Performance Work Statement FMBT IVV - DRAFT.docx

Financial Management Business Transformation (FMBT) Independent Verification and Validation (IV&V)

VA-26-00044457

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Office of Information & Technology Independent Verification and Validation (IV&V) Compliance, Risk and Remediation (CRR)

Independent Verification and Validation (IV&V) Services for Financial Management Business Transformation (FMBT) Program

Date: April 16, 2026

VA-26-00044457

PWS Version Number: 1.0

Contents

BACKGROUND

The Department of Veterans Affairs (VA), Office of Information & Technology (OIT), Compliance, Risk and Remediation (CRR) strives to provide high quality, effective, and efficient Information Technology (IT) services to those responsible for providing care to the Veterans at the point-of-care as well as throughout all the points of the Veterans’ health care in an effective, timely and compassionate manner. VA depends on Information Management/Information Technology (IM/IT) systems to meet mission goals.

The VA OIT mission is to provide benefits and services to Veterans of the United States. In meeting these goals, OIT strives to provide high quality, effective, and efficient IT services to VA components that are ultimately responsible for providing services to our nation’s Veterans. VA depends on IM/IT systems and services to meet mission goals.

The Financial Management Business Transformation (FMBT) program vision is to provide VA with a modern financial and acquisition management solution with transformative business processes and capabilities that enable VA to meet its goals and objectives in compliance with financial management legislation and directives. The financial system transformation effort will increase the transparency, accuracy, timeliness and reliability of financial information resulting in improved fiscal accountability to American taxpayers and offers a significant opportunity to improve care and services to our Veterans.

Through the FMBT program, VA is working to implement an enterprise-wide financial and acquisitions management system and integrated solution, known as the Integrated Financial and Acquisitions Management System (iFAMS), which will enable VA to improve service to Veterans, increase innovation, and enhance data integrity.

The iFAMS solution includes Momentum® a commercial Enterprise Resource Planning (ERP) system developed by CGI. VA is migrating to the Momentum commercial cloud solution, configured for VA as the Integrated Financial and Acquisition Management System (iFAMS), allowing VA to leverage CGI’s Software as a Service (SaaS) model. VA will gain increased operational efficiency, productivity, agility, and flexibility from a modern Enterprise Resource Planning (ERP) cloud solution. The new cloud solution will also provide additional security, storage, and scalability. By implementing Momentum Acquisitions, VA is getting real-time integration with financials through a single, consolidated system.

VA has many financial systems related to veterans’ support that interface with the legacy Financial Management System (FMS) of record. VA is replacing FMS under its FMBT program. Currently this work is being conducted by the FMBT program under OIT. The FMBT program includes integrating multiple other systems and applications that currently interface or are interoperable with FMS in the current environment.

The FMBT program has adopted an Agile framework for project management with its SaaS provider to improve cross-workstream collaboration and focus on delivering business value sooner. The Agile framework focuses on implementing highest priority requirements first and is specifically tailored for FMBT to help deliver iFAMS in small increments while continually engaging the customer.

The iFAMS deployment schedule is organized into a series of implementation rollouts known as implementation waves. In May 2017, VA determined that FMBT could accelerate the existing program schedule by planning a limited-scope initiative, designated Implementation Wave 1, to pilot specific budget formulation capabilities of iFAMS while more complicated program activities were still concluding. After almost a year of collaborative preparation, the Wave 1 - Budget Formulation environment was successfully launched on March 26, 2018, as planned, and became accessible to a group of approximately 120 users across all VA Administrations and Staff Offices.

The Payments Module (Grants) and National Cemetery Administration (NCA) iFAMS implementation wave achieved the scheduled Go Live in November 2020. An additional 31 implementation waves, spanning across Administrations and staff offices will continue through 2030.

VA OIT has the requirement to obtain Independent Verification and Validation (IV&V) services for the FMBT program, to include utilizing today’s best practices commercially and in Government, to further enable VA’s efforts to transform its current financial environment into a better, more efficient and effective one.

The OIT Compliance, Risk Remediation (CRR), Independent Verification and Validation (IV&V) Directorate is independent of the OIT organizations and VA business customer organizations responsible for the FMBT program execution and delivery of FMBT products and services. The Government developed FMBT IV&V Plan defines and guides the planned and recommended IV&V activities to support the FMBT program.

Additionally, the FMBT IV&V Plan considers that VA OIT will also be responsible for meeting the Veteran Focused Integration Process (VIP) requirements including documentation and activities outlined within the VA’s VIP guide. VIP is a Lean-Agile framework that services the interest of Veterans through the efficient streamlining of activities that occur within the enterprise. The current approved OIT tool set is JIRA/X-ray for project management, issue management, test and defect management.

Throughout the FMBT program the FMBT IV&V Plan will be reviewed and revised occasionally by the Government based on the ongoing planning, development and delivery of other program deliverables and as knowledge accumulates about the characteristics of the system, the software, and the problem areas in the system or the lifecycle methodology adopted by the FMBT program.

Due to the mission-critical nature of the FMBT modernization program, the VA requires qualified contract support that is familiar with VA’s mission, Electronic Health Record Modernization (EHRM) and FMBT programs, has the necessary background to start the work immediately, and has significant experience with the requirements, tasks and deliverables in the PWS. This experience includes work as a prime contractor providing IV&V support on a major Financial Management program.

APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. “Federal Information Security Modernization Act of 2014”

2. Federal Information Processing Standards (FIPS) Publication 140-3, “Security Requirements for Cryptographic Modules”, March 22, 2019

3. FIPS Pub 199. “Standards for Security Categorization of Federal Information and Information Systems,” February 2004

4. FIPS Pub 200, “Minimum Security Requirements for Federal Information and Information Systems,” March 2006

5. FIPS Pub 201-3, “Personal Identity Verification of Federal Employees and Contractors,” January 2022

6. 10 U.S.C. § 2224, "Defense Information Assurance Program", as amended

7. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

8. Public Law 109-461 (P.L. 109-461), Veterans Benefits, Health Care, and Information Technology Act of 2006, as amended, Title IX, Information Security Matters

9. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”, as amended

10. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, https://www.va.gov/vapubs/index.cfm

11. VA Handbook 0710, “Personnel Security and Suitability Program,” May 2, 2016, https://www.va.gov/vapubs/index.cfm

12. VA Directive 6102, “Internet/Intranet Services,” August 5, 2019

13. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and Guidelines,” as amended

14. Office of Management and Budget (OMB) Circular A-130, “Managing Federal Information as a Strategic Resource,” July 28, 2016

15. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed Services (CHAMPUS)”, as amended

16. NIST SP 800-66 Rev. 2, “Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule: A Cybersecurity Resource Guide,” February 2024

17. 45 C.F.R Parts 160 and 164, Subparts A and E, the Standards for Privacy of Individually Identifiable Health Information (“Privacy Rule”); and 45 C.F.R. Parts 160 and 164, Subparts A and C, the Security Standard (“Security Rule”); as amended

18. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended

19. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

20. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021 (see VA NOTICE 24-18, dated September 27, 2024, “Update to VA Directive 6500 Cybersecurity Program”, and VA Notice 25-07, dated 3/18/25, “Amending VA Directive 6500 to incorporate M-24-15”)

21. VA Handbook 6500, “Risk Management Framework for VA Information Systems VA Information Security Program,” February 24, 2021 (see VA Notice 25-01, dated October 15, 2024, “Update to VA Handbook 6500 Risk Management Framework for VA Information Systems VA Information Security Program”, and VA Notice 25-06, dated 3/18/25, “Amending VA Directive 6500 to incorporate M-24-15”)

22. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI),” June 30, 2023

23. VA Handbook 6500.6, “Contract Security,” March 12, 2010 (see VA Notice 24-12, dated April 22, 2024, “Update to VA Handbook 6500.6, Contract Security, Appendix C VA Information and Information System Security/Privacy Language For Inclusion Into Contracts, As Appropriate”)

24. VA Handbook 6500.8, “Information System Contingency Planning,” March 25, 2025

25. VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018

26. VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017

27. OIT Process Asset Library (PAL), OIT Process Asset Library.

28. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

29. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014

30. VA Directive 6510, “VA Identity, Credential and Access Management,” September 3, 2024

31. VA Handbook 6510, “VA Identity, Credential and Access Management,” September 27, 2024

32. VA Directive and Handbook 6513, “Secure External Connections,” October 12, 2017

33. VA Directive 6300, “Records and Information Management,” September 21, 2018

34. VA Handbook, 6300.1, “Records Management Procedures,“ March 24, 2010

35. NIST SP 800-37 Rev 2, “Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy,” December 2018

36. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020)

37. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015

38. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” March 24, 2014

39. OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005

40. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019

41. OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008

42. Federal Identity, Credential, and Access Management (FICAM) Architecture, June 30, 2023 (FICAM Architecture (idmanagement.gov))

43. NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access,“ June 2018

44. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, “Digital Identity Guidelines,” updated March 02, 2020

45. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014

46. VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

47. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

48. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

49. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

50. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019

51. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008

52. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (P.L. 110–140), December 19, 2007

53. Section 104 of the Energy Policy Act of 2005, (P.L. 109–58), August 8, 2005

54. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 2, 2001

55. VA Directive 0057, “VA Environmental Management Program,” October 25, 2022

56. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

57. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

58. “Veteran Focused Integration Process (VIP) Guide 4.0,” March 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

59. VA Memorandum “Proper Use of Email and Other Messaging Services,” January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

60. “Product Line Management Transformation Playbook” version 3.1, August 2023, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

61. NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020

62. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol Version 6 (IPv6),” November 19, 2020

63. Social Security Number (SSN) Fraud Prevention Act of 2017

64. Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23, 2018

65. C.F.R Title 15 Part 7, “Securing the Information and Communications Technology and Services (ICTS) Supply Chain”, as amended

66. Executive Order 14028, “Executive Order on Improving the Nation's Cybersecurity,” May 12, 2021, https://bidenwhitehouse.archives.gov/briefing-room/presidential-actions/2025/01/16/executive-order-on-strengthening-and-promoting-innovation-in-the-nations-cybersecurity/

67. OMB Memorandum M-22-09, “Moving the U.S. Government Toward Zero Trust Cybersecurity Principles”, January 26, 2022, https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf.

68. NIST SP 800-52 Revision 2, “Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations

69. OMB M-22-18, “Enhancing the Security of the Software Supply Chain through Secure Software Development Practices,” September 14, 2022

70. OMB M-23-16, “Update to Memorandum M-22-18,” June 9, 2023

71. OMB M-21-31, “Improving the Federal Government’s Investigative and Remediation Capabilities Related to Cybersecurity Incidents,” August 27, 2021

72. NIST SP 800-88 Revision 1 “Guidelines for Media Sanitization,” December 2014

73. CISA Binding Operational Directive (BOD) 19-02: “Vulnerability Remediation Requirements of Internet-Accessible Systems,” April 29, 2019, BOD 19-02: Vulnerability Remediation Requirements for Internet-Accessible Systems | CISA

74. CISA BOD 22-01: “Reducing the Significant Risk of Known Exploited Vulnerabilities,” November 3, 2021, BOD 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities | CISA

75. CISA BOD 23-01: Improving Asset Visibility and Vulnerability Detection on Federal Networks.” Cybersecurity & Infrastructure Security Agency (CISA), BOD 23-01: Improving Asset Visibility and Vulnerability Detection on Federal Networks | CISA

76. VA Directive 6550, Pre-Procurement Assessment and Implementation of Medical Devices/Systems, June 03, 2019

77. VA Memorandum, “VA Security Controls,” January 17, 2025, https://www.voa.va.gov/DocumentView.aspx?DocumentID=5010

78. VA Financial Management Business Transformation (FMBT), Independent Verification & Validation (IV&V) Plan, August 23, 2018 | Version 1.2, Attachment #1

79. FMBT IV&V Plan Checklists, August 23, 2018, v1.2., PWS Attachment #2

80. FMBT Roadmap draft, (20260128)

81. FMBT Product Delivery Framework V6.0 30APR2021, PWS Attachment #4

82. FMBT Product Lifecycle RACI v7 30APR2021, PWS Attachment #5

83. FMBT Risk Management Framework FINAL (02062025), PWS Attachment #6

84. VA FMBT Program Test Strategy V1.3, PWS Attachment #7

85. SQAS FMBT JIRA Process and Procedures Guide v1.0, PWS Attachment #8

86. FMBT Project Requirements Management Plan, v4.0_11.25.19, PWS Attachment #9.

87. iFAMS Sustainment Agility Handbook v1.9, February, PWS Attachment #10

SCOPE OF WORK

The Contractor shall perform IV&V services, comprised of independent testing and quality assurance services, in support of the FMBT program in accordance with the tasks under this PWS. The PWS requirements are based on the IV&V activities in the Government defined FMBT IV&V Plan. The FMBT IV&V Plan is a living document, occasionally being revised by the Government based on the ongoing planning, development and delivery of other program deliverables and as knowledge accumulates about the characteristics of the system, the software, and the problem areas in the system or the lifecycle methodology adopted by the FMBT program.

The FMBT IV&V Plan is being provided as a comprehensive guide to the IV&V activities defined in support of the FMBT program. The FMBT IV&V Plan was developed by the Government based on, but not limited to, Institute of Electrical and Electronics Engineers (IEEE) Standards to encompass the full breath of IV&V activities potentially performed for the program. The selection and execution of the IV&V tasks in this effort is expected to be applied based on program risk and the program schedule.

The Government, at its discretion, may define a sub-set of IV&V activities contained within the overall FMBT IV&V Plan for execution within an FMBT IV&V Execution Plan based on program priorities.

The Contractor shall work with the Government IV&V team on coordination and scheduling of IV&V tasks within this PWS. The Government IV&V team is the Independent Verification and Validation (IV&V) Directorate , under the Office of Compliance, Risk and Remediation (CRR) within OIT. CRR IV&V directorate has overall responsibility for IV&V services on the FMBT program. Contractor and Government IV&V team collaboration will include the use of VA’s Microsoft Teams application.

PERFORMANCE DETAILS

PERFORMANCE PERIOD

The period of performance (PoP) shall be a 12-month base period with four (4) 12-month option periods to be exercised by the Government at its sole discretion.

This Task Order also includes eight (8) Optional Tasks. Optional Task One through Four may be exercised up to one (1) time in each of the base and option periods for a period of up to 12 months. Optional Task Five through Seven may be exercised up to four (4) times in each of the Base and Option Periods, and each exercised optional task shall have a period of performance of up to 12 months. Optional Task Eight may be exercised one (1) time during performance of this Task Order for a period of 60 days. The overall Task Order POP shall not exceed 60 months.

Any work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO).

There are 11 Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, five are set by date:

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

PLACE OF PERFORMANCE

Efforts under this TO shall be performed at Contractor Site within the United States only, to include telework/remote. The Contractor shall identify the Contractor’s place of performance in their Contractor Project Management Plan submission. When emergencies, natural disasters, or special circumstances occur, the Contracting Officer’s Representative (COR), in coordination with VA Program Manager, will evaluate and approve changes for special circumstances on a case-by-case basis. The Contractor shall identify the Contractor’s place of performance in their submission.

TRAVEL

The Government anticipates travel under this effort to perform the tasks associated with the effort throughout the period of performance. The Government encourages maximum utilization of teleconferencing and video conferencing for meetings. The Government anticipates travel may be required in support of meetings, training, presentations, or briefings with project stakeholders including project team members, VA management, and VA customers impacted by business, functional, product, and process requirements.

Travel shall be in accordance with the Federal Travel Regulations (FTR) and requires advanced written concurrence by the COR, in conjunction with the VA Program Manager. Travel and per diem shall be reimbursed in accordance with FTR. The Contractor shall provide cost estimates with each travel request to the COR. Each Contractor invoice must include copies of all requested, applicable, and required receipts (FTR §301-11.25: required for lodging, regardless of amount, and a receipt for every authorized expense over $75) that support the travel costs claimed in the invoice. Contractor travel within the local commuting area of 50-miles will not be reimbursed. Travel performed for personal convenience and daily travel to and from work at the Contractor’s facility will not be reimbursed. Local travel within a 50-mile radius from the Contractor's facility is considered the cost of doing business and will not be reimbursed. This includes travel, subsistence, and associated labor charges for travel time.

The total estimated number of trips in support of the program related meetings for this effort is 15 over the life of the contract. Anticipated locations in the Austin Texas area, include the following, estimated at 3 days in duration:

1. Austin Information Technology Center (AITC) 1615 Woodward Street Austin, TX. 78772

SPECIFIC TASKS AND DELIVERABLES

The Contractor shall perform the following:

PROJECT MANAGEMENT

CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Project Management Plan (CPMP) that outlines the Contractor’s approach, timeline, and tools to be used in execution of this TO effort. The CPMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks, and resource support. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPMP shall be concurred upon by the VA PM and Alternate PMs and updated in accordance with Section B of the TO. The Contractor shall update and maintain the VA Program Manager (PM) approved CPMP throughout the PoP.

The Contractor shall work with the Government IV&V team on the coordination and scheduling of IV&V tasks. The Government IV&V team is IV&V directorate, under Compliance, Risk and Remediation (CRR) the Office of Information Technology.

The Contractor shall also develop and maintain an FMBT IV&V Integrated Master Schedule and Work Breakdown Structure (FMBT IV&V IMS/WBS), encompassing all Government and Contractor IV&V activities including deliverables, and shall coordinate with the Government to receive input and approval. The Contractor shall define all individual activities, regardless of how minimal the hours are for the individual activity and include them in the project schedule. The Contractor shall assign the Contractor staff to the appropriate activities in the schedule as they pertain to the activities described in Section 5.0 and subjections of the PWS and the schedule of deliverables. The Contractor shall provide the actual percent complete for all activities described in Section 5.0 of the PWS and the schedule of deliverables in the schedule on a weekly basis. Both Government and contractor FMBT IV&V work will be entered and managed in the VA IV&V JIRA tool utilizing IV&V JIRA procedures and processes. The FMBT IV&V IMS/WBS shall be developed in Microsoft Project 2021 or other agreed upon tool. The initial baseline IV&V IMS/WBS shall be approved by the VA PM and Alternate PMs and updated in accordance with Section B of the contract. The Contractor shall update and maintain the approved FMBT IV&V IMS/WBS throughout the PoP.

Deliverable:

A. Contractor Project Management Plan B. FMBT IV&V Integrated Master Schedule and Work Breakdown Structure

REPORTING REQUIREMENTS

The Contractor shall provide the VA PM, Alternate VA PMs, and COR with IV&V Weekly Status Reports in electronic form in Microsoft Word and Project formats. The report shall include detailed instructions/explanations for each required data element, to ensure that data is accurate and consistent. These reports shall reflect data as of the last day of the preceding week.

The IV&V Weekly Status Reports shall cover all work completed during the reporting period and work planned for the subsequent reporting period. The report shall also identify any problems that arose and a description of how the problems were resolved. If problems have not been completely resolved, the Contractor shall provide an explanation including their plan and timeframe for resolving the issue. The report shall also include an itemized list of all Information and Communication Technology (ICT) deliverables and their current Section 508 conformance status. The Contractor shall monitor performance against the CPMP and report any deviations. The Contractor shall keep in communication with the VA PM, Alternate PMs, and COR accordingly so that issues that arise are transparent to both parties to prevent escalation of outstanding issues.

The IV&V Weekly Status Report shall provide accurate, timely, and complete project information including, but not limited to, the following data elements:

1. Project Name.

2. Noteworthy Items

3. Hot Topics: (Include items or observations of potential significance to the FMBT program or FMBT IV&V activities)

4. Big Wins: (Include good news, positive IV&V impacts, FMBT IV&V team collaborations (internal and external))

5. UP Next: (Include insight into next two weeks of upcoming anticipated IV&V activities.)

6. Accomplishments (Include significant FMBT IV&V activities completed, date completed and outcome.)

7. Stakeholder Engagements (Include the Stakeholder(s) collaborated with, the activity date, the topic, and the outcome.)

8. Activities requiring collaboration (Include the Stakeholder(s) to be collaborated with, the anticipated activity date, the topic, and the expected outcome.)

9. Risks and Mitigations (Include risks that could have detrimental impact to FMBT priorities, affect other VA systems/programs, etc. The risk must include the VA FMBT IV&V JIRA number, brief description, background activities, potential impact of the risk and mitigation efforts.)

10. Impediments

11. Questions, Comments, Concerns

12. FMBT IV&V Implementation Wave Independent Test and Evaluation Status

13. FMBT IV&V O&M Independent Test Execution and Evaluation Status

14. FMBT IV&V Reported Defects (Status by Implementation Wave and O&M)

15. FMBT IV&V Findings and Recommendations

16. FMBT IV&V Deliverables Progress

17. FMBT IV&V Product Reviews Status

18. FMBT IV&V Optional Tasks Reporting (if applicable)

19. FMBT IV&V Meetings Attended

The Contactor shall also provide a weekly IV&V status meeting (virtual or other) to discuss the status of the project (work in-progress, completed and planned) including any VA PM/COR or Contractor concerns or project issues.

The Contractor shall also deliver IV&V Monthly Progress Reports detailing the status of all work efforts. These reports shall provide accurate, timely, and complete project information including, but not limited to, the following data elements:

1. Project Name.

2. Overview and description of the TO.

3. Overall high-level assessment of TO progress.

4. All work in-progress and completed during the reporting period.

5. Identification of any TO-related issues uncovered during the reporting period and highlight those areas with a high probability of impacting schedule, cost, or performance goals and their likely impact on schedule, cost, or performance goals.

6. Explanations for any unresolved issues, including possible solutions and any actions required of the Government and/or Contractor to resolve or mitigate any identified issue, including a plan and timeframe for resolution.

7. Status on previously identified issues, actions taken to mitigate the situation and/or progress made in rectifying the situation.

8. Work planned for the subsequent four reporting periods, when applicable.

9. Current TO schedule overlaid on original TO schedule showing any delays or advancement in schedule.

10. Workforce staffing data showing all Contractor personnel performing on the effort during the current reporting period. After the initial labor baseline is provided, each IV&V Monthly Progress Report shall identify any changes in staffing identifying each person who was added to the contract or removed from the contract.

11. Original schedule of deliverables and the corresponding deliverables made during the current reporting period.

12. Identification of a single, Contractor Onboarding point of Contact (POC), the names of all personnel engaged on the task, their initial training completion date for VA Privacy and Information Security Awareness and Rules of Behavior Training and Health Insurance Portability and Accountability Act (HIPPA) training, and their next required training date.

These reports shall not be the only means of communication between the Contractor and VA PM/COR to advise of performance/schedule issues and to develop strategies for addressing the issues. The Contractor shall continuously monitor performance and report any deviation from the CPMP or previous IV&V Monthly Progress Report to the VA PM/COR during routine regular communications, generally daily or weekly. In the case of a significant IV&V risk, issue or situation, the Contractor shall notify the VA PM, Alternate PMs, and COR within twenty-four hours.

The Contractor shall develop an IV&V Bi-Weekly leadership reports related to the status, execution, findings and recommendations from IV&V Independent Testing and IV&V O&M Testing.

Deliverable:

A. IV&V Weekly Status Report B. IV&V Monthly Progress Report C. IV&V Bi-Weekly Leadership Report

TECHNICAL KICKOFF MEETING

A technical kickoff meeting shall be held within 10 days after TO award. The Contractor shall coordinate the date, time, and location (can be virtual) with the Contracting Officer (CO), and the COR, in conjunction with the VA PM. The Contractor shall invite the CO, Contract Specialist (CS), COR, the VA PM, and the Alternate PMs. The Contractor shall provide a draft agenda to the CO, COR, VA PM, and Alternate PMs five (5) business days prior to the meeting. Upon Government approval of a final agenda, the Contractor shall distribute to all meeting attendees. During the kickoff-meeting, the Contractor shall present in a Draft Summary Technical Kickoff Report, for review and approval by the Government, the details of the intended approach, work plan, draft staffing/resource plan and project schedule for each effort via a Microsoft Office PowerPoint presentation. At the conclusion of the meeting, the Contractor shall update the presentation with the revised product entitled “Final Summary Technical Kickoff Report” which shall include notes on any major issues, agreements, or disagreements discussed during the kickoff meeting.

The Contractor shall submit the final updated presentation to the VA PMs/COR for review and acceptance within three (3) business days after the meeting. The Contractor shall obtain concurrence from the COR and VA PM on the content of the meeting minutes prior to distribution of the document.

Deliverables:

A. Draft Kick-Off Meeting Agenda B. Final Kick-Off Meeting Agenda C. Draft Summary Technical Kickoff Report D. Final Summary Technical Kickoff Report E. Technical Kickoff Meeting Minutes

1.1.1 ONBOARDING

The Contractor shall manage the onboarding of its staff and shall coordinate with the COR. Onboarding includes steps to obtain a VA network and email account, complete training, initiate background investigations, and gain physical and logical access to the Government approved VA systems environments. The Contractor shall coordinate with the VA PM, Alternate PMs, and COR to request access to the required FMBT test environments and any required production environments.

The Contractor shall track the onboarding status of all Contractor personnel and be responsible for accurate and timely submission of all required VA onboarding paperwork to the COR. The Contractor shall be responsible for tracking the status of all their staff’s onboarding activities and report the status at the staff level during onboarding status meetings. The Contractor shall provide the Onboarding Status Report, for any staff with outstanding onboarding requests for review by the VA PM/COR, in accordance with the IV&V Monthly Progress Report in Section 5.1.2.

DELIVERABLE:

A. Onboarding Status Report

1.1.2 STAFFING/RESOURCE PLANNING

The Contractor shall deliver a Staffing/Resource Plan to the Government for approval. The Contractor shall identify any known technology resource requirements and provide the materials that are needed to support the TO. The Contractor shall identify, secure, and utilize the minimum levels of staff, with optimal skill sets, that are required to support this TO. The Staffing/Resource Plan shall include an analysis of current and projected resource needs to meet the requirements of this TO.

The Contractor shall provide competent, productive, and qualified IT professionals to be assigned to the project team. These individuals must have expertise in the Agile development methodology, Subject matter expertise and knowledge of financial management and acquisitions business transformation, and expert knowledge related to SaaS delivery model adoption. The following two Key Personnel with associated qualifications are required to successfully support the program:

Key Personnel:

1. The Government anticipates requiring six Subject Matter Experts (SME) that are Momentum functional and systems experts, with a minimum of 5 years’ experience including functional and technical experience with large, complex Momentum federal implementations. The Contractor shall also have experience with Momentum functional and technical systems testing. Experience utilizing and optimizing automated test scripts is highly desirable.

2. The Government anticipates requiring one SME that is a VA Federal Financial Accounting expert with extensive knowledge of VA enterprise systems, VA operations, and the FMBT program environment. A minimum of 5 years VA federal Government accounting and financial management experience is required. Previous experience supporting the FMBT program and Momentum experience is highly desirable.

3. The Government anticipates requiring two Program Managers who hold a Project Management Professional (PMP) certification. These individuals must have at least 5 years’ experience in implementing program management techniques including federal IV&V processes, VA’s Agile test and development methodologies and industry best practices. Additionally, the program managers must have experience with managing a large enterprise-wide program.

4. The Government anticipates requiring five IV&V Test Leads with a minimum of 5 years’ experience in performing IV&V testing on large-scale federal IT mission-critical enterprise systems, VA’s Agile test and development methodologies and industry best practices. The IV&V test leads shall have demonstrated expertise in developing and executing test strategies, test plans, and test cases aligned with VA’s IEEE standards-based testing methodologies, and other industry best practices. The individuals must have experience leading test teams, managing test environments, defect tracking, requirements traceability, and risk-based testing approaches. The IV&V test leads shall also have experience briefing senior program leadership on test readiness, progress, risks and quality metrics.

The Contractor shall provide resumes for any individual(s) who the Contractor proposes to fill the Key Personnel positions identified above. Submitted resumes are to be redacted to prevent disclosure of personally identifiable information (PII). Examples of PII include but are not limited to names, addresses, phone numbers, social security numbers, and birthdays/dates. For those individuals proposed as Key Personnel who are not current employees of the contractor, a signed a letter of intent will be required. The Key Personnel positions and redacted resumes of individuals who shall fill the key personnel positions shall be included as an attachment to the contract in Section D upon award.

During the first 120 days of performance, the Contractor shall not replace or substitute Key Personnel who Contractor proposed pre-award unless the replacement is necessitated by illness, death, or termination of employment. The Contractor shall notify the Contracting Officer within 15 calendar days after the occurrence of any of these events and provide a detailed explanation of the circumstances necessitating the proposed substitution and shall demonstrate that the proposed replacement personnel are of at least substantially equal ability and qualifications as the individual originally proposed for that position.

After the initial 120 days, any personnel the Contractor offers as substitutes for the above identified key personnel positions shall have the ability and qualifications equal to or better than the key personnel which are being replaced and shall meet or exceed the qualifications designated for that Key Personnel position. If any change to a key personnel position becomes necessary, the Contractor shall immediately notify the VA PM and COR in writing, but whenever possible Contractor shall notify the VA PM of substitutions in personnel in writing 30 calendar days prior to making any change in key personnel, and provide a detailed explanation of the circumstances necessitating the proposed substitution and shall demonstrate that the proposed replacement personnel are of at least substantially equal ability and qualifications as the individual originally proposed for that position and that the proposed replacement meets or exceeds the qualifications designated for that Key Personnel position.

The Contractor agrees that it has a contractual obligation to mitigate the consequences of the loss of Key Personnel and shall promptly secure any necessary replacements in accordance with (IAW) this PWS section in order to avoid any interruption in contract performance by that Key Personnel. Failure to replace a Key Personnel pursuant to this clause shall be considered a condition endangering contract performance and shall provide grounds for default termination.

Deliverable:

A. Staffing/Resource Plan

1.2 FMBT IV&V SERVICES AND STANDARDS

IV&V is an extension of program management and system engineering that employs a rigorous methodology to identify objective data and conclusions to provide feedback about quality, performance, and schedule to stakeholders. IV&V is performed in parallel with all life cycle stages, not at their conclusion. In the context of the FMBT IV&V Plan, the term “life cycle” is used in reference to the evolution of a system, product, service, project or other human-made entity from conception through retirement (Institute of Electrical and Electronics Engineers (IEEE)Standard 12207:2017).

The FMBT IV&V Plan was developed by the Government based on, but not limited to, IEEE Standards to encompass the full breath of IV&V activities potentially performed for the FMBT program. The selection and execution of the IV&V tasks in this effort is expected to be applied by the Government based on program risk and the program schedule. The IV&V PWS tasks execution may need to be tailored by the Contractor with concurrence from the VA PM to align with the FMBT program execution methodology, the program deliverables, or the program implementation approach. The Contractor shall utilize its understanding of the barriers, challenges and risks related to large scale Enterprise Resource Planning (ERP) implementations of Momentum Financial Management applications to provide recommendations to the VA PM related to mitigating risk to the FMBT program and FMBT IV&V execution or improving FMBT IV&V processes.

The FMBT IV&V Plan is intended to be a comprehensive integrated IV&V plan tailored to meet the needs of the VA FMBT program and to be inclusive of the IV&V process standards defined in IEEE Standard 1012-2024: System and Software and Hardware Verification and Validation. While tailored to include areas beyond systems engineering, such as, organizational change management, the FMBT IV&V Plan is based on several industry best practices, including Project Management Institute (PMI), Guide to the Project Management Body of Knowledge (PMBOK) and Capability Maturity Model Integration (CMMI), and was developed in accordance with the following Institute of Electrical and Electronics Engineers (IEEE) Standards:

· IEEE Std. 1012-2012: System and Software Verification and Validation

· IEEE Std. 1012-2024: System and Software and Hardware Verification and Validation

· IEEE Std. 730-2014: Software Quality Assurance Processes

· IEEE Std. 1028-2008: Software Reviews and Audits

IEEE Standard 1012 applies to systems, software, and hardware being developed, maintained, or reused (legacy, commercial off-the-shelf (COTS), non-developmental items). The IEEE Standard does not assign the responsibility for performing the verification and validation tasks to any specific organization. The analysis, evaluation, and test activities may be performed by multiple organizations; however, the methods and purpose will differ for each organization’s functional objectives. This plan is intended to establish the framework for on-going integrated planning efforts and refinement of the FMBT VA IV&V approach.

IV&V provides an independent, objective assessment regarding the quality of program management and systems engineering products and processes.

Verification: Confirmation by examination and provisions of objective evidence that specified requirements have been fulfilled.

Validation: Confirmation by examination and provisions of objective evidence that the requirements for a specific intended use are fulfilled.

IV&V utilizes a variety of IV&V methods in the planning and execution of IV&V activities. The IV&V techniques and methods included in the FMBT IV&V Plan include independent testing, product/technical reviews, evaluation, review, inspection, walkthrough, interviews, and observation. The IV&V function is to provide recommendations for process or document improvements, including suggestions for increased efficiency and effectiveness. The IV&V function will provide comprehensive deliverables including various analysis and assessment reports.

For all tasks within section 5.2 of this PWS, the Contractor shall track all IV&V findings and recommendations, defects, risk, issues, and lesson learned to closure.

1.2.1 IMPLEMENTATION WAVES INDEPENDENT TEST AND EVALUATION

The FMBT program through an incremental deployment approach is migrating VA’s current financial management and acquisition environment to the new Integrated Financial and Acquisition Management System (iFAMS) utilizing Momentum. Each deployment, referred to as a “wave,” will deliver capabilities to a subset of the VA organization. The scope of each wave will define the VA organization, funds, Momentum functionality, business intelligence, data, legacy systems, and reports.

The FMBT Implementation Waves include the approved VA Business Processes based on approved requirements and associated interfaces for a given wave. Each FMBT Implementation Wave builds on the approved VA enterprise configuration and may incorporate additional requirements, business processes and interfaces as needed. The scope of the system under test may include components, configurations, workflows, reports, transactions, interfaces, and Application Programming Interfaces (API)s. The FMBT program documents implementation waves in the FMBT Implementation Roadmap. The document is reviewed and revised as necessary by the FMBT program.

All IV&V independent test and evaluation activities shall be aligned with FMBT Implementation Wave iterative development and configuration releases, iFAMS Operations and Maintenance (O&M) planned monthly releases, out-of-cycle releases, emergency releases, special projects and Momentum upgrade releases. IV&V independent test and evaluation activities for Momentum upgrade releases are addressed in PWS Section 5.2.1. IV&V independent test and evaluation activities for O&M, out-of-cycle releases, emergency releases and special projects are addressed in PWS Section 5.2.2.

An objective of the IV&V test approach is to select the verification and validation analysis and testing technique to most effectively detect the system and software problems. IV&V activities may focus on different levels and types of testing to include but not limited to: Component, Integration, System, User Acceptance, Performance, Data Conversion, Smoke, Regression, and Security.

The FMBT IV&V Plan System and Software test approach section incorporates IEEE Standard 1012 software IV&V activities related to software testing. System and software test plan and execution IV&V tasks include the following activities: the review and verification of test plans, user stories, design, configuration, test scripts, test execution, defect disposition, and interfacing data files. Selected system and software activities from the FMBT IV&V Plan have been incorporated into the VA IV&V requirements within the sub-sections of 5.2.1 of this PWS. The Contractor shall manage Wave scrum team(s) with SAFe Certified Scrum Master(s).

1.2.1.1 SYSTEM INTEGRATOR TEST PLAN, TEST SCRIPT AND EXECUTION ASSESSMENT

The Contractor shall review system integrator (SI) test plans, test scripts, test procedures, test design and analyze test execution, test results, Agility tickets and…