PWS - Enterprise AI Support Services Draft.docx

Enterprise AI Support Services

VA-27-00007524

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Office of Information & Technology (OIT) Chief Artificial Intelligence Office (CAIO)

Enterprise Artificial Intelligence Support Services

Date: September 22, 2026

VA-27-00007524

PWS Version Number: 2.0

Contents

BACKGROUND

The Department of Veterans Affairs (VA), Office of Information and Technology (OIT), requires professional services to implement, integrate, operate, support, govern, measure, sustain, and transition enterprise artificial intelligence (AI) capabilities, including generative AI.

VA delivers health care, benefits, and other services to Veterans and their families. As AI capabilities advance, VA intends to use AI and automation to improve the speed, quality, accuracy, and cost-effectiveness of internal operations and Veteran services while maintaining applicable safety, security, privacy, accessibility, governance, and human-oversight requirements.

VA’s enterprise AI priorities include:

a) Expanding appropriate AI access across the workforce.

b) Building an AI-ready workforce.

c) Reimagining high-impact workflows using AI, automation, and agentic capabilities.

d) Strengthening the data, integration, and infrastructure foundations necessary for AI adoption.

e) Maintaining transparent and effective AI governance.

VA’s objective goes beyond provisioning access to enterprise AI product(s). VA intends to incorporate approved AI and automation into appropriate operational workflows to simplify work, reduce repetitive activity, improve accuracy and turnaround time, and create measurable operational and mission value. The Enterprise AI Product(s), the professional services acquired under this PWS, and applicable VA-furnished and separately acquired capabilities are complementary components of that enterprise operating model.

Definitions for purposes of this PWS

“Enterprise AI Products” means the separately acquired commercial, employee- and contractor-facing artificial intelligence products and the associated native product capabilities.

“Enterprise AI Product Environment” means the VA-authorized tenant, workspace, or other deployed environment through which the Enterprise AI Products are made available.

“Enterprise AI Product Provider” means the product publisher, Original Equipment Manufacturer, or other VA-designated provider responsible under a separate acquisition for furnishing and supporting the Enterprise AI Product, including its native product capabilities, models, administrative interfaces, reporting interfaces, security evidence, and product-side enablement services.

VA separately acquires the Enterprise AI Product(s) and the native Original Equipment Manufacturer (OEM) services. This PWS does not buy the product(s). It buys the professional services needed to integrate, operate, and support that product within the VA environment. Specifically excluded from this PWS: product subscriptions, user licenses, model or application programming interface (API) consumption, cloud consumption, raw computing resources, and standard OEM support.

The service model relies on approved capabilities and reusable assets furnished by VA, the Enterprise AI Product Provider(s), and Cloud Service Providers where they satisfy the requirement and is structured to avoid unnecessary duplication of services already available to VA. The acquisition includes two service groupings:

a) Enterprise Implementation and Sustainment, including enterprise integration, rollout support, administration, service management, support operations, financial operations, adoption, and sustainment.

b) Advanced Technical Services, including approved data connectivity, retrieval, tool integration, agents, workflows, evaluations, software-development enablement, and specialized use-case support.

Successful enterprise AI implementation depends on coordinated performance among three principal participants: VA, the Enterprise AI Product Provider(s), and the professional-services Contractor performing this PWS. Each participant performs a distinct but interdependent role within the enterprise operating model.

VA establishes mission priorities, enterprise policies, governance, funding, authorization and approval decisions, data- and system-owner decisions, risk acceptance, and Government acceptance. The Enterprise AI Product Provider(s) furnish and support the separately acquired Enterprise AI Product(s), including the underlying models and native product capabilities, enterprise administrative capabilities, product-side reporting and security evidence, product support and escalation, technology updates, and included product-side enablement services.

The Contractor shall provide the services necessary to integrate those capabilities into VA’s environment, coordinate dependencies across VA organizations and providers, sustain assigned enterprise operations, support users and adoption, provide financial and performance management support, support governance and authorization activities, and perform separately authorized advanced technical services.

APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. “Federal Information Security Modernization Act of 2014”

2. Federal Information Processing Standards (FIPS) Publication 140-3, “Security Requirements for Cryptographic Modules,” March 22, 2019

3. FIPS Pub 199, “Standards for Security Categorization of Federal Information and Information Systems,” February 2004

4. FIPS Pub 200, “Minimum Security Requirements for Federal Information and Information Systems,” March 2006

5. FIPS Pub 201-3, “Personal Identity Verification of Federal Employees and Contractors,” January 2022

6. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

7. Public Law 109-461 (P.L. 109-461), Veterans Benefits, Health Care, and Information Technology Act of 2006, as amended, Title IX, Information Security Matters

8. VA Directive 0710, “Personnel Vetting Program,” September 8, 2025, https://www.va.gov/vapubs/index.cfm

9. VA Handbook 0710, “Personnel Vetting Program,” September 8, 2025, https://www.va.gov/vapubs/index.cfm

10. 36 C.F.R. Part 1194, “Information and Communication Technology Standards and Guidelines,” as amended

11. Office of Management and Budget (OMB) Circular A-130, “Managing Federal Information as a Strategic Resource,” July 28, 2016

12. 45 C.F.R. Parts 160 and 164, Subparts A and E, the Standards for Privacy of Individually Identifiable Health Information (“Privacy Rule”); and 45 C.F.R. Parts 160 and 164, Subparts A and C, the Security Standard (“Security Rule”); as amended

13. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended

14. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

15. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021 (see VA NOTICE 24-18, dated September 27, 2024, “Update to VA Directive 6500 Cybersecurity Program,” and VA Notice 25-07, dated 3/18/25, “Amending VA Directive 6500 to incorporate M-24-15”)

16. VA Handbook 6500, “Risk Management Framework for VA Information Systems VA Information Security Program,” February 24, 2021 (see VA Notice 25-01, dated October 15, 2024, “Update to VA Handbook 6500 Risk Management Framework for VA Information Systems VA Information Security Program”, and VA Notice 25-06, dated 3/18/25, “Amending VA Directive 6500 to incorporate M-24-15”, VA Notice 25-16, dated September 15, 2025, “Amending VA Handbook 6500 to Replace Enterprise Mission Assurance Support Services Tool With Office of Information Technology Governance Risk Compliance Tool, and VA Notice 25-17, dated September 22, 2025, “Rescission Of Office Of Information Security (OIS) Deputy Assistant Secretary (DAS) Memorandum – Requirements of Proper Plan of Action and Milestones (POA&M) Completion)

17. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI),” June 30, 2023

18. VA Handbook 6500.6, “Contract Security,” March 12, 2010 (see VA Notice 24-12, dated April 22, 2024, “Update to VA Handbook 6500.6, Contract Security, Appendix C”)

19. VA Handbook 6500.8, “Information System Contingency Planning,” March 25, 2025

20. VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018 (see VA NOTICE 25-10, dated June 9, 2025, “Use of Personally Owned Mobile Devices Policy Amendment of Department of Veterans Affairs Handbook 6500.10,” and VA Notice 25-15, dated August 22, 2025, “Update to VA Handbook 6500.10 Mobile Device Security Policy”)

21. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014

22. VA Directive 6510, “VA Identity, Credential and Access Management,” September 3, 2024

23. VA Handbook 6510, “VA Identity, Credential and Access Management,” September 27, 2024

24. VA Directive and Handbook 6513, “Secure External Connections,” October 12, 2017

25. VA Directive 6300, “Records and Information Management,” September 21, 2018

26. VA Handbook 6300.1, “Records Management Procedures“, March 24, 2010

27. NIST SP 800-37 Rev 2, “Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy,” December 2018

28. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020)

29. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015

30. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” March 24, 2014

31. OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005

32. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019

33. NIST SP 800-63 Rev 4, 800-63A-4, 800-63B-4, 800-63C-4, “Digital Identity Guidelines,” August 1, 2025

34. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019

35. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol Version 6 (IPv6),” November 19, 2020

36. C.F.R. Title 15 Part 7, “Securing the Information and Communications Technology and Services (ICTS) Supply Chain”, as amended

37. OMB Memorandum M-22-09, “Moving the U.S. Government Toward Zero Trust Cybersecurity Principles”, January 26, 2022, https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf.

38. NIST SP 800-52 Revision 2, “Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations”

39. OMB M-26-05, “Adopting a Risk-based Approach to Software and Hardware Security,” January 23, 2026

40. OMB M-21-31, “Improving the Federal Government’s Investigative and Remediation Capabilities Related to Cybersecurity Incidents,” August 27, 2021

41. NIST SP 800-88 Revision 1 “Guidelines for Media Sanitization,” December 2014

42. VA Memorandum, “VA Security Controls,” January 17, 2025, https://www.voa.va.gov/DocumentView.aspx?DocumentID=5010

43. E.O. 13960, “Promoting the Use of Trustworthy Artificial Intelligence in the Federal Government,” December 3, 2020

44. E.O. 14319, “Preventing Woke AI in the Federal Government,” July 23, 2025

45. OMB Memorandum M-25-21, “Accelerating Federal Use of AI through Innovation, Governance, and Public Trust,” April 3, 2025

46. OMB Memorandum M-25-22, “Driving Efficient Acquisition of Artificial Intelligence in Government,” April 3, 2025

47. OMB Memorandum M-26-04, “Increasing Public Trust in Artificial Intelligence (AI) Through Unbiased AI Principles,” December 11, 2025

48. NIST AI 100-1, “Artificial Intelligence Risk Management Framework (AI RMF 1.0),” January 2023.

49. NIST AI 600-1, “Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile,” July 2024.

50. NIST SP 800-161 Rev. 1, “Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations,” May 2022.

51. NIST SP 800-207, “Zero Trust Architecture,” August 2020.

52. NIST SP 800-218, “Secure Software Development Framework (SSDF), Version 1.1,” February 2022.

53. P.L. 118-187, “Source Code Harmonization and Reuse in Information Technology (SHARE IT) Act,” December 23, 2024

SCOPE OF WORK

ANNUAL CORE SERVICES

During each exercised performance period, the Contractor shall provide the recurring services necessary to sustain operations and service continuity for the Enterprise AI Product Environment and associated VA-approved AI capabilities.

Annual core services include:

a) Program management, staffing, scheduling, quality control, performance reporting, dependency management, annual rebaselining, and coordination among VA, the Enterprise AI Product Provider, Cloud Service Providers, and other contractors.

b) Sustainment of approved enterprise integrations, configurations, identity and entitlement processes, supported product surfaces, and user populations included in the annual baseline.

c) Tier 1, Tier 2, and Tier 3 support operations integrated with the VA Enterprise Service Desk, including incident coordination, knowledge support, user communications, and escalation to the responsible Enterprise AI Product Provider or other provider.

d) Task-level support for cybersecurity, privacy, Risk Management Framework (RMF) and Authority to Operate (ATO) activities, AI governance, Artificial Intelligence Bill of Materials (AI-BOM) maintenance, continuous-monitoring evidence, incident readiness, and the annual baseline regression verification required by Section 5.5.6 and scoped in the Price Schedule. This task-level support does not replace or narrow the Contractor’s independent compliance obligations under Section 6.0, Addendum A, Addendum B, and applicable contract clauses.

SERVICE DELIVERY PRINCIPLES

Contractor provided services shall be designed and operated using the following principles:

a) Least-privilege access, separation of duties, attributable actions, and controlled production release.

b) Reuse of approved capabilities, product-native functions, administrative controls, reporting and telemetry sources, training and enablement resources, support channels, connectors, tools, evaluation capabilities, documentation, and other services furnished by VA, the Enterprise AI Product Provider, Cloud Service Providers, or other responsible providers before creating new or duplicative solutions.

c) Selection of methods and technologies appropriate to the workload, mission risk, quality requirements, performance needs, and cost.

d) Preservation of required security, privacy, safety, accessibility, auditability, reliability, and human-review controls when optimizing cost or performance.

e) Documentation, portability, and transitionability sufficient for VA to evaluate, modify, transfer, or recompete the services and for VA or a successor provider to operate and maintain them.

The Contractor may recommend changes to configurations, workflows, models, routes, caching, quotas, or other operating methods when supported by evidence. Such changes shall be implemented only through VA-approved capabilities, authorized personnel, and established approval processes.

The Contractor shall not introduce unnecessary proprietary dependencies or undocumented processes that would restrict VA’s ability to access, operate, transfer, or independently evaluate the services.

PERFORMANCE DETAILS

PERFORMANCE PERIOD

The period of performance shall consist of one 12-month Base Period and two (2) 12-month Option Periods. Option Periods may be exercised at the Government’s discretion.

Optional tasks described in Section 5.0 may be exercised during the Base Period or an exercised Option Period via modification issued by the Contracting Officer.

The total period of performance shall not exceed 36 months.

Any work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO).

There are 11 Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, five are set by date:

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

PLACE OF PERFORMANCE

Tasks under this PWS shall be performed primarily at Contractor or subcontractor facilities, including remote-work locations approved for contract performance.

The Contractor shall identify its proposed places of performance in its proposal.

VA may require limited onsite performance at VA facilities for meetings, reviews, training, production-readiness activities, or transition support. Routine Government-provided office space is not anticipated.

TRAVEL

The Government anticipates limited travel in support of this effort, primarily for program-related meetings, reviews, training, production-readiness activities, and transition support. Unless otherwise specified in the applicable contract action, travel necessary to perform awarded work shall be included in the applicable firm-fixed price and shall not be separately reimbursed by the Government. Each authorized trip may include up to three business days onsite, excluding reasonable travel time, at a VA facility within the continental United States.

SPECIFIC TASKS AND DELIVERABLES

The Contractor shall perform the following:

PROJECT MANAGEMENT, MOBILIZATION, ANNUAL REBASELINE, AND BOUNDARY CONTROL

The Contractor shall provide integrated management of all awarded services through a Project Management Office led by a Contractor Project Manager.

The Contractor Project Manager shall serve as the primary Contractor point of contact and shall have authority to direct Contractor and subcontractor resources, coordinate performance, and resolve Contractor performance issues. The Contractor Project Manager shall not direct Government personnel, change contract scope, authorize optional work, obligate funds, or otherwise bind the Government.

The Contractor shall manage staffing, schedules, quality, subcontractors, communications, risks, issues, actions, decision tracking, dependencies, deliverables, corrective actions, invoice support, controls for advanced, demand-driven, and optional tasks, continuity, and transition readiness.

The Contractor shall coordinate performance among VA, the Enterprise AI Product Provider, Cloud Service Providers, the Enterprise Service Desk, data owners, system owners, subcontractors, and other contractors.

Project records shall be maintained in a VA-approved, VA-accessible repository and shall provide traceability among requirements, tasks, responsible parties, milestones, deliverables, acceptance results, corrective actions, and CLINs. Use of any Contractor-controlled repository, collaboration space, workflow system, reporting tool, or storage location shall comply with Section 6.0, Addendum A, Addendum B, applicable records-management requirements, data-rights requirements, and VA security and privacy approvals. Activities performed under separate tasks, CLINs, or service groupings shall remain separately identifiable for pricing, performance, acceptance, and transition purposes.

CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall develop, maintain, and execute a Contractor Project Management Plan describing how the Contractor will manage all required services.

The plan shall include:

a) Contractor organization, key personnel, authorities, staffing, and subcontractor management.

b) An Integrated Master Schedule identifying major activities, milestones, deliverables, dependencies, decision points, and Government-furnished inputs.

c) Mobilization and annual rebaseline activities, including incorporation of the then-current VA rollout planning baseline in Addendum C and any subsequent VA-authorized rebaseline into applicable staffing, capacity, dependency, support, adoption, FinOps, and schedule planning.

d) Quality-control, communications, and reporting processes for managing risks, issues, actions, decisions, and dependencies.

e) Deliverable development, review, submission, correction, and acceptance-support processes.

f) Advanced, demand-driven, and optional-task scope, quantity, schedule, and ceiling controls.

g) Repository, records, continuity, knowledge-transfer, and transition-management processes.

The Contractor shall identify, track, and promptly escalate assumptions, constraints, dependencies, and required Government decisions that could materially affect cost, schedule, security, privacy, authorization, acceptance, or service continuity. For each material dependency, the Contractor shall identify the responsible party, required date, affected task, anticipated impact, proposed mitigation, and required decision or action.

The Contractor shall treat the rollout and adoption figures in Addendum C as Government-furnished planning assumptions and shall track material differences between those assumptions and actual activation, adoption, utilization, support demand, and capacity requirements when the applicable data are available. Incorporation of Addendum C into Contractor planning does not authorize a rollout wave, additional users, additional capacity, optional work, or work outside an awarded CLIN or authorized service baseline.

The Contractor shall update the plan and schedule after an authorized material change to scope, staffing, organization, schedule, interface, authorization status, operating approach, subcontractor arrangement, or transition posture. A plan or schedule update does not authorize a change to contract scope, price, funded quantity or capacity, or period of performance.

Deliverables:

A. Contractor Project Management Plan, including its Revision History;

B. Integrated Master Schedule

Acceptance Criteria: VA can identify responsible personnel, major milestones, deliverables, dependencies, decision points, management controls, and the relationship between authorized work and the applicable CLINs. The plan and schedule are current, achievable, internally consistent, and sufficient to support surveillance, acceptance, continuity, and transition.

REPORTING REQUIREMENTS

The Contractor shall provide a Monthly Program Status Report covering all awarded services active during the reporting period, including applicable recurring core, advanced, demand-driven, and optional services.

For purposes of Section 6.1.12.2, the Monthly Program Status Report constitutes the Monthly Progress Report in which applicable material AI deviations, corrective actions, and results shall be reported. Detailed information provided under another task may be incorporated by reference when it is current and accessible to VA.

The report shall summarize:

a) Work completed and planned.

b) Schedule, milestone, and deliverable status.

c) Staffing, onboarding, offboarding, credentialing, and access status, limited to management-status information appropriate for the Monthly Program Status Report. Reporting under this item does not replace, modify, or satisfy the Contractor Staff Roster, personnel-security, background-investigation, Rules of Behavior, training, access-request, access-removal, or personnel-separation notice requirements in Section 6.0, Addendum B, or applicable VA processes.

d) Risks, issues, actions, decisions, dependencies, and required Government decisions.

e) Quality-control results, performance deficiencies, corrective actions, and status of Contractor-controlled remediation.

f) Advanced, demand-driven, and optional-task scope, quantity, ceiling, schedule, and remaining capacity, as applicable.

g) Significant Enterprise AI Product Provider, Cloud Service Provider, subcontractor, or other-provider escalations.

h) Invoice-support status and continuity or transition-readiness concerns.

i) Material Enterprise AI Product, provider, technology, industry-practice, standards, or regulatory developments that could affect VA implementation, operations, support, risk, cost, schedule, or future planning, including recommended VA actions when applicable.

j) Material variance between the then-current VA rollout planning baseline in Addendum C and available actual activation, adoption, utilization, support demand, and capacity information, including any resulting effect on staffing, service capacity, support, FinOps, adoption activities, dependencies, risks, or anticipated need for separately authorized work. Detailed information reported under Sections 5.2, 5.3, 5.4, 5.6, or 5.8 may be incorporated by reference.

The Contractor shall maintain supporting registers for risks, issues, actions, decisions, dependencies, staffing, deliverables, corrective actions, and material interface changes. Structured registers shall be provided in a VA-approved machine-readable format.

The Contractor shall support the operational, executive, surveillance, invoice, deliverable, and annual-planning reviews identified in the Contractor Project Management Plan, Integrated Master Schedule, Schedule for Deliverables, or other written Government direction and shall maintain the resulting actions and decisions.

The Contractor shall report promptly any condition that could materially affect security, privacy, safety, authorization, funded ceilings, service continuity, a critical milestone, or transition, and do not defer it until the next monthly report. Suspected security incidents, privacy incidents, data-exposure conditions, breach-related matters, and other reportable security or privacy events shall be reported and handled in accordance with Addendum B and applicable VA security and privacy procedures.

Deliverable:

A. Monthly Program Status Report

Acceptance Criteria: The report and supporting registers are timely, current, internally consistent, traceable to active tasks and CLINs, and supported by objective evidence. Known limitations, unavailable information, and unresolved discrepancies are clearly identified.

BASE PERIOD MOBILIZATION AND ANNUAL REBASELINE

During the Base Period, the Contractor shall establish the management, staffing, access-request coordination, reporting, repository, quality-control, communications, governance, and escalation capabilities necessary to begin performance. Establishing access-request coordination does not authorize Contractor or subcontractor access to VA information, VA systems, VA networks, Government information, or Government Data before completion of applicable Section 6.0, Addendum B, personnel-security, training, Rules of Behavior, access-approval, and remote-access requirements.

Mobilization shall include:

a) Kickoff and stakeholder alignment.

b) Confirmation and onboarding of key personnel and subcontractors.

c) Establishment of project repositories, schedules, registers, and review cadences.

d) Validation of Government-furnished information, access-request status, required approvals, and dependencies.

e) Completion of the product-to-services handoff required by Section 5.1.4 before assuming the affected operational responsibilities.

f) Coordination of readiness activities for the recurring core services and initially authorized advanced, demand-driven, or optional work.

The Contractor shall incorporate mobilization activities, responsible parties, prerequisites, dependencies, risks, required Government decisions, and readiness criteria into the Contractor Project Management Plan and Integrated Master Schedule required by Section 5.1.1. The Integrated Master Schedule shall include 30-, 60-, and 90-day mobilization milestones unless the Contracting Officer approves another mobilization schedule in writing.

The Contractor shall use the then-current VA rollout planning baseline in Addendum C, actual activation and utilization information, and applicable operational results as planning inputs to the annual rebaseline process. The Contractor shall identify material variance between planned and actual conditions and recommend appropriate updates for the succeeding performance period. Contractor recommendations do not modify Addendum C, the awarded annual baseline, contract scope, funded quantity or capacity, price, or authorized optional work unless implemented through the applicable VA and Contracting Officer action.

Before the end of each performance period, the Contractor shall provide an Annual Rebaseline Package to support VA planning for the succeeding performance period.

The package shall identify:

a) Current performance, notified or provisioned user population, activation, adoption, utilization, monthly active-user information when available, support demand, capacity, staffing, costs, risks, dependencies, authorization status, and unresolved corrective actions, including material variance from the then-current rollout planning baseline in Addendum C.

b) Recommended rollout-planning assumptions, service levels, quantities, capacities, support requirements, staffing assumptions, and advanced, demand-driven, or optional work for the succeeding period, including the basis for material changes from the then-current Addendum C planning baseline.

c) Material changes to products, integrations, responsibilities, security or authorization status, knowledge-transfer requirements, and transition readiness.

d) Government information, approvals, decisions, or other actions required to support continued performance.

The Contractor shall submit the package in accordance with the Schedule for Deliverables. The Annual Rebaseline Package does not authorize additional work or obligate VA to exercise an Option Period or optional task.

Deliverable:

A. Annual Rebaseline Package

Acceptance Criteria: VA can determine whether mobilization activities and milestones are current and achievable; identify the current service baseline; compare material actual activation, adoption, utilization, support-demand, and capacity results with the then-current VA rollout planning baseline in Addendum C; understand the basis for recommended changes for the succeeding period; and identify unresolved risks, dependencies, capacity considerations, and required Government decisions.

PRODUCT-TO-SERVICES BOUNDARY, MULTI-PARTY RESPONSIBILITY ASSIGNMENT, AND PROVIDER REACHBACK Before assuming an affected operational responsibility, the Contractor shall complete and obtain VA acceptance of a Product-to-Services Handoff Package.

The package shall define the responsibilities and interfaces among VA, the Contractor, subcontractors, the Enterprise AI Product Provider, Cloud Service Providers, resellers, the Enterprise Service Desk, data owners, system owners, platform providers, and other contractors.

The package shall include:

a) A Product-to-Services Boundary Matrix and Responsibility Assignment Matrix identifying who performs, approves, supports, escalates, and accepts each material activity.

b) An Interface Control Document describing the technical, operational, administrative, security, privacy, authorization, reporting, and support interfaces required for performance.

c) Support and escalation procedures identifying handoff, acceptance, status, return, workaround, and closure responsibilities.

d) An inventory of supported products, environments, access paths, interfaces, and responsible providers.

e) Current evidence of certifications, partner status, support entitlements, or provider relationships relied upon by the Contractor.

f) Product-native capabilities and provider-furnished services made available through the separate Enterprise AI Product acquisition, including applicable entitlement and availability status; included enablement, customer-success, technical-support, engineering, and administrative services; administrative interfaces and controls; product-native dashboards; reporting APIs; usage and audit exports; SLA and issue-resolution obligations; product roadmap or release-notification mechanisms; technology-change artifacts; security and safety evidence sources; and support and escalation channels.

g) Known limitations, unavailable product evidence, unsupported product features, capabilities not included in VA’s current entitlement, preview or beta capabilities, roadmap capabilities, separately priced product capabilities or services, unresolved dependencies, and transition considerations.

The Contractor shall maintain direct and documented reachback to the responsible Enterprise AI Product Provider, Cloud Service Provider, or other provider for matters outside the Contractor’s authority or control.

The Contractor shall promptly disclose the expiration, suspension, loss, or material limitation of a certification, support entitlement, authorization, or provider relationship relied upon for performance.

The Contractor shall not restrict or condition VA’s direct access to applicable products, providers, support channels, documentation, administrative capabilities, security and safety information, pricing information, configurations, data, exports, or transition materials.

The Contractor shall maintain the handoff package throughout performance and update it after a material change to responsibilities, products, access paths, interfaces, support arrangements, authorizations, or operating models.

Deliverable:

A. Product-to-Services Handoff Package

Acceptance Criteria: VA can identify the responsible parties and decision authorities for each material service and interface, distinguish included provider support from Contractor services, route a representative issue through the documented escalation process, verify relied-upon qualifications and support relationships, and replace or transition the Contractor without losing access, records, configurations, support rights, or operational continuity.

VENDOR RELATIONSHIP MANAGEMENT AND BUSINESS REVIEWS

The Contractor shall serve as the primary Contractor-side point of coordination for day-to-day operational matters with the Enterprise AI Product Provider, consolidating the reachback, escalation, and roadmap-tracking responsibilities established elsewhere in this PWS into a single managed relationship function.

The Contractor shall:

· Maintain a current record of Enterprise AI Product Provider account contacts, escalation contacts, entitlement identifiers, and support-tier relationships consistent with the Product-to-Services Handoff Package required by Section 5.1.4.

· Track the Enterprise AI Product Provider's performance against applicable service-level and issue-resolution obligations furnished under the separate Enterprise AI Product acquisition, and report material non-performance to the COR.

· Track the Enterprise AI Product Provider's public and disclosed roadmap, upcoming feature releases, deprecations, and model version changes, and assess and communicate their effect on VA operations, cost, training, and support requirements.

· Prepare data, usage analysis, performance summaries, and open-issue status to support VA-led business reviews (QBRs or equivalent) with the Enterprise AI Product Provider.

· Identify recurring or systemic Provider performance, support, or roadmap issues warranting escalation beyond routine account management.

The Contractor does not represent VA in, lead, or participate in negotiation of the terms of the separate Enterprise AI Product acquisition. The Contractor's role under this section is limited to operational coordination, performance tracking, and analytical support for VA-led vendor governance activities.

This function shall extend to each Enterprise AI Product Provider and Cloud Service Provider relevant to a given performance period. If VA procures, pilots, or transitions to an additional or replacement Enterprise AI Product Provider during the period of performance, the Contractor shall establish an equivalent relationship-management structure for that Provider within the timeframe specified in the Product-to-Services Handoff Package update required by Section 5.1.4, without requiring a new CLIN or task authorization unless the change materially increases the scope of vendor-management effort beyond what is included in the awarded baseline.

Deliverable(s):

A. Vendor Relationship and Business Review Support Package (per scheduled review).

Acceptance Criteria: VA can identify current Provider relationships, entitlements, and escalation paths for each Enterprise AI Product Provider in use; verify that Provider performance is being tracked against applicable obligations; and confirm that roadmap and material Provider changes are being assessed and communicated in a timely manner.

5.1.6 SERVICE CONTINUITY AND DISASTER RECOVERY

The Contractor shall maintain a Service Continuity and Disaster Recovery Plan addressing the Contractor's ability to sustain awarded services in the event of a disruption to Contractor personnel, facilities, subcontractor performance, or Contractor-controlled systems and tools used to perform this PWS.

The plan shall identify, at a minimum:

· Key-person dependencies and succession or backup staffing arrangements for each role.

· Continuity arrangements in the event of a Contractor facility disruption, including alternate work locations or remote-performance capability.

· Subcontractor continuity dependencies and the Contractor's plan to sustain performance if a subcontractor cannot perform.

· Procedures for maintaining continuity of the Contractor-controlled repositories, ticketing systems, knowledge bases, and records required elsewhere in this PWS (see Sections 5.1.1, 5.3.2, 5.4.5) in the event of a Contractor system disruption, including backup and restoration procedures.

· Notification procedures and timeframes for informing VA of a disruption affecting the Contractor's ability to perform, distinguishing routine staffing changes (governed by Section 5.1.2) from a disruption materially affecting service continuity.

This section addresses continuity of the Contractor's service-delivery capability and does not replace, modify, or satisfy the separately required Enterprise AI Product Provider's or Cloud Service Provider's own business continuity, disaster recovery, or contingency-planning obligations, nor the VA information-system contingency-planning requirements referenced in Section 6.0 and applicable VA Handbooks.

The Contractor shall support at least one continuity readiness review during the Base Period and each exercised Option Period, coordinated with the readiness drill required by Section 5.4.7 where practicable to avoid duplicative testing burden.

Deliverable(s):

A. Service Continuity and Disaster Recovery Plan;

B. Continuity Readiness Review Record

Acceptance Criteria: VA can identify how the Contractor would sustain awarded services through a disruption to Contractor personnel, facilities, subcontractors, or Contractor-controlled systems; verify that key dependencies and backup arrangements are current; and confirm that a continuity readiness review has been performed and material findings addressed.

CORE ENTERPRISE INTEGRATION AND SUSTAINMENT

The Contractor shall implement, integrate, operate, and sustain the separately acquired Enterprise AI Product within the VA enterprise environment and shall support its associated VA-approved access paths. Work under this section is limited to professional-services support for VA-furnished, product-native, or separately acquired capabilities and does not authorize the Contractor to furnish, license, host, or operate a Contractor-controlled product, platform, gateway, broker, orchestration service, identity service, endpoint-management service, telemetry service, observability service, or usage meter.

The required integration and sustainment activities shall include, as applicable, network, browser, endpoint, device, deployment, identity, entitlement, administrative configuration, supported product surfaces, release management, and routine technical sustainment.

The Contractor shall perform work in accordance with the approved responsibility assignments, architectures, authorization boundaries, and change-control processes. When an activity must be performed by VA, the Enterprise AI Product Provider, a Cloud Service Provider, or another contractor, the Contractor shall provide the requirements and supporting documentation, testing, coordination, and evidence necessary to support that activity.

The Contractor shall use approved VA, Enterprise AI Product Provider, Cloud Service Provider, and other provider capabilities before proposing a duplicative capability or point-to-point solution and shall identify unsupported configurations, product limitations, responsibility conflicts, and material dependencies.

CORE INTEGRATION AND SUSTAINMENT PLAN

The Contractor shall develop, maintain, and execute a Core Integration and Sustainment Plan covering each product surface, environment, access path, and user population included in the approved annual core baseline.

The plan shall identify:

a) Supported products, environments, configurations, access paths, and user populations.

b) Network, identity, endpoint, deployment, administrative, and entitlement interfaces.

c) Responsible VA, Contractor, Enterprise AI Product Provider, Cloud Service Provider, and other-provider organizations.

d) Required Government-furnished information, access-request status, required approvals, and dependencies.

e) Implementation, testing, sustainment, support, change, and rollback processes.

f) Applicable security, privacy, authorization, training, support, and transition dependencies.

g) The capacity and scope included in the annual core baseline.

The plan shall include a current Integration Inventory identifying the owner, responsible parties, configuration, authorization status, operational status, support path, known limitations, dependencies, and transition requirements for each supported element. The plan and Integration Inventory support performance management and do not replace, modify, or satisfy security, privacy, accessibility, records-management, personnel-security, access, authorization, assessment, approval, or documentation requirements established in Section 6.0, Addendum A, Addendum B, applicable contract clauses, or applicable VA processes.

The Contractor shall update the plan after a material change to the supported architecture, product surface, access path, identity pattern, endpoint configuration, administrative model, user population, authorization status, or responsibility assignment. A plan update does not authorize a change to contract scope, price, funded quantity or capacity, products, user populations, or optional work.

Deliverable:

A. Core Integration and Sustainment Plan, including the Integration Inventory.

Acceptance Criteria: VA can identify each supported element, how it is configured, its operational and authorization status, the responsible parties, applicable dependencies and limitations, and the activities and capacity included in the approved annual core baseline.

ENDPOINT AND END-USER MANAGEMENT AND APPLICATION-DEPLOYMENT INTEGRATION

The Contractor shall perform or coordinate the network, browser, endpoint, desktop, device-management, application-package build, deployment, and related activities assigned to it under the approved responsibility assignments.

Activities shall include, as applicable, requirements analysis; connectivity and network coordination; browser, endpoint, and device configuration; endpoint configuration-baseline support; application-package build and deployment; installation, update, and change-control testing; client patching and vulnerability-management coordination; coordination with VA endpoint instrumentation, monitoring, optimization, reporting, and endpoint-security functions; and production-deployment support.

For each supported product surface, the Contractor shall document:

a) Supported operating systems, browsers, devices, clients, and versions.

b) Approved deployment, installation, configuration, update, and removal methods.

c) Network, certificate, proxy, firewall, identity, and administrative dependencies.

d) Local data, file, telemetry, crash-log, and storage behavior.

e) Known compatibility limitations and rollback procedures.

The Contractor shall use VA-approved software distribution, endpoint management, device management, and change-control processes. The Contractor shall not require personal accounts, personal payment methods, unmanaged devices, unapproved extensions, personal API keys, unapproved installation methods, or Contractor-owned equipment or software on VA information systems except as expressly authorized in accordance with Section 6.0, Addendum A, Addendum B, and applicable VA security and access approvals.

Material changes shall be tested in an approved nonproduction or limited-production environment before broad deployment unless VA authorizes implementation through an approved emergency-change process. The Contractor shall maintain test evidence identifying the tested configuration and environment, test cases, results, defects, corrective actions, approval status, and rollback or removal validation.

Deliverable: Supported Client and Deployment Configuration Record, including Test Evidence and Rollback or Removal Procedures.

Acceptance Criteria: VA can identify the approved network, endpoint, device, and deployment configuration for each supported product surface; verify that material changes were authorized, tested, and capable of rollback or removal; and verify that unauthorized clients, devices, and access methods remain unavailable.

IDENTITY, ENTITLEMENT, AND ADMINISTRATIVE OPERATIONS

The Contractor shall implement and sustain VA-approved identity, authentication, authorization, provisioning, deprovisioning, role, group, persona, service account, delegated administration, and entitlement processes for the Enterprise AI Product within the Contractor’s assigned authority.

The Contractor shall use VA-approved identity, multifactor authentication, least-privilege, separation-of-duties, federation, and role- or attribute-based access patterns.

The Contractor shall maintain approved entitlement profiles identifying the product surfaces, features, models, routes, data sources, tools, agents, workflows, administrative capabilities, and expiration or review conditions available to each authorized user category.

Users shall not be permitted to self-enable restricted, administrative, premium, paid, or otherwise unauthorized capabilities.

The Contractor shall support assignment, modification, suspension, recertification, reclamation, expiration, and removal of access. Privileged actions shall be attributable, logged, reviewable, and reversible where technically supported.

The Contractor shall administer only VA-furnished or separately acquired licenses, accounts, entitlements, model access, API access, and related capacity.

The Contractor shall provide an Entitlement and Reclamation Report identifying current account and access status, assigned profiles, activity or inactivity where available, expiration or review dates, and recommended activation, suspension, downgrade, reclamation, or recertification actions.

Deliverables:

A. Entitlement Profile Records;

B. Entitlement and Reclamation Report

Acceptance Criteria: VA can provision, modify, suspend, recertify, reclaim, expire, and remove representative users, service accounts, and entitlements through approved processes; verify that access remains within approved roles, entitlement profiles, and funded capacity; and trace privileged actions to authorized administrators and supporting records.

SUPPORTED CONFIGURATION, RELEASE, AND CHANGE MANAGEMENT

The Contractor shall maintain a version-controlled Supported Configuration and Release…