PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Office of Information & Technology Produce Delivery Service (PDS) eDiscovery Software as a Service (SaaS) & Maintenance

Date: 03/10/2026

VA-26-00011700

PWS Version Number: 1.0

Contents

1.0 BACKGROUND

2.0 APPLICABLE DOCUMENTS

3.0 SCOPE OF WORK

4.0 PERFORMANCE DETAILS

4.1 PERFORMANCE PERIOD

4.2 PLACE OF PERFORMANCE

4.3 TRAVEL

5.0 SPECIFIC TASKS AND DELIVERABLES

5.1 SaaS FEDRAMP ASSESSMENT AND AUTHORIZATION AND CONTINUOUS

MONITORING REQUIREMENTS

5.1.1 IF THE SOLUTION IS FedRAMP AUTHORIZED BUT NOT VA AUTHORIZED

5.1.2 IF THE SOLUTION IS FedRAMP AUTHORIZED AND VA AUTHORIZED: . 9

5.2 SPECIFIC TASKS AND DELIVERABLES

5.2.1 CONTRACTOR PROJECT MANAGEMENT PLAN

5.2.2 PRIVACY & HIPAA TRAINING

5.2.3 TECHNICAL KICKOFF MEETING

5.3 COMMERCIAL-OFF-THE-SHELF (COTS) EDISCOVERY PRODUCT

5.4 EDISCOVERY IMPLEMENTATION

5.4.1 REQUIREMENTS

5.4.2 DESIGN

5.4.3 CONFIGURATION & IMPLEMENTATION

5.4.4 PROVIDE NETWORK CONNECTIVITY

5.4.5 TEST & EVALUATION (T & E)

5.4.6 MONTHLY REPORTING

5.5 EDISCOVERY TRAINING

5.6 EDISCOVERY SUPPORT

5.7 ASSESSMENT, AUTHORIZATION, AND CONTINUOUS MONITORING

5.8 MIGRATION TASKS

5.9 OPTIONAL TASKS

5.9.1 OUTGOING TRANSITION SUPPORT (OPTIONAL TASK 1)

5.9.2 ADDITIONAL STORAGE (OPTIONAL TASK 2)

5.9.3 ADDITIONAL CONCURRENT USERS (OPTIONAL TASK 3)

6.0 GENERAL REQUIREMENTS

6.1 ENTERPRISE AND IT FRAMEWORK

6.1.1 VA TECHNICAL REFERENCE MODEL

6.1.2 ZERO TRUST – VA CRITICAL SECURITY CONTROLS

6.1.3 FEDERAL IDENTITY, CREDENTIAL, AND ACCESS MANAGEMENT (FICAM)

6.1.4 INTERNET PROTOCOL VERSION 6 (IPv6)

6.1.5 TRUSTED INTERNET CONNECTION (TIC)

6.1.6 STANDARD COMPUTER CONFIGURATION

6.1.7 VETERAN FOCUSED INTEGRATION PROCESS (VIP) AND PRODUCT LINE

MANAGEMENT (PLM)

6.1.8 PROCESS ASSET LIBRARY (PAL)

6.1.9 AUTHORITATIVE DATA SOURCES

6.1.10 SOCIAL SECURITY NUMBER (SSN) REDUCTION

6.2 SECURITY AND PRIVACY REQUIREMENTS

6.2.1 POSITION/TASK RISK DESIGNATION LEVEL(S)

6.2.2 CONTRACTOR PERSONNEL SECURITY REQUIREMENTS

6.3 METHOD AND DISTRIBUTION OF DELIVERABLES

6.4 PERFORMANCE METRICS

6.5 FACILITY/RESOURCE PROVISIONS

ADDENDUM B – VA INFORMATION AND INFORMATION SYSTEM SECURITY/ PRIVACY

LANGUAGE

1.0 BACKGROUND

The Department of Veterans Affairs (VA), Office of Information & Technology (OIT), Product Delivery Services (PDS), strives to provide high quality, effective, and efficient Information Technology (IT) services to those responsible for providing care to the Veterans at the point-of-care as well as throughout all the points of the Veterans’ health care in an effective, timely and compassionate manner. VA depends on Information Management/Information Technology (IM/IT) systems to meet mission goals.

The VA Office of General Counsel (OGC) and Office of Accountability and Whistleblower Protection (OAWP) require an eDiscovery system to effectively preserve, collect, process, review, analyze, and produce Electronically Stored Information (ESI) in compliance with legal obligations under the Federal Rules of Civil Procedure (FRCP).

VA OGC requires the capability to meet time sensitive requests to process, upload and analyze millions of ESI records as required to meet time sensitive court-ordered deadlines for productions in litigation, investigations, Freedom of Information Act (FOIA) requests, and Congressional Oversight requests to minimize risks of court sanctions and costly unmerited settlements.

2.0 APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. Public Law 109-461, Veterans Benefits, Health Care, and Information Technology Act of 2006, Title IX, Information Security Matters

2. 42 U.S.C. § 2000d, “Title VI of the Civil Rights Act of 1964,” as amended

3. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010 https://www.va.gov/vapubs/index.cfm

4. VA Handbook 0710, “Personnel Security and Suitability Program,” May 2, 2016 https://www.va.gov/vapubs/index.cfm

5. 36 C.F.R. Part 1194, “Information and Communication Technology Standards and

Guidelines,” as amended

6. OMB Circular A-130, “Managing Federal Information as a Strategic Resource,” July

28, 2016

7. NIST SP 800-66 Rev. 2, “Implementing the HIPAA Security Rule,” February 2024

8. 45 C.F.R Parts 160 and 164 (HIPAA Privacy and Security Rules)

9. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended

10. Homeland Security Presidential Directive 12 (HSPD-12), August 27, 2004

11. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021

(Includes VA Notice 24-18 and VA Notice 25-07)

12. VA Handbook 6500, “Risk Management Framework for VA Information Systems,”

February 24, 2021 (Includes VA Notice 25-01 and VA Notice 25-06)

13. NIST SP 800-37 Rev. 2, “Risk Management Framework for Information Systems,” December 2018

14. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” 2020

15. VA Memorandum, VAIQ #7100147, “Continued Implementation of HSPD-12,” April 29, 2011 https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514

16. IAM Identity Management Business Requirements Guidance (2013) https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514

17. Federal Identity, Credential, and Access Management (FICAM) Architecture, June 30, 2023 https://www.idmanagement.gov/arch/

18. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, “Digital Identity Guidelines,” March 02, 2020

19. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014

20. VA Memorandum, “PIV Logical Access Policy Clarification,” July 17, 2019 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

21. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents https://www.cisa.gov/publication/tic-30-core-guidance-documents

22. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC)

Initiative,” September 12, 2019

23. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name

System Infrastructure,” August 22, 2008

24. Executive Order 14028, “Executive Order on Improving the Nation's Cybersecurity” https://bidenwhitehouse.archives.gov/briefing-room/presidential-actions/2025/01/16/executive-order-on-strengthening-and-promoting-innovation-in-the-nations-cybersecurity/

25. OMB Memorandum M-22-09, “Moving the U.S. Government Toward Zero Trust Cybersecurity Principles,” January 26, 2022 https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf

26. NIST SP 800-52 Rev. 2, “Guidelines for the Selection, Configuration, and Use of TLS Implementations”

27. OMB Memorandum M-22-18, “Enhancing the Security of the Software Supply Chain,” September 14, 2022

28. OMB Memorandum M-23-16, “Update to Memorandum M-22-18,” June 9, 2023

29. OMB Memorandum M-21-31, “Improving the Federal Government’s Investigative and Remediation Capabilities Related to Cybersecurity Incidents,” August 27, 2021

30. NIST SP 800-88 Rev. 1, “Guidelines for Media Sanitization,” December 2014

31. CISA Binding Operational Directive (BOD) 19-02, “Vulnerability Remediation

Requirements for Internet-Accessible Systems” https://www.cisa.gov/news-events/directives/bod-19-02-vulnerability-remediation-requirements-internet-accessible-systems

32. CISA BOD 22-01, “Reducing the Significant Risk of Known Exploited Vulnerabilities” https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities

33. CISA BOD 23-01, “Improving Asset Visibility and Vulnerability Detection on Federal Networks” https://www.cisa.gov/news-events/directives/bod-23-01-improving-asset-visibility-and-vulnerability-detection-federal-networks

34. VA Memorandum, “VA Security Controls,” January 17, 2025 https://www.voa.va.gov/DocumentView.aspx?DocumentID=5010

35. NIST SP 500-267B Rev 1, “USGv6 Profile,” November 2020

36. OMB Memorandum M-21-07, “Completing the Transition to IPv6,” November 19,

3.0 SCOPE OF WORK

The Contractor shall provide an enterprise Software as a Service (SaaS) consisting of a Commercial-off-the-shelf (COTS) product that fully supports VA eDiscovery needs to increase capacity and comply with Federal eDiscovery Law and VA requirements.

The eDiscovery System shall provide the following functions and capabilities to the VA OGC/OAWP eDiscovery needs:

• A SaaS solution authorized at the FedRAMP MODERATE level and meet FISMA Moderate requirements as specified in Section 5.1 at time of proposal submission and fully configurable, deployed and ready for VA use within 14 days of award.

• Implementation of the system, including software installation, data migration, testing, and deployment support.

• Training support shall be available through the duration of the contract period of performance.

• 24/7 on-call technical support.

• Product service and support including technical support and Service Level Agreements

(SLAs).

• Installation of software upgrades, patches, and releases.

4.0 PERFORMANCE DETAILS

4.1 PERFORMANCE PERIOD

The period of performance (PoP) shall consist of a 12-month base period plus four (4), 12-month option periods and four (4) optional tasks to be exercised at the Government’s discretion and as follows:

• Base period shall include eDiscovery software solution implementation, one-year support of the eDiscovery software, and VA staff training.

• Option Period 1 shall include one-year support of the eDiscovery solution and training for new and updated software modules as released.

• Option Period 2 shall include one-year support of the eDiscovery solution and training

• Option Period 3 shall include one-year support of the eDiscovery solution and training

• Option Period 4 shall include one-year support of the eDiscovery solution and training

• Optional Task One – Transition Support: One 90-day optional task for transitional support which may be exercised once at any time during the during the base or option periods (if exercised).

Optional Task Two – Additional Storage: This optional task may be exercised multiple times, and at any time during the base and/or option periods (if exercised) up to 20 times for up to a total of 400TB.

• Optional Task Three - Additional Concurrent Users: This optional task may be exercised multiple times, and at any time during the base and/or option periods (if exercised) up to 18 times for up to a total of 180 Additional Concurrent Users.

There are 11 Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, five are set by date:

New Year's Day January 1 Juneteenth June 19 Independence Day July 4 Veterans Day November 11 Christmas Day December 25

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

Martin Luther King's Birthday Third Monday in January Washington's Birthday Third Monday in February Memorial Day Last Monday in May Labor Day First Monday in September Columbus Day Second Monday in October Thanksgiving Fourth Thursday in November

4.2 PLACE OF PERFORMANCE

Tasks under this PWS shall be performed at Contractor facilities. The Contractor shall identify the Contractor’s place of performance in their proposal submission.

Work may be performed at remote locations with prior approval of the Program Manager (PM).

The Contractor shall maintain onsite presence during normal Monday through Friday business hours. After-business-hours, emergency, and pre-approved scheduled work may be performed at remote locations with prior approval of the VA PM as stated in this PWS.

4.3 TRAVEL

The Government does not anticipate travel under this effort to perform the tasks associated with the effort.

5.0 SPECIFIC TASKS AND DELIVERABLES

The Contractor shall perform the specific tasks and deliverables described in the sections that follow.

5.1 SAAS FEDRAMP ASSESSMENT AND AUTHORIZATION AND CONTINUOUS

MONITORING REQUIREMENTS

5.1.1 IF THE SOLUTION IS FedRAMP AUTHORIZED BUT NOT VA

AUTHORIZED

1. The information system solution selected by the Contractor shall comply with the

Federal Information Security Management Act (FISMA)

2. The Contractor shall remain in compliance with FedRAMP requirements as mandated by Federal laws and policies, including making available any documentation, physical access, and logical access needed to support this requirement.

3. The system must be FedRAMP Authorized at no less than the Moderate impact level.

4. The Contractor shall, where applicable, assist with the VA Authority to Operate (ATO) Process to help achieve agency authorization of the cloud service or migrated application.

5. The Contractor shall provide confirmation of the completion of its FedRAMP System Security Plan (SSP) and supporting documentation by providing, to the VA PM, COR, and DTC, its repository ID number and associated link for VA to download the SSP and all required artifacts within five calendar days of contract award.

6. The Contractor shall work with a VA DTC Subject Matter Expert to develop and provide a VA specific system boundary diagram including any integration and connectivity components for VA use. This will be known as the VA Implementation Diagram (VAID) and will demonstrate the proposed implementation of this system at

VA.

7. The Contractor shall provide the results of their most recent Third-Party Assessment Organization (3PAO) Security Assessment Plan (SAP).

8. The Contractor shall complete a 3PAO Security Assessment Report (SAR).

9. The Contractor shall provide VA with the most recent monthly scans for the production environment within the authorization boundary and their scan upload schedule for FedRAMP within 30 calendar days of contract award.

10. The Contractor shall provide their availability to participate in monthly continuous monitoring meetings to be scheduled following successful VA ATO within 30 calendar days of contract award.

11. If new or unanticipated vulnerabilities are discovered by either VA or the Contractor, or if existing safeguards have ceased to function, the discoverer shall https://www.fedramp.gov/

12. bring the situation to the attention of the other party within one hour in accordance with Addendum B, VA Information and Information System Security/Privacy Language.

13. The Contractor shall comply with FedRAMP data management requirements.

14. Successful issuance of a VA ATO will be required before live VA data can be used in the system.

15. The Contractor shall participate in FedRAMP Continuous Monitoring activities as

16. outlined by FedRAMP’s Continuous Monitoring Strategy.

17. The Contractor shall participate in monthly Agency and FedRAMP Sustainment meetings following the granting of a VA ATO.

18. The Contractor shall provide continuous monitoring activities including, but not limited to scans, security artifacts, and provide Continuous Monitoring Monthly Scans and monthly Plan of Action and Milestones (POAM) reports as outlined by VA and FedRAMP requirements.

19. The Contractor shall provide a Monthly VA License Report of VA sites currently utilizing the cloud product post ATO award. The license report shall include the number of subscription licenses being utilized and the specific VA site where they’re in use.

Deliverables:

A. VA Implementation Diagram B. 3PAO Security Assessment Plan (SAP) C. 3PAO Security Assessment Report (SAR) D. Plan of Action and Milestones Reports E. Monthly VA License Report

5.1.2 IF THE SOLUTION IS FedRAMP AUTHORIZED AND VA

AUTHORIZED:

1. The information system solution selected by the Contractor shall comply with the

Federal Information Security Management Act (FISMA) and have a current VA authorization.

2. The Contractor shall remain in compliance with FedRAMP requirements as mandated by Federal laws and policies, including making available any documentation, physical access, and logical access needed to support this requirement.

3. The FedRAMP Authorization level and existing VA ATO should be no less than the level required for this use case which has been defined as Moderate impact level.

4. The Contractor shall, where applicable, assist with the VA ATO Sustainment Process to help maintain health and quality of agency authorization of the cloud service or migrated application.

5. The Contractor shall exclusively provide subscription licenses to FedRAMP authorized and VA authorized environments.

6. If new or unanticipated vulnerabilities are discovered by either VA or the Contractor, or if existing safeguards have ceased to function, the discoverer shall bring the situation to the attention of the other party within one hour in https://www.fedramp.gov/

7. accordance with Addendum B, VA Information and Information System Security/Privacy Language. VA Privacy and Security deliverables as directed by the VA System owner.

8. The Contractor shall comply with FedRAMP data management requirements.

9. Successful issuance of a VA ATO will be required before live VA data can be used in the system.

10. The Contractor shall participate in FedRAMP Continuous Monitoring activities as outlined by FedRAMP’s Continuous Monitoring Strategy Guide found on the FedRAMP Website.

11. The Contractor shall provide continuous monitoring activities including, but not limited to, scans, security artifacts, and provide Continuous Monitoring Monthly Scans and monthly Plan of Action and Milestones (POAM) reports as outlined by FedRAMP requirements.

12. The Contractor shall participate in monthly Agency and FedRAMP Sustainment meetings following the granting of a VA ATO.

13. The Contractor shall provide a Monthly VA License report of VA sites currently utilizing the cloud product post ATO award. The license report shall include the number of subscription licenses being utilized and the specific VA site where they’re in use.

A. Continuous Monitoring Monthly Scans B. Plan of Action and Milestones Reports.

C. Monthly VA License Report

5.2 SPECIFIC TASKS AND DELIVERABLES

5.2.1 CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, timeline, and tools to be used in execution of this Task Order (TO) effort. The CPMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks, and resource support. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPMP shall be concurred upon and updated in accordance with Section B of the TO. The Contractor shall update and maintain the VA Program Manager (PM) approved CPMP throughout the PoP.

Deliverable:

A. Contractor Project Management Plan

5.2.2 PRIVACY & HIPAA TRAINING

The Contractor shall submit Talent Management System (TMS) training certificates of completion for VA Privacy and Information Security Awareness and Rules of Behavior Training and Health Insurance Portability and Accountability Act (HIPAA) training and provide signed copies of the Contractor Rules of Behavior in accordance with Section 9, Training, from Appendix C of the VA Handbook 6500.6, “Contract Security”.

Deliverables:

A. VA Privacy and Information Security Awareness and Rules of Behavior Training Certificate

B. VA HIPAA certificate of completion

5.2.3 TECHNICAL KICKOFF MEETING

A technical kickoff meeting shall be held within 10 days after TO award. The Contractor shall coordinate the date and time of a virtual meeting with the Contracting Officer (CO), the VA PM, the Contract Specialist, and the Contracting Officer Representative (COR). The Contractor shall provide a draft agenda to the CO and VA PM at least five (5) calendar days prior to the meeting. Upon Government approval of a final agenda, the Contractor shall distribute to all meeting attendees. The Contractor shall prepare and distribute the meeting minutes of the kickoff meeting to the CO, COR, and all attendees within three (3) calendar days after the meeting. The Contractor shall obtain concurrence from the COR on the content of the meeting minutes prior to distribution of the document.

Deliverables:

A. Kickoff Meeting Agenda B. Kickoff Meeting Minutes

5.3 COMMERCIAL-OFF-THE-SHELF (COTS) EDISCOVERY PRODUCT

The eDiscovery platform shall provide the following business capabilities that are required to comply with Federal eDiscovery Law and VA requirements, and to ensure that the OGC and OAWP will be capable of producing ESI in a timely, repeatable, and defensible manner within 30 calendar days of contract award. The required business capabilities include:

1. Provide the capability for an average of 100 concurrent users or the ability to support approximately 1,000 named users, depending on platform user licensing model.

2. Support the opening of 450 new cases per year, average case size 350 gigabyte (GB).

3. Support VA staff ability to upload/download ESI, including an initial upload of approximately 300TB of existing data from VA’s current platform.

4. Ability to Read, Import, Process, and Export industry standard Concordance formatted data files.

5. Support a single tenant cloud hosting architecture, with the capability to support the multiple internal VA business organizations and requiring no access to each other’s workspace.

6. Accommodate Microsoft Entra ID authentication or other VA approved authentication methods.

7. VA Entra ID authentication and authorization must be a native function without additional on-premises devices.

8. Must support role-based access with 2-factor authentication.

9. Role-based access is defined based on type of user (attorney, paralegal, etc) with a standard set of permissions and the ability to granularly customize access with additional security/permission attributes for individual users.

10. Allow for future interoperability with Office 365, SharePoint, OneDrive, and Microsoft (MS) Teams.

11. Compliance with VA Section 508 Office requirements shall be implemented and successfully tested within 90 days of all software update/upgrade releases.

12. 508 Accessibility features are activated/deactivated at the user level.

13. Support utilization of VA security protocols to automate discovery and collection.

14. Perform Authentication, Authorization, and Accounting (AAA) to validate parties attempting to log on to a system or application as authorized users to include tracking access credentials for the protection of federal information assets and to log and prevent unauthorized access to those assets.

15. Provide knowledge management capture services in order to record problem-solving knowledge to include the processes, techniques, and technologies for collecting information so that it may be stored for publishing and reuse.

16. Manage official Government records to enforce policies and rules for the retention and disposition of Government information and records.

17. Conduct data governance to establish and manage policies, processes, and standards for the management of VA data to include the identification and designation of VA common data, appoint data stewards for information subject areas, and identification and designation of Authoritative Data Sources for VA data.

18. Provide business intelligence services to deliver the applications, tools, services, and best practices that enable access to and analysis of information to improve and optimize VA decisions and performance.

19. Perform business analytics using VA data to perform statistical analysis, reporting, and visualizations to provide meaningful information to VA and to external Federal entities as required for regulatory and oversight purposes.

20. The eDiscovery solution shall conform to the Electronic Discovery Reference Model (EDRM) framework guidance as follows:

a. Analysis - Perform analytical functions in a manner consistent with federal law, matching current industry standards as of 2026 for reliability, user friendliness, and customizability. The solution shall accommodate evaluation of ESI for content and context, including key patterns and topics, to search, triage, predictively code, organize, and report on large volumes of data as follows:

1) Audio search.

2) Automated identification of Social Security numbers (SSNs) or other Personally Identifiable Information (PII).

3) Concept clustering.

4) Database reporting, visualizations, and exports.

5) Email threading.

6) Full search capabilities - including Boolean logic, fuzzy or stemmed searching, saved searches, search history, and dynamic or scheduled search updating among many search features.

7) Keyword highlighting.

8) Near-duplicate identification, searching, and clustering.

9) Predictive coding and Technology Assisted Review (TAR), including Simple Passive Learning, Simple Active Learning, Continuous Active Learning, and/or other eDiscovery-focused AI capabilities.

10) TAR analytics are rendered with visualizations features include graphs, word clouds and/or circle clusters.

b. Processing - Reduce the volume of ESI and convert it as needed for review and analysis. The solution capabilities shall consist of:

1) Processing (indexing) speed of no less than 500GB per hour.

I. 70% of documents shall be indexed on the first attempt.

II. 95% of documents shall be indexed on the second attempt.

III. 100% of documents shall be indexed on the third attempt

2) Data De-duplication in the way of Duplicate suppression and Near-duplication.

3) Removal of all files on a specific list of file types deemed to be of no evidentiary value; “De-NISTing” utilizing the list created by the National Institute of Standards and Technology (NIST).

4) Moving documents containing certain file paths.

5) Omitting certain multipurpose internet mail extension (MIME) types (e.g., system files and executables).

6) Eliminating files that fall below a size threshold.

7) Processing ESI based on date range restrictions.

8) Not extracting certain types of "children" or "embedded objects" as separate records (e.g., inline images in office documents and emails).

9) Clustering the data using semantic analysis.

10) Grouping by date and custodian.

11) Allowing manual custodian assignments.

12) Processing digital audio files.

13) Email threading and reconstructing communication threads.

14) Full text indexing.

15) Providing logs of what was accomplished and what failed during processing, such as:

I. No document text.

II. Optical Character Recognition (OCR) being extracted from the ESI.

III. Encrypted or password-protected files.

IV. Errors encountered due to corrupted files.

c. Review - Evaluate ESI for relevance and privilege in a simple, efficient manner, matching industry standards as of 2026 for reliability, maintainability, scalability, and user interface design. Capabilities shall include:

1) Accessibility (508 compliance, use with all current VA supported versions of web browsers, dual screen functionality, ability to adjust test/font size, security/permissions options).

2) Document navigation and retrieval in 4 seconds or less from TIC gateway.

3) Audit logging of user actions.

4) Automatic OCR for image and PDF file formats.

5) Batching for review.

6) Document redaction.

7) Document printing and downloads or exports by end users.

8) Document tagging and bulk tagging.

9) Family group tagging/review flexibility.

10) Keyword highlighting including folder or review batch-based persistent highlighting.

11) Proprietary document viewer capabilities, true native document view options or integration.

12) Scalability for VA use.

13) Visibility of metadata, hidden data, and Microsoft in-document tracked changes or comments.

14) Ability to show/hide different folders for different user profiles within a case

15) Ability to show/hide different tagging attributes within a case for different user roles/profiles and for individual users.

d. Production - Deliver ESI to intended recipients in appropriate forms and using appropriate delivery mechanisms as follows:

1) Produce in Load File format and create Load File Exports Templates.

2) Export or “package” case data in a format that can be more readily and directly loaded into a downstream application for review and analysis.

3) Produce “metadata” exports.

4) Capability to export with Nested Attachments.

5) Execute image-based productions.

6) Support custom headers and footers.

7) Support watermark labeling of documents.

8) Support Bates stamp or other unique file identifiers for native files.

9) Enable a reviewer to undo highlighting or other native attorney work product appearing on documents.

10) Hash (encrypt) ESI production artifacts.

e. Presentation - Display ESI data findings before audiences at depositions, hearings, trials, etc., especially in native and near-native forms, to elicit further information, validate existing facts or positions, or persuade an audience.

21. Preservation - Ensure that potentially e-discovery-relevant ESI is properly stored and protected against inappropriate alteration or destruction using measures such as retention and deletion schedules.

22. Advanced Artificial Intelligence (AI) – Due to the rapidly developing nature of the technology, the following are preferred features. The VA requires an integrated eDiscovery platform that implements and leverages advanced AI technologies -including, but not limited to, industry-standard Generative AI and Agentic AI capabilities. The following are objectives and features the VA is envisioning to increase the efficiency, accuracy, and defensibility of the document review process.

a. Natural Language Query Interface o The platform should provide a search interface that allows users to execute queries using plain-English instructions, leveraging natural language processing (NLP) to interpret intent, context, and semantic meaning.

b. Content Summarization Feature o The platform should provide the ability to generate natural language summaries of documents, folders, and search results.

c. Generative and Agentic AI-based Predictive Coding Tool o The platform should provide features that automate reviews through predictive coding based on natural language prompts that can be leveraged for reviews for both relevancy and privilege without manual training sets.

d. Automated PII/PHI Identification and Redaction Tool o The platform should provide the ability to automatically identify, recommend, and apply redactions for Personally Identifiable Information (PII) and Protected Health Information (PHI).

e. Concept Searching and Clustering Feature o The platform should provide a solution that allows users to visualize the data landscape, identifying and grouping conceptually similar documents.

f. Permission-based user access/features o The platform should allow user-based permissions to be applied for access and use of AI features/tools that can be controlled by administrators.

g. Human-in-the Loop Design o The AI tools should be designed as assistive technology, allowing for user verification and correction. The platform should provide metrics to validate the accuracy of AI suggestions based on recall and precision.

h. Ability to control and audit data generated from AI features and its usage.

o The platform must generate comprehensive audit trails tracking which user activated an AI feature, the parameters used, and output generated. It should also provide access and control to any data generated or created to be used by the various AI features, including the ability to control any potential hosting impacts from its usage.

i. Transparency o Upon request, on an as-needed basis, the Vendor shall provide documentation regarding the risk management processes used to ensure AI outputs are non-discriminatory and reasonably accurate.

j. AI Data Usage and Prompt Security o The platform must prevent exposure or unauthorized access to AI prompt queries used by the Agency, storing them in encrypted, secure logs. User-uploaded data, confidential information, or case-specific data will not be used to train, update, or refine Vendor’s underlying AI models.

5.4 EDISCOVERY IMPLEMENTATION

5.4.1 REQUIREMENTS

During the implementation, the Contractor shall complete requirements sessions with the VA business customer, users, and OI&T staff (hereinafter “VA Team”) to properly understand and refine business requirements for implementation. The outcome shall be a detailed understanding of VA business customer needs which shall be documented in Requirements Session Meeting Notes.

A. Requirements Sessions Meeting Notes

5.4.2 DESIGN

The Contractor shall ensure that the product design includes software configurations, interface specifications, screen and report designs, and security control specifications. The design document shall reflect the physical, functional, and operational architecture of the Contractor’s solution including constraints to functionality and any gaps. The system/software information shall be captured in the System/Software Design Document (SDD). The SDD shall at a minimum address the following:

1. Establish the system architecture to include key interfaces between the cloud application and VA systems.

2. Include design considerations for security and audit procedures, archival of historical data, data migration and data handling criteria, scheduling, disaster recovery, and quality assurance factors.

3. Identify, define, and design capacity and performance requirements and any associated limitations. Specifically, coordinate with the Government to identify limitations and considerations during the design phase.

4. Apply VA standards complying with security requirements, enterprise architecture, data standardization, format, transmission, and storage in adherence with VA standards identified in the One-VA Technical Reference Model (TRM).

A. System Design Document (SDD)

5.4.3 CONFIGURATION & IMPLEMENTATION

The Contractor shall provide eDiscovery application configuration services that are consistent with its standard implementation and deployment methodology. The Contractor shall configure the application to meet all VA’s requirements as stipulated in this PWS. The Contractor shall provide guidance on alternative approaches to minimize future customizations of the application. The Contractor shall perform all configuration of the systems prior to deployment.

The Contractor shall prepare a Change and Configuration Management Plan in accordance with all applicable regulatory policy and guidance. The Change and Configuration Management Plan shall contain all information relevant to defining and modifying the application from the initial baseline configuration and subsequent re-baselining activities.

The Contractor shall assist the VA project teams with data migration as outlined in section 5.8 from existing eDiscovery software to be completed within 60 days of receipt of Authority to Operate (ATO).

A. Change and Configuration Management Plan

5.4.4 PROVIDE NETWORK CONNECTIVITY

The Contractor’s hosted cloud environment shall have established and approved direct access to the VA Trusted Internet Connection (TIC) 2.0 Gateway Connection. Connectivity between the Cloud Service Provider (CSP) and the VA TIC shall comply with TIC Reference Architecture Document Version 2.0. The Contractor shall not send or receive data to the VA network without an approved ATO from VA. Any deployment outside of the VA firewall is subject to VA TIC 2.0 Gateway Connection requirements for communication with other VA systems within the VA Firewall.

The Contractor shall provide network solutions for connectivity between the primary and secondary site, subject to Federal Information Processing Standard (FIPS)-140-2 certification and (FIPS)-140-3 when required of equipment and configurations and the criteria set forth by the System Security Plan (SSP).

The Contractor shall deliver the following network functionality:

1. Provide network connectivity that complies with FIPS 140-2, Section 1, Table 1, up to and including Security Level 3.

2. The Contractor solution shall support Internet Protocol Version 6 (IPv6) in accordance with the directive issued by the Office of Management and Budget (OMB) on September 28, 2010, IPv6 technology, in accordance with the USGv6: “Technical Infrastructure for IPv6 Adoption” and the NIST SP 800 series applicable compliance shall be included in all IT infrastructures, application designs, application development, operational systems and sub-systems, and their integration. In addition to the above requirements, all devices shall support dual stack connectivity without additional memory or other resources being provided by the Government, so that they can function in a mixed environment. All public/external facing servers and services (e.g., web, email, DNS, ISP services, etc.) shall support native IPv6 users, and all internal infrastructure and applications shall communicate using native IPv6 operations.

3. All user connectivity to the cloud hosting environment shall be through the TIC gateway.

Users shall not be capable of accessing the Case Management System or background investigation data through an internet connection direct to the cloud that bypasses the TIC gateway.

4. The Contractor shall provide a Service Level Agreement (SLA) document identifying the expected availability of the application. Availability of 99.9 percent is required, with a maximum amount of unplanned downtime per year not to exceed 8 hours.

A. Service Level Agreement

5.4.5 TEST & EVALUATION (T & E)

The Contractor shall support the testing by the VA (e.g., unit, functional, accessibility, system, reliability, usability, interoperability, regression, security, performance) throughout the implementation cycle using industry best practices. The Contractor shall correct or mitigate any deficiencies discovered during such testing, at no additional cost.

5.4.6 MONTHLY REPORTING

The Contractor shall provide a Monthly Status Report for the eDiscovery system. The Monthly Status Report shall include at a minimum the following data and information:

A. Monthly Project Cost Platform Utilization: Provide information showing VA how much it cost for the services provided for the month and Year-to-date.

B. Successful processing/indexing percentage – Provide information on the success rate of indexing documents on the first, second, and third attempts.

C. Analysis and Review Performance – Provide information on the success of retrieving documents in 4 seconds or less and 100% Native document rendering.

D. Output/Production - Shall include number of successful operations.

E. Monthly Up-time - 99.9% Application availability over the course of the previous 30 days and year-to-date.

F. Security Compliance - Application compliance with VA Security standards.

G. Web Request/Database Metrics - The number of transactions over the period of observation.

A. Monthly Status Reports

5.5 EDISCOVERY TRAINING

Training shall be available throughout the duration of the task order to include each Option Period. Training shall be role-based (user, admin, etc.). The Contractor shall provide training as follows:

1. Provide four (4) Web training sessions to train approximately 300 VA staff during transition

2. Provide Train-the-Trainer support.

3. Provide pre-recorded training for on-going VA staff training.

4. Provide training for new and updated software modules as released.

5. Online Help Center with step by step guides and release notes.

6. Live and on-demand training sessions and webinars.

7. Scheduled bi-weekly (every other week) Office hours.

8. Scheduled bi-weekly (every other week) Q&A sessions.

9. Customized customer playbooks and user manuals.

The Contractor shall deliver or provide links to training plans, manuals and other training documentation or training aids. Electronic training tools such as video teleconferencing and computer-based training shall be employed to enhance the effectiveness of training materials and courses. The Contractor shall identify and/or provide any additional training required by end-users, technicians, or any other staff for implementation, maintenance and use of deliverables specified in individual Task Orders.

Deliverable:

A. Training plans, manuals and other training documentation and training aids.

B. Training, and Office Hours and Q&A sessions.

5.6 EDISCOVERY SUPPORT

The Contractor shall provide operations support and systems maintenance support of the application for the life of the task order to include each Option Period as follows:

1. The Contractor shall ensure the application is maintained to the most recent approved COTS baseline.

2. The Contractor shall perform software maintenance activities that may include version and release upgrades, security updates or patches, performance enhancements, data cleansing/archiving, and application modifications. The Contractor shall provide notifications or access to release documentation.

3. The Contractor shall provide proactive operation health monitoring of the application.

The Contractor shall provide either notification or access to information about the application availability.

4. The Contractor shall provide a 24/7 toll-free monitored Help Desk number to provide application support services for users of the application. Any telephone support provided by the Contractor shall be at no additional cost. Unresolved support issues will be elevated to the VA Enterprise Service Desk for submission of a service ticket. The

Contractor shall provide input and technical support to VA help/service desks on all layers until resolution.

5. Have a designated Customer Service Manager (CSM) to perform the following duties:

a. Serve as the primary point of contact for program oversight and coordination

b. Ensure platform adoption and alignment with KPIs

c. Facilitate executive visibility and roadmap discussions

d. Conduct regular business reviews.

e. Weekly status meetings.

f. Performance check-ins every other week.

g. Track operational metrics such as turnaround times, action items, cost control, and usage trends

h. Manage customer enhancement requests and ensure alignment with future product development

i. Rapid escalation processes to engineering and infrastructure teams

j. Produce Root Cause Analysis (RCA) if needed

A. Toll-Free Help Desk Phone Number B. Notifications or access to release documentation.

C. Notification or access to information about the application availability.

D. CSM meetings as noted above in Section 5.6.5

5.7 ASSESSMENT, AUTHORIZATION, AND CONTINUOUS MONITORING

1. The information system solution selected by the Contractor shall comply with the

Federal Information Security Management Act (FISMA).

2. The Contractor shall comply with FedRAMP requirements as mandated by Federal laws and policies, including making available any documentation, physical access, and logical access needed to support this requirement.

3. The Contractor shall, assist with the VA ATO Process to achieve agency authorization of the cloud service or migrated application by providing all required documentation in order to attain a VA ATO.

4. The Contractor shall provide an Incident Response Plan (IRP) scenario within 14 days of award and complete Table-Top exercise within 21 days of award unless current VA IRP can be provided.

5. The Contractor shall provide a System Boundary Diagram that demonstrates implementation and any proposed VA interconnections including required ports and protocols at the time award.

https://gcc01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.fedramp.gov%2Fagency-authorization%2F&data=04%7C01%7C%7C9bef8e8447cf4f0552c008d8ceae86fa%7Ce95f1b23abaf45ee821db7ab251ab3bf%7C0%7C0%7C637486596264469348%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=9HYm8sumkjHmG%2Fyn5Xa6V1aVMKAz0n%2Frnb2yqY2W8wE%3D&reserved=0

6. The Contractor shall complete a FedRAMP System Security Plan (SSP) and supporting documentation at the time of award.

7. The Contractor shall complete a Third-Party Assessment Organization (3PAO) Security Assessment Plan (SAP) at the time of award.

8. The Contractor shall complete a 3PAO Security Assessment Report (SAR) at the time of award.

9. To the extent required to carry out the FedRAMP assessment and authorization process and FedRAMP continuous monitoring, to safeguard against threats and hazards to the security, integrity, and confidentiality of any non-public VA data collected and stored by the Contractor, the Contractor shall provide the VA access to the Contractor’s and Cloud Service Provider’s facilities, installations, technical capabilities, operations, documentation, records, and databases.

10. If new or unanticipated threats or hazards are discovered by either VA or the Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party in accordance with the security addendum B.

11. The Contractor shall not release any data without the written consent of VA. All requests for release must be submitted in writing to the COR/CO.

12. In order for live VA data to be used in this system, a FedRAMP Authorization and VA ATO will be required.

13. Identified gaps between required FedRAMP Security Control Baselines and Continuous Monitoring controls and the contractor’s implementation as documented in the Security Assessment Report shall be tracked by the Contractor for mitigation in a Plan of Action and Milestones (POA&M) document. Depending on the severity of the gaps, VA may require them to be remediated before a provisional or agency authorization is issued.

14. The Contractor shall maintain a security management continuous monitoring environment based upon the latest edition of the VA Cloud Computing Continuous Monitoring Process, FedRAMP Security Controls Baseline and FedRAMP Continuous Monitoring Strategy Plan.

15. The Contractor shall comply with all VA and FedRAMP privacy requirements.

16. VA may choose to cancel the Contract and terminate any outstanding orders if the contractor has its ATO revoked and the deficiencies are greater than VA risk tolerance thresholds.

Contractor shall be paid as follows:

• 30 days after award: Completed FedRAMP System Security Plan (SSP) and supporting documentation (10% of contract value billable after review and acceptance)

• 30 days after award: 3PAO Security Assessment Plan (SAP) (10% of contract value billable after review and acceptance)

• 30 days after award: 3PAO Security Assessment Report (SAR) (10% of contract value billable after review and acceptance)

The remaining 70% will be billable when all ATO work is complete.

A. System Boundary Diagram B. FedRAMP System Security Plan (SSP) and supporting documentation C. 3PAO Security Assessment Plan (SAP) D. 3PAO Security Assessment Report (SAR)

5.8 MIGRATION TASKS

This requirement is not intended to limit competition. The VA remains fully open to considering an alternative “brand name or equal” solution, provided it meets the requirements of the PWS/PD. The awardee must complete the migration to the newly proposed solution within 90 days of contract award. The transition must be executed without degradation to VA’s network infrastructure.

If migration is required, the Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, timeline, and tools to be used in execution of the contract. The CPMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks, and resource support. The CPMP shall also include how the Contractor shall coordinate and execute the migration. The Contractor shall update and maintain the VA PM approved CPMP throughout the PoP.

The contractor shall be responsible for planning, executing, and validating the end-to-end data migration from legacy systems to the target platform, ensuring data integrity, security, and minimal business disruption throughout the process. This includes developing a detailed migration strategy and schedule; performing data profiling, cleansing, and transformation; and defining, testing, and implementing migration scripts or tools in alignment with the organization’s data governance and security policies. The contractor must verify completeness and accuracy of migrated data through reconciliation and user acceptance testing, provide clear documentation of mappings and procedures, and coordinate closely with stakeholders to address defects or discrepancies identified during testing. Additionally, the contractor shall provide knowledge transfer and support during cutover and post-migration stabilization to ensure continuity of operations and effective use of the migrated data.

5.9 OPTIONAL TASKS

5.9.1 OUTGOING TRANSITION SUPPORT (OPTIONAL TASK 1)

If outgoing migration is required, the Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, timeline, and tools to be used in execution of the contract. The CPMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks, and resource support. The CPMP shall also include how the Contractor shall coordinate and execute the migration. The Contractor shall update and maintain the VA PM approved CPMP throughout the PoP.

The contractor shall be responsible for planning, executing, and validating the end-to-end data migration from legacy systems to the target platform, ensuring data integrity, security, and minimal business disruption throughout the process. This includes developing a detailed migration strategy and schedule; performing data profiling, cleansing, and transformation; and defining, testing, and implementing migration scripts or tools in alignment with the organization’s data governance and security policies. The data must be converted into a format that target system can ingest. The contractor must verify completeness and accuracy of migrated data through reconciliation and user acceptance testing, provide clear documentation of mappings and procedures, and coordinate closely with stakeholders to address defects or discrepancies identified during testing. Additionally, the contractor shall provide knowledge transfer and support during cutover and post-migration stabilization to ensure continuity of operations and effective use of the migrated data.

If the Optional Task is exercised by VA,…