Performance Work Statement ECSP Audit Support 2.0_RFI draft.docx

Enterprise Cybersecurity Program Audit Support

VA-26-00036760

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Office of Information & Technology Information Security Programs & Logistics

Enterprise Cybersecurity Program Audit Support

Date: March 18, 2026

VA-26-00036760

PWS Version Number: 1.0

Contents

APPENDIX A …………………………………………………………………………………..55

BACKGROUND

The Department of Veterans Affairs (VA), Office of Information & Technology (OIT), Office of Information Security (OIS) strives to provide high quality, effective, and efficient Information Technology (IT) services to those responsible for providing care to the Veterans at the point-of-care as well as throughout all the points of the Veterans’ health care in an effective, timely and compassionate manner. VA depends on Information Management (IM)/IT systems to meet mission goals.

OIS is one of six divisions within OIT. OIS’s mission, in collaboration with its business partners, is to provide an enterprise information security program that strengthens security strategy, risk management, engineering excellence, policy, budgeting, and operations services to over 25 million Veterans, families, and their caregivers.

Within OIS, the Information Security Programs and Logistics (ISPL) service line is responsible for coordinating activities across OIS to ensure operations and the use of resources are integrated, transparent, and efficient. ISPL develops the program’s strategic goals, objectives, and recommends necessary adjustments to improve the organization’s ability to meet those goals. Additionally, ISPL evaluates, develops, recommends, and implements management and administrative practices for efficiencies and to meet organizational goals and objectives. ISPL functions include the following: Cybersecurity Program Planning; Programming; Budgeting and Execution; Acquisition Management; Cybersecurity Program Integration; and OIS logistics functions, such as, Chief of Staff and Business/Program Administration.

A primary task within the lifecycle management of OIT Audit processes is ISPL’s support of multiple audit activities that involve Veterans Health Administration (VHA), Veterans Benefits Administration (VBA) and National Cemetery Administration component agencies and their respective applications. These activities include interviews of management personnel, inspection of information security policies and procedures, observation of operational controls, and technical control testing of VA general support systems and major applications. Additionally, corrective actions identified in prior audits are often evaluated for implementation.

ISPL supported audits currently include, but are not limited to, the following:

The IRS conducts cyclic audits to evaluate the VA’s compliance with IRS data security requirements. The ISPL Division’s functions include identifying broad trends of non-compliance among all audit activities (FISMA/FISCAM, Government Accountability Office (GAO), IRS, etc.); identifying and involving stakeholders at all levels during all audit activities, facilitating root cause analysis on audit findings: coordinating remediation activities based on applicable laws and regulations and validating enterprise compliance implementation activities.

APPLICABLE DOCUMENTS

In the performance of the tasks associated with this PWS, the Contractor shall comply with the following:

1. “Federal Information Security Modernization Act of 2014”

2. Federal Information Processing Standards (FIPS) Publication 140-3, “Security Requirements for Cryptographic Modules”, March 22, 2019

3. FIPS Pub 199. “Standards for Security Categorization of Federal Information and Information Systems,” February 2004

4. FIPS Pub 200, “Minimum Security Requirements for Federal Information and Information Systems,” March 2006

5. FIPS Pub 201-3, “Personal Identity Verification of Federal Employees and Contractors,” January 2022

6. 10 U.S.C. § 2224, "Defense Information Assurance Program", as amended

7. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

8. Public Law 109-461 (P.L. 109-461), Veterans Benefits, Health Care, and Information Technology Act of 2006, as amended, Title IX, Information Security Matters

9. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”, as amended

10. VA Directive 0710, “Personnel Vetting Program,” September 8, 2025, https://www.va.gov/vapubs/index.cfm

11. VA Handbook 0710, “Personnel Vetting Program,” September 8, 2025, https://www.va.gov/vapubs/index.cfm

12. VA Directive 6102, “Internet/Intranet Services,” August 5, 2019

13. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and Guidelines,” as amended

14. Office of Management and Budget (OMB) Circular A-130, “Managing Federal Information as a Strategic Resource,” July 28, 2016

15. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed Services (CHAMPUS)”, as amended

16. NIST SP 800-66 Rev. 2, “Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule: A Cybersecurity Resource Guide,” February 2024

17. 45 C.F.R Parts 160 and 164, Subparts A and E, the Standards for Privacy of Individually Identifiable Health Information (“Privacy Rule”); and 45 C.F.R. Parts 160 and 164, Subparts A and C, the Security Standard (“Security Rule”); as amended

18. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended

19. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

20. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021 (see VA NOTICE 24-18, dated September 27, 2024, “Update to VA Directive 6500 Cybersecurity Program”, and VA Notice 25-07, dated 3/18/25, “Amending VA Directive 6500 to incorporate M-24-15”)

21. VA Handbook 6500, “Risk Management Framework for VA Information Systems VA Information Security Program,” February 24, 2021 (see VA Notice 25-01, dated October 15, 2024, “Update to VA Handbook 6500 Risk Management Framework for VA Information Systems VA Information Security Program”, and VA Notice 25-06, dated 3/18/25, “Amending VA Directive 6500 to incorporate M-24-15”, VA Notice 25-16, dated September 15, 2025, “Amending VA Handbook 6500 to Replace Enterprise Mission Assurance Support Services Tool With Office of Information Technology Governance Risk Compliance Tool, and VA Notice 25-17, dated September 22, 2025, “Rescission Of Office Of Information Security (OIS) Deputy Assistant Secretary (DAS) Memorandum – Requirements of Proper Plan of Action and Milestones (POA&M) Completion)

22. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI),” June 30, 2023

23. VA Handbook 6500.6, “Contract Security,” March 12, 2010 (see VA Notice 24-12, dated April 22, 2024, “Update to VA Handbook 6500.6, Contract Security, Appendix C VA Information and Information System Security/Privacy Language For Inclusion Into Contracts, As Appropriate”)

24. VA Handbook 6500.8, “Information System Contingency Planning,” March 25, 2025

25. VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018 (see VA NOTICE 25-10, dated June 9, 2025, “Use of Personally Owned Mobile Devices Policy Amendment of Department of Veterans Affairs Handbook 6500.10”, and VA Notice 25-15, dated August 22, 2025, “Update to VA Handbook 6500.10 Mobile Device Security Policy”)

26. VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017

27. OIT Process Asset Library (PAL), OIT Process Asset Library.

28. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

29. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014

30. VA Directive 6510, “VA Identity, Credential and Access Management,” September 3, 2024

31. VA Handbook 6510, “VA Identity, Credential and Access Management,” September 27, 2024

32. VA Directive and Handbook 6513, “Secure External Connections,” October 12, 2017

33. VA Directive 6300, “Records and Information Management,” September 21, 2018

34. VA Handbook, 6300.1, “Records Management Procedures,“ March 24, 2010

35. NIST SP 800-37 Rev 2, “Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy,” December 2018

36. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020)

37. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015

38. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” March 24, 2014

39. OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005

40. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019

41. OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008

42. Federal Identity, Credential, and Access Management (FICAM) Architecture, June 30, 2023 (FICAM Architecture (idmanagement.gov))

43. NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access,“ June 2018

44. NIST SP 800-63 Rev 4, 800-63A-4, 800-63B-4, 800-63C-4, “Digital Identity Guidelines,” August 1, 2025

45. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014

46. VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

47. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

48. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

49. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

50. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019

51. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008

52. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (P.L. 110–140), December 19, 2007

53. Section 104 of the Energy Policy Act of 2005, (P.L. 109–58), August 8, 2005

54. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 2, 2001

55. Executive Order 14148, “Initial Rescissions of Harmful Executive Orders and Actions,” dated January 20, 2025

56. VA Directive 0057, “VA Environmental Management Program,” October 25, 2022

57. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

58. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

59. “Veteran Focused Integration Process (VIP) Guide 4.0,” March 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

60. VA Memorandum “Proper Use of Email and Other Messaging Services,” January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

61. “Product Line Management Transformation Playbook” version 3.1, August 2023, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

62. NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020

63. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol Version 6 (IPv6),” November 19, 2020

64. Social Security Number (SSN) Fraud Prevention Act of 2017

65. Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23, 2018

66. C.F.R Title 15 Part 7, “Securing the Information and Communications Technology and Services (ICTS) Supply Chain”, as amended

67. Executive Order 14028, “Executive Order on Improving the Nation's Cybersecurity,” May 12, 2021, https://bidenwhitehouse.archives.gov/briefing-room/presidential-actions/2025/01/16/executive-order-on-strengthening-and-promoting-innovation-in-the-nations-cybersecurity/

68. OMB Memorandum M-22-09, “Moving the U.S. Government Toward Zero Trust Cybersecurity Principles”, January 26, 2022, https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf.

69. NIST SP 800-52 Revision 2, “Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations

70. OMB M-26-05, “Adopting a Risk-based Approach to Software and Hardware Security,” January 23, 2026

71. OMB M-21-31, “Improving the Federal Government’s Investigative and Remediation Capabilities Related to Cybersecurity Incidents,” August 27, 2021

72. NIST SP 800-88 Revision 1 “Guidelines for Media Sanitization,” December 2014

73. CISA Binding Operational Directive (BOD) 19-02: “Vulnerability Remediation Requirements of Internet-Accessible Systems,” April 29, 2019, BOD 19-02: Vulnerability Remediation Requirements for Internet-Accessible Systems | CISA

74. CISA BOD 22-01: “Reducing the Significant Risk of Known Exploited Vulnerabilities,” November 3, 2021, BOD 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities | CISA

75. CISA BOD 23-01: Improving Asset Visibility and Vulnerability Detection on Federal Networks.” Cybersecurity & Infrastructure Security Agency (CISA), BOD 23-01: Improving Asset Visibility and Vulnerability Detection on Federal Networks | CISA

76. VA Directive 6550, Pre-Procurement Assessment and Implementation of Medical Devices/Systems, June 03, 2019

77. VA Memorandum, “VA Security Controls,” January 17, 2025, https://www.voa.va.gov/DocumentView.aspx?DocumentID=5010

78. E.O. 13960, “Promoting the Use of Trustworthy Artificial Intelligence in the Federal Government,” December 3, 2020

79. E.O. 14319, “Preventing Woke AI in the Federal Government,” July 23, 2025

80. OMB Memorandum M-25-21, “Accelerating Federal Use of AI through Innovation, Governance, and Public Trust,” April 3, 2025

81. OMB Memorandum M-25-22, “Driving Efficient Acquisition of Artificial Intelligence in Government,” April 3, 2025

82. OMB Memorandum M-26-04, “Increasing Public Trust in Artificial Intelligence (AI) Through Unbiased AI Principles,” December 11, 2025

83. Attachment 001 – OIG Audit Lifecycle Process Asset Library (PAL), April 19, 2022

SCOPE OF WORK

The Contractor shall provide comprehensive support with all VA audit cycle processes assigned to Enterprise Cybersecurity Program (ECSP) to include continuous improvement of the Audit Portal and management of all audit lifecycle information housed within it, as well as associated with the ISPL-ECSP internal and external communication SharePoint and/or websites. The Contractor shall assist in managing, coordinating and reporting responses to audit findings; identifying, capturing and conducting analysis of audit cycle lessons learned to formulate action plans with input from key stakeholders; managing and reporting audit findings, emerging findings and conducting trend analysis to inform stakeholder and OIT Leadership decisions throughout the audit lifecycle; managing the ISPL-ECSP “Due Out” action tracker, organizing and facilitating meetings with audit stakeholders, providing “ADHOC” daily, weekly and monthly status reports; scheduling and coordinating audit briefings and interviews with Subject Matter Experts (SMEs) and key stakeholders.

The Contractor shall provide, develop, and implement a variety of IT-related communication strategies and services to a variety of VA OIT internal and various external stakeholders such as, but not limited to, VHA, VBA, OIG, IRS, etc. through a variety of sophisticated and highly professional media, strategic communication techniques and campaigns, as well as provide planning services to anticipate key current and future strategic communication requirements that VA’s IT organization must consider to best serve its organizational goals and numerous stakeholders.

The Contractor shall provide expertise in integrating a multitude of communication vehicles into a cohesive and proactive implementation plan that reflects VA priorities in support of the VA Digital Transformation Strategy. The Contractor shall provide the change management and programmatic expertise to assist in maturing the operational foundation for a young but substantial communication organization (making recommendations for process improvements, facilitating collaboration, and documenting processes/procedures). The Contractor support shall include project management and communication support services to targeted audiences and associated remediation activities.

ORDER TYPE

The effort shall be proposed on a Firm-Fixed-Price basis.

PERFORMANCE DETAILS

PERFORMANCE PERIOD

The Period of Performance (PoP) shall be 12 months from date of award, with three 12-month option periods, and one 60-day Optional Task for Transition services, if exercised. The overall PoP shall not exceed 50 months.

PLACE OF PERFORMANCE

Tasks under this PWS shall be performed at Contractor facilities. The Contractor shall identify the Contractor’s place of performance in their proposal submission. The Contractor staff shall be available to coordinate with VA staff on normal Federal Government workdays and shall be responsive between the core hours of 8:00am and 5:00pm Eastern Time.

TRAVEL

The Government does not anticipate travel under this effort.

SPECIFIC TASKS AND DELIVERABLES

The Contractor shall provide support to OIT ISPL-ECSP through the execution of a variety of audit cycle processes to include, but not limited to; FISMA, FISCAM, IRS, IT Security Inspection, and other compliance audits as assigned. The Contractor shall perform the following in the Base Period and, if exercised, each Option Period (except 5.1.3, Technical Kickoff meeting):

PROJECT MANAGEMENT

CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, timeline, and tools to be used in execution of this TO effort. The CPMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks, and resource support. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPMP shall be concurred upon and updated in accordance with Section B of the TO. The Contractor shall update and maintain the VA Program Manager (PM) approved CPMP throughout the PoP. The Contractor shall include a description within the CPMP of its project management processes for the following project management disciplines:

· Schedule Management

· Financial Management

· Quality Management

· Resource Management

· Communications Management

· Change Management

· Risk Management

Deliverable:

A. Contractor Project Management Plan

REPORTING REQUIREMENTS

The Contractor shall provide the Contracting Officer’s Representative (COR) with Monthly Progress Reports in electronic form in Microsoft (MS) Word or PDF formats (or other format as agreed upon by the Government PM and COR). The report shall include detailed instructions/explanations for each required data element to ensure that data is accurate and consistent. These reports shall reflect data as of the last day of the preceding quarterly reporting period.

The Monthly Progress Reports shall cover all work completed during the reporting period and work planned for the subsequent reporting period. The report shall also identify any problems that arose and a description of how the problems were resolved. If problems have not been completely resolved, the Contractor shall provide an explanation including their plan and timeframe for resolving the issue. The Contractor shall monitor performance against the CPMP and report any deviations. It is expected that the Contractor will keep in communication with COR and ISPL-ECSP Leadership between Monthly Progress Reports as needed so that issues that arise are transparent to both parties to prevent escalation to risks.

The Contractor shall present the Monthly Progress Report to ISPL-ECSP Government staff at a monthly progress meeting with an emphasis on continuous improvement of the program. These monthly meetings shall be conducted virtually, based upon the direction of the ISPL-ECSP Director. The Contractor shall develop the agenda and meeting materials for the presentation; the Contractor shall create and distribute meeting agendas and meeting materials for each meeting-to-meeting participants at least two full working days prior to the meeting. The Contractor shall also document and distribute the meeting minutes from each meeting.

The Monthly Progress Report shall include the following data elements:

a. Overarching Project Name and PWS Name

b. Overall high-level assessment of Contractor progress and related outcomes

c. All work in-progress completed during the reporting period, presented in a user- friendly format for program management

d. 2-4 communication campaigns focused on ensuring the audit stakeholder requirements are being met, based on data-driven analysis from the reporting period that highlights appropriate metrics, communication outcomes, best practices, lessons learned, and recommendations for continuous improvement, concise format and metrics to be agreed upon in advance with ISPL-ECSP Government staff

e. Identification of any programmatic issues uncovered during the reporting period; highlight those areas with a high probability of impacting schedule, cost, or performance goals

f. Explanations for any unresolved issues, including possible solutions and any actions required of the Government and/or Contractor to resolve or mitigate any identified issue, including a plan and timeframe for resolution

g. Status on previously identified issues, actions taken to mitigate the situation and/or progress made in rectifying the situation

h. Work planned for the subsequent reporting period

i. Current schedule overlaid on initial schedule showing any delays or advancement in schedule of key communication activities, such as major campaigns

j. Current schedule overlaid on initial schedule showing any delays or advancement in schedule of project deliverables

k. Workforce staffing data showing all Contractor personnel performing on the effort during the current reporting period. After the initial labor baseline is provided, each Monthly Outcome Report shall identify any changes in staffing, identifying each person who was added to or removed from the contract.

l. Original schedule of deliverables and Contractor progress towards meeting each deliverable.

Deliverable:

A. Monthly Progress Report

TECHNICAL KICKOFF MEETING

A technical kickoff meeting shall be held within 10 days after Task Order (TO) award. The Contractor shall coordinate the date, time, and location (can be virtual) with the CO, as the Post-Award Conference Chairperson, the VA PM, as the Co-Chairperson, the Contract Specialist (CS), and the COR. The Contractor shall provide a draft agenda to the CO and VA PM at least five calendar days prior to the meeting. Upon Government approval of a final agenda, the Contractor shall distribute to all meeting attendees. During the kickoff-meeting, the Contractor shall present, for review and approval by the Government, the details of the intended approach, work plan, and project schedule for each effort via a MS Office PowerPoint presentation. At the conclusion of the meeting, the Contractor shall update the presentation with a final slide entitled “Summary Report” which shall include notes on any major issues, agreements, or disagreements discussed during the kickoff meeting and the following statement “As the Post- Award Conference Chairperson, I have reviewed the entirety of this presentation and assert that it is an accurate representation and summary of the discussions held during the Technical Kickoff Meeting for the “Enterprise Cybersecurity Program Audit Support effort.” The Contractor shall submit the final updated presentation to the CO for review and signature within three calendar days after the meeting. The Contractor shall also work with the CS, the Government’s designated note taker, to prepare and distribute the meeting minutes of the kickoff meeting to the CO, COR and all attendees within three calendar days after the meeting. The Contractor shall obtain concurrence from the CS on the content of the meeting minutes prior to distribution of the document.

AUDIT CYCLE MANAGEMENT SUPPORT

The Contractor shall provide support for the management of the three stages of the VA audit cycle.

AUDIT PREPARATION STAGE

During the Audit Preparation Stage of all supported audits, OIS is responsible for performing various support tasks in preparation for upcoming audits to ensure successful outcomes for all identified audit targets. The audit records will be maintained within the Audit Portal through automation, solution design mechanism as required.

The Contractor shall support VA Audit Cycle Preparation as follows:

1. Stakeholder Management

a) Identify, update, and maintain the complete Audit Stakeholder List in the designated tool, including but not limited to:

i. OIT Leadership

ii. Trusted Agents

iii. Enterprise Control Leaders

iv. Vulnerability Scan Points of Contact (POCs)

v. Security Control SME

b) Identify and maintain accurate and complete Security Control SMEs and records.

2. Schedule Management

a) Identify, update, and maintain the complete Audit Schedule in the designated tool, including but not limited to:

i. Audit Targets

ii. Audit Engagements

b) Identify, update, and maintain Scheduled Audit Engagements in the designated tool, specific to calendar scheduling (Approximately 20 per month).

Deliverables:

A. Audit Stakeholder List B. Audit Schedule C. Scheduled Audit Engagements

AUDIT FOLLOW-UP STAGE

During this stage of all ISPL-ECSP supported audits, ISPL-ECSP is responsible for performing various post audit support tasks.

The Contractor shall support the VA Audit Follow-Up Stage as follows:

1. Receive and distribute draft audit reports from VA for each site/system.

2. Receive and distribute draft Notice of Findings & Recommendations (NFR).

3. Track NFR recommendations, final FISMA recommendations, and site/system level findings associated with the OIT Material Weakness, ongoing Material Weakness strategic remediation efforts and milestone updates, to identify and maintain currency with OIT strategic responses, Corrective Action Plans, and other remediation efforts.

4. Update the findings list throughout the stage. Throughout the audit cycle, new enterprise and local SMEs for each NIST control family will be identified. The Contractor shall work with the appropriate ECSP Analyst to ensure these SMEs are added to the Information System Security Stakeholders and associated with the correct NIST security controls, organizations, and systems/applications.

5. Develop comparisons to show metrics for preliminary observations and draft findings for audit stakeholders.

TREND ANALYSIS/DATA ANALYTICS

The Contractor shall conduct and report on trend analysis of audit findings throughout the audit cycle, to include:

1. Leveraging data collected throughout the audit cycle (findings, responses, FISMA metrics, lessons learned, material weakness, etc.) to identify trends. The Contractor shall provide Finding Records.

2. Drafting Weekly and Ad-Hoc Audit Trend Reports for submission to the appropriate ISPL-ECSP committee(s)/workgroup(s). Reports to include data view and graphical view of the data, displayed in PowerBI Dashboard(s).

3. Create a Final Audit Trend Report which reflects all the audit findings for each Fiscal Year FISMA/FISCAM Audit Requests, displayed in PowerBI Dashboard(s).

Deliverables:

DATA MODELING AND ANALYSIS

The Contractor shall assist OIT in the following activities:

1. Use TRM-approved software (if not provided by VA) to analyze data gathered from all ECSP supported audits to generate meaningful/actionable information, including but not limited to:

2. Review and analyze all data in the OIT Audit Portal and other applications such as, but not limited to: the Governance, Risk, and Compliance (GRC) tool, Enterprise-RISK Registry and other related data repositories to determine data availability, quality, and any potential ISPL-ECSP reporting gaps.

3. Normalize data used by ECSP in order to provide meaningful visualization of data. Identify relationships between the various databases used by ECSP, and link through data tables/relational DB.

4. Build and disseminate ISPL-ECSP reporting dashboards and ad-hoc reports as needed in order to satisfy OIT stakeholder requirements.

5. Analyze Model Data to identify information that provides consumable, defensible, and actionable information to the organization that will help inform decision making.

6. Design and monitor role-based access privileges for the OIT Audit Data Model Design, Model Implementation, and Data Maturation phases.

7. Maintain and keep updated documentation for Audit Model Process Methodologies, Mappings, and Model Allocations in order to enable a standardized, repeatable process for data modeling and visualization.

8. Develop automated processes for the intake of ECSP’s operational audit data (Evidence Requests, Draft/Final Findings, Draft/Final Responses, Material Weaknesses, etc.) using solution determined by Contractor.

9. Develop automated data mapping in the OIT Audit Portal Data Model to reduce the amount of manual mapping that is required for ISPL-ECSP reporting.

10. Analyze model data to identify information that provides consumable, defensible, and actionable information to the organization that will help inform decision making.

11. Use SharePoint Online Development; MS Power Platform (Power Apps, Power Automate, Power BI and AI Builder; relational database creation and administration; business and data analysis methodologies to optimize business process and system workflow to help improve Business Processes.

12. Ability to showcase data in context with stunning interactive data visualizations in applications, websites, portals, SharePoint, and MS Teams.

OIT AUDIT PORTAL

MANAGEMENT OF THE OIT AUDIT PORTAL

The Contractor shall manage and maintain the OIT Audit Portal as well as maintain and update all information hosted in the OIT Audit Portal throughout the audit cycle, to include:

Ensuring annual data for the Audit Portal, including but not limited to:

Deliverables:

IMPROVEMENT OF THE OIT AUDIT PORTAL

The Contractor shall assist with the continuous improvement of the OIT Audit Portal, to include:

· Improvement of deficiencies

· Corrective measures

· Additional features/capabilities

· Process improvement

· Optimization of:

· Data collection

· Data reporting

· Data usage

Deliverables:

BUSINESS INTELLIGENCE (BI) ARTIFACT DEVELOPMENT

The Contractor shall make data visualizations (approximately 50 visualizations/dashboards per PoP) available to VA OIT ISPL-ECSP Staff and audit stakeholders, as well as Leaders, and Enterprise/OIT Organization Executives, through various methods to include publishing to the VA OIT Audit Portal or providing MS Power BI desktop files for consumption. The Contractor shall provide ongoing support with the continued maintenance of existing dashboards. Specific Contractor BI activities shall include:

1. Coordinate with stakeholders, project teams, and SMEs to gather requirements and develop technical documentation, to include business requirements, quality assurance test scripts.

2. Design and develop ad-hoc apps, dashboards, reports, and datasets using MS Power BI to visualize ISPL-ECSP (descriptive, predictive, and prescriptive) analytics and performance management catalog.

3. Develop and publish Certified Power BI Datasets for OIT, ISPL and ISPL-ECSP dashboards, and reports user access security framework

4. Develop and sustain ISPL-ECSP Power BI Artifact Governance, and a User Access Security Framework.

5. Use SharePoint Online Development; MS Power Platform (Power Apps, Power Automate, Power BI and AI Builder, and MS Flow); relational database creation and administration; automation of business and data analysis methodologies to optimize business process and system workflow to help improve Business Processes.

6. Develop ECSP Power BI Metadata Portal as part of the OIT Audit Portal solution.

7. Develop and maintain Power BI Artifact Metadata Digital Catalog that includes data refresh schedule and status, data sources and performance measure calculation methodologies.

8. Develop and implement Power BI Audit Life Cycle Artifacts Datasets (applications, dashboards, and datasets of development life cycle artifacts and processes) for the display of audit data to ECSP Stakeholders. (i.e. requirements, design, development, testing, deployment, maintenance and sunset activities)

9. Develop a MS SQL Database to develop data models related to collected & managed audit data.

10. Use popular machine learning open-source libraries & platforms (MLflow, Aforge.Net, Pytorch, pandas, numpy, sklearn, XGBoost, Tensorflow/Keras, or similar TRM-approved languages), Application Programming Interfaces, cloud computing, & databases to develop enhanced audit management solutions.

11. Create and modify data reports and up to 50 dashboards/visualizations per year, sharing them securely across applications (SharePoint Online, Excel, Power BI, Power Apps, MS Flow)—providing new views for deeper insights.

Deliverables:

SHAREPOINT SUPPORT

ISPL-ECSP uses SharePoint to deliver capabilities associated with content management, collaboration, and communications. SharePoint allows ISPL-ECSP ease of access to organize, manage and utilize substantial amounts of information. It is also used as a development platform, which enables the capability to build sophisticated web sites, provides integration with external data sources and the creation of workflows to facilitate collaboration and knowledge sharing, all of which fosters the improvement of business and IT processes across the organization.

The Contractor shall provide expert-level development recommendations and maintenance of ISPL-ECSP’s MS SharePoint platform and content. The Contractor shall provide written recommendations for improvement in performance and maintenance of ISPL-ECSP applications that interface or use MS SharePoint.

All recommendations must comply with vendor product technical specification to retain vendor support. The Contractor shall provide best practices, written recommendations, guidance, architecture, training, design, problem resolution and other actives required for the successful maintenance and operations of the ISPL-ECSP MS SharePoint hosted site environments. The Contractor shall provide this information (files, build instructions, user instructions, documentation of enhancements, modifications, etc.) in a User Guide for each SharePoint sub- site that is created.

Current SharePoint integrations consist of approximately 12 custom developed Power Apps. There are currently two planned Power App integrations with SharePoint and/or SQL database (to be determined).

Maintenance tasks shall include, but not be limited to, the following:

1. SharePoint integration and Agency roll out/deployment support.

2. SharePoint site structure/navigational architecture guidance and execution.

3. Placement of data/content within SharePoint or on data shares or other systems (as required) if SharePoint is not used.

4. Governance, development, design and maintenance of SharePoint sites to include updating, improving, and enhancing SharePoint sites.

5. SharePoint/site/sub-site taxonomy at any level of the organization based on an organization's needs.

6. Process for defining, posting, and managing relevant content based on the ISPL-ECSP informational needs.

7. Add ISPL-ECSP users and Contractors for SharePoint development and integration into the production environment.

8. Review of custom developed web parts, custom code, and their integration into the SharePoint environment. (Approximately 35 custom applications)

9. Assist with the integration of agency applications with SharePoint 365.

10. Install and test recommendations as required.

11. Provide, based on MS Industry Best practices and written guidance, assistance with, and recommendations for architecting, installing, configuring, maintaining, integrating and securing MS SharePoint for production systems and systems associated with the continuity of operations within ISPL-ECSP.

12. Provide recommendations for and assistance with deployment, test and production practices, and make recommendations for improved support and product integration of new applications.

13. Adhere to style and branding guidelines as required by VA and OIT. When required, the Contractor shall ensure site security to restrict and protect data and/or Personally Identifiable Information via the appropriate control mechanism such as, but not limited to, MS Global Access List (GAL).

14. Grant VA staff edit permissions to all SharePoint sub-sites and grant access to the code developed to implement SharePoint capabilities.

15. Create Release Notes for versioning control related to development changes and/or enhancements designed by the Contractor.

Deliverables:

OPTIONAL TASK ONE: TRANSITION SERVICES

The Contractor shall continue to perform all activities listed within this PWS (Sections 5.1 through 5.5) and support the transition of essential knowledge and work products to and from other Contractors as directed by VA to ensure the continuity of operations, its related components, and workflows. If exercised, this Optional Task shall begin on the last day of the PoP in which it is exercised, for a period of 60 calendar days.

A. TRANSITION-OUT PLAN

The Contractor shall prepare a Transition-Out Plan. The Contractor’s plans shall define transition efforts to be conducted, documentation, and information to be transferred to and reviewed with other relevant contractors or Government. Transition-Out Plan will be reviewed by and require approval of the VA PM and COR. The services offered may transition to either the Government or a new contractor.

The Transition-Out Plan shall, at a minimum, address the following:

B. TRANSITION-OUT SERVICES

In accordance with the Government-approved transition-out plan, the Contractor shall assist the Government in implementing a complete transition of this TO. This shall include formal coordination with Government staff as well as successor staff and management if applicable. All transition-out services shall be completed within 60 calendar days. Successful transition is defined as 100% completion of all work defined in the Government-approved Transition-Out Plan.

Upon the completion of the transition period, the Contractor shall provide Closeout Certifications that include a statement that the contract is complete, all deliverables have been provided, all services are complete, and there are no outstanding contractual issues.

Deliverables:

GENERAL REQUIREMENTS

ENTERPRISE AND IT FRAMEWORK

VA TECHNICAL REFERENCE MODEL

The Contractor shall comply with the VA OIT Technical Reference Model (VA TRM). Compliance with the VA TRM is achieved by using only technologies and standards that are listed as approved for use in the VA TRM. The Contractor shall provide all necessary information requested by VA to ensure TRM approval is obtained prior to use on VA’s network.

ZERO TRUST – VA CRITICAL SECURITY CONTROLS

VA has established minimum mandatory security requirements and requires that any network connected software system or service must meet the VA Critical Security Controls as outlined in the VA Memorandum, “VA Security Controls”, https://www.voa.va.gov/DocumentView.aspx?DocumentID=5010. VA Critical Security Controls identify the minimum mandatory requirements that must be implemented across all VA enterprise infrastructure, cloud computing environments, information systems, networks, and specialized devices (medical devices/systems, special-purpose systems, and research scientific computing devices) that process, store, and/or transmit VA data. Effective July 1, 2025, the Contractor shall implement these VA Critical Security Controls, within any network connected software system or service prior to being authorized for use in the VA. This functional requirement is not negotiable, and Plan of Action & Milestones (POAM) will not be accepted in the event these controls cannot be implemented for new systems.