PWS_VESEE2_RFIDraft.pdf

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Office of Information & Technology

Product Engineering Services (PES)

Veteran Experience Services (VES) Portfolio

Veteran Experience Services Eligibility and Enrollment (VESEE) 2.0

Date: May 13, 2025

VA-26-00001686

PWS Version Number: 1.0

1.0 BACKGROUND

The Department of Veterans Affairs (VA) Eligibility and Enrollment (E&E) Product Line within the Veteran Experience Services (VES) portfolio is part of the Product Engineering Service

(PES) service line within the Office of Information & Technology (OIT). E&E’s vision and mission are as follows:

Vision: To build a seamless experience for Veterans and their families through enterprise eligibility and enrollment.

Mission: To provide Veterans and their families with a wide array of channels that make it easy for them to apply and for the VA to make enrollment decisions.

VES objectives are as follows:

Objective 1: Allow Veterans to share their information with VA once and update it when needed.

Objective 2: Create a seamless experience for Veterans to get accurate, consistent, and timely information across channels.

Objective 3: Make it easier to discover and enroll in VA benefits.

Objective 4: Improve data collection process and analytics structure to understand gaps in the Veteran experience.

Objective 5: Create operational processes that support our teams in effectively executing our work and sharing it with partners.

The work described in this PWS directly supports E&E. E&E collaborates with many partner and stakeholder groups across VA in support of VA staff, Veterans, and other end users.

1.1 PROBLEMS WE ARE TRYING TO SOLVE

VESEE supports numerous independently developed systems that support Eligibility and

Enrollment for Veterans and family members.

This contract will maintain these existing systems (including sustainment and necessary enhancements) while migrating their data and capabilities into the modernized VHA Enrollment

System (ES). This core VHA Enrollment System serves an expanding population which currently includes over 8 million enrolled Veterans and 5 million additional Veterans, family members, and caregivers in a registration only status. The migration and modernization are crucial to meet the needs of an expanding Veteran population.

The modernization of back end functionality is being released into the production environment, and front end capabilities are projected to go live beginning in 2026.

This task order aims to address several key challenges. First, there is the need for system consolidation and modernization, which involves migrating and consolidating numerous independently developed systems into one modern system, the VHA Enrollment System (ES), while also supporting, maintaining, and enhancing all existing systems including but not limited to ES, Enrollment Database (EDB), Income Verification Matching System (IVM), VistA

Registration, Eligibility, and Enrollment (VistA REE). This is essential to streamline operations and improve efficiency. Additionally, effective data management and integration are crucial, as

ES serves as the authoritative source for various types of data, including enrollment applications, military service information, rating decisions, and financial information. Privacy and security are also paramount, given the high sensitivity of medical and disability data. The system must comply with FedRAMP, FISMA, and HIPAA regulations to maintain high-level security and privacy standards.

Scalability and reliability are other significant concerns, as the system needs to handle the demands of an expanding Veteran population, including those affected by the PACT Act, and provide continuous and reliable service. Interoperability is also vital, facilitating the sharing of eligibility and enrollment information with other VA and non-VA organizations to support comprehensive care and benefits management. Ongoing support and maintenance are necessary to ensure the system remains functional and up-to-date, addressing any issues that arise promptly. Also, there should be an avoidance of proprietary technology or platforms, where solutions should be portable and agnostic to hosting platform, to avoid vendor and/or cloud provider lock in.

Finally, implementation and go-live support are critical to ensure a smooth transition during the implementation phase and provide robust support during the go-live period. This helps address any immediate issues and ensures the system operates as intended from the start.

1.2 ADDITIONAL CONSIDERATIONS ON THE PROBLEM SPACE

After the modernized system goes live, ongoing support will be crucial to ensure its continued success and reliability. This support will include continuous monitoring, maintenance, ramped up tier 2 and 3 support, to promptly address any technical issues or bugs that may arise, ensuring minimal disruption to service. Regular updates and patches will be necessary to keep the system secure and up-to-date with the latest changes and regulatory requirements.

Data integrity and security will remain a top priority, requiring ongoing audits and compliance checks to protect sensitive information. By providing robust post-go-live and ongoing support, the modernized system can continue to meet the needs of Veterans and their families efficiently and securely. Once the system has stabilized post go-live, the focus will shift to regular support and enhancement. This includes implementing smaller, ongoing modernization efforts to ensure the system remains current and avoids quickly becoming a legacy system again. By providing robust post-go-live and ongoing support, along with continuous enhancements, the modernized system can continue to meet the needs of Veterans and their families efficiently and securely.

2.0 APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. 44 U.S.C. § 3541-3549, “Federal Information Security Management Act (FISMA) of

2002”

2. “Federal Information Security Modernization Act of 2014”

3. Federal Information Processing Standards (FIPS) Publication 140-2, “Security

Requirements for Cryptographic Modules”

4. FIPS Pub 199. “Standards for Security Categorization of Federal Information and

Information Systems,” February 2004

5. FIPS Pub 200, “Minimum Security Requirements for Federal Information and

Information Systems,” March 2006

6. FIPS Pub 201-2, “Personal Identity Verification of Federal Employees and Contractors,”

August 2013

7. 10 U.S.C. § 2224, "Defense Information Assurance Program"

8. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

9. Public Law 109-461, Veterans Benefits, Health Care, and Information Technology Act of

2006, Title IX, Information Security Matters

10. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”

11. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, https://www.va.gov/vapubs/index.cfm

12. VA Handbook 0710, “Personnel Security and Suitability Program,” May 2, 2016, https://www.va.gov/vapubs/index.cfm

13. VA Directive and Handbook 6102, “Internet/Intranet Services,” August 5, 2019

14. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and

Guidelines,” January 18, 2017

15. Office of Management and Budget (OMB) Circular A-130, “Managing Federal

Information as a Strategic Resource,” July 28, 2016

16. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed Services

(CHAMPUS)”

17. NIST SP 800-66 Rev. 1, “An Introductory Resource Guide for Implementing the Health

Insurance Portability and Accountability Act (HIPAA) Security Rule,” October 2008

18. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended, January

18, 2017

19. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

20. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021

21. VA Handbook 6500, “Risk Management Framework for VA Information Systems VA

Information Security Program,” February 24, 2021

22. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal

Information (SPI),” March 12, 2019

23. VA Handbook 6500.5, “Incorporating Security and Privacy into the System Development

Lifecycle,” March 22, 2010

24. VA Handbook 6500.6, “Contract Security,” March 12, 2010

25. VA Handbook 6500.8, “Information System Contingency Planning,” April 6, 2011

26. VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018

27. VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017

28. OIT Process Asset Library (PAL), https://www.va.gov/process/ . Reference Process

Maps at https://www.va.gov/process/maps.asp and Artifact templates at https://www.va.gov/process/artifacts.asp

29. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

30. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact

Assessment,” October 15, 2014

31. VA Handbook 6508.1, “Procedures for Privacy Threshold Analysis and Privacy Impact

Assessment,” July 30, 2015

32. VA Handbook 6510, “VA Identity and Access Management,” January 15, 2016

33. VA Directive and Handbook 6513, “Secure External Connections,” October 12, 2017

34. VA Directive 6300, “Records and Information Management,” September 21, 2018

35. VA Handbook, 6300.1, “Records Management Procedures,“ March 24, 2010

36. NIST SP 800-37 Rev 2, “Risk Management Framework for Information Systems and

Organizations: A System Life Cycle Approach for Security and Privacy,” December

37. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020)

38. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,”

October 26, 2015

39. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-12)

Program,” March 24, 2014

40. OMB Memorandum 05-24, “Implementation of Homeland Security Presidential

Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal

Employees and Contractors,” August 5, 2005

41. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019

42. OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD)

12 Implementation,” May 23, 2008

43. Federal Identity, Credential, and Access Management (FICAM) Roadmap and

Implementation Guidance, December 2, 2011, (NOTE: Part A of the FICAM Roadmap and Implementation Guidance, v2.0, was replaced in 2015 with an updated Architecture

(https://arch.idmanagement.gov/#what-is-the-ficam-architecture)

44. NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity Verification (PIV)

Credentials in Facility Access,“ June 2018

45. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, “Digital Identity Guidelines,” updated

March 02, 2020

46. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014

47. NIST SP 800-164, “Guidelines on Hardware-Rooted Security in Mobile Devices

(Draft),” October 2012

48. Draft National Institute of Standards and Technology Interagency Report (NISTIR) 7981, “Mobile, PIV, and Authentication,” March 2014

49. VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland Security

Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

50. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

51. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy

Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

52. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

53. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC)

Initiative,” September 12, 2019

54. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name

System Infrastructure,” August 22, 2008

55. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (Public Law

110–140), December 19, 2007

56. Section 104 of the Energy Policy Act of 2005, (Public Law 109–58), August 8, 2005

57. Executive Order 13834, “Efficient Federal Operations,” dated May 17, 2018

58. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 2, 2001

59. VA Directive 0058, “VA Green Purchasing Program,” July 19, 2013

60. VA Handbook 0058, “VA Green Purchasing Program,” July 19, 2013

61. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote Access,”

January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

62. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

63. “Veteran Focused Integration Process (VIP) Guide 4.0,” January 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

64. VA Memorandum “Proper Use of Email and Other Messaging Services,” January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

65. “DevSecOps Product Line Management Playbook” version 2.0, May 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

66. NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020

67. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol Version 6

(IPv6),” November 19, 2020

68. Social Security Number (SSN) Fraud Prevention Act of 2017

69. Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23, 2018

3.0 SCOPE OF WORK

3.1 OVERVIEW OF WORK

The Contractor shall support efforts to be delivered within the E&E and VES Portfolio that will enable and support enterprise-wide improvements to customer experience and Veteran outcomes as described in section 3.1.1 – 3.1.3 below. The Contractor shall develop and iterate on existing and new platforms and systems with approaches that will be resilient to technical and http://www.va.gov/vapubs http://www.va.gov/vapubs organizational change and meeting Veteran, family member, caregiver, and internal and external end user needs across the agency instead of in silos. The Contractor shall provide delivery lifecycle execution, configuration, enhancement/development, modernization, data management, and operations and maintenance support services. The Contractor must adhere to VA Directive

6500 policies, Service Level Agreements (SLA), and Authority to Operate (ATO) requirements including some products that are FISMA Federal Risk and Authorization Management Program

(FedRAMP) High classification, as well as some that are Moderate classification.

The historical level of effort for PWS Section 3.0 and all subsections is 150 Full Time

Employees (FTEs), which applies to the base task and all option years. Although no significant deviation is anticipated, in the event that the scope of work under this contract changes, the

Government agrees to work collaboratively with the Contractor to reassess and minimize the resources necessary to complete the adjusted scope of work. The parties will jointly evaluate the impact of the changes and make reasonable efforts to reduce costs, streamline processes, and allocate resources efficiently while still achieving the desired outcomes. Both parties commit to transparent communication and timely negotiation to adjust deliverables, schedules, and resource allocations accordingly.

The efforts are as follows:

3.1.1. PRODUCT LIFECYLE TEAM

The product lifecycle team plays a crucial role in supporting E&E by executing the entire lifecycle of the products from inception to retirement. This includes developing and executing the product roadmap, delivering on the VA vision, strategy, and goals, and prioritizing features based on user needs, congressional mandates, and senior leadership vision. The team runs multiple efforts of custom applications using the specified technology stack, ensuring they align with the product vision and are portable and vendor-agnostic, ensuring alignment with the roadmap and delivering high-quality features.

A key responsibility is ensuring continuous improvement and maintenance by monitoring product performance, gathering user feedback, and implementing iterative enhancements, managing the migration of functionality and data from siloed applications to the modernized platform, ensuring minimal disruption and data integrity.

Effective DevSecOps ensures timely delivery, with the team developing and executing project plans, tracking progress, coordinating with stakeholders, ensure compliance with security standards and regulations by integrating security into the product lifecycle and conducting regular assessments. A structured change and release management process is implemented for all updates, ensuring changes are documented, tested, and approved before deployment.

The Contractor shall provide comprehensive DevSecOps Support and Maintenance Services.

This includes incorporating Configuration Management, building and maintaining CI/CD pipelines, and automating all phases of software delivery with robust testing and deployment processes. The contractor shall support multiple technology stacks, ensure adherence to security and cloud compliance standards, and facilitate Test Driven Development (TDD). They will develop and monitor DevSecOps dashboards, and deliver metrics and reports for both product applications and environments as required by the VA. Additionally, they must manage cloud services, respond to incidents, and maintain documentation such as System Design Documents

(SDD) and Interface Control Documents (ICD). Expertise in various DevSecOps tools and migration of functions between tools is also required.

3.1.2 SUSTAINMENT AND ENHANCEMENT

The Contractor shall provide sustainment and enhancement services for the ES, EDB, IVM, and

VistA REE systems. The Contractor shall continue to support these systems throughout their operational period. Following the decommissioning of these systems, the Contractor's focus will transition to providing sustainment and enhancement services exclusively for the modernized ES platform and VistA REE.

1. Ongoing Maintenance and Support o The contractor shall provide continuous maintenance and support for E&E products and the modernized platform and ensure all systems are operational, perform regular updates, and address any issues promptly. This includes bug fixes, performance tuning, and routine maintenance tasks. Maintain comprehensive documentation for all products and platforms.

2. System Monitoring and Performance Management o The contractor shall implement and manage monitoring tools to track system performance and health, continuously monitor system performance, identify potential issues, and take proactive measures to prevent downtime. The contractor shall also generate regular performance reports and optimize system resources as needed.

3. Security and Compliance o The contractor shall ensure all products and platforms comply with relevant security standards and regulations, conduct regular security assessments, apply security patches, and update systems to address vulnerabilities. The contractor shall also ensure compliance with industry standards and government regulations.

4. User Support and Issue Resolution o The contractor shall provide user support and resolve issues related to existing products and the modernized platform. The contractor shall also track, analyze, and resolve user-reported problems efficiently, ensuring minimal disruption to their experience.

5. Backup and Disaster Recovery o The contractor shall manage backup and disaster recovery plans and ensure regular backups of all critical data and systems. The contractor shall also develop and test disaster recovery plans to ensure quick restoration of services in case of a failure.

6. Enhancements and Upgrades o The contractor shall implement enhancements and upgrades to existing products and the modernized platform. The contractor shall plan and execute upgrades to improve functionality, performance, and user experience; prioritize enhancements based on user feedback and technological advancements.

7. Integration Management o The contractor shall manage integrations between existing products, the modernized platform, and other systems. The contractor shall ensure seamless data flow and interoperability between systems, address any integration issues promptly and maintain compatibility with external systems.

3.1.3 MODERNIZATION

The Contractor shall be responsible for the consolidation, migration, and modernization of the

EDB, IVM, and VistA REE systems into the modernized ES. This comprehensive effort will encompass the initial rollout phase. Following the successful implementation of the initial rollout, the Contractor shall continue to perform modernization activities to enhance the modernized ES. However, these subsequent modernization efforts will be executed incrementally and on a reduced scale compared to the initial phase.

1. Monolithic Applications o The contractor shall modernize and migrate existing monolithic applications to a microservices-based architecture, complete the break down the monolithic applications into smaller, manageable microservices and ensure each microservice is independently deployable and scalable, improving overall system flexibility and performance.

2. Technology Stack Upgrade o The contractor shall upgrade the technology stack to modern, efficient, and scalable technologies. The contractor shall transition to the specified technology stack, including Java 17+, Spring Boot, Reactive RESTful Web Service

Development with Spring WebFlux, Streams, Kafka, Redis, Oracle database, React/Next.js UI framework, Github, Kubernetes, and Docker. The contractor shall also ensure the new stack enhances performance, security, and maintainability.

3. Data Migration and Integration o The contractor shall migrate data from legacy systems to the modernized platform, develop and execute a data migration plan that ensures data integrity and minimal disruption; and integrate the modernized platform with existing systems and external data sources to ensure seamless data flow.

4. User Interface and Experience Enhancement o The contractor shall redesign the user interface to improve user experience, implement a modern, intuitive UI using the React/Next.js framework; and gather user feedback to ensure the new interface meets user needs and enhances their experience.

5. Continuous Improvement and Agile Development o The contractor shall adopt an agile development approach for continuous improvement. implement iterative development cycles, allowing for regular updates and enhancements; and use agile methodologies to ensure flexibility and responsiveness to changing requirements and user feedback.

6. Security and Compliance o The contractor shall ensure the modernized platform complies with security standards and regulations, integrate security best practices into the development process, conduct regular security assessments and apply necessary updates to maintain compliance with industry standards and government regulations.

7. Performance Optimization o The contractor shall optimize the performance of the modernized platform, implement performance monitoring tools to track system performance; and identify and address performance bottlenecks, ensuring the platform operates efficiently under varying loads.

8. Change Management o The contractor shall implement a structured change management process for the modernization effort, ensure all changes are documented, tested, and approved before deployment; and communicate changes to relevant stakeholders and provide necessary training to ensure smooth transitions.

9. Implementation Rollout Planning o The contractor shall develop and execute a detailed implementation rollout plan.

The contractor shall plan the rollout in phases to minimize disruption and ensure a smooth transition; and coordinate with stakeholders to ensure readiness, manage risks, and address any issues that arise during the rollout.

10. Post-Go-Live Support o The contractor shall provide comprehensive support following the go-live of the modernized platform, establish a post-go-live support team to address any issues, provide user assistance, and ensure system stability. The contractor shall also monitor system performance closely and make necessary adjustments to optimize functionality.

3.2 DEVELOPMENT METHODOLOGY AND WORKING PRINCIPLES

The Contractor’s support and solutions shall follow the practices described in the Digital

Services Playbook (https://playbook.cio.gov). The Contractor shall be familiar with the concepts https://playbook.cio.gov/ in each play and implement them in its approaches and support. The Contractor shall deliver modern digital services that use DevOps techniques that embrace Continuous Integration /

Continuous Delivery (CI/CD). The Contractor shall deliver secure and tested modern web application designs using automated testing frameworks.

The Contractor shall provide VA with teams that shall deliver viable, digital solutions in support of VA’s strategic mission and objectives. Specifically, the Contractor shall:

1. Deliver high-quality, functional products that are measured by user feedback from surveys, research, etc.

2. Follow the practices described in the “Digital Services Playbook”

(https://playbook.cio.gov).

3. Be agile. Incorporate Agile methodologies and ceremonies into work, such as (but not limited to) sprint planning, daily scrum, sprint review, sprint retrospective, backlog grooming, and estimating activities.

4. Actively involve users in the design of all solutions. Incorporate best practices for modern user research and usability testing, such as (but not limited to) creating user personas, problem space definitions, affinity maps, user flow diagrams, wireframes, information architecture diagrams, design prototypes, user research plans, conversation guides, and user research synthesis.

5. Maintain a consistent look, feel, and voice across user facing sites and services.

Incorporate best practices defined in the VA Design System and VA Content Style Guide

(https://design.va.gov/).

6. Personalize solutions for the individual or team using the product

(https://www.whitehouse.gov/briefing-room/presidential-actions/2021/12/13/executive-order-on-transforming-federal-customer-experience-and-service-delivery-to-rebuild-trust-in-government/; https://www.whitehouse.gov/wp-content/uploads/2018/06/s280.pdf)

7. Optimize web applications for mobile-first operation, with all solutions being equally available on both mobile and desktop whenever possible. Incorporate robust accessibility principles into design, development and testing for all web applications to deliver high-quality digital experiences to users of assistive devices.

8. Protect user information with best-in-class security, given the constraints of the environment.

9. Use DevOps techniques of CI/CD across all environments including, at a minimum, development, staging, and production. (http://github.com/department-of-veterans-affairs/va.gov-team/tree/master/platform/engineering/).

10. Use automated testing frameworks to create unit tests, integration tests, functional/black box tests, and load tests (or their equivalents as applicable) to test 100% of functionality delivered. Strive for compliance with Test Driven Development practices.

11. Ensure configuration and sensitive data, including data the VA defines as sensitive, are not present in source code, and are stored in encrypted credential management systems.

12. Deliver all code not containing configuration or sensitive data to an open source repository per Office of Management and Budget Guidance M-16-21.

13. Cultivate a positive, trusting, and cooperative working relationship with the Government and all other vendors supporting this work.

https://playbook.cio.gov/ https://design.va.gov/ https://www.whitehouse.gov/briefing-room/presidential-actions/2021/12/13/executive-order-on-transforming-federal-customer-experience-and-service-delivery-to-rebuild-trust-in-government/ https://www.whitehouse.gov/briefing-room/presidential-actions/2021/12/13/executive-order-on-transforming-federal-customer-experience-and-service-delivery-to-rebuild-trust-in-government/ https://www.whitehouse.gov/briefing-room/presidential-actions/2021/12/13/executive-order-on-transforming-federal-customer-experience-and-service-delivery-to-rebuild-trust-in-government/ https://www.whitehouse.gov/wp-content/uploads/2018/06/s280.pdf http://github.com/department-of-veterans-affairs/va.gov-team/tree/master/platform/engineering/ http://github.com/department-of-veterans-affairs/va.gov-team/tree/master/platform/engineering/

4.0 OBJECTIVES

4.1 DESIRED OUTCOMES

In addition to the VES Objectives, as referenced in PWS paragraph section 1.0, the following are desired outcomes of these efforts:

Quicker Access to Services: Veterans and their families receive faster eligibility and enrollment processing, leading to quicker access to healthcare and benefits.

Clear and Seamless Customer Experience: Customers and users have a seamless, intuitive user experience that ensures they understand each step of the eligibility and enrollment process, improving efficiency and reducing errors.

Targeted and Personalized Support: The system delivers more personalized and effective services by focusing on the specific needs of customers and/or users.

Informed Decision-Making: Enhanced data management ensures accurate and accessible information, supporting better decision-making for personalized service delivery to customers and/or users.

Secure and Trustworthy Environment: Veterans and their families trust that their sensitive information is safeguarded in compliance with FedRAMP, FISMA, and HIPAA regulations.

Consistent and Reliable Service: The system can scale to accommodate an expanding

Veteran population, ensuring continuous and reliable access to services.

Continuous Improvement: Ensure the system remains effective, up-to-date, and capable of meeting the needs of customers and users during implementation/roll out, post go-live and enhancements.

4.2 OUTCOMES WE WANT TO AVOID

System Downtime and Interruptions: Avoid significant downtime or service interruptions that disrupt access to healthcare and benefits for Veterans and their families.

Data Breaches and Security Incidents: Prevent breaches of sensitive medical and disability data to ensure the privacy and security of Veterans and their families.

Complex and Confusing User Experience: Avoid creating a user experience that is complex or confusing, which could lead to frustration and errors during the registration and enrollment process.

Lack of Interoperability: Ensure the system does not become siloed, preventing effective sharing of eligibility and enrollment information with other VA and non-VA organizations.

Vendor and Cloud Provider Lock-In: Avoid reliance on proprietary technology or platforms that lead to vendor or cloud provider lock-in, limiting flexibility, portability, and adaptability.

Delayed Implementation and Go-Live: Prevent delays in the implementation and go-live phases, which could postpone the benefits of the modernized system for users.

Inadequate Support and Maintenance: Avoid insufficient support and maintenance that could lead to unresolved technical issues, system instability, and decreased user satisfaction.

Failure to Meet Regulatory Requirements: Ensure the system remains compliant with all relevant regulations, such as FedRAMP, FISMA, and HIPAA, to avoid legal and operational risks.

5.0 PERFORMANCE DETAILS

5.0.1 PERIOD OF PERFORMANCE (POP)

The PoP shall be as follows:

A 12-month base period supporting the development and iteration of the efforts described, four

12-month option periods and two optional tasks.

5.1 CONTRACT TYPE

The effort shall be proposed on a Firm Fixed Price (FFP) basis.

5.2 KEY PERSONNEL

All personnel performing work shall possess expertise in the disciplines and technical areas as related to the tasks in the PWS. The Contractor shall provide key personnel with the qualifications listed below to support this effort and any additional key personnel it deems necessary to support the requirements of this PWS. These personnel shall not be removed from the Task Order without written notification to the CO.

It is the responsibility of the Contractor to provide personnel and subcontractors who have the required educational background, experience, security clearance, and access authorization or combination thereof to meet the labor category descriptions under this Task Order for the required PWS tasks.

If any change to the Key Personnel assigned to the labor categories identified below becomes necessary (initial staffing, substitutions or additions), the Contractor shall immediately notify the

CO/COR/PM in writing, accompanied by the resume, if applicable, of the proposed replacement personnel who shall be of at least substantially equal ability and qualifications as the individual(s) currently performing in that category and that the proposed replacement meets or exceeds the qualifications designated for that Key Personnel position. It is expected that substitution or replacement of the personnel will not occur within the first six months after date of TO award.

The Contractor agrees that it has a contractual obligation to mitigate the consequences of the loss of Key Personnel and shall promptly secure any necessary replacements in accordance with this

PWS section. Failure to replace a Key Personnel pursuant to this clause and without a break in performance of the labor category at issue shall be considered a condition endangering contract performance and may provide grounds for default termination.

The labor categories below are identified as Key Personnel.

• Chief DevSecOps Engineer

• Principal Senior Software Engineer

• Release/Delivery Manager

• Business (Analyst) Manager

• Quality Assurance Manager

• Program Manager

Additional Information

SCRUM teams will be considered acceptable when they can effectively work. This may include some resources that are staffed, but not cleared. This will be case by case and worked with the

Contracting Officer Representative (COR). For the initial team to be deemed ready to work, all members of the team will have a Personal Security Adjudication Center letter in order to obtain access to working tools such as GitHub and Slack that do not require VA network access.

Access to Amazon Web Services requires an Electronic Questionnaires for Investigations

Processing release date.

5.3 KICKOFF

The Contractor shall hold a kickoff within 10 days after task order award. The Contractor shall present, for review and approval by the Government, at a minimum the details of the intended approach, work plan, and onboarding plan. The Contractor shall specify dates, locations (can be virtual), agenda (shall be provided to all attendees at least five calendar days prior to the kick off), and kick off outcomes (shall be provided to all attendees within three calendar days after the kickoff). The Contractor shall invite the Contracting Officer, Contract Specialist, COR and the

VA Program Manager/Product Owner.

Deliverables:

a. Kickoff Agenda

b. Kickoff outcomes

6.0 QUALITY ASSURANCE SURVEILLANCE PLAN (QASP)

6.0.1 PRODUCT SPECIFIC OBJECTIVES AND KEY RESULTS

All work will be assessed based on the QASP. VA will work with the Contractor to update the

QASP on an as needed basis.

6.1 RECURRING DELIVERABLES

Delivery and Monitoring Report and Roster: The Contractor shall provide a report at least monthly for each workstream, detailing and providing links to all stories, epics and other work completed. This includes a plain language description of all work accepted by the Government

Product Owner and COR at the end of each sprint. This report shall include, in plain language, additional details about the project status, sprint team velocity, sprint team goal completion, and highlight project risks. The report shall also highlight and provide links to key infrastructure and application monitoring data. The report shall also include details with links to documentation for any critical incidents or outage events that resulted in service outages or significant service degradations. The Contractor shall attach or provide links to postmortem documentation for all critical incidents or outage events. Should there not be any reported incidents during the reporting period, a link to the relevant monitoring tools is sufficient. The specific data points and format of this monthly report shall be determined by the Contractor in collaboration with the VA

Program Manager/Product Owner and COR. Lastly, the Contractor shall submit a roster as part of the monthly report to the COR that includes the Status of Government Furnished Equipment

(GFE) for all GFE all staff, as applicable.

Deliverable:

A. Delivery and Monitoring Report and Roster

6.2 DATA AND OPEN SOURCE REQUIREMENTS

The Government shall receive Unlimited Rights to data first produced in performance of this contract in accordance with FAR 52.227-14, “Rights In Data-General” (MAY 2014). This includes all rights to source code and any and all documentation created in support thereof.

License rights in any Commercial Computer Software shall be governed by FAR 52.227-19, “Commercial Computer Software License” (DEC 2007). Any data delivered shall be submitted and protected in accordance with VA handbook 6500.

VA intends that the software delivered under this task order will be publicly posted without restriction. To the extent that the Contractor(s) seeks to incorporate into the software delivered under this task order any software that was not first produced in the performance of this task order, VA encourages the Contractor(s) to incorporate either software that is in the public domain, or free and open source software that qualifies under the Open Source Definition promulgated by the Open Source Initiative. In any event, the Contractor(s) must promptly disclose to VA in writing, and list in the documentation, any software incorporated in the delivered software that is subject to a license fee.

7.0 ADDITIONAL SCRUM TEAMS - OPTIONAL TASK 1

It is anticipated that additional support may be needed to achieve the desired outcomes related to the scope described in 3.0. If exercised by the Government, the Contractor shall provide resources identified in collaboration with the Government's technical representatives, not to exceed the amount identified by the Government. This task may be exercised multiple times and at any time, at the discretion of the Government and can be exercised during the base period and each option period of performance.

Each surge support optional task will not exceed a 12-month period. Each sprint will have a duration of 2 weeks. Resource team composition shall be determined by VA based on its analysis. The contractor shall be capable of providing four team sizes. The required dedicated

FTE count for each team size is as follows based off historical sizing.

Size Resource Team

Expert 1 FTE resource providing additional support aligned to the desired outcomes and scope described in PWS 3.0

Small 3 FTE resource providing additional support aligned to the desired outcomes and scope described in PWS 3.0

Medium 6 FTE resources providing additional support aligned to the desired outcomes and scope described in PWS 3.0

Large 10 FTE resources providing additional support aligned to the desired outcomes and scope described in PWS 3.0

7.0 TRANSITION OUT - OPTIONAL TASK 2

The Contractor shall provide a plan for 90 days of outgoing transition support for transitioning work from the current task order to a follow-on task order or Government entity. This transition may be to a Government entity or to another Contractor or to the incumbent Contractor under a new task order. The Contractor shall convey any and all information, as it pertains to the VESEE effort. The Contractor shall submit details for the Transition Plan and execute the Transition Plan upon Government approval. The Transition Plan may be exercised once by the Government anytime during the base or Option Periods. Transition Plan shall be delivered at least 75 days prior to the end of the PoP.

The Contractor shall provide subject matter expertise support to affect the knowledge transfer in accordance with the resulting Transition Plan.

In accordance with the Government-approved Transition Plan, the Contractor shall work collaboratively with other support Contractors and/or Government personnel in implementing a complete transition from this task order to a new support provider. This shall include formal coordination with Government staff and successor staff and management.

This support shall also consist of providing advice, and clarification or explanation to facilitate the understanding of the information presented. It shall also include delivery of copies of all artifacts delivered under this contract, as well as existing policies and procedures, and delivery of baseline metrics and statistics.

The Transition Plan shall detail both the assumption of responsibilities and the transfer of responsibilities to follow-on parties at the conclusion of the PoP. This Transition Plan shall include, but is not limited to:

a. Coordination with Government representatives.

b. Review, evaluation and transition of current support services.

c. Transition of historic data to new Contractor system.

d. Transfer of all necessary business and/or technical documentation

e. Orientation phase and program to introduce Government and Contractor personnel to the programs, product, code and users to the Contractor's team, tools, methodologies, and business processes.

f. Disposition of Contractor purchased Government owned assets,

g. Transfer of Government Furnished Equipment (GFE) and Government Furnished

Information, and GFE inventory management assistance.

The finalized asset list shall be delivered as a Certificate of Transition Completion for all Assets, which will be signed by the Development PM and the Receiving Organization to indicate acceptance. The Certificate of Transition Completion for all Assets shall be delivered 30 days prior to the completion of the PoP.

Deliverables:

A. Transition Plan

B. Certificate of Transition Completion

8.0 OTHER ADMINISTRATIVE ITEMS

8.0 PLACE OF PERFORMANCE

Tasks under this PWS shall be performed at Contractor facilities or locations within the United

States determined by the Contractor. The Contractor shall identify the Contractor’s place of performance in their proposal submission. Work may be performed at remote locations with prior concurrence from the Contracting Officer’s Representative (COR). All work locations must be able to accommodate the Hours of Work specified in Section 8.2.

8.1 TRAVEL

The Government anticipates travel to perform the tasks associated with the effort, as well as to attend program-related meetings or conferences throughout the PoP.

Travel shall be included in Firm Fixed Price. There will be 3 large trips of 20 people and 5 trips of 4 people or less per year to various US destinations.

Travel shall be in accordance with the Federal Travel Regulations and requires advanced concurrence by the COR. Contractor travel within the local commuting area will not be reimbursed by the Government. Also, not reimbursable are travel performed for personal convenience or daily travel to and from work at the Contractor’s facility.

8.2 HOURS OF WORK

The Contractor shall set their own work hours. However, Contractors may be required to attend meetings with Government personnel between standard east coast work hours (typically 7am-

5pm ET). Additionally, monitoring and support for production systems will be required between

7am-8pm ET, with a 24/7 on-call escalation process codified for urgent issues, as applicable.

9.0 GENERAL REQUIREMENTS

9.0 ENTERPRISE AND IT FRAMEWORK

9.1.1 VA TECHNICAL REFERENCE MODEL

The Contractor shall support the VA enterprise management framework. In association with the framework, the Contractor shall comply with OIT Technical Reference Model (VA TRM). The

VA TRM is one component within the overall Enterprise Architecture (EA) that establishes a common vocabulary and structure for describing the information technology used to develop, operate, and maintain enterprise applications. Moreover, the VA TRM, which includes the

Standards Profile and Product List, serves as a technology roadmap and tool for supporting OIT.

Architecture & Engineering Services (AES) has overall responsibility for the VA TRM.

9.1.2 FEDERAL IDENTITY, CREDENTIAL, AND ACCESS MANAGEMENT

(FICAM)

The Contractor shall ensure Commercial Off-The-Shelf (COTS) product(s), software configuration and customization, and/or new software are Personal Identity Verification (PIV) card-enabled by accepting HSPD-12 PIV credentials using VA Enterprise Technical Architecture

(ETA), https://www.ea.oit.va.gov/EAOIT/VA_EA/Enterprise_Technical_Architecture.asp, and

VA Identity and Access Management (IAM) approved enterprise design and integration patterns, https://www.oit.va.gov/library/recurring/edp/index.cfm. The Contractor shall ensure all

Contractor delivered applications and systems comply with the VA Identity, Credential, and

Access Management policies and guidelines set forth in VA Handbook 6510 VA Identity and

Access Management, VA Handbook 0735 Homeland Security Presidential Directive 12 (HSPD-

12) Program, and align with the Federal Identity, Credential, and Access Management Roadmap and Implementation Guidance v2.0.

The Contractor shall ensure all Contractor delivered applications and systems provide user authentication services compliant with the National Institute of Standards and Technology

(NIST) Special Publication (SP) 800-63-3, VA Handbook 6500 Appendix F, “VA System

Security Controls”, and VA IAM enterprise requirements for direct, assertion based authentication, and/or trust based authentication, as determined by the design and integration patterns. Direct authentication at a minimum must include Public Key Infrastructure (PKI) based authentication supportive of PIV card and/or Common Access Card (CAC), as determined by the business need.

The Contractor shall ensure all Contractor delivered applications and systems conform to the specific Identity and Access Management PIV requirements set forth in the Office of

Management and Budget (OMB) Memoranda M-05-24, M-19-17, and NIST Federal Information

Processing Standard (FIPS) 201-2. OMB Memoranda M-05-24 and M-19-17 can be found at:

https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2005/m05-24.pdf, and https://www.whitehouse.gov/wp-content/uploads/2019/05/M-19-17.pdf respectively. Contractor delivered applications and systems shall be on the FIPS 201-2 Approved Product List (APL). If the Contractor delivered application and system is not on the APL, the Contractor shall be responsible for taking the application and system through the FIPS 201 Evaluation Program.

The Contractor shall ensure all Contractor delivered applications and systems support:

1. Automated provisioning and are able to use enterprise provisioning service.

2. Interfacing with VA’s Master Person Index (MPI) to provision identity attributes, if the solution relies on VA user identities. MPI is the authoritative source for VA user identity data.

3. The VA defined unique identity (Secure Identifier [SEC ID] / Integrated Control Number

[ICN]).

4. Multiple authenticators for a given identity and authenticators at every Authenticator

Assurance Level (AAL) appropriate for the solution.

5. Identity proofing for each Identity Assurance Level (IAL) appropriate for the solution.

6. Federation for each Federation Assurance Level (FAL) appropriate for the solution, if applicable.

7. Two-factor authentication (2FA) through an applicable design pattern as outlined in VA

Enterprise Design Patterns.

8. A Security Assertion Markup Language (SAML) implementation if the solution relies on assertion-based authentication. Additional assertion implementations, besides the required SAML assertion, may be provided as long as they are compliant with NIST SP

800-63-3 guidelines.

9. Authentication/account binding based on trusted Hypertext Transfer Protocol (HTTP) headers if the solution relies on Trust based authentication.

10. Role Based Access Control.

11. Auditing and reporting capabilities.

12. Compliance with VIEWS 00155984, PIV Logical Access Policy Clarification https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896.

The required Assurance Levels for this specific effort are Identity Assurance Level 3, Authenticator Assurance Level 3, and Federation Assurance Level 3.

9.1.3 INTERNET PROTOCOL VERSION 6 (IPV6)

The Contractor solution shall support Internet Protocol Version 6 (IPv6) based upon the memo issued by the Office of Management and Budget (OMB) on November 19, 2020

(https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-07.pdf). IPv6 technology, in accordance with the USGv6 Program (https://www.nist.gov/programs-projects/usgv6-program/usgv6-revision-1), NIST Special Publication (SP) 500-267B Revision 1 “USGv6

Profile” (https://doi.org/10.6028/NIST.SP.500-267Br1), and NIST SP 800-119 “Guidelines for the Secure Deployment of IPv6” (https://doi.org/10.6028/NIST.SP.800-119), compliance shall be included in all IT infrastructures, application designs, application development, operational systems and sub-systems, and their integration. In addition to the above requirements, all devices shall support native IPv6 and dual stack (IPv6 / IPv4) connectivity without additional memory or other resources being provided by the Government, so that they can function in a mixed environment. All public/external facing servers and services (e.g. web, email, DNS, ISP services, etc.) shall support native IPv6 and dual stack (IPv6 / IPv4) users and all internal infrastructure and applications shall communicate using native IPv6 and dual stack (IPv6 / IPv4) operations.

9.1.4 TRUSTED INTERNET CONNECTION (TIC)

The Contractor solution shall meet the requirements outlined in Office of Management and

Budget…