PWS - ELMS Transition and IV-V DRAFT.pdf

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Human Capital Services Center (HCSC) Talent Development Solutions (TDS) Directorate

VA Enterprise Learning Management Solution (VA ELMS) Transition

Support/Independent Verification and Validation (IV&V)

Date: July 10, 2024

<VA-24-00097954>

PWS Version Number: 1.4

Enterprise Learning Management Solution (ELMS) Independent Verification and Validation (IV&V) and Transition Support

Contents

1.0 BACKGROUND

2.0 APPLICABLE DOCUMENTS

3.0 SCOPE OF WORK

4.0 PERFORMANCE DETAILS

4.1 PERFORMANCE PERIOD

4.2 PLACE OF PERFORMANCE

4.3 TRAVEL

5.0 SPECIFIC TASKS AND DELIVERABLES

5.1 PROJECT MANAGEMENT

5.1.1 CONTRACTOR PROJECT MANAGEMENT PLAN

5.1.2 REPORTING REQUIREMENTS

5.1.3 MEETINGS

5.1.4 ONBOARDING

5.1.5 Privacy Training

5.2 ELMS IV&V SERVICES AND STANDARDS

5.2.1 IV&V PLAN

5.2.2 IMPLEMENTATION PHASES INDEPENDENT TEST AND EVALUATION

5.2.3 OPERATIONS AND MAINTENANCE (O&M) INDEPENDENT TEST AND

EVALUATION

5.3 ELMS SUPPORT SERVICES

5.3.1 DEVELOP AND MAINTAIN REQUIREMENTS TRACEABILITY MATRIX

(RTM) 36

5.3.2 CONDUCT GAP ANALYSES

5.4 STATISTICAL ANALYSIS AND DOCUMENTATION

5.5 DATA QUALITY AUDIT

5.5.1 DATA QUALITY ISSUE RESOLUTION SUPPORT

5.6 OPTIONAL TASK 1 - DOMAIN MANAGEMENT SUPPORT

5.7 KEY PERSONNEL

6.0 GENERAL REQUIREMENTS

6.1 ENTERPRISE AND IT FRAMEWORK

6.2 SECURITY AND PRIVACY REQUIREMENTS

6.3 METHOD AND DISTRIBUTION OF DELIVERABLES

6.4 PERFORMANCE METRICS

6.5 FACILITY/RESOURCE PROVISIONS

6.6 GOVERNMENT FURNISHED PROPERTY

6.7 SHIPMENT OF HARDWARE OR EQUIPMENT

7.0 TASK ORDER QUALITY ASSURANCE SURVEILLANCE PLAN (QASP)

7.1 Methods of Surveillance

7.2 Frequency of Measurement

7.3 Acceptable Performance Levels (APLs)

7.4 DOCUMENTING PERFORMANCE

ADDENDUM A – ADDITIONAL VA REQUIREMENTS, CONSOLIDATED

ADDENDUM B – VA INFORMATION AND INFORMATION SYSTEM SECURITY AND

PRIVACY LANGUAGE

1.0 BACKGROUND

The Department of Veterans Affairs (VA), Human Capital Services Center (HCSC) strives to provide high quality customer service experience and engage VA employees with products and services that will enable them to become role models in serving Veterans and their families. The HCSC believes engaged and developed VA employees will change the lives of Veterans and their families for the better. To deliver on this mission, HCSC strives to provide high-quality, effective, and efficient Information Technology (IT) services to those responsible for providing care to Veterans at the point-of-care as well as throughout all the points of Veterans’ health care, benefits delivery, and memorial services in an effective, timely, and compassionate manner. The VA depends on Information Management/Information Technology systems to meet mission goals.

As embodied in the “Department of Veterans Affairs Fiscal Years 2022-2028 Strategic Plan” at Section 4.4.2:

VA as a learning organization reflects a dynamic cycle of information sharing, accessibility, feedback, and improvement. It requires VA to commit to high-value employee professional development and establishing and sharing best practices so that the entire Department - and therefore all Veterans and other beneficiaries whom we serve - benefit. Employees are the focus of the learning organization, without whom VA services cannot be provided. This message is captured by the VA Chief Learning Officer’s vision that ‘engaged and developed VA employees will change the lives of Veterans and their families for the better. VA encourages and supports continuous learning and fosters a leadership-instilled culture of learning, where leadership actionably demonstrates their commitment to employees’ professional development.

The HCSC is a catalyst for Department-wide learning initiatives and strategies that develop and sustain a high-performing workforce. As a result of the VA’s large and diverse user population, HCSC’s vision must be aligned to support and meet the VA’s mission, namely, to be recognized as a public sector leader in employee continuous learning within the Federal Government. In order to meet the VA’s strategic and operational goals and objectives, HCSC is in the process of implementing The VA Enterprise Learning Management Solution (VA ELMS) as our new enterprise learning management solution.

VA ELMS is a Commercial off the Shelf (COTS) solution delivered as Software as a Service (SaaS) in a cloud hosting environment. It is Federal Risk and Authorization Management Program (FedRAMP) certified at the moderate level for both the environment and the solution. As part of the overall solution, software, hardware, database, hosting, licensing, and services are available to support enterprise-wide VA talent development and learning management activities. It includes a comprehensive, modernized, and intuitive set of tools to support employees and other workforce members in their individual development planning, succession management, career development, competency assessment, skills acquisition, and training goals. VA ELMS integrates with other VA human capital management and business solutions and serves as an authoritative data source to facilitate data management and data sharing across the Department.

VA ELMS provides licensed account access to all VA employees and additional support staff to include but are not limited to contractors, volunteers, clinical trainees, residents, interns and fellows, private sector individuals working with VA, individuals without compensation, individuals from other Federal government agencies, and individuals on extended leave without pay.

The VA ELMS deployment schedule is organized into a series of rollouts known as implementation phases. During the first two years of the contract, the vendor will work with HCSC to design the solution, configure capabilities, and plan for and migrate existing data from TMS 2.0 to VA ELMS. The first implementation phase is scheduled during the first option period of the contract and will encompass multiple pilot site(s).

The VA Chief Learning Officer and Executive Director of HCSC is the Executive Sponsor for the VA ELMS IV&V/Transition Support contract. The IV&V Plan developed via this contract will define the planned and recommended IV&V activities to support the VA ELMS program. Throughout the VA ELMS solution design and implementation, the IV&V Plan will be reviewed and revised based on the ongoing planning, development, and delivery of other program deliverables. The IV&V Plan is a living document, periodically being revised as knowledge accumulates about the characteristics of the system, the software, and the problem areas in the solution.

2.0 APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. 44 U.S.C. § 3541-3549, “Federal Information Security Management Act (FISMA) of 2002”

2. “Federal Information Security Modernization Act of 2014”

3. Federal Information Processing Standards (FIPS) Publication 140-2, “Security Requirements for Cryptographic Modules”

4. FIPS Pub 199. “Standards for Security Categorization of Federal Information and Information Systems,” February 2004

5. FIPS Pub 200, “Minimum Security Requirements for Federal Information and

Information Systems,” March 2006

6. FIPS Pub 201-2, “Personal Identity Verification of Federal Employees and

Contractors,” August 2013

7. 10 U.S.C. § 2224, "Defense Information Assurance Program"

8. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

9. Public Law 109-461, Veterans Benefits, Health Care, and Information

Technology Act of 2006, Title IX, Information Security Matters

10. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”

11. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, https://www.va.gov/vapubs/index.cfm

12. VA Handbook 0710, “Personnel Security and Suitability Program,” May 2, 2016, https://www.va.gov/vapubs/index.cfm

13. VA Directive and Handbook 6102, “Internet/Intranet Services,” August 5,

14. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and Guidelines,” January 18, 2017

15. Office of Management and Budget (OMB) Circular A-130, “Managing Federal

Information as a Strategic Resource,” July 28, 2016

16. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed

Services (CHAMPUS)”

17. NIST SP 800-66 Rev. 1, “An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule,” October 2008

18. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended, January 18, 2017

19. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

20. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021

21. VA Handbook 6500, “Risk Management Framework for VA Information

Systems VA Information Security Program,” February 24, 2021

22. VA Handbook 6500.2, “Management of Breaches Involving Sensitive

Personal Information (SPI),” March 12, 2019

23. VA Handbook 6500.5, “Incorporating Security and Privacy into the System

Development Lifecycle,” March 22, 2010

24. VA Handbook 6500.6, “Contract Security,” March 12, 2010 (Appendix C updated April 22, 2024, VA Notice 24-12)

25. VA Handbook 6500.8, “Information System Contingency Planning,” April 6,

26. VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018

27. VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017

28. OIT Process Asset Library (PAL), https://www.va.gov/process/ . Reference

Process Maps at https://www.va.gov/process/maps.asp and Artifact templates at https://www.va.gov/process/artifacts.asp

29. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

30. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014

31. VA Handbook 6508.1, “Procedures for Privacy Threshold Analysis and Privacy Impact Assessment,” July 30, 2015

32. VA Handbook 6510, “VA Identity and Access Management,” January 15, https://www.va.gov/vapubs/index.cfm https://www.va.gov/vapubs/index.cfm http://www.va.gov/vapubs http://www.va.gov/vapubs https://www.va.gov/process/ https://www.va.gov/process/maps.asp https://www.va.gov/process/artifacts.asp https://www.va.gov/trm/TRMHomePage.aspx

33. VA Directive and Handbook 6513, “Secure External Connections,” October 12, 2017

34. VA Directive 6300, “Records and Information Management,” September 21,

35. VA Handbook, 6300.1, “Records Management Procedures,“ March 24, 2010

36. NIST SP 800-37 Rev 2, “Risk Management Framework for Information

Systems and Organizations: A System Life Cycle Approach for Security and Privacy,” December 2018

37. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020)

38. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol version 6”, November 2020.

39. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015

40. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-

12) Program,” March 24, 2014

41. OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005

42. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019

43. OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008

44. Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance, December 2, 2011, (NOTE: Part A of the FICAM Roadmap and Implementation Guidance, v2.0, was replaced in 2015 with an updated Architecture (https://arch.idmanagement.gov/#what-is-the-ficam-architecture)

45. NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access,“ June 2018

46. OMB Memorandum M-17-12, “Preparing for and Responding to a Breach of Personally Identifiable Information”, January 3, 2017

47. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, “Digital Identity Guidelines,” updated March 02, 2020

48. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014

49. NIST SP 800-164, “Guidelines on Hardware-Rooted Security in Mobile

Devices (Draft),” October 2012

50. Draft National Institute of Standards and Technology Interagency Report

(NISTIR) 7981, “Mobile, PIV, and Authentication,” March 2014

51. VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland

Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

52. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514) https://arch.idmanagement.gov/#what-is-the-ficam-architecture https://arch.idmanagement.gov/#what-is-the-ficam-architecture https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514 https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514

53. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

54. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

55. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019

56. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008

57. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (Public Law 110–140), December 19, 2007

58. Section 104 of the Energy Policy Act of 2005, (Public Law 109–58), August 8, 2005

59. Executive Order 13834, “Efficient Federal Operations,” dated May 17, 2018

60. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August

2, 2001

61. VA Directive 0058, “VA Green Purchasing Program,” July 19, 2013

62. VA Handbook 0058, “VA Green Purchasing Program,” July 19, 2013

63. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote

Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

64. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

65. “Veteran Focused Integration Process (VIP) Guide 4.0,” March 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

66. VA Memorandum “Proper Use of Email and Other Messaging Services,”

January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

67. “DevSecOps Product Line Management Playbook” version 2.0, May 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

68. NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020

69. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol

Version 6 (IPv6),” November 19, 2020

70. Social Security Number (SSN) Fraud Prevention Act of 2017

71. Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23,

72. NIST Special Publication 800-60 Vol 1, Guide for Mapping Types of

Information and Information Systems to Security Categories.

https://csrc.nist.gov/publications/detail/sp/800-60/vol-1-rev-1/final

73. VA Strategic Plan “Department of Veteran Affairs Fiscal Years 2022-28 Strategic Plan”, March 29, 2022 https://www.va.gov/performance/index.asp#one

74. Web Content Accessibility Guidelines (WCAG) 2.0 level AA.

https://www.w3.org/TR/WCAG20/

75. VA Directive 6517, Risk Management Framework for Cloud Computing Services, November 15, 2016 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896 https://www.cisa.gov/publication/tic-30-core-guidance-documents https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371 https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946 https://csrc.nist.gov/publications/detail/sp/800-60/vol-1-rev-1/final https://www.va.gov/performance/index.asp#one https://www.w3.org/TR/WCAG20/

76. VA Handbook 6517, Risk Management Framework for Cloud Computing Services, November 15, 2016

77. Code of Federal Regulation (CFR) Title 5 Chapter I, Subchapter B, Part 410- Training https://www.ecfr.gov/current/title-5/chapter-I/subchapter-B/part-410

78. High Level ELMS Delivery Schedule

79. ISO/IEC/IEEE 29119 Software Testing

80. IEEE Std. 12207:2017

81. IEEE Std. 1012-2016: System, Software, and Hardware Verification and

Validation

82. IEEE Std. 730-2014: Software Quality Assurance Processes

3.0 SCOPE OF WORK

The Contractor shall provide project management, ELMS IV&V services, ELMS support services, statistical analysis and documentation, and data quality audits.

The Contractor shall perform IV&V and Transition Support services in support of Human Capital Services Center (HCSC) Talent Development Solutions (TDS) directorate efforts to implement and maintain the VA ELMS solution in accordance with the tasks under this PWS. The Contractor shall deliver an IV&V plan based on the PWS requirements.

The VA ELMS IV&V Plan should be treated as a living document, periodically being revised by the Government as knowledge accumulates about the characteristics of the solution, the software, and the problem areas in the solution or the lifecycle methodology adopted by the VA ELMS solution.

Transition Support shall support TDS directorate’s efforts to deploy and maintain ELMS through multiple upgrades and capability updates. These activities include planning, requirements management, solution configuration, solution testing, and learning management. The tasks/requirements have been authored to secure the support necessary to support the solution today and to ensure any efforts to introduce new capabilities are successful. The Contractor shall support this initiative with individuals possessing the necessary technical acumen, analytical clarity, and professional experience sufficient to ensure success of the effort. Focus for this effort shall include but not limited to the following:

1. Training Materials

2. Training Delivery

3. Development and maintenance of a complete toolkit of procedures, guides, and artifacts in support of the VA team deploying ELMS upgrade; and

4. Support of VA stakeholders and ELMS solution administrators.

The Contractor’s IV&V team and TDS will work collaboratively and be collectively known as the ELMS IV&V Team.

https://www.ecfr.gov/current/title-5/chapter-I/subchapter-B/part-410

In addition, if the optional task is exercised, the Contractor shall provide support for Domain Management.

4.0 PERFORMANCE DETAILS

The Contractor shall work with the Government’s team on coordination and scheduling of IV&V and transition support tasks within this PWS. The Government’s team is TDS, under the HCSC. The System Team under TDS has overall responsibility for IV&V and support services on the ELMS solution. Contractor and Government’s team collaboration will include the use of VA’s Microsoft Teams application.

4.1 PERFORMANCE PERIOD

The period of performance (PoP) shall be a twelve (12)-month Base Period, with four (4), twelve (12)-month Option Periods and one optional task to be exercised at the

Government’s discretion. In no instance shall the cumulative PoP, to include any

Option Periods exercised, exceed sixty (60) months.

Any work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO). (If required, the CO may designate the

Contractor to work during holidays and weekends.)

There are eleven (11) Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, five (5) are set by date:

New Year's Day January 1 Juneteenth June 19 Independence Day July 4 Veterans Day November 11 Christmas Day December 25

If any of the above falls on a Saturday, then Friday shall be observed as a holiday.

Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six (6) are set by a day of the week and month:

Martin Luther King's Birthday Third Monday in January Washington's Birthday Third Monday in February Memorial Day Last Monday in May Labor Day First Monday in September Columbus Day Second Monday in October Thanksgiving Fourth Thursday in November

4.2 PLACE OF PERFORMANCE

Work required in accordance with this PWS shall be performed primarily at Contractor facilities. The Contractor shall identify the Contractor’s place of performance in its proposal submission. The Contractor shall be required to be present on the Government site for meetings and other face-to-face customer engagements as detailed in Section 4.3.

4.3 TRAVEL

The Government anticipates travel to perform certain tasks associated with the effort, as well as to attend program-related meetings or conferences throughout the PoP.

Contractors may be required to perform additional site-visits (i.e., Continental United States (CONUS), only) to government facilities to conduct user and stakeholder engagement and training.

The total estimated number of trips in support of the program-related meetings or conferences for this effort is six (6) travel sessions per year. The government expect no more than four (4) Contractor per trip. Anticipated locations include but are not limited to the following, each estimated at five (5) days per trip.

1. Washington, D.C.

2. Seattle, WA

3. San Francisco, CA

4. Chicago, IL

All travel must be in accordance with the Federal Travel Regulations (FTR) and requires advanced written approval (e.g., email) by the Contracting Officer’s Representative (COR). Contractor travel within the local commuting area will not be reimbursed.

5.0 SPECIFIC TASKS AND DELIVERABLES

The Contractor shall perform each of the Government’s requirements established in Section 5.0 and each of its sub-sections and ensure that all deliverables are submitted in accordance with the Performance Work Statement (PWS).

5.1 PROJECT MANAGEMENT

5.1.1 CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, timeline and tools to be used in execution of this PWS.

The CPMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks and resource support. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPMP shall be concurred upon and updated in accordance with Section B of any resulting contract.

The Contractor shall update and maintain the VA Program Manager (PM) approved CPMP throughout the PoP.

The Contractor shall work with the Government’s team on the coordination and scheduling of IV&V and Transition Support tasks.

The Contractor shall include in the CPMP, sections or separate plans for:

• Scope Statement

• Schedule Baseline

• Schedule Management

• Work Breakdown Structure

• Quality Management

• Logistical Support

• Communications Management

• Personnel Management

• Milestones

• Risk Register

The initial baseline CPMP shall be concurred upon by the COR within seven (7) business days of delivery from the Contractor or rejected for deficiencies. The Contractor shall update and maintain the COR-approved CPMP throughout the period of performance. The CPMP is an evolutionary document that shall be updated monthly and identify tasks and deliverables to be completed by the Contractor, as specified in this PWS. For purposes of the requirements established herein, the term “monthly” shall mean once (1) a month unless otherwise identified. The Contractor shall clearly identify the CPMP updates made in each monthly submission and receive concurrence from the COR within five (5) business days or rejected for deficiencies.

The Contractor shall develop and maintain an Integrated Master Schedule and Work Breakdown Structure (IMS/WBS), encompassing all Government and Contractor IV&V and Transition Support activities including deliverables, and shall coordinate with the Government to receive input and approval. The Contractor shall define all individual activities, regardless of how minimal the hours are for the individual activity and include them in the project schedule. The Contractor shall assign the Contractor staff to the appropriate activities in the schedule as they pertain to the activities described in Section 5.0 and subsections of the PWS and the schedule of deliverables. The Contractor shall provide the actual percent complete for all activities described in Section 5.0 of the PWS and the schedule of deliverables in the schedule on a weekly basis. Both Government and contractor work will be entered and managed in the VA ELMS JIRA tool utilizing System Team JIRA procedures and processes. The IMS/WBS shall be developed in Microsoft Project 2016 or other agreed upon tool. The IMS/WBS shall include an implementation schedule inclusive of:

• Milestones

• Status tracking

• Duration for each task

• Including Identification of all project Stakeholders (internal and external)

• Gap analysis and risk identification/mitigation strategy for impacted Stakeholders

• Responsible, Accountable, Consulted, Informed (RACI) chart

• Defined roles and responsibilities for the Implementation Team, including milestone approvals required from VA governing bodies

• System Design Document (SDD), a design strategy

• Documentation for system integration with internal (VA)/external organizations, as well as application interdependencies (both internal and external)

• Agile design review/acceptance procedures

• User Acceptance Testing (UAT) support

• Privacy and Personnel Security management (site security, data privacy/security)

• Performance monitoring and defect tracking, performance monitoring management, resolution and Veteran-Focused Integration Process (VIP) processes.

The Contractor Program Manager (PrgM) shall develop, maintain, and review the

IMS/WBS on a weekly basis with the Government in order to: review and identify issues, risks, impediments, upcoming milestones, as well as the status of key performance indicators to be determined at the Kick-Off meeting. The Contractor shall develop a dynamic dashboard, driven by the IMS/WBS, that includes real-time updates available for

Government review.

The Contractor PrgM shall maintain a core capabilities Decision Log and ensure the VA

COR has concurred with changes (e.g., updates to data fields, changes to analytic reports, changes in views).

Deliverable:

Required throughout contract lifecycle:

A. Contractor Project Management Plan (CPMP) due thirty (30) DAC award and updated monthly thereafter.

B. Integrated Master Schedule and Work Breakdown Structure due seven (7) DAC award and updated weekly thereafter.

C. Decision log due sixty (60) DAC award and updated seven (7) days after any change

5.1.2 REPORTING REQUIREMENTS

The Contractor shall provide the COR with Weekly Progress Reports in electronic form in Microsoft Word and Project formats. The report shall include detailed instructions/explanations for each required data element, to ensure that data is accurate and consistent. These reports shall reflect data as of the last day of the preceding week.

The Weekly Progress Reports shall cover all work completed during the reporting period and work planned for the subsequent reporting period. The report shall also identify any problems that arose and a description of how the problems were resolved. If problems have not been completely resolved, the Contractor shall provide an explanation including their plan and timeframe for resolving the issue. The report shall also include an itemized list of all Information and Communication Technology (ICT) deliverables and their current Section 508 conformance status. The Contractor shall monitor performance against the CPMP and report any deviations. It is expected that the Contractor will keep in communication with VA accordingly so that issues that arise are transparent to both parties to prevent escalation of outstanding issues.

The Contactor shall also provide a weekly status meeting (virtual or other) to discuss the status of the project (work in-progress, completed and planned) including any VA PM/COR or Contractor concerns or project issues.

The Contractor shall deliver a Monthly Status Report (MSR) every month that details the status of key performance indicators for each phase of work, milestones met during the reporting periods, risk tracking, and impediment tracking. The MSR shall include:

a) Project name and contract name

b) Overview and description of the contract

c) Overall high-level assessment of contract progress

d) All work-in-progress and completed during the reporting period

e) Identification of any contract related issues uncovered during the reporting period and especially highlight those areas with a high probability of impacting schedule, cost, or performance goals and their likely impact on schedule, cost, or performance goals and their likely impact on schedule, cost, or performance goals

f) Explanations for any unresolved issues, including possible solutions and any actions required of the Government and/or Contractor to resolve or mitigate any identified issue, including a plan and timeframe for resolution

g) Status on previously identified issues, actions taken to mitigate the situation, and/or progress made in rectifying the situation

h) Work planned for the subsequent two (2) reporting periods, when applicable

i) Current contract schedule overlaid on original contract schedule showing any delays or advancement in schedule

j) Original schedule of deliverables and the corresponding deliverables made during the current reporting period

k) Reportable Government Furnished Equipment (GFE)

l) Workforce staffing data showing all Contractor personnel performing on the effort during the current reporting period. After the initial labor baseline is provided, each MSR shall identify the full team engaged in the contract including any changes in staffing, identifying each person who was added to the contract or removed from the contract, along with their status on VA mandatory Privacy and Information Security Awareness training. The status shall include their initial training completion date, their next training due date, and their current status (compliant or not). Contractor team members that do not remain compliant with this mandatory training will have their administrator privileges revoked and administrator profiles locked until they become compliant, rendering them incapable of supporting VA through the application.

These reports shall not be the only means of communication between the Contractor and VA PM/COR to advise of performance/schedule issues and to develop strategies for addressing the issues. The Contractor shall continuously monitor performance and report any deviation from the CPMP or previous Monthly Status Report to the VA PM/COR during routine regular communications.

Deliverable:

Base year

A. Weekly Progress Report Due COB (close of business) ET on the last business day of the week).

B. Monthly Status Report Option Period 1

A. Weekly Progress Report Due COB (close of business) ET on the last business day of the week).

B. Monthly Status Report

Option Period 2

A. Weekly Progress Report Due COB (close of business) ET on the last business day of the week).

B. Monthly Status Report

Option Period 3

A. Weekly Progress Report Due COB (close of business) ET on the last business day of the week).

B. Monthly Status Report

Option Period 4

A. Weekly Progress Report Due COB (close of business) ET on the last business day of the week).

B. Monthly Status Report

5.1.3 MEETINGS

5.1.3.1 TECHNICAL KICKOFF MEETING

A technical kickoff meeting shall be held within 10 days after contract award. The Contractor shall coordinate the date, time, and location (can be virtual) with the Contracting Officer (CO), and the Contracting Officer Representative (COR), in conjunction with the VA PM. The Contractor shall provide a draft agenda to the CO and VA PM five (5) calendar days prior to the meeting. Upon Government approval of a final agenda, the Contractor shall distribute to all meeting attendees. During the kickoff-meeting, the Contractor shall present, for review and approval by the Government, the details of the intended approach, work plan, and project schedule for each effort via a Microsoft Office or PowerPoint presentation. At the conclusion of the meeting, the Contractor shall update the presentation with a final slide entitled “Summary Technical Kickoff Report” which shall include notes on any major issues, agreements, or disagreements discussed during the kickoff meeting. The Presentation, shall include:

1. Points of contact (POC) – include all stakeholders and the Contractor’s team members anticipated to be involved as well as the roles and responsibilities of all Contractor support personnel. List of POCs shall include resumes for key personnel for initial approval.

2. Overview of the draft IV&V Plan based on provided ELMS Delivery Schedule

3. A high-level schedule

4. Draft Support Plan

5. Overview of the draft Contractor Project Management Plan (CPMP)

The Contractor shall submit the final updated presentation to the VA PMs/COR for review and acceptance within three (3) calendar days after the meeting. The Contractor shall obtain concurrence from the COR on the content of the meeting minutes prior to distribution of the document.

Deliverables:

A. Kick-Off Meeting Agenda and Materials (PowerPoint or similar presentation) due five (5) business days before the meeting.

B. Technical Kickoff Meeting Minutes due two (2) business days after the meeting.

C. Key Personnel resumes

5.1.3.2 MEETING SUPPORT

The Contractor shall support VA ELMS meetings by attending, providing input during, documenting notes (including action items) from, and distributing those notes within 24 hours for the following meetings:

Base Year

C. Daily ELMS technical calls D. Weekly VA ELMS Status call (Due COB (close of business) ET on the last business day of the week).

Option Period 1

A. Daily ELMS technical calls B. Weekly VA ELMS Status call (Due COB (close of business) ET on the last

C. Bi-weekly Pilot Community of Practice Call

Option Period 2

B. Weekly VA ELMS Status call (Due COB (close of business) ET on the last

C. Bi-weekly Pilot Community of Practice Call

Option Period 3

B. Weekly VA ELMS Status call (Due COB (close of business) ET on the last

C. Bi-weekly Enterprise Transition Community of Practice call

Option Period 4

B. Weekly VA ELMS Status call (Due COB (close of business) ET on the last

C. Bi-weekly Sustainment Community of Practice call

5.1.4 ONBOARDING

The Contractor shall manage the onboarding of its staff and coordinate with the COR.

Onboarding includes steps to obtain a VA network and email account, complete training, initiate background investigations, and gain physical and logical access, which may include elevated privileges to the necessary development and test environments for the various system to be enhanced.

The Contractor shall track the onboarding status of all Contractor personnel and be responsible for accurate and timely submission of all required VA onboarding paperwork to the COR. The Contractor shall be responsible for tracking the status of all their staff’s onboarding activities and report the status at the staff level during onboarding status meetings. The Contractor shall provide the Onboarding Status Report, for any staff with outstanding onboarding requests for review by the VA PM/COR, with the Monthly Status Report.

Base Period

A. Onboarding Status Report due monthly.

Option Period 1

A. Onboarding Status Report due monthly.

Option Period 2

A. Onboarding Status Report due monthly.

Option Period 3

A. Onboarding Status Report due monthly.

A. Onboarding Status Report due monthly.

5.1.5 Privacy Training

The Contractor shall submit status of VA Privacy and Information Security Awareness Training and Signed Rules of Behavior for all Contractor employees engaged in the work to be performed under this effort. The status reporting shall identify; a single Contractor Security POC, the names of all personnel engaged on the task, their initial training date for VA Privacy and Information Security training, and their next required training date. The report shall also contain the status of Contractor employee with respect to gaining VA network access and PIV badge attainment as required, to include identifying the Contractor employees to whom this requirement applies, the date of request completion, the date of task completion, and the date of next action required.

This information shall be included as part of the Monthly Status Report referred to in section 5.1.2.

The Contractor shall submit VA Privacy and Information Security Awareness Training and Signed Rules of Behavior certificates in accordance with Section 4, Training, from Appendix C (updated April 22, 2024) of the VA Handbook 6500.6, “Contract Security”.

Deliverable:

Base Period A.TMS Training Certificates of Completion for VA Privacy and Information Security Awareness Training B.VA Privacy and Information Security Awareness Signed Rules of Behavior

Option Period 1

A.TMS Training Certificates of Completion for VA Privacy and Information Security Awareness Training

B.VA Privacy and Information Security Awareness Signed Rules of Behavior

A.TMS Training Certificates of Completion for VA Privacy and Information Security Awareness Training

B.VA Privacy and Information Security Awareness Signed Rules of Behavior

Option Period 3

A.TMS Training Certificates of Completion for VA Privacy and Information Security Awareness Training

B.VA Privacy and Information Security Awareness Signed Rules of Behavior

Option Period 4

A.TMS Training Certificates of Completion for VA Privacy and Information Security Awareness Training

B.VA Privacy and Information Security Awareness Signed Rules of Behavior

5.2 ELMS IV&V SERVICES AND STANDARDS

IV&V is an extension of program management and system engineering that employs a rigorous methodology to identify objective data and conclusions to provide feedback about quality, performance, and schedule to stakeholders. IV&V is performed in parallel with all life cycle stages, not at their conclusion. In the context of the IV&V Plan, the term “life cycle” is used in reference to the evolution of the solution, product, service, project or other human-made entity from conception through retirement (IEEE Std.

12207:2017).

The IV&V Plan, referenced in section 5.2.1, shall be developed by the Contractor based on, but not limited to, IEEE Standards to encompass the full breath of IV&V activities potentially performed for the program. The selection and execution of the IV&V tasks in this effort is expected to be applied based on program risk and the program schedule.

The IV&V PWS tasks execution may need to be tailored to the program execution methodology, the program deliverables, or the program implementation approach. The Contractor shall utilize its understanding of the barriers, challenges and risks related to large scale enterprise implementations of Learning Management applications.

The IV&V plan is intended to be a comprehensive integrated IV&V plan tailored to meet the needs of the VA ELMS solution and to comply with the IV&V requirements defined in IEEE Standard 1012. While tailored to include areas beyond systems engineering, such as, organizational change management, it shall be based on industry best practice guidance, including Project Management Institute (PMI), Guide to the Project Management Body of Knowledge (PMBOK) and Capability Maturity Model Integration (CMMI), and shall be developed in accordance with the following Institute of Electrical and Electronics Engineers (IEEE) Standards:

• IEEE Std. 1012-2016: System, Software, and Hardware Verification and Validation

• IEEE Std. 730-2014: Software Quality Assurance Processes

IEEE Standard 1012 applies to systems, software, and hardware being developed, maintained, or reused (legacy, commercial off-the-shelf (COTS), non-developmental items). The IEEE Standard does not assign the responsibility for performing the verification and validation tasks to any specific organization. The analysis, evaluation, and test activities may be performed by multiple organizations; however, the methods and purpose will differ for each organization’s functional objectives. This plan is intended to establish the framework for on-going integrated planning efforts and refinement of the IV&V approach.

IV&V provides an independent, objective assessment regarding the quality of program management and systems engineering products and processes.

Verification: Confirmation by examination and provisions of objective evidence that specified requirements have been fulfilled.

Validation: Confirmation by examination and provisions of objective evidence that the requirements for a specific intended use are fulfilled.

IV&V utilizes a variety of IV&V methods in the planning and execution of IV&V activities.

The IV&V techniques and methods that shall be included in the ELMS IV&V Plan are:

• Independent Testing

• Product/Technical reviews

• Evaluation review

• Inspection

• Walkthrough

• Interviews and Observation

The IV&V function is to provide recommendations for process or document improvements, including suggestions for increased efficiency and effectiveness. The IV&V function will provide comprehensive deliverables including various analysis and assessment reports.

For all tasks within section 5.2 of this PWS, the Contractor shall track all IV&V findings and recommendations, defects, risks, issues, and lessons learned to closure. This shall be reported as part of the IV&V Plan.

5.2.1 IV&V PLAN

The Contractor shall develop an ELMS IV&V Plan based on, but not limited to, Institute of Electrical and Electronics Engineers (IEEE) Standards to encompass the full breadth of IV&V activities potentially performed for the program. The selection and execution of the IV&V tasks in this effort is expected to be applied based on program risk and the program schedule. The Government, at its discretion, may define a sub-set of IV&V activities contained within the overall ELMS IV&V Plan for execution within an VA ELMS IV&V Execution Plan based on program priorities.

Deliverable (required each contract period if exercised):

Base Period:

A. IV&V PLAN due thirty (30) DAC award and updated monthly thereafter.

Option Period 1:

A. IV&V PLAN due thirty (30) days after option period award and updated monthly thereafter.

Option Period 2:

A. IV&V PLAN due thirty (30) days after option period award and updated monthly thereafter.

Option Period 3:

A. IV&V PLAN due thirty (30) days after option period award and updated monthly thereafter.

Option Period 4:

A. IV&V PLAN due thirty (30) days after option period award and updated monthly thereafter.

5.2.2 IMPLEMENTATION PHASES INDEPENDENT TEST AND EVALUATION

The VA ELMS Implementation Phases include the approved VA Business Processes based on approved requirements and associated interfaces for a given phase. Each VA ELMS Implementation phase builds on the approved VA enterprise configuration and may incorporate additional requirements, business processes and interfaces as needed.

The scope of the system under test may include components, configurations, workflows, reports, transactions, interfaces, and Application Programming Interfaces (API)s.

All IV&V independent test and evaluation activities shall be aligned with VA ELMS Implementation Phase iterative development and configuration releases. IV&V independent test and evaluation activities for O&M, out-of-cycle releases and emergency releases are addressed in PWS Section 5.2.3.

An objective of the IV&V test approach is to select the verification and validation analysis and testing technique to most effectively detect the system and software problems. IV&V activities may focus on different levels and types of testing to include but not be limited to: Component, Integration, System, User Acceptance, Performance, Data Migration, Hosting, Software Maintenance, Implementation, Smoke, Regression, Security, and Section 508.

The IV&V Plan System and Software test approach section shall incorporate IEEE Standard 1012 software IV&V activities related to software testing. System and software test plan and execution IV&V tasks include the following activities: the review and verification of test plans, user stories, design, configuration, test scripts, test execution, defect disposition, and interfacing data files. Selected system and software activities from the IV&V Plan shall be incorporated into the VA ELMS IV&V requirements within the sub-sections of 5.2.2 of this PWS.

5.2.2.1 SYSTEM INTEGRATOR TEST PLAN AND EXECUTION

ASSESSMENT

The Contractor shall include the review test plans, test scripts, test procedures, test design and analyze test execution, test results and defects for all levels of testing being verified and validated and include in IV&V Test Plan and Execution Assessment for system integrator executed test events, such as, Integrated System Testing (IST). All test plans and test plan elements (test script, test data, and test execution) are verified by IV&V to confirm each conforms to project defined purpose, format, content included in the test plan and compared against ISO/IEC/IEEE 29119 for Software and System Test documentation best practice. The VA PM and Alternate PMs, in collaboration with the Contractor, will determine the specific ELMS test events to be reviewed.

When specified by the Government, the Contractor shall support IV&V assessments by participating in and witnessing applicable Government or Contractor testing of ELMS system and software, including implementation and integration with VA networks and systems to the extent necessary to efficiently fulfill the requirements of the VA as set forth in this PWS.

In coordination with the COR, and in conjunction with the PM, the Contractor shall engage with business and technical stakeholders as needed to fulfill the requirements of this PWS.

Deliverable (required each contract period if exercised):

Base Period:

A. IV&V Test Plan due five (5) days prior to each test event (quarterly events are planned)

B. Execution Assessment Report due five (5) days after each test event (quarterly events are planned)

Option Period 1:

A. IV&V Test Plan due five (5) days prior to each test event (quarterly events are planned)

Option Period 2:

planned)

Option Period 3:

planned)

Option Period 4:

planned)

5.2.2.2 PRODUCT REVIEWS

The Contractor shall perform IV&V product reviews of ELMS program deliverables, such as, but not limited to, meeting materials, Program Management Plans, Data Migration Plan, processes or procedures, Configuration Management, POA&M, Section 508 validation, test summary and execution reports, UAT test scripts, configurations and designs, Risk Management Plan, workflows, and training materials. Product reviews assess correctness, completeness and consistency, and validate the deliverables against organization, agency, industry, or other specified acceptance criteria. Product reviews also evaluate conformance to related specifications and plans. ELMS Phase documentation that would require IV&V Product Review include, but is not limited to, the following; Implementation Plan, Deployment Plan, schedules, test event schedules, Interface Controls Documents, Release Plans, and Remediation Plans. Interface design product reviews include verification that interfaces specify data formats, interface protocols, frequency of data exchanges and key performance requirements.

Deliverable (required each contract period if exercised):

Base Year:

A. IV&V Product Review Report (IV&V Comment Tracker Spreadsheet) due at the end of each quarter of the period of performance

Option Period 1:

A. IV&V Product Review Report (IV&V Comment Tracker Spreadsheet) due at the end of each quarter of the period of performance

A. IV&V Product Review Report (IV&V Comment Tracker Spreadsheet) due at the end of each quarter of the period of performance Option Period 3:

B. IV&V Product Review Report (IV&V Comment Tracker Spreadsheet) due at the end of each quarter of the period of performance

Option Period 4:

C. IV&V Product Review Report (IV&V Comment Tracker Spreadsheet) due at the end of each quarter of the period of performance

5.2.2.3 REQUIREMENTS EVALUATION

The Contractor shall conduct an IV&V requirements evaluation which will include evaluating in-scope requirements for correctness, consistency, completeness, accuracy, readability and testability. Requirements evaluation criteria includes the following:

specific, measurable, attainable, prioritized, unique, unambiguous, and located in the VA requirements tool (JIRA). The IV&V requirements evaluation will be used to plan and design IV&V testing for verification of implementation for the specified release. The Contractor shall include, if available, the evaluation of in-scope epics, user stories, and features to provide findings and recommendations. The results of the IV&V requirements evaluation shall be provided in the IV&V Requirements Evaluation Report.

Deliverable (required each contract period if exercised):

Base Period:

A. IV&V Requirements Initial Evaluation Report due one month after contract award, and monthly thereafter.

Option Period 1:

A. IV&V Requirements Initial Evaluation Report due one month after option period award and monthly thereafter.

Option Period 2:

A. IV&V Requirements Initial Evaluation Report due one month after option period award and monthly thereafter.

Option Period 3:

A. IV&V Requirements Initial Evaluation Report due one month after option period award and monthly thereafter.

Optoin Period 4:

A. IV&V Requirements Initial Evaluation Report due one month after option period award and monthly thereafter.

5.2.2.4 INTERFACE REQUIREMENTS ANALYSIS

The Contractor shall conduct an Interface Requirements Analysis (per interface) on interface requirements to verify and validate that the requirements for interfaces are correct, consistent,…