PWS ERP RFI 1.16.pdf

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Office of Information & Technology Infrastructure Operations (IO) - Enterprise Service Management (ESM)

Enterprise Resource Planning (ERP)

Date: January 7, 2026

VA-26-000769

PWS Version Number: 1.0

Enterprise Resource Planning Platform

Contents

1.0 BACKGROUND

2.0 APPLICABLE DOCUMENTS

3.0 SCOPE OF WORK

4.0 PERFORMANCE DETAILS

4.1 PERFORMANCE PERIOD

4.2 PLACE OF PERFORMANCE

4.3 TRAVEL

5.0 SPECIFIC TASKS AND DELIVERABLES

5.1 PROJECT MANAGEMENT

5.1.1 CONTRACTOR PROJECT MANAGEMENT PLAN

5.1.2 REPORTING REQUIREMENTS

5.2 ERP

5.2.1 ITSM

5.2.2 ITAM

5.2.3 ITOM

5.2.4 ITBM

5.2.5 DIGITAL WORKPLACE

5.2.6 CSM

5.2.7 SecOps

5.2.8 INTEGRATED RISK MANAGEMENT (IRM)

5.2.9 INTEGRATION CENTER

5.2.10 REPORTING AND ANALYTICS

5.2.11 PLATFORM TOOLS

5.2.12 MOBILE

5.2.13 PRODUCTION INSTANCE

5.2.14 NON-PRODUCTION INSTANCE

5.2.15 PLATFORM PERFORMANCE TESTING INSTANCE

5.3 TRANSITION IN – TOOL REQUIREMENTS (OPTIONAL TASK NINE)

5.3.1 IMPLEMENT CURRENT FUNCTIONALITY

5.3.2 MIGRATION FROM SERVICENOW

5.3.3 AUTHORITY TO OPERATE

5.4 TRAINING

5.5 OPTION PERIOD ONE - FOUR

5.6 ENTERPRISE ASSET MANAGEMENT (OPTIONAL TASK ONE)

5.7 ENTERPRISE HRSD (OPTIONAL TASK TWO)

5.8 ARTIFICAL INTELLIGENCE (OPTIONAL TASK THREE)

5.8.1 GENERATIVE AI CAPABILITIES

5.8.2 AGENTIC AI CAPABILITIES

5.8.3 COMBINED GENERATIVE AI ANDAGENTIC AI USE CASES

5.9 DATA LAKE SOLUTION (OPTIONAL TASK FOUR)

5.10 GREENFIELD SOLUTION - Out of the Box (OPTIONAL TASK FIVE)

5.11 VENDOR RISK MANAGEMENT (VRM) (OPTIONAL TASK SIX)

5.12 FIELD SERVICE MANAGEMENT (OPTIONAL TASK SEVEN)

5.13 PROFESSIONAL SERVICES (OPTIONAL TASK EIGHT)

5.14 TRANSITION OUT (OPTIONAL TASK NINE)

6.0 GENERAL REQUIREMENTS

6.1 ENTERPRISE AND IT FRAMEWORK

6.1.1 VA TECHNICAL REFERENCE MODEL

6.1.2 ZERO TRUST – VA CRITICAL SECURITY CONTROLS

6.1.3 FEDERAL IDENTITY, CREDENTIAL, AND ACCESS MANAGEMENT

(FICAM)

6.1.4 INTERNET PROTOCOL VERSION 6 (IPv6)

6.1.5 TRUSTED INTERNET CONNECTION (TIC)

6.1.6 STANDARD COMPUTER CONFIGURATION

6.1.7 VETERAN FOCUSED INTEGRATION PROCESS (VIP) AND PRODUCT

LINE MANAGEMENT (PLM)

6.1.8 PROCESS ASSET LIBRARY (PAL)

6.1.9 AUTHORITATIVE DATA SOURCES

6.1.10 SOCIAL SECURITY NUMBER (SSN) REDUCTION

6.1.11 SOFTWARE AND LICENSING REQUIREMENTS

6.2 SECURITY AND PRIVACY REQUIREMENTS

6.2.1 POSITION/TASK RISK DESIGNATION LEVEL(S)

6.2.2 CONTRACTOR PERSONNEL SECURITY REQUIREMENTS

6.3 METHOD AND DISTRIBUTION OF DELIVERABLES

6.4 PERFORMANCE METRICS

6.5 FACILITY/RESOURCE PROVISIONS

6.6 GOVERNMENT FURNISHED PROPERTY

6.7 SHIPMENT OF HARDWARE OR EQUIPMENT

N/A

ADDENDUM A – ADDITIONAL VA REQUIREMENTS, CONSOLIDATED

ADDENDUM B – VA INFORMATION AND INFORMATION SYSTEM SECURITY/

PRIVACY LANGUAGE

1.0 BACKGROUND

The Department of Veterans Affairs (VA), Office of Information and Technology (OIT), Infrastructure Operations (IO) Enterprise Service Management (ESM) requires the acquisition of cloud-based Enterprise Resource Planning (ERP) solution delivered via a multi-instance Platform-as-a-Service (PaaS) and Software-as-a-Service (SaaS) subscription model.

This requirement supports the VA mission to enhance IT service delivery, strengthen operational efficiency, and advance digital transformation across the enterprise. The required solution must provide enterprise-wide integration and functionality consistent with leading ERP in the marketplace

VA OIT currently leverages a SaaS platform to manage critical enterprise operational practices, including enterprise service desk operations, incident and event triage, request fulfillment, change enablement, and problem resolution. Additionally, the platform supports application provisioning, clinician support, and telehealth availability.

The SaaS platform is central to maintaining uptime for essential systems, including Veterans Health Information Systems and Technology Architecture (VistA) and the new Oralce/Cerner Electronic Health Record Management (EHRM) platform.

As demand increases for real-time support, automation, cybersecurity compliance, and adaptability to evolving legislative and policy requirements, VA requires acquisition of a next-generation ERP solution with capabilities that meet or exceed industry standards for federal environments. This solution must span across IT Service Management (ITSM), IT Asset Management (ITAM), IT Operations Management (ITOM), IT Business Management (ITBM), Human Resource Service Delivery (HRSD), and other service domains.

2.0 APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. “Federal Information Security Modernization Act of 2014”

2. Federal Information Processing Standards (FIPS) Publication 140-3, “Security Requirements for Cryptographic Modules”, March 22, 2019

3. FIPS Pub 199. “Standards for Security Categorization of Federal Information and Information Systems,” February 2004

4. FIPS Pub 200, “Minimum Security Requirements for Federal Information and

Information Systems,” March 2006

5. FIPS Pub 201-3, “Personal Identity Verification of Federal Employees and

Contractors,” January 2022

6. 10 U.S.C. § 2224, "Defense Information Assurance Program", as amended

7. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

8. Public Law 109-461 (P.L. 109-461), Veterans Benefits, Health Care, and Information Technology Act of 2006, as amended, Title IX, Information Security Matters

9. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”, as amended

10. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, https://www.va.gov/vapubs/index.cfm

11. VA Handbook 0710, “Personnel Security and Suitability Program,” May 2, 2016, https://www.va.gov/vapubs/index.cfm

12. VA Directive 6102, “Internet/Intranet Services,” August 5, 2019

13. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and Guidelines,” as amended

14. Office of Management and Budget (OMB) Circular A-130, “Managing Federal

Information as a Strategic Resource,” July 28, 2016

15. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed

Services (CHAMPUS)”, as amended

16. NIST SP 800-66 Rev. 2, “Implementing the Health Insurance Portability and

Accountability Act (HIPAA) Security Rule: A Cybersecurity Resource Guide,” February 2024

17. 45 C.F.R Parts 160 and 164, Subparts A and E, the Standards for Privacy of Individually Identifiable Health Information (“Privacy Rule”); and 45 C.F.R.

Parts 160 and 164, Subparts A and C, the Security Standard (“Security Rule”); as amended

18. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended

19. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

20. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021 (see VA

NOTICE 24-18, dated September 27, 2024, “Update to VA Directive 6500 Cybersecurity Program”, and VA Notice 25-07, dated 3/18/25, “Amending VA Directive 6500 to incorporate M-24-15”)

21. VA Handbook 6500, “Risk Management Framework for VA Information Systems VA Information Security Program,” February 24, 2021 (see VA Notice 25-01, dated October 15, 2024, “Update to VA Handbook 6500 Risk Management Framework for VA Information Systems VA Information Security Program”, and VA Notice 25-06, dated 3/18/25, “Amending VA Directive 6500 to incorporate M-24-15”)

22. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI),” June 30, 2023

23. VA Handbook 6500.6, “Contract Security,” March 12, 2010 (see VA Notice 24-12, dated April 22, 2024, “Update to VA Handbook 6500.6, Contract Security, Appendix C VA Information and Information System Security/Privacy Language For Inclusion Into Contracts, As Appropriate”)

24. VA Handbook 6500.8, “Information System Contingency Planning,” March 25, 2025

25. VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018

26. VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017

27. OIT Process Asset Library (PAL), OIT Process Asset Library.

28. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

29. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014

30. VA Directive 6510, “VA Identity, Credential and Access Management,” September 3, 2024

31. VA Handbook 6510, “VA Identity, Credential and Access Management,” September 27, 2024

32. VA Directive and Handbook 6513, “Secure External Connections,” October 12, 2017

33. VA Directive 6300, “Records and Information Management,” September 21,

34. VA Handbook, 6300.1, “Records Management Procedures,“ March 24, 2010

35. NIST SP 800-37 Rev 2, “Risk Management Framework for Information

Systems and Organizations: A System Life Cycle Approach for Security and Privacy,” December 2018

36. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020)

37. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015

38. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-

12) Program,” March 24, 2014

39. OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005

40. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019

41. OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008

42. Federal Identity, Credential, and Access Management (FICAM) Architecture, June 30, 2023 (FICAM Architecture (idmanagement.gov))

43. NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access,“ June 2018

44. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, “Digital Identity Guidelines,” updated March 02, 2020

45. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014

46. VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland

Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

47. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

48. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

49. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

50. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019

51. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008

52. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (P.L. 110–140), December 19, 2007

53. Section 104 of the Energy Policy Act of 2005, (P.L. 109–58), August 8, 2005

54. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August

2, 2001

55. VA Directive 0057, “VA Environmental Management Program,” October 25,

56. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote

Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

57. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

58. “Veteran Focused Integration Process (VIP) Guide 4.0,” March 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

59. VA Memorandum “Proper Use of Email and Other Messaging Services,”

January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

60. “Product Line Management Transformation Playbook” version 3.1, August 2023, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

61. NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020

62. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol

Version 6 (IPv6),” November 19, 2020

63. Social Security Number (SSN) Fraud Prevention Act of 2017

64. Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23,

65. C.F.R Title 15 Part 7, “Securing the Information and Communications

Technology and Services (ICTS) Supply Chain”, as amended

66. Executive Order 14028, “Executive Order on Improving the Nation's

Cybersecurity,” May 12, 2021, https://bidenwhitehouse.archives.gov/briefing-room/presidential-actions/2025/01/16/executive-order-on-strengthening-and-promoting-innovation-in-the-nations-cybersecurity/

67. OMB Memorandum M-22-09, “Moving the U.S. Government Toward Zero Trust Cybersecurity Principles”, January 26, 2022, https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf.

68. NIST SP 800-52 Revision 2, “Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations

69. OMB M-22-18, “Enhancing the Security of the Software Supply Chain through Secure Software Development Practices,” September 14, 2022

70. OMB M-23-16, “Update to Memorandum M-22-18,” June 9, 2023

71. OMB M-21-31, “Improving the Federal Government’s Investigative and Remediation Capabilities Related to Cybersecurity Incidents,” August 27,

72. NIST SP 800-88 Revision 1 “Guidelines for Media Sanitization,” December

73. CISA Binding Operational Directive (BOD) 19-02: “Vulnerability Remediation Requirements of Internet-Accessible Systems,” April 29, 2019, BOD 19-02:

Vulnerability Remediation Requirements for Internet-Accessible Systems |

CISA

74. CISA BOD 22-01: “Reducing the Significant Risk of Known Exploited Vulnerabilities,” November 3, 2021, BOD 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities | CISA

75. CISA BOD 23-01: Improving Asset Visibility and Vulnerability Detection on Federal Networks.” Cybersecurity & Infrastructure Security Agency (CISA), BOD 23-01: Improving Asset Visibility and Vulnerability Detection on Federal Networks | CISA

76. VA Directive 6550, Pre-Procurement Assessment and Implementation of Medical Devices/Systems, June 03, 2019

77. VA Memorandum, “VA Security Controls,” January 17, 2025, https://www.voa.va.gov/DocumentView.aspx?DocumentID=5010

3.0 SCOPE OF WORK

The Contractor shall provide an enterprise-wide ERP SaaS/PaaS platform with a subscription model that includes licensing, and support. The Contractor shall also perform the following optional tasks when the tasks are exercised:

1. Enterprise Asset Management

2. Enterprise HRSD

3. Artificial Intelligence

4. Data Lake Solution

5. Greenfield Solution

6. Vendor Risk Management

7. Field Service Management

8. Professional Services

a. Service Configuration Management Process Program Support

9. Transition Out

4.0 PERFORMANCE DETAILS

4.1 PERFORMANCE PERIOD

The Period of Performance (PoP) shall be six month base period with four 12-month option periods with nine Optional Tasks. The overall Period of Performance shall not exceed 54 months.

Any work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO).

There are 11 Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, five are set by date:

New Year's Day January 1 Juneteenth June 19 Independence Day July 4 Veterans Day November 11 Christmas Day December 25

If any of the above falls on a Saturday, then Friday shall be observed as a holiday.

Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

Martin Luther King's Birthday Third Monday in January Washington's Birthday Third Monday in February Memorial Day Last Monday in May Labor Day First Monday in September Columbus Day Second Monday in October Thanksgiving Fourth Thursday in November

4.2 PLACE OF PERFORMANCE

Tasks under this PWS shall be performed at Contractor facilities. The Contractor shall identify the Contractor’s place of performance in their proposal submission.

4.3 TRAVEL

The Government does not anticipate travel under this effort.

5.0 SPECIFIC TASKS AND DELIVERABLES

The Contractor shall perform the following:

5.1 PROJECT MANAGEMENT

5.1.1 CONTRACTOR PROJECT MANAGEMENT PLAN

If migration is required, the Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, timeline, and tools to be used in execution of the contract. The CPMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks, and resource support. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPMP shall be concurred upon and updated in accordance with Section B of the contract. The Contractor shall update and maintain the VA Program Manager (PM) approved CPMP throughout the PoP.

Deliverable:

A. Contractor Project Management Plan

5.1.2 REPORTING REQUIREMENTS

If migration is required, the Contractor shall provide the Contracting Officer’s Representative (COR) with Weekly Progress Reports in electronic form in Microsoft Word and Project formats. The report shall include detailed instructions/explanations for each required data element, to ensure that data is accurate and consistent. These reports shall reflect data as of the last day of the preceding week.

The Progress Reports shall cover all work completed during the reporting period and work planned for the subsequent reporting period. The report shall also identify any problems that arose, and a description of how the problems were resolved. If problems have not been completely resolved, the Contractor shall provide an explanation including their plan and timeframe for resolving the issue. The report shall also include an itemized list of all Information and Communication Technology (ICT) deliverables and their current Section 508 conformance status. The Contractor shall monitor performance against the CPMP and report any deviations. It is expected that the Contractor will keep in communication with VA accordingly so that issues that arise are transparent to both parties to prevent escalation of outstanding issues.

The Contractor shall conduct an Annual Reporting Capability Review within the 4th quarter of the federal fiscal year. The review shall include comprehensive review of the platform’s reporting and analytics capabilities, with recommendations for enhancements.

Deliverable:

A. Weekly Progress Report

5.2 ERP

The Contractor shall provide an ERP solution that is cloud-based, multi-instance architecture PaaS with enterprise software subscription model licenses delivered via SaaS. The ERP solution shall provide VA with capability for ERP and to manage digital workflows for enterprise operations. The ERP solution shall include the following capabilities:

1. ITSM

2. ITAM

3. ITOM

4. ITBM

5. Digital Workplaces

6. Customer Service Management (CSM)

7. Security Operations (SecOps)

8. Integrated Risk Management (IRM)

9. Integration Center

10. Reporting and Analytics

11. Platform Tools

12. Production Instance

13. Non-Production Instance

14. Customer Performance Testing Instance

15. Enterprise Asset Management (EAM) – (Optional task)

16. Custom applications (Scope App) – (Optional task)

17. HRSD (Optional Task)

The ERP solution shall provide the capability to automate and streamline processes based on the Information Technology Infrastructure Library (ITIL) framework for ITSM, which include ITAM, ITOM, ITBM. The cloud-based platform shall include incident, problem, change, asset, and configuration management capabilities, along with scalability, integration features, application programming interfaces (APIs), support for plug-ins and external connectors, and the ability to develop custom applications to meet VA’s operational and security requirements.

The Contractor shall provide support and maintenance for the ERP solution, including regular updates, troubleshooting, and user training to ensure sustained performance and user adoption.

The Contractor shall provide an enterprise licensing model that enables the VA to monitor and report on actual license consumption and usage in real-time. Additionally, this licensing model shall accommodate an unlimited enterprise license arrangement, ensuring that the VA can utilize the capabilities of all related modules across all departments and user bases without any restriction on the number of users or instances. The model shall combine the transparency of actual usage tracking with the flexibility and cost-efficiency of an unrestricted, enterprise-wide license, thereby enabling the VA to scale its IT service management operations and associated modules seamlessly while maintaining thorough oversight of licensing utilization.

5.2.1 ITSM

The Contractor shall provide, configure, deploy and maintain SaaS-based ITSM capabilities (incident, problem, change, release, service request, service catalog, Configuration Management Database (CMDB), knowledge, etc., thereby improving overall IT service delivery and support, meeting VA business and technical requirements.

Additionally, the Contractor shall provide ITSM with the following capabilities:

1. Enable notifications and alerts, accessible dashboards and reports, and track the status of IT services.

2. Incident Management capabilities to efficiently handle and resolve IT incidents and shall

a. Provide incident logging, categorization, prioritization, and assignment.

b. Provide automated notifications and escalations that can be configured based on Service Level Targets and SLA response times.

3. Problem Management capabilities to identify and manage the root causes of Major Incidents and recurring incidents and shall:

a. Provide capability to avert occurrences and recurrences of impactful incidents.

b. Provide logging, categorization, and prioritization of problems.

c. Provide root cause analysis tools and permanent solution documentation.

d. Provide sustainable Known Error Database capabilities as an output of

Problem Management practice

4. Change Management capabilities to enable and control the lifecycle of all changes to reduce risk and disruption and shall:

a. Provide logging, categorization, and assessment of change requests.

b. Provide automated workflows for change approvals and tracking.

c. Include functionalities for impact analysis, risk assessment, and change calendar management.

d. Support Change Freezes and blackout periods

i. A change freeze is defined as a period of time where production environment changes, via Change Control, are stopped and only supported changes are allowed to proceed.

ii. Typically a change freeze or change blackout period is initiated during specific hardware/software upgrades on the affected system. This is a planned event that is communicated to all customers.

iii. A freeze can be enterprise wide, but usually only covers a specific system or service. The scope of a freeze/blackout can include all systems interfacing with the affected system/service and is planned, communicated, and executed by the product team performing the production upgrade functions.

e. Support Communications and Collaboration on the Change workflows

f. This concerns the required change control activities associated with the service or system being changed in the production environment. The project team (FTE and contractors) are required to work together to complete all change control requests and communications for their system.

g. Each change request has a workflow and the common workflow steps require all project team members to be involved and meet all normal requirements involved in the workflow steps. Common required workflow steps include approvals, communications, planning steps, execution, testing, documentation, and close out of change requests.

5. Service Request Management capabilities to streamline the handling of user requests and shall:

a. Provide service request logging, categorization, and prioritization.

b. Provide automated workflows for request fulfillment and approval processes.

c. Include self-service capabilities for users to submit and track their service requests.

6. Knowledge Management module to create, manage, and share knowledge articles and shall:

a. Provide capability to create and maintain a knowledge base with categorized and searchable articles.

b. Provide functionalities for article approval, feedback, and lifecycle management.

c. Integrate with other ITSM modules to offer contextual knowledge during incident and service request resolution.

7. Service Catalog module to present a centralized list of available IT services and shall:

a. Provide users with capability to browse, request, and track the status of IT services.

b. Include capabilities for service definition, approval workflows, and request fulfillment tracking.

c. Ensure integration with the Service Request Management module for seamless service delivery.

8. CMDB to provide the capability to establish a comprehensive repository of configuration items (CIs) and their relationships. CMDB shall:

a. Provide accurate and up-to-date data through automated discovery, integration and manual updates.

b. Provide data certification and reconciliation functions to validate and clean CMDB data.

c. Provide impact analysis functionality to support change management, and incident/problem resolution.

9. Service Level Management module to define, track, and manage service level agreements (SLAs) and shall:

a. Provide the capability to allow for creation of SLAs with measurable metrics and targets.

b. Provide functionalities for SLA monitoring, reporting, and breach notifications.

c. Include capabilities for tracking the performance of IT services against defined SLAs.

10. Self-Service Portal to empower users to resolve their own issues; verify and update their own information; and make requests using forms, Chat Services, Virtual Agent Services, Generative and Agentic Artificial Intelligence, and other modern technological advances. The portal shall:

a. Provide access to the service catalog, knowledge base, and request/incident tracking.

b. Provide personalized user interfaces and intuitive navigation.

c. Ensure mobile responsiveness for access from various devices.

11. Automated Release Management module to manage and automate the release of software and updates and shall:

a. Provide the scheduling and tracking of releases, ensuring minimal disruption to services.

b. Integrate with existing CI/CD pipelines and deployment tools for seamless release automation.

c. Provide functionalities for rollback management, release notes, and compliance reporting.

The Contractor shall ensure that Incident Management, Problem Management, Monitoring and Event Management, and Change Enablement/Management, are interoperable with each other and enable us to trend and analyze these relationships, such as incidents caused by change, root cause analysis and incident trend reporting.

5.2.2 ITAM

The Contractor shall provide, configure, deploy, and maintain a SaaS-based ITAM platform module(s) to support the Department’s enterprise-wide asset lifecycle needs.

The ITAM solution shall be capable of scaling for a large, complex enterprise with a geographically distributed and remote workforce. The Contractor shall ensure seamless integration of ITAM with ITSM modules for incident, problem, and change management to include third party integrations. The Contractor shall Correlate asset data with incidents to expedite troubleshooting and resolution. The Contractor shall utilize asset data for impact analysis during change management processes.

The Contractor shall provide ITAM with the following capabilities:

1. Asset Repository to maintain a centralized database of all IT assets and shall:

a. Ensure accurate recording of asset details such as asset type, serial number, location, status, and ownership.

b. Enable automated and manual updates to keep the repository current.

2. Asset Discovery tools to automatically identify and record IT assets across the organization’s network and shall:

a. Ensure the discovery tool captures data from physical, virtual, and cloud environments.

b. Perform scheduled discovery runs to maintain up-to-date asset information.

3. Lifecycle Management processes to track IT assets from procurement to disposal and shall:

a. Define stages for each asset's lifecycle, including acquisition, deployment, maintenance, and retirement.

b. Enable workflows for lifecycle stages to automate transitions and approvals.

4. Software Asset management (SAM) to track and manage software licenses, usage, and compliance and shall:

a. Enable license tracking for various software types, including on-premises and cloud-based solutions.

b. Provide functionalities for license reconciliation, renewal alerts, and compliance reporting.

5. Hardware Asset Management to track physical IT assets such as servers, laptops, and networking equipment and shall:

a. Ensure accurate details for each asset, including specifications, purchase date, warranty status, and maintenance history.

b. Integrate hardware management with service management for incident and change correlation.

6. Contract Management to track vendor contracts, warranties, and agreements and shall:

a. Enable alerts for contract renewals, expirations, and compliance requirements.

b. Provide functionalities for evaluating vendor performance and managing vendor relationships.

c. Track vendor details, such as contact information, SLAs, and performance metrics.

d. Enable the assessment of vendor reliability and effectiveness in providing goods and services.

e. Integrate Vendor Management with asset and financial management for comprehensive oversight.

7. Financial Management to track the cost, depreciation, and financial impact of IT assets and shall:

a. Enable budget allocation and expense tracking for asset-related activities.

b. Provide reports on asset depreciation, total cost of ownership, and return on investment.

c. Support multi-fund and multi-year budgeting and financial management program.

8. Compliance Management to ensure IT assets meet regulatory and industry standards and shall:

a. Provide audit trails and reporting capabilities to track asset history, changes, and compliance status.

b. Enable functionalities for internal and external audits, providing necessary documentation and reports.

9. Self-Service Portal to empower users to manage their assigned assets and shall:

a. Provide functionalities for submitting asset-related requests, tracking asset status, and performing self-audits.

b. Ensure mobile responsiveness for access from various devices.

5.2.3 ITOM

The Contractor shall provide a SaaS-based ITOM solution that enables enterprise-wide visibility, proactive monitoring, and optimization of IT infrastructure and services. The Contractor shall provide ITOM with the following capabilities:

Discovery module to identify and map devices, applications, and services across the enterprise, and shall:

a. Ensure Discovery accurately captures data from physical, virtual, and cloud environments.

b. Set up scheduled discovery runs and configure patterns to match the existing environment.

c. Validate and normalize discovered data to maintain data integrity and consistency.

Service Mapping to provide a comprehensive, real-time view of business services and their dependencies.

a. Ensure accurate mapping of applications, services, and underlying infrastructure components.

b. Regularly update and validate service maps to reflect current configurations and changes.

c. Enable impact analysis to understand the potential effects of changes or incidents on business services.

Event Management to aggregate and correlate events from various monitoring tools and systems.

a. Define event rules and thresholds to filter noise and highlight significant events.

b. Integrate Event Management with existing monitoring tools such as Nagios, SolarWinds, or Splunk.

c. Create actionable alerts and notifications for IT operations teams based on event severity and impact.

Operational Intelligence to analyze ITOM and real-time data, identifying trends and anomalies.

a. Use machine learning algorithms to detect patterns and predict potential issues before they occur.

b. Set up dashboards and reports to provide insights into the health and performance of IT services.

c. Facilitate proactive issue resolution through automated anomaly detection and alerting.

Orchestration to automate IT tasks and processes, reducing manual intervention and improving efficiency.

a. Develop workflows to handle routine tasks such as user provisioning, software distribution, and patch management.

b. Integrate Orchestration with external systems and applications to extend automation capabilities.

c. Ensure compliance with organizational policies and standards while automating critical processes.

Cloud Management module to manage and optimize cloud resources across multiple providers.

a. Enable provisioning, configuration, and governance of cloud assets through a single interface.

b. Implement cost management and optimization features to control cloud spending and resource usage.

c. Integrate Cloud Management with public and private cloud platforms such as AWS, Azure, and VMware.

Utilize the CMDB to maintain a comprehensive repository of configuration items (CIs) and their relationships.

a. Ensure accurate and up-to-date data in the CMDB through automated discovery and service mapping.

b. Implement data certification and reconciliation processes to validate and clean CMDB data.

c. Use CMDB data for impact analysis, change management, and compliance reporting.

Integrate ITOM modules with the Change Management process to streamline change planning and execution.

a. Use insights from Discovery, Service Mapping, and Event Management to assess change impacts.

b. Automate change approval workflows and notifications to improve efficiency and reduce delays.

c. Ensure changes are implemented with minimal disruption and maximum visibility into their effects.

Develop custom dashboards and reports to monitor ITOM activities and performance metrics.

a. Provide real-time visibility into the health, performance, and status of IT services and infrastructure.

b. Generate actionable insights for decision-makers to enhance operational efficiency and service delivery.

c. Regularly review and update dashboards to align with evolving business needs and priorities.

5.2.4 ITBM

The Contractor shall provide a comprehensive IT Business Management capability that enables the VA to align technology investments with business strategy, optimize resources, and improve decision-making across the enterprise. The Contractor shall provide ITBM with the following capabilities:

1. Project and Portfolio Management (PPM) capabilities to oversee and manage projects within the organization should

a. Provide functionalities for project planning, execution, tracking, and reporting.

b. Provide tools for portfolio management to prioritize and align projects with business objectives.

c. Provide capabilities for resource allocation, risk management, and milestone tracking.

2. Demand Management capabilities to capture, assess, and prioritize incoming demands and requests including:

a. Provision of a centralized demand intake process to collect and evaluate business needs.

b. Provision of tools for demand categorization, assessment, and approval workflows.

c. Integration with PPM for seamless transition from demand capture to project initiation.

3. Financial Management capabilities to track and manage IT financials, including budgeting, forecasting, and cost tracking including:

a. Enablement of functionalities for cost transparency, chargeback/show back mechanisms, and financial planning.

b. Provision of detailed financial reports and dashboarding capabilities to monitor IT spending and optimize IT investments.

c. Integration of financial data with project and portfolio management for comprehensive financial oversight.

4. Resource Management capabilities to effectively allocate and optimize resources across projects and operations including:

a. Enablement of functionalities for resource planning, allocation, and capacity management.

b. Provision of tools for skills management, resource forecasting, and utilization tracking.

c. Integration with PPM to ensure optimal resource deployment and workload balancing.

5. Application Portfolio Management (APM) and Enterprise Architecture capabilities to manage and optimize the organization's application portfolio including:

a. Enable functionalities for application inventory, assessment, and rationalization.

b. Provide tools to assess application value, cost, risks, and alignment with business objectives.

c. Provide capabilities for setting application roadmaps and lifecycle management.

d. Provide enhanced capabilities for enterprise modeling, visualization, and connection of business capabilities, technology, and data which enable VA organizations to plan and manage the entire IT architecture, and therefore align with business strategy

6. Agile Management capabilities to support agile methodologies and frameworks within the organization including:

a. Enablement of functionalities for backlog management, sprint planning, task tracking, and agile reporting.

b. Provision of collaboration tools, agile boards, and dashboards to monitor agile team performance.

c. Integration with PPM to align agile initiatives with broader project and portfolio goals.

7. Application Cost and Business Value Analysis to valuate total cost of ownership for applications and the ability to prioritize applications based on cost, risk, and alignment with enterprise goals.

8. Innovation Management capabilities to capture, evaluate, and develop innovative ideas within the organization including:

a. Enable functionalities for idea submission, evaluation, and prioritization.

b. Provide tools for managing innovation pipelines, tracking progress, and assessing impact.

c. Integrate with Demand Management to transition high-potential innovations into actionable projects.

9. Integration and Interface Management Capabilities to provide centralized management of integrations, interfaces, and system interactions including:

documenting and assessing the purpose, dependencies, and risks of integrations across the enterprise.

10. Technology Portfolio Management capabilities to manage the lifecycle of enterprise technologies, identifying risks, compliance gaps, and exceptions including providing tools to evaluate business services and applications using technology inventories, audit data, and discovered information.

11. Integrated Risk Management (IRM) capabilities to ensure integration with Governance, Risk and Compliance (GRC)/IRM modules to manage IT risks, compliance, and governance activities included.

a. Enable functionalities for risk assessment, mitigation planning, operational resilience, Business Continuity Management, Authority- To-Operate (ATO) Lifecycle Management, and overall compliance monitoring.

b. Provide tools for policy management, audit tracking, and regulatory reporting.

c. Integrate with PPM and Financial Management to ensure holistic governance and risk management.

12. Reporting and Dashboarding capabilities to allow development of custom dashboards and reports to monitor ITBM activities and performance metrics including.

a. Provide real-time visibility into project, portfolio, financial, resource, and agile management processes.

b. Generate actionable insights for decision-makers to enhance strategic planning and execution.

c. Regularly review and update dashboards to align with evolving business needs and priorities.

5.2.5 DIGITAL WORKPLACE

Digital Workplaces are designed to enhance productivity and streamline workflows by providing a unified, intuitive interface for users to perform their tasks more efficiently. By consolidating various functions, data, and applications into a single workspace, Digital Workplaces help users to focus on their core responsibilities without the need to navigate multiple modules or screens. The Digital Workplaces shall include the following key capabilities:

1. Provide a unified interface that combines multiple functionalities into a single, easy-to-navigate screen to include a cohesive user experience by integrating related tasks and data.

2. Provide the ability to create Personalized dashboards that are configurable to display relevant metrics, reports, and tasks that Users can tailor their workspace to show the information most pertinent to their role.

3. Provides real-time insights and analytics to help users make informed decisions.

4. Displays key performance indicators (KPIs) and trends relevant to the user's responsibilities.

5. Centralized task lists and calendars to manage and prioritize work.

6. Allows users to track the status of their tasks and collaborate with team members.

7. Seamless integration with other applications and third-party tools.

8. Enable users to carry out a wide range of activities without switching contexts.

9. Displays relevant contextual information and data points related to the task at hand.

10. Facilitates better understanding and faster resolution of issues.

11. Optimized for use across different devices, including desktops, tablets, and smartphones.

12. Ensures consistent and efficient user experience on any device.

5.2.6 CSM

The Contractor shall provide CSM capabilities within the SaaS platform to support delivery of exceptional customer service to both internal and external stakeholders, including customers outside of the VA network (e.g., Veterans). The Contractor shall provide the following CSM capabilities:

1. Provide Case Management tools for tracking, managing, and resolving customer cases.

2. Enable linking of cases to related resources, records, or services.

3. Support collaboration across multiple teams for issue resolution.

4. Deliver OmniChannel Support to seamlessly provide customer interactions across channels including email, chat, web portal, phone, and social media

5. Ensure case continuity when customers switch between channels.

6. Provide a centralized knowledge base to store and share articles, FAQs, and solutions.

7. Enable customers and service agents to quickly locate relevant information for faster resolution.

8. Provide a unified interface where customer service representatives can access cases, history, knowledge articles, and communication tools.

9. Ensure the workspace improves efficiency through streamlined navigation and automation.

10. Support integration with other SaaS platform modules such as ITSM, ITOM, and

Field Service Management (FSM).

11. Enable cross-departmental workflows to provide a complete view of customer interactions and service delivery.

12. Monitor products, services, and customer activity to proactively detect and address potential issues before they impact end users.

13. Provide automated alerts and workflows to initiate resolution activities.

14. Use machine learning and AI to route cases, recommend solutions, and identify patterns or trends in customer activity.

15. Provide self-service recommendations to reduce manual intervention.

16. Provide dashboards and reporting tools to measure customer satisfaction, service efficiency, and compliance with SLAs.

17. Enable leadership to identify areas for improvement in customer service delivery.

18. Provide AI-driven virtual agents capable of handling routine inquiries, requests, and transactions.

19. Ensure the virtual agent escalates to a live representative for more complex cases.

20. Provide tools to manage team productivity, assign cases based on skill sets, and monitor workload distribution.

21. Support scheduling, training identification, and performance evaluation of customer service staff.

22. Provide customer and partner portals for self-service, request tracking, and engagement.

23. Support communities, forums, and peer-to-peer collaboration for shared knowledge.

24. Provide capabilities to manage service contracts, entitlements, and SLAs.

25. Ensure cases and requests are linked to the appropriate customer accounts, products, or services.

26. Provide configurable workflows to handle complex case management processes.

27. Support multi-step approvals, escalations, and automation to ensure timely resolution

5.2.7 SecOps

The Contractor shall provide a comprehensive capability to manage and maintain Security Operations within the SaaS platform. The Contractor shall perform the following tasks:

Provide Security Incident Response tools and workflows to detect, investigate, and respond to security incidents.

Enable execution of predefined response plans to ensure consistent and timely mitigation of threats.

Support integration of multiple threat intelligence feeds into the platform.

Correlate threat data with enterprise activity to enhance situational awareness and accelerate response.

Provide a vulnerability response and risk management capability to track, prioritize, and remediate security weaknesses.

Support application vulnerability management to identify and mitigate risks within deployed software.

Provide patch orchestration workflows to streamline updates, reduce risk exposure, and maintain compliance.

Provide integrated risk management features to evaluate and manage enterprise risks aligned to security frameworks and policies.

Enable processes for managing large-scale or critical security incidents.

Provide escalation workflows, communication tracking, and cross-team coordination to contain and resolve incidents effectively.

Provide executive-level dashboards to track incident trends, vulnerabilities, patching status, and overall security posture.

Enable exportable reports to support compliance, audits, and leadership briefings.

Provide integration bundles to connect with enterprise security tools (e.g., SIEMs, monitoring solutions, endpoint protection systems).

Provide centralized security capabilities to consolidate incident, threat, and vulnerability information into a unified view.

5.2.8 INTEGRATED RISK MANAGEMENT (IRM)

The Contractor shall provide a comprehensive IRM capabilities within the SaaS platform to support GRC activities. The IRM Module shall allow business users, risk managers, and compliance officers to manage tasks, approve actions, and participate in workflows that strengthen enterprise risk posture. The Contractor shall perform the following tasks:

1. Core Business User Tasks

a. Provide functionality for business users to approve policy exceptions, evidence requests, and advanced risk assessments.

b. Enable users to report new compliance cases (e.g., policy violations) and view or respond to existing issues.

c. Allow users to respond to automated tasks generated by KRIs and related risk monitoring activities.

d. Provide access to IRM processes through a centralized portal where employees can view policies, submit requests, and track compliance activities.

e. Provide the ability for users to view, download, and update the status of business continuity and disaster recovery plans during exercises and real crisis events.

f. Enable participation in workflows for Business Impact Analysis (BIA), Business Continuity Planning (BCP), and crisis management, including reviewing and approving analysis outputs.

2. Advanced Risk and Compliance Management

a. Provide advanced quantitative and qualitative risk analysis tools to identify, measure, and mitigate risks.

b. Provide centralized policy and compliance management processes for creating, approving, and managing policies, standards, procedures, and regulatory requirements.

c. Automate the audit management lifecycle, including planning, scheduling, fieldwork, findings, and reporting.

d. Provide capabilities to assess, monitor, and mitigate risks posed by third-party vendors and partners.

e. Include modules for managing privacy obligations, Environmental, Social, and Governance (ESG) requirements.

f. Utilize advanced automation and AI to provide issue summarization, accelerate system certifications, enable continuous compliance monitoring, and automate regulatory update tracking.

g. Provide executive cybersecurity and compliance dashboards and customizable reporting for risk metrics, compliance posture, audit outcomes, and security trends.

h. Provide advanced workflows and accelerators for business continuity, crisis management, and resilience planning.

3. Integration, Reporting, and Accelerators

a. Enable cross-platform integration with ITSM, SecOps, CSM, and other enterprise systems to ensure risk data informs operational processes.

b. Provide configurable reports, dashboards, and visualizations to analyze compliance and risk data at multiple organizational levels.

c. Provide pre-built content, templates, and use case accelerators for frameworks (e.g., NIST, FedRAMP, ISO, HIPAA) to speed implementation and compliance alignment.

5.2.9 INTEGRATION CENTER

The Contractor shall provide a SaaS-based tool that enables secure, scalable, and governed interoperable integrations across the VA enterprise. The Contractor shall provide the following integration center capabilities and support all modules and their associated requirements.

1. Support Standard Protocols and APIs:

a. Provide REST, SOAP, OData, and GraphQL APIs to have the capability to connect to internal VA systems and external partner systems.

b. Ensure backward compatibility and API version management.

2. Enable Pre-Built and Custom Connectors:

a. Deliver pre-built connectors for common federal systems, cloud services, and

Commercial Off-The-Shelf (COTS) applications.

b. Allow VA technical staff to build and manage custom connectors through a low-code/no-code environment.

c. Provide ability to create custom integrations by building actions and connectors for VA internal and external systems.

3. Provide Secure Data Exchange:

a. Ensure all integrations comply with VA security and data governance requirements (FedRAMP High, FISMA, HIPAA).

b. Provide encryption in transit and at rest.

c. Enforce role-based access controls for integration activities.

4. Support Orchestration and Automation:

a. Enable workflow-driven integrations that allow business and IT users to automate cross-platform processes.

b. Provide event-driven triggers for real-time data…