PWS_MISI_DRAFT.docx

Memorials Integration Services and Innovation (MISI)

VA-26-00071371

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Office of Information & Technology (OIT) Benefits, Appeals and Memorials (BAM)

Memorials Integration Services and Innovation (MISI)

Date: June 30, 2026

VA-26-00071371

PWS Version Number: 1.2

Contents

BACKGROUND

The Department of Veterans Affairs (VA), Office of Information and Technology (OIT), Product Delivery Services (PDS), Benefits and Memorials (BAM), Memorial and Benefit Services (MBS), is responsible for delivering secure, reliable, and effective Information Technology (IT) solutions that support the Department’s mission. These solutions enable the efficient administration of benefits and memorial services provided to Veterans and their families. VA relies on Information Management and Information Technology (IM/IT) systems to achieve mission objectives and delivery timely, accurate, and compassionate services.

The MBS Product Line teams with NCA to establish modern enterprise services and solutions that increase efficacy and efficiency of memorial benefits for our nation’s Veterans. NCA oversees the largest cemetery system in the country with over four million Americans memorialized by burial in VA’s national cemeteries. The National Cemetery Administration (NCA) has designated Enterprise Interment Services System (EISS) as the authoritative system of record for burial and memorial benefits operations. The Office of Army Cemeteries (OAC) originally developed the EISS to support cemetery operations across Army cemeteries.

VA has acquired the Army’s EISS application and associated source code from OAC and, by the start of this contract, will have deployed EISS to the VA Enterprise Cloud (VAEC) and renamed it to VA-EISS. VA intends for VA-EISS to replace VA’s Burial Operations Support System – Enterprise (BOSS-E) and Memorial Benefits Management System (MBMS) systems (as described below).

EISS was created to standardize and streamline interment services across all 30 Army cemeteries, replacing older, fragmented systems. It supports daily scheduling, burial requests, funeral resource management, marker ordering, quality assurance, and administrative functions. VA-EISS will provide a modern, integrated platform for managing burial and memorial benefit services for VA. It will determine eligibility, schedule burials, certify interments, be used for ordering memorial products, and manage burial records. VA-EISS will improve service delivery, enhance the Veteran and family experience, increase operational efficiency, and reduce lifecycle support costs.

BOSS-E automates the manual, paper-intense recordkeeping and forms processing for interments in National, State and other Veterans’ cemeteries. It was developed to maintain electronic records of over 135,000 yearly interments; to support the VA corporate master Veteran identification initiative; provide electronic transfer of interment data between cemeteries and VA systems; and integrate the Automated Monument Application System (AMAS) to manage monument orders, deliveries, and tracking. BOSS-E is comprised of 10 applications and interfaces.

MBMS is a modernized, unified web-based platform replacing many of BOSS-E’s older applications. It was designed to: provide a single, consistent interface for NCA staff and partners; streamline and automate eligibility verification, pre-need and time-of-need scheduling, and burial operations. Serve Veterans and family members requesting services at the nation’s 135+ National Cemeteries. Consolidate functions from the National Cemetery Scheduling office, Eligibility Office, and National Cemetery Operations into one system. Before the recent decision to implement EISS at VA, VA intended to roll out MBMS to replace BOSS-E’s user-facing capabilities, eventually encompassing all NCA benefit delivery activities.

APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. “Federal Information Security Modernization Act of 2014”

2. Federal Information Processing Standards (FIPS) Publication 140-3, “Security Requirements for Cryptographic Modules”, March 22, 2019

3. FIPS Pub 199. “Standards for Security Categorization of Federal Information and Information Systems,” February 2004

4. FIPS Pub 200, “Minimum Security Requirements for Federal Information and Information Systems,” March 2006

5. FIPS Pub 201-3, “Personal Identity Verification of Federal Employees and Contractors,” January 2022

6. 10 U.S.C. § 2224, "Defense Information Assurance Program", as amended

7. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

8. Public Law 109-461 (P.L. 109-461), Veterans Benefits, Health Care, and Information Technology Act of 2006, as amended, Title IX, Information Security Matters

9. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”, as amended

10. VA Directive 0710, “Personnel Vetting Program,” September 8, 2025, https://www.va.gov/vapubs/index.cfm

11. VA Handbook 0710, “Personnel Vetting Program,” September 8, 2025, https://www.va.gov/vapubs/index.cfm

12. VA Directive 6102, “Internet/Intranet Services,” August 5, 2019

13. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and Guidelines,” as amended

14. Office of Management and Budget (OMB) Circular A-130, “Managing Federal Information as a Strategic Resource,” July 28, 2016

15. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed Services (CHAMPUS)”, as amended

16. NIST SP 800-66 Rev. 2, “Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule: A Cybersecurity Resource Guide,” February 2024

17. 45 C.F.R Parts 160 and 164, Subparts A and E, the Standards for Privacy of Individually Identifiable Health Information (“Privacy Rule”); and 45 C.F.R. Parts 160 and 164, Subparts A and C, the Security Standard (“Security Rule”); as amended

18. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended

19. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

20. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021 (see VA NOTICE 24-18, dated September 27, 2024, “Update to VA Directive 6500 Cybersecurity Program”, and VA Notice 25-07, dated 3/18/25, “Amending VA Directive 6500 to incorporate M-24-15”)

21. VA Handbook 6500, “Risk Management Framework for VA Information Systems VA Information Security Program,” February 24, 2021 (see VA Notice 25-01, dated October 15, 2024, “Update to VA Handbook 6500 Risk Management Framework for VA Information Systems VA Information Security Program”, and VA Notice 25-06, dated 3/18/25, “Amending VA Directive 6500 to incorporate M-24-15”, VA Notice 25-16, dated September 15, 2025, “Amending VA Handbook 6500 to Replace Enterprise Mission Assurance Support Services Tool With Office of Information Technology Governance Risk Compliance Tool, and VA Notice 25-17, dated September 22, 2025, “Rescission Of Office Of Information Security (OIS) Deputy Assistant Secretary (DAS) Memorandum – Requirements of Proper Plan of Action and Milestones (POA&M) Completion)

22. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI),” June 30, 2023

23. VA Handbook 6500.6, “Contract Security,” March 12, 2010 (see VA Notice 24-12, dated April 22, 2024, “Update to VA Handbook 6500.6, Contract Security, Appendix C VA Information and Information System Security/Privacy Language For Inclusion Into Contracts, As Appropriate”)

24. VA Handbook 6500.8, “Information System Contingency Planning,” March 25, 2025

25. VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018 (see VA NOTICE 25-10, dated June 9, 2025, “Use of Personally Owned Mobile Devices Policy Amendment of Department of Veterans Affairs Handbook 6500.10”, and VA Notice 25-15, dated August 22, 2025, “Update to VA Handbook 6500.10 Mobile Device Security Policy”)

26. VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017

27. OIT Process Asset Library (PAL), OIT Process Asset Library.

28. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

29. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014

30. VA Directive 6510, “VA Identity, Credential and Access Management,” September 3, 2024

31. VA Handbook 6510, “VA Identity, Credential and Access Management,” September 27, 2024

32. VA Directive and Handbook 6513, “Secure External Connections,” October 12, 2017

33. VA Directive 6300, “Records and Information Management,” September 21, 2018

34. VA Handbook, 6300.1, “Records Management Procedures,“ March 24, 2010

35. NIST SP 800-37 Rev 2, “Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy,” December 2018

36. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020)

37. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015

38. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” March 24, 2014

39. OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005

40. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019

41. OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008

42. Federal Identity, Credential, and Access Management (FICAM) Architecture, June 30, 2023 (FICAM Architecture (idmanagement.gov))

43. NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access,“ June 2018

44. NIST SP 800-63 Rev 4, 800-63A-4, 800-63B-4, 800-63C-4, “Digital Identity Guidelines,” August 1, 2025

45. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014

46. VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

47. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

48. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

49. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

50. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019

51. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008

52. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (P.L. 110–140), December 19, 2007

53. Section 104 of the Energy Policy Act of 2005, (P.L. 109–58), August 8, 2005

54. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 2, 2001

55. Executive Order 14148, “Initial Rescissions of Harmful Executive Orders and Actions,” dated January 20, 2025

56. VA Directive 0057, “VA Environmental Management Program,” October 25, 2022

57. OIS VAIQ #7424808 Memorandum, “Remote Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

58. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

59. “Veteran Focused Integration Process (VIP) Guide 4.0,” March 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

60. VA Memorandum “Proper Use of Email and Other Messaging Services,” January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

61. “Product Line Management Transformation Playbook” version 3.1, August 2023, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

62. NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020

63. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol Version 6 (IPv6),” November 19, 2020

64. Social Security Number (SSN) Fraud Prevention Act of 2017

65. Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23, 2018

66. C.F.R Title 15 Part 7, “Securing the Information and Communications Technology and Services (ICTS) Supply Chain”, as amended

67. Executive Order 14028, “Executive Order on Improving the Nation's Cybersecurity,” May 12, 2021, https://bidenwhitehouse.archives.gov/briefing-room/presidential-actions/2025/01/16/executive-order-on-strengthening-and-promoting-innovation-in-the-nations-cybersecurity/

68. OMB Memorandum M-22-09, “Moving the U.S. Government Toward Zero Trust Cybersecurity Principles”, January 26, 2022, https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf.

69. NIST SP 800-52 Revision 2, “Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations

70. OMB M-26-05, “Adopting a Risk-based Approach to Software and Hardware Security,” January 23, 2026

71. OMB M-21-31, “Improving the Federal Government’s Investigative and Remediation Capabilities Related to Cybersecurity Incidents,” August 27, 2021

72. NIST SP 800-88 Revision 1 “Guidelines for Media Sanitization,” December 2014

73. CISA Binding Operational Directive (BOD) 19-02: “Vulnerability Remediation Requirements of Internet-Accessible Systems,” April 29, 2019, BOD 19-02: Vulnerability Remediation Requirements for Internet-Accessible Systems | CISA

74. CISA BOD 22-01: “Reducing the Significant Risk of Known Exploited Vulnerabilities,” November 3, 2021, BOD 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities | CISA

75. CISA BOD 23-01: Improving Asset Visibility and Vulnerability Detection on Federal Networks.” Cybersecurity & Infrastructure Security Agency (CISA), BOD 23-01: Improving Asset Visibility and Vulnerability Detection on Federal Networks | CISA

76. VA Directive 6550, Pre-Procurement Assessment and Implementation of Medical Devices/Systems, June 03, 2019

77. VA Memorandum, “VA Security Controls,” January 17, 2025, https://www.voa.va.gov/DocumentView.aspx?DocumentID=5010

78. E.O. 13960, “Promoting the Use of Trustworthy Artificial Intelligence in the Federal Government,” December 3, 2020

79. E.O. 14319, “Preventing Woke AI in the Federal Government,” July 23, 2025

80. OMB Memorandum M-25-21, “Accelerating Federal Use of AI through Innovation, Governance, and Public Trust,” April 3, 2025

81. OMB Memorandum M-25-22, “Driving Efficient Acquisition of Artificial Intelligence in Government,” April 3, 2025

82. OMB Memorandum M-26-04, “Increasing Public Trust in Artificial Intelligence (AI) Through Unbiased AI Principles,” December 11, 2025

83. Attachment 0001 Memorials DevSecOps Application Systems Product List

SCOPE OF WORK

The Contractor shall provide project management, technical expertise, agile software development, DevSecOps, cybersecurity, system integration, testing, deployment, operations, maintenance/sustainment, and technical support services necessary to modernize, enhance, deploy, operate, maintain/sustain, and continuously improve the MBS Product Line.

The scope of this contract is to:

a) Integrate VA’s BOSS-E and MBMS capabilities into VA-EISS thereby producing VA-EISS.;

b) Provide Operations and Maintenance (O&M) for VA-EISS (and BOSS-E and MBMS until VA decides to decommission BOSS-E and MBMS, which will be after VA-EISS is fully operational and being used by VA);

c) Decommission the BOSS-E and MBMS systems; and

d) Continue O&M for VA-EISS for the remainder of the life of the contract.

PERFORMANCE DETAILS

PERFORMANCE PERIOD

The PoP shall be one 6-month Base Period with two 12-month Option Periods, along with four (4) Optional Tasks for additional Systems Teams, Agile Development Teams, Training Teams, and Transition Out Support. Any work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO).

There are 11 Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, five are set by date:

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

PLACE OF PERFORMANCE

Tasks under this PWS shall be performed at Contractor facilities. The Contractor shall identify the Contractor’s place of performance in their proposal submission. When travel is required, work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Office (CO) or the Contracting Officer’s Representative (COR).

TRAVEL

The Government anticipates travel to perform the tasks associated with the effort, as well as to attend planning and program-related meetings or conferences throughout the PoP.

The total estimated number of trips in support of the program related meetings for this effort is ten (10). Anticipated locations include the following, estimated at five (5) days in duration:

National Cemetery Scheduling Office - St. Louis, MO NCA Northeast District – Philadelphia, PA

NCA Southeast District – Decatur, GA

NCA Central District – Indianapolis, IN

NCA West District – Oakland, CA

Travel and per diem shall be in accordance with the Federal Travel Regulations (FTR) and requires written concurrence in advance of travel arrangements by the VA PM and COR. The Contractor shall provide cost estimates with each travel request. Each Contractor invoice must include copies of all receipts that support the travel costs claimed in the invoice.

Local travel within a 50-mile radius from the Contractor’s normal duty location is considered the cost of doing business and will not be reimbursed. This includes travel, subsistence, and associated labor charges for travel time. Travel performed for personal convenience and daily travel to and from work at the Contractor’s facility will not be reimbursed. Travel, subsistence, and associated labor charges for travel time for travel beyond a 50-mile radius of the Contractor’s facility may be authorized on a case-by-case basis and must be pre-approved by the COR.

SPECIFIC TASKS AND DELIVERABLES

Services shall include:

1. Agile software development, enhancement, modernization, and sustainment of VA-EISS.

2. Application and data integration services supporting internal and external VA business systems.

3. DevSecOps, CI/CD, infrastructure automation, configuration management, and release management.

4. Cybersecurity engineering, RMF compliance, vulnerability remediation, continuous monitoring, and Authority to Operate (ATO) sustainment.

5. Database engineering, data architecture, migration, and administration services.

6. Enterprise geospatial services, web mapping applications, and GIS platform support.

7. User experience, accessibility, and Section 508 compliance activities.

8. Operations, maintenance, monitoring, incident response, and service desk escalation support.

9. Training, documentation, knowledge management, and organizational change management services.

10. Transition support at contract completion, including transfer of knowledge, artifacts, documentation, and operational responsibilities.

The Contractor shall provide services to support IT DevSecOps for Memorial Benefits Services Product Line, Products in accordance with the working principles and definitions provided in Section 5.0. The Contractor shall provide dedicated teams of cross-functional staff to operate, build, maintain, and develop the VA-EISS platform and associated benefits systems with capabilities to streamline systems, improve scalability, increase availability of services, and enable more efficient delivery. The Contractor shall provide VA with iterations of Agile software development and CI/CD. The Contractor shall provide support services for legacy systems and shall support transitioning legacy systems to the BIP Platform and decommissioning legacy systems. The Contractor shall support the intake of business needs, prioritization, and delivery. The Contractor shall support and oversee initiatives and epics through initial business need definition, prioritization, and execution. The Contractor shall provide overarching architecture support. The Contractor shall identify dependencies, inputs, and outputs, the timeline for completion of integrated efforts, and processes to manage the overall integrated effort.

The Contractor shall perform all work in accordance with applicable Federal laws, VA policies, NIST guidance, RMF requirements, VA Enterprise Architecture standards, VA Product Lifecycle Management (PLM) guidance, and VA Enterprise Cloud operational requirements.

PROJECT MANAGEMENT

CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, timeline, and tools to be used in execution of the contract. The CPMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks, and resource support. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPMP shall be concurred upon and updated in accordance with Section B of the contract. The Contractor shall update and maintain the VA Program Manager (PM) approved CPMP throughout the PoP.

Deliverable:

A. Contractor Project Management Plan

TECHNICAL KICKOFF MEETING

A Technical Kickoff Meeting shall be held within 10 days after award. The Contractor shall coordinate the date, time, and location (which may be virtual) with the Contracting Officer (CO), the Contract Specialist (CS), MBS Product Line Manager, PMs, and CORs. The Contractor shall provide a Technical Kickoff Agenda to the CO, CORs, and VA PMs at least five business days prior to the meeting. The Contractor shall distribute the Technical Kickoff Agenda to all meeting attendees upon receipt of approval by the Government.

During the technical kickoff meeting, the Contractor shall display the Technical Kickoff Presentation which includes the details of the intended approach, work plan, and project schedule for each effort. At the conclusion of the meeting, the Contractor shall update the presentation with a final slide entitled “Summary Report” which shall include notes on any major issues, agreements, or disagreements discussed during the meeting. The Contractor shall distribute the Technical Kickoff Meeting Presentation to all attendees within three business days after the meeting.

The Technical Kickoff Meeting shall be held within 10 days of award for all Optional Tasks, including award of a new or renewal of an Optional Task for continuation of support services. The CO and CS need not attend these subsequent meetings.

Deliverables:

A. Technical Kickoff Agenda B. Technical Kickoff Presentation

REPORTING REQUIREMENTS

The Contractor shall provide a Monthly Status Report. The report shall provide accurate, timely, and complete product/project information. The detail and technical level of this report shall be appropriate for VA management and shall summarize, not replicate, the information contained in the Sprint Review. This report shall reflect data as of the last day of the preceding month. The Monthly Status Report shall include the following data elements for the Product Line and Product:

High-level schedule and milestones from the current reporting period (i.e., the prior month) through two months in the future

a) Epics or similar work completed and in progress

b) Work planned for the subsequent two months, when applicable

c) Risks and Issues

i. Contract-related issues uncovered during the month and especially highlight those areas with a high probability of impacting schedule or performance goals and their likely impact on same

ii. Explanations for any unresolved issues, including possible solutions and any actions required of the Government and/or Contractor to resolve or mitigate the issue, including a plan and timeframe for resolution

iii. Status on previously identified issues, actions taken to mitigate the situation and/or progress made in rectifying the situation

d) Original schedule of project management deliverables and the corresponding deliverables made during the current reporting period Software licenses at or nearing end of life and software security certificates nearing expiration.

Deliverable:

A. Monthly Status Report

ONBOARDING

The Contractor shall manage the onboarding of its staff. Onboarding shall include steps to obtain a VA network and email account, complete required VA training, initiate background investigations, and gain physical and logical access, which may include elevated privileges to the necessary development and test environments for the various systems to be enhanced.

A Contractor shall designate a Contractor Onboarding POC who shall track the onboarding status of all Contractor personnel. The Contractor (i.e., the Contractor Onboarding POC) shall be responsible for accurate and timely submission of all required VA onboarding paperwork to the COR or his/her onboarding designee. The Contractor shall provide for every employee the signed Contractor Rules of Behavior and VA Privacy and Information Security Awareness Training Certificate showing an employee completed the training, fingerprints, background investigation submission and status, GFE request, signature for GFE, Personal Identity Verification (PIV) card, Active Directory account, Remote Access Request, Elevated Privileges Request per environment, VA Tools training, and any other information deemed necessary for tracking by the Contractor, VA PM, or COR.

PROGRAM INCREMENT (PI) PLANNING

The Contractor shall support requirements management processes and participate in an Intake Review Board (IRB) to demonstrate traceability of demand requests, with VA priority strategic objectives, VA investments, and associated metrics for measuring and reporting execution, outcomes, value, and end-user satisfaction.

Program Increment (PI) Planning sessions are typically two- to four-day, cadence-based, face-to-face and/or hybrid virtual events. These sessions are essential for effectively organizing teams around prioritized requirements, with a strong focus on achieving outcomes that deliver shared value.

The Contractor shall create a PI Planning Process document to record the processes required to plan, communicate, and execute PI Planning sessions including dependencies, risks and issues, timelines, logistics and content for activities. The Contractor shall follow those processes to plan, manage, facilitate, and execute quarterly PI Planning sessions. The Contractor shall orchestrate collaboration, provide transparency, and adapt to dynamic priorities and conditions.

The Contractor shall create draft PI plans with VA PMs and obtain approval from them in advance before sharing this or any information with the Business stakeholders.

During PI planning, the Contractor shall create PI objectives that:

a. Provide a common language for communicating with business and technology stakeholders to include the value outcomes

b. Collaborate, contribute, and validate with the VA PM the establishment of Key Performance Indicators (KPI)’s, definitions of done, and additional reporting metrics

c. Create the near-term vision, which teams shall align to and develop during the PI

d. Document internal and external dependencies, requests, risks, and issues

Post PI planning the Contractor shall:

1. Provide a PI Out Brief Executive Summary which includes detailed summation of PI Commitments, alignment to VA strategic priorities, and value outcomes.

2. Provide PI Commitment Plans which illustrates how commitments align with strategic objective priorities, and value outcomes.

3. Provide PI Commitment Assessment Status Reports of teams’ progress to execute and deliver on commitments including burndown charts at the completion of every other Sprint

Deliverables:

A. PI Planning Process Document B. PI Planning Out Brief Executive Summary C. PI Commitment Plans D. PI Commitment Assessment Status Reports

RISK MANAGEMENT

The Contractor shall assist VA PMs in conducting Risk Management and document risks using VA approved processes and SDLC tools. The Contractor shall submit all risks to the VA PM within three days of risk discovery. The Contractor shall facilitate and participate in Risk Management by identifying, reviewing, and documenting risks and issues using the approved VA management tools. The Contractor shall work in accordance with the VA OIT Risk Management Plan to identify, analyze, respond to, manage, and monitor risks.

CONFIGURATION MANAGEMENT

The Contractor shall follow all activities and standards in the VA BAM OIT Portfolio and Product Line Configuration Management (CM) Plan. Any deviations from the standard CM plan need to be approved in advance. The Contractor shall use designated VA-approved tools and repositories for all software source code and electronic artifact configuration and version management. If assigned a Product using CM tools that are being deprecated, the Contractor shall assist the VA Tools team in migrating to the replacement CM tools.

The Contractor shall identify types of configuration items pertaining to each product and make recommendations for items to be placed under configuration management and change control. Configuration items may include source code, documents, technical stories, compiled and uncompiled software, libraries, diagrams, and models. The Government will make the final determination on components that must be under configuration management.

Additionally, the Contractor shall:

1. Provide change and configuration management activities in accordance with VA standards and processes and in coordination with VA PMs.

2. Coordinate configuration management activities with quality assurance, product development, testing, intake, schedule, risk and defect management, vendors, customers, and business stakeholder teams.

3. Audit build packages and release candidates for compliance and adherence to VA configuration management standards. Known defects shall not be promoted to Production.

Demonstrate build and release candidates to the appropriate government officials and Configuration/Change Control Board (CCB), made up of government OIT and Business stakeholders, to gain approval for Production implementation.

4. Ensure software and/or software releases and patches are managed using VA instances of VA TRM approved tools (i.e., Jira, GitHub, Slack, etc.)

5. Ensure that all product software and non-software artifacts are versioned correctly according to VA standards and follow a build/release promotion versioning approach which identifies all approved major, minor, and update changes.

Maintain Project and Product Artifacts baselined and versioned in the CM repository to show active and past histories of all software components, data, and documentation. The Contractor shall commit and push code to VA source control repositories daily. All product data and artifacts under development shall be maintained and kept updated in the VA repository daily.

Maintain all baselines of software, software builds, and electronic artifacts in the VA repository, labeling updates, and versions.

DATA ANALYTICS

The Contractor shall provide recommendations for data innovation and data-driven AI/ML Solutions. The Contractor shall incorporate data analytics requirements into designs and data pipelines to extract, transform and load data into approved data analytics platforms. The Contractor shall enable FinOps principal capabilities to enable the government’s visibility and informed decision-making as to solutions by creating, monitoring, and improving forecasting, planning, and reporting cloud utilization.

The Contractor shall recommend and develop Business Intelligence (BI) solutions for the portfolio and product lines to enable data driven decisions and support decommissioning efforts.

The Contractor shall:

1. Deliver cross-cutting tools for analytics, provide complex data analysis, data migration, data aggregation, and implement emergent data practices such as pattern recognition and data mining

2. Interpret and mine data to identify patterns and trends to determine how business decisions influence business improvement initiatives and decision making

3. Perform statistical analysis, detect anomalies, identify outliers, provide mitigation strategies, and provide predictive strategies and outputs to inform business line operations Create reports, charts, models, and tools to help tell stories to inform business best practices

4. Detect and resolve data quality issues and perform analysis on the cause and effect of errors/deficiencies

5. Perform gap analysis of the structure, governance, capability, and measurements of the data analytical environment

6. Recommend, design, implement and support methodologies and best practice around data governance frameworks to include data classification, data access and security, data privacy, data retention, data quality, data sharing, and definitions for clear roles and responsibilities and decision-making authorities.

7. Deliver data analytic integration strategies and solutions on optimal ways to integrate data from various BAM sources and internal and external VA agencies such as NCA, VBA, VBA, VHA, and other Corporate VA sources.

8. Analyze and document the ability to manage data at scale, including the ability to handle large volumes of data, ensure data quality and accuracy, and meet any regulatory or compliance requirements

9. Develop Data Models, Data Dictionaries, Data migration strategies, plans, tests, database designs

10. Document feature, solution, and architecture design information details in the Solution Architecture Package for VA PM/COR review and approval. Document potential compliance or technology-based limitations that may impact future solution delivery

11. Establish data baselines, analyze data requirements including how data is queried, and recommend opportunities to optimize data use and database performance

12. Recommend effective Business Intelligence (BI) solutions including:

a. Data Extract, Transform, Load (ETL) and Extract, Load, Transform (ELT) processes, data consolidation techniques, data validation procedures, integrating multiple VA data sources.

b. Data storage and management processes to ensure efficient data retrieval and analysis from centralized locations for BI reporting and analytics.

c. Data governance policies, data stewardship roles, and data quality management processes in supporting BI outputs.

13. Recommend technical solutions for AI-based predictive analysis toolsets to enable data driven decision-making in verification and processing of VA claims and benefits.

14. Recommend technical solutions for predictive modeling and data mining support to classify categorical variables and to estimate continuous variables using advanced mathematical techniques. Provide integration of models into reports, dashboards, analysis, and business processes.

ENHANCING VA-EISS WITH BOSS-E AND MBMS CAPABILITIES

VA-EISS is developed using Microsoft technologies, including C#, .NET, and the Blazor framework, and integrates with Geographic Information System (GIS) capabilities to support cemetery mapping and operational functions. VA’s BOSS-E system is built on Oracle databases with Java and REST services. VA’s MBMS system is a modernized, API-driven platform using React, Ruby on Rails, Node.js, and Oracle (plus possibly NoSQL for memorial content), integrated into VA’s broader microservices architecture. VA-EISS, BOSS-E, and MBMS are all deployed in the VAEC. See Attachment 0001 for more information about EISS, BOSS-E and MBMS.

The Contractor shall use enhance and/or integrate VA’s BOSS-E and MBMS capabilities into VA-EISS, thereby producing VA-EISS 2.0 using the agile software development methodology, DevSecOps, and the Software Development Lifecycle (SDLC), Agile Development Teams of sections 5.5, 5.5.1, 5.5.2, 5.5.3, 5.5.4, and 5.5.5, and System Teams of sections 5.4, 5.4.1, 5.4.2, 5.4.3, and 5.4.4.

The Contractor shall achieve a VA-EISS production deployment and operational readiness by October 01, 2027.

ARCHITECTURE AND ENGINEERING SUPPORT

The Contractor shall develop architecture in accordance with VA policy, Federal law, best practices, and product line guidance. The Contractor shall ensure secure, efficient, innovative, and holistic design, development, execution, and maintenance of VA’s strategic and mission priorities necessary to support delivery of service to Veterans. The Contractor shall facilitate architectural collaboration to ensure consistency and common architectural concepts including emerging designs and tradeoffs that may be implemented upon government approval. The Contractor shall provide documentation and artifacts that includes details necessary to satisfy the VA Systems Inventory (VASI), VA information assurance systems, VA FINOPS systems, and VA / Federal Enterprise Architecture mandates.

The Contractor shall provide solution, architecture, and engineering support to enable the portfolio-level strategy for secure, modern, BAM enterprise solutions, services, and data. The Contractor shall identify, enable, implement, and expand the utilization of benefits common services, and solutions. The Contractor shall implement a strategy to re-use and share capabilities across products to realize the BIP capabilities including resiliency, scalability, security, and data quality and economies of scale by utilizing modular design patterns. The Contractor shall provide recommendations that offer innovation and improve the User Experience (UX) to include decreased systems overlap, elimination of siloed systems and data, and improved use of authoritative data and data integrations. The Contractor shall integrate data analytics requirements in designs to enable data pipelines and data analytics platforms. The Contractor shall design, develop, operationalize, and maintain solutions using AI/ML to enable new business capabilities that increase the speed and efficiency of business processes and reduce the number of user touches in BAM PL products and services. The Contractor shall develop, operationalize, and maintain business intelligence data for the portfolio and product lines to enable data-driven decisions and support decommissioning efforts. The Contractor shall deliver cross-cutting tools for analytics, provide data analysis, data migration, data aggregation, and introduce emergent data practices such as pattern recognition and data mining. The Contractor shall:

1. Support functional, non-functional, compliance, and legacy product architecture requirements

2. Provide support for technical analysis, solution, and design

3. Provide requirements gathering, solutioning and coordination support to enable BIP tenancy

4. Optimize solution reusability in the development of architecture patterns and solution delivery

5. Provide Solution Alternatives or Analysis of Alternatives for Government decision making.

6. Maintain prioritized Portfolio and Product team backlog of architectural/platform requirements to include configuration and alignment of all required environments

7. Create and maintain enterprise architecture, designs, and strategies in an iterative manner over the course of Sprints and PIs

8. Develop and update Data Models and Data Dictionaries

Architecture Documentation Artifacts: The Contractor shall develop, execute, deliver, update, and maintain Portfolio, Product Line, Product, and Tenant Architecture documentation, artifacts, and databases inclusive of systems, services, and data.

The Contractor shall adhere to the recommendations contained in the VA EA Architecture Style Guide (ASG). The Contractor shall upgrade legacy and existing product documentation artifacts and databases to comply with the ASG standards as the functionality is modified. In addition to overarching BIP architecture, BIP Tenant architecture needs to be represented at the Product Line and Product levels.

The ASG includes, but is not limited to, the following artifacts:

1. Strategy Domain (Capability to Organizational Development Mapping, Capability to Operational Activities Mapping)

2. Data and Information Domain (Conceptual, Logical, and Physical Data Models which include entity-relationship diagrams and data element dictionaries)

3. Business Domain (Operational Resource Flow and Operational Rules Model)

4. Systems and Application Domain (Systems Interfaces, Systems Resource Flows, System/Services Rules Model)

5. Network and Infrastructure Domain (Network Topology Diagrams)

6. Security Domain (Security Controls)

Service Catalog: The Contractor shall maintain a comprehensive catalog of technology resources, software, systems, and services. The Service Catalog shall include a description, identify the owner, and include the environment availability status.

Solution Architecture Package: In accordance with new requirements and proposed capabilities, the Contractor shall develop and deliver solutioning documentation artifacts that enable the Government to make informed decisions for proposed future target architectures. A typical package could include:

Architecture Status Reports: The Contractor shall review technology resources, software, systems, and services for compliance to VA Enterprise Architecture. The Contractor shall report upon progress to re-use technology and capabilities across the Benefits Enterprise. The Contractor shall report compliance issues in the Architecture Status Report. The Contractor shall make recommendations for changes and updates to improve existing product architectures and technical approaches to improve security, including zero trust, operational efficiencies, and resiliencies.

Deliverable:

A. Architecture Documentation Artifacts

SYSTEM SUPPORT

System Support Teams are specialized groups of cross-functional individuals dedicated to providing product support which includes comprehensive operations, maintenance, and sustainment of application system support services and building and supporting Agile Continuous Integration and Continuous Delivery (CI/CD) environment pipelines. These teams provide Product specialty expertise, support for the continuous integration, automated builds, verification testing, automated build verification, delivery, automated deployment, and database support.

The Contractor shall provide System Teams to enable Product support inclusive of AI/ML Operations. The Contractor shall integrate System Teams through all SDLC phases, including Sprint and PI planning activities. System Teams shall achieve continuous compliance including ATO, Section 508, and Zero-Trust Architecture (ZTA) by providing all associated documentation and artifacts.

Each System Team shall be comprised of the appropriate distribution of cross functional roles with the requisite mix of labor categories, experience, skills, and expertise to execute comprehensive Product support across all environments.

The team size required to provide the System Team support shall be determined by VA based on its analysis. There are five (5) categories of team sizes, named Levels 1 through 5 inclusive. Team sizes may be combined if Product needs additional resources, and these would perform as a single team. For example, a product line estimates 45 staff members are needed to support its products.

The range of required dedicated full-time equivalent (FTE) count for each team size is as follows:

The Contractor shall maintain or exceed Service Level Targets:

*UAT environments shall adhere to the Production Service Level Targets.

**Core hours are Mon – Sat 6 AM to 10 PM Eastern, and Sun 6 AM to 3 PM Eastern, except for Federal holidays

During the Base Period, the Contractor shall provide a Systems Team as specified in Section 5.4. The Government anticipates exercising additional System Teams to support Product Lines and Products throughout the base and option periods per Optional Task 1 at Section 5.9 to provide expertise and support for the Application Systems Products identified in Attachments 0001

OPERATIONS AND INFRASTRUCTURE SERVICES SYSTEM TEAM

The Contractor shall work in concert with Product teams to achieve holistic and seamless product support. Each System Team shall comprehensively support the security, operations, sustainment, maintenance, resiliency, accessibility, performance, core services, technical standards, architectural compliance, operational capability testing, audits and reviews, integration with external systems, triage and resolution support of issues, proactive monitoring, contingency and capacity planning, and recovery for its assigned Product. KPI baselines shall be established at the beginning of an increment, and incremental improvements towards DevSecOps maturity shall be agreed upon at the beginning of the increment and measured at the end of the increment. Prior to each sprint, the Contractor and VA shall agree upon, in writing, a sprint cadence and a Definition of Done for the upcoming sprint increment, including required deliverables.

The Contractor shall use VA's implementation of Jira and GitHub, or other VA-approved toolsets, to provide a single authoritative project and product data and artifact repository. All product data and artifacts under development shall be maintained and updated in the VA repository daily. The following artifacts shall be checked back in daily:

· Scheduled product sprints and backlog

· Product Agile requirements

· Product risks and issues

· Product configurations, changes, and version descriptions (major or minor)

· Product test plans and execution

· Product planning, operations, maintenance, and engineering documentation

· Linkages to correlate requirements to change orders to configurable items to risks, impediments, and issues to test cases and test results to show full traceability The Contractor shall input all requirements, changes, tests performed, and test results in the approved VA project management tools to show evidence of code coverage and test coverage of all requirements specified.

The Contractor shall:

· Perform all operations and maintenance support services including job scheduling and execution, backup and restoration activities, performance, and dashboard monitoring.

· Apply Operating…