereof to meet the labor category descriptions for the required PWS tasks.

The Contractor shall participate in DTC work groups as requested by the VA DTC Directors.

If any change to the Key Personnel assigned to the labor categories identified below becomes necessary (initial staffing, substitutions, or additions), the Contractor shall notify the CO/CS/COR/PM in writing within 24 hours and shall have 15 business days to fill the position. If the Contractor requires more time, it shall coordinate with the COR/PM. The proposed replacement personnel shall be of at least substantially equal ability and qualifications as the individual(s) currently performing in that category and the proposed replacement shall meet or exceed the qualifications designated for that Key Personnel position. The substitution or replacement of the personnel shall not occur within the first six months after the date of award unless there are extenuating circumstances agreed to by the VA DTC Director.

The Contractor agrees that it has a contractual obligation to mitigate the consequences of the loss of Key Personnel. The Contractor shall promptly secure any necessary replacements in accordance with (IAW) this PWS section. Failure to replace a member of the Key Personnel pursuant to this clause, causing a break in performance of the labor category at issue, shall be considered a condition endangering contract performance and may provide grounds for termination for default.

All Contractor personnel shall be available on VA Teams and respond to VA emails within 24 hours of receipt. All business done in support of DTC OMEGA shall be conducted from VA issued accounts, once credentials are received. All artifacts generated in support of DTC OMEGA shall be stored on a VA-approved repository.

The labor categories below are identified as Key Personnel. The Contractor shall provide Key Personnel that meet the corresponding requirements identified in the Labor Description below:

Program Manager (Senior Program Manager)

· Shall oversee all functions, personnel, and contract deliverables of the DTC Center of Excellence (COE). This resource shall have at a minimum of three years’ experience in managing enterprise Salesforce, Microsoft Power Platform, Microsoft Dynamics, Pega, or Appian platform delivery solutions.

· This resource shall have a minimum of 15 years of demonstrated experience managing large IT enterprise projects with 10 team members or more. This resource shall hold an industry- recognized Administrator certificate for the respective COE (i.e., Salesforce Certified Administrator) and shall have a post baccalaureate degree.

Platform Architect (Lead Architect Platform - PaaS/SaaS)

· Shall be a Salesforce, Microsoft Power Platform, Pega, Appian or any approved DTC Ecosystem vendor platform Certified Technical Architect (CTA) credential, Certified Application Architect, or a Certified System Architect.

· Shall have extensive experience (a minimum of five years) and depth of understanding of experience with large scale Low Code/No Code (LCNC) platform deployments.

Software/System Architect, Senior (Lead Architect - (Integration)/Emerging Tech)

· Shall have all the certifications listed below:

· MuleSoft Certified Developer - Integration and API Associate

· MuleSoft Certified Developer - Integration Professional

· MuleSoft Certified Platform Architect

· MuleSoft Certified Integration Architect.

Business Process Expert (PaaS/SaaS/IT SME - Product Manager)

· Shall be a Salesforce Certified Administrator and shall have a minimum of two of the following Salesforce Design Certifications:

· Certified Identity and Access Management Designer

· Certified Data Architecture and Management Designer

· Certified Sharing and Visibility Designer

· Certified Development Lifecycle and Deployment Designer

· Certified Integration Architecture Designer.

· Shall have a minimum of two mid-level Industry Recognized certifications for each respective PaaS CoE ecosystem platforms (listed in Attachment 6) for which PaaS CoE the resource is assigned to.

Shall have extensive experience (a minimum of five years) and depth of understanding of all other PaaS CoE ecosystem platforms and experience with large scale PaaS platforms deployments. The resource will oversee the PaaS CoE architecture from a technical perspective, lead and manage a Tier 2/Tier 3 Support and Sustainment team.

Project Manager (Project Manager/PSL)

· Shall have a minimum of an Associate’s Degree plus a minimum of four years’ experience, Bachelor’s Degree plus a minimum of two years’ experience, or, in lieu of a degree, five-years’ experience of relevant project management experience in managing multiple concurrent LCNC product and platform focused projects across various and asynchronous delivery lifecycle phases with individual project value over $5 million dollars each.

· One entry level industry recognized cloud/cyber certification is required, such as Certificate of Cloud Security Knowledge (CCSK), Security+, Systems Security Certified Practitioner (SSCP), etc.

· Written communication skills to provide actionable project plans, roadmaps, executive briefings focusing on outcomes and impact.

· Verbal communication skills to clearly articulate project deliverables, timeline constraints, action items, next steps, escalation levers, and blockers to customers, support members, and third-party participants.

Developer (Technical Configurator)

· Bachelor’s degree in computer science, information technology, or a related field

· Minimum of two years of professional experience working with LCNC platforms Proficiency (Certified) in one or more popular LCNC platforms such as Salesforce, Microsoft Power Apps, Pega, or Appian

· Strong problem-solving skills and the ability to translate business requirements into technical solutions

Developer, Senior (Senior LCNC Platform Engineer)

· Bachelor’s degree in computer science, information technology, or a related field

· Minimum of four years of work experience in software development and implementation

· Experience of leading a team with a minimum of five members

· Deep understanding of application design, development, support, and enhancement lifecycle

· Strong track record working as a technical lead to perform process analysis, gather business requirements, and develop/configure digital applications.

· Experience working in software development life cycle (Agile) across all phases including design, development, testing, implementation, deployment, and maintenance.

Business Analyst, Senior (IT Business Relationship Liaison) (Project Management/PSL Resource Manager)

· Associate’s degree plus a minimum of seven years’ experience, Bachelor’s degree plus a minimum of five years’ experience, or seven years’ experience can be substituted in lieu of a degree, for managing relationships across diverse audiences from technology partners, customers, end users, executive leadership, and vendors to objectively communicate project deliverables, expectations, and contingencies.

· One industry recognized cloud/cyber certification is required. CCSK, Security+, SSCP, etc.

· One industry recognized project management certification is preferred.

· Ability to communicate the requirements, feedback, and status of target solution delivery.

· Ability to communicate timeline considerations, escalation levers, deliverable contingencies, and completion goals.

· Verbal communication skills sufficient to understand your audience and communicate appropriately based on the context, role, rank, and requirements from a varied potential audience base.

· Written communication skills sufficient to understand your audience and communicate appropriately based on the context, role, rank, and requirements from a varied potential audience base. Must be able to clearly articulate dependencies in plain language with a call to action.

· Ability to strategize across audiences by applying knowledge of business architecture and LCNC system of system engineering to identify, manage, and resolve solution delivery risks, future requirements, and prioritization change management.

· Ability to leverage agile best practices to dynamically manage multiple projects with work in progress that may have external dependencies.

Functional Area Expert II (Security Lead) (Security Team Resource Manager)

· Shall have a minimum of five years’ experience with, and depth of understanding of, Platform Security requirements and experience with NIST security requirements on large scale deployments.

· Shall possess a current Certified Information Systems Security Professional (CISSP), no substitutions will be accepted.

· Shall have a minimum of five…