P09_RFI PWS Health Agile Development Enhancement Modernization and Sustainment Services_1.27.26.docx

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Office of Information & Technology Product Delivery Service

Health Agile Development Enhancement Modernization and Sustainment Services

Date: January 27, 2026

VA-26-00011357

Task Order PWS Version Number: 1.0

Contents

1.0 BACKGROUND

The mission of the Department of Veterans Affairs (VA), Office of Information & Technology (OIT), Health Services Portfolio, is to provide IT services for all the medical centers, clinics and military installations for Veterans. In meeting these goals, OIT strives to provide high quality, effective, and efficient Information Technology (IT) services to those responsible for providing care to the Veterans at the point-of-care as well as throughout all the points of the Veterans’ health care in an effective, timely and compassionate manner.

VA OIT PDS, Health Services Portfolio (HSP) delivers world-class, Veteran-centric capabilities that provide secure, seamless delivery of services to Veterans and their families. The HSP consists of ten product lines that consist of a variety of products that deliver Veteran-centric technology solutions that are available, adaptable, secure, and cost-effective.

The HSP products are essential to the success of modernizing and providing seamless care to Veterans and delivering quality and effective care in VA medical centers, clinics and outpatient sites and in the community. The continual sustainment, development, modernization, enhancement and integration of the HSP products is necessary to provide an improved and unified healthcare system for Veterans, without the complexities of developing and maintaining technical architecture. This Task Order (TO) will provide development and sustainment support to all HSP Products, including but not limited to, Clinical Services, Patient Care Services, Veterans Health Administration (VHA) Finance, Health Informatics, Community Care, Healthcare Environment and Logistics Management (HELM), Scheduling and Telehealth, Discovery, Education and Affiliate Networks (DEAN), Clinical Imaging, and VHA Front Office. Under the product line management (PLM) model, VA teams are directly led and managed by product managers and operations managers.

Within Health Services, the product lines and teams within each line require support to develop, test, deploy, and operate and maintain products and solutions to meet business needs across VA. Product backlogs provide descriptions of planned development and sustainment work.

VA employs a Development, Security, and Operations (DevSecOps) methodology and Agile practices focused on bringing about business value through continuous delivery and improvement. The requirements identified in this PWS are intended to provide development, testing, deployment, and security and operations support for legacy, current, and future products or services in a DevSecOps lifecycle.

2.0 APPLICABLE DOCUMENTS

The Contractor shall comply with the following documents in the performance of this effort:

1. Federal Risk and Authorization Management Program (FedRAMP), “FedRAMP Standard Contractual Clauses”, June 2017 (www.fedramp.gov/documents)

2. VA Enterprise Cloud (VAEC) Technical Reference Guide, Version 2.0 November 2022.

3. VA Cloud-First Policy, January 16, 2018.

4. Use of Cloud-Based Native Technologies and Approaches, October 29, 2019.

5. Health Services Product List

6. DevSecOps Tools and the Delivery Process

7. Current Health Intake Process

8. Architecture Standard Operating Framework

9. Key Performance Indicators (KPIs) for DevSecOps Support/

10. FY25 Sustainment Data

11. Product Line Architecture (PLA) - VA Enterprise Architecture

12. OMB Memo M-24-04, Fiscal Year Guidance on Federal Information Security and Privacy Management Requirements, https://www.whitehouse.gov/wp-content/uploads/2023/12/M-24-04-FY24-FISMA-Guidance.pdf

13. Health Financial Product Line ASOF

3.0 SCOPE OF WORK

The Contractor shall provide shippable products, operations support, and security compliance for the Health Services Portfolio. A shippable product is defined as health services related software, code or interface that has been deployed to a production like environment, validated through testing, monitored for resiliency, and determined to be operable and available for customers. This support includes all development, testing, integration, architecture (with concurrence from enterprise and product line architecture), refactoring as needed, and all ongoing planned and unplanned operations and maintenance support to include predictive, preventative, corrective, and evolutionary through a cycle of Continuous Integration. The Contractor shall comply with any applicable VA/Veterans Health Administration (VHA) or other Government mandates, as necessary. The Contractor shall follow the Lifecycle described in PWS Section 5.3, including all subparagraphs of this PWS. The development cycle will require teams of various sizes and resources to meet the business needs which are subject to continuous evolution. Each product or project to receive services through this TO will be subject to an intake and evaluation process prior to award in order to properly identify scope, associated tasks, deliverables, and applicable staff size. Approval to proceed with each individual product or project will be provided by the Product Managers, Contracting Officer Representative (COR) or their designees.

3.1 APPLICABILITY

TBD

3.2 ORDER TYPE

The effort shall be proposed on a Firm Fixed Price (FFP) basis with a Cost Reimbursement line item for travel.

4.0 PERFORMANCE DETAILS

4.1 PERFORMANCE PERIOD

The Period of Performance (PoP) shall be one 12-month base period with two 12-month option periods and two optional tasks, if exercised.

4.2 PLACE OF PERFORMANCE

Efforts under this TO shall be performed at Contractor facilities. The Contractor shall identify the Contractor’s place of performance in their Task Execution Plan submission.

When travel is required, work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO) or the COR.

4.3 TRAVEL OR SPECIAL REQUIREMENTS

The Government encourages the Contractor to maximize its use of teleconferencing and video conferencing for meetings.

The Government anticipates travel to perform the tasks associated with the effort, as well as to attend program-related meetings or conferences throughout the PoP.

Travel and per diem shall be in accordance with the Federal Travel Regulations (FTR) and requires advanced concurrence by the COR. The Contractor shall provide cost estimates with each travel request. Each Contractor invoice must include copies of all receipts that support the travel costs claimed in the invoice. Local travel within a 50-mile radius from the Contractor’s normal duty location is considered the cost of doing business and will not be reimbursed. This includes travel, subsistence, and associated labor charges for travel time. Travel performed for personal convenience and daily travel to and from work at the Contractor’s facility will not be reimbursed. Travel, subsistence, and associated labor charges for travel time for travel beyond a 50-mile radius of the Contractor’s facility are authorized on a case-by-case basis and must be pre-approved by the COR.

The total number of trips in support of this effort for the entire PoP is estimated to be 50 trips, with five people traveling for an average of four days per trip.

Anticipated travel locations include, but are not limited to, the following:

1. Washington, DC

2. Austin, TX

3. Eatontown, NJ

4. Salt Lake City, UT

4.4 GOVERNMENT FURNISHED PROPERTY

The Government has multiple remote access solutions available to include Citrix Access Gateway (CAG) and RESCUE VPN.

The Government’s issuance of Government Furnished Equipment (GFE) is limited to Contractor personnel requiring direct access to the network to: development environments; install, configure and run Technical Reference Model (TRM) approved software and tools (e.g., Oracle, Fortify, Eclipse, SoapUI, WebLogic, LoadRunner); upload/download/ manipulate code, run scripts, and apply patches; configure and change system settings; check logs, troubleshoot/debug, and test/QA.

When necessary, the Government will furnish desktops or laptops, for use by the Contractor to access VA networks, systems, or applications to meet the requirements of this PWS. The overarching goal is to determine the most cost-effective approach to providing needed access to the VA environment coupled with the need to ensure proper Change Management principles are followed. Contractor personnel shall adhere to all VA system access requirements for on-site and remote users in accordance with VA standards, local security regulations, policies, and rules of behavior. GFE shall be approved by the COR and Program Manager on a case-by-case basis prior to issuance.

Based upon the Government assessment of remote access solutions and requirements of this TO, the Government estimates that the following GFE will be required by this TO:

1. 900 standard laptops

The Government will not provide IT accessories including but not limited to Mobile Wi-Fi hotspots/wireless access points, additional or specialized keyboards or mice, laptop bags, extra charging cables, extra Personal Identity Verification card readers, peripheral devices, or additional Random Access Memory (RAM). The Contractor is responsible for providing these types of IT accessories in support of the TO as necessary and any VA installation required for these IT accessories shall be coordinated with the COR.

The Contractor shall provide a status of all reportable GFE as part of the Status Report as required by paragraph 5.1 and shall be delivered to the COR/VA PM as required.

The Contractor shall be provided access to Government Equipment such as servers, networks, and information, as required.

The Government will provide access to VA’s JIRA/Github or other project/product repository(s) to provide appropriate Agile project/product application lifecycle management toolsets to track execution details after Contractor personnel complete the training as required in PWS Section 5.1.4. To access VA’s JIRA/Github, the Contractor will require VA access. If the mandated toolset changes throughout the PoP of this TO, then the Government will provide access to the new toolset.

The Government will provide access to VA’s development tools and environments on a product-by-product basis to ensure products, artifacts and data created during execution of this TO remain in a centralized, government managed location.

VA may provide VA-specific software as appropriate. The Contractor shall utilize VA provided accounts, document and requirements repositories and others as required for the configuration, storage, maintenance and delivery of products.

4.5 SECURITY AND PRIVACY

The vendor shall notify VA within 24 hours of the discovery or disclosure of successful exploits of the vulnerability which can compromise the security of the Systems (including the confidentiality or integrity of its data and operations, or the availability of the system). Such issues shall be remediated as quickly as is practical, but in no event longer than 2 days.

When the Security Fixes involve installing third party patches (such as Microsoft OS patches or Adobe Acrobat), the vendor will provide written notice to VA that the patch has been validated as not affecting the Systems within 10 working days. When the vendor is responsible for operations or maintenance of the Systems, they shall apply the Security Fixes within 2 days.

It has been determined that protected health information may be disclosed or accessed and a signed Business Associate Agreement (BAA) shall be required. The Contractor shall adhere to the requirements set forth within the BAA, referenced in the Request for Task Execution Plan (RTEP) and shall comply with VA Directive 6066.

4.5.1 POSITION/TASK RISK DESIGNATION LEVEL(S)

In accordance with VA Handbook 0710, Personnel Security and Suitability Program, the position sensitivity and the level of background investigation commensurate with the required level of access for the following tasks within the PWS are:

Position Sensitivity and Background Investigation Requirements by Task:

The Tasks identified above, and the resulting Position Sensitivity and Background Investigation requirements identify, in effect, the Background Investigation requirements for Contractor individuals, based upon the tasks the particular Contractor individual will be working. The submitted Contractor Staff Roster must indicate the required Background Investigation Level for each Contractor individual based upon the tasks the Contractor individual will be working, in accordance with their submitted proposal.

4.6 RESOURCES

The Contractor shall provide resources with a blend of specific expertise in operating and refining the Agile methodology for the enterprise to meet stakeholder expectations in terms of continuous improvements in quality, responsiveness, and consistency of releases. Specific subject matter and technology expertise will be application dependent with a wide range of technologies utilized within HSP. Outside of standard industry technologies, there is an emphasis on the Massachusetts General Hospital Utility Multi-Programming System (MUMPS) programming language as this is the technology employed in VistA. Additionally, there is periodic need for subject matter expertise in legacy or obscure applications or software components typically encountered during modernization activities. It is anticipated that Artificial Intelligence (AI) will begin to enter the HSP space during this effort, therefore resource with the ability to plan and implement new AI components into existing applications and as well as utilize AI within the application development and sustainment process is expected. Resources are expected to have the minimum knowledge to execute their roles without the support of Government personnel outside of being provided existing application documentation.

The cross-functional team resources for the configuration and development of product enhancements and infrastructure support and maintenance necessary for the end-to-end functionality of each solution delivered may include team roles/responsibilities as outlined below:

Table 1 Roles with Certifications

For Microsoft Azure Government (MAG) Azure Solutions Architect (Expert) or Azure DevOps Engineer (Expert) Pega Certified System Architect

For MAG Azure Solutions Architect (Associate) or Azure Developer (Associate) And International Information System Security Certification Consortium (ISC)2 (Certified Information System Security Professional)

Certified Information Security Manager (CISM) Global Information Assurance Certification (GIAC) Security Leadership Certification (GSLC)

Certified Information Systems Security Professional-Information Systems Security Engineering Professional (CISSP-ISSEP)

HealthShare Health Connect HL7 Interface Specialist Certification InterSystems IRIS Core Solutions Developer Specialist Certification

Microsoft Dynamics 365 Fundamentals

5.0 SPECIFIC TASKS AND DELIVERABLES

The Contractor shall perform the following tasks and provide the specific deliverables described below for each product/project initiated under this TO within the performance period stated in PWS Section 4.1 of this PWS.

The Contractor shall utilize an Agile framework for product management to deliver iteratively & incrementally which regularly produces high quality results in a cost effective, timely, and highly collaborative. Incremental deliveries of viable products shall occur no less than 90 days apart unless otherwise approve by the COR. Sprint duration will be identified during product/project intake and shall be no shorter than two weeks and no longer that four weeks unless approved by the COR and VA Product Manager.

The Contractor shall adhere to VA policies and procedures to include the PLM Playbook, Process Asset Library, VA-approved Release Processes, or successor policies and adopt modern practices to continuously improve VA experiences through a combination of people, processes, and technology.

VA will follow an intake process outlined in PWS Section 5.2.1. when new products/applications/systems are added to the TO. VA will utilize available application/system related data as part of the intake process to determine the services and level of effort (LOE) required. The LOE per project/product will be determined during intake and will consist of a mix of both management and technical LCATs. The specific tasks and deliverables required by each product/project and identified in PWS Section 5.3 will be determined during intake. Backlog Grooming and prioritization are continued throughout the product life cycle and as such requirements and tasks as subject to change over the course of an individual effort. The Contractor shall not exceed the planned and procured LOE of a project after intake but shall adjust planned resource types or adjust staffing to surge or slow down velocity to accommodate project needs at the VA Product Manager (PM) or VA CORs direction. In the event project demands exceed LOE after award, the Government can procure additional capacity or request the vendor to proceed at the velocity dictated by the previously agreed LOE.

Health Product sustainment services will be a separately priced firm-fixed price line item to provide specific application sustainment services to all products within the Health Services Portfolio.

5.1 PROJECT MANAGEMENT

5.1.1 CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, timeline and tools to be used in execution of this TO effort. The CPMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks and resource support. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPMP shall be concurred upon by the COR and updated in accordance with Section B of the TO. The Contractor shall update and maintain the COR approved CPMP throughout the PoP.

Deliverable:

A. Contractor Project Management Plan

5.1.2 REPORTING REQUIREMENTS

The Contractor shall use VA’s approved application development tools to track execution details. The VA approved tools will be used to provide a single authoritative project and product data and artifact repository. All OIT project data and artifacts will be required to be managed in these data and artifact repositories daily. All checked out artifacts shall be checked back in daily, and any data updated daily to synchronize work and ensure version control.

The Contractor shall utilize the VA approved toolset to:

The Contractor shall show all Agile requirements, changes, tests performed and test results in the VA approved toolset to show evidence of code coverage and test coverage of all the requirements specified. This expectation will allow VA to have high confidence in a fully documented, requirements traceability matrix, as evidenced by data in the tools.

The Contractor shall maintain a Weekly Utilization report that provides details on the status of project resources. Resources shall be considered delivered to an effort once a complete onboarding package has been delivered to the COR or in the case of resources transferring from another contract, when an account modification is initiated via Help Desk Ticket, VA On/Off Boarding Service, or successor process. The report shall provide:

1. Resource Name

2. Role Title with technical specialization if applicable

3. Assigned Products/Projects

4. Time percentage dedicated to each effort during the period.

5. Date resource joined each effort.

6. Resources with planned leave exceeding five consecutive business days, with dates

7. Resources working on other contracts, with contract title and associated time commitment.

The Contractor shall provide deliverable tracking support. Due to the large quantity of deliverables that can be generated from multiple efforts utilizing this TO the Contractor shall support the VA COR in the creation and management of a SharePoint based deliverable library and associated approval workflow. Additionally, the Contractor shall produce a Weekly Deliverable Schedule which shall identify deliverables submitted over the past week and anticipated for the preceding week. The Weekly Deliverable Schedule shall identify the associated project, deliverable date, deliverable POC, as well as any deliverables which are past due with and associated reason for failed delivery for COR consideration.

The Contractor shall create and maintain a Consolidated Performance Report of product/project team specific performance metrics covering the calendar month of activities. The Consolidation Performance Report shall detail number of sprints completed, number of story points delivered in each sprint, the number of defects identified that were attributed to the vendor, conformance with the vendors proposed resource plan, date of last release and planned date of the next release.

Deliverables:

A. Weekly Utilization Report B. Weekly Deliverable Schedule C. Consolidated Performance Report

5.1.3 TECHNICAL KICKOFF MEETING

A technical kickoff meeting shall be held within 10 days after TO award. The Contractor shall coordinate the date, time, and location (can be virtual) with the CO, the VA PM, the Contract Specialist (CS), and the COR. The Contractor shall provide a draft agenda to the CO and VA PM at least five calendar days prior to the meeting. Upon Government approval of the final agenda, the Contractor shall distribute to all meeting attendees. During the kickoff-meeting, the Contractor shall present, for review and approval by the Government, the details of the intended approach, work plan, and project schedule for each effort via a Microsoft Office PowerPoint presentation. At the conclusion of the meeting, the Contractor shall update the presentation with a final slide entitled “Summary Report” which shall include notes on any major issues, agreements, or disagreements discussed during the kickoff meeting. The Contractor shall distribute the updated presentation and meeting minutes to the CO, COR and all attendees within three calendar days after the meeting.

5.1.4 VA MANDATORY TRAINING

All resources are required to have access to the VA network and shall complete all the required VA Talent Management System (TMS) training courses within 14 days of submitting an onboarding package. The Contractor shall work with its respective onboarding point of contact and COR, to obtain access to TMS to complete the mandatory training courses.

As an action under the Continuous Readiness in Information Security Program, VA's Assistant Secretary for Information and Technology issued a memorandum requiring all VA government and contract staff to complete information security awareness and applicable role-based training. The Contractor shall submit TMS Training Certificates of completion for VA Privacy and Information Security Awareness, Rules of Behavior, Health Insurance Portability and Accountability Act (HIPAA). If elevated privileges are required Role-Based training will be identified for completion prior to gaining additional access.

Deliverable:

A. TMS Training Certificates

5.1.5 ONBOARDING

The Contractor shall support the onboarding and offboarding of its staff. Onboarding includes steps to obtain a VA PIV card, network and email account, complete training, initiate background investigations, and obtain GFE. In addition, the Contractor shall identify individuals which may require elevated privileges to the necessary development and test environments for the various systems to be developed or enhanced.

A single Contractor Onboarding point of contact (POC) shall be designated by the Contractor that tracks the onboarding status of all Contractor personnel. The Contractor Onboarding POC shall be responsible for accurate and timely submission of all required VA onboarding paperwork to the VA COR or applicable systems used for onboarding. The Contractor shall be responsible for tracking the status of all its staff’s onboarding activities to include the names of all personnel engaged on the task, commercial email address, phone numbers, immediate contract supervisor, onboarding milestone dates, and their initial training date for VA Privacy and Information Security training. The Contractor shall provide a Weekly Onboarding Status Report for review by the COR, VA PM or Government designee.

Deliverable:

A. Weekly Onboarding Status Report

5.2 HEALTH SERVICES PORTFOLIO AND PRODUCT LINE SUPPORT

The Contractor shall support the advancement of the maturity of the Health Services Product Lines through compliance with the DevSecOps process, Agile practice implementation and/or other OIT initiatives. To complete this task, the Contractor shall provide a senior team of subject matter experts to support the integration and oversight of capabilities at the Portfolio level and within the Product Line value stream through collaboration with relevant stakeholders and partners. Additionally, the Contractor shall support planning across interdependent systems to mitigate technical risk and improve integration with business processes and other VA products and enterprise services. As part of this task, the Contractor shall manage the following processes:

1. Assist in defining new application implementation requirements, to include the generation of Epics and translation to Features and User Stories which make up the Product Roadmap and Product Increment Plans while mitigating dependencies between them.

2. Consolidate requirements or sequencing to generate product line efficiencies.

3. Understand future state requirements for a successful implementation of new applications in VA and identify impacts to legacy or dependent systems.

4. Provide guidance on dependencies between implementation requirements within and outside the product to reduce risk as new capabilities are introduced and current systems are retired.

5. Identify and analyze the systems targeted for integration and the design and technologies needed to implement them.

6. Assist with database solutions and designs for data migrations for implementations at VA sites.

7. Provide product line and Health Services Portfolio-level analyses of risks and issues to identify trends and possible opportunities for responses and mitigations at and above the product line level.

8. Understand current and future state data flows, networking, cybersecurity, and infrastructure requirements.

5.2.1 INTAKE PROCESS

The Contractor shall assist VA with employing and refining an intake process that enables the collection, evaluation, and disposition of product/projects seeking services from this TO. The Contractor shall support VA by tracking proposed changes to the process and current intake tool which is a custom ServiceNow module. The contractor shall receive requests, analyze level of effort, coordinate meetings with requestors to clarify requirements and produce a Requirements Solution Proposal (RSP). The RSP shall identify the scope of the effort, high level objectives and requirements, any applicable deadlines and required dates of delivery, milestones, significant risks and impediments, the labor mix expected to meet the request, the resource types to be utilized over the course of the effort with associated level of commitment, a labor mix burndown plan depicting the expected resource utilization over the PoP, and the applicable deliverables that will be created during the execution of the effort. Requestors will evaluate the recommendation to discuss changes, clarifications, or costs that may necessitate an amended RSP.

Deviations from the RSP may be required due to the Agile methodology of development, changing requirements, external barriers, or unexpected changes to staffing. All changes must be documented and agreed on between the vendor, VA PM and COR during the performance period.

Deliverable:

A. Requirements Solution Proposal

5.2.2 SCHEDULE MANAGEMENT

The Contractor shall create, maintain, analyze, and report Solution Roadmaps and Release Train Schedules in the VA-approved toolset. The Contractor shall provide schedule updates within the VA-approved toolset on a weekly basis. The Contractor shall evolve the roadmap, iteratively maturing. Product Line support shall include management of patches to mitigate collisions in addition to the portfolio level tracking. The Health Portfolio Product Line tracking shall be planned/coordinated to ensure optimized sequencing of releases to avoid patch collisions, and all risks are documented in VA approved toolset within 2 days of the risk being realized.

Deliverables:

A. Solution Roadmaps B. Release Train Schedules

5.2.3 RISK MANAGEMENT

The Contractor shall conduct risk management of all work performed under this TO and provide input to the product Risk Management registry within the VA approved toolset which currently is JIRA.

The Contractor shall:

1. Use VA-provided approved tool to create/update and actively manage a product risk register (also referred to as risk log) that identifies knowable circumstances that may have a negative impact on product success, describes potential impacts and asserts measures to either reduce/eliminate their impact. Risks determined by the VA PM shall also be documented in the VA PARS Dashboard and/or other OIT-approved tools.

2. Use the VA-approved tool to facilitate risk meetings and reviews.

3. Collaborate with product team to actively manage, size (level of effort), develop approved mitigations and plans of action and milestones (POAM) and assess/re-assess probability and severity of product risks and issues throughout the product lifecycle.

4. Assess the status of risks and provide a Weekly Risk Management Status Report to VA for inclusion in the larger Risk Management Registry. When new risks occur which could impact development, testing and deployment schedule, the Contractor shall notify the COR and VA PM via email within 24 hours. Email subject line shall read “{Product Name} Risk Alert Notification.”

5. Summarize the status of active risks and issues as determined by their risk score. Risk score calculations must be conducted in accordance with OIT policies and practices to enable analysis of risks and issues across products and product lines. This shall be reported in the Contract Management Plan, at critical decision points and as needed for periodic reviews, program monitoring communications and dashboard updates.

6. The Contractor shall provide a report weekly to Health Portfolio leadership, PM and COR of all risks to include all high, high risks with a summarization of the mitigations to all risks annotated.

5.2.4 CONFIGURATION MANAGEMENT

The Contractor shall:

1. Identify the standard and unique aspects of configuration management to be performed for each Agile Product Team (APT) by establishing a Product Configuration Management (CM) Plan (PCMP) which meets Health Portfolio Website CM plan requirements. The Contractor shall reflect all CM required activities and standards in each product-level CM plan while determining the unique aspects of the product which require individualized procedures. The COR and VA PM will approve the PCMP.

2. Deliver a Recommended List of Configuration Items as part of the PCMP to be placed under configuration and change control. The Contractor shall identify types of configuration items pertaining to each product to be placed under configuration management. Based on Health Portfolio requirements, and the unique needs or nature of each product, the Contractor shall determine the components within each product that must be under configuration control.

3. Use a VA-approved tool and repository for all software source code and electronic artifact configuration and version management. The Contractor shall use the VA-approved tool to manage change, activity, issue, action, risk, and other product data as prescribed by VA standards and processes. If assigned a product using tools that are being deprecated, the Contractor shall assist the VA Tools Team in migrating products using other Change and/or Configuration Management tools.

4. Ensure that all product software and non-software artifacts are versioned correctly according to VA standards and follow a build/release promotion versioning approach which identifies all major, minor, and update changes to the components.

5. Create Project and Product Artifacts baselined and versioned in the CM repository to allow the tool to show active and past histories of the check-ins and check-outs of all software components, data, and software project engineering documents. Maintain all baselines of software, software builds, and electronic artifacts in the repository, labeling updates and versions according to CM procedures.

6. Establish and maintain status reporting on change and configuration management activity and ensure VA approved tools data records and artifacts are filed and updated daily.

7. Develop and manage a CM process that supports all necessary changes for the project including changes to Definition of Done, Acceptance Criteria and any other items deemed necessary.

Deliverables:

A. Product Configuration Management Plan B. Version Description Document

5.2.5 USER EXPERIENCE MANAGEMENT

The Contractor shall conduct user feedback for all products supported during the period of performance to uncover actionable insights from users to ensure all products are meeting the end user’s needs documenting status and input within the User Experience Monthly Report.

The Contractor shall:

1. Engage with Product Stakeholders to determine user base, propose questions and identify best distribution method for survey engagement.

2. Disseminate Survey and collect all feedback addressing questions from all end users

3. Prepare and Share data utilizing existing VA tools to be used for both product specific and Health Portfolio Dashboards

4. Analyze Data to include qualitative data and provide insights into how the products could be updated based on survey results with the insights and feedback being updated in the VA approved tool and the product team backlog.

Deliverable:

A. User Experience Monthly Report

5.2.6 CLOUD USAGE REPORTING AND SUPPORT

The Contractor shall conduct cloud usage reporting and optimization support for all products that are included in this TO. The Contractor shall review and analyze all components of the products in use to identify opportunities to be more efficient in hosting support. The Contractor shall document the findings in the Cloud Usage Report and make the necessary updates within the product based on the Contractor findings upon Government approval.

Deliverable:

A. Cloud Usage Report

5.2.7 PORTFOLIO AND PRODUCT LINE ARCHITECTURE SUPPORT

The Contractor shall lead value stream Continuous Exploration and documentation in coordination with the portfolio for each of the products on which the Contractor is engaged. The Contractor shall support elaboration of epics into features and stories and manage cross-team risks and dependencies along with large initiative Agile product management. The Contractor shall provide a single source of truth in the form of To-be Architecture models, Architecture Diagrams, Solution Level Roadmaps, Solution Data Models, and User Research Artifacts regarding the intended and actual behavior of the solution following the Architecture Standard Operating Framework (ASOF), which implements SAFe best practices and defines architecture roles and responsibilities. The Health Financial Product Line ASOF may be applied as the ASOF for this TO. The Contractor shall work with customers to understand their needs, prioritize capabilities, create the Solution vision and roadmap, define requirements, and guide work through the product team as described below.

1. Perform Continuous Exploration and Planning. Conduct Continuous Exploration activities on existing VA solutions, dependent products, and internal and external business process flows and functions. Work closely with VA customers to understand their needs and how these needs map to VA capabilities.

2. Document business operations following VA Product Line Architecture (PLA) guidelines, including creation of Department of Defense Architecture Framework (DoDAF) High-Level Operational Concept Graphic and Operational Activity Hierarchy aligned with the VA Enterprise Architecture Business Reference Model (BRM) organized in a hierarchal structure limited to business function.

3. Work with the Health Services Portfolio architects to derive a globally consistent design which meets the needs of the intake item(s) and aligns with SAFe Intentional Architecture as described in the ASOF.

4. Develop As-is and To-be Architecture Models following PLA guidelines, including creation of DoDAF System Context Description, System-System Matrix summary of the system interactions, and Operational Activity to Systems traceability mapping systems to business functions as defined in the Operational Activity Hierarchy.

5. The As-is Architecture Model shall represent the baseline architecture to be maintained throughout the PoP. Collect available data, user feedback, and VA stakeholder feedback and capture in a CE Report.

6. Develop current and correct Architecture Diagrams in accordance with VA Enterprise Architecture guidance, detailing logical, network, and dataflow of the products. This shall be updated for every release and maintained throughout the PoP.

7. Support Solution Level Strategy ensuring the solution meets business intent and data integrity.

8. Develop a Solution Level Roadmap, including Architecture Runway Features for implementation of required Technical Enablers.

9. Define Solution Level Epics with acceptance criteria.

10. Develop Solution Data Models and develop Business Cases.

11. Develop Solution Architecture (technical, business, and data). The details shall be included in the Solution Architecture Package.

12. Support early user interface and technical prototypes.

13. Support Business Process Modeling.

14. Document Product Dependencies.

15. Establish KPIs for Solution.

16. Structure a product roadmap within the VA approved tool) that provides a comprehensive list of the software components, Health Services Portfolio products, services, and functionality that need to be built or updated, and prioritization of these based on completed Continuous Exploration efforts. For roadmap items under active Continuous Exploration or development, issue-tracking and associated documentation should easily enable full visibility and transparency of all work from user stories through epics up to the roadmap item as well as progress against all work required for a roadmap item.

17. Develop, execute, and deliver a solution demo.

18. Identify user adoption and training needs.

19. Develop, execute, and deliver architecture documents.

20. Develop and deliver Continuous Exploration Reports: Logical Data Models, Business Process Models.

21. Develop and deliver solution user research and usability testing (as need).

22. Develop and deliver solution KPI definition and reporting.

Solutions and desired outcomes are planned, baselined, and agreed upon during product increment planning events. The Contractor shall work in coordination with the Portfolio Architects and ensure that the solutions provided are in compliance with Portfolio and Enterprise Architectures. Product teams commit to developing stories in play that will achieve improvements to the planned KPI with quantitative and objective indicators that measure progress and success during Product Increment execution.

Deliverables:

A. As-is and To-be Architecture Models B. Architecture Diagrams C. Solution Level Roadmap D. Solution Data Models E. User Research Artifacts

5.2.8 SOFTWARE DEVELOPMENT LIFECYCLE

Agile product management is evolutionary (iterative & incremental) which regularly produces high quality results in a cost effective, timely, and highly collaborative manner. This requires open lines of communication among all participants contributing to a project/program/portfolio that includes multiple consumers. The Contractor shall continuously support the iterative build and development methodology described within PWS Section 5.3 and all subparagraphs to complete all epics and user stories identified in the backlog.

The Contractor shall design, configure, develop, enhance, maintain, test, and deploy builds of each HSP product on a continuous basis no shorter than two weeks but no longer than three months in duration throughout PoP. The Contractor shall provide deliverables/artifacts specified herein that meet documentation and code delivery requirements of activities specified in this PWS and are VA policy compliant. The Contractor shall leverage and reuse relevant content and pre-existing product documentation as appropriate to satisfying the content of package deliverables.

5.2.9 AGILE REQUIREMENTS ELABORATION

The Contractor shall complete an initial Backlog Grooming session with the VA team to properly understand and elaborate business Agile requirements. The outcome of this session shall be a review of, and agreement to, the initial user stories, including user stories added as a result of Backlog Grooming by decomposing Epics into stakeholder needs, business requirements, business rules, requirements visualizations and user story elaborations. The Contractor shall facilitate Product Increment Planning, both virtually and face-to- face, as the collaborative forum with business stakeholders to prioritize features for implementation and to kick off the Continuous Integration process. All requirements shall be entered and maintained in the VA identified repository.

The Contractor shall:

1. Ensure all Epics are included and executed as appropriate within the overall Agile Backlog Grooming effort.

2. Populate the backlog during an initial planning session identifying all features the team considers relevant to building the product. The backlog serves as the primary source for all program requirements and user stories, and the team shall prioritize the contents.

3. Establish initial Unit of measurement (e.g. Story Points) as the estimated relative complexity of user stories.

4. Facilitate any stakeholder briefings, meetings and/or elicitation sessions.

5. Execute requirements reviews with stakeholders and record results of reviews using the VA Approved Tool, updating requirements data as a result of the reviews.

6. Identify the non-production environment access that is needed 30 days prior to configuration start.

7. All Epics, stakeholder needs, visualizations, stories, and other sources of requirements information for functional and non-functional requirements are input and maintained in VA Approved Tool and delivered in a Requirements Package. All requirements data is under change control and is fully linked to work items that show traceability to design changes, configurable items, test cases and test results.

5.2.9.1 CONTENT AND DESIGN

As part of the content and design, the Contractor shall:

1. Employ design process management by breaking designs into small, bite-sized implementations and collecting data from each deployment to inform priorities and decisions in the next iteration.

2. Write and edit plain language content. See https://design.va.gov for the style guide.

3. Ensure consistency and continuity in Health product information architecture, including URL schema, page layout, menus and navigation, user flows, and search engine optimization. Work with all VA Product Teams to incorporate new, both authenticated and unauthenticated content and tools, into the Information Architecture Document to be included in the Solution Architecture Package (PWS Section 5.3.3.1, Solution Architecture Planning and Execution) of Health products.

4. Craft, test, and deploy design deliverables, including Wireframes, low- and high-fidelity prototypes, or interactive web forms to be included in the Solution Architecture Package (PWS Section 5.3.3.1, Solution Architecture Planning and Execution) to facilitate usability testing and agile development of health products. As appropriate, create and update prototypes to conduct facilitated demos or usability testing to elicit feedback for improvements to the design.

5. Develop designs that adhere to VA’s application of the U.S. Web Design System, available on https://design.va.gov. If the Contractor determines a need for a new pattern, the Contractor shall collaborate with PM/COR to design that pattern. The Contractor will work with the Enterprise Architecture team to build and validate new enterprise design pattern and document within the User Experience Design Document

6. Support and comply with all user experience guidelines and standards as defined by VA,…