RFI ERP SI PWS DRAFT6.26.26.pdf

PERFORMANCE WORK STATEMENT (PWS) 10

DEPARTMENT OF VETERANS AFFAIRS 11

Office of Information & Technology 13

Infrastructure Operations (IO) - Enterprise Service Management (ESM) 14

Enterprise Resource Planning (ERP) 16 Date: June 26, 2026 17

VA-26-000769 18

PWS Version Number: 1.0 19

Enterprise Resource Planning

VA-26-000769

Contents 27

1.0 BACKGROUND .................................................................................................... 5 28

2.0 APPLICABLE DOCUMENTS................................................................................ 5 29

3.0 SCOPE OF WORK ............................................................................................... 9 30

4.0 PERFORMANCE DETAILS ................................................................................ 10 31

4.1 PERFORMANCE PERIOD ............................................................................. 10 32

4.2 PLACE OF PERFORMANCE ......................................................................... 11 33

4.3 TRAVEL .......................................................................................................... 11 34

5.0 SPECIFIC TASKS AND DELIVERABLES .......................................................... 11 35

5.1 PROJECT MANAGEMENT ............................................................................. 11 36

5.1.1 CONTRACTOR PROJECT MANAGEMENT PLAN ................................... 11 37

5.1.2 REPORTING REQUIREMENTS ............................................................... 11 38

5.2 ENTERPRISE SERVICE INTEGRATION, LICENSING, OPERATIONS, AND 39

ACCOUNTABILITY MODEL ...................................................................................... 12 40

5.2.1 ENTERPRISE OPERATIONAL OUTCOME REQUIREMENTS ................ 13 41

5.2.2 ENTERPRISE DELIVERY MODEL ........................................................... 14 42

5.2.3 ENTERPRISE LICENSING ACCOUNTABILITY AND TRANSPARENCY 15 43

5.2.4 ENTERPRISE OPERATIONAL ACCOUNTABILITY ................................. 17 44

5.2.5 PLATFORM OPERATIONS, SUSTAINMENT, AND MODERNIZATION... 19 45

5.2.6 CONTINUOUS SERVICE IMPROVEMENT AND BUSINESS VALUE 46

REALIZATION........................................................................................................ 20 47

5.2.7 ENTERPRISE AVAILABILITY AND OPERATIONAL CONTINUITY ......... 22 48

5.2.8 INCIDENT RESPONSE AND SERVICE RESTORATION ......................... 24 49

5.2.9 CHANGE , RELEASE, AND MODERNIZATION PERFORMANCE .......... 25 50

5.2.10 INTEGRATION RELIABILITY AND DATA INTEGRITY ............................. 26 51

5.2.11 SECURITY AND OPERATIONAL RESILIENCE ....................................... 27 52

5.2.12 USER EXPERIENCE, ADOPTION, AND SERVICE EFFICIENCY ........... 29 53

5.2.13 SYSTEM INTEGRATOR TRANSITION-IN SERVICES ............................. 30 54

5.3 ENTERPRISE RESOURCE PLANNING PLATFORM REQUIREMENTS ...... 31 55

5.3.1 ITSM .......................................................................................................... 32 56

5.3.2 ITAM .......................................................................................................... 34 57

5.3.3 ITOM.......................................................................................................... 36 58

5.3.4 ITBM .......................................................................................................... 37 59

5.3.5 DIGITAL WORKPLACE ............................................................................. 39 60

5.3.6 CSM........................................................................................................... 40 61

5.3.7 SecOps ...................................................................................................... 41 62

5.3.8 INTEGRATED RISK MANAGEMENT........................................................ 42 63

5.3.9 INTEGRATION CENTER .......................................................................... 44 64

5.3.10 REPORTING AND ANALYTICS ................................................................ 46 65

5.3.11 PLATFORM TOOLS .................................................................................. 48 66

5.3.12 MOBILE ..................................................................................................... 54 67

5.3.13 PRODUCTION INSTANCES ..................................................................... 55 68

5.3.14 NON-PRODUCTION INSTANCES ............................................................ 57 69

5.3.15 PLATFORM PERFORMANCE TESTING INSTANCE ............................... 58 70

5.4 TRAINING ....................................................................................................... 59 71

5.5 OPTION PERIOD ONE - FOUR ..................................................................... 60 72

5.6 PLATFORM TRANSITION IN – TOOL REQUIREMENTS (OPTIONAL TASK 1)73

60 74

5.6.1 IMPLEMENT CURRENT FUNCTIONALITY .............................................. 61 75

5.6.2 MIGRATION FROM SERVICENOW ......................................................... 63 76

5.6.3 FedRAMP AUTHORIZED AND VA AUTHORIZED ................................... 63 77

5.7 ENTERPRISE ASSET MANAGEMENT (OPTIONAL TASK 2) ....................... 64 78

5.8 ENTERPRISE HRSD (OPTIONAL TASK 3) ................................................... 66 79

5.9 ARTIFICIAL INTELLIGENCE (OPTIONAL TASK 4) ....................................... 66 80

5.9.1 GENERATIVE AI CAPABILITIES .............................................................. 67 81

5.9.2 AGENTIC AI CAPABILITIES ..................................................................... 67 82

5.9.3 COMBINED GENERATIVE AI AND AGENTIC AI USE CASES ................ 68 83

5.10 DATA LAKE SOLUTION (OPTIONAL TASK 5) .............................................. 68 84

5.11 GREENFIELD SOLUTION - Out of the Box (OPTIONAL TASK 6) ................. 70 85

5.12 VENDOR RISK MANAGEMENT (VRM) (OPTIONAL TASK 7) ....................... 72 86

5.13 FIELD SERVICE MANAGEMENT (OPTIONAL TASK 8) ................................ 73 87

5.14 Cloud Cost Management & FINANCIAL operations (finops) (optional task 9) 74 88

5.15 DISTRIBUTED DEVELOPMENT AND SUSTAINMENT (OPTIONAL Task 10)89 77 90

5.15.1 ORDERING AND AUTHORIZATION MODEL ........................................... 78 91

5.15.2 OUTCOME-BASED SCOPING AND SOLUTION ASSESSMENT ............ 79 92

5.15.3 SCOPE DEFINITION AND WORK PACKAGE REQUIREMENTS ............ 80 93

5.15.4 STANDARDIZED PRICING AND CONSUMPTION MODEL ..................... 81 94

5.15.5 ENTERPRISE DEMAND MANAGEMENT AND FORECASTING ............. 83 95

5.15.6 ENTERPRISE ARCHITECTURE, REUSE, AND STANDARDIZATION .... 84 96

5.15.7 DELIVERY ACCOUNTABILITY AND OPERATIONAL READINESS ........ 85 97

5.15.8 SUSTAINMENT AND LIFECYCLE ACCOUNTABILITY ............................ 86 98

5.15.9 PERFORMANCE OUTCOMES AND KEY PERFORMANCE INDICATORS99

87 100

5.16 TRANSITION OUT (OPTIONAL TASK 11) ..................................................... 88 101

6.0 GENERAL REQUIREMENTS ............................................................................. 90 102

6.1 ENTERPRISE AND IT FRAMEWORK ............................................................ 90 103

6.1.1 VA TECHNICAL REFERENCE MODEL .................................................... 90 104

6.1.2 ZERO TRUST – VA CRITICAL SECURITY CONTROLS .......................... 90 105

6.1.3 FEDERAL IDENTITY, CREDENTIAL, AND ACCESS MANAGEMENT 106

(FICAM) ................................................................................................................. 90 107

6.1.4 INTERNET PROTOCOL VERSION 6 (IPv6) ............................................. 91 108

6.1.5 TRUSTED INTERNET CONNECTION (TIC) ............................................. 92 109

6.1.6 STANDARD COMPUTER CONFIGURATION .......................................... 92 110

6.1.7 VETERAN FOCUSED INTEGRATION PROCESS (VIP) AND PRODUCT 111

LINE MANAGEMENT (PLM) .................................................................................. 93 112

6.1.8 PROCESS ASSET LIBRARY (PAL) .......................................................... 93 113

6.1.9 AUTHORITATIVE DATA SOURCES ......................................................... 94 114

6.1.10 SOCIAL SECURITY NUMBER (SSN) REDUCTION ................................. 95 115

6.1.11 SOFTWARE AND LICENSING REQUIREMENTS .................................... 95 116

6.1.12 GENERATIVE ARTIFICIAL INTELLIGENCE REQUIREMENTS ............... 95 117

6.1.12.1 AI SYSTEM/LLM DEVELOPMENT AND OPERATION 118

DOCUMENTATION REQUIREMENTS .............................................................. 97 119

6.1.12.2 MONITORING, REPORTING, AND CORRECTIVE ACTION ........... 98 120

6.1.12.3 AI MODEL UPDATES AND CHANGE DISCLOSURES ................... 98 121

6.1.13 SOURCE CODE HARMONIZATION AND REUSE IN INFORMATION 122

TECHNOLOGY (SHARE IT Act) ............................................................................ 99 123

6.2 SECURITY AND PRIVACY REQUIREMENTS ............................................... 99 124

6.2.1 POSITION/TASK RISK DESIGNATION LEVEL(S) ................................... 99 125

6.2.2 CONTRACTOR PERSONNEL SECURITY REQUIREMENTS ............... 100 126

6.3 METHOD AND DISTRIBUTION OF DELIVERABLES .................................. 102 127

6.4 PERFORMANCE METRICS ......................................................................... 102 128

6.5 FACILITY/RESOURCE PROVISIONS .......................................................... 103 129

6.6 GOVERNMENT FURNISHED PROPERTY .................................................. 104 130

6.7 SHIPMENT OF HARDWARE OR EQUIPMENT ........................................... 104 131

ADDENDUM A – ADDITIONAL VA REQUIREMENTS, CONSOLIDATED ................. 105 132

ADDENDUM B – VA INFORMATION AND INFORMATION SYSTEM SECURITY/ 133

PRIVACY LANGUAGE ................................................................................................ 110 134

1.0 BACKGROUND 137

The Department of Veterans Affairs (VA), Office of Information and Technology (OIT), 138 Infrastructure Operations (IO) Enterprise Service Management (ESM) requires the 139 acquisition of cloud-based Enterprise Resource Planning (ERP) solution delivered via a 140 multi-instance Platform-as-a-Service (PaaS) and Software-as-a-Service (SaaS) 141 subscription model. The Government requires a fully integrated enterprise operating 142 model in which the Contractor served as Enterprise System Integrator, is accountable 143 for the service delivery, performance, reliability, maintainability, scalability, 144 supportability, and continuous improvement of the enterprise IT Service Management 145 platform and associated enterprise services. 146 This requirement supports the VA mission to enhance IT service delivery, strengthen 148 operational efficiency, and advance digital transformation across the enterprise. The 149 required solution must provide enterprise-wide integration and functionality consistent 150 with leading ERP in the marketplace 151 VA OIT currently leverages a SaaS platform to manage critical enterprise operational 153 practices, including enterprise service desk operations, incident and event triage, 154 request fulfillment, change enablement, and problem resolution. Additionally, the 155 platform supports application provisioning, clinician support, and telehealth availability. 156 The SaaS platform is central to maintaining uptime for essential systems, including 157 Veterans Health Information Systems and Technology Architecture (VistA) and the new 158 Oralce/Cerner Electronic Health Record Management (EHRM) platform. 159 As demand increases for real-time support, automation, cybersecurity compliance, and 161 adaptability to evolving legislative and policy requirements, VA requires acquisition of a 162 next-generation ERP solution with capabilities that meet or exceed industry standards 163 for federal environments. This solution must span across IT Service Management 164 (ITSM), IT Asset Management (ITAM), IT Operations Management (ITOM), IT Business 165 Management (ITBM), Human Resource Service Delivery (HRSD), and other service 166 domains. 167

2.0 APPLICABLE DOCUMENTS 169

In the performance of the tasks associated with this Performance Work Statement, the 170 Contractor shall comply with the following: 171

1. “Federal Information Security Modernization Act of 2014” 172

2. Federal Information Processing Standards (FIPS) Publication 140-3, 173

“Security Requirements for Cryptographic Modules”, March 22, 2019 174

3. FIPS Pub 199. “Standards for Security Categorization of Federal Information 175 and Information Systems,” February 2004 176

4. FIPS Pub 200, “Minimum Security Requirements for Federal Information and 177

Information Systems,” March 2006 178

5. FIPS Pub 201-3, “Personal Identity Verification of Federal Employees and 179

Contractors,” January 2022 180

6. 10 U.S.C. § 2224, "Defense Information Assurance Program", as amended 181

7. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974” 182

8. Public Law 109-461 (P.L. 109-461), Veterans Benefits, Health Care, and 183 Information Technology Act of 2006, as amended, Title IX, Information 184 Security Matters 185

9. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”, as amended 186

10. VA Directive 0710, “Personnel Vetting Program,” September 8, 2025, 187 https://www.va.gov/vapubs/index.cfm 188

11. VA Handbook 0710, “Personnel Vetting Program,” September 8, 2025, 189 https://www.va.gov/vapubs/index.cfm 190

12. VA Directive 6102, “Internet/Intranet Services,” August 5, 2019 191

13. 36 C.F.R. Part 1194 “Information and Communication Technology Standards 192 and Guidelines,” as amended 193

14. Office of Management and Budget (OMB) Circular A-130, “Managing Federal 194

Information as a Strategic Resource,” July 28, 2016 195

15. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed 196

Services (CHAMPUS)”, as amended 197

16. NIST SP 800-66 Rev. 2, “Implementing the Health Insurance Portability and 198

Accountability Act (HIPAA) Security Rule: A Cybersecurity Resource Guide,” 199 February 2024 200

17. 45 C.F.R Parts 160 and 164, Subparts A and E, the Standards for Privacy of 201 Individually Identifiable Health Information (“Privacy Rule”); and 45 C.F.R. 202 Parts 160 and 164, Subparts A and C, the Security Standard (“Security 203 Rule”); as amended 204

18. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as 205 amended 206

19. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004 207

20. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021 (see VA 208

NOTICE 24-18, dated September 27, 2024, “Update to VA Directive 6500 209 Cybersecurity Program”, and VA Notice 25-07, dated 3/18/25, “Amending VA 210 Directive 6500 to incorporate M-24-15”) 211

21. VA Handbook 6500, “Risk Management Framework for VA Information 212 Systems VA Information Security Program,” February 24, 2021 (see VA 213 Notice 25-01, dated October 15, 2024, “Update to VA Handbook 6500 Risk 214 Management Framework for VA Information Systems VA Information 215 Security Program”, and VA Notice 25-06, dated 3/18/25, “Amending VA 216 Directive 6500 to incorporate M-24-15”, VA Notice 25-16, dated September 217 15, 2025, “Amending VA Handbook 6500 to Replace Enterprise Mission 218 Assurance Support Services Tool With Office of Information Technology 219 Governance Risk Compliance Tool, and VA Notice 25-17, dated September 220 22, 2025, “Rescission Of Office Of Information Security (OIS) Deputy 221 Assistant Secretary (DAS) Memorandum – Requirements of Proper Plan of 222 Action and Milestones (POA&M) Completion) 223

22. VA Handbook 6500.2, “Management of Breaches Involving Sensitive 224 Personal Information (SPI),” June 30, 2023 225

23. VA Handbook 6500.6, “Contract Security,” March 12, 2010 (see VA Notice 226 24-12, dated April 22, 2024, “Update to VA Handbook 6500.6, Contract 227 https://www.va.gov/vapubs/index.cfm https://www.va.gov/vapubs/index.cfm http://www.va.gov/vapubs http://www.va.gov/vapubs

Security, Appendix C VA Information and Information System 228 Security/Privacy Language For Inclusion Into Contracts, As Appropriate”) 229

24. VA Handbook 6500.8, “Information System Contingency Planning,” March 230 25, 2025 231

25. VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018 232 (see VA NOTICE 25-10, dated June 9, 2025, “Use of Personally Owned 233 Mobile Devices Policy Amendment of Department of Veterans Affairs 234 Handbook 6500.10”, and VA Notice 25-15, dated August 22, 2025, “Update 235 to VA Handbook 6500.10 Mobile Device Security Policy”) 236

26. VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017 237

27. OIT Process Asset Library (PAL), OIT Process Asset Library. 238

28. One-VA Technical Reference Model (TRM) (reference at 239 https://www.va.gov/trm/TRMHomePage.aspx) 240

29. VA Directive 6508, “Implementation of Privacy Threshold Analysis and 241

Privacy Impact Assessment,” October 15, 2014 242

30. VA Directive 6510, “VA Identity, Credential and Access Management,” 243

September 3, 2024 244

31. VA Handbook 6510, “VA Identity, Credential and Access Management,” 245

September 27, 2024 246

32. VA Directive and Handbook 6513, “Secure External Connections,” October 247

12, 2017 248

33. VA Directive 6300, “Records and Information Management,” September 21, 249

2018 250

34. VA Handbook, 6300.1, “Records Management Procedures,“ March 24, 2010 251

35. NIST SP 800-37 Rev 2, “Risk Management Framework for Information 252

Systems and Organizations: A System Life Cycle Approach for Security and 253 Privacy,” December 2018 254

36. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal 255 Information Systems and Organizations,” September 23, 2020 (includes 256 updates as of 12/10/2020) 257

37. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) 258 Program,” October 26, 2015 259

38. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-260

12) Program,” March 24, 2014 261

39. OMB Memorandum 05-24, “Implementation of Homeland Security 262 Presidential Directive (HSPD) 12 – Policy for a Common Identification 263 Standard for Federal Employees and Contractors,” August 5, 2005 264

40. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved 265 Identity, Credential, and Access Management,” May 21, 2019 266

41. OMB Memorandum, “Guidance for Homeland Security Presidential Directive 267 (HSPD) 12 Implementation,” May 23, 2008 268

42. Federal Identity, Credential, and Access Management (FICAM) Architecture, 269 June 30, 2023 (FICAM Architecture (idmanagement.gov)) 270

43. NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity 271 Verification (PIV) Credentials in Facility Access,“ June 2018 272 https://digital.va.gov/process-asset-library/ https://www.va.gov/trm/TRMHomePage.aspx https://www.idmanagement.gov/arch/#:%7E:text=FICAM%20is%20the%20federal%20government%E2%80%99s%20enterprise%20approach%20to,identity%20processes%2C%20practices%2C%20policies%2C%20and%20information%20security%20disciplines.

44. NIST SP 800-63 Rev 4, 800-63A-4, 800-63B-4, 800-63C-4, “Digital Identity 273 Guidelines,” August 1, 2025 274

45. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014 275

46. VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland 276

Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference 277 https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514) 278

47. IAM Identity Management Business Requirements Guidance document, May 279 2013, (reference Enterprise Architecture Section, PIV/IAM (reference 280 https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514) 281

48. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy 282 Clarification,” July 17, 2019, 283 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896 284

49. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, 285 https://www.cisa.gov/publication/tic-30-core-guidance-documents 286

50. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections 287 (TIC) Initiative,” September 12, 2019 288

51. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain 289 Name System Infrastructure,” August 22, 2008 290

52. Sections 524 and 525 of the Energy Independence and Security Act of 2007, 291 (P.L. 110–140), December 19, 2007 292

53. Section 104 of the Energy Policy Act of 2005, (P.L. 109–58), August 8, 2005 293

54. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 294

2, 2001 295

55. Executive Order 14148, “Initial Rescissions of Harmful Executive Orders and 296

Actions,” dated January 20, 2025 297

56. VA Directive 0057, “VA Environmental Management Program,” October 25, 298

2022 299

57. OIS VAIQ #7424808 Memorandum, “Remote Access,” January 15, 2014, 300 https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 301

58. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103 302

59. “Veteran Focused Integration Process (VIP) Guide 4.0,” March 2021, 303 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371 304

60. VA Memorandum “Proper Use of Email and Other Messaging Services,” 305

January 2, 2018, 306 https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 307

61. “Product Line Management Transformation Playbook” version 3.1, August 308 2023, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946 309

62. NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020 310

63. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol 311

Version 6 (IPv6),” November 19, 2020 312

64. Social Security Number (SSN) Fraud Prevention Act of 2017 313

65. Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23, 314

2018 315

66. C.F.R Title 15 Part 7, “Securing the Information and Communications 316

Technology and Services (ICTS) Supply Chain”, as amended 317 https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514 https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896 https://www.cisa.gov/publication/tic-30-core-guidance-documents https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371 https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

67. Executive Order 14028, “Executive Order on Improving the Nation's 318 Cybersecurity,” May 12, 2021, https://bidenwhitehouse.archives.gov/briefing-319 room/presidential-actions/2025/01/16/executive-order-on-strengthening-and-320 promoting-innovation-in-the-nations-cybersecurity/ 321

68. OMB Memorandum M-22-09, “Moving the U.S. Government Toward Zero 322 Trust Cybersecurity Principles”, January 26, 2022, 323 https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf. 324

69. NIST SP 800-52 Revision 2, “Guidelines for the Selection, Configuration, and 325 Use of Transport Layer Security (TLS) Implementations 326

70. OMB M-26-05, “Adopting a Risk-based Approach to Software and Hardware 327 Security,” January 23, 2026 328

71. OMB M-21-31, “Improving the Federal Government’s Investigative and 329 Remediation Capabilities Related to Cybersecurity Incidents,” August 27, 330 2021 331

72. NIST SP 800-88 Revision 1 “Guidelines for Media Sanitization,” December 332 2014 333

73. CISA Binding Operational Directive (BOD) 19-02: “Vulnerability Remediation 334 Requirements of Internet-Accessible Systems,” April 29, 2019, BOD 19-02: 335 Vulnerability Remediation Requirements for Internet-Accessible Systems | 336

CISA 337

74. CISA BOD 22-01: “Reducing the Significant Risk of Known Exploited 338 Vulnerabilities,” November 3, 2021, BOD 22-01: Reducing the Significant 339 Risk of Known Exploited Vulnerabilities | CISA 340

75. CISA BOD 23-01: Improving Asset Visibility and Vulnerability Detection on 341 Federal Networks.” Cybersecurity & Infrastructure Security Agency (CISA), 342 BOD 23-01: Improving Asset Visibility and Vulnerability Detection on Federal 343 Networks | CISA 344

76. VA Directive 6550, Pre-Procurement Assessment and Implementation of 345 Medical Devices/Systems, June 03, 2019 346

77. VA Memorandum, “VA Security Controls,” January 17, 2025, 347 https://www.voa.va.gov/DocumentView.aspx?DocumentID=5010 348

78. E.O. 13960, “Promoting the Use of Trustworthy Artificial Intelligence in the 349 Federal Government,” December 3, 2020 350

79. E.O. 14319, “Preventing Woke AI in the Federal Government,” July 23, 2025 351

80. OMB Memorandum M-25-21, “Accelerating Federal Use of AI through 352

Innovation, Governance, and Public Trust,” April 3, 2025 353

81. OMB Memorandum M-25-22, “Driving Efficient Acquisition of Artificial 354

Intelligence in Government,” April 3, 2025 355

82. OMB Memorandum M-26-04, “Increasing Public Trust in Artificial Intelligence 356

(AI) Through Unbiased AI Principles,” December 11, 2025 357

3.0 SCOPE OF WORK 359

The Contractor shall serve as the enterprise System Integrator, responsible for 360 performing enterprise service integration, providing and managing all necessary 361 licensing, conducting operations and sustainment activities, executing modernization 362 initiatives, and maintaining full accountabilities for all assigned tasks and outcomes. The 363 https://bidenwhitehouse.archives.gov/briefing-room/presidential-actions/2025/01/16/executive-order-on-strengthening-and-promoting-innovation-in-the-nations-cybersecurity/ https://bidenwhitehouse.archives.gov/briefing-room/presidential-actions/2025/01/16/executive-order-on-strengthening-and-promoting-innovation-in-the-nations-cybersecurity/ https://bidenwhitehouse.archives.gov/briefing-room/presidential-actions/2025/01/16/executive-order-on-strengthening-and-promoting-innovation-in-the-nations-cybersecurity/ https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf https://www.cisa.gov/news-events/directives/bod-19-02-vulnerability-remediation-requirements-internet-accessible-systems https://www.cisa.gov/news-events/directives/bod-19-02-vulnerability-remediation-requirements-internet-accessible-systems https://www.cisa.gov/news-events/directives/bod-19-02-vulnerability-remediation-requirements-internet-accessible-systems https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities https://www.cisa.gov/news-events/directives/bod-23-01-improving-asset-visibility-and-vulnerability-detection-federal-networks https://www.cisa.gov/news-events/directives/bod-23-01-improving-asset-visibility-and-vulnerability-detection-federal-networks https://www.voa.va.gov/DocumentView.aspx?DocumentID=5010 https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-21-Accelerating-Federal-Use-of-AI-through-Innovation-Governance-and-Public-Trust.pdf https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-22-Driving-Efficient-Acquisition-of-Artificial-Intelligence-in-Government.pdf https://www.whitehouse.gov/wp-content/uploads/2025/12/M-26-04-Increasing-Public-Trust-in-Artificial-Intelligence-Through-Unbiased-AI-Principles-1.pdf?_bhlid=c0113a16495d987bc33f63e3dccf35c28d6bfd15

Contractor shall provide a single, unified product/platform to support an enterprise-wide 364 ERP SaaS/PaaS solution with a subscription model that includes licensing and support. 365 The Contractor shall ensure that no additional platforms or tools are required for the 366 implementation and operation of the solution. 367 The Contractor shall also perform the following optional tasks when these tasks are 369 exercised: 370

1. Enterprise Asset Management 372

2. Enterprise HRSD 373

3. Artificial Intelligence (AI) 374

4. Data Lake Solution 375

5. Greenfield Solution 376

6. Vendor Risk Management 377

7. Field Service Management 378

8. Transition Out 379

4.0 PERFORMANCE DETAILS 381

4.1 PERFORMANCE PERIOD 383

The PoP shall be 12-month base period with four 12-month option periods with nine 384 Optional Tasks. The overall Period of Performance shall not exceed 60 months. 385 Any work at the Government site shall not take place on Federal holidays or weekends 387 unless directed by the Contracting Officer (CO). 388 There are 11 Federal holidays set by law (USC Title 5 Section 6103) that VA follows: 390 Under current definitions, five are set by date: 392 New Year's Day January 1 394 Juneteenth June 19 395 Independence Day July 4 396 Veterans Day November 11 397 Christmas Day December 25 398 If any of the above falls on a Saturday, then Friday shall be observed as a holiday. 400 Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday. 401 The other six are set by a day of the week and month: 403 Martin Luther King's Birthday Third Monday in January 405 Washington's Birthday Third Monday in February 406 Memorial Day Last Monday in May 407 Labor Day First Monday in September 408 Columbus Day Second Monday in October 409

Thanksgiving Fourth Thursday in November 410

4.2 PLACE OF PERFORMANCE 412

Tasks under this PWS shall be performed at Contractor facilities. The Contractor shall 413 identify the Contractor’s place of performance in their proposal submission. 414

4.3 TRAVEL 416

The Government does not anticipate travel under this effort. 417

5.0 SPECIFIC TASKS AND DELIVERABLES 419

The Contractor shall perform the following: 420

5.1 PROJECT MANAGEMENT 422

5.1.1 CONTRACTOR PROJECT MANAGEMENT PLAN 424

The Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays 425 out the Contractor’s approach, timeline, and tools to be used in execution of the 426 contract. The CPMP should take the form of both a narrative and graphic format that 427 displays the schedule, milestones, risks, and resource support. The CPMP shall also 428 include how the Contractor shall coordinate and execute planned, routine, and ad hoc 429 data collection reporting requests as identified within the PWS. The initial baseline 430 CPMP shall be concurred upon and updated in accordance with Section B of the 431 contract. The Contractor shall update and maintain the VA Program Manager (PM) 432 approved CPMP throughout the PoP. 433 Deliverable: 435

A. Contractor Project Management Plan 436

5.1.2 REPORTING REQUIREMENTS 438

The Contractor shall provide the Contracting Officer’s Representative (COR) with 439 weekly Progress Reports in electronic form in Microsoft Word and Project formats. The 440 report shall include detailed instructions/explanations for each required data element, to 441 ensure that data is accurate and consistent. These reports shall reflect data as of the 442 last day of the preceding week. 443 The Weekly Progress Reports shall cover all work completed during the reporting period 445 and work planned for the subsequent reporting period. The report shall also identify any 446 problems that arose and a description of how the problems were resolved. If problems 447 have not been completely resolved, the Contractor shall provide an explanation 448 including their plan and timeframe for resolving the issue. The report shall also include 449 an itemized list of all Information and Communication Technology (ICT) deliverables 450 and their current Section 508 conformance status. The Contractor shall monitor 451 performance against the CPMP and report any deviations. It is expected that the 452 Contractor will keep in communication with VA accordingly so that issues that arise are 453 transparent to both parties to prevent escalation of outstanding issues. 454

The Contractor shall conduct an Annual Reporting Capability Review within the 4th 456 quarter of the federal fiscal year. The review shall include comprehensive review of the 457 platform’s reporting and analytics capabilities, with recommendations for 458 enhancements. 459 Deliverable: 461

A. Weekly Progress Report 462

5.2 ENTERPRISE SERVICE INTEGRATION, LICENSING, OPERATIONS, AND 464

ACCOUNTABILITY MODEL 465

The Contractor shall perform enterprise service integration, provide and manage 466 licensing, conduct operations and sustainment, execute modernization, and maintain full 467 accountability in its role as the enterprise System Integrator. The Contractor shall 468 provide the management, operational capabilities, technical coordination, vendor 469 coordination, sustainment support, licensing coordination, release management, 470 integration support, and continuous improvement capabilities necessary to deliver a 471 secure, scalable, resilient, and continuously supportable enterprise environment. The 472 Contractor shall provide the enterprise licensing, service delivery, operational support, 473 and sustainment support. The Contractor shall meet all Service Level Agreement (SLA) 474 requirements applicable to the Contractor’s enterprise System Integrator role. Where 475 requirements overlap, this section shall be interpreted as establishing the Contractor’s 476 integrated enterprise accountability for achieving the operational outcomes, service 477 performance levels, modernization outcomes, and lifecycle sustainment obligations 478 described herein. 479 The Contractor shall ensure the enterprise platform supports VA mission operations by 481 enabling reliable delivery of Veteran-facing and mission-support services, improving 482 enterprise service delivery efficiency, reducing operational disruption, improving user 483 experience, increasing automation and self-service adoption, and reducing duplicative 484 or non-standard enterprise capabilities. The Contractor shall remain accountable for 485 achievement of the outcomes required by this PWS regardless of dependencies such 486 as subcontractor participation, original equipment manufacturer dependencies, cloud 487 provider dependencies, third-party service relationships, or supporting infrastructure 488 arrangements. 489 The Contractor shall not attribute performance failures, outages, service degradation, 491 licensing deficiencies, integration failures, sustainment issues, or operational delays to 492 subcontractors, software publishers, cloud providers, infrastructure providers, or other 493 third parties as a basis for avoiding contractual responsibility. The Contractor shall 494 manage and coordinate all such dependencies as part of its enterprise service 495 integration responsibilities. 496 The Government shall retain ownership of all Government data, metadata, 498 configurations, workflows, automations, integrations, reports, analytics, documentation, 499 operational records, and associated information assets created, processed, stored, 500 configured, or maintained under this contract. The Contractor shall ensure Government 501 access, portability, auditability, and transitionability of those assets throughout the 502 Period of Performance. 503

5.2.1 ENTERPRISE OPERATIONAL OUTCOME REQUIREMENTS 505

The Contractor shall achieve measurable enterprise operational outcomes throughout 506 the Period of Performance. These outcomes shall support VA mission priorities and 507 shall improve the reliability, usability, scalability, interoperability, maintainability, and 508 efficiency of enterprise IT service delivery. 509 The Contractor shall maintain the enterprise platform in a manner that improves 511 operational resiliency, reduces recurring incidents, increases standardization, reduces 512 unnecessary customization, improves integration reliability, improves data integrity, and 513 supports continuous platform modernization. The Contractor shall also improve user-514 facing outcomes by increasing self-service utilization, improving customer satisfaction, 515 reducing manual service fulfillment activities, and supporting more efficient completion 516 of enterprise service requests. 517 The Contractor shall establish operational baselines within 90 calendar days of contract 519 award. Baseline methodology shall be included in the Transition-In Readiness 520 Assessment as indicated in 5.2.13 and approved by the Contracting Officer’s 521 Representative prior to finalization. The Contractor shall provide an Enterprise 522 Operational Baseline and Improvement Plan which include baseline data sources, 523 assumptions, known data gaps, data quality limitations, and measurement 524 methodology. Performance improvement requirements under this section shall be 525 measured against the approved baseline beginning in the first full contract year 526 following baseline approval. 527 Baselines shall include, at a minimum, platform availability, incident trends, service 528 restoration times, change success rates, release performance, integration performance, 529 user satisfaction, self-service adoption, automation utilization, recurring incident rates, 530 modernization delivery performance, and business value realization measures. The 531 Contractor shall use these baselines to demonstrate measurable year-over-year 532 improvement. 533 The Enterprise Operational Baseline and Improvement Plan shall include, at minimum: 535 approved baseline values for each required metric; data sources and collection 536 methodology for each metric; identified trends and known operational risks; year-one 537 improvement targets for each metric; and proposed measurement and reporting 538 cadence. 539 The Contractor shall maintain performance management capabilities sufficient to 541 identify recurring service issues, modernization constraints, underutilized platform 542 capabilities, automation opportunities, service delivery inefficiencies, and opportunities 543 to reduce duplicative or non-standard functionality. The Contractor shall provide 544 recommendations to the Government that support improved service reliability, 545 enterprise reuse, platform standardization, operational efficiency, and mission-aligned 546 modernization. Upon Government approval, the baseline values in Enterprise 547 Operational Baseline and Improvement Plan shall serve as the performance targets. 548 Standard Acceptable Quality Level (AQL) Measurement Method

Completeness All required content elements are presented per PWS section requirements; no more than 3 minor deficiencies per submission.

COR review of deliverable.

Accuracy Factual errors or data discrepancies in no more than 2% of reported data points per submission.

COR review of reported data and supporting documentation.

Timeliness Submitted on or before the due date established in the Contract Deliverables Requirements List; no more than 1 late submission per contract year.

Deliverable schedule

Enterprise Operational Baseline Established

Baseline delivered within 90 calendar days of contract award.

COR review of deliverable.

Year-over-Year Recurring Incident Reduction

Minimum 10% reduction in recurring incident volume per contract year versus prior year baseline.

Monthly and annual incident trend analysis.

Enterprise Platform Standardization

No more than 3 unsupported customizations identified in annual modernization assessment.

Annual modernization assessment and configuration review.

Improvement Plan Submission

Submitted on time. COR review of deliverable.

Failure to meet a performance standard shall require the Contractor to submit a written 551 Corrective Action Plan to the COR within five business days and to implement 552 corrective actions within the timeframe approved by the COR and the Contracting 553 Officer (CO), not to exceed 30 calendar days for Priority 1 and Priority 2 deficiencies 554 and 60 calendar days for Priority 3 and Priority 4 deficiencies as defined in the SLA at 555 Attachment 001. 556 Deliverable: 558

A. Enterprise Operational Baseline and Improvement Plan 559

5.2.2 ENTERPRISE DELIVERY MODEL 561

The Contractor shall assume the operational and financial risk associated with normal 562 enterprise growth, increased user adoption, transaction volume growth, expanded 563 platform utilization, routine modernization demand, and service scaling necessary to 564 maintain required performance levels. For purposes of this section, normal enterprise 565 growth means increases in licensed user counts, transaction volumes, platform 566 utilization, or related operational demand. that do not exceed 15% above the baseline 567 established at award in any contract year. Growth exceeding this threshold shall be 568 subject to contract modification at the Government’s discretion. 569 The Contractor shall not impose additional charges for routine operational scaling, 571 standard platform upgrades, maintenance releases, support activities, or licensing 572 adjustments required to maintain the contracted enterprise service levels, except where 573 expressly authorized by the contract. 574 The Contractor shall submit the Annual Enterprise Pricing Integrity Certification within 576 30 calendar days of each contract year anniversary. The Certification will be accepted 577 by the Government if it identifies all active cost components, 100% of licensing, 578 sustainment, operational, and modernization costs separately identifiable with no 579 undisclosed markups. Certifications failing Government acceptance shall be 580 resubmitted within 15 business days. 581 Performance Standard

Acceptable Quality Level Measurement Method

Annual Enterprise Pricing Integrity Certification Submission

Submitted within 30 calendar days of each contract year anniversary.

COR review of certification submission date and completeness.

Pricing Transparency

100% of licensing, sustainment, operational, and modernization costs separately identifiable with no undisclosed markups or bundled pricing structures.

COR review of pricing artifacts, invoices, and supporting documentation.

Invoice Reconciliation Accuracy

Pricing certification reconciles to invoiced amounts within no more than 2% variance.

Invoice reconciliation and financial review.

Operational Scaling Support

Contractor maintains required service levels during normal enterprise growth without additional charges.

SLA performance reports and operational trend analysis.

Deliverable: 584

A. Annual Enterprise Pricing Integrity Certification. 585

5.2.3 ENTERPRISE LICENSING ACCOUNTABILITY AND TRANSPARENCY 587

The Contractor shall provide, manage, coordinate, and maintain all licensing, 588 subscriptions, entitlements, support agreements, and related licensing activities 589 necessary to sustain uninterrupted enterprise platform operations and approved 590 modernization activities. The Contractor shall ensure all licensing remains current, valid, 591 sufficient, and aligned with authorized enterprise usage. 592 The Contractor shall structure licensing to support enterprise scalability, phased 594 deployment, module expansion, operational continuity, upgrade compatibility, and long-595 term maintainability. Licensing shall align to actual Government usage and adoption to 596 the maximum extent practicable and shall avoid unnecessary purchase of unused 597 capacity when phased deployment or usage-based consumption is available. 598 The Contractor shall provide the most cost-effective licensing model type, including 600 named user, concurrent user, consumption-based, or enterprise licensing 601 arrangements, that meet Government requirements. The Contractor shall document the 602 basis for the selected licensing model in the Licensing Transparency Artifact and shall 603 identify alternative models considered and reasons for their exclusion. 604 The Contractor shall provide a Licensing Transparency Artifact that shows licensing 606 costs shall be separately identifiable from implementation, sustainment, modernization, 607 operational support, and other professional service costs. The Contractor shall not 608 obscure licensing costs through undisclosed markups, hidden fees, bundled structures 609 that prevent cost validation, or packaging arrangements that prevent the Government 610 from understanding what is being purchased and how pricing was calculated. 611 The Contractor shall maintain an enterprise licensing management capability that 613 identifies license quantities, license types, modules, unit prices, discount structures, 614 utilization levels, unused capacity, growth assumptions, and optimization opportunities. 615 The Contractor shall recommend actions to reduce unnecessary licensing costs, 616 improve utilization, and support future enterprise scalability and provide a Licensing 617 Optimization Assessment capturing the above requirements. 618 The Contractor shall provide Enterprise Licensing Management that identify, at 620 minimum, all active licenses by type, module, and vendor; unit prices and applicable 621 discount structures; the basis for the selected licensing model; comparison of alternative 622 models considered; utilization rates; unused capacity; growth assumptions; pending 623 renewals; and expiration dates within the subsequent 12-month period. 624 Performance Standard

Acceptable Quality Level Measurement Method

Licensing Transparency Artifact

Updated on schedule with all required licensing elements identified.

COR review of deliverable.

Unused Capacity Identification

Unused licensed capacity exceeding 15% identified and corrective recommendations provided quarterly.

Licensing Optimization Assessment review.

Performance Standard

Acceptable Quality Level Measurement Method

Licensing Renewal Tracking

100% of licenses with expiration within 12 months identified in reporting.

License inventory and renewal audit.

Licensing Model Optimization

Contractor documents evaluation of alternative licensing models and justification for selected approach.

COR review of Licensing Transparency Artifact.

Deliverables: 627

A. 628 B. Licensing Optimization Assessment 629 C. Licensing Transparency Artifact 630

5.2.4 ENTERPRISE OPERATIONAL ACCOUNTABILITY 632

The Contractor shall serve as the single point of accountability for end-to-end enterprise 633 operational performance. This accountability includes platform availability, application 634 functionality, integration performance, service support, sustainment, security 635 coordination, release management, vendor coordination, subcontractor performance, 636 operational continuity, and lifecycle support. 637 The Contractor shall maintain operational governance capabilities sufficient to identify 639 risks before they impact service delivery, coordinate resolution of enterprise issues, 640 prevent recurring failures, manage dependencies, support release planning, and 641 maintain continuity of enterprise services. The Contractor shall ensure that operational 642 risks are tracked, prioritized, mitigated, and reported no less than monthly in a manner 643 that supports timely Government decision-making. The Contractor shall add newly 644 identified risks to the Enterprise Service Accountability Dashboard Enterprise 645 Operational Risk Assessment within five business days of identification. Risks rated 646 High or Critical as defined in the SLA at Attachment 001 shall be reported to the COR 647 within two business days of identification. 648 The Contractor shall provide and maintain Risk Rating Methodology approved by the 650 Government within 60 calendar days of contract award. The methodology shall define 651 risk likelihood, consequence, and rating criteria at minimum. Risk ratings shall be 652 applied consistently across the Period of Performance. 653 The Contractor shall maintain enterprise coordination capabilities sufficient to manage 655 dependencies among software publishers, cloud providers, hosting providers, 656 subcontractors, infrastructure providers, third-party integrations, and VA stakeholders. 657 The Contractor shall ensure those dependencies do not degrade enterprise platform 658 performance, delay modernization, impair sustainment, or reduce service quality. 659 The Contractor will not be responsible for performance failures solely attributable to 661 Government-controlled systems, infrastructure, networks, or services outside Contractor 662 operational authority, provided the Contractor demonstrates timely escalation, 663 documented coordination, and reasonable mitigation efforts. 664 The Contractor shall maintain the ERP solution in a current, secure, and fully supported 666 state throughout the period of performance. The Contractor shall provide access to and 667 implement all standard OEM platform enhancements, security updates, performance 668 improvements, workflow automation capabilities, analytics capabilities, and AI 669 capabilities included within the Government's licensed subscription at no additional cost 670 to the Government. The Contractor shall provide a quarterly Technology Modernization 671 Report identifying newly available capabilities, recommended adoption actions, 672 implementation impacts, and anticipated business value. The Contractor shall maintain 673 upgrade readiness and support implementation of OEM-supported releases within 674 Government-approved timelines. 675 The ERP solution shall support secure, near real-time integration and data sharing 677 across all authorized ERP instances and environments. The Contractor shall ensure 678 enterprise data synchronization, interoperability, and reporting capabilities are 679 maintained with a minimum availability of 99.9% and without duplicate data repositories 680 or manual data re-entry processes. The Contractor shall support standard APIs, 681 integration services, and data exchange mechanisms necessary to enable enterprise-682 wide visibility, governance, reporting, and workflow orchestration across multiple 683 instances. 684 Performance Standard

Acceptable Quality Level Measurement Method

Enterprise Risk Register Maintenance

Newly identified risks entered into the register within 5 business days of identification.

Monthly risk register review.

High/Critical Risk Escalation

High and Critical risks reported to COR within 2 business days of identification.

COR review of escalation records and risk logs.

Government- Approved Risk Methodology

Risk methodology submitted and approved within 60 calendar days of contract award.

COR approval of methodology deliverable.

Dependency Coordination Effectiveness

No recurring unresolved dependency issue remains open longer than 30 calendar days without approved mitigation plan.

Operational governance…