PWS_Draft_TSS.docx

Transformation Support Services (TSS)

VA-24-00022828

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Office of Information & Technology (OIT)

Transformation Support Services (TSS)

Date: March 18, 2024

VA-24-00022828

PWS Version Number: 2.0

Contents

BACKGROUND

The Office of Information & Technology (OIT) serves the Department of Veterans Affairs (VA) as a Veteran-centric provider of secure and cost-effective technology services. OIT collaborates with its business partners to create the best experience for all Veterans by endeavoring to provide a seamless and unified Veteran experience via state-of-the-art information technology (IT) solutions and service delivery. OIT provides enterprise-level infrastructure engineering, system implementation, production operations, and IT service management. OIT is responsible for the design, testing, deployment, and sustainment of platforms and supporting infrastructure. OIT is the VA’s largest technical directorate with more than 6,000 IT professionals across the United States and its territories.

The largest component of OIT is Service Operations (SO), which has full accountability and responsibility for all system operations and production service delivery across the agency. SO is comprised of five major divisions: End User Operations (EUO), Infrastructure Operations (IO), Enterprise Command Operations (ECO), Enterprise Security Operations (ESO), and the Service Management Office (SMO).

EUO provides onsite and remote support to IT customers across all VA Administrations and special program offices, including direct support of over 340,000 VA employees and thousands of contractors who are issued government-furnished IT equipment and accesses. EUO provisions computing devices, conducts new facility activations and performs move, adds and changes; executes local systems implementations; performs break/fix functions; and engages with VA’s customers across the nation to meet IT support needs. EUO is comprised of over 3,400 VA staff providing support at over 1,400 VA facilities in addition to supporting remote IT users.

IO has responsibility for management and 24x7x365 operation of the agency’s IT infrastructure, enterprise IT systems and data centers, which handle the data processing of Veterans’ health information and nearly $100 billion in Veterans’ benefits, payments and payroll processing for the Department. IO manages and operates IT infrastructure and systems supporting all agency Administrations and functions, including the Veterans Health Administration, Veterans Benefits Administration, and National Cemetery Administration, as well as VA’s special program offices. This organization provides operations, change control, security and Tier 3 support for enterprise systems, platforms, operating systems, storage, backups, file system management, back office, database, client technologies and mainframe; and enterprise call center infrastructure; as well as website and enterprise-based application hosting services. IO provides data processing services not only to VA but to other Federal agencies. The IO organization is comprised of over 2,000 government employees.

ECO includes the Enterprise Command Center and Enterprise Service Desk. The Enterprise Command Center provides proactive 24x7x365 performance monitoring of critical VA applications, services, and systems to ensure compliance with service level objectives; rapid responses to incidents supporting service restoration; and remediation efforts to report on and mitigate repeat incidents. The Enterprise Service Desk serves as the initial single point of contact for all VA IT customers for requesting IT services or reporting IT incidents. Enterprise Service Desk provides Tier 1 support 24x7x365, including end-to-end ticket management, and manages the restoration process for service outages. Enterprise Service Desk also manages notifications and After Action Reporting on service disruptions.

ESO ensures the privacy, confidentiality, integrity, and availability of VA information assets, and advises on information security initiatives as a trusted principal advisor. ESO includes Security Customer Support and Security Systems Support. The Security Customer Support team is dedicated to district and area level support, which provides “boots on the ground” for all VA facilities for local audit support, incident response, research and contracting support, and local risk management activities in addition to security awareness training. The Security Systems Support section is dedicated to enterprise-level maintenance providing common security services to customers and is responsible for infrastructure and applications security support including data center support, research support, Cybersecurity Risk Management Framework, specialized device support, business requirements support and field program support.

The SMO provides oversight and governance of OIT’s IT Service Management (ITSM) tool and the IT Infrastructure Library (ITIL) processes that are the foundation of OIT’s service delivery framework. Processes and supporting ITSM tool modules overseen by this office include Service Catalog, Request Management, Service Desk, Incident Management, Problem Management, Change Management, Configuration Management, Release Management, and more.

Solution Delivery (SD) is the engineering arm of OIT. SD is responsible for engineering solutions that meet the needs of the Veteran and support the internal business requirements of VA. SD consists of four divisions: Business Systems Engineering, Infrastructure Engineering, Endpoint Engineering, and Security Engineering. The specialized engineering disciplines supported are Health Systems, Interagency Systems, Storage, Network, Platform, Data Center, Security, Video, Cloud, Messaging, Authentication, Personal Computers, Laptops, and Mobile Devices.

Service Management and Planning enables OIT to increase effectiveness and efficiency through central services supporting OIT. These enabling services include capital investment planning and management; multi-year programming, budget formulation and management; Contracting Officer Representative (COR) services for national IT infrastructure and operations contracts; executive correspondence and external reporting; strategic communications, OIT- wide action management; workforce and personnel administration services; OIT resource request management; central IT implementation management services; and oversight of the Enterprise Infrastructure Solutions program for telecommunications contracts.

Business Systems Engineering provides solutions for VA business service requirements supported by Infrastructure and End-Point Engineering. This engineering team collaborates with VA business entities, Government agencies, and private health organizations to ensure enterprise alignment with VA strategic goals and objectives. Infrastructure Engineering Engineers build standards-based enterprise infrastructure including networks, platform, storage, data center, and database services. These services include Wide Area Network (WAN)/Local Area Network (LAN) Infrastructure/Provisioning, Data Center Engineering and the Telecom Provisioning Office. Endpoint Engineering is responsible for creating and maintaining all baselines related to endpoint technologies. This engineering team is responsible for technology life-cycle changes for all endpoints, Messaging and Authentication Engineering, Business Voice/Call Center/Video Engineering, Enterprise Endpoint Management and Reporting, Mobile Technology, Endpoint Security Engineering, and Desktop and Device Engineering. Security Engineering provides the Department with an analytical security engineering foundation that delineates the principles and functions to meet the Department’s requirements, such as business needs and to reinforce compliance with VA Policy and other associated Federal mandates. This team engineers standards-based, policy-compliant security for the network enterprise and endpoint capabilities.

APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. 44 U.S.C. § 3541-3549, “Federal Information Security Management Act (FISMA) of 2002”

2. “Federal Information Security Modernization Act of 2014”

3. Federal Information Processing Standards (FIPS) Publication 140-2, “Security Requirements for Cryptographic Modules”

4. FIPS Pub 199. “Standards for Security Categorization of Federal Information and Information Systems,” February 2004

5. FIPS Pub 200, “Minimum Security Requirements for Federal Information and Information Systems,” March 2006

6. FIPS Pub 201-2, “Personal Identity Verification of Federal Employees and Contractors,” August 2013

7. 10 U.S.C. § 2224, “Defense Information Assurance Program”

8. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

9. Public Law 109-461, Veterans Benefits, Health Care, and Information Technology Act of 2006, Title IX, Information Security Matters

10. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”

11. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, https://www.va.gov/vapubs/index.cfm

12. VA Handbook 0710, “Personnel Security and Suitability Program,” May 2, 2016, https://www.va.gov/vapubs/index.cfm

13. VA Directive and Handbook 6102, “Internet/Intranet Services,” August 5, 2019

14. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and Guidelines,” January 18, 2017

15. Office of Management and Budget (OMB) Circular A-130, “Managing Federal Information as a Strategic Resource,” July 28, 2016

16. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed Services (CHAMPUS)”

17. NIST SP 800-66 Rev. 1, “An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule,” October 2008

18. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended, January 18, 2017

19. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

20. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021

21. VA Handbook 6500, “Risk Management Framework for VA Information Systems VA Information Security Program,” February 24, 2021

22. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI),” March 12, 2019

23. VA Handbook 6500.5, “Incorporating Security and Privacy into the System Development Lifecycle,” March 22, 2010

24. VA Handbook 6500.6, “Contract Security,” March 12, 2010

25. VA Handbook 6500.8, “Information System Contingency Planning,” April 6, 2011

26. VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018

27. VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017

28. OIT Process Asset Library (PAL), https://www.va.gov/process/ . Reference Process Maps at https://www.va.gov/process/maps.asp and Artifact templates at https://www.va.gov/process/artifacts.asp

29. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

30. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014

31. VA Handbook 6508.1, “Procedures for Privacy Threshold Analysis and Privacy Impact Assessment,” July 30, 2015

32. VA Handbook 6510, “VA Identity and Access Management,” January 15, 2016

33. VA Directive and Handbook 6513, “Secure External Connections,” October 12, 2017

34. VA Directive 6300, “Records and Information Management,” September 21, 2018

35. VA Handbook, 6300.1, “Records Management Procedures,“ March 24, 2010

36. NIST SP 800-37 Rev 2, “Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy,” December 2018

37. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020)

38. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015

39. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” March 24, 2014

40. OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005

41. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019

42. OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008

43. Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance, December 2, 2011, (NOTE: Part A of the FICAM Roadmap and Implementation Guidance, v2.0, was replaced in 2015 with an updated Architecture (https://arch.idmanagement.gov/#what-is-the-ficam-architecture)

44. NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access,“ June 2018

45. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, “Digital Identity Guidelines,” updated March 02, 2020

46. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014

47. NIST SP 800-164, “Guidelines on Hardware-Rooted Security in Mobile Devices (Draft),” October 2012

48. Draft National Institute of Standards and Technology Interagency Report (NISTIR) 7981, “Mobile, PIV, and Authentication,” March 2014

49. VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

50. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

51. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

52. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

53. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019

54. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008

55. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (Public Law 110–140), December 19, 2007

56. Section 104 of the Energy Policy Act of 2005, (Public Law 109–58), August 8, 2005

57. Executive Order 13834, “Efficient Federal Operations,” dated May 17, 2018

58. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 2, 2001

59. VA Directive 0058, “VA Green Purchasing Program,” July 19, 2013

60. VA Handbook 0058, “VA Green Purchasing Program,” July 19, 2013

61. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

62. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

63. “Veteran Focused Integration Process (VIP) Guide 4.0,” January 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

64. VA Memorandum “Proper Use of Email and Other Messaging Services,” January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

65. “DevSecOps Product Line Management Playbook” version 2.0, May 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

66. NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020

67. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol Version 6 (Ipv6),” November 19, 2020

68. Social Security Number (SSN) Fraud Prevention Act of 2017

69. Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23, 2018

70. Software Engineering Institute, Software Acquisition Capability Maturity Modeling (SA CMM) Level 2 procedures and processes

71. NBS SP500-153, “Guide to Auditing for Controls and Security: A System Development Life-Cycle Approach,” April 1988

72. Defense Information Systems Agency (DISA) Application Security and Development Security Technical Implementation Guide (STIG)

73. Electronic Signatures in Global and National Commerce Act

74. Federal Information Security Control Audit Manual (FISCAM)

75. IEEE (ISO/IEC) 12207, Standard for Information Technology Software Life Cycle Processes (in May 1998, replaced MIL-STD 498, Software Development and Documentation; which in November 1994, replaced DOD-STD-2167A, Defense System Software Development)

76. VA, Office of the Inspector General, Federal Information Security Management Act Audit for Fiscal Year 2013 (13-01391-72), May 29, 2014

The Contractor shall comply with the most recent version of any of the documents listed above. Additionally, the Contractor shall comply with any newly issued rules, regulations, instructions, handbooks, memoranda, or other Federal documents relating to security and privacy.

SCOPE OF WORK

The Contractor shall provide IT enterprise support services, including program/project management; systems, application, and database administration; software/system technical support; cyber security; and disaster recovery, to OIT in order to sustain OIT operations and OIT remediation support services. OIT is evolving based on the ChooseVA reorganization and OIT support services will be evolving throughout the life of the contract, where performance and support may be adjusted in order to support consolidating, transforming, and modernizing IT services across the enterprise.

ORDER TYPE

Tasks under this effort shall be proposed on a hybrid Firm-Fixed-Price (FFP) and Time-and Materials (T&M) basis, as follows: tasks set forth under PWS Sections 5.1 and all of its subsections and 5.4, if exercised, shall be performed on a FFP basis; tasks set forth under PWS Sections 5.2 and 5.3, including all subsections, shall be performed on a T&M basis. All travel shall be on a cost reimbursable, no fee basis.

All tasks 5.1 through 5.3 shall be performed in the base and option periods, if exercised.

Overtime premiums will not be permitted/approved under this order. It will not be approved for individual Contractor personnel exceeding his/her monthly tour of duty without prior concurrence from the Contracting Officer’s Representative (COR).

PERFORMANCE DETAILS

PERFORMANCE PERIOD

The period of performance (PoP) shall be 12 months from date of award, with four 12-month option periods, if exercised by the Government. The Transition Support and Plan Optional Task, if exercised by VA, shall have a 60 day PoP. The overall PoP for this contract shall not exceed 60 months, inclusive of all options.

Any work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO).

There are 11 Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, five are set by date:

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

PLACE OF PERFORMANCE

Tasks under this PWS shall be performed at Contractor facilities or remotely (offsite) and at VA Government facilities (onsite). The Contractor shall identify the Contractor’s place of performance in their proposal submission. The required onsite support is identified in Sections 5.1 through 5.3, as applicable. If onsite is not identified, then offsite support is anticipated.

The Contractor shall provide support to any of the VA facilities as required which is subject to change throughout the life of the Task Order (TO) PoP.

Figure 1. VA Districts

At VA facilities, the standard hours of operation for a normal workday, are Monday through Friday (onsite and offsite) for eight and one-half (8 ½) hours per day (to include a 30 min lunch break, if applicable) within the hours from 6:00 AM to 10:00 PM, location’s local time, and coordinated with the Government official at that site. Flexible work hours, such as staggered shifts and/or compressed tours-of-duty, shall be required to meet the standard hours required above by each facility.

In addition, Contractor performance may require the utilization of resources during non-standard hours of operation, including 24/7 operations, to respond to established scheduled maintenance activities that cannot be performed during standard hours since minimal interruption of service to VA staff or systems is required. The Contractor shall be required to adjust resource support accordingly as overtime premiums will not be reimbursed under scheduled maintenance occurrences.

The Contractor may be required to support emergency changes, which are outside the scheduled maintenance occurrences, and will not be reimbursed through overtime premiums. If additional hours are needed (beyond the normal 40-hour work week or no more than 80 hours in a two-week period), approval from the Government Project Oversight Official, VA Program Manager (PM) and COR is required.

TRAVEL

The Government anticipates travel under this effort throughout the period of performance. All travel will be on a cost reimbursable, no fee basis.

Travel and per diem shall be in accordance with the Federal Travel Regulations (FTR) and requires advanced concurrence by the Contracting Officer’s Representative (COR). Each Contractor invoice shall include copies of all receipts that support the travel costs claimed in the invoice. The Government will not reimburse local travel, which is travel within a 50-mile radius of an assigned duty location.

Requests for travel approval shall:

a. Be prepared in a legible manner.

b. Be summarized by traveler.

c. Identify the contract line item number (CLIN) and PWS task associated with the travel.

SPECIFIC TASKS AND DELIVERABLES

The Contractor shall coordinate with the COR/VA PM to review the Contractor’s Project Management Plan and its contents in accordance with Section 5.1.2 below for completing each deliverable and performing each task, prior to commencement of the task.

The Contractor shall provide personnel that are fully trained in their assigned technical field of expertise and maintain technical proficiency and currency during the TO PoP. If the Contractor requires or requests training to maintain professional or technical certifications, the acquisition of this training shall be the Contractor’s responsibility at no cost to the Government.

All personnel performing work shall possess experience in the disciplines and technical areas described in each task which are related to the design, analysis, engineering, operation, maintenance, and security of the Data Centers.

It is the responsibility of the Contractor to provide Contractor support personnel and subcontractors who have the required educational background, experience, VA or DoD security clearance, and access authorization or combination thereof to meet the labor category descriptions under this contract for the T&M tasks.

The personnel in the labor categories identified below are considered to be key to supporting this effort and shall not be removed from the TO, replaced or added to the TO without a compelling reason and without written notification to the COR. If any change to the personnel in the labor categories identified below becomes necessary (substitutions or additions), the Contractor shall immediately notify the COR in writing, accompanied by the resume of the proposed replacement personnel. To the extent possible, replacement personnel shall be at least equal in technical ability as the individuals currently performing in that category. It is expected that substitution or replacement of all the personnel outlined below will not occur within the first 90 days after date of TO award. Such labor categories and specific roles and responsibilities are further defined in the PWS Sections below:

The Contractor shall perform the following:

PROJECT MANAGEMENT (FFP)

SUPPORT MANAGEMENT

The Contractor shall provide a Project Manager (PjM) who shall serve as the manager of the TO and shall be the Contractor’s single point of contact for VA CORs and OIT management. The PjM shall manage the tasks, schedules, and analyze work discrepancies, communicate policies, purposes, and goals of the organization to the Contractor personnel for all projects. The PjM shall analyze and resolve programmatic issues, facilitate information exchange, and enhance management coordination as coordinated with the contract COR/VA PM(s). This support shall include managing onsite and offsite Contractor support, any tracking of resources across projects, transitioning and onboarding of new Contractor support required, and scheduling to ensure Support Services for OIT supported organizations for resolution of issues.

The Contractor PjM shall:

1. Conduct weekly VA Project Progress Reviews (PPR).

2. Provide Monthly Management Reports.

3. Track deliverables across projects.

4. Coordinate, escalate and resolve project issues (e.g. risk, resources, scheduling).

5. Attend status meetings and provide status reports to project stakeholders with COR coordination.

6. Track Contractor support across projects on a daily basis.

7. Maintain a VA provided document management system e.g. SharePoint, to track project deliverables.

8. Track that all Contractor support:

a. Meets all task schedules including non-standard work schedule(s) as required. Schedules include: nights, weekends, and holidays in accordance with OIT requirements a nonstandard work schedule, if required. Work may be required beyond normal duty hours, including nights, weekends, and holidays as necessary.

b. Performance is tracked against the PWS requirements and performance metrics.

9. Provide a Program Management Office (PMO) to facilitate the management of the program across all sites, functions and major initiatives. The Contractor (e.g. PMO) shall:

a. Ensure compliance with all contract and government regulations (i.e. Section 2).

b. Monitor performance/compliance.

c. Respond to customer data calls.

CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, timeline, and tools to be used in execution of the contract. The CPMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks, and resource support. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPMP shall be presented at the kick-off meeting and concurred upon and updated in accordance with Section B of the contract. The Contractor shall update and maintain the VA PM approved CPMP throughout the PoP.

The purpose of the CPMP is to provide a tool to allow VA to effectively manage this T&M TO as well as report/reprioritize activities on a monthly basis. The CPMP shall address program integration and communication activities to include disseminating communications, developing documents, plans and briefs, and managing program interdependencies.

The CPMP shall contain the following:

1. Risk and Issue Register – identify risks and define and manage mitigation strategies.

2. Master Schedule – the Master Schedule shall incorporate the individual organization’s program/project milestones and schedules. The Master Schedule shall present each individual organization milestones and schedules for task completion.

3. Work Breakdown Structure (WBS), activity lists and resources, plan and work schedule (including dependencies and interdependencies), and a project baseline.

The CPMP data elements required by each organization and its activities include:

1. Project and specific activities.

2. Overview and description of the activity.

3. Overall high level assessment of progress of the activity

4. All work in-progress and completed for the activity during the week.

5. Identification of any contract related issues/risks uncovered during the previous week, especially highlighting those areas that have a high probability of impacting schedule, cost, or performance goals and their likely impacts on schedule, cost, or performance goals.

6. Explanations for any unresolved issues/risks, including possible solutions and any actions required of the Government and/or Contractor to resolve or mitigate any identified issue, including a plan and timeframe for resolution.

7. Status of previously identified issues/risks, actions taken to mitigate the situation, and/or progress made in rectifying the situation.

8. Work planned for the subsequent week.

9. Current activity schedule overlaid on original activity schedule showing any delays or advancement in schedule.

10. Current expenditures overlaid over the original budget showing any deviations in the actual expenditures versus the original budget and versus the current budget.

11. Workforce staffing data showing all Contractor personnel performing on the effort during the previous week. After the initial labor baseline is provided, each Weekly Work Plan Report shall identify any changes in staffing identifying each person who was added to the activity or removed from the contract. This should also include any planned travel for the activity.

12. Original schedule of deliverables and the corresponding deliverables made during the previous week.

The Contractor shall continuously monitor performance and report any deviation from the CPMP to the COR and VA PM during routine, regular communications. The Contractor shall respond to all COR queries related to project milestones and schedule within four business hours of receipt of written request.

Deliverable:

A. Contractor Project Management Plan

PROGRAM ONBOARDING

The Contractor shall manage the onboarding and offboarding of its staff. Onboarding includes steps to obtain a VA PIV card, network and email account, complete training (mandatory and non-mandatory), initiate background investigations, and gain physical and logical access. The Contractor shall utilize VA’s Account Provisioning and Deprovisioning (APDP) system for the managing and tracking of onboarding and offboarding of its staff.

A Contractor Onboarding Security Point of Contact (SPOC) shall be designated by the Contractor that tracks the onboarding status of all Contractor personnel. The Contractor Onboarding SPOC shall be responsible for accurate and timely submission of all required VA onboarding paperwork to the VA COR. The Contractor shall be responsible for tracking the status of all its staff’s onboarding activities to include the names of all personnel engaged on the task, their initial training date for VA Privacy and Information Security training, and their next required training date. The Contractor Onboarding SPOC shall also report the status at the staff level during status meetings. The Contractor shall provide a Daily Onboarding Status Report for any staff with outstanding onboarding requests for review by the COR.

Deliverable:

A. Daily Onboarding Status Report Privacy Training The Contractor shall submit status of VA Privacy and Information Security Awareness training for all individuals engaged on the TO. The status reporting shall identify the following information: a single Contractor SPOC, the names of all personnel engaged on the task, their initial training dates for VA Privacy and Information Security training, and their next required training dates. This information shall be submitted as part of the Daily Onboarding Status Report.

Technical Kickoff Meeting A technical kickoff meeting shall be held within 10 days after TO award. The Contractor shall coordinate the date, time, and location (can be virtual) with the Contracting Officer (CO), as the Post-Award Conference Chairperson, the VA PM as the Co-Chairperson, the Contract Specialist (CS), and the COR. The Contractor shall provide a draft agenda to the CO and VA PM at least five calendar days prior to the meeting. Upon Government approval of a final agenda, the Contractor shall distribute to all meeting attendees. During the kickoff-meeting, the Contractor shall present, for review and approval by the Government, the details of the intended approach, work plan, and project schedule for each effort via a Microsoft Office PowerPoint presentation. At the conclusion of the meeting, the Contractor shall update the presentation with a final slide entitled “Summary Report” which shall include notes on any major issues, agreements, or disagreements discussed during the kickoff meeting and the following statement “As the Post-Award Conference Chairperson, I have reviewed the entirety of this presentation and assert that it is an accurate representation and summary of the discussions held during the Technical Kickoff Meeting for the Transformation Support Services (TSS) effort.” The Contractor shall submit the final updated presentation to the CO for review and signature within three calendar days after the meeting. The Contractor shall also work with the CS and the Government’s designated note taker, to prepare and distribute the Meeting Minutes of the kickoff meeting to the CO, COR and all attendees within three calendar days after the meeting. The Contractor shall obtain concurrence from the CS on the content of the meeting minutes prior to distribution of the document.

PROGRAM MANAGEMENT AND OPERATIONAL MANAGEMENT REVIEWS

The Contractor shall conduct monthly Program Management Reviews (PMRs) and Operational Management Reviews (OMRs) detailing the previous period’s achievements and progress on emerging and existing activities, identified risk and recommendations to mitigate risk, staffing plans and forecasts, as well as a financial analysis of contract expenditures. The COR may adjust the frequency of these meetings during performance. The Contractor shall deliver PMR and OMR Reports and Presentations to the COR and PM two days prior to the scheduled monthly PMR. The Contractor shall document the PMR and OMR in minutes that shall include a list of action items.

As determined by the COR/VA PM, the PMR and OMR shall be conducted in person or virtually, by video or telephone conferencing or by Microsoft Teams, or other conferencing capabilities within VA and Contractor capabilities.

Deliverable:

A. Monthly Program Management Review (PMR) and Operational Management Review (OMR) Reports and Presentations.

B. PMR and OMR Minutes

PROGRAM MANAGEMENT COMMUNICATION PLAN

The Contractor shall develop a single VA Enterprise Communication strategy which reaches across the OIT components supported in the PWS and shall be delivered to the COR/VA PM within 90 days of contract award. The VA Enterprise Communication strategy shall be tailored to each of the OIT components to disseminate vulnerabilities to all VA organizations (e.g., Individual facilities or Program Offices). The Contractor shall document the Communication strategy in a VA Enterprise Communication Plan. The Contractor shall maintain and update the plan every 90 days after initial VA PM approval, for the life of the contract. The Contractor shall implement the VA approved Communication Plan for the duration of the PoP.

Deliverable:

A. VA Enterprise Communication Plan

REMEDIATION SUPPORT SERVICES (T&M)

CRISP CONFIGURATION MANAGEMENT SUPPORT

The Contractor shall support the Continuous Readiness in Information Security Program (CRISP) configuration management controls and security protection tasks described below. This support is required within the Office of Information Security (OIS) and End User Services (EUS) to support the implementation of all recommendations identified in this PWS and future Federal Information Security Management Act (FISMA) and Federal Information System Controls Audit Manual (FISCAM) audit recommendations. The configuration management support may be adjusted to reflect any changes resulting from the ChooseVA initiatives and/or new Federal mandates (e.g., OMB Directives), Executive Orders (EO) and Cybersecurity & Infrastructure Security Agency (CISA) requirements.

The Contractor shall provide support services to OIT and field facilities (OIS) for resolving any critical Material Weaknesses (MW) as well as findings and recommendations related to configuration management, as identified by the VA Office of Inspector General (OIG) FISMA and FISCAM audits.

The Contractor shall:

1. Integrate all audit efforts into an Enterprise Cybersecurity Program (ECSP) governance structure to track status and outcomes.

2. Provide recommendations, status, support governance functions and develop all reports for Material Weakness Remediation.

3. Provide Subject Matter Expertise support to all projects, programs and activities under the ECSP.

4. Align assets to FISMA system boundaries. Provide coordination with System boundary owners/leads to address unaligned assets and build a repeatable business process. Automation is utilized where possible.

5. Document process for FISMA asset alignment.

The Contractor shall provide all relevant critical MW as well as relevant Configuration Management Reports, Briefings, Schedules and Recommendation Papers.

Deliverables:

A. Configuration Management Reports B. Configuration Management Briefings C. Configuration Management Schedules D. Configuration Management Recommendation Papers.

CONFIGURATION MANAGEMENT VULNERABILITIES SUPPORT

The Contractor shall provide the following configuration support services to OIT:

1. Provide an information security analysis and documentation to support the implementation of standardized processes, technology configurations, and security controls across VA. Any remediation completed or vulnerabilities identified as a result shall be continuously tracked, monitored, and reported in the Vulnerabilities and Remediation Status Reports and delivered to the COR for review and approval.

2. Provide Reports, Briefings, Recommendations, White Papers and Other Documents to enhance OIT security processes and documentation. All documentation drafted, as a result, of these services shall be provided to the COR.

Deliverables:

A. Vulnerabilities and Remediation Status Reports B. Reports, Briefings, Recommendations, White Papers and Other Documents

ENTERPRISE VULNERABILITY REMEDIATION PLANNING

The Contractor shall provide onsite configuration management support to OIT, including:

1. Enhance the monitoring process to identify and communicate changes in systems (e.g., information security controls, configuration baselines) enterprise-wide, and continuously track the status of vulnerabilities in the Vulnerabilities and Remediation Status Report and support communication to the governance board on enterprise-wide vulnerabilities.

2. With input from VA, update the Information System Vulnerability Management Plan (ISVMP) to define and implement clear roles and responsibilities for developing, maintaining, completing, and reporting vulnerabilities and program strategy, goals, and objectives.

3. Provide reports, briefings, recommendations, track all vulnerabilities, and respond to all data calls for IT.

4. Remediation of Aged Critical and High Vulnerabilities – The Contractor shall implement practices to ensure OIT managed aged critical and high vulnerabilities are remediated or aligned to Plans of Action and Milestones (POA&M) with mitigation factors.

5. Remediation of Known Exploited Vulnerabilities – The Contractor shall ensure OIT managed Known Exploited Vulnerabilities (KEV) identified on or before September 29, 2023, for assets aligned to the Enterprise Mission Assurance Support Service (eMASS) system boundaries, are remediated or aligned to POA&Ms with mitigation factors.

6. Information System Vulnerability Management Plan (ISVMP) v2.0 – The Contractor shall develop and deliver the ISVMP v2.0 document.

7. Hardware Asset Alignment to eMASS System Boundaries – The Contractor shall align hardware assets to appropriate eMASS system boundaries FISMA Containerization Asset to Boundary (FCAB) project for ownership identification and compliance.

8. Continuous Monitoring for Vulnerabilities – The Contractor shall sustain a 95% success rate threshold of critical, high, and known exploited vulnerabilities for assets aligned to eMASS system boundaries.

9. Development and Implementation of End of Life (EOL) Policy – The Contractor shall work with the VA to create and implement an End of Life policy.

10. Transition Plans for EOL Applications – The Contractor shall provide transition plans and POA&Ms for all Bedrock and Critical systems with EOL applications.

11. Transition Plans for Remaining Systems – The Contractor shall provide transition plans and POA&Ms for all remaining systems with EOL applications.

The Contractor shall provide detailed Implementation Plans for each task and provide Documentation, evidencing the completion of each task.

Deliverables:

A. Vulnerabilities and Remediation Status Reports B. Information Systems Vulnerability Management Program Plan C. Reports, Briefings, and Recommendation Papers D. Enterprise Vulnerability Remediation Support and Implementation Plans E. Enterprise Vulnerability Remediation Improvements Documentation

ENTERPRISE PATCH AND VULNERABILITY SUPPORT

The Contractor shall provide enterprise-level patch and vulnerability management support to prevent the exploitation of IT vulnerabilities within VA. The Contractor shall perform the following tasks:

1. Manage and maintain the OIT’s vulnerability management lifecycle process including the creation of a comprehensive Patch and Vulnerability Action Item List, outlining specific actions to address vulnerabilities.

2. Collaborate with OIS, IO and EUS organizations to streamline the patch and vulnerability management process.

3. Participate in meetings as directed by the OIT Government Manager or Lead to further refine and improve processes and procedures for patch and vulnerability management.

4. Coordinate with appropriate groups to respond to specific vulnerabilities, generating Monthly Patch Reports to summarize patching activities and progress.

5. Utilize data from OIT’s monthly predictive scan results to develop and coordinate completion of appropriate actions and track compliance of baseline implementation.

6. Analyze and document vulnerability management gaps. Provide solutions to address known gaps.

7. Provide recurring vulnerability remediation support.

8. Perform an analysis of the TRM process and assist in vulnerability response of TRM classified applications/software.

9. Perform vulnerability continuous monitoring and response for vulnerabilities that exceed VA defined timelines, with a corresponding Remediation Package Status Report, indicating the status of remediation packages for vulnerabilities.

10. Track milestone progress of vulnerability management improvement. Provide results and status to VA leadership and partners.

11. Provide analysis and solutions for Federal Cybersecurity requirements.

12. Develop and provide sustainment strategy and processes for cybersecurity vulnerability management solutions.

Deliverables:

A. Patch and Vulnerability Action Item List B. Monthly Patch Reports C. Remediation Packages Status Report

BASELINE CONFIGURATION PROCESS SUPPORT

The Contractor shall provide Enterprise Secure Configuration Baseline (ESCB) management support for electronic configurable items (CI) or assets that will connect to the OIT managed IT networked infrastructure.

The Contractor shall perform the following tasks:

1. Update and maintain the Baseline Configuration Intake (BCI) process.

2. Provide recommendations to improve the Enterprise Secure Configuration Checklist (ESCC) and BCI process and procedures and deliver the ESCC and Baseline Configuration Intake Process Recommendations to the COR/VA PM.

3. Review and post new baseline configurations to the Baseline Configuration Management (BCM) SharePoint repository that have been approved and ratified through the BCI process.

4. Assist in the development and submission of action items or bulletins of newly developed baselines.

5. Create an ESCB, submitted through the BCI, that meets the established criteria requirements, final baseline for each commonly used platform or technology and centralize access by all project stakeholders throughout the enterprise.

6. Compliance Monitoring – for each ESCB, the Contractor shall publish, on the BCM SharePoint repository, whether compliance monitoring is covered by an enterprise automated tool or if it must be manually assessed by an Information System Owner (ISO).

7. Compliance Monitoring Tool Validation – If the ESCB has an…