PWS RFI Copy.docx

Information Technology (IT) Support

VA-24-00043029

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Debt Management Center (DMC)

Information Technology (IT) Support

Date: March 30, 2024

VA-24-00043029

PWS Version Number: 1.0

DRAFT

Contents

1.0 BACKGROUND

The Department of Veterans Affairs (VA), Office of Information & Technology (OIT) strives to provide high quality, effective, and efficient Information Technology (IT) services to those responsible for providing care to the Veterans at the point-of-care as well as throughout all the points of the Veterans’ health care in an effective, timely and compassionate manner. VA depends on Information Management/Information Technology (IM/IT) systems to meet mission goals.

The mission of the Debt Management Center (DMC) is to collect debts resulting from an individual’s participation in Department of Veterans Affairs (VA) benefit programs and VA provided healthcare in the most efficient and cost-effective manner while maintaining compassionate, high-quality service to Veterans and their families.

The DMC operates as a franchise fund, also known as a working capital fund. The DMC reports to the Deputy Assistant Secretary for Finance under the Office of Management. Currently, DMC is responsible for the management of debts incurred from the following benefits programs: education chapters 30, 1607, 1606, 32, 34, 35, and 33; compensation and pension; loan guaranty; and Veterans retraining assistance; as well as other debts including First Party Medical Co-pays that can be offset through withholdings from current compensation and pension payments.

The Information Technology Division (ITD) supports the DMC’s ability to perform debt collection by developing, sustaining, and securing the DMC owned IT applications and systems that enable debt collection activities to occur. ITD reports both to the DMC which is the primary business customer and resource owner as well as to OIT via the Financial Technology Service (FTS) in Austin, TX which is currently under the Software Product Management (SPM) organization. This dual relationship ensures DMC systems are both financially resourced as well as maintained and accountable to within OIT standards.

The mission of ITD is to provide high-quality IT infrastructure, software engineering/development, including system and data, architecture, and database support services to the DMC in support of the DMCs overall mission of providing high-quality financial services, exceeding the expectations of our Federal customers, inspiring their trust and empowering them to focus on their core missions.

The objective of this acquisition is to acquire software engineering and development support, software architecture expertise, as well as application administration and other support needed to perform software development life cycle (SDLC) tasks in the development and support of applications and systems associated with current and future DMC environments. This acquisition is also needed to handle the day-to-day tasks associated with the management of increasingly complex environments managed by DMC. This acquisition provides increased capabilities for the Information Technology Division (ITD) to support emerging development tasks not previously identified as well as requirements associated with VA partner modernization efforts.

The base period of this TO requires development and sustainment support to ITD for DMC systems to include sustainment of fielded systems as well as modernization activities to stay current with external VA modernization mandates.

The Government’s objectives are to:

1. Reduce operational costs.

2. Enhance Government operations, particularly in development and support of applications.

3. Enhance consistency with development best practices from industry to the maximum extent practicable.

4. Allow flexibility in meeting variable demands.

5. Improve Government operations, particularly accountability and performance reporting; and

6. Provide procedural checks and feedback to improve compliance and management control on processes.

7. Increase automation of system processes to improve resilience and fault tolerance and recovery from any issues.

2.0 APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. 44 U.S.C. § 3541-3549, “Federal Information Security Management Act (FISMA) of 2002”

2. “Federal Information Security Modernization Act of 2014”

3. Federal Information Processing Standards (FIPS) Publication 140-2, “Security Requirements for Cryptographic Modules”

4. FIPS Pub 199. “Standards for Security Categorization of Federal Information and Information Systems,” February 2004

5. FIPS Pub 200, “Minimum Security Requirements for Federal Information and Information Systems,” March 2006

6. FIPS Pub 201-2, “Personal Identity Verification of Federal Employees and Contractors,” August 2013

7. 10 U.S.C. § 2224, "Defense Information Assurance Program"

8. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

9. Public Law 109-461, Veterans Benefits, Health Care, and Information Technology Act of 2006, Title IX, Information Security Matters

10. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”

11. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, https://www.va.gov/vapubs/index.cfm

12. VA Handbook 0710, “Personnel Security and Suitability Program,” May 2, 2016, https://www.va.gov/vapubs/index.cfm

13. VA Directive and Handbook 6102, “Internet/Intranet Services,” August 5, 2019

14. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and Guidelines,” January 18, 2017

15. Office of Management and Budget (OMB) Circular A-130, “Managing Federal Information as a Strategic Resource,” July 28, 2016

16. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed Services (CHAMPUS)”

17. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended, January 18, 2017

18. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

19. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021

20. VA Handbook 6500, “Risk Management Framework for VA Information Systems VA Information Security Program,” February 24, 2021

21. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI),” March 12, 2019

22. VA Handbook 6500.5, “Incorporating Security and Privacy into the System Development Lifecycle,” March 22, 2010

23. VA Handbook 6500.6, “Contract Security,” March 12, 2010

24. VA Handbook 6500.8, “Information System Contingency Planning,” April 6, 2011

25. VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017

26. OIT Process Asset Library (PAL), https://www.va.gov/process/ . Reference Process Maps at https://www.va.gov/process/maps.asp and Artifact templates at https://www.va.gov/process/artifacts.asp

27. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

28. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014

29. VA Handbook 6508.1, “Procedures for Privacy Threshold Analysis and Privacy Impact Assessment,” July 30, 2015

30. VA Handbook 6510, “VA Identity and Access Management,” January 15, 2016

31. VA Directive and Handbook 6513, “Secure External Connections,” October 12, 2017

32. VA Directive 6300, “Records and Information Management,” September 21, 2018

33. VA Handbook, 6300.1, “Records Management Procedures, “March 24, 2010

34. NIST SP 800-37 Rev 2, “Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy,” December 2018

35. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020)

36. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015

37. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” March 24, 2014

38. OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005

39. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019

40. OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008

41. Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance, December 2, 2011, (NOTE: Part A of the FICAM Roadmap and Implementation Guidance, v2.0, was replaced in 2015 with an updated Architecture (https://arch.idmanagement.gov/#what-is-the-ficam-architecture)

42. NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access, “ June 2018

43. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, “Digital Identity Guidelines,” updated March 02, 2020

44. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014

45. Draft National Institute of Standards and Technology Interagency Report (NISTIR) 7981, “Mobile, PIV, and Authentication,” March 2014

46. VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

47. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

48. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

49. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

50. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019

51. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008

52. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

53. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

54. “Veteran Focused Integration Process (VIP) Guide 4.0,” January 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

55. VA Memorandum “Proper Use of Email and Other Messaging Services,” January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

56. “DevSecOps Product Line Management Playbook” version 2.0, May 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

57. NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020

58. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol Version 6 (IPv6),” November 19, 2020

59. Social Security Number (SSN) Fraud Prevention Act of 2017

60. Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23, 2018

61. VA Memorandum “Vulnerability Management for Department of Veterans Affairs Information Systems,” October 1, 2022,

3.0 SCOPE OF WORK

The Contractor shall provide support to the DMC ITD for the IT infrastructure, operations, software development, and various initiatives in support of the DMC to accomplish its debt collection functions on behalf of the VA.

The Contractor shall provide support to the DMC system environment outlined in section 3.1 below. This includes on-going modernization projects, new software projects to support emerging business requirements, maintenance releases, and emergency software releases for supported DMC systems. The Contractor shall perform resource planning in support of new software projects, maintenance releases, emergency software releases, and operations and maintenance support. The Contractor will make proactive recommendations to increase capabilities and resilience of these systems. The Contractor shall manage their staffing/resource levels and coordinate with DMC Product Owners and ITD leadership and designated IT personnel, as needed, to understand schedule timelines.

The scope of services required includes the following functional areas and tasks:

1. Project Management

2. Technical Writing

3. Software Development and Deployment

a. Establishing and maintaining Continuous integration/Continuous Deployment (CI/CD) pipelines as necessary

b. Quality Assurance

c. System Analysis

d. System Design

e. System Engineering

f. Capacity Planning

g. Vulnerability remediation

h. Section 508 remediation

4. Production Support

a. Application

b. Database

c. Integration

d. Patching and bugfixes

5. Infrastructure Support

a. System Administration

b. Vulnerability remediation

c. Information Assurance Support

6. Cloud Solution Design and Migration

a. Support for Cloud-based systems, software, or applications

b. Support for migrating systems and applications from on-premises to a Cloud solution

7. Database Development

a. Data Modeling

b. Data Normalization

c. Database Design

d. Database Performance Engineering

e. Extract Transform and Load (ETL)

f. Vulnerability remediation

8. Project Support

a. Scrum Master

b. Technical Writing

c. Project Management

4.0 DESCRIPTION OF CURRENT TECHNICAL ENVIRONMENT

Following is an overview of the current DMC IT Infrastructure and Technical Environment as well as Software Development Lifecycle (SDLC):

3.3.1 VA DMC IT SOFTWARE INFRASTRUCTURE

The DMC IT Software Infrastructure currently consists, but is not limited to, the following products:

1. Desktop Environment

a. Microsoft Windows 10

b. Microsoft Teams

c. Office 365

2. Server Operating Systems

a. Red Hat Enterprise Linux

b. Windows Server

c. IBM z/OS

3. Database Software

a. Microsoft SQL Server

b. Microsoft SQL Server Reporting Services (SSRS)

c. Microsoft SQL Server Integration Services (SSIS)

d. Microsoft SQL Management Studio

e. IBM Data Virtualization Manager

4. Development Pipeline

a. Jira

b. Maven

c. Fortify

d. Nexus

e. GitHub

f. Jenkins

g. Endevor

5. Software Languages and Environments

a. Java

b. Python

c. Ruby

d. IBM Enterprise COBOL for z/OS

e. MuleSoft Anypoint Platform

f. CA 7

g. Microsoft T-SQL

h. Microsoft SharePoint

i. Microsoft Power BI

j. Veterans Affairs Enterprise Cloud – Amazon Web Services and Microsoft Azure

k. NEAR STAR DataServer Manager

l. LCDS Print Description Language

This list may change based on contractor recommendations or government needs.

3.3.2 VA DMC IT HARDWARE INFRASTRUCTURE

The DMC IT hardware infrastructure currently consists of:

Development (DEV) Servers

Above table data is current as of Dec 31, 2023.

IT hardware at the server and operating system (OS) level is provided as a service to DMC through responsible OIT parties or cloud provider. A large majority of infrastructure is provisioned within The Austin Information Technology Center (AITC). DMC is only responsible for application-level development and configuration in most cases.

3.3.3. VA DMC APPLICATION ENVIRONMENTS

The following provides an overview of the application environment at DMC. The mainframe legacy applications are written in COBOL and the server-based applications are written in Java. The following are major applications maintained by the DMC.

Centralized Accounts Receivable System (CARS) - CARS refers to both the legacy mainframe application as well as the larger backend infrastructure that supports the system as a whole.

a. CARS Application: It is a combination of JCL and custom COBOL software that automates the aging of debts, postal correspondence, reporting and interfacing with external financial systems. CARS houses and maintains the master debt record in Virtual Storage Access Method (VSAM) format for debts being serviced by the Debt Management Center. Interfaces are via File Transfer Protocol with support for Transport Layer Security (FTPS), Secure Shell (SSH) File Transfer Protocol (SFTP), Connect:Direct and IBM Data Virtualization Manager. Debts are referred to and updated in CARS nightly via one of the above interfaces. DMC is responsible for the software development, sustainment, configuration and interfaces of CARS and the associated non-production environments.

b. Application Program Interface (API) Environment: CARS also encompasses an API platform running on the Mulesoft Anypoint Platform. DMC uses the GovCloud instance of the Anypoint Platform to manage customer hosted Mulesoft runtimes located in a VA datacenter. These APIs connect CARS to external systems such as VA.gov and the DMC VAMS Salesforce Application (see item e below). The Mulesoft Anypoint Platform is also used to consume Kafka events from other VA and external business partners. It is expected that the mainframe application will be migrated to a SQL Database, SSIS packages and Mule APIs during the period of performance of this TO.

c. Databases: CARS contains a Microsoft SQL Database that tracks the master record, additional information, and history. This database populates a corresponding data warehouse that DMC users access with PowerBI. DMC currently supports 14 production databases. Additionally, there are corresponding lower-level environments for each where applicable.

d. CARS Supporting Infrastructure: Additional infrastructure is present to support batch/file transfers to and from CARS utilizing File Transfer Protocol with support for Transport Layer Security (FTPS) and Secure Shell (SSH) File Transfer Protocol (SFTP). There are a total of 300 to 500 programs that run daily and interface with 22 external systems.

e. User interface: The Centralized Accounts Receivable Online System (CAROLS) was the legacy user interface to the CARS master record and allowed viewing and updating information stored in the master record. The Veterans Account Management System (VAMS) has replaced the CAROLS user interface. VAMS is a Salesforce application that is outside the scope of this task order.

f. Ancillary Tools: Batch programs written in Java that support various ETL processes and Microsoft SQL databases that support these processes. These processes include referring debts to the Department of Treasury Centralized Receivables Service as well as building CARS transactions for various business processes.

3.3.4 VA BENEFIT PROGRAMS MODERNIZATION

The Veterans Benefit Administration (VBA) is undergoing a modernization program to replace both the Benefits Delivery Network (BDN) and the Financial Accounting System (FAS). Both systems are upstream of DMC and the modernization of FAS and sunset of BDN require changes to the current DMC environment to allow for continued debt processing. The new VBA application is referred to as the Enterprise Management of Payments, Workload and Reporting for VA (eMPWR-VA). eMPWR is solely a VBA system, but the DMC is required to build and maintain connections to both VBA’s Benefit Integration Service (BIS) and the eMPWR-VA API’s and Kafka event platform in the new architecture.

3.3.5 SDLC - SCALED AGILE FRAMEWORK (SAFe)

DMC currently utilizes an agile methodology in its approach to software development. In conjunction with the larger VA transition, it is currently undertaking an effort to fully migrate to SAFe to capitalize on the efficiencies and improvements of that methodology. SAFE is envisioned to utilize three-month Program Increments (PI) made up of two-week sprints. Annually there would be four PI increments during the year. Each PI would be kicked off using a PI Planning (section 5.2.1) session in accordance with the SAFe methodology. The PI sessions are organized with the DMC Business representatives and applicable Product Owners and ITD Federal Program Managers and leadership to determine portfolio priorities for the next PI. IT contract participation will be as required to inform priorities.

5.0 PERFORMANCE DETAILS

6.0 PERFORMANCE PERIOD

The period of performance shall be 12 months from date of award, with four 12-month option periods and one Optional Task. The overall period of performance shall not exceed 60 months.

Any work at the Government site shall not take place on Federal holidays or weekends unless directed by the COR. If required, the COR may designate the Contractor to work during holidays and weekends.

There are eleven (11) Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, four are set by date:

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

7.0 CONTRACTOR PERSONNEL HOURS OF AVAILABILITY

Contractor personnel shall maintain a work schedule that coincides with the schedule of the DMC organizations that they support. Contractor personnel shall provide services on normal Federal Government workdays during the core hours of 7:00 a.m. Central Time (CT) to 6:00 p.m. CT. The Government may also require onsite support after core hours for activities covered under PWS Task 5.3 Operations and Maintenance and its subparagraphs during the hours of 6:00 p.m. CT to 6:00 a.m. CT. Contractor services at DMC sites must not occur on Federal holidays or weekends, unless authorized in advance by the COR. In general, Contractor duties will be performed during normal business hours. However, when necessary, Contractor personnel may be required to provide services outside the normal hours of duty. Activities include tasks such as application deployments/upgrades, third-party application patching as well as testing/verification after such tasks are completed. These occasions will require services to be performed after normal working hours, evenings, weekends (Saturday and Sunday) and/or holidays. The COR and the Contractor will mutually agree upon all deviations to the normal work schedule.

8.0 PLACE OF PERFORMANCE

Contractor tasks under this PWS shall be performed remotely. Operational support shall be provided on an on-call basis, 24 hour a day, seven days a week.

9.0 TRAVEL

The Government anticipates travel to interact directly with DMC on-site staff throughout the period of performance. Include all estimated travel costs in your firm-fixed price line items. These costs will not be directly reimbursed by the Government.

The total estimated number of trips in support of the program related meetings for this effort is a maximum of once in the Base Period and once in Option Periods One, Two, Three, and Four for approximately four days for five individuals not located at the DMC. Anticipated locations include the following, estimated at three days in duration:

DMC 1 Federal Drive; St. Paul, MN 55111

Travel shall be in accordance with the Federal Travel Regulations (FTR) and requires advanced concurrence by the COR. Contractor travel within the local commuting area will not be reimbursed.

10.0 SPECIFIC TASKS AND DELIVERABLES

The Contractor shall perform the following:

11.0 PROJECT MANAGEMENT

The Contractor shall provide a single point of contact for the VA COR and DMC ITD management. The Contractor shall manage the tasks, schedules, and analyze work discrepancies for all assigned work. The Contractor shall assist in analyzing and resolving programmatic issues, facilitate information exchange, and enhance management coordination between the COR/VA PM(s) and the Contractor. This support shall include managing support, any tracking of resources across projects, transitioning and onboarding of new required support, and scheduling staff to ensure support services are provided during the DMC operational hours. The Contractor shall identify point(s) of contact for all tasks under this PWS. The Contractor shall:

1. Conduct Weekly Project Progress Reviews (PPR).

2. Provide Monthly Management Reports to include status of all active projects and production support, outstanding issues (if any), forecast for the upcoming month.

3. Track deliverables across projects.

4. Coordinate, escalate and resolve project issues (e.g., risk, resources, scheduling).

5. Attend status meetings and provide status reports to designated project stakeholders with COR coordination.

6. Track Contractor support across projects daily during normal working hours.

7. Use a government provided document management system, e.g., SharePoint, to track project deliverables to avoid reliance on the transmission of large files via email.

8. Work with DMC IT Program Manager to develop and maintain Product and Technology Roadmaps as required.

9. Manage daily Scrum calls with the ITD Federal and contract team. Currently this call is held via the VA instance of MS Teams Monday through Thursday each week at 0900 CST.

10. Track and ensure that all Contractor support:

a. Follows all documented processes and procedures utilized by VA DMC.

b. Meets all service level agreements, response and call back timeframes such as for responding to system failures and metrics in Section 6.1 of the PWS.

c. Meets all task schedules including non-standard work schedule(s) as required. Schedules include nights, weekends, and holidays in accordance with VA DMC requirements a non-standard work schedule, if required. Work may be required beyond normal duty hours, including nights, weekends, and holidays as necessary.

d. Complies with all VA DMC policies and processes.

e. Complies with and support all Federal, VA and local security regulations and policies, security regulations and policies.

f. Provides onboarding support to obtain the proper security clearances (completing the Contractor Background Investigation Request and submitting it to the Personnel Security and Adjudication Center (PSAC)), PIV card requests (to the DMC COR), network access (Service Now (SNOW) and Identity Access Management (IAM)), and IT equipment support (SNOW and IAM).

g. Tracks performance against the PWS requirements and metric.

h. Follows established change order processes.

Deliverable:

A. Monthly Management Reports (includes Onboarded Contractors, Training Completed, GFE, and PIV tracking) B. Product and Technology Roadmaps

12.0 CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, timeline, and tools to be used in execution of this TO/contract effort. The CPMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks, and resource support. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPMP shall be concurred upon and updated in accordance with Section B of the TO/contract. The Contractor shall update and maintain the VA Program Manager (PM) approved CPMP throughout the period of performance.

Deliverable:

A. Contractor Project Management Plan

13.0 TECHNICAL KICKOFF MEETING

A technical kickoff meeting shall be held within 10 days after TO/contract award. The Contractor shall coordinate the date, time, and location (can be virtual) with the CO, the VA PM (ITD Division Chief), as the Co-Chairperson, the Contract Specialist (CS), and the COR. The Contractor shall provide a draft agenda to the CO and VA PM at least five calendar days prior to the meeting. Upon Government approval of a final agenda, the Contractor shall distribute to all meeting attendees. During the kickoff-meeting, the Contractor shall present, for review and approval by the Government, the details of the intended approach, work plan, and project schedule for each effort via a Microsoft Office PowerPoint presentation. At the conclusion of the meeting, the Contractor shall update the presentation with a final slide entitled “Summary Report” which shall include notes on any major issues, agreements, or disagreements discussed during the kickoff meeting. The Contractor shall also work with the CS, to prepare and distribute the meeting minutes of the kickoff meeting to the CO, COR, and all attendees within three (3) calendar days after the meeting. The Contractor shall obtain concurrence from the CS on the content of the meeting minutes prior to distribution of the document.

14.0 TRAINING

The Contractor shall submit Talent Management System (TMS) training certificates of completion for VA Privacy and Information Security Awareness and Rules of Behavior training and provide signed copies of the Contractor Rules of Behavior in accordance with Section 9, Training, from Appendix C of the VA Handbook 6500.6, “Contract Security”.

Additional future training classes may be required, which will be identified by the COR. The Contractor shall ensure completion of these classes for itself and subcontractors. Any person who does not complete required VA training will not be granted access to VA information, VA information systems, or the VA network.

Contractors who have completed these VA training courses within the past 12 months and have furnished certificates will not be required to re-take the training courses.

Deliverables:

A. VA Privacy and Information Security Awareness and Rules of Behavior Training Certificate B. Signed Contractor Rules of Behavior C. Records Management for Everyone (TMS 4192704) D. Elevated privileges for System Access (TMS 3867205) E. Information Security and Privacy Role-Based Training for System Administrators (TMS 1357076) F. Information Security and Privacy Role-Based Training for Network Administrators (TMS 1357083) G. Information Security and Privacy Role-Based Training for Data Managers (TMS 1357084

5.1.4 TECHNICAL WRITING

The Contractor shall create high quality documents which will be used by technical and non-technical personnel across ITD and DMC. The Contractor shall:

1. Develop written information about the organization’s computing systems that aid in their development, use, and support.

2. Establish, communicate, and maintain documentation, and provide training where required.

The Contractor shall support system sustainment documentation activities including:

1. Edit written documentation of development and other IT staff to create unified and consistent support documents as required.

2. Revise all documentation to incorporate system changes and other updates.

3. Create and maintain documentation (Product Operation Manual (POM), process workflows, standard operating procedures, user guides, data dictionaries, etc.).

4. Gather information by observing developmental and production activities, by studying product plans, drawings, specifications, and samples and by interviewing production, development, and engineering personnel to become familiar with product technologies, uses, operation, and maintenance.

5. Create/update documentation as necessary in accordance with all change requests (CR).

The Contractor shall support customer requirements elaboration (Section 5.2.1) including:

1. Analyze IT project requirements to determine types of documents needed. Collaborate with sustainment and development staff to collect and interpret technical information.

2. Plan, design, research, write, and edit a range of documents, including user guides and manuals, technical specifications, proposals, and sustainment support. Maintain online archives of project documentation. Currently this is housed in MS SharePoint within the VA Enterprise.

Deliverable:

A. System Documentation B. Support Documentation

15.0 SOFTWARE DEVELOPMENT AND DEPLOYMENT

The Contractor shall develop, test and deploy DMC applications and customizes existing applications following the approved SDLC (described in section 3) and required tasks below.

16.0 PROGRAM INCREMENT PLANNING

The Contractor shall participate in PI planning prior to the start of each increment to assign items from the backlog to the increment. The Contractor shall assist the project team in developing the PI Plan by estimating the user stories in the product backlog and providing input regarding appropriate and proper sequencing. Each increment shall be no longer than 90 days in duration and shall be made up of individual sprints. Each increment will be fully tested by end users and shall end in a new release candidate.

The Contractor shall contribute to the creation of the PI Plan in collaboration with the project team prior to beginning the increment as required. The PI Plan is the scope of work which will be completed in the agreed upon increment timeframe.

An increment shall consist of a series of sprints (typically 2-3 weeks in duration).

The Contractor shall continuously support an iterative build and development methodology to complete all epics and features and associated user stories identified in the backlog.

Backlog grooming and prioritization are continued throughout the product life cycle and shall be managed throughout the period of performance. All activity scheduled in each increment and backlog shall be captured and have status showing all work items, changes, impediments, and retrospectives. All data and artifacts in a VA approved project management tool shall be fully linked to requirements data and test data.

17.0 REQUIREMENTS ELABORATION

The contractor shall support backlog grooming sessions with the DMC designated Product Owners and ITD personnel to properly understand and elaborate properly forwarded customer functional requirements designated in the applicable PI. The Contractor shall support this effort by reviewing and elaborating on functional requirements. The Contractor is responsible for proposing non-functional requirements from the technical debt backlog for inclusion in builds with an emphasis on those items where the Government would realize savings by integrating functional and non-functional requirements into a single build. The Contractor shall provide input to the DMC designated PM or Product Owner on prioritization of non-functional requirements. The Contractor shall inform the PM or Product Owner of any nonfunctional requirement that must be completed prior to the next production release of the solution such as resolving security findings.

The Contractor shall:

1. Participate in elaboration sessions with Product Owners, ITD, external partners, and customer representatives to finalize functional requirements.

2. Work with customers, and external partners of the DMC and the business units to develop business Epics, Features, and User Stories. Some of these external partners are contractors supporting VA projects and commercial organizations.

3. Ensure that the information collected (Epics, Features, User Stories, and data exchange requirements) is sufficient to deliver the necessary system or application functionality. This includes the ability to translate requirements into terms that can be implemented in system designs.

4. Complete systems analysis for all components of systems or applications, working in close coordination with other project team members to assure effective and efficient systems component integration and address system dependencies.

5. Write and maintain compliance (508, security, technical standards) requirements in the form of Epics and User Stories to ensure that all Contractor-produced or supported applications are fully functional and operate correctly as intended on systems using the VA Federal Desktop Core Configuration, VA 508 guidelines, VA NIST 6500, and the common security configuration guidelines provided by NIST, VA and any other Federal Agency as dictated by VA or Federal Regulations.

6. Coordinate with project teams to integrate non-functional requirements into the Jira product backlog and establish build and sprint plans that incorporate both functional and non- functional requirements.

7. Establish initial Unit of measurement (e.g., Story Points) as the estimated relative complexity of user stories.

8. Manage and oversee daily SCRUM calls (5.1 Item 8 above)

All requirements' data is under change control and shall be fully linked to work items that show traceability to design changes, configurable items, test cases and test results.

18.0 DESIGN

The Contractor shall utilize its Solution design expertise to develop the appropriate designs for each project. The Contractor shall abide by standards established by the DMC Enterprise Architect.

The Contractor shall:

1. Analyze business requirements in conjunction with the DMC Product Owners and IT management and translate those requirements into technical solutions that may include one or more of the following: Commercial off the Shelf (COTS), service-oriented architecture (SOA) components, custom-developed software, and interfaces.

2. Utilize SOA principles such as standardized service contracts, service loose coupling, service abstraction, service reusability, service autonomy, service statelessness, service discoverability, service composability, and service scalability in the implementation of RESTful APIs.

3. Provide expertise in the following areas: hardware, software, interfaces, protocols, SOA, within the financial industry, databases, security, and 508.

4. Coordinate system and application designs with the rest of the project stakeholders.

5. Provide software Solution Design Documentation to establish a blueprint for the design, including specifications for hardware, software, people, interfaces, integrations, and data resources as required.

6. Trace system components to functional requirements.

7. Support the VA enterprise management framework. In association with the framework, the Contractor shall comply with OIT Technical Reference Model (One-VA TRM). One-VA TRM is one component within the overall Enterprise Architecture (EA) that establishes a common vocabulary and structure for describing the information technology used to develop, operate, and maintain enterprise applications. One-VA TRM includes the Standards Profile and Product List that collectively serves as a VA technology roadmap.

8. Validate that the implementation matches the solution design during testing.

9. Provide expertise to the rest of the project stakeholders on the solution design and implementation.

10. Utilize established Enterprise Standards from both the VA and the DMC’s Enterprise Architect and provide input into Enterprise Standards.

11. Contribute to the Interface Control Document (ICD) to describe the interface specification for all external interfaces as required.

Deliverable:

A. Solution Design Documentation

19.0 SPRINT PLANNING

Once the PI plan is provided, the Contractor shall manage and participate in Sprint Planning sessions. All activity scheduled in each sprint and backlog shall be captured in a Sprint Plan and have status showing all work items, changes, impediments, and retrospectives. All data and artifacts in the VA designated tool (currently Jira) shall be fully linked to requirements data and test data by the assigned scrum team.

The Contractor shall:

1. Create Development tasks for each user story and document them in Jira or other VA designated tool.

2. Establish unit of measurement (e.g., Story Points) as the estimated relative complexity of user stories.

3. Participate in a Sprint Planning Meeting, at the beginning of each sprint.

20.0 SPRINT EXECUTION

All activity executed in each sprint and backlog shall be captured and have status showing all work items, changes, risks, issues, impediments, and retrospectives. All project artifacts and source code shall be under change and configuration management as specified by DMC.

The Contractor shall:

1. Develop the features and capabilities as work items in Jira or other VA approved tool that were established in the PI and Sprint Plans and deliver the Preliminary Source Code, Scripts, and Executable Files into a VA approved repository (Currently GitHub for Java development and Endevor for the Cobol).

2. Complete sprint development including disciplined automated testing (unit, functional, regression) and reviews as a continuous process, to avoid finding issues at the end of sprint development.

3. Manage execution and individual participation in scheduled scrums (typically 30 minutes) to show the team progress, impediments, and daily plans.

4. Update Jira or other VA designated project management tool daily, to include progress on tasks during sprints, blockers, and dependencies.

5. Support demonstration of the sprint activities with the project team and users at the end of each sprint. This is termed a Sprint Review and will result in Customer Acceptance of the Sprint.

6. Develop and deliver automated build and automated publishing capabilities to schedule jobs and support continuous integration for every sprint. Automated build tools shall follow the approved list from the One-VA TRM and code shall be demonstrable and stable enough to be promoted to another environment without issue by evidence of the status of tests and results in Jira or other VA approved tool.

7. Manage and participate in a Sprint Retrospective at the end of the Sprint to provide team performance lessons learned.

8. Support a stable development environment by executing automated tests after infrastructure changes per the change management policy.

9. At a minimum, the Contractor shall support the technologies for DMC identified previously in Section 3 Description of Current Technical Environment.

Deliverables:

A. Preliminary Source Code, Scripts, and Executable Files

21.0 BUILD PIPELINE

The Contractor shall use VA TRM approved tools to manage a DMC DevOps pipeline and Infrastructure as Code environment that automates builds, tests, and deployments that meet VA project requirements. The Contractor shall ensure that all project artifacts are versioned correctly and follow a build release promotion versioning approach which identifies all major, minor, and update changes to the components. The Contractor shall maintain baselines of software, software builds, and electronic artifacts and ensure all code is checked in compliance with the following VA requirements: Technical Reference Model (One-VA TRM), VA 6500, VA Enterprise Design Patterns Cloud Computing and Cloud Computing Architecture.

22.0 TESTING

The Contractor shall adopt SAFe and Test-Driven Development (TDD) best practices for integration testing into each Agile development sprint and build and document the Test Strategy and Plan. The Contractor shall conduct tests throughout the development using industry best practices of continuous integration methods and automated regression testing utilities using One-VA TRM approved tools and document the results in a Test Results Summary document. Testing also includes quality assurance for the CARS mainframe system which does not support automated testing.

The Contractor shall develop and maintain an automated regression suite of unit tests that can be executed whenever there is a change to the system and/or infrastructure. The Contractor shall expand and improve on existing efforts to fully integrate automated testing with automated deployment across all environments.

The Contractor shall remediate defects uncovered during compliance testing for security and 508 accessibility requirements. The Contractor shall create and maintain internal coding standards which are designed to prevent duplicate compliance defects. The Contractor shall train staff on changes to the coding standard as needed.

The Contractor shall support the security, accessibility, technical standards, and architectural compliance. Security scanning is done by multiple methods and is done multiple times throughout the course of a project with methods such as penetration testing (WASA), code analysis tools (Fortify), etc. Accessibility reviews are performed through a variety of tool based and manual reviews, able to scan web applications and other technologies used for user interfaces. Architectural compliance assessments are done through submission of design materials to confirm compliance with allowed enterprise architecture. The Contractor shall expand and improve upon existing efforts to automate security scans, accessibility reviews, and architectural assessments.

The Contractor shall validate that the solution implementation matches the solution architecture, document any differences, and submit change requests to address the differences.

The Contractor shall support the Project Manager for prioritizing the defect in the sprint backlog. Based on a prioritization the defect could be entered into the current sprint or entered into the backlog.

The Contractor shall create, and update solution design documentation as required and ensure entries made by development staff in project management tools are up to date so that VA stakeholders can access accurate and timely status.

The Contractor shall support functional, user, performance, and compliance (security and 508) testing in conjunction with the DMC business as required. This includes support for triage meetings and remediation of defects.

Deliverables:

A. Test Strategy and Plan B. Test Results Summary C. Automated Regression Test Scripts

23.0 SOFTWARE DEPLOYMENTS

The Contractor shall not have administrative access to the Production environment. The Contractor shall design the entire solution and understand how environments should be configured to support the solution. Solutions shall use a cloud service whenever practical to do so. The Contractor shall use that expertise to support Configuration Management, System Administrators, and Database Administrators to configure environments, migrate solutions from one environment to another, and test the configurations.

The Contractor shall:

1. Create a Deployment and Installation Plan. The plan shall include all required instructions to create a new environment for the entire solution and describe how to move the solution from one environment to another.

2. Serve as the expert on the configuration of the Development environment. That configuration becomes the standard for the other non-production and production environments. Assist with system roll-out to production and all other environments as requested by DMC. Support developed software by assisting in deployments and by addressing technical issues.

3. Contribute to the product operations manual (POM) as required.

4. Ensure implementation is successful; lead troubleshooting and coordinate with Configuration Management to resolve any issues related to a deployment.

5. Provide in a VA repository final versions of all Technical Documentation Updates to include DMC Source Code, Scripts, Executable Files, and Configuration documentation for each application, systems, tools, and software developed as soon as the request for deployment has been approved.

6. Support Configuration Management, System Administrators, and Database Administrators with all deployment activities for the Development environments.

7. Improve an existing repeatable automated process for software deployment.

The Contractor shall update the Technical Documentation to reflect deployment activities as required.

Deliverables:

A. Deployment and Installation Plan B. DMC Source Code C. Scripts D. Executable Files E. Technical Documentation Updates

5.2.9 SYSTEM ENGINEERING SUPPORT

System Engineering support by the Contractor shall be in conjunction with the DMC’s Enterprise Architect and shall support the existing infrastructure as it exists at this time as well as when it transitions to future configurations.

The Contractor shall provide system engineering support. The Contractor shall:

1. Design and manage the complex engineering and integration of the application…