PWS CCSS 2.0 RFI.pdf

Corporate Consolidated Support Services 2

VA-25-00009118

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Office of Information & Technology (OIT) Product Delivery Service (PDS) Corporate (CORP) Service Line

Consolidated Corporate Support Services (CCSS) 2

Date: October 31, 2024

PWS Version Number: 1.0

Contents

1.0 BACKGROUND

2.0 APPLICABLE DOCUMENTS

3.0 SCOPE OF WORK

4.0 PERFORMANCE DETAILS

4.1 PERFORMANCE PERIOD

4.2 PLACE OF PERFORMANCE

4.3 TRAVEL

4.4 KEY TECHNOLOGIES

4.5 RESOURCE CERTIFICATION

5.0 SPECIFIC TASKS AND DELIVERABLES

5.1 PROGRAM MANAGEMENT

5.1.1 CONTRACTOR PROJECT MANAGEMENT PLAN

5.1.2 REPORTING REQUIREMENTS

5.1.3 TECHNICAL KICKOFF MEETING

5.1.4 ONBOARDING AND OFFBOARDING

5.1.5 MANDATORY TRAINING

5.2 FinaNCIAL MANAGEMENT SYSTEM (FMS) AND OPEN SYSTEMS

SUSTAIMENT SUPPORT

5.2.1 FMS AND OPEN SYSTEMS ADMINISTRATIVE SUSTAINMENT

SUPPORT

5.2.2 OPEN SYSTEMS TECHNICAL SUSTAINMENT SUPPORT

5.2.3 FMS MAINFRAME TECHNICAL SUSTAINMENT SUPPORT

5.3 SCOPING OF ADDITIONAL CORPORATE PRODUCTS

5.4 OPTION PERIOD ONE

5.5 OPTION PERIOD TWO

5.6 OPTION PERIOD THREE

5.7 OPTION PERIOD FOUR

5.8 OPTIONAL TASK ONE – LEGACY PRODUCTS

5.8.1 PRODUCT ASSESSMENT

5.8.2 ARCHITECTURE DESIGN AND ENHANCEMENTS

5.8.3 PRODUCT SUPPORT

5.8.4 SYSTEM AND PRODUCT TESTING

5.8.5 DEFECT REMEDIATION AND ENHANCEMENTS

5.8.6 INFORMATION ASSURANCE

5.9 OPTIONAL TASK TWO – DEVSECOPS PRODUCTS

5.9.1 AGILE RELEASE TRAIN (ART) TEAMS

5.9.2 SYSTEMS TEAMS

5.9.3 IMPLEMENTATION TEAMS

5.10 OPTIONAL TASK THREE – PRODUCT AND DATA MIGRATION

5.11 OPTIONAL TASK FOUR – EDISCOVERY

5.12 OPTIONAL TASK FIVE – Enterprise Human Capital Management (EHCM)

INTERFACE/API SUPPORT

5.13 OPTIONAL TASK SIX – SURGE SUPPORT

5.14 OPTIONAL TASK SEVEN – PRODUCT CLOSURE

5.15 OPTIONAL TASK EIGHT – PHASE-OUT TRANSITION PLAN

6.0 GENERAL REQUIREMENTS

6.1 ENTERPRISE AND IT FRAMEWORK

6.1.1 VA TECHNICAL REFERENCE MODEL

6.1.2 FEDERAL IDENTITY, CREDENTIAL, AND ACCESS MANAGEMENT

(FICAM)

6.1.3 INTERNET PROTOCOL VERSION 6 (IPV6)

6.1.4 TRUSTED INTERNET CONNECTION (TIC)

6.1.5 STANDARD COMPUTER CONFIGURATION

6.1.6 VETERAN FOCUSED INTEGRATION PROCESS (VIP) AND PRODUCT

LINE MANAGEMENT (PLM)

6.1.7 PROCESS ASSET LIBRARY (PAL)

6.1.8 AUTHORITATIVE DATA SOURCES

6.1.9 SOCIAL SECURITY NUMBER (SSN) REDUCTION

6.1.10 SOFTWARE AND LICENSING REQUIREMENTS

6.2 SECURITY AND PRIVACY REQUIREMENTS

6.2.1 POSITION/TASK RISK DESIGNATION LEVEL(S)

6.2.2 CONTRACTOR PERSONNEL SECURITY REQUIREMENTS

6.3 METHOD AND DISTRIBUTION OF DELIVERABLES

6.4 PERFORMANCE METRICS

6.5 FACILITY/RESOURCE PROVISIONS

6.6 GOVERNMENT FURNISHED PROPERTY

6.7 SHIPMENT OF HARDWARE OR EQUIPMENT

ADDENDUM A – ADDITIONAL VA REQUIREMENTS, CONSOLIDATED

ADDENDUM B – VA INFORMATION AND INFORMATION SYSTEM

SECURITY/PRIVACY LANGUAGE

1.0 BACKGROUND

The Department of Veterans Affairs (VA) depends on Information Management/ Information Technology systems to meet mission goals. VA’s Office of Information & Technology (OIT), Product Delivery Service (PDS) strives to provide high quality, effective, and efficient Information Technology (IT) services to those responsible for providing care to the Veterans at the point-of-care as well as throughout all the points of the Veterans’ health care in an effective, timely and compassionate manner.

The VA OIT PDS, Corporate (CORP) Service Line (SL) delivers world-class, Veteran-centric capabilities that provide secure, seamless delivery of IT systems to VA corporate offices so these offices may efficiently and effectively provide benefits and services to Veterans and their families. Corporate SL IT systems enable the delivery of services to Veterans by enabling technology to provide relevant internal, foundational information to the VA workforce. CORP SL provides available, adaptable, secure, and cost-effective IT products and services to VA business offices, enabling VA staff to provide mission-critical support to the Nation’s Veterans.

CORP SL provides oversight, and overall leadership to software development projects, Commercial Off- The-Shelf (COTS), Software as a Service implementations, and system maintenance to support VA business functions and deliver value. CORP SL includes the following four Product Lines (PL):

Acquisition and Property Management - IT products for conducting acquisition and performance management activities, including acquisition planning, sourcing, contracting, purchasing, equipment and inventory management, and facility operations, and construction.

Financial Management - IT products for conducting financial management activities including budget formulation and execution, account management, payment processing and financial performance reporting.

Human Capital Management - IT products for conducting human capital management, including talent acquisition and development, employee performance and compensation management and employee separation and retirement management.

Office of the Secretary of VA (Sec VA)/Congressional/Legal Affairs - IT products for supporting the activities of Sec VA, Office of General Counsel, Office of the Inspector General (OIG), and Congressional Liaison operations.

It also includes products for enabling regulatory activities such as matter intake and tracking under the VA accountability and whistleblower's protection program.

CORP SL is currently responsible for approximately 170 products assigned within the four PLs and is subject to change. It is anticipated that newly created product line efforts will be added to the CORP SL throughout the life of this contract. Additionally, products may be re-assigned to other portfolios as the VA matures this model.

Commented [WR1]: Suggest start with VA, then describe VA’s OIT contribution to VA’s mission.

E.g., “The Department of Veterans Affairs (VA) depends on Information Management/ Information Technology (IM/IT) systems to meet mission goals. VA’s Office of Information & Technology (OIT), Product Delivery Service (PDS) strives to provide high quality, effective, and efficient Information Technology (IT) services to those responsible for providing care to the Veterans at the point-of-care as well as throughout all the points of the Veterans’ health care in an effective, timely and compassionate manner.

All CORP SL activities follow the Veteran-focused Integration Process (VIP) framework.

VIP is a Lean-Agile framework that services the interest of Veterans through the efficient streamlining of activities that occur within the enterprise for the development and management of IT projects and products and will propel the Department with even more rigor toward Veteran-focused delivery of IT capabilities. The VIP framework unifies and streamlines IT delivery oversight and will deliver IT products more efficiently, securely, and predictably.

VA OIT instituted an initiative to improve IT solutions delivery and sustainment and strengthen security of our IT systems. This ensures all efforts have requisite VA resources across Development, Security and (DevSecOps), hence DevSecOps. VA OIT also implemented a Product Line Manager (PLM) model which complements the DevSecOps approach to product management, software delivery, and overall information technology support. DevSecOps improves the experience of OIT customers, enables OIT to implement new technologies and systems and update existing systems more quickly and frequently, and lowers costs by leveraging industry best practices and innovation.

The wider DevSecOps community must prepare to address global trends in Artificial Intelligence (AI): increased use of AI in code testing, ongoing threats to IP ownership and privacy, a rise in AI bias, and an increased reliance on AI technologies. This will require a cultural and strategic shift, which demands rethinking business and security processes, product development, and customer engagement strategies. This shift promises a radical increase in productivity and accuracy, but it also demands significant adjustments to traditional testing roles and practices.

The tasks described in the Performance Work Statement (PWS) are required to support the ongoing operations, maintenance, enhancement, and development for the products assigned to the CORP SL.

2.0 APPLICABLE DOCUMENTS

In the performance of the tasks associated with this PWS, the Contractor shall comply with the following:

1. 44 U.S.C. § 3541-3549, “Federal Information Security Management Act (FISMA) of 2002”

2. “FISMA of 2014”

3. Federal Information Processing Standards (FIPS) Publication 140-2, “Security Requirements for Cryptographic Modules”

4. FIPS Pub 199. “Standards for Security Categorization of Federal Information and Information Systems,” February 2004

5. FIPS Pub 200, “Minimum Security Requirements for Federal Information and

Information Systems,” March 2006

6. FIPS Pub 201-2, “Personal Identity Verification (PIV) of Federal Employees and Contractors,” August 2013

7. 10 U.S.C. § 2224, "Defense Information Assurance Program"

8. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

9. Public Law 109-461, Veterans Benefits, Health Care, and Information Technology Act of 2006, Title IX, Information Security Matters

10. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”

11. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, https://www.va.gov/vapubs/index.cfm

12. VA Handbook 0710, “Personnel Security and Suitability Program,” May 2, 2016, https://www.va.gov/vapubs/index.cfm

13. VA Directive and Handbook 6102, “Internet/Intranet Services,” August 5,

14. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and Guidelines,” January 18, 2017

15. Office of Management and Budget (OMB) Circular A-130, “Managing Federal

Information as a Strategic Resource,” July 28, 2016

16. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed

Services”

17. National Institute of Standards and Technology (NIST) Special Publication

(SP) 800-30 Rev 1, “Guide for Conducting Risk Assessment,” September

18. NIST SP 800-37 Rev 2, “Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy,” December 2018

19. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020)

20. NIST SP 800-66 Rev. 1, “An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule,” October 2008

21. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended, January 18, 2017

22. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

23. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021

24. VA Handbook 6500, “Risk Management Framework for VA Information

Systems VA Information Security Program,” February 24, 2021

25. VA Handbook 6500.2, “Management of Breaches Involving Sensitive

Personal Information (SPI),” March 12, 2019

26. VA Handbook 6500.5, “Incorporating Security and Privacy into the System

Development Lifecycle,” March 22, 2010

27. VA Handbook 6500.6, “Contract Security,” March 12, 2010

28. VA Handbook 6500.8, “Information System Contingency Planning,” April 6,

29. VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018

30. VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017

31. OIT Process Asset Library (PAL), https://www.va.gov/process/ Reference

Process Maps at https://www.va.gov/process/maps.asp and Artifact templates at https://www.va.gov/process/artifacts.asp http://www.va.gov/vapubs http://www.va.gov/vapubs

32. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

33. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014

34. VA Handbook 6508.1, “Procedures for Privacy Threshold Analysis and Privacy Impact Assessment,” July 30, 2015

35. VA Handbook 6510, “VA Identity and Access Management,” January 15,

36. VA Directive and Handbook 6513, “Secure External Connections,” October 12, 2017

37. VA Directive 6300, “Records and Information Management,” September 21,

38. VA Handbook, 6300.1, “Records Management Procedures,” March 24, 2010

39. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12)

Program,” October 26, 2015

40. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-

12) Program,” March 24, 2014

41. OMB Memorandum 05-24, “Implementation of Homeland Security

Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005

42. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019

43. OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008

44. Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance, December 2, 2011, (NOTE: Part A of the FICAM Roadmap and Implementation Guidance, v2.0, was replaced in 2015 with an updated Architecture (https://arch.idmanagement.gov/#what-is-the-ficam-architecture)

45. NIST SP 800-116 Rev 1, “Guidelines for the Use of PIV Credentials in Facility Access,” June 2018

46. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, “Digital Identity Guidelines,” updated March 02, 2020

47. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014

48. NIST SP 800-164, “Guidelines on Hardware-Rooted Security in Mobile

Devices (Draft),” October 2012

49. Draft National Institute of Standards and Technology Interagency Report

(NISTIR) 7981, “Mobile, PIV, and Authentication,” March 2014

50. VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland

Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

51. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

52. VA Memorandum “PIV Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

53. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

54. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019

55. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008

56. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (Public Law 110–140), December 19, 2007

57. Section 104 of the Energy Policy Act of 2005, (Public Law 109–58), August 8, 2005

58. Executive Order 13834, “Efficient Federal Operations,” dated May 17, 2018

59. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August

2, 2001

60. VA Directive 0058, “VA Green Purchasing Program,” July 19, 2013

61. VA Handbook 0058, “VA Green Purchasing Program,” July 19, 2013

62. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote

Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

63. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

64. “Veteran Focused Integration Process (VIP) Guide 4.0,” January 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

65. “Product Line Management (PLM) Transformation Playbook,” version 3.1, August 2023, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

66. VA Memorandum “Proper Use of Email and Other Messaging Services,” January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

67. “DevSecOps Product Line Management Playbook” version 2.0, May 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

68. NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020

69. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol

Version 6 (IPv6),” November 19, 2020

70. Social Security Number (SSN) Fraud Prevention Act of 2017

71. Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23,

72. VA Enterprise Design Patterns and Application Programming Interfaces (API) Best Practices: https://www.oit.va.gov/library/recurring/edp/ OIT PAL:

Home - Process Asset Library (sharepoint.com)

73. Scaled Agile Framework (SAFe) Diagram and related SAFe information can be referenced here: http://www.scaledagileframework.com/

74. VA Office of Information Security (OIS), Secure Code Review, Web Application Security Assessment (WASA), and Network Security Operations Center (NSOC) standards: https://vaww.oit.va.gov/office-of-information-security/

75. OIS Secure Code Review: https://mobile.va.gov/content/code-review

76. 18 F b: https://github.com/18F/api-standards

3.0 SCOPE OF WORK

The Contractor shall provide services to support IT Legacy Applications and DevSecOps for CORP SL and products in accordance with Section 5.0. The Contractor shall provide dedicated teams of cross-functional staff to design, build, operate, and maintain Corporate systems with the goal to streamline systems, improve scalability, increase availability of services, ensure security is met within VA standards, implement new technologies, such as AI, and enable more efficient delivery of services. The Contractor shall provide VA with iterations of Agile software development and Continuous Integration/Continuous Delivery (CI/CD).

4.0 PERFORMANCE DETAILS

This Task Order (TO) shall be proposed on a Firm-Fixed Price (FFP) basis with a Cost Reimbursement line item for travel.

4.1 PERFORMANCE PERIOD

The period of performance (PoP) shall be twelve (12) months from date of award with four (4) 12-month option periods and three optional tasks. Optional Task 3 may be exercised once during performance of this TO for a period of two months. The overall PoP shall not exceed 62 months.

There are eleven (11) Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, five are set by date:

New Year's Day January 1 Juneteenth June 19 Independence Day July 4 Veterans Day November 11 Christmas Day December 25

If any of the above falls on a Saturday, then Friday shall be observed as a holiday.

Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

Martin Luther King's Birthday Third Monday in January Washington's Birthday Third Monday in February Memorial Day Last Monday in May Labor Day First Monday in September Columbus Day Second Monday in October Thanksgiving Fourth Thursday in November

4.2 PLACE OF PERFORMANCE

Efforts under this TO shall be performed at Contractor facilities. It is expected that this work will be primarily conducted during core business hours, which are defined as 8am to 5pm local time when applicable. The Contractor shall identify the Contractor’s place of performance in their Task Execution Plan submission.

When travel is required, work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO) or the Contracting Officer’s Representative (COR).

4.3 TRAVEL

The Government anticipates travel under this effort to perform the tasks associated with the effort throughout the period of performance under a Cost Reimbursable basis.

Travel shall be Cost Reimbursable with a not to exceed ceiling on travel expenses per year. The Government encourages maximum utilization of teleconferencing and video conferencing for meetings. The Government anticipates travel may be required in support of meetings, training, presentations, or briefings with project stakeholders including project team members, VA management, and VA customers impacted by business, functional, product, and process requirements.

Travel shall be in accordance with the Federal Travel Regulations (FTR) and requires advanced concurrence by the COR. Travel and per diem shall be reimbursed in accordance with FTR. The Contractor shall provide cost estimates with each travel request. Each Contractor invoice shall include copies of all receipts that support the travel costs claimed in the invoice. The Government will not reimburse local travel within a 50-mile radius from the Contractor's facility. This includes travel, subsistence, and associated labor charges for travel time. Travel performed for personal convenience and daily travel to and from work at the Contractor's facility will not be reimbursed.

4.4 KEY TECHNOLOGIES

The following is a non-exclusive list of the key technologies that comprise Corporate systems and are critical to the success of this effort. The Contractor shall provide appropriate personnel trained and/or experienced in these technologies, depending on the technologies identified at intake.

• Amazon Web Services (AWS)

• Angular Command Line Interface

(CLI)

• Apache Server

• Apex

• AppDynamics

• Application Monitoring Tools such as but not limited to AppDynamics

• Application Scanning Tools such as but not limited to Fortify

• Artificial Intelligence

• ASP.net Controls

• Automated Resources Manager

• Avalanche

• Azure DevOps Server

• BeanStore

• BI Publisher

• Big Fix Enterprise

• Big Fix Remote

• Business/Vision Analytics

• C#

• CA-7 Batch Processing

• Cascading Style Sheets

• CentrifyDC

• CICS, IDMS, TSO/ISPF

• Citrix Virtual Apps and Desktops

(CVAD)

• Classic ASP

• Client/Server Architecture

• Cloud Computing (e.g. AWS and Azure)

• COBOL 75, 85 and newer releases as appropriate

• Cold Fusion

• Connectrix Manager

• Data Distribution

• DB2

• DYL-260/280

• eBusiness Suite (Finance)

• Electronic Data Interchange

• Electronic Payroll Deduction

• ENDEVOR

• Enterprise Output Solution 360

• EOS Access

• GitHub

• GitLab Community Edition (CE)

• Hibernate

• HTML

• IBM Installation Manager

• IBM Mainframe – Z/OS

• IBM Middleware/WRS Stack

• IBM MQ

• InfoPath

• Informatica (or similar ETL tool experience)

• Inter Systems Cache

• International Business Machines (IBM) Hypertext Transfer Protocol (HTTP) Server

• International Business Machines (IBM) Message Queue (MQ)

• Java

• Java Enterprise Edition (Java EE)

• Java Enterprise Edition SDK (Software Development Kit)

• Java Runtime Environment (JRE)

– Oracle

• Java Script

• Jenkins Continuous Integration Server

• Jira

• Job Control Language (JCL)

• KixTart (Kickstart)

• Linux RHEL

• Mainframe Database System Administration

• Machine Learning

• Mainframe Systems Analysis and administration (including system programming tape hardware printers, transaction process hardware storage and disk management disaster recovery)

• Massachusetts General Hospital Utility Multi-Programming System

(MUMPS)

• Microsoft .NET Framework

• Microsoft Active Server Pages (ASP).NET Core

• Microsoft Azure

• Microsoft Internet Information Services (IIS)

• Microsoft Structured Query Language

• Microsoft Structured Query Language (SQL) Server

• Microsoft Visual Studio

• Microsoft Windows Server

• Microsoft.Net Framework

• Mirrorview

• Monarch (A desktop report mining tool used to extract data from readable report files (e.g.

text, Excel, PDF, XPS and

HTML)

• MS NET

• MS Office Forms Server 2007

• MS SharePoint

• MS SQL Server

• MS Visual Basic

• Mulesoft AnyPoint Platform

• Net Electronic Payment (NETePay)

• NetCOBOL

• NetEpay (DataCap)

• Nintex

• Node.js

• OKTA

• Oracle Analytics Publisher (Oracle BI Publisher)

• Oracle Application Express

(APEX)

• Oracle Business Intelligence (OBIEE)/Oracle Analytics Server

(OAS)

• Oracle Business Intelligence Enterprise Edition (OBIEE)

• Oracle Client

• Oracle cloud hosted COTS CRM system

• Oracle Database

• Oracle Database Management System

• Oracle E-Business suite

• Oracle E-Business Suite Financials

• Oracle Enterprise Manager

(OEM)

• Oracle Forms

• Oracle Golden Gate

• Oracle Hyperion Management

(OHM)

• Oracle Merchandise Financial Planning

• Oracle Merchandise Financial Planning (MFP)

• Oracle Price Management (RPM)

• Oracle Retail Data Warehouse

(RDW)

• Oracle Retail Extract, Transform and Load (RETL)

• Oracle Retail Integration Bus Hospital Administration

• Oracle Retail Invoice Matching

• Oracle Retail Management System

• Oracle Retail Merchandising System

• Oracle Retail Sales Audit (ReSA)

• Oracle Retail Store Inventory Management

• Oracle Snapshot Technology

• Oracle SQL Developer

• Oracle WebLogic Server

• Perl Programming Language

• PL/SQL and SQL Server Integration

• Point of Sale (POS)

• PostgreSQL

• Power BI

• PowerBI

• PowerShell

• Primavera P6 Enterprise Professional Project Management (EPPM)

• RDS SQL Server

• Red Hat Enterprise Linux (RHEL)

• Reflection Desktop

• Reflection for Secure IT

• Reflection for Secure IT Server

• RESTful Architecture

• Robotics

• Salesforce

• Service Oriented Architecture

(SOA)

• SiteMinder WebAgent

• Snapview

• Solaris

• SonarQube

• Spring

• SQL Developer

• SQL Server (for Windows)

• SQL Server Integration Services (SSIS) or similar ETL Tools

• SQL Server Management Studio

• SSOi (2FA/PIV)

• Statistical Analysis Software

(SAS)

• Symmetrix Manager

• Talend

• Terminal Servers

• Timefinder

• Tool for Oracle Application Developers (TOAD) for Oracle

• Tuxedo

• VA FileMan

• Vault AutoCad

• VB.6

• VB.net

• MS Visual Basic for Applications

(VBA)

• MicroStrategy Reporting Tools

• VCW Web Applications

• VendMAX

• Vision Bean Store Point-of-Sale

(POS)

• Vision Central Management

• Vision Store Management

• VistA

• Visual Studio Code (VS Code)

• Web Distributed Data eXchange

(WDDX)

• Web Services (e.g. REST, SOAP)

• Webforms.aspx

• WebLogic

• WebLogic Server

• WebSphere

• WebSphere Application Server

(WAS)

• Windows Server

• Workload Agent

• Workload Analyzer

• ws_ftp (Ipswitch)WSS30

• XML 3

• XML1

• Zebra Enterprise Connector

• Zebra PPME

4.5 RESOURCE CERTIFICATION

The Contractor shall provide resources with a blend of specific expertise in operating and refining the SAFe for the enterprise to meet stakeholder expectations in terms of continuous improvements in quality, responsiveness, and consistency of releases. The Contractor shall adhere to industry best practices and standards.

The cross-functional team resources for the configuration and development of product enhancements and infrastructure support and maintenance necessary for the end-to-end functionality of each solution delivered may include team roles/responsibilities as outlined below:

Role Certification

DevSecOps Coach SAFe DevOps Practitioner (SDP)

Release Manager or equivalent role SAFe Release Manager or equivalent

Scrum Master SAFe Scrum Master (SSM)

Cloud Engineer For AWS Solutions Architect

(Professional) or DevOps Engineer (Professional) For Microsoft Azure Government (MAG) Azure Solutions Architect (Expert) or Azure DevOps Engineer (Expert) Pega Certified System Architect

DevSecOps Engineer/Security Specialist

For AWS Solutions Architect (Associate) or Developer (Associate).

For MAG Azure Solutions Architect (Associate) or Azure Developer (Associate) International Information System Security Certification Consortium (ISC)2 (Certified Information System Security Professional)

Solution System Architect/Engineer Certified SAFe Architect (ARCH)

Solution Lead

SAFe Agile Product and Solution Management (APSM) or SAFe Product Owner (PO)/Product Manager (PM) or SAFe Architect (ARCH) or SAFe Agilest

Data Architect Certified Maximo Deployment Professional and Certified SAFe Agile Architect

Data Migration Specialist Certified Maximo Deployment Professional

Cyber Security Risk Lead

Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM) Global Information Assurance Certification (GIAC) Security Leadership Certification (GSLC)

Cyber Security Architect

Certified Information Systems Security Professional- Information Systems Security Architecture Professional

(CISSP-ISSAP)

Certified Information Systems Security Professional- Information Systems Security Engineering Professional

(CISSP-ISSEP)

Privacy (HealthCare Environment) HealthCare Information Security & Privacy Practitioner (HCISPP)

Integration Lead/Engineer

Salesforce Certified Administrator or Salesforce Certified Platform App Builder HealthShare Health Connect HL7 Interface Specialist Certification

InterSystems IRIS Core Solutions Developer Specialist Certification

Cloud Developer Salesforce Certified Platform Developer Microsoft Dynamics 365 Fundamentals

Test Automation Engineer International Software Testing Qualifications Board (ISTQB) Agile Tester Certification

5.0 SPECIFIC TASKS AND DELIVERABLES

The Contractor shall perform the services required by Sections 5.1 through 5.3 and all its subparagraphs for the Base Period and Option Years 1 through 4.

5.1 PROGRAM MANAGEMENT

5.1.1 CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, timeline, and tools to be used in execution of the contract. The CPMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks, and resource support. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPMP shall be concurred upon and updated in accordance with Section B of the contract. The Contractor shall update and maintain the VA PM approved CPMP throughout the PoP.

Deliverable:

A. Contractor Project Management Plan

5.1.2 REPORTING REQUIREMENTS

The Contractor shall use VA’s implementation of Jira, GitHub, ServiceNow, or other VA-approved toolset to provide a single, authoritative Agile product lifecycle management tool to track execution details in a Product Data and Artifact Repository. All OIT product data and artifacts shall be required to be managed in this repository daily to synchronize work and ensure version control.

The Contractor shall utilize the VA-approved toolset to:

a. Input and manage scheduled product sprints and backlog

b. Input and manage product Agile requirements

c. Input and manage product risks and issues

d. Input and manage product configurations and changes

e. Input and manage product test plans and execution

f. Input and manage product planning, design, and engineering documentation

g. Input and manage product user guides and training materials

h. Input and manage linkages to correlate requirements to change orders to configurable items to risks, impediments, and issues to test cases and test results to show full traceability

The Contractor shall show all Agile requirements, changes, tests performed, and test results in the VA-approved toolset to show evidence of code coverage and test coverage of all the requirements specified. This will allow VA to have high confidence in a fully documented requirements traceability matrix.

The Contractor shall provide the COR and PM with Biweekly Status Reports in electronic form per mutually agreed upon format and media. The report shall include detailed instructions/explanations for each required data element, to ensure that data is accurate and consistent. These reports shall reflect data as of the last day of the preceding Biweekly report.

The Contractor shall deliver Biweekly (every two weeks) Status Reports. These reports shall provide accurate, timely, and complete project information supporting PDS Reporting Requirements. The Biweekly Status Report shall include the following data elements for each product supported:

Product TO Name Overview and description of the TO Overall high-level assessment of TO progress Product Increment (PI) and Sprint including upcoming future releases being reported on including date and a brief summary of releases planned within next 30 days.

All Work In-Progress (WIP) vs work in-progress limit (as defined by SAFe) and completed during the reporting period.

Identification of any TO related issues uncovered during the reporting period and especially highlight those areas with a high probability of impacting schedule, cost or performance goals and their likely impact on schedule, cost, or performance goals.

Explanations for any unresolved issues, including workable solutions and any actions required of the Government and/or Contractor to resolve or mitigate any identified issue, including a plan and timeframe for resolution.

Status on previously identified issues, actions taken to mitigate the situation and/or progress made in rectifying the situation.

Work planned for the subsequent four (4) reporting periods, when applicable Current TO schedule overlaid on original TO schedule showing any delays or advancement in schedule.

Workforce staffing data showing all Contractor personnel performing on the effort during the current reporting period. After the initial labor baseline is provided and approved, each report shall identify any changes in staffing identifying each person who was added to the TO or removed from the TO.

The report shall include the replacement personnel’s resumes that include education level and other information as to replacement personnel’s qualification in general.

Training Certificates, after initial and updated certificates are provided, each report shall identify any changes for all Contractor personnel including the dates of expiration and the due date for the next time due

A Government Furnished Equipment (GFE) Report for all equipment issued to Contractor personnel performing on the effort during the current reporting period including a record of transfer of any GFE. The report shall include up-to-date information on the physical location of the GFE and to whom the GFE is assigned.

Original schedule of deliverables and the corresponding deliverables made during the current reporting period.

Deliverable:

A. Biweekly Status Report

5.1.3 TECHNICAL KICKOFF MEETING

A virtual technical kickoff meeting shall be held within 10 business days after award.

The Contractor shall present, for review and approval by the COR, the details of the intended approach, work plan, and project schedule for each effort via a Microsoft Office PowerPoint presentation. The Contractor shall specify dates and provide the draft agenda to all attendees at least five business days prior to the meeting. The Contractor shall invite the CO, the Contract Specialist (CS), the COR and the project managers

(PM).

At the conclusion of the meeting, the Contractor shall update the Final Kickoff Presentation with a final slide entitled “Summary Report” which shall include notes on any major issues, agreements, or disagreements discussed during the kickoff meeting and the following statement “As the Post-Award Conference Chairperson, I have reviewed the entirety of this presentation and assert that it is an accurate representation and summary of the discussions held during the Technical Kickoff Meeting for the Consolidated Corporate Support Services.”

The Contractor shall submit the final Kickoff Presentation which shall include the meeting minutes to the COR for review and signature within three (3) business days after the meeting. The Contractor shall also work with the CS, the Government’s designated notetaker, to prepare, finalize, and distribute CS-approved meeting minutes of the kickoff meeting to the CO, COR, and all attendees within three calendar days after the meeting. The Contractor shall obtain concurrence from the CS on the content of the meeting minutes prior to distribution of the document.

Deliverable:

A. Kickoff Presentation

5.1.4 ONBOARDING AND OFFBOARDING

The Contractor shall manage the onboarding of its staff on this contract. Onboarding includes steps to obtain a VA PIV card, network and email account, complete VA mandatory trainings for Contractors, initiate background investigations, and gain physical and logical access. In addition, the Contractor shall identify individuals which may require elevated privileges to the necessary development and test environments for the Product Lines. After review between the Contractor and VA COR(s), a decision will be made as to the necessity of obtaining GFE for the onboarding staff. If approved, Contractor shall follow the appropriate steps to obtain the equipment.

A single Contractor Onboarding Point of Contact (POC) shall be designated by the Contractor that tracks the onboarding status of all Contractor personnel. The Contractor Onboarding POC shall be responsible for alerting the COR of any new Contractor personnel as soon as the individual is assigned to the TO and providing accurate and timely submission of all required VA onboarding paperwork to the VA COR(s). All VA onboarding paperwork shall be stored on the deliverables folder in the COR designated VA SharePoint site or equivalent tool. The Contractor Onboarding POC shall be responsible for tracking the status of all their staff’s onboarding activities to include the names of all personnel engaged on the task, their initial training date for VA Privacy and Information Security training, and their next required training date. The Contractor Onboarding POC shall also report the status of the staff level in the Biweekly Status Report.

The Contractor shall manage the offboarding process for VA access and to individual system/environment access for all Contractor staff. The Contractor shall prepare all forms necessary for termination of access to VA information systems, in accordance with VA guidance. The Contractor shall assist in confirming whether the GFE equipment, associated documentation, and PIV card has been returned to the proper receiving authorities in accordance with VA policy.

5.1.5 MANDATORY TRAINING

The Contractor shall submit Talent Management System (TMS) Training Certificates of completion for VA Privacy and Information Security Awareness and Rules of Behavior and HIPAA training and provide signed copies of the Contractor Rules of Behavior in accordance with Section 9, Training, Appendix C of the VA Handbook 6500.6, “Contract Security”. The Contractor shall provide newly obtained certificates as part of the Biweekly Status Report.

Contractor employees may be required to complete VA training courses before receiving access to the Data Repository. Contractor employees who have completed these VA training courses within a specified time and have furnished certificates will not be required to re-take the training courses. The Contractor shall collect and store copies of Training Certificates as evidence of completion for everyone. The Contractor shall file:///C:/Users/VACORO~1/AppData/Local/Temp/MicrosoftEdgeDownloads/d63124b4-5d38-445e-bd99-821d60bb9767/VA261-16-Q-1120-013.pdf provide a copy of the Training Roster and certificates to indicate the staff that have completed training in the Biweekly Status Report.

The Contractor and VA lead(s) shall determine which team members require access to the VA network and VA approved toolset. All Contractors that require access shall complete all required VA TMS training courses within 14 days of the identification of the access need. The Contractor shall work with its respective point of contact to obtain access to TMS to complete the mandatory courses.

The Contractor shall complete the appropriate VA TMS role-based training courses for all Contractors with required access to Elevated Privileges:

a. TMS ID 3197: Information Security Role-Based Training for IT Specialist (Web

Based Training (WBT])

b. TMS ID 3867205: Training for Elevated Privileges for System Access (WBT)

c. TMS ID 3867207: Information Security Role-Based Training for System Owners

(WBT)

d. TMS ID 1016925: Information Security Role-Based Training for Software

Developers (WBT)

e. MS ID 1357076: Information Security and Privacy Role-Based Training for

System Administrators (WBT)

f. TMS ID 1357084: Information Security Role-Based Training for Data Managers

(WBT)

g. TMS ID 1357083: Information Security Role-Based Training for Network

Administrators (WBT)

h. TMS ID 64899: Information Security Role-Based Training for IT Project

Managers (WBT)

The Contractor shall complete the following Agile training courses, and other emerging PLM and SAFe courses as necessary:

a. TMS ID 4533235: Product and Product Line Management: Creating and

Managing the Product Back Log

b. TMS ID 4533231: Product and Product Line Management: Overview of Product

Line Management

c. TMS ID 4551891: Introduction to Agile

d. TMS ID 4551982: Product Owner

The Contractor shall complete emerging training requirements for GitHub, Jira, or other VA-approved tools as appropriate or required.

Contractors who have completed these VA training courses within the past 12 or 24 months, depending on the training requirements, and have furnished training certificates to VA, will not be required to re-take the courses.

5.2 FINANCIAL MANAGEMENT SYSTEM (FMS) AND OPEN SYSTEMS

SUSTAIMENT SUPPORT

The Contractor shall provide sustainment support for FMS and Open Systems (Management Information Exchange System (MinX), Financial Content Management (FCM), Financial Reporting System (FRN), and Financial Reporting Data Warehouse System (FRDW)).

The Contractor shall support the advancement of the maturity of the Product Lines through compliance with the DevSecOps process, SAFe implementation and/or other OIT initiatives. Contractor shall provide a senior team of subject matter experts to support the integration and oversight of capabilities within the Product Line value stream through collaboration with relevant stakeholders and partners.

Contractor shall support planning across interdependent systems to mitigate technical risk and improve integration with business processes and other VA products and enterprise services. As part of this task, the Contractor shall manage the following processes:

a. Assist in defining new application implementation requirements, to include the generation of Epics and translation to Features and User Stories which make up the Product Roadmap and Product Increment Plans while mitigating dependencies between them.

b. Consolidate requirements or sequencing to generate product line efficiencies.

c. Understand future state requirements for a successful implementation of new applications in VA and identify impacts to legacy or dependent systems.

d. Provide guidance on dependencies between implementation requirements within and outside the product to reduce risk as new capabilities are introduced and current systems are retired.

e. Identify and analyze the systems targeted for integration and the design and technologies needed to implement them.

f. Assist with database solutions and designs for data migrations for implementations at VA sites.

g. Provide product line and Financial Management Portfolio-level analyses of risks and issues to identify trends and possible opportunities for responses and mitigations at and above the product line level.

h. Coordinate with the VA selected Subject Matter Expert for data processes.

5.2.1 FMS AND OPEN SYSTEMS ADMINISTRATIVE SUSTAINMENT SUPPORT

The Contractor shall support the below activities, but not limited to:

a. Attain and maintain an Authority to Operate (ATO) and support all ATO-related activities.

b. Create and update security Plans of Action and Milestones (POA&M).

c. Report system performance metrics and objectives and key results (OKRs).

d. Coordinate with Infrastructure Operations on all activities but not limited to issues, scans, compliances, updates, upgrades, vulnerabilities, patches, maintenance, requests for server provisioning, etc.

e. Document vulnerabilities, assign them to related team, and track them through remediation.

f. Manage and configure Jira and ServiceNow (SNOW) reporting.

g. Provide updates into project management repository (e.g., VA PARS).

h. Review, add entries, and updates into VA Systems Inventory (VASI).

i. Provide and present Status Reports weekly to include deliverables, accomplishments, progress updates, risks, upcoming releases, etc. to the VA PM and selected system stakeholders.

j. Support data calls and ad-hoc documentation.

k. Provide inputs into the Operation Management Review reports (mostly monthly, but it can vary).

l. Produce Product Scorecards.

m. Provide Assessment and Authorization (A&A) artifacts, to include, but not limited to the following:

1. System Security Plan (SSP)

2. Security Configuration Plan

3. Information System Contingency Plan (coordinate with Office of Business

Continuity)

4. Business Impact Assessment

5. Incident Response Plan (IRP)

6. Configuration Management Plan (CMP)

7. Privacy Threshold Analysis (coordinate with Office of Privacy)

8. Privacy Impact Assessment (PIA) (coordinate with Office of Privacy)

9. Risk Assessment (coordinate with Office of Risk Management and Incident

Reporting)

10. Security Configuration Checklist

11. System Interconnection Agreements (Memorandum of Understanding [MOU] and Interconnection)

12. Interconnection Security Agreement (ISA) as necessary

13. Disaster Recovery Plan

14. Minor Application Self-Assessment (if applicable)

15. Security Control Assessment (SCA)

16. Signatory Authority (SA)

17. Standard Operating Procedures (SOP)

18. Information System Vulnerability Management Plan

19. System Security Categorization Report

20. After Action Report (AAR)

21. Ports, Protocols, and Services

22. Security Impact Analysis

23. Service Level Agreements (SLAs)

n. Create and maintain documentation including but not limited to technical roadmaps, system architecture diagrams, data flow processes, and fact sheets.

o. Follow CORP SOPs for Teams channel, SharePoint, and network drive.

p. Identify, analyze, and track risk and prepare risk reports.

Deliverables:

A. OKRs B. Status Reports C. Product Scorecards D. A&A Artifacts E. Technical Roadmaps F. System Architecture diagrams G. Data Flow Processes H. Fact Sheets

5.2.2 OPEN SYSTEMS TECHNICAL SUSTAINMENT SUPPORT

This includes but is not limited to resolving all issues, keeping systems in compliance, rectifying human errors, and supporting system software issues that may include application testing, risks, and provide verification and validation to maintain (financial) integrity and report accuracy of VA’s financial operational environment. The Contractor shall support any sustainment related activities during annual close for Open Systems products. The Contractor shall supply technical and customer support to the VA staff related to the design and maintenance of Open Systems.

Sustainment support includes, but is not limited to:

a. Respond to all audit and assessment requests (e.g., OIG, FISMA/ Federal Information System Controls Audit Manual (FISCAM), SCA, Cybersecurity and Infrastructure Security Agency (CISA), etc.) and mitigate all findings.

b. Track and remediate all sustainment related security vulnerabilities within time frames established in VA Handbook 6500 (30/60/90 days for critical, high, and medium severity).

c. Analyze and resolve identified sustainment related issues to include system failures and downtime issues.

d. After hours support is required on an as needed basis to include weekends and holidays for the following:

1. Resolving abnormal operating events

2. Maintenance, issues, annual close, reporting deadlines

e. Document and present Root Cause Analysis (RCA) and Issue Papers during the issue, and anAAR after issue resolution.

f. Manage and maintain Open Systems user access, perform Quarterly User

Access Reviews; automate and refine the process for provisioning, modifying, and deleting user access.

g. Decouple the user authentication from Mainframe (e.g., FRN, FCM).

h. Support operating system and database upgrades/patches and the installation of monitoring tools. Monitoring tools include: Splunk, SolarWinds, Dynatrace, and

AppDynamics or similar tools on all Open Systems environments. After-hours support may be required.

i. Update, upgrade, and migrate products, supporting applications, and database with latest VA approved software.

j. Ensure software compliance with applicable laws, regulations, and standards, including providing evidence of compliance upon request to include but not limited to implement, manage, and maintain Zero Trust Security, Two-Factor

Authentication (2FA), and 508.

k. Provide day-to-day technical knowledge on how to utilize Open System and knowledge transfer to VA staff upon request.

l. Support Program Management Reviews monthly reporting.

m. Support automation initiatives and tools (Keysight Eggplant or similar tool), reporting automation, and new automation requests.

n. Document Open Systems roles and configurations to identify gaps and make recommendations for remediation.

o. Validate that system configurations are consistent with required approved states and remediate (approval process or configurations as required).

p. Application sustainment and enhancements using programming languages (e.g., C#. NET or similar) for FRN.

q. Application Administration and enhancements to the COTS packages (MinX, FRDW, FCM).

r. Support Disaster Recovery Cycle.

s. Support improvements to Database design.

t. Thorough testing prior to each production release.

u. Support end-to-end sustainment part of annual close activities, for MinX & FRDW to include but not limited to:

1. Receive and process files.

2. Update and process data, financial records, and application variables to reflect new time periods. This is limited to sustainment activities.

3. Load data for analysis and testing.

v. Support end-to-end annual close activities (FRN, FCM), to include but not limited to:

1. Process end of year files.

2. Update and process data, financial records, and application values to reflect new time periods.

3. Monitor and troubleshoot production loads from Mainframe to Database.

4. Load data for analysis and testing.

Deliverables:

A. RCA

B. Issue Papers

C. AAR

D. Quarterly User Access Review Results

5.2.3 FMS MAINFRAME TECHNICAL SUSTAINMENT SUPPORT

The Contractor shall provide complete sustainment support to the FMS Mainframe System. Sustainment support includes, but not limited to:

Resolve all issues, keep the system in compliance, rectify human errors, and support of Operations and Maintenance (O&M) of FMS include testing, risks, and IV&V approval to maintain (financial) integrity and report accuracy of VA’s financial operational environment. The Contractor shall also support O&M and sustainment related activities during annual close for FMS. The Contractor shall supply technical and customer support to the VA staff related to the design and maintenance of FMS.

a. Resolve all issues that are not base (non-proprietary) COBOL and base SAS…