RFI_ Draft PWS_DAIMO.pdf

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Office of Information & Technology Product Engineering Service (PES)

Data and Analytics Integrated Modernization and Operations (DAIMO) Data-centric Systems Development, Modernization and Sustainment

Date: 11/22/2023

VA-24-00013843

Task Order PWS Version Number: 0.3

Contents

1.0 BACKGROUND

1.1 Data and Analytics Integrated Modernization and Operations (DAIMO)

1.2 VA PROFILE

1.3 VETERANS INFORMATION ELIGIBILITY REPORTING SYSTEM (VIERS)

1.4 VA DOD IDENTITY REPOSITORY (VADIR) AND VETERANS INFORMATION

SOLUTION (VIS)

1.5 HEALTH DATA REPOSITORY (HDR)

1.6 CORPORATE DATA WAREHOUSE (CDW)

1.7 SUMMIT DATA PLATFORM (SDP)

1.8 CUSTOMER EXPERIENCE DATA WAREHOUSE (CxDW)

1.9 VETERANS INFORMATICS and COMPUTING INFRASTRUCTURE (VINCI) 10

1.10 ROBOTICS PROCESS AUTOMATION (RPA)

1.11 OTHER Product Engineering Service DA (PES DA) PRODUCTS

1.12 DATA ACCESS SERVICE (DAS) ENTERPRISE SERVICE ENHANCEMENTS

(DESE)

2.0 APPLICABLE DOCUMENTS

3.0 SCOPE OF WORK

3.1 APPLICABILITY

3.2 ORDER TYPE

4.0 PERFORMANCE DETAILS

4.1 PERFORMANCE PERIOD

4.2 PLACE OF PERFORMANCE

4.3 TRAVEL OR SPECIAL REQUIREMENTS

4.4 CONTRACT MANAGEMENT

4.5 GOVERNMENT FURNISHED PROPERTY

4.6 Scrum Team / PERSONNEL REQUIREMENTS

4.6.1 SCRUM TEAM SIZE

4.6.2 Personnel Requirements

4.7 SECURITY AND PRIVACY

4.7.1 POSITION/TASK RISK DESIGNATION LEVEL(S)

5.0 SPECIFIC TASKS AND DELIVERABLES

5.1 PROJECT MANAGEMENT (FFP)

5.1.1 CONTRACTOR PROJECT MANAGEMENT PLAN

5.1.2 TECHNICAL KICKOFF MEETING

5.1.3 ONBOARDING STATUS (FFP)

5.1.4 PRIVACY, HIPAA, AND ELEVATED PRIVILEGES TRAINING (FFP) ... 33

5.1.5 REPORTING REQUIREMENTS (FFP)

5.1.6 OFFBOARDING STATUS (FFP)

5.1.7 CONFIGURATION MANAGEMENT (FFP)

5.1.8 SCHEDULE MANAGEMENT (FFP)

5.1.9 RISK MANAGEMENT (FFP)

5.1.10 INCIDENT REPORTING (FFP)

5.2 OPERATIONS AND MAINTENANCE (FFP)

5.2.1 PRODUCTION OPERATIONS SUPPORT (FFP)

PRODUCTION SUPPORT TIERS

PRODUCTION OPERATIONS

MONITORING/MAINTENANCE ACTIVITIES

PRODUCTION SUPPORT

CONTINUITY OF OPERATIONS AND DISASTER RECOVERY (FFP)

CONTINUOUS INTEGRATION (FFP)

SYSTEMS ADMINISTRATION (FFP)

HELP DESK SUPPORT (FFP)

SPECIAL EVENT 24 X 7 SUPPORT (FFP)

ON-CALL SUPPORT (FFP)

5.2.2 PRODUCTION PERFORMANCE (FFP)

5.2.3 ENVIRONMENT MANAGEMENT (FFP)

ENVIRONMENT MONITORING AND ANALYTICS (FFP)

LOGGING AND AUDITING (FFP)

ENVIRONMENT MANAGEMENT | CODE PROMOTION (FFP)

ENVIRONMENT CONFIGURATION SUPPORT (FFP)

ASSESSMENT AND AUTHORIZATION (FFP)

AUTHORITY TO OPERATE (FFP)

5.2.4 USER GUIDE UPDATES (FFP)

5.2.5 SOLUTION TRAINING (FFP)

5.3 CDW SUPPORT SERVICES

5.3.1 CDW ADMINISTRATION AND SUPPORT SERVICES (T&M)

5.4 VINCI SYSTEM ADMINISTRATION SERVICES

5.4.1 VINCI STORAGE AND SYSTEM ADMINISTRATION (FFP)

5.4.2 BACKUP ADMINISTRATION (FFP)

5.4.3 LINUX ADMINISTRATION (FFP)

5.4.4 WINDOWS ADMINISTRATION (FFP)

5.4.5 SYSTEM MAINTENANCE SUPPORT (FFP)

5.5 Software DEVELOPMENT (FFP&T&M)

5.5.1 RESOURCE PLANNING Optional Task (FFP)

5.5.2 AGILE/SAFe REQUIREMENTS ELABORATION (FFP)

5.5.3 BUILD AND DEVELOPMENT (FFP)

SOLUTION ARCHITECTURE PLANNING AND EXECUTION (FFP)

DATA ARCHITECTURE PLANNING SUPPORT (FFP)

BUILD PLANNING (FFP)

TEST PLANNING (TP) (FFP)

5.5.4 SPRINT PLANNING (FFP)

5.5.5 SPRINT EXECUTION (FFP)

5.5.6 TESTING (FFP)

TEST DATA (FFP)

SPRINT TESTING (FFP)

BUILD ASSEMBLY AND TESTING (FFP)

5.5.7 RELEASE AND DEPLOYMENT (FFP)

PRE-RELEASE SUPPORT (FFP)

RELEASE AND DEPLOYMENT SUPPORT(FFP/T&M)

5.6 Solution architecture and advanced data ENGINEERING (t&m) - OPTIONAL

TASK 2)

5.7 OPERATIONS & MAINTENANCE SERVICES (OPTIONAL TASKS 3-7) (FFP)

5.7.1 OPERATIONS & MAINTENANCE SUPPORT - SPIKE SCRUM TEAM

(OPTIONAL TASK 3)

5.7.2 OPERATIONS & MAINTENANCE SUPPORT - SMALL SCRUM TEAM

(OPTIONAL TASK 4)

5.7.3 OPERATIONS & MAINTENANCE SUPPORT - STANDARD SCRUM

TEAM (OPTIONAL TASK 5)

5.7.4 OPERATIONS & MAINTENANCE SUPPORT - LARGE SCRUM TEAM

(OPTIONAL TASK 6)

5.7.5 OPERATIONS & MAINTENANCE SUPPORT – MULTI-SCRUM TEAM

(OPTIONAL TASK 7)

5.8 DEVELOPMENT SERVICES (OPTIONAL TASKS 8-11) (FF)

5.8.1 DEVELOPMENT - SPIKE SCRUM TEAM (OPTIONAL TASK 8)

5.8.2 DEVELOPMENT – SMALL SCRUM TEAM (OPTIONAL TASK 9)

5.8.3 DEVELOPMENT - STANDARD SCRUM TEAM (OPTIONAL TASK 10) 78

5.8.4 DEVELOPMENT – LARGE SCRUM TEAM (OPTIONAL TASK 11)

5.8.5 DEVELOPMENT – MULTI-SCRUM TEAM (OPTIONAL TASK 12)

5.8.6 CDW SQL SERVER ANALYSIS SERVICES (SSAS) SUPPORT

SERVICES (OPTIONAL TASK 13)

5.8.7 CDW MICROSOFT POWERBI SUPPORT SERVICES (OPTIONAL

TASK 14) 79

5.9 OUTGOING TRANSITION SUPPORT (OPTIONAL TASK 15)

6.0 GENERAL REQUIREMENTS

6.1 PERFORMANCE METRICS

6.2 SECTION 508 – ELECTRONIC AND INFORMATION TECHNOLOGY (EIT)

STANDARDS

6.2.1 SECTION 508 STANDARDS

6.2.2 COMPATIBILITY WITH ASSISTIVE TECHNOLOGY

6.2.3 ACCEPTANCE AND ACCEPTANCE TESTING

6.3 ORGANIZATIONAL CONFLICT of INTEREST

ADDENDUM B- VA INFORMATION AND INFORMATION SYSTEM SECURITY /

PRIVACY LANGUAGE

APPENDIX A

1.0 BACKGROUND

The Department of Veterans Affairs (VA), Office of Information & Technology (OI&T), Product Engineering Service (PES), Data and Analytics Pillar (DA) maintains a vision to provide positive outcomes for Veterans and their families through the enablement of a data-driven VA culture that continuously improves the delivery of world-class benefits and services. This vision is supported by PES DA’s mission to deliver an integrated ecosystem of interoperable data management, discovery and analytics tools that enable evidence-based decision making grounded in the adoption of authoritative data sources across the VA Enterprise. PES DA manages a complex portfolio of platforms and products that empower the VA and OI&T specifically to support the increasing demand for data to meet the Department’s obligations to the Veteran community. PES DA is charged with ensuring VA’s enterprise data assets are artificial intelligence (AI) ready.

OI&T modernization and t Sergeant First Class (SFC) Heath Robinson Honoring our Promise to Address Comprehensive Toxics (PACT) Act initiatives are accelerating demand for advanced AI-based solutions and VA’s core data management capabilities are critical to the achievement of the Department’s goals, and PES DA must continue to evolve the Summit Data Platform (SDP) to support the modernization of the enterprise data management lifecycle. This will ensure the tools, best practices and supporting architecture continually evolve to meet the needs and expectations of OI&T’s technical product teams. Furthermore, evolving the platform and maintaining high availability of essential products and services is increasingly important to PES DA’s objectives to achieving the VA’s mission.

1.1 Data and Analytics Integrated Modernization and Operations (DAIMO) Data and Analytics Integrated Modernization and Operations (DAIMO) will consolidate the development, enhancement, and modernization and daily operational sustainment of products and programs executed by the DA of the PES. PES DA also manages the Data and Analytics Product Line (DAPL) for VA OI&T and facilitates efforts across VA and with external partners to foster the secure, timely and accurate sharing of trusted data products that enable the delivery of healthcare and benefits to the Veteran community. Data-centric products managed in the DAPL are in various stages of their modernization journeys. In some cases, this calls for the consolidation of capabilities from multiple products to be delivered on robust, developer friendly platforms that enable rapid integration by technical teams across the Department. In other areas, the need to reevaluate the approach, design and engineer utilizing modern patterns is necessary to realize a scalable architecture capable of meeting the needs of a digital first VA.

PES DA strives to provide thought leadership to innovate and drive the adoption of leading-edge technologies to positively impact Veteran outcomes, enable a highly resilient availability posture, standardize and improve all aspects of the DevOps processes and practices supporting its products and platforms. This includes, but is not limited to, capabilities for proactive monitoring including synthetic transactions where appropriate, optimizing infrastructure as code, and unifying the continuous integration/continuously delivery (CI/CD) product development and deployment practices across PES DA portfolio. PES DA is responsible for platform and product health monitoring described above, and communicating root cause of detected defects, performance issues and other production disruptions that may impact the consistent availability, performance and integrity of Pillar ecosystem. DAIMO will address the ongoing sustainment needs of the programs and products discussed in the following sections.

As VA continues the adoption of a product mindset for information technology solutions, PES DA will progressively evolve each Pillar’s offerings in concert with our business partners. PES DA will continue to define modernization goals for each product and platform to ensure that capabilities delivered to VA reflect the evolving state of the industry.

PES DA has identified two overarching target state platforms that will enable the consolidation of product capabilities across the Pillar. SDP is the target modernization state for legacy data management, reporting and analytics development products and programs within the DA Pillar. SDP will enable the future development of enterprise Machine Learning (ML) and Artificial Intelligence (AI) solutions and will provide self-service capabilities to technical teams across OI&T to build and serve source and domain aligned data products. VA Profile will deliver the enterprise’s Master Data Management (MDM) capability and will enable the transactional delivery of key master data products to IT products and systems across the Department.

The intended target state of the Pillar’s ecosystem to minimize duplication of technology stacks and drive commonality in required skills will permit service providers to focus on a reduced footprint of skillsets once the target state architecture is realized.

1.2 VA PROFILE

VA Profile is the authoritative data source for VA customer contact information and the authoritative service for VA common data. VA Profile provides VA customers the ability to update information and have a 360° view of their Master Record. This improves data quality and management of the Veteran Profile through implementing business rules and exception handling within the solution, as well as enterprise data governance (policy, procedures, etc.). The customer record is readily available for the Veteran and VA staff to view.

VA Profile modernizes VA systems by ensuring that customer common data is synchronized and shared across the VA, regardless of the channel used to update the information. Synchronizing data across the three major Veterans Benefits Administration

(VBA), Veterans Health Administration (VHA), and National Cemetery Administration (NCA) systems is just one step in synchronizing all VA systems. Currently, VA Profile is integrating with new VA systems and business lines so Veterans’ identity, contact information, military service, enrollment, eligibility for VA services and benefits, socio-economic, demographic, customer experience, interaction history and shared data from VHA, VBA, and NCA are automatically synchronized across all VA systems.

VA Profile employs an enterprise MDM solution that provides a capability to supply a cleansed, singular, authoritative set of information encompassing all applicable data subject areas shared among multiple Lines of Business (LoBs). MDM data updates are propagated to relevant consuming systems in all applicable LoBs; VA customers will be enabled to update contact, demographic and socio-economic information for immediate propagation VA-wide to avoid the need for duplicate data entry.

In the VA Enterprise Cloud (VAEC), VA Profile utilizes a service platform that hosts distinct software microservices to encapsulate specific functional needs. Data subject area payloads are transmitted and received in business provided subject models, referred to as Business Information Objects (BIOs). Within the accreditation boundary of VA Profile to support scale, message volume tuning, and system resilience within the service mesh, asynchronous messaging is leveraged. LoB or Enterprise Systems integrate with VA Profile as either a Direct Consumer Integration, or as a Synchronization Partner.

Direct Consumer Integration – VA Profile direct consumer integration communicates with the Common Update Framework (CUF) Data Hub via industry standard REpresentational State Transfer (REST) Application Programming Interface (APIs) using commodity tools. The Hub provides RESTful microservices to push and pull data from the Longitudinal Veteran Record by issuing HTTP requests that transmit and receive a BIO. The single set of APIs is technology agnostic enabling consumer applications to interact with VA Profile in both attended and unattended flows.

Synchronization Partner – In collaboration with a LoB system owner, VA Profile implements a Change Data Capture (CDC) or Web Service / API based method to capture all operations taken.

1.3 VETERANS INFORMATION ELIGIBILITY REPORTING SYSTEM (VIERS)

Veteran Identity/Eligibility Reporting System (VIERS) is a system providing middleware services that support access to consuming applications such as:

• Affordable Care Act (ACA)

• Airborne Hazards Burn Pit Registry (AHOBP)

• Digits-to-Digits (D2D) Veterans Service Organization (VSO) Claims Processing

• Outreach Reporting Tool

• eBenefits

• Veteran Online Health Application (VOA)

• Veterans OnLine Application (VONAPP) Direct Connect (VDC)

• Stakeholder Enterprise Portal (SEP)

• Customer Relationship Management (CRM)

• Voice Access Modernization (VAM)

• Enrollment System (ES)

• Veteran Benefits Management System (VBMS) and Chapter 33 (CH33)

• Federal Case Management Tool (FCMT)

VIERS services function as a middleware (based on WebLogic and WebSphere) using a Service Oriented Architecture (SOA) providing services for: submitting electronic forms, validating Master Veteran Index (MVI), correspondence, event notification, claims submission (Benefits Gateway Services (BGS)/CGS) and various data stores established in the data layer such as Corporate, Beneficiary Information Record Locator System (BIRLS), Administrative Data Repository (ADR), and Master Veteran Index

(MVI).

The VIERS suite of middleware services provide orchestration to Military Service Data Sharing (MSDS), Digits-to-Digits (D2D), Claims Processing & Eligibility (CP&E) Adapters, CP&E Eligibility service, CP&E Beneficiary service, Business Event Notification Service (BENS), Affordable Care Act (ACA) Enrollment Verification Service, Veteran Person Adaptor Service, Veterans Appeals Control and Locator System (VACOLS) adapter, reporting and analysis warehouse, .

1.4 VA DOD IDENTITY REPOSITORY (VADIR) AND VETERANS INFORMATION

SOLUTION (VIS)

VA Department of Defense (DoD) Identity Repository (VADIR), Veterans Information Solution (VIS) provides a database and Graphical User Interface (GUI) to store data and web services to consuming applications, such as, Enrollment Systems, Veterans Access, Choice, and Accountability Act (VACAA), aka Veterans Choice (VC), Patient Protection/Affordable Care Act (ACA), ChampVA, Veterans Online Application (VONAPP), Business Events Notification Service (BENS), Identity Management System (IAM IdS), etc. VADIR and VIS are hosted in the AWS Cloud.

VADIR functions as a database and middleware using a SOA approach to provide orchestration according to business rules, with services that crosscut among various business capabilities including electronic forms, storing images and validation of MVI.

VADIR is a service/program provider for Veterans Information Solution (VIS) which display a GUI for VADIR data.

The VADIR database serves as the authoritative data store from the DoD and VA sources for all military service records (for those currently serving, transitioning, and/or separated members and veterans) to support eligibility decisions to include registration, automated eligibility determinations, common business functions, and consistent identification of beneficiaries across VA, providing the data to support the improved veteran-centric services that support enterprise goals and the determination of legislatively mandated Veterans’ benefits. VADIR provides reporting and analysis capability to VA staff offices and LoBs. VADIR provides real-time notification of critical events across to service member care and benefits which can be applied across VA as needed. VADIR database is built in an Oracle – Red Hat Linux operating system.

VADIR Web Services are on the RedHat Linux operating system and use the Apache web server and WebLogic application server.

VIS is a web-based query application that provides a consolidated GUI view of VADIR data for the VBA and the DoD. VIS enables authorized users to search records and retrieve information on the Veteran’s or Service member’s profile or military history; on certain education benefits; and information on compensation and disability pension ratings and awards and on dependents included in those awards. VIS is a SOA -based application that leverages the Java Enterprise Edition (Java EE) technology stack. The application is packaged in Web Archives (WAR) and deployed to WebLogic on a clustered group of managed servers that are load balanced via the Apache web server and its WebLogic plugin. The web server and application server run on Red Hat Enterprise Linux.

1.5 HEALTH DATA REPOSITORY (HDR)

Health Data Repository (HDR)/Clinical Data Service (CDS) is a national repository of clinical information which stores discrete data. CDS is the data abstraction layer that applications utilize to retrieve and send data to the HDR. On one national platform and provides a national, longitudinal data base of veteran's clinical data that is structured, standardized and used by clinical & analytic applications.

Below are details of the HDR product/service:

HDR serves as the authoritative data store for nationalized clinical programs such as Home Telehealth and MyHealthVet and other non-VistA clinical applications. Healthcare providers use the HDR and VistA to facilitate longitudinal patient-centric care, storing patient-centric clinical data in a computable format that can be used by other applications for analytical purposes. The HDR database is developed in Oracle and the Clinical Data Service (CDS) and Pathways access layer in Structured Query Language (SQL), Java, and PL/SQL with interfaces to WebLogic. WebLogic is responsible to interface with the access layer.

1.6 CORPORATE DATA WAREHOUSE (CDW)

Corporate Data Warehouse (CDW) provides national authoritative health and enterprise data and analytic tools at scale to 23,000+ developer/analysts from 7,500+ workgroups.

These workgroups create downstream data products that get consumed by 100,000+ content customers including Veterans, Congress, Inter-agency partners, VA Senior

Leaders, Health Research, and National/Field Healthcare Operations. CDW provides the authoritative health data for the VA. It also integrates other Enterprise Financial and Administrative data sources. These resources are critical to maintain CDW which is a large complex critical data ecosystem with thousands of downstream dependencies.

Core services include development and implementation of Structured Query Language (SQL) Server Integration Services (SSIS) Enterprise Architecture, SQL Server Analysis Services (SSAS) Enterprise Architecture, Pyramid Analytics Enterprise Architecture, and SharePoint Enterprise Architecture. Core services also include Extract-Transform- Load (ETL) programming using SSIS to support adding new data domains to the CDW, creation and maintenance of SQL Server Analysis Services (SSAS) cubes, CDW Enclave Windows System Administration services, Cache Shadow support services, and CDW Customer Service support.

1.7 SUMMIT DATA PLATFORM (SDP)

The SDP is VA’s cloud-based Enterprise Data Analytics platform serving VA’s Administrations and Staff Offices. The SDP enables governed access to VA data integrated with a comprehensive analytics toolset for data analysis and research teams to derive valuable insights, uncover patterns, and make data-driven decisions to benefit veterans. The SDP enables self-service analytics: IT/Analytics teams from across the VA can fully leverage the platform for their needs with minimal interference. The SDP also offers “White Glove” services to VA lines of business who have mission critical needs but might lack analytical skillsets.

1.8 CUSTOMER EXPERIENCE DATA WAREHOUSE (CXDW)

The Customer Experience Data Warehouse (CxDW) uses advanced data intake, conditioning, and curating techniques to provide business-actionable customer experience data analyses to diverse VA Customers and external entities with similar data management needs. Further, CxDW extends their data management services to other VA entities with data management needs and provides them with business actionable data analyses for their customers.

CxDW enables The Veteran Experience Office (VEO) to gain insights into the full encompassing experience of VA customers. It converts conditioned and refactored data into a consistent, common data model that can be used across the enterprise. It is a cloud data service product that allows other data platform owners to offload reporting and analytics overhead while also supporting a centralized repository of VA data.

1.9 VETERANS INFORMATICS AND COMPUTING INFRASTRUCTURE (VINCI)

The Veterans Informatics and Computing Infrastructure (VINCI) mission is to provide high-quality data, openly extensible information technology, and supporting services to generate and integrate new knowledge, methods, and technologies for research and medical-care communities to assess and improve Veterans’ healthcare. VINCI’s vision is to be part of a vital private-public community in which open-source and open-standards technologies provide a foundation for generation of new content and technologies to promote transparent and reproducible health science and business intelligence. VINCI provides Cloud based computing for no charge in the VA to authorized individuals and groups. VINCI offers Statistical Analysis for System (SAS), MATLAB, STATA and a host of analytic analysis software. VINCI will help researchers develop patient cohorts specific to their operational or research needs.

VINCI Research Program’s mantra is innovation and translation for dual research and operational medical-care benefit. Health Systems Research and Development (HSR&D) and VA in general, recognizes that for a sustainable, relevant, and vibrant program, the Program must serve a dual mission that supports health services research and innovative business intelligence. The following statements of mission, vision, and value are from the perspective of research. For a broader perspective, researchers could be interchanged with business-intelligence innovators and practitioners. VINCI Research Program’s mission is to provide services to help researchers and clinicians appropriately access data and use tools, to conduct research addressing key gaps in VINCI’s offerings, and to manage the interface with IT partners for translating research innovations into deployed tools for general use. VINCI Research Program’s vision is an enticing, cooperative scientific infrastructure that provides a majority of HSR&D funded projects with transparent methods and reusable tools resulting in reproducible results.

VINCI utilizes the Corporate Data Warehouse (CDW) which is the central collection of standardized databases integrating key enterprise-wide clinical, administrative, and financial data to provide a unified view of VA data. In addition to CDW data, VINCI uses data from National Institute of Health (NIH), Center for Medicare and Medicaid Services (CMS), DoD and other data sources. The CDW strategy includes standard information, standard architectures, and standard tools that management needs to have access to data to support management decision making. The Business Intelligence Services Line (BISL) requires support services for the CDW teams. VINCI is a research and development partnership and clinical operational platform for health services research, epidemiology, decision support, and business intelligence; and its partners are the VHA HSR&D program, VHA’s Office of Informatics and Analysis, and OI&T BISL. All participating groups desire that their contributions be managed as an integrated organization, the impact of which will be much greater than the sum of its parts.

Since VINCI has expertise in the Veterans Health Information System and Technology Architecture (VistA) Electronic Health Record (EHR) data, other VA projects will call upon this expertise to further the larger mission of OI&T to assist in data migrations, transformations and conversion to Cerner or other formats. Also, as VA Community Care progresses more data sources will become available and VINCI will need to be able to incorporate those sources in the support pool of data. These are potential data sources that will be valuable in the VINCI environment. In addition to the data support, a research Natural Language Processing (NLP) effort yielded some versatile software that will be used for search in both the commercial software and VistA environments. It is expected that enhancement and sustainment of this effort will be supported by VINCI.

VINCI brings together data sources and provides the analytical environment for performing studies, data stewards such as VHA National Data Systems (NDS), VA Information Resource Center (VIReC), Oak Ridge National Labs (ORNL) and others that authorize research access to patient data. This potentially could include Cerner, Community Care, and other initiatives in the future. New research projects are granted access to dynamic views or snapshots of data that can be updated as needed. In addition to data storage, VINCI includes a cluster of servers set aside for tasks like analysis, data processing, and extracting information from text. This means that VA researchers will have access to data and the applications they need to select, transform, and analyze patient data in a central, secure location accessible from the VA intranet.

1.10 ROBOTICS PROCESS AUTOMATION (RPA)

The VA Robotic Process Automation (RPA) Center of Excellence (COE) provides VA customers with services they need to start and maintain and successful RPA Program.

These include security and privacy governance, purchasing of licenses; acquisition of integrator services; RPA program support; RPA system integrator network; and best practices. The VA RPA Platform provides Secure platform environment maintained by the VA within the VA Enterprise Cloud with a High Authority to Operate (ATO) with ongoing maintenance and support from the VA COE. Two leading RPA software solutions are available, UiPath and Blue Prism. Both solutions have Orchestration and runtime resources in Development, Pre-Production, and Production environments.

Business rule-based AI/ML capabilities are available to automate use cases with AI needs.

1.11 OTHER PRODUCT ENGINEERING SERVICE DA (PES DA) PRODUCTS

The DAIMO system will continue to support a variety of PES DA products. These products may include applications created to access, examine and correlate data available in one or more of the platforms listed above. Such products include, but are not limited to:

• Access to Care (ATC)

• CDW-Electronic Quality Measurement (CDW-eQM)

• CDW Mental Health (MH)

• Coordinated Care Tracking System (CCTS)

• National Surveillance Tool (NST)

• VA Common Operating Platform (COP) (Palantir)

• PACT Act Data Mart

• Data Interoperability (DI)

• Federated Data Sharing with External Agencies

• Source and Domain Aligned Authoritative Data Products

1.12 DATA ACCESS SERVICE (DAS) ENTERPRISE SERVICE ENHANCEMENTS

(DESE)

The Data Access Service (DAS) Enterprise Service Enhancements (DESE) project is the enhancement of DAS Core Phase 1 and 2 capabilities. Enhancements in DESE are driven by service requests initiated by DESE partners, also referred to as customers, and require the use of messaging and data persistent middleware to service data calls from their respective systems.

DESE is a system of middleware applications that is responsible for the transport of Veterans health, benefits, or administrative data between DESE partners. DESE partners are generally categorized into two groups: producers who typically provide data and can be external or internal to VA; and consumers who are typically partners that are end users of data and are internal or external to VA.

DESE provides a common access mechanism for data related to Veterans’ electronic record information which is stored in and outside of VA. The VLER DAS MongoDB is authorized to store 3rd party data (e.g., external Veteran/Service Member data) which is transported from the provider entity (e.g., DoD, Walgreens, contracted vendors) to the large MongoDB repository.

DAS was, and DESE is, essential to VA’s ability to execute its mission and proactively provide Veterans with access to the full continuum of services and benefits they have earned. DESE sets the foundation for sharing information within VA and between VA and its external partners. DESE delivers a wide range of integrally linked, complementary capabilities that enable information sharing throughout VA and with its partners.

DESE delivers a wide range of integrally linked, complementary capabilities that enable information sharing throughout VA and with its partners, including but not limited to:

• Affordable Care Act (ACA) Reporting to Centers for Medicare/Medicaid Services

(CMS)

• Joint Legacy Viewer (JLV)

• Veteran Health Information Exchange (VHIE) (formerly known as VLER Health) and eHealth Exchange

• VA Pharmacy Re-engineering (PRE) Inbound Prescriptions (eRX)

• Veterans Benefits Management System (VBMS)

• Veterans Health Information Systems and Technology Architecture (VistA)

Imaging (VI) Viewers (Computerized Patient Record System [CPRS], JLV,

• Electronic Health Management Platform [eHMP])

• Community Care (Community Care Network)

2.0 APPLICABLE DOCUMENTS

1. In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

2. 44 U.S.C. § 3541-3549, “Federal Information Security Management Act (FISMA) of

2002”

3. “Federal Information Security Modernization Act of 2014”

4. Federal Information Processing Standards (FIPS) Publication 140-2, “Security

Requirements for Cryptographic Modules”

5. FIPS Pub 199. “Standards for Security Categorization of Federal Information and

Information Systems,” February 2004

6. FIPS Pub 200, “Minimum Security Requirements for Federal Information and

Information Systems,” March 2006

7. FIPS Pub 201-2, “Personal Identity Verification of Federal Employees and

Contractors,” August 2013

8. 10 U.S.C. § 2224, "Defense Information Assurance Program"

9. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

10. Public Law 109-461, Veterans Benefits, Health Care, and Information Technology

Act of 2006, Title IX, Information Security Matters

11. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”

12. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, https://www.va.gov/vapubs/index.cfm

13. VA Handbook 0710, “Personnel Security and Suitability Program,” May 2, 2016, https://www.va.gov/vapubs/index.cfm

14. VA Directive and Handbook 6102, “Internet/Intranet Services,” August 5, 2019

15. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and

Guidelines,” January 18, 2017

16. Office of Management and Budget (OMB) Circular A-130, “Managing Federal

Information as a Strategic Resource,” July 28, 2016

17. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed

Services (CHAMPUS)”

18. NIST SP 800-66 Rev. 1, “An Introductory Resource Guide for Implementing the

Health Insurance Portability and Accountability Act (HIPAA) Security Rule,” October 2008

19. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended, January 18, 2017

20. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

21. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021

22. VA Handbook 6500, “Risk Management Framework for VA Information Systems

VA Information Security Program,” February 24, 2021 23.

24. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal

Information (SPI),” March 12, 2019

25. VA Handbook 6500.5, “Incorporating Security and Privacy into the System

Development Lifecycle,” March 22, 2010

26. VA Handbook 6500.6, “Contract Security,” March 12, 2010 https://www.va.gov/vapubs/index.cfm https://www.va.gov/vapubs/index.cfm

27. VA Handbook 6500.8, “Information System Contingency Planning,” April 6, 2011

28. VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018

29. VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017

30. OIT Process Asset Library (PAL), https://www.va.gov/process/ . Reference

Process Maps at https://www.va.gov/process/maps.asp and Artifact templates at https://www.va.gov/process/artifacts.asp

31. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

32. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014

33. VA Handbook 6508.1, “Procedures for Privacy Threshold Analysis and Privacy Impact Assessment,” July 30, 2015

34. VA Handbook 6510, “VA Identity and Access Management,” January 15, 2016

35. VA Directive and Handbook 6513, “Secure External Connections,” October 12,

36. VA Directive 6300, “Records and Information Management,” September 21, 2018

37. VA Handbook, 6300.1, “Records Management Procedures,“ March 24, 2010

38. NIST SP 800-37 Rev 2, “Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy,” December 2018

39. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020)

40. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015

41. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” March 24, 2014

42. OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005

43. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019

44. OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008

45. Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance, December 2, 2011, (NOTE: Part A of the FICAM Roadmap and Implementation Guidance, v2.0, was replaced in 2015 with an updated Architecture (https://arch.idmanagement.gov/#what-is-the-ficam-architecture)

46. NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access,“ June 2018

47. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, “Digital Identity Guidelines,” updated March 02, 2020

48. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014

49. Draft National Institute of Standards and Technology Interagency Report (NISTIR)

7981, “Mobile, PIV, and Authentication,” March 2014 https://www.va.gov/process/ https://www.va.gov/process/maps.asp https://www.va.gov/process/artifacts.asp https://www.va.gov/trm/TRMHomePage.aspx https://arch.idmanagement.gov/#what-is-the-ficam-architecture https://arch.idmanagement.gov/#what-is-the-ficam-architecture

50. VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

51. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

52. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

53. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

54. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019

55. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008

56. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (Public Law 110–140), December 19, 2007

57. Section 104 of the Energy Policy Act of 2005, (Public Law 109–58), August 8, 2005

58. Executive Order 13834, “Efficient Federal Operations,” dated May 17, 2018

59. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 2, 2001

60. VA Directive 0058, “VA Green Purchasing Program,” July 19, 2013

61. VA Handbook 0058, “VA Green Purchasing Program,” July 19, 2013

62. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote

Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

63. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

64. “Veteran Focused Integration Process (VIP) Guide 4.0,” January 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

65. VA Memorandum “Proper Use of Email and Other Messaging Services,” January

2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

66. “DevSecOps Product Line Management Playbook” version 2.0, May 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

67. NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020

68. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol

Version 6 (IPv6),” November 19, 2020

69. Social Security Number (SSN) Fraud Prevention Act of 2017

70. Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23, 2018

71. FedRAMP Authorization Act, December 23, 2022

72. VA SaaS Definition - Attachment 1

73. Existing VA Enterprise Case Management Solutions (VECMS) Solutions -

Attachment 2

Please be advised that any hyperlinks contained within this document, if any, are for convenience purposes, only. Due to the dynamic nature of hyperlinks and the information accessed through or imbedded therein, it is incumbent upon the Contractor https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514 https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896 https://www.cisa.gov/publication/tic-30-core-guidance-documents https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371 https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946 to ensure that all information required to successfully complete the requirements established herein is independently located, verified for accuracy, and confirmed to be the most up-to-date version available, prior to use.

3.0 SCOPE OF WORK

The Contractor is required to offer a comprehensive range of services for the systems outlined in Sections 1.1 to 1.12. These services include production and non-production support and provisioning, operations and maintenance (O&M) for all product environments, project/product management, solution development, coordination with partners, software integration, testing, release management, technical support, training, content management, systems engineering, development, enhancements, modernization, and documentation. These services should support the Veterans Affairs Office of Information Technology (VA OIT) processes and adhere to the DevOps and agile methodologies. Agile processed and frameworks utilized will vary by team and may include Scrum, Kanban, and the Scaled Agile Framework (SAFe). Some product teams may employ tailored hybrid approach based on the previously listed frameworks and methodologies.

Additionally, the Contractor must adhere to VA 6500 policies, Service Level Agreements (SLAs), and Authority to Operate (ATO) requirements. The contractor may be called upon to facilitate the modernization of legacy applications through transition of hosting to the VAEC cloud environment and will be responsible for proposing solutions that utilize cloud-native, highly resilient design patterns where able. Some modernization efforts may require the adoption of Low Code/No Code (LCNC) solutions built upon approved VA OIT platforms. All modernization and re-hosting efforts will require the Contractor to develop decommissioning plans for legacy environments and must include support for training of VA staff, end users and other technical personnel identified in the planning cycle.

For the Base Period and all Option Periods, the Contractor must provide scrum teams (as detailed in PWS 4.6.1) to support O&M for the products listed in Sections 1.1 through 1.12. Any additional O&M and Development teams needed throughout the task order period will be addressed by authorizing optional tasks for additional scrum teams.

3.1 APPLICABILITY

This Task Order (TO) effort PWS is within the scope of paragraph(s) of the T4NG Basic

PWS:

4.1 Program Management, Strategy, Enterprise Architecture and Planning Support

4.1.1 Strategy and Planning

4.1.2 Standards, Policy, Procedure and Process Development, and Implementation Support

4.1.3 Requirements Development and Analysis Support

4.1.3.1 Requirements Packages

4.1.4 Technology Refresh and Configuration Reviews

4.1.5 Studies and Analyses

4.1.6 Program Management Support

4.1.7 Product Data

4.1.8 IT Services Management Support

4.2 Systems/Software Engineering

4.2.1 Design and Development

4.2.2 Architecture Development

4.2.4 Enterprise Application/Services

4.2.5 Cloud Computing

4.2.6 Web Application Design and Development

4.2.7 Mobile Application Design and Development

4.2.8 Human-computer Interaction

4.2.9 System/Software Integration

4.2.10 Modeling and Simulation

4.4.11 Informatics Services

4.2.12 Engineering and Technical Documentation

4.2.13 Current System and Data Migration

4.2.14 Devlopment Toolkit Support

4.3 Software Technology Demonstration and Transition,

4.4 Test and Evaluation (T&E)

4.5 Independent Verification and Validation (IV&V)

4.6 Enterprise Network

4.8 Operations and Maintenance

4.9 Cyber Security

4.10 Training

4.11 Information Technology Facilities.

3.2 ORDER TYPE

The effort shall be proposed on a hybrid Firm Fixed Price (FFP) and Time and Materials (T&M) basis with a Cost Reimbursable (CR) line item for travel. The Optional Tasks for Development referenced in PWS Sections 5.5.1 CDW Admin & Support Services, 5.5.3 Build and Development and 5.6 Solution Architect shall be proposed on a T&M basis.

4.0 PERFORMANCE DETAILS

4.1 PERFORMANCE PERIOD

The Period of Performance (PoP) shall consist of one 12-month base period, four 12-month option periods, and nine Optional Tasks. The overall PoP shall not exceed 60 months.

4.2 PLACE OF PERFORMANCE

The work to be performed under this TO shall be performed at Contractor furnished facilities and work may be performed at remote locations with prior concurrence from the Contracting Officer’s Representative (COR). Work shall be conducted during core business hours of 8:00am-5:00pm EST, unless specified otherwise. For specific meeting types, including user requirements sessions and other key meetings which are best accomplished at Government facilities, the Government will schedule meeting rooms as necessary. No work under this TO shall take place outside the United States.

If required, all travel will be pre-approved by the COR.

4.3 TRAVEL OR SPECIAL REQUIREMENTS

The Government anticipates travel to perform the tasks associated with the effort to attend program-related meetings and user requirement sessions throughout the PoP.

Travel shall be proposed on a Cost-Reimbursable basis. There will be 12 large trips of 20 people yearly traveling to DC, Austin, TX, and St. Petersburgh FL, and 40 trips of 4 people or less per year to various US destinations. Travel shall be in accordance with the Federal Travel Regulations (FTR) and requires advanced concurrence by the COR.

Contractor travel within the local commuting area will not be reimbursed.

4.4 CONTRACT MANAGEMENT

All requirements of Sections 3.0 and 5.0 of the PWS apply to this effort. This TO shall be addressed in the Contractor’s Progress, Status and Management Report as set forth in the T4NG Basic contract. (TBD based on RFI)

4.5 GOVERNMENT FURNISHED PROPERTY

The Government has multiple remote access solutions available to include Citrix Access Gateway (CAG), Site-to-Site Virtual Private Network (VPN), and RESCUE VPN.

The Government’s issuance of Government Furnished Equipment (GFE) is limited to Contractor personnel requiring direct access to the network to: development environments; install, configure and run Technical Reference Model (TRM) approved software and tools (e.g., Oracle, Fortify, Eclipse, SoapUI, WebLogic, LoadRunner);

upload/download/ manipulate code, run scripts, and apply patches; configure and change system settings; check logs, troubleshoot/debug, and test/QA.

When necessary, the Government will furnish desktops or laptops, for use by the Contractor to access VA networks, systems, or applications to meet the requirements of this PWS. The overarching goal is to determine the most cost-effective approach to providing needed access to the VA environment coupled with the need to ensure proper Change Management principles are followed. Contractor personnel shall adhere to all VA system access requirements for on-site and remote users in accordance with VA standards, local security regulations, policies, and rules of behavior. GFE shall be approved by the COR and Program Manager on a case-by-case basis prior to issuance.

Based upon the Government assessment of remote access solutions and requirements of this TO, the Government estimates that the following GFE will be required by this TO:

1. Up to 150 developer-grade laptops

2. Up to 250 standard grade laptops.

The Government will not provide IT accessories including, but not limited to Mobile Wi- Fi hotspots/wireless access points, additional or specialized keyboards or mice, laptop bags, extra charging cables, extra Personal Identity Verification (PIV) card readers, peripheral devices, or additional Random Access Memory (RAM). The Contractor is responsible for providing these types of IT accessories in support of the TO as necessary and any VA installation required for these IT accessories shall be coordinated with the COR.

The Status of Government Furnished Equipment Report under the T4NG Basic Contract requirements is applicable to this TO and shall be delivered to the COR/VA PM as required.

4.6 SCRUM TEAM / PERSONNEL REQUIREMENTS

4.6.1 SCRUM TEAM SIZE

Task Size / Complexity Description

Spike A Spike Scrum Team is appropriate for short, focused activity by individuals with deep experience or specific skills. Spike Teams would be utilized to investigate new technologies, evaluate tools and third-party products for fit within the products/programs they support, or evaluate feasibility of complex architecture changes.

Small System efficiency improvements; minor to moderate changes to existing processes. Updating existing letters, forms, reports or correspondence protocols, and modify API. Moderate to major user interface updates.

Modifications/deletions to 3 to 8 data fields in an information service (and

Task Size / Complexity Description corresponding adapter, access, and/or partner component). Minor user interface changes or API if applicable, reference table updates, data validation, minor updates to existing business rules or existing services, modifications/deletions to 2 or less data fields in an information service (and corresponding adapter), Medium Minor to moderate enhancements, major business rule additions or rewrites, extensive database modifications or major modifications to existing services, new letters, forms, reports, or correspondence protocols, 1-2 new SOA components (Presentation, Process, Information, Business Application, Access, Partner, Infrastructure levels), integration with new system, system modifications to propagate/seed/synchronize authoritative data to/from a source where a propagation or seeding exists. Orchestrations with 1-2 non- dependencies.

Additions / modifications / deletions to 9 data fields in an information service (and corresponding adapter, access, and/or partner component), Development of new web services requiring 1-2 component levels.

Large Development of new web services or APIs requiring 3-5 or more component (logic layer, service layer, infrastructure layer, or partner layer) levels, or extensive system modifications to propagate/seed/synchronize authoritative data to/from a new service, orchestrations with 3-5 dependencies. Development of new web services or APIs requiring 5 or more component levels and 2+ integrations, orchestrations with 6 or more dependencies, major system enhancements impacting multiple systems/services.

Multi Multi-Team: The Contractor shall provide a combined scrum team consisting of a minimum of 12 FTE and a maximum of 18 FTE resources in total led by a single scrum master to support all services/deliverables required by PWS 5.2 (O&M), PWS 5.3 (CDW Support), PWS 5.4 (VINCI Support) or PWS 5.5 (Development), including all subparagraphs

4.6.2 Personnel Requirements

The Contractor shall provide at least one Scrum Alliance Certified Scrum Master for every two active scrum teams.

The Contractor shall provide personnel with requisite skillsets to support the following functional areas for all products:

• Application/System Support – Tier 3 fault isolation and triage

• Database Administration, Operations and Development

• Application/System Administration

• Application/Systems Engineering

• Software Development

• Middleware Support

• Monitoring Tools Support

•…