PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Office of Information & Technology Product Engineering Service (PES)

Geographic Information System (GIS) Support

Date: 4/24/2026

VA-27-00001461

PWS Version Number: 1.0

Geographic Information System Support

Contents

1.0 BACKGROUND

2.0 APPLICABLE DOCUMENTS

3.0 SCOPE OF WORK

4.0 PERFORMANCE DETAILS

4.1 PERFORMANCE PERIOD

4.2 ORDER TYPE

4.3 PLACE OF PERFORMANCE

4.4 TRAVEL OR SPECIAL REQUIREMENTS

4.5 KEY PERSONNEL

4.5.1 PERSONNEL REQUIREMENTS

5.0 SPECIFIC TASKS AND DELIVERABLES

5.1 PROJECT MANAGEMENT

5.1.1 CONTRACTOR PROJECT MANAGEMENT PLAN

5.1.2 TECHNICAL KICKOFF MEETING

5.1.3 ONBOARDING STATUS

5.1.4 PRIVACY, HIPAA, AND ELEVATED PRIVILEGES TRAINING

5.1.5 REPORTING REQUIREMENTS

5.2 SYSTEM SUPPORT

5.2.1 SYSTEM ADMINISTRATION

5.2.2 DATABASE ADMINISTRATION

5.2.2.1 DATABASE PATCHES

5.2.2.2 DATABASE UPGRADES

5.2.3 TROUBLESHOOTING

5.3 CUSTOMER SUPPORT

5.3.1 TRAINING

5.3.2 APPLICATION DEVELOPMENT

5.3.2.1 REQUIREMENTS ELABORATION

5.3.2.2 TESTING

5.3.3 END USER SUPPORT

5.4 TRANSISTION SUPPORT And Migration support

5.5 OUTGOING TRANSITION SUPPORT (OPTIONAL TASK 1)

6.0 GENERAL REQUIREMENTS

6.1 ENTERPRISE AND IT FRAMEWORK

6.1.1 VA TECHNICAL REFERENCE MODEL

6.1.2 ZERO TRUST – VA CRITICAL SECURITY CONTROLS

6.1.3 FEDERAL IDENTITY, CREDENTIAL, AND ACCESS MANAGEMENT

(FICAM) 22

6.1.4 INTERNET PROTOCOL VERSION 6 (IPV6)

6.1.5 TRUSTED INTERNET CONNECTION (TIC)

6.1.6 STANDARD COMPUTER CONFIGURATION

6.1.7 VETERAN FOCUSED INTEGRATION PROCESS (VIP) AND PRODUCT

LINE MANAGEMENT (PLM)

6.1.8 PROCESS ASSET LIBRARY (PAL)

6.1.9 AUTHORITATIVE DATA SOURCES

6.1.10 SOCIAL SECURITY NUMBER (SSN) REDUCTION

6.1.11 GENERATIVE ARTIFICIAL INTELLIGENCE REQUIREMENTS

6.1.11.1 AI SYSTEM/LLM DEVELOPMENT AND OPERATION

DOCUMENTATION REQUIREMENTS

6.1.11.2 MONITORING, REPORTING, AND CORRECTIVE ACTION

6.1.11.3 AI MODEL UPDATES AND CHANGE DISCLOSURES

6.1.12 SOURCE CODE HARMONIZATION AND REUSE IN INFORMATION

TECHNOLOGY (SHARE IT Act)

6.2 POSITION/TASK RISK DESIGNATION LEVEL(S)

6.2.1 CONTRACTOR PERSONNEL SECURITY REQUIREMENTS

6.3 METHOD AND DISTRIBUTION OF DELIVERABLES

6.4 PERFORMANCE METRICS

6.5 FACILITY/RESOURCE PROVISIONS

6.6 GOVERNMENT FURNISHED PROPERTY

ADDENDUM A – ADDITIONAL VA REQUIREMENTS, CONSOLIDATED

ADDENDUM B – VA INFORMATION AND INFORMATION SYSTEM SECURITY/

PRIVACY LANGUAGE

1.0 BACKGROUND

The Department of Veterans Affairs (VA), Office of Information & Technology (OI&T), Product Engineering Service (PES), Data and Analytics (DA) Pillar maintains a vision to provide positive outcomes for Veterans and their families through enabling a data-driven VA culture that continuously improves the delivery of world-class benefits and services.

This vision is supported by PES DA Pillar’s mission to deliver an integrated ecosystem of interoperable data management, discovery and analytics tools that enable evidence-based decision making grounded in the adoption of authoritative data sources across the VA Enterprise. PES DA Pillar manages a complex portfolio of platforms and products that empower the VA and OI&T specifically to support the increasing demand for data to meet the Department’s obligations to the Veteran community. PES DA Pillar is charged with ensuring VA’s enterprise data assets are Artificial Intelligence (AI) ready.

VA’s Geographic Information System (GIS) provides tools to assist VA staff and Contractors, program offices, and Veterans Integrated Service Networks (VISNs), in managing and analyzing geospatial data and utilize and incorporate geospatial data into applications, systems and reports to ultimately improve services to our nations veterans.

The GIS consists of the ArcGIS Enterprise software/servers, and ArcGIS datastores, hosted in the Corporate Data Warehouse (CDW).

The requirement for this contract is to provide system and customer support for the current GIS platform within the CDW, provide programming services to VA customers looking to utilize GIS data within their systems and assist VA in transitioning and consolidating GIS platforms within VA into a single platform which will be hosted within the VA Enterprise Cloud (VAEC) environment.

2.0 APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. “Federal Information Security Modernization Act of 2014”

2. Federal Information Processing Standards (FIPS) Publication 140-3, “Security

Requirements for Cryptographic Modules”, March 22, 2019

3. FIPS Pub 199. “Standards for Security Categorization of Federal Information and

Information Systems,” February 2004

4. FIPS Pub 200, “Minimum Security Requirements for Federal Information and

Information Systems,” March 2006

5. FIPS Pub 201-3, “Personal Identity Verification of Federal Employees and

Contractors,” January 2022

6. 10 U.S.C. § 2224, "Defense Information Assurance Program", as amended

7. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

8. Public Law 109-461 (P.L. 109-461), Veterans Benefits, Health Care, and

Information Technology Act of 2006, as amended, Title IX, Information Security Matters

9. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”, as amended

10. VA Directive 0710, “Personnel Vetting Program,” September 8, 2025, https://www.va.gov/vapubs/index.cfm

11. VA Handbook 0710, “Personnel Vetting Program,” September 8, 2025, https://www.va.gov/vapubs/index.cfm

12. VA Directive and Handbook 6102, “Internet/Intranet Services,” August 5, 2019

13. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and

Guidelines,” as amended

14. Office of Management and Budget (OMB) Circular A-130, “Managing Federal

Information as a Strategic Resource,” July 28, 2016

15. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed

Services (CHAMPUS)”, as amended

16. NIST SP 800-66 Rev. 2, “ Implementing the Health Insurance Portability and

Accountability Act (HIPAA) Security Rule: A Cybersecurity Resource Guide,” February 2024

17. 45 C.F.R Parts 160 and 164, Subparts A and E, the Standards for Privacy of Individually Identifiable Health Information (“Privacy Rule”); and 45 C.F.R. Parts 160 and 164, Subparts A and C, the Security Standard (“Security Rule”); as amended

18. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended,

19. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

20. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021 (see VA

NOTICE 24-18, dated September 27, 2024, “Update to VA Directive 6500 Cybersecurity Program”, and VA Notice 25-07, dated 3/18/25, “Amending VA Directive 6500 to incorporate M-24-15”)

21. VA Handbook 6500, “Risk Management Framework for VA Information Systems VA Information Security Program,” February 24, 2021 (see VA Notice 25-01, dated October 15, 2024, “Update to VA Handbook 6500 Risk Management Framework for VA Information Systems VA Information Security Program”, and VA Notice 25- 06, dated 3/18/25, “Amending VA Directive 6500 to incorporate M-24-15”, VA Notice 25-16, dated September 15, 2025, “Amending VA Handbook 6500 to Replace Enterprise Mission Assurance Support Services Tool With Office of Information Technology Governance Risk Compliance Tool, and VA Notice 25-17, dated September 22, 2025, “Rescission Of Office Of Information Security (OIS) Deputy Assistant Secretary (DAS) Memorandum – Requirements of Proper Plan of Action and Milestones (POA&M) Completion)

22. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI),” June 30, 2023

23. VA Handbook 6500.6, “Contract Security,” March 12, 2010 (see VA Notice 24-12, dated April 22, 2024, “Update to VA Handbook 6500.6, Contract Security, Appendix C VA Information and Information System Security/Privacy Language For Inclusion Into Contracts, As Appropriate”)

24. VA Handbook 6500.8, “Information System Contingency Planning,” March 25,

25. VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018 (see VA NOTICE 25-10, dated June 9, 2025, “Use of Personally Owned Mobile Devices Policy Amendment of Department of Veterans Affairs Handbook 6500.10”, and VA

Notice 25-15, dated August 22, 2025, “Update to VA Handbook 6500.10 Mobile Device Security Policy”)

26. VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017

27. OIT Process Asset Library (PAL), OIT Process Asset Library

28. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

29. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy

Impact Assessment,” October 15, 2014

30. VA Directive 6510, “VA Identity, Credential and Access Management,” September

3, 2024

31. VA Handbook 6510, “VA Identity, Credential and Access Management,”

September 27, 2024

32. VA Directive and Handbook 6513, “Secure External Connections,” October 12,

33. VA Directive 6300, “Records and Information Management,” September 21, 2018

34. VA Handbook, 6300.1, “Records Management Procedures,“ March 24, 2010

35. NIST SP 800-37 Rev 2, “Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy,” December 2018

36. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020)

37. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015

38. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” March 24, 2014

39. OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005

40. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019

41. OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008

42. Federal Identity, Credential, and Access Management (FICAM) Architecture, June 30, 2023 (FICAM Architecture (idmanagement.gov))

43. NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access,“ June 2018

44. NIST SP 800-63-3, 800-63A-4, 800-63B-4, 800-63C-4, “Digital Identity Guidelines,” August 1, 2025

45. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014

46. VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland

Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

47. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514) https://digital.va.gov/process-asset-library/ https://www.va.gov/trm/TRMHomePage.aspx https://www.idmanagement.gov/arch/#:~:text=FICAM%20is%20the%20federal%20government%E2%80%99s%20enterprise%20approach%20to,identity%20processes%2C%20practices%2C%20policies%2C%20and%20information%20security%20disciplines.

https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514 https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514

48. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

49. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

50. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019

51. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008

52. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (Public Law 110–140), December 19, 2007

53. Section 104 of the Energy Policy Act of 2005, (Public Law 109–58), August 8, 2005

54. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 2, 2001

55. Executive Order 14148, “Initial Rescissions of Harmful Executive Orders and

Actions,” dated January 20, 2025

56. VA Directive 0057, “VA Environmental Management Program,” October 25, 2022

57. OIS VAIQ #7424808 Memorandum, “Remote Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

58. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

59. “Veteran Focused Integration Process (VIP) Guide 4.0,” March 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

60. VA Memorandum “Proper Use of Email and Other Messaging Services,” January

2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

61. “Product Line Management Transformation Playbook” version 3.1, August 2023, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

62. NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020

63. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol

Version 6 (IPv6),” November 19, 2020

64. Social Security Number (SSN) Fraud Prevention Act of 2017

65. Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23, 2018

66. C.F.R Title 15 Part 7, “Securing the Information and Communications Technology and Services (ICTS) Supply Chain”, as amended

67. Executive Order 14028, “Executive Order on Improving the Nation's

Cybersecurity,” May 12, 2021, https://bidenwhitehouse.archives.gov/briefing-room/presidential-actions/2025/01/16/executive-order-on-strengthening-and-promoting-innovation-in-the-nations-cybersecurity/

68. OMB Memorandum M-22-09, “Moving the U.S. Government Toward Zero Trust Cybersecurity Principles”, January 26, 2022, https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf.

69. NIST SP 800-52 Revision 2, “Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations

70. OMB M-26-05, “Adopting a Risk-based Approach to Software and Hardware Security,” January 23, 2026

71. OMB M-21-31, “Improving the Federal Government’s Investigative and Remediation Capabilities Related to Cybersecurity Incidents,” August 27, 2021

72. NIST SP 800-88 Revision 1 “Guidelines for Media Sanitization,” December 2014 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896 https://www.cisa.gov/publication/tic-30-core-guidance-documents https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371 https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946 https://bidenwhitehouse.archives.gov/briefing-room/presidential-actions/2025/01/16/executive-order-on-strengthening-and-promoting-innovation-in-the-nations-cybersecurity/ https://bidenwhitehouse.archives.gov/briefing-room/presidential-actions/2025/01/16/executive-order-on-strengthening-and-promoting-innovation-in-the-nations-cybersecurity/ https://bidenwhitehouse.archives.gov/briefing-room/presidential-actions/2025/01/16/executive-order-on-strengthening-and-promoting-innovation-in-the-nations-cybersecurity/ https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf

73. CISA Binding Operational Directive (BOD) 19-02: “Vulnerability Remediation Requirements of Internet-Accessible Systems,” April 29, 2019, BOD 19-02:

Vulnerability Remediation Requirements for Internet-Accessible Systems | CISA

74. CISA BOD 22-01: “Reducing the Significant Risk of Known Exploited Vulnerabilities,” November 3, 2021, BOD 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities | CISA

75. CISA BOD 23-01: Improving Asset Visibility and Vulnerability Detection on Federal Networks.” Cybersecurity & Infrastructure Security Agency (CISA), BOD 23-01:

Improving Asset Visibility and Vulnerability Detection on Federal Networks | CISA

76. VA Directive 6550, Pre-Procurement Assessment and Implementation of Medical Devices/Systems, June 03, 2019

77. VA Memorandum, “VA Security Controls,” January 17, 2025, https://www.voa.va.gov/DocumentView.aspx?DocumentID=5010

78. E.O. 13960, “Promoting the Use of Trustworthy Artificial Intelligence in the Federal Government,” December 3, 2020

79. E.O. 14319, “Preventing Woke AI in the Federal Government,” July 23, 2025

80. OMB Memorandum M-25-21, “Accelerating Federal Use of AI through Innovation, Governance, and Public Trust,” April 3, 2025

81. OMB Memorandum M-25-22, “Driving Efficient Acquisition of Artificial Intelligence in Government,” April 3, 2025

82. OMB Memorandum M-26-04, “Increasing Public Trust in Artificial Intelligence (AI)

Through Unbiased AI Principles,” December 11, 2025

83. FedRAMP Authorization Act, December 23, 2022

84. VA SaaS Definition - Attachment 1

85. Existing VA Enterprise Case Management Solutions (VECMS) Solutions -

Attachment 2

86. Third-party systems – Attachment 3

Please be advised that any hyperlinks contained within this document, if any, are for convenience purposes, only. Due to the dynamic nature of hyperlinks and the information accessed through or imbedded therein, it is incumbent upon the Contractor to ensure that all information required to successfully complete the requirements established herein is independently located, verified for accuracy, and confirmed to be the most up-to-date version available, prior to use.

3.0 SCOPE OF WORK

The Contractor is required to provide system support of the GIS platform currently residing within the CDW. This support includes system admin and database admin support as well as troubleshooting issues between the ArcGIS system and third-party systems. The third-party systems that the ArcGIS system interfaces with are identified in Attachment 3. The Contractor shall also provide customer support including but not limited to the following areas: programming which includes web map/app development, automation scripting, geocoding, analysis, and integration into third party systems.

Customer training and providing help support for general user inquiries. The Contractor shall provide the key personnel identified that possess the requisite GIS experience as https://www.cisa.gov/news-events/directives/bod-19-02-vulnerability-remediation-requirements-internet-accessible-systems https://www.cisa.gov/news-events/directives/bod-19-02-vulnerability-remediation-requirements-internet-accessible-systems https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities https://www.cisa.gov/news-events/directives/bod-23-01-improving-asset-visibility-and-vulnerability-detection-federal-networks https://www.cisa.gov/news-events/directives/bod-23-01-improving-asset-visibility-and-vulnerability-detection-federal-networks https://www.voa.va.gov/DocumentView.aspx?DocumentID=5010 https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-21-Accelerating-Federal-Use-of-AI-through-Innovation-Governance-and-Public-Trust.pdf https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-22-Driving-Efficient-Acquisition-of-Artificial-Intelligence-in-Government.pdf https://www.whitehouse.gov/wp-content/uploads/2025/12/M-26-04-Increasing-Public-Trust-in-Artificial-Intelligence-Through-Unbiased-AI-Principles-1.pdf?_bhlid=c0113a16495d987bc33f63e3dccf35c28d6bfd15 identified in the labor category description. There will be an optional task to support the VA staff in transitioning the current ArcGIS system within the CDW to the VAEC and assisting in the consolidation of all GIS platforms across VA into one platform housed within the VAEC.

Additionally, the Contractor must adhere to VA Handbook 6500-series policies, Service Level Agreements (SLAs), and ATO requirements.

4.0 PERFORMANCE DETAILS

4.1 PERFORMANCE PERIOD

The Period of Performance (PoP) shall consist of one 12-month base period, four 12-month option periods, and includes 1 Optional Task. The overall PoP shall not exceed 63 months.

Any work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO).

There are 11 Federal holidays set by law (USC Title 5 Section 6103) that VA follows.

Under current definitions, five are set by date:

New Year's Day January 1 Juneteenth June 19 Independence Day July 4 Veterans Day November 11 Christmas Day December 25

If any of the above falls on a Saturday, then Friday shall be observed as a holiday.

Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

Martin Luther King's Birthday Third Monday in January Washington's Birthday Third Monday in February Memorial Day Last Monday in May Labor Day First Monday in September Columbus Day Second Monday in October Thanksgiving Fourth Thursday in November

4.2 ORDER TYPE

The effort shall be proposed on a Firm Fixed Price (FFP) basis and a Direct Reimbursable (DR) line item for travel.

4.3 PLACE OF PERFORMANCE

The work to be performed under this TO shall be performed at Contractor furnished facilities and work may be performed at remote locations with prior concurrence from the Contracting Officer’s Representative (COR). Work shall be conducted during core business hours of 8:00am-5:00pm EST, unless specified otherwise. For specific meeting types, including user requirements sessions and other key meetings which are best accomplished at Government facilities, the Government will schedule meeting rooms as necessary. No work under this TO shall take place outside the United States.

If required, all travel will be pre-approved by the COR. The Contractor shall identify the Contractor’s place of performance in their proposal submission.

4.4 TRAVEL OR SPECIAL REQUIREMENTS

The Government does not anticipate travel to perform the tasks associated with the effort but if required it will be funded on a direct reimbursement basis.

4.5 KEY PERSONNEL

4.5.1 PERSONNEL REQUIREMENTS

The Contractor shall provide resources that have the requisite skills and experience required to perform the tasks within the PWS. The Contractor agrees that the personnel identified below, as key to supporting the efforts, shall not be removed from the TO effort, replaced or added to the TO without a compelling reason and without written notification to the Contracting Officer (CO). It is the responsibility of the Contractor to provide Contractor support personnel and subcontractors who have the required experience, security clearance, and access authorization or combination thereof to meet the labor category descriptions under this task order for the required PWS tasks. The Contractor agrees that it has a contractual obligation to mitigate the consequences of the loss of Key Personnel and shall promptly secure any replacements IAW this PWS section.

All Contractor personnel shall possess demonstrated proficiency in ArcGIS technology.

The labor categories below are identified as Key Personnel. Key Personnel must meet the corresponding requirements identified in the Labor Description column below:

Labor Category

Labor Description Minimum Years Experience

GIS System Administrator

Manages the virtual machines (VMs), software, and cloud resources needed to keep ArcGIS Enterprise running and configured correctly. Able to

5-10 Yr troubleshoot problems with ArcGIS Enterprise and third-party systems.

GIS Database Administrator

Manges all Structured Query Language (SQL) Server instances and Spatial Database Engine (SDE) geodatabases. Able to load, transform, and update GIS data without the ArcGIS interface.

5-10 Yr

GIS Analyst

Provides customer support and training to VA GIS users. Able to conduct GIS analyst and create maps (both printable and web maps).

Knowledgeable in CAD/BIM/LAS data and software.

3-5 Yr

GIS

Programmer

Able to write python, JavaScript, and web applications using ArcGIS APIs.

5-7 Yr

5.0 SPECIFIC TASKS AND DELIVERABLES

The Contractor shall perform the following:

5.1 PROJECT MANAGEMENT

5.1.1 CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, timeline and tools to be used in execution of this TO effort. The CPMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks and resource support. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPMP shall be concurred upon and updated in accordance with Section B of the TO.

The Contractor shall update and maintain the VA Program Manager (PM) approved CPMP throughout the PoP.

Deliverable:

A. Contractor Project Management Plan

5.1.2 TECHNICAL KICKOFF MEETING

A technical kickoff meeting shall be held within 10 days after TO award. The Contractor shall coordinate the date, time, and location (can be virtual) with the Contracting Officer (CO), as the Post-Award Conference Chairperson, the VA PM, as the Co-Chairperson, the Contract Specialist (CS), and the COR. The Contractor shall provide a draft agenda (via email) to the CO, CS, COR, and VA PM at least five (5) calendar days prior to the meeting. Upon Government approval of a final agenda, the Contractor shall distribute to all meeting attendees). During the kickoff-meeting, the Contractor shall present, for review and approval by the Government, the details of the intended approach, work plan, and project schedule for each effort via a Microsoft Office PowerPoint presentation. At the conclusion of the meeting, the Contractor shall update the presentation with a final slide entitled “Summary Report” which shall include notes on any major issues, agreements, or disagreements discussed during the kickoff meeting and the following statement “As the Post-Award Conference Chairperson, I have reviewed the entirety of this presentation and assert that it is an accurate representation and summary of the discussions held during the Technical Kickoff Meeting for the GIS support effort.” The Contractor shall submit the final updated presentation to the CO for review and signature within three (3) calendar days after the meeting. The Contractor shall also work with the CS, the Government’s designated note taker, to prepare and distribute the meeting minutes of the kickoff meeting a to the CO, COR and all attendees within three (3) calendar days after the meeting. The Contractor shall obtain concurrence from the CS on the content of the meeting minutes prior to distribution of the document.

Deliverables:

A. Draft Agenda B. Final Agenda C. Kickoff Meeting Power Point Presentation D. Meeting Minutes

5.1.3 ONBOARDING STATUS

The Contractor shall manage the onboarding of its staff on this TO. Onboarding includes steps to obtain a VA PIV card, network and email account, complete training, initiate background investigations, and gain physical and logical access. In addition, the Contractor shall identify individuals which may require elevated privileges to the necessary development, test and/or production environments for the various systems to be enhanced. After review between the Contractor and VA COR(s), a decision will be made as to the necessity of obtaining GFE for the onboarding staff. If approved, Contractor shall follow the appropriate steps to obtain the equipment. A single Contractor Onboarding Point of Contact (POC) shall be designated by the Contractor that tracks the onboarding status of all Contractor personnel. The Contractor Onboarding POC shall be responsible for accurate and timely submission of all required VA onboarding paperwork to the VA COR(s). All VA onboarding paperwork shall be stored on the deliverables folder in the COR designated VA SharePoint site or equivalent tool. The Contractor shall be responsible for tracking the status of all their staff’s onboarding activities to include the names of all personnel engaged on the task, their initial training date for VA Privacy and Information Security training, and their next required training date. The Contractor Onboarding POC shall also report the status at the staff level during onboarding status meetings. The Contractor shall provide an Onboarding Status Report for all staff in the Monthly Status Report (5.1.5).

5.1.4 PRIVACY, HIPAA, AND ELEVATED PRIVILEGES TRAINING

The Contractor shall submit Talent Management System (TMS) training certificates of completion for VA Privacy and Information Security Awareness and Rules of Behavior and Health Insurance Portability and Accountability Act (HIPAA) training and provide signed copies of the Contractor Rules of Behavior in accordance with Section 9, Training, from Appendix C of the VA Handbook 6500.6, “Contract Security”. The Contractor shall provide a copy of the Privacy, HIPAA and Elevated Privileges Training Roster to indicate the staff that have and have not completed the training in the monthly Status Report (5.1.5).

Deliverables:

A. VA Privacy and Information Security Awareness and Rules of Behavior

Training Certificate B. Signed Contractor Rules of Behavior C. VA Health Insurance Portability and Accountability Act (HIPAA) Training

Certificate

5.1.5 REPORTING REQUIREMENTS

The Contractor shall provide the COR with a Monthly Status Report using a modern, automated tool. The report shall include detailed instructions/explanations for each required data element, to ensure that data is accurate and consistent. The report shall reflect data as of the last business day of the preceding period. The Progress Report shall cover all work completed during the reporting period and work planned for the subsequent reporting period. The report shall also identify any problems that arose and a description of how the problems were resolved. If problems have not been completely resolved, the Contractor shall provide an explanation including their plan and timeframe for resolving the issue. The report shall also include an itemized list of all documents and electronic deliverables. The Contractor shall monitor performance against the VA PARS/CPMP and report any deviations. It is expected that the Contractor will keep in communication with VA accordingly so that issues that arise are transparent to both parties to prevent escalation of outstanding issues. The Contractor shall also provide the data and reporting content to support management level reporting.

The Contractor shall show all Agile requirements, changes, tests performed and test results in approved project management tools (i.e., JIRA) to show evidence of code coverage and test coverage of all the requirements specified. This expectation will allow VA to have high confidence in a fully documented, as evidenced by data in the tools, requirements traceability matrix.

The Contractor shall track all risks in the VA approved project management tool utilized by the team they are supporting. This could include Jira, MS Project or other industry standard tools. Risk identification should include impact statements including severity, likelihood of impact and a proposed mitigation strategy. Risk status should be reviewed and updated at least once per week. Risks that are impactful to the product, the Pillar or Portfolio should be documented in the associated VA PARS entry for the product/program.

A. Monthly Status Report

5.2 SYSTEM SUPPORT

The contractor shall perform the following tasks:

5.2.1 SYSTEM ADMINISTRATION

The Contractor shall manage the VMs, software, and cloud resources needed to keep ArcGIS Enterprise running and configured correctly. The Contractor shall support IT hardware, operating systems, installation of software, monitoring and adjusting system performance, application of patches, security updates and service packs, repairs and upgrades of IT software and hardware associated with the ArcGIS Enterprise system.

The Contractor shall monitor system resources such as processor, memory and disk utilization using VA approved automated monitoring tools, monitor system logs, create system backups, schedules and tape allocations, establish/maintain access authorizations, perform installations, upgrades or replacements as required.

The Contractor shall receive issues and report resolution progress using VA approved tools. These could include ServiceNow, Service Desk Manager, Rational or another similar tool. The Contractor will be required to troubleshoot problems with the ArcGIS Enterprise and third-party systems. Third-party systems are identified in Attachment 3.

The Contractor shall:

1. Perform advanced system analysis and operational support for GIS and data platform environments, including root cause analysis (RCA) of complex backend issues. Activities include log analysis, performance monitoring, trend analysis, and identification of data anomalies impacting system functionality. Support installation, configuration, patching, and sustainment of GIS enterprise software and associated web services, ensuring system stability, security compliance, and optimal performance.

2. Manage, intake, report and resolve as many as 10-15 incidents a week., to a high trend of 15-20 incidents a week. Incident management shall include triage, analysis, root cause, and resolution for each data incident.

3. Manage, intake, report, coordinates, analyzes, and report and triage complex issues. The Contractor shall complete analysis, trend pattern reviews, and RCA, and provide recommended solutions to prevent and correct issues.

4. For production support, help desk tickets and data triage:

a. Determine root cause in missing or mismatched data causing features to not function

b. Execute high-level, complex, data integrity analysis

c. Determine if the ticket is due to data issues

d. When a ticket is identified as a data issue, apply the current data correction process.

e. Forward information for resolution to the identified data authority.

f. Meet weekly, to improve processes, check, and update the status of data corrections

g. When that data is corrected, contact the customer to verify the correction

h. Support triage status, tasks, and escalation on tickets.

5. Complete operational analysis related to data issues, including development of data queries, to identify data inconsistency patterns. Queries shall be developed, maintained and executed in a recurring pattern to identify data-related issues.

Reports from query results are shared and reported with the VA PM and security officer.

6. Develop analysis processes and fraud pattern analysis, identifying users and populations in portals, to identify possible threats for data compromise

7. Resolve complex data issues: a) data patterns, b) trends, and c) understanding of database structures and entities and relationship between primary and foreign key indicators. The Contractor shall develop queries to retrieve and analyze data and develop corrective scripts to fix data inconsistencies.

8. The Contractor shall manage user and service accounts in accordance with VA security policies, including provisioning, deprovisioning, access modifications, and account auditing. This includes administration of service accounts, enforcement of least privilege principles, credential management, and implementation of corrective actions such as account locking, disabling, or escalation in response to security incidents or anomalous activity.

5.2.2 DATABASE ADMINISTRATION

The Contractor shall provide system-level database administration including software installation and maintenance, backup and recovery, and writing and maintaining scripts to automate tasks in support of customer database environments.

The Contractor shall perform the following tasks:

1. The Contractor shall administer and support SQL Server instances and SDE geodatabases, operation under the direction of the Government-designated Senior DBA and EGT team lead, to ensure availability, performance, and integrity of GIS data environments.

2. The Contractor shall perform ETL operations on GIS data, including loading, transforming, and updating datasets using SQL, Python, and automated scripts independent of the ArcGIS user interface.

3. Provide database storage management and develop, maintain, and track database storage for reporting and trend analysis

4. Manage database communication software configuration, installation, and maintenance.

5. Open, track, triage, and resolve database related incidents in accordance with defined SLAs, ensuring timely escalation, root cause analysis (RCA), and documentation of corrective actions.

6. Generate automated security notifications for security exceptions per government security policy and procedures.

7. Monitor database environments through review of audit logs, alert logs, trace files, and system logs, and generate automated alerts and tickets for performance degradation, failures, or security anomalies.

8. Provide database support services to application teams, including performance tuning, query optimization, and support for non standard backup and recovery requirements, in coordination with the Senior DBA.

9. Implement and administer database management tools across all database instances including ensuring the availability of performance metrics and historical data for trending and reporting over a minimum of 12 months.

10. The Contractor shall troubleshoot and maintain SDE geodatabases, including identifying and correcting orphaned records, managing versioning workflows, reconciling and posting edits, compressing geodatabases, and archiving datasets and database objects in accordance with data lifecycle policies.

11. Maintain consistency of non-sizing and non-platform specific database parameters and system settings across all like instances according to established software development life cycle (SDLC).

12. Maintain documentation for all database instance parameters and system settings.

13. Execute all database system-level changes (initialization parameters)

14. Execute database creation, configuration, and refresh.

5.2.2.1 DATABASE PATCHES

The Contractor shall perform the following database and geodatabase patching activities in accordance with established SDLC and security guidelines, including SQL server and SDE/ArcGIS Enterprise environments.

Activities shall include:

1. Apply database and SDE/geodatabase patches, updates, and hotfixes in accordance with vendor guidance and VA SDLC processes.

2. Execute security patches in compliance with VA security policies and timelines.

3. Perform emergency and out of band patching as required or directed by the

Government.

4. Validate patching in development and test environments prior to production deployment.

5. Coordinate patching activities with application, GIS, and infrastructure teams to minimize service disruption and ensure compatibility.

5.2.2.2 DATABASE UPGRADES

The Contractor shall perform database and SDE/geodatabase upgrades when requested by the Government, including:

1. Conduct upgrade assessments in non production environments and develop a documented upgrade plan, including risk, rollback, and validation procedures for Government approval.

2. Execute upgrades in development and test environments and validate system, application, and GIS functionality prior to production deployment.

3. Implement approved upgrades in production, ensuring minimal downtime and full system integrity.

5.2.3 TROUBLESHOOTING

The Contractor shall provide routine troubleshooting support to resolve issues between ArcGIS and third party systems. The Contractor shall support in meeting all SLAs that the customer has for support with the ArcGIS Program Office.

5.3 CUSTOMER SUPPORT

The Contractor shall provide customer support as detailed below.

5.3.1 TRAINING

The Contractor shall provide training for the ArcGIS system and how it can apply to VA systems across the Enterprise. The training shall be tailored to VA users that currently access ArcGIS data and for customers that have limited knowledge of ArcGIS capabilities and benefits. The training should be tailored to the knowledge and skill level of the target audience. Topics that should be covered include but not limited to capabilities of the ArcGIS system, how to access and gather data from ArcGIS, potential use cases, and the benefits to veterans of incorporating ArcGIS data into end systems and applications.

To accomplish the training objectives the Contractor shall provide Virtual training to the VA as specified below.

1. Perform collaborative sessions with the VA ArcGIS team throughout the process of developing training materials to ensure that they meet the needs of the team.

2. Provide a walk-through of all training materials prior to the start of training sessions to the end users.

3. Conduct weekly virtual office hours to support VA users, including and combination of instructional demonstrations and open question and answer (Q&A). Each session shall include approximately 30 minutes of user support.

The Contractor shall track attendance, capture user questions and issues and incorporate feedback into updates to training materials.

4. Develop, update and maintain training materials, user guides, and online help artifacts to be consistent with system enhancements. Additionally, all training materials shall remain current and shall be updated to reflect the most current information.

The Contractor shall provide a minimum of two (2) training sessions per month and track attendance, user feedback, and satisfaction. Training effectiveness shall be measured and reported in the Monthly Status Report.

A. User Guides

B. Monthly Status Report

5.3.2 APPLICATION DEVELOPMENT

The Contractor shall provide application development support in response to end user requests to interface their system/application with the ArcGIS system. This support requires developing code in Python, Java Script and in creating web applications using the ArcGIS APIs. Extensive experience in these areas is required. The Contractor shall work with the customer on their requirements and develop a project plan that details the approach of development and the schedule to completion. Once the Requirements elaboration as defined below is completed the projects will be designated as s small, medium and large as approved by the VA PM. The definition of a small, medium or large project is as defined below.

Small Project:

Discrete task or enhancement with a narrowly defined scope, typically completed within 1 week or less, such as minor data updates, script modifications, or configuration changes.

Medium Project:

Moderate effort involving multiple tasks or components, typically completed within 2 to 6 weeks, such as workflow enhancements, data integrations, or development of new scripts/tools supporting GIS or data operations.

Large Project:

Complex initiative involving multiple stakeholders, systems, or data domains, typically exceeding 6 weeks in duration, such as major system enhancements, platform integrations, or development of new capabilities requiring design, testing and deployment coordination.

The Contractor shall support a mix of small, medium, and large projects as defined above, based on Government priorities and workload demands. Project assignments shall be managed and prioritized in coordination with the VA PM.

5.3.2.1 REQUIREMENTS ELABORATION

The Contractor shall conduct requirement sessions with the VA business customer, users and OI&T Staff to properly understand and refine business requirements for implementation. The outcome shall be a detailed understanding of business customer needs which shall be documented in a Requirements document. The Contractor shall track and report development performance, including number of projects delivered, adherence to schedule, and defect rates.

A. Requirements Document

5.3.2.2 TESTING

Any code developed should be tested in a pre-production environment before being deployed in a production environment. Conduct Pre-Production (Pre-Prod) testing in a Pre-Prod environment inside the VA firewall. The Contractor shall coordinate with the appropriate teams prior to release to ensure compliance with VA release processes.

Gate reviews are performed in the Pre-Prod environment prior to code promotion to production environments. Before testing commences, the Contractor shall develop a Test Plan and receive Government approval.

1. Promote code to the Production Environment after the successful completion of testing environments.

Manage the production environment to meet SLAs, escalate and resolve defects, and maintain a sustainable operating production environment

A. Test Plan

5.3.3 END USER SUPPORT

The Contractor shall provide end user support for VA ArcGIS systems, including assisting users with accessing, using, and troubleshooting GIS data and troubleshooting GIS data and applications.

Support activities include:

• Creating and maintaining we maps and indoor floor plans that require knowledge of CAD/BIM/LAS data and associated tools.

• Analyzing GIS applications and system issues to identify root causes and provide resolution.

• Resolving Tier 1 and Tier 2 support issues that do not require escalation to the VA Enterprise Service Desk.

• Providing guidance and best practices for end users to improve effective use of GIS capabilities.

5.4 TRANSISTION SUPPORT AND MIGRATION SUPPORT

The Contractor shall provide support to the VA for the transition and consolidation of ArcGIS environments, including migration of systems currently hosted within the CDW environment to the VAEC, as well as the integration of other VA ArcGIS instances into a unified enterprise environment.

These efforts are a core component of this contract and will be performed throughout the period of performance as directed by the Government:

1. Support in the migration of hosted applications, middleware components, databases and utilities installed on or associated with each hosted server instance or image including backup and recovery scripts and schedules from the current host environment to the VAEC.

2. Help to ensure that other environments are reconstituted in the VAEC to include sandbox, Testing environments, Pre-Production and Production environments.

3. Work to ensure that migrated data in the VAEC has been properly transferred and is in sync with production data prior to system cutover.

4. Assist the Government in all system testing (to include but not limited to user, performance, regression) to ensure that the ArcGIS system and components and the interfaces to third party systems/applications are functioning properly and meets all requirements.

Once other ArcGIS environments are migrated to form a combined single ArcGIS system most of the same support tasks will be required to be performed by the Government with support by the Contractor. The Contractor shall support the Government in Authority to Operate (ATO) activities to achieve a new ATO within the VAEC environment. The Contractor shall provide migration plans, status reporting, and risk mitigation strategies for all transition activities.

The Contractor shall track and report migration progress, including number of systems migrated, data validation results, and system availability post migration. Migration activities shall ensure minimal disruption to operations and meet Government defined acceptance criteria.

5.5 OUTGOING TRANSITION SUPPORT (OPTIONAL TASK 1)

The Contractor shall provide a plan for 90 days of outgoing transition support for transitioning work from the current TO to a follow-on TO or Government entity. The Contractor shall ensure a complete and orderly transition of all services, knowledge, and artifacts to the Government or follow on Contractor to prevent disruption of operations. This Transition Plan shall include, but is not limited to:

1. Coordination with Government representatives.

2. Review, evaluation and transition of current support services.

3. Transition of historic data to new Contractor system.

4. Disable access to VA approved tool accounts.

5. Transfer of hardware and software warranties, maintenance agreements and licenses.

6. Transfer of all necessary business and/or technical documentation.

7. Orientation phase and program to introduce Government and

Contractor personnel, programs, and users to the Contractor's team, tools, methodologies, and business processes.

8. Disposition of Contractor purchased Government owned assets.

9. Turn in of all Government keys, ID/access cards, and security codes.

10. Transition of all programing source codes, source documents, and associated operations and maintenance procedure documents.

11. Provide transition plan, project management transition documents, technical management transition documents.

12. Provide project technical, and operations and maintenance procedure transition training.

13. Conduct knowledge transfer sessions for all functional areas

14. Provide complete and up to date system, operational, and technical documentation

15. Support a transition overlap period as directed by the Government

16. Validate transfer of all data, code, and configurations

17. Ensure all access is properly transferred or revoked

18. Support Government acceptance of transition completion prior to contract closeout

A. Transition Plan

6.0 GENERAL REQUIREMENTS

6.1 ENTERPRISE AND IT FRAMEWORK

6.1.1 VA TECHNICAL REFERENCE MODEL

The Contractor shall comply with the VA OIT Technical Reference Model (VA TRM).

Compliance with the VA TRM is achieved by using only technologies and standards that are listed as approved for use in the VA TRM. The Contractor shall provide all necessary information requested by VA to ensure TRM approval is obtained prior to use on VA’s network.

6.1.2 ZERO TRUST – VA CRITICAL SECURITY CONTROLS

VA has established minimum mandatory security requirements and requires that any network connected software system or service must meet the VA Critical Security Controls as outlined in the VA Memorandum, “VA Security Controls”, https://www.voa.va.gov/DocumentView.aspx?DocumentID=5010.