PWS - Data Engineering for SSG Fox SPGP.docx

Data Engineering, Management Support, and Quality Assurance Recommendations

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Veterans Health Administration (VHA) Office of Mental Health and Suicide Prevention

Staff Sergeant Parker Gordon Fox Suicide Prevention Grant Program Data Engineering, Management Support, and Quality Assurance Recommendations

Date: April 15, 2026 PWS Version Number: 1.3

Contents

BACKGROUND

The Department of Veterans Affairs (VA), Veterans Health Administration (VHA) Office of Mental Health and Suicide Prevention, strives to reduce military and Veteran suicide by focusing on clinical interventions and community-based outreach prevention strategies. Through this program, VA has offered grants to eligible entities, identified in the regulations, for providing or coordinating suicide prevention services to Veterans and their families. The goal of the program is to identify Veterans who are at risk of suicide and their family members and to provide them with suicide prevention services either through VA or the community.

The SSG Fox Suicide Prevention Grant Program (SPGP) is authorized pursuant to the Commander John Scott Hannon Veterans Mental Health Care Improvement Act of 2019 (Public Law 116-171) and implemented by final rule, promulgating 38 C.F.R. part 78. Per 38 C.F.R. part 78, grantees may provide the following suicide prevention services to program participants: Outreach to identify those at risk of suicide; Baseline mental health screening to eligible individuals; Education of communities, Veterans and families on suicide risk and prevention, how to identify those at risk of suicide, how and when to make referrals for care, and the types of suicide prevention resources available within the area; Provision of clinical services for emergency treatment; Case management services; Peer support services; VA benefits assistance for eligible individuals and their families; Assistance with obtaining and coordinating other benefits provided by the federal VA, a state or local VA, or an eligible entity; Assistance with emergent needs relating to health care services, daily living services, personal financial planning and counseling, transportation services, temporary income support services, fiduciary and representative payee services, legal services to assist the eligible individual with issues that may contribute to the risk of suicide, and child care. In addition, grantees may provide nontraditional and innovative approaches and treatment practices, as determined appropriate by VA.

In November 2021, VA engaged the MITRE Federally Funded Research Development Centers (FFRDC) to perform an Analysis of Alternatives (AoA) for a functional prototype for data collection tools and processes for grantees for the SSG Fox SPGP. The FFRDC was required to explore the potential use of up to five existing applications in use at VA and deliver an AoA with findings, risks, and an overall recommendation. That analysis was delivered to VA and as a result the VA OSP selected the existing VA Behavioral Health Lab (BHL) Touch platform as the application to be configured for the SSG Fox SPGP. The BHL Platform collects several of the same data within the VA by Veterans Health Administration (VHA) providers as was needed to collect from the grantees (not directly affiliated with VA) for the suicide prevention grant program.

MITRE conducted the BHL Touch system configuration to allow for additional data collection via BHL interview forms to comply with Congressional statute for a data collection tool. The Data Collection Tool (DCT) operates in VA’s Enterprise Cloud environment (VAEC) and achieved an Authority to Operate in June of 2025 for another two (2)-year period. From 2022 through 2024, VA continued to refine the DCT, identifying and testing additional data collection needs to meet statute requirements. The DCT functional prototype allowed VA to demonstrate the ability to securely collect sensitive de-identified Veteran mental health/suicide risk data which by law has been included in the Interim Congressionally Mandated Report (CMR) and is in process of being included in the Final CMR. VA demonstrated the success of the functional prototype and is now able to continue operation of the DCT in their production environment which will allow the program to engage additional grantees to the program for 2026 and beyond. The DCT platform is now undergoing transition back to VA or to another expected contractor to continue to manage the DCT environment which is mandated by the statute.

SSG Fox SPGP has entered its fourth year. VA published the Notice of Funding Opportunity (NOFO) for Fiscal Year (FY) 2026 SSG Fox SPGP services on May 15, 2025. The NOFO assumes that Congress will extend the authority beyond September 2025 and appropriate funds consistent with section 201 of the Hannon Act as currently written. Applications are due July 18, 2025, and the awards will be announced by September 30, 2025. OSP allocated approximately $52M to avoid a disruption in services through this NOFO, and Congress finalized legislative extension and appropriations as anticipated, another NOFO could soon follow.

APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. “Federal Information Security Modernization Act of 2014.”

2. Federal Information Processing Standards (FIPS) Publication 140-3, “Security Requirements for Cryptographic Modules”, March 22, 2019

3. Federal Information Processing Standard (FIPS) Publication 140-2, “Security Requirements for Cryptographic Modules.”

4. FIPS Pub 199. “Standards for Security Categorization of Federal Information and Information Systems,” February 2004.

5. FIPS Pub 200, “Minimum Security Requirements for Federal Information and Information Systems,” March 2006.

6. FIPS Pub 201-3, “Personal Identity Verification of Federal Employees and Contractors,” January 2022.

7. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974.”

8. Public Law 109-461 (P.L. 109-461), Veterans Benefits, Health Care, and Information Technology Act of 2006, as amended, Title IX, Information Security Matters.

9. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”, as amended.

10. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2024, https://www.va.gov/vapubs/index.cfm.

11. VA Handbook 0710, “Personnel Security and Suitability Program,” May 2, 2016, https://www.va.gov/vapubs/index.cfm.

12. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and Guidelines,” as amended.

13. Office of Management and Budget (OMB) Circular A-130, “Managing Federal Information as a Strategic Resource,” July 28, 2016.

14. NIST SP 800-66 Rev. 2, “Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule: A Cybersecurity Resource Guide,” February 2024.

15. 45 C.F.R Parts 160 and 164, Subparts A and E, the Standards for Privacy of Individually Identifiable Health Information (“Privacy Rule”); and 45 C.F.R. Parts 160 and 164, Subparts A and C, the Security Standard (“Security Rule”); as amended.

16. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended, January 18, 2017.

17. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004.

18. VA Handbook 6500.6, “Contract Security,” March 12, 2010 (see VA Notice 24-12, dated April 22, 2024, “Update to VA Handbook 6500.6, Contract Security, Appendix C VA Information and Information System Security/Privacy Language For Inclusion Into Contracts, As Appropriate”).

19. OIT Process Asset Library (PAL), OIT Process Asset Library. Reference Process Maps at https://www.va.gov/process/maps.asp and Artifact templates at https://www.va.gov/process/artifacts.asp.

20. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx).

21. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014.

22. VA Handbook 6510, “VA Identity, Credential and Access Management,” September 27, 2024.

23. VA Directive and Handbook 6513, “Secure External Connections,” October 12, 2017.

24. VA Directive 6300, “Records and Information Management,” September 21, 2018.

25. VA Handbook, 6300.1, “Records Management Procedures, “March 24, 2010.

26. NIST SP 800-37 Rev 2, “Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy,” December 2018.

27. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020).

28. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015.

29. OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005.

30. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019.

31. OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008.

32. Federal Identity, Credential, and Access Management (FICAM) Architecture, June 30, 2023 (FICAM Architecture (idmanagement.gov)).

33. NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access,“ June 2018.

34. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, “Digital Identity Guidelines,” updated March 02, 2020.

35. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014.

36. VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514).

37. Identity Access Management (IAM) Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, Personal Identity Verification (PIV)/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514).

38. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896.

39. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents.

40. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019.

41. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008.

42. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28.

43. VA Memorandum “Proper Use of Email and Other Messaging Services,” January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28.

44. Social Security Number (SSN) Fraud Prevention Act of 2017.

45. NIST SP 800-52 Revision 2, “Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations.

46. OMB M-22-18, “Enhancing the Security of the Software Supply Chain through Secure Software Development Practices,” September 14, 2022.

47. OMB M-23-16, “Update to Memorandum M-22-18,” June 9, 2023.

48. CISA Binding Operational Directive (BOD) 19-02: “Vulnerability Remediation Requirements of Internet-Accessible Systems,” April 29, 2019, BOD 19-02: Vulnerability Remediation Requirements for Internet-Accessible Systems | CISA.

49. CISA BOD 22-01: “Reducing the Significant Risk of Known Exploited Vulnerabilities,” November 3, 2021, BOD 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities | CISA.

50. CISA BOD 23-01: Improving Asset Visibility and Vulnerability Detection on Federal Networks.” Cybersecurity & Infrastructure Security Agency (CISA), BOD 23-01: Improving Asset Visibility and Vulnerability Detection on Federal Networks | CISA.

51. VA Memorandum, “VA Security Controls,” January 17, 2025, https://www.voa.va.gov/DocumentView.aspx?DocumentID=5010.

52. SSG Fox SPGP Website for the current list of grantees here: https://www.mentalhealth.va.gov/ssgfox-grants/index.asp.

SCOPE OF WORK

The Contractor shall support VA with the operation of the DCT, as well as the processes for grantees to review data quality. Furthermore, the Contractor shall provide the DCT Data Engineering, Management Support, and Quality Assurance Recommendations and complete the specific task and deliverables set forth in Section 5.0 below.

PERFORMANCE DETAILS

PERFORMANCE PERIOD

The Period of Performance (PoP) shall be a 12-month base period, with two, 12-month option periods.

Any work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO).

There are 11 Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, five are set by date:

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

PLACE OF PERFORMANCE

Tasks under this PWS shall be performed primarily at Contractor facilities. The Contractor shall identify the Contractor’s place of performance in their proposal submission.

In the event that VA requires the Contract to travel to a VA site, any work at a VA site shall not take place on Federal holidays or weekends unless directed by the CO or the Contracting Officer’s Representative (COR).

TRAVEL

The Government anticipates travel under this effort to perform the tasks associated with the effort. The Contractor shall include all estimated travel costs in firm-fixed-price line items as these costs will not be directly reimbursed by the Government.

There are two (2) in-person conferences per each year of the PoP where the Contractor, VA, and the grantees enrolled in SSG Fox SPGP are required to attend. The location of the travel will not be known until determined by VA during the PoP.

The following is VA’s estimated long-distance travel estimate (per year):

Travel shall be in accordance with the Federal Travel Regulations and requires advanced concurrence by the COR. Contractor travel within the local commuting area will not be reimbursed.

SPECIFIC TASKS AND DELIVERABLES

PROJECT MANAGEMENT

CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall provide the COR with a Contractor Project Management Plan (CPMP) in electronic form in Microsoft Word and Project formats that lay out the Contractor’s approach, timeline, and tools to be used in execution of the contract. The CPMP shall cover all work completed during the reporting period and work planned for the subsequent reporting period. The report should also identify any problems that arose and a description of how the problems were resolved, including DCT technical management and issue tracking reports. If problems have not been completely resolved, the Contractor shall provide an explanation including their plan and timeframe for resolving the issue. The report should also include an itemized list of all Information and Communication Technology deliverables and their current Section 508 conformance status. The Contractor shall monitor performance against the CPMP and report any deviations. It is expected that the Contractor will keep in communication with VA accordingly so that issues that arise are transparent to both parties to prevent escalation of outstanding issues.

The report should not only include future timelines and plans but also shall include detailed instructions and explanations for each required data element, to ensure that data is accurate and consistent. These reports shall reflect data as of the last day of the preceding month. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPMP shall be concurred upon and updated in accordance with Section B of the contract. The CPMP shall be updated monthly throughout the PoP.

Deliverable:

A. Monthly Contractor Project Management Plan

DATA ENGINEERING, MANAGEMENT SUPPORT, AND QUALITY ASSURENCE RECOMMENDATIONS

The Contractor shall collaborate with VA to support the operation of the DCT, as well as the processes for grantees to review data quality. The Contractor shall provide the DCT Data Engineering, Management Support, and Quality Assurance Recommendations.

The Contractor shall receive support for the following activities:

· The Contractor shall receive a knowledge transfer through observation and demonstrating their ability to start and stop the web application and databases, including the onboarding application and extraction, transformation and loading (ETL) process. The ETL process moves the data from VA’s Behavioral Health Lab Commercial Off-The-Shelf (COTS) product that was used to configure the DCT to the secure VA Enterprise Cloud which is used to further prepare the data for ingesting into VA’s Power Business Intelligence (BI) tool. VA anticipates continued use of the VA’s Enterprise License for Microsoft Power BI for the SSG Fox SPGP until such time that VA mandates the use of any other enterprise BI tool.

· The Contractor shall receive a knowledge transfer through observation and demonstrate their ability to control the schedule of this data being moved from one environment to the next in the event of any disruptions in the process.

· The contractor shall receive a knowledge transfer through observation and demonstrating their understanding and comprehension of troubleshooting Technical Assistance logs, where alerts go, and receiving alerts.

· The Contractor shall receive a knowledge transfer through observation and demonstrating their ability to support the transition as the site administrator.

· The Contractor shall track, monitor, and archive data in the DCT from grantees who provide or coordinate suicide prevention services to eligible individuals and their families on the notification (from initial day of enrollment in the grantee or subcontractor program) that the recipients of such services are being paid for, in whole or in part, by the department. The Contractor will not have access to view payment information for grantees. The Contractor shall provide a dashboard that allows VA to track and monitor the services that are being reported for each participant on a monthly basis which can be viewed from the initial day of enrollment.

· Data shall be archived in several ways:

· Allowing a grantee to submit through the BHL Touch a request to archive a previous interview’s data (e.g., screening, service form, etc.) and submit a new replacement form.

· Providing a backend process to close out old Adobe records that are not active.

· Filtering out retiring grantee data (grantee’s no longer in the program) from the dashboard views (while still retaining that data in the database)

· The Contractor shall research and coordinate with VA to identify and recommend a process for grant managers to review and monitor compliance using a development plan. The development of the process has begun and each development plan is developed in consultation with the eligible individual and their family. This process will occur outside the DCT, however, the Contractor shall provide guidance for how DCT can be further used in this process.

· The Contractor shall manage data quality assurance protocols for archiving and analyzing data for monthly, quarterly, and annual reports. The data quality assurance protocol shall address data use and transfer security. The Contractor shall analyze data and compile briefings and reports with grantees data on monthly, quarterly, and annual bases for reporting and regular dissemination to VA.

· The Contractor shall create DCT documentation of new requirements as a result of Congressional feedback and program policy changes, coordinate with VA and other vendors in the design of new online data collection forms as a result of policy changes; update the data extract, transformation, and load processes, and prepare the data for ingestion into the data analytics platform.

· The Contractor shall recommend the requirements, design, and testing necessary for reducing the maintenance burdens and costs to VA.

· The Contractor shall include the definitions of the required roles and responsibilities for the data engineering, management support, and quality assurance for the DCT over time.

· The Contractor shall maintain the DCT in the enterprise cloud Authority to Operate (ATO).

· The Contractor shall support VA with the implementation of systems configuration, coordinating with the VA COTS vendor.

Deliverables:

A. Grant Manager Review and Monitor Process B. Suicide Prevention Plan C. Analyze Data, Compiled Briefings and Reports D. DCT Documentation of New Requirements

SUSTAINMENT SUPPORT CAPABILITIES AND SKILLS

The contractor shall have the following capabilities and skills:

CONFIGURATION MANAGEMENT AND APPLICATION STACK (E.G., DATA ACCESS LAYER, BUSINESS LOGIC) AND DATA MODELS

1. The Contractor shall have experience working with COTS product vendors as well as other contractors responsible for implementing ISO standards, protocols, and other integrative technologies.

2. The Contractor shall have deep systems integration expertise for configuration of a forms-based COTS solution, including systems integration experience and configuring and integrating COTS software via API

CLOUD ENGINEERING

The Contractor shall have experience in systems configuration with an existing COTS product in a Federal Cloud Enterprise, such as VA’s Enterprise Cloud, where the solution offers secure access for external-facing users without credentialing, utilizing VA authorized identity providers.

DEVELOPMENT OPERATIONS (DEVOPS)

The Contractor shall have strong software and DevOps implementation expertise and demonstrated experience in implementing solutions that receive and share health information, working within an architecture that segments data to ensure sensitive information is separated from any identifying information.

SYSTEM MONITORING AND TROUBLESHOOTING

The Contractor shall have provision of near-real-time monitoring capabilities for usage patterns and network traffic monitoring.

FEDERAL DATA SECURITY AND PRIVACY REQUIREMENTS IMPLEMENTATION

The Contractor shall have experience achieving and maintaining an ATO for a federally implemented COTS product requiring additional systems configuration, where that product collects sensitive health information that must be protected.

DEVELOPMENT AND MANAGEMENT OF TECHNICAL SYSTEMS DOCUMENTATION

The Contractor shall have provision of well-documented system configuration guides and other technical documentation resources.

TRANSITION ACTIVITY TIMELINE

The Contractor shall be provided recommendations from MITRE, the current Contractor and the VA, to include but not limited to: staffing with the right engineering and architectural support for the data engineering, management support, and quality assurance activities post-transition from MITRE.

The Contractor shall work with the MITRE over the course of approximately six months using the Data Engineering, Management Support, and Quality Assurance Transition Plan. VA will review the recommendations and determine the appropriate approach to support the transition.

The Contractor shall have roles and responsibilities transitioned from MITRE, on a regular basis.

The Contractor shall perform the following activities:

1. Participate in knowledge sharing and regular meetings to acclimate the data engineer(s)/architect(s) into VA’s cloud infrastructure activities as it relates to the DCT:

a. Vendor coordination between MITRE, VA OSP, and Neuroflow

b. VAEC Concierge Scrum

c. Leadership call

d. Data call

2. Onboard to access resources such as Source Control, VAEC SPGP environment, and cloud devices

3. Learn and comprehend the architecture, integrations, and code

4. Assigned troubleshooting tickets for triage

5. Assigned Development Environment and Pre-Production Environment (PPD) deployment roles

6. Assigned PPD testing and quality assurance (QA) roles

7. Assigned Production Environment deployments and QA checks

At each step, the Contractor shall consult with the COR to ensure timeliness and completion of all tasks.

MONTH 1: IDENTIFYING ROLES AND RESPONSIBILITIES

During the first month of the transition, the Contractor shall have VA badge and be ready to begin working with MITRE in the VAEC.

1. The Contractor shall obtain access to all applicable assistance with the direction of the VA and MITRE after award, including requests for the necessary certifications from MITRE.

2. The Contractor shall be introduced to the following:

a. The role that the Neuroflow Team plays in providing operational support for the DCT.

b. The interactions that occur between the Neuroflow Team and MITRE Team, along with VA OSP Program staff.

c. The processes in place for coordinating across teams when new business requirements are identified or when errors are discovered with the BHL Touch that require coordination.

MONTHS 1–2: GOVERNANCE TRANSITION OVERVIEW

The Contractor shall understand the technical governance activities within the VAEC within the first month of the transition. This includes:

1. Achieving compliance for the 100+ controls

2. Conducting report-outs to the system steward and ISSO

3. Managing key policies and procedures, including:

a. Managing privileges for user access

b. Requesting new data pulls from VA’s grant management system at the beginning of the new grant award cycle for new grantees, including those that received a renewal, and those that will no longer continue in the program

Other activities that will be included during this first-month transition period related to governance include engaging key stakeholders across VA involved in review and approval of the ATO.

At the end of this period, the Contractor shall:

1. Actively participate in the meetings that regularly take place with the VA OI&T teams.

2. Align staff to the timeline for addressing the ATO roadmap.

3. Achieve access to the VAEC Virtual Private Cloud (VPC) and AWS Console.

4. Obtain and document key contact points at Neuroflow, VA OI&T, MITRE, and VA OSP Program staff.

MONTHS 2–3: VAEC AND THE DCT INFRASTRUCTURE AND DEPLOYMENT OVERVIEW

1. The Contractor shall review and comprehend the architecture design document that was delivered to the VA OSP Program team on March 28, 2024.

2. The Contractor shall obtain access to the Development, Pre-Production, and Production environments. The VA OSP Business Operations Manager must approve access.

3. The Contractor shall identify and own a set of initial tasks.

MONTHS 3–6: TRANSITIONING OPERATIONS AND MAINTENANCE ACTIVITIES

1. The Contractor shall begin integrating into the day-to-day activities for managing the SSG Fox SPGP infrastructure.

2. The Contractor shall review and comprehend the engineering management support that shall be provided to the SSG Fox project through planning, execution, and adoption of any changes to the infrastructure.

3. The Contractor shall understand how to prepare project plans for defining and implementing any new infrastructure updates or specifications. This includes a detailed work breakdown structure that integrates other contractor and vendor activities or dependencies into the plan.

4. The Contractor shall integrate into the ongoing working group meetings to continue to maintain the strong relationships with the VA OSP Program staff, Neuroflow Team, and VA OI&T teams.

MONTHS 3–6: TRANSITIONING NEW REQUIREMENTS AND ENHANCEMENT ACTIVITIES

The Contractor shall work with MITRE and VA OSP Program staff to define and document the detailed requirements for handling participants that complete the program and then later return to the program.

The Contractor Shall:

1. Implement this effort

2. Design and implement any new forms that are needed.

3. Provide the initial mapping of that data for the data pipeline.

TRANSITIONING OPERATIONS AND MAINTENANCE TASKS

ESTABLISHING AND MANAGING PERMISSIONS/USER ACCESS

The Contractor shall understand the permission and user access processes:

1. The DCT is integrated with VA’s Single Sign-On External (SSOe). SSOe’s identity provider is ID.me, which manages all aspects of the authentication account, including password complexity, password rotation, verification of identity, and email address.

2. The DCT authorizes ID.me accounts in the Onboarding Application based on email address to perform the initial mapping and linkage, and subsequently on the ID.me-generated “secID” value, both of which are passed as a claim in the OpenID Connect protocol.

3. Site Administrators’ authorizations are kept in a local configuration file and can be changed only by editing the configuration on the host itself.

4. Site Administrators, as documented in the Standard Operating Procedure, must have valid Privileged Access as documented in EPAS. Program Administrators are authorized in the Onboarding Application by Site Administrators.

5. Applications in the DCT, such as BHL Touch and the embedded Power BI application for grantee analytics dashboard views, query the Onboarding Application user API endpoint to confirm authorization of ID.me identities.

The Contractor shall demonstrate an understanding and comprehend:

1. The system of record for Grantee Staff Users is the VA grants management system called the Universal Design Platform as a Service (UDPaaS) Grants Management System (GMS) which is expected to change in 2026 or sometime after. OSP manages entries in UDPaaS to list all users who have read/write access to the DCT.

2. Users who appear in the list with a value of “Active” are granted access to the DCT. If a user is not in the list, or has a value of anything other than Active, they are denied permission to access the DCT.

3. New Grantee Staff Users must be added to UDPaaS before they can be granted access to the DCT. Regular authorization reviews are conducted by OSP in UDPaaS, and any changes are transferred to the DCT through a bulk synchronization process (detailed in the next paragraph).

4. OPS produces a report from UDPaaS of authorized users and delivers the report to a Program Administrator, who then uploads the report to the Onboarding Application.

5. The Onboarding Application processes the report and makes changes accordingly so that the Onboarding Application and UDPaaS are in sync, either authorizing users or disabling existing users who do not appear in the list with the correct value.

a. Completion of this step includes:

i. Transition team access to UDPaaS user reports.

ii. Team member authorization as a Program Administrator:

Uploading a UDPaaS report Verifying authorization changes

MANAGING THE ONBOARDING APPLICATION

The Contractor shall demonstrate an understanding and ability of managing the Onboarding Application.

The key topics shall include, but not limited to:

1. Database Schemas – A breakdown of the data elements stored in several document-based data stores (MongoDB or DocumentDB) that support operation of the Onboarding Application, and the data analysis pipeline

2. API Endpoints – A comprehensive list of API endpoints offered by the Onboarding Application to effect user authorization management in the DCT, communication between the Onboarding Application and BHL Touch, and Power BI integration.

3. Authorization Management – An overview of the integration between VA’s Identity Provider (SSOe by ID.me) and the DCT.

4. BHL Touch Integration – An overview of how the different components of the DCT interact with BHL Touch and for what purpose.

5. DCT Roles and Permissions – An overview of the three primary roles in the Onboarding Application that manage who has access to the DCT and for what purpose.

6. Log Files – An overview of the log files and locations used to audit activity and troubleshoot issues.

7. Updating Policy and Procedures – Policy and procedures for moving changes through the Development, Pre-Production, and Production environments.

MANAGING THE ATO PROCESS

The Contractor shall manage the ATO process.

Management of the ATO includes:

1. Web Application Scan – Examines web applications for common vulnerabilities and vulnerable design patterns.

2. Penetration Scan – Examines infrastructure for common vulnerabilities and weak communication security.

3. Database Scan – Examines database configurations and data management for vulnerabilities and weak protections.

4. Controls Documentation – Provides a comprehensive access and policy documentation managed by the ISSO and system steward in eMASS.

5. Threat Model – Presents a diagram-based mapping of elements, devices, and connections to identify threats.

6. Privacy Statement – Presents a comprehensive review of data elements, policies, and procedures of the DCT to determine privacy risk and mitigation.

MONITORING THE DCT AND DATA ANALYTICS PLATFORM ENVIRONMENTS

The Contractor shall monitor the DCT and Data Analytics Platform Environments.

The Contractor shall demonstrate an understanding of the transition activities related to tracking, monitoring and archiving data as well as the extracting, transforming and loading processes that are a part of the transition plan for TA and training support.

Monitoring the DCT and Data Analytics Platform Environments includes:

1. Data Pipeline Interruptions – Describes how to identify, and provides examples of how to triage, data pipeline issues

2. Unexpected Data Errors Presented on the Back End – Provides an overview of previous unexpected data errors and their resolution

3. Infrastructure Monitoring – Provides an overview of Dynatrace, the mandatory Tier 3 monitoring of the DCT

PROVIDING GRANTEE TECHNICAL ASSISTANCE FOR DCT

The Contractor shall obtain technical assistance (TA) for using the DCT from MITRE.

The Contractor shall have access to TA and training logs, and common issues that are raised by users of the DCT.

Transition for DCT TA and Training shall include:

1. Data Collection Forms – Overview of current data collection forms and processes

2. Data Collection Forms Archiving – Overview of archive process for data collection forms and previous assistance provided to grantees

QUALITY ASSURANCE

The Contractor shall develop a transition checklist to confirm that each activity has been performed.

The Contractor shall complete the Final Transition Handoff of Operational Tasks. This includes:

1. Evaluating Readiness for Transition Completion – Evaluated completion of activities in Section 5.3 through Section 5.4 of this PWS

2. Mitigating Risks in Handoff Process – Identifies any gaps in knowledge/skills for the new contractor prior to final handoff of the DCT platform

GENERAL REQUIREMENTS

ENTERPRISE AND IT FRAMEWORK

VA TECHNICAL REFERENCE MODEL

The Contractor shall comply with the VA OIT Technical Reference Model (VA TRM). Compliance with the VA TRM is achieved by using only technologies and standards that are listed as approved for use in the VA TRM. The Contractor shall provide all necessary information requested by VA to ensure TRM approval is obtained prior to use on VA’s network.

ZERO TRUST – VA CRITICAL SECURITY CONTROLS

VA has established minimum mandatory security requirements and requires that any network connected software system or service must meet the VA Critical Security Controls as outlined in the VA Memorandum, “VA Security Controls”, https://www.voa.va.gov/DocumentView.aspx?DocumentID=5010. VA Critical Security Controls identify the minimum mandatory requirements that must be implemented across all VA enterprise infrastructure, cloud computing environments, information systems, networks, and specialized devices (medical devices/systems, special-purpose systems, and research scientific computing devices) that process, store, and/or transmit VA data. Effective July 1, 2025, the Contractor shall implement these VA Critical Security Controls, within any network connected software system or service prior to being authorized for use in the VA. This functional requirement is not negotiable, and Plan of Action & Milestones (POAM) will not be accepted in the event these controls cannot be implemented for new systems. Critical Security Controls are intended to increase VA’s security posture and provide security and privacy risk visibility into the VA network and is not a new requirement. The Contractor’s failure to maintain these VA Critical Controls after implementation will result in VA discontinuing the use of the system.

FEDERAL IDENTITY, CREDENTIAL, AND ACCESS MANAGEMENT (FICAM)

The Contractor shall ensure Commercial Off-The-Shelf (COTS) product(s), software configuration and customization, and/or new software are Personal Identity Verification (PIV) card-enabled by accepting HSPD-12 PIV credentials using VA Enterprise Architecture (EA), and VA Identity and Access Management (IAM) approved Enterprise Technology Guidelines (ETG). The Contractor shall ensure all Contractor delivered applications and systems comply with the VA Identity, Credential, and Access Management policies and guidelines set forth in Executive Order 14028, VA Handbook 6510 VA Identity and Access Management, VA Handbook 0735 Homeland Security Presidential Directive 12 (HSPD-12) Program, CISA Binding Operational Directive 23-01, and align with the Federal Identity, Credential, and Access Management Roadmap and Implementation Guidance v2.0.

The Contractor shall ensure all Contractor delivered applications and systems provide user authentication services compliant with the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-63-3, VA Handbook 6500, and VA IAM enterprise requirements for direct, assertion based authentication, and/or trust based authentication, as determined by the ETGs. Direct authentication at a minimum must include Public Key Infrastructure (PKI) based authentication supportive of PIV card and/or Common Access Card (CAC), as determined by the business need.

The Contractor shall ensure all Contractor delivered applications and systems conform to the specific Identity and Access Management PIV requirements set forth in the Office of Management and Budget (OMB) Memoranda M-05-24, M-19-17, M-22-09, and NIST Federal Information Processing Standard (FIPS) 201-3. Contractor delivered applications and systems shall be on the FIPS 201 Approved Product List (APL). If the Contractor delivered application and system is not on the APL, the Contractor shall be responsible for taking the application and system through the FIPS 201 Evaluation Program.

The Contractor shall ensure all Contractor delivered applications and systems support:

1. Automated provisioning and are able to use enterprise provisioning service.

2. Interfacing with VA’s Master Person Index (MPI) to provision identity attributes, if the solution relies on VA user identities. MPI is the authoritative source for VA user identity data.

3. The VA defined unique identity (Secure Identifier [SEC ID] / Integrated Control Number [ICN]).

4. Multiple authenticators for a given identity and authenticators at every Authenticator Assurance Level (AAL) appropriate for the solution.

5. Identity proofing for each Identity Assurance Level (IAL) appropriate for the solution.

6. Federation for each Federation Assurance Level (FAL) appropriate for the solution, if applicable.

7. Two-factor authentication (2FA) through an applicable Technology Guideline as outlined in VA ETG.

8. A Security Assertion Markup Language (SAML) implementation if the solution relies on assertion-based authentication. Additional assertion implementations, besides the required SAML assertion, may be provided as long as they are compliant with NIST SP 800-63-3 guidelines.

9. Authentication/account binding based on trusted Hypertext Transfer Protocol (HTTP) headers if the solution relies on Trust based authentication.

10. Role Based Access Control.

11. Auditing and reporting capabilities.

12. Compliance with VIEWS 00155984, PIV Logical Access Policy Clarification https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896.

The required Assurance Levels for this specific effort are Identity Assurance Level 3, Authenticator Assurance Level 3, and Federation Assurance Level 3.

INTERNET PROTOCOL VERSION 6 (IPv6)

The Contractor solution shall support IPv6-Only based upon the memo issued by the Office of Management and Budget (OMB) on November 19, 2020 (https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-07.pdf). Which defines IPv6-only as the state of an operational system or service when IPv4 protocol functions (addressing, packet forwarding) are not in use. The NIST USGv6 profile defines technical requirements for a product to be capable of operating in IPv6-Only environments. IPv6-Only technology, in accordance with the USGv6 Program ((https://www.nist.gov/programs-projects/usgv6-program/usgv6-revision-1), NIST Special Publication (SP) 500-267B Revision 1 “USGv6 Profile” (https://doi.org/10.6028/NIST.SP.500-267Br1), and NIST SP 800-119 “Guidelines for the Secure Deployment of IPv6” (https://doi.org/10.6028/NIST.SP.800-119), compliance shall be included in all IT infrastructures, application designs, application development, operational systems and sub-systems, and their integration. In addition to the above requirements, all devices, applications, and systems shall support all applicable functionality on native IPv6-Only as well as dual stack (IPv6 / IPv4) connectivity without additional memory or other resources being provided by the Government, so that they can function in a mixed environment. All public/external facing servers and services (e.g., web, email, DNS, ISP services, etc.) shall support native IPv6-Only and dual stack (IPv6 / IPv4) users and all internal infrastructure and applications shall support using native IPv6-Only and dual stack (IPv6 / IPv4) for all functionality and operations.

TRUSTED INTERNET CONNECTION (TIC)

The Contractor solution shall meet the requirements outlined in Office of Management and Budget Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative“ (https://www.whitehouse.gov/wp-content/uploads/2019/09/M-19-26.pdf), VA Directive 6513 “Secure External Connections”, and shall comply with the TIC 3.0 Core Guidance Documents, including all Volumes and TIC Use Cases, found at the Cybersecurity & Infrastructure Security Agency (CISA) (https://www.cisa.gov/publication/tic-30-core-guidance-documents).

STANDARD COMPUTER CONFIGURATION

The Contractor IT end user solution that is developed for use on standard VA computers shall be compatible with and be supported on the standard VA operating system, Windows 10 (64bit) and Windows 11, Edge (Chromium based), and 365 Apps for enterprise. Applications delivered to VA and intended to be deployed to Windows 10 and or Windows 11 workstations shall be delivered as a signed .msi package with switches for silent and unattended installation and updates shall be delivered in signed .msp file formats for easy deployment using Microsoft Endpoint Configuration Manager (CM) VA’s current desktop application deployment tool. Signing of the software code shall be through a vendor provided certificate that is trusted by VA using a code signing authority such as Verizon/Cybertrust or Symantec/VeriSign. The Contractor shall also ensure and certify that their solution functions as expected when used from a standard VA computer, with non-admin, standard user rights that have been configured using the Defense Information Systems Agency (DISA) Secure Technical Implementation Guide (STIG) specific to the particular client operating system being used.

VETERAN FOCUSED INTEGRATION PROCESS (VIP) AND PRODUCT LINE MANAGEMENT (PLM)

The Contractor shall support VA efforts IAW the Veteran-Focused Integration Process (VIP) Guide and Product Line Management (PLM) Playbook. The major focus of VIP is on Enterprise Oversight, Governance, reporting, and establishing practices that focus on outcomes and continuously delivering sustainable IT capabilities to benefit the Veteran. PLM is a framework that focuses on delivering functional products that provide the highest priority work to customers while delivering simplified, reliable, and practical solutions to the business, medical staff, and our Veterans. The VIP Guide is a companion guide to the PLM Transformation Playbook and can be found at: https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371 and the PLM Transformation Playbook can be found at https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946. VIP and PLM are the authoritative processes that IT projects must follow to ensure development and delivery of IT products.

The VIP Guide provides guidance for transitioning from project-centric to product-centric delivery. The VIP guide applies to all OIT Office of Management and Budget (OMB) reportable products that are required to collect and report costs, schedules, risks, and other valuable information in VA PARS (whether products are procured or developed by VA) and any VA Information Technology project effort in Software Product Management (SPM) and Infrastructure Operations (IO), or their successors, that touch the VA network regardless of IT organizational alignment (whether it spends government funding from VA's Congressional IT Appropriation or any other appropriation).

The PLM Transformation Playbook details how OIT leadership expects Product Lines (PLs) to implement PLM, DevOps, and Lean-Agile principles, methods, practices, and techniques through levels of maturity. The PLM Transformation Playbook applies to all Information Technology (IT) products aligned to PLs in the Software Product Management, Infrastructure Operations and Product Engineering organizations within the OIT organization.

Others outside the referenced groups or organizations may use the VIP Guide and PLM Transformation Playbook for situational awareness as needed.

PROCESS ASSET LIBRARY (PAL)

The Contractor shall perform their duties consistent with the processes defined in the OIT Process Asset Library (PAL). The Process Asset Library (PAL) includes a spectrum of OIT functions and activities, such as project management, operations, service delivery, communications, acquisition, and resource management. PAL serves as an authoritative and informative repository of searchable processes, activities or tasks, roles, artifacts, tools and applicable standards and guides to assist the OIT workforce, Government and Contractor personnel. OIT utilizes PAL processes to ensure compliance with policies and regulations and to meet VA quality standards. The PAL includes the contractor onboarding process consistent with Section 6.2.2 and can be found at process_CONB_ext.docx (live.com). The main PAL can be accessed at www.va.gov/process.

AUTHORITATIVE DATA SOURCES

The VA Enterprise Architecture Repository (VEAR) is one component within the overall EA that establishes the common framework for data taxonomy for describing the data architecture used to develop, operate, and…