S02 36C10B25R0032.pdf

PAGE 1 OF 1. REQUISITION NO.

2. CONTRACT NO. 3. AWARD/EFFECTIVE DATE 4. ORDER NO. 5. SOLICITATION NUMBER 6. SOLICITATION ISSUE DATE

a. NAME b. TELEPHONE NO. (No Collect Calls) 8. OFFER DUE DATE/LOCAL

TIME

9. ISSUED BY CODE 10. THIS ACQUISITION IS UNRESTRICTED OR SET ASIDE: % FOR:

SMALL BUSINESS

HUBZONE SMALL

BUSINESS

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

WOMEN-OWNED SMALL BUSINESS

(WOSB) ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

EDWOSB

8(A)

NAICS:

SIZE STANDARD:

11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

SEE SCHEDULE

12. DISCOUNT TERMS

13a. THIS CONTRACT IS A

RATED ORDER UNDER

DPAS (15 CFR 700)

13b. RATING

14. METHOD OF SOLICITATION

RFQ IFB RFP

15. DELIVER TO CODE 16. ADMINISTERED BY CODE

17a. CONTRACTOR/OFFEROR CODE FACILITY CODE 18a. PAYMENT WILL BE MADE BY CODE

TELEPHONE NO. UEI: EFT:

PHONE: FAX:

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN OFFER

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK BELOW IS CHECKED

SEE ADDENDUM

19. 20. 21. 22. 23. 24.

ITEM NO. SCHEDULE OF SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

(Use Reverse and/or Attach Additional Sheets as Necessary)

25. ACCOUNTING AND APPROPRIATION DATA 26. TOTAL AWARD AMOUNT (For Govt. Use Only)

27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1, 52.212-4. FAR 52.212-3 AND 52.212-5 ARE ATTACHED. ADDENDA ARE ARE NOT ATTACHED.

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA ARE ARE NOT ATTACHED

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN _______________ 29. AWARD OF CONTRACT: REF. ___________________________________ OFFER COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND DATED ________________________________. YOUR OFFER ON SOLICITATION DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY (BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED SET FORTH HEREIN IS ACCEPTED AS TO ITEMS:

30a. SIGNATURE OF OFFEROR/CONTRACTOR 31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER)

30b. NAME AND TITLE OF SIGNER (TYPE OR PRINT) 30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER (TYPE OR PRINT) 31c. DATE SIGNED

AUTHORIZED FOR LOCAL REPRODUCTION (REV. NOV 2021)

PREVIOUS EDITION IS NOT USABLE Prescribed by GSA - FAR (48 CFR) 53.212

7. FOR SOLICITATION

INFORMATION CALL:

STANDARD FORM 1449

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL PRODUCTS AND COMMERCIAL SERVICES

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 30

36C10B25R0032 9-09-2025

Daniel Renna 848 377 5048 09-10-2025

1PM EDT

36C10B Department of Veterans Affairs Technology Acquisition Center Procurement Services E 23 Christopher Way Eatontown NJ 07724

X 100

X

541519

$34 Million

N/A

X

See Delivery Schedule

36C10B

Department of Veterans Affairs Technology Acquisition Center Procurement Services E 23 Christopher Way Eatontown NJ 07724

9K5L9

HUNTRIDGE LABS, LLC

1 E MARKET ST STE 200

LEESBURG VA 20176-3014

DZR3YHG6WBM5

36C10A

Department of Veterans Affairs Technology Acquisition Center Financial Services Center PO Box 149971 Austin TX 78714-8971

Benefits Intake Optimization – Contract #1

This is a sole source contract to Huntridge Labs, LLC under the authority of 41 U.S.C. 3304(a)(5), “Authorized or Required by Statute”, as implemented by FAR 6.302-5.

X X

Heather Utt Contracting Officer

36C10B25R0032

Table of Contents

SECTION B - CONTINUATION OF SF 1449 BLOCKS

B.1 GOVERNING LAW CLAUSE

B.2 CONTRACT ADMINISTRATION DATA

B.3 PRICE/DELIVERY SCHEDULE

B.4 PERFORMANCE WORK STATEMENT

SECTION C - CONTRACT CLAUSES

C.1 FAR 52.252-2 CLAUSES INCORPORATED BY REFERENCE (FEB 1998)

C.2 FAR 52.204-21 BASIC SAFEGUARDING OF COVERED CONTRACTOR INFORMATION

SYSTEMS (NOV 2021)

C.3 FAR 52.212-5 CONTRACT TERMS AND CONDITIONS REQUIRED TO IMPLEMENT

STATUTES OR EXECUTIVE ORDERS—COMMERCIAL PRODUCTS AND COMMERCIAL

SERVICES (JAN 2025) (DEVIATION FEB 2025)

C.4 FAR 52.217-7 OPTION FOR INCREASED QUANTITY—SEPARATELY PRICED LINE

ITEM (MAR 1989)

C.5 VAAR 852.204-71 INFORMATION AND INFORMATION SYSTEMS SECURITY (FEB

2023)

C.6 VAAR 852.211-76 LIQUIDATED DAMAGES – REIMBURSEMENT FOR DATA BREACH

COSTS (FEB 2023)

C.7 VAAR 852.219-73 VA NOTICE OF TOTAL SET-ASIDE FOR CERTIFIED SERVICE-

DISABLED VETERAN-OWNED SMALL BUSINESSES (JAN 2023) (DEVIATION)

C.8 VAAR 852.219-75 VA NOTICE OF LIMITATIONS ON SUBCONTRACTING—

CERTIFICATE OF COMPLIANCE FOR SERVICES AND CONSTRUCTION (JAN 2023)

(DEVIATION)

C.9 VAAR 852.239-76 INFORMATION AND COMMUNICATION TECHNOLOGY

ACCESSIBILITY (FEB 2023)

C.10 VAAR 852.242-71 ADMINISTRATIVE CONTRACTING OFFICER (OCT 2020)

SECTION D - CONTRACT DOCUMENTS, EXHIBITS, OR ATTACHMENTS

SECTION E - SOLICITATION PROVISIONS

E.1 FAR 52.252-1 SOLICITATION PROVISIONS INCORPORATED BY REFERENCE (FEB

1998)

E.2 FAR 52.204-24 REPRESENTATION REGARDING CERTAIN TELECOMMUNICATIONS

AND VIDEO SURVEILLANCE SERVICES OR EQUIPMENT (NOV 2021)

E.3 FAR 52.204-29 FEDERAL ACQUISITION SUPPLY CHAIN SECURITY ACT ORDERS—

REPRESENTATION AND DISCLOSURES (DEC 2023)

E.4 FAR 52.209-7 INFORMATION REGARDING RESPONSIBILITY MATTERS (OCT 2018) ..89

E.5 FAR 52.212-3 OFFEROR REPRESENATIONS AND CERTIFICATIONS- COMMERCIAL

PRODUCTS AND COMMERCIAL SERVICES (MAY 2024) (DEVIATION FEB 2025)

E.6 FAR 52.216-1 TYPE OF CONTRACT (APR 1984)

E.7 FAR 52.233-2 SERVICE OF PROTEST (SEP 2006)

E.8 BASIS FOR AWARD

E.9 ADDENDUM to FAR 52.212-1 INSTRUCTIONS TO OFFERORS-COMMERCIAL ITEMS

SECTION B - CONTINUATION OF SF 1449 BLOCKS

B.1 GOVERNING LAW CLAUSE

Federal law and regulations, including the Federal Acquisition Regulations (FAR), shall govern this Contract/Order. Commercial license agreements may be made a part of this Contract/Order but only if both parties expressly make them an addendum hereto. If the commercial license agreement is not made an addendum, it shall not apply, govern, be a part of or have any effect whatsoever on the Contract/Order; this includes, but is not limited to, any agreement embedded in the computer software (clickwrap), any agreement that is otherwise delivered with or provided to the Government with the commercial computer software or documentation (shrinkwrap), or any other license agreement otherwise referred to in any document. If a commercial license agreement is made an addendum, only those provisions addressing data rights regarding the Government’s use, duplication and disclosure of data (e.g., restricted computer software) are included and made a part of this Contract/Order, and only to the extent that those provisions are not duplicative or inconsistent with Federal law, Federal regulation, the incorporated FAR clauses and the provisions of this Contract/Order;

those provisions in the commercial license agreement that do not address data rights regarding the Government’s use, duplication and disclosure of data shall not be included or made a part of the Contract/Order. Federal law and regulation including, without limitation, the Contract Disputes Act (41 U.S.C. § 7101 et seq.), the Anti- Deficiency Act (31 U.S.C. § 1341 et seq.), the Competition in Contracting Act (41 U.S.C.

§ 3301 et seq.), the Prompt Payment Act (31 U.S.C. §3901 et seq.), Contracts for Data Processing or Maintenance (38 U.S.C. § 5725), and FAR clauses 52.212-4, 52.227-14, 52.227-19 shall supersede, control, and render ineffective any inconsistent, conflicting, or duplicative provision in any commercial license agreement. In the event of conflict between this Clause and any provision in the Contract/Order or the commercial license agreement or elsewhere, the terms of this Clause shall prevail. Claims of patent or copyright infringement brought against the Government as a party shall be defended by the U.S. Department of Justice (DOJ). 28 U.S.C. § 516. At the discretion of DOJ, the Contractor may be allowed reasonable participation in the defense of the litigation. Any additional changes to the Contract/Order must be made by contract/order modification (Standard Form 30) and shall only be effected by a warranted Contracting Officer.

Nothing in this Contract/Order or any commercial license agreement shall be construed as a waiver of sovereign immunity.

B.2 CONTRACT ADMINISTRATION DATA

1. Contract Administration: All contract administration matters will be handled by the following individuals:

a. CONTRACTOR: Attn: Patrick Sullivan/patrick@huntridgelabs.com Huntridge Labs, LLC

1 E Market Street, Suite 200 Leesburg, VA 20176-3014

b. GOVERNMENT: Heather Utt/Heather.Utt@va.gov Contracting Officer 36C10B Department of Veterans Affairs Technology Acquisition Center 23 Christopher Way Eatontown NJ 07724

2. CONTRACTOR REMITTANCE ADDRESS: All payments by the Government to the contractor will be made in accordance with:

[X] 52.232-33, Payment by Electronic Funds Transfer—System For Award Management, or

[] 52.232-36, Payment by Third Party

3. INVOICES: Invoices shall be submitted in arrears:

a. Quarterly []

b. Semi-Annually []

c. Other [X] In accordance with Section B.3

4. GOVERNMENT INVOICE ADDRESS: All Invoices from the contractor shall be submitted electronically in accordance with VAAR Clause 852.232-72 Electronic Submission of Payment Requests.

5. ACKNOWLEDGMENT OF AMENDMENTS: The offeror acknowledges receipt of amendments to the Solicitation numbered and dated as follows:

AMENDMENT NO DATE

6. ARM Approval: 196987

B.3 PRICE/DELIVERY SCHEDULE

Inspection/Acceptance/F.O.B: Destination

BASE PERIOD

The Period of Performance shall be

12 Months from Date of Award Contract Line-Item Number (CLIN)

Description Qty Unit Unit Price Total Price

0001 Minimal Viable Product – Production Ready Source Code and Implementation on VA.gov – VA 21- 534EZ IAW PWS paragraph 5.2, inclusive of all subparagraphs except 5.2.6, 5.2.7 and 5.2.7.1.

Due By: November 11, 2025

This FFP CLIN includes all labor and deliverables required for the successful completion of the services detailed in PWS paragraph 5.2, inclusive of all subparagraphs except 5.2.6, 5.2.7 and 5.2.7.1.

Electronic submission to: www.va.gov Implementation, VA GitHub Software Source Code Inventory, VA PM, COR, CO, and OCTO.

PSC: DA01

1 LO $ $

0002 Enhanced Completed Form – Production Ready Source Code and Implementation on VA.gov – VA 21- 534EZ IAW PWS paragraph 5.2, inclusive of all subparagraphs except 5.2.6, 5.2.7 and 5.2.7.1.

Due By: March 30, 2026

This FFP CLIN includes all labor and deliverables required for the successful completion of the services detailed in PWS paragraph 5.2, inclusive of all subparagraphs except 5.2.6, 5.2.7 and 5.2.7.1.

1 LO $ $

This CLIN may be invoiced on a monthly basis in equal payments of the total CLIN price. However final invoice shall not be submitted until the Enhanced Form is delivered and accepted by the Government.

Electronic submission to: www.va.gov Implementation, VA GitHub Software Source Code Inventory, VA PM, COR, CO, and OCTO.

PSC: DA01

0003 Minimal Viable Product – Production Ready Source Code and Implementation on VA.gov – VA 21- 8416 IAW PWS paragraph 5.2, inclusive of all subparagraphs except 5.2.5, 5.2.7 and 5.2.7.1.

Due By: November 11, 2025

This FFP CLIN includes all labor and deliverables required for the successful completion of the services detailed in PWS paragraph 5.2, inclusive of all subparagraphs except 5.2.5, 5.2.7 and 5.2.7.1.

Electronic submission to: www.va.gov Implementation, VA GitHub Software Source Code Inventory, VA PM, COR, CO, and OCTO.

PSC: DA01

1 LO $ $

0004 Enhanced Completed Form – Production Ready Source Code and Implementation on VA.gov – VA 21- 8416 IAW PWS paragraph 5.2, inclusive of all subparagraphs except 5.2.5, 5.2.7 and 5.2.7.1.

Due By: March 30, 2026

This FFP CLIN includes all labor and deliverables required for the successful completion of the services detailed in PWS paragraph 5.2, inclusive of all subparagraphs.

This CLIN may be invoiced on a monthly basis in equal payments of the total CLIN price. However final invoice shall not be submitted until the Enhanced Form is delivered and accepted by the Government.

Electronic submission to: www.va.gov Implementation, VA GitHub Software Source Code Inventory, VA PM, COR, CO, and OCTO.

PSC: DA01

0005 Common Attachment Validator Component MVP Production Ready Source Code and Package IAW PWS paragraph 5.2.7.

Due By: November 11, 2025

This FFP CLIN includes all labor and deliverables required for the successful completion of the services detailed in PWS paragraph 5.2.7, inclusive of all subparagraphs.

Electronic submission to: www.va.gov Implementation, VA GitHub Software Source Code Inventory, VA PM, COR, CO, and OCTO.

PSC: DA01

1 LO $ $

0006 Common Attachment Validator Enhanced Component - Production Ready Source Code and Package IAW PWS paragraph 5.2.7.

Due By: March 30, 2026

This FFP CLIN includes all labor and deliverables required for the successful completion of the services detailed in PWS paragraph 5.2.7, inclusive of all subparagraphs.

This CLIN may be invoiced on a monthly basis in equal payments of the total CLIN price. However final invoice shall not be submitted until the Enhanced Form is delivered and accepted by the Government.

Electronic submission to: www.va.gov Implementation, VA GitHub Software Source Code Inventory, VA PM, COR, CO, and OCTO.

PSC: DA01

0007 Project Management IAW PWS paragraph 5.1, inclusive of all subparagraphs

PSC: DA01

12 MO Not Separately Priced

(NSP)

NSP

0007AA Contractor Project Management Plan IAW PWS paragraph 5.1.1.

Due: 30 days after contract award and updated monthly thereafter.

Delivered electronically to VA PM, COR, CO

PSC: DA01

1 LO NSP NSP

0007AB Program Status Dashboard IAW PWS paragraph 5.1.2.

Due: 14 days after contract award and updated monthly thereafter.

Delivered electronically to VA PM, COR, CO

PSC: DA01

1 LO NSP NSP

0007AC Contractor Staff Roster IAW PWS paragraph 6.2.2.

Due: 3 days after contract award and updated as required throughout the PoP.

Delivered electronically to VA PM, COR, CO

PSC: DA01

1 LO NSP NSP

BASE PERIOD TOTAL $

OPTIONAL TASKS

These optional tasks may be exercised by the Government IAW FAR 52.217-7 Option for Increased Quantity – Separately Priced Line Item (MAR 1989). Work shall not commence until, and unless, a formal modification is issued by the Contracting Officer.

These optional tasks shall be exercised multiple times up to the Not to Exceed (NTE) amount at the

Government’s discretion at any time during the Period of Performance.

Contract Line-Item Number (CLIN)

Description Qty Unit Unit Price Total Price

1001 Optional Task One – Sustainment IAW PWS paragraph 5.3.

May be exercised any time throughout the PoP up to the NTE amount.

This FFP CLIN includes all labor and deliverables required for the successful completion of the services detailed in PWS paragraph 5.3.

*Qty of one (1) equals one (1) two (2)-week sprint.

PSC: DA01

Not to Exceed

(NTE)

EA $ $

1001AA Bug and Issue Log IAW PWS paragraph 5.3.

Due: 30 days after exercise of Optional Task and updated monthly thereafter.

Electronic submission to: VA PM, COR, and CO.

PSC: DA01

12 EA NSP NSP

1001AB Update and Patch Summary Report IAW PWS paragraph 5.3.

Due: 30 days after exercise of Optional Task and updated monthly thereafter.

Electronic submission to: VA PM, COR, and CO.

PSC: DA01

12 EA NSP NSP

1001AC Security Audit Report IAW PWS paragraph 5.3.

Due: 30 days after exercise of Optional Task and updated monthly thereafter.

Electronic submission to: VA PM, COR, and CO.

12 EA NSP NSP

PSC: DA01

1002 Transition Support – Optional Task 2 IAW PWS paragraph 5.4.

This FFP CLIN includes all labor and deliverables required for the successful completion of the services detailed in PWS paragraph 5.4.

Period of Performance: 2 months from exercise of optional task.

2 MO

1002AA Transition Support Package IAW PWS paragraph 5.4.

Due: 7 days after exercise of Optional Task.

Electronic submission to: VA PM, COR, and CO.

1 EA

NSP NSP

OPTIONAL TASK TOTAL $

TOTAL BASE + OPTIONS $

B.4 PERFORMANCE WORK STATEMENT

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Office of Information & Technology Office of the Deputy Secretary

Benefits Intake Optimization - Contract #1

Date: 9/3/2025

VA-25-00104524

PWS Version Number: 1.0

1.0 BACKGROUND

The Department of Veterans Affairs (VA), Office of Information & Technology (OIT) strives to provide high-quality, effective, and efficient Information Technology (IT) services to those responsible for providing benefits and care to the Veterans throughout their journey with the Department in an effective, timely, and compassionate manner. VA depends on Information Management/Information Technology (IM/IT) systems to meet mission goals.

VA Memoranda “Delegation of Authority for Critical Veteran Services Initiatives (VIEWS 13018712)” dated April 9, 2025 prioritized reducing the disability claims backlog and implementing automation plans for Digital GI Bill (DGIB), Pension Optimization Initiatives (POI), and Veteran Readiness and Employment (VRE) and other program elements aimed at ensuring that Veterans receive their benefits they deserve in the most expeditious manner possible. Supporting this goal, the Deputy Secretary (DepSec) created the Critical Veterans Initiatives team, comprised of detailed members from OIT and Veterans Benefits Administration (VBA) offices. This effort places positive Veteran outcomes and drives all subsequent activities, actions, and solutions aimed at rapidly producing significant advances towards timely objectives.

These programs have a significant national impact and are the focus of Congressional and media attention. They directly align with the strategic objectives of the Secretary of Veterans Affairs and the DepSec and are in alignment with Executive Order “Improving Our Nation Through Better Design” dated August 21, 2025.

To expedite claims processing, the Critical Veterans Services Initiative (CVSI) will implement and oversee a subproject to establish and launch a data validation mechanism and build and publish additional forms on VA.gov. The forms selected have high volume and a high impact to the Veteran community. These forms are being added to VA.gov in support of the goal of reducing average days to complete (ADC) for multiple types of claims processed by the VBA. Adding data validation and the new forms will drive three key outcomes: 1) transition paper forms of intake for these claims to electronic intake to reduce scanning costs and improve information fidelity; 2) ensure data is captured for these claims to reduce data fidelity losses related to optical character recognition and optimize preparation for automation and; 3) drive validation of claimant inputs and optimize those inputs for automation.

2.0 APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. “Federal Information Security Modernization Act of 2014”

2. FIPS Pub 201-3, “Personal Identity Verification of Federal Employees and

Contractors,” January 2022

3. 10 U.S.C. § 2224, "Defense Information Assurance Program", as amended

4. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

5. Public Law 109-461 (P.L. 109-461), Veterans Benefits, Health Care, and

Information Technology Act of 2006, as amended, Title IX, Information Security Matters

6. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”, as amended

7. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, https://www.va.gov/vapubs/index.cfm

8. VA Handbook 0710, “Personnel Security and Suitability Program,” May 2, 2016, https://www.va.gov/vapubs/index.cfm

9. VA Directive 6102, “Internet/Intranet Services,” August 5, 2019

10. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and Guidelines,” as amended

11. Office of Management and Budget (OMB) Circular A-130, “Managing Federal

Information as a Strategic Resource,” July 28, 2016

12. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed

Services (CHAMPUS)”, as amended

13. NIST SP 800-66 Rev. 2, “Implementing the Health Insurance Portability and

Accountability Act (HIPAA) Security Rule: A Cybersecurity Resource Guide,” February 2024

14. 45 C.F.R Parts 160 and 164, Subparts A and E, the Standards for Privacy of Individually Identifiable Health Information (“Privacy Rule”); and 45 C.F.R.

Parts 160 and 164, Subparts A and C, the Security Standard (“Security Rule”); as amended

15. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended

16. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

17. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021 (see VA

NOTICE 24-18, dated September 27, 2024, “Update to VA Directive 6500 Cybersecurity Program”, and VA Notice 25-07, dated 3/18/25, “Amending VA Directive 6500 to incorporate M-24-15”)

18. VA Handbook 6500, “Risk Management Framework for VA Information Systems VA Information Security Program,” February 24, 2021 (see VA Notice 25-01, dated October 15, 2024, “Update to VA Handbook 6500 Risk Management Framework for VA Information Systems VA Information Security Program”, and VA Notice 25-06, dated 3/18/25, “Amending VA Directive 6500 to incorporate M-24-15”)

19. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI),” June 30, 2023

20. VA Handbook 6500.6, “Contract Security,” March 12, 2010 (see VA Notice 24-12, dated April 22, 2024, “Update to VA Handbook 6500.6, Contract Security, Appendix C VA Information and Information System Security/Privacy Language For Inclusion Into Contracts, As Appropriate”)

21. OIT Process Asset Library (PAL), OIT Process Asset Library.

22. VA Directive 6510, “VA Identity, Credential and Access Management,”

September 3, 2024

23. VA Handbook 6510, “VA Identity, Credential and Access Management,”

September 27, 2024

24. VA Directive 6300, “Records and Information Management,” September 21,

25. VA Handbook, 6300.1, “Records Management Procedures,“ March 24, 2010

26. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12)

Program,” October 26, 2015

27. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-

12) Program,” March 24, 2014

28. OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005

29. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019

30. NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access,“ June 2018

31. VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

32. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

33. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

34. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019

35. VA Directive 0057, “VA Environmental Management Program,” October 25,

36. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

37. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

38. “Veteran Focused Integration Process (VIP) Guide 4.0,” March 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

39. VA Memorandum “Proper Use of Email and Other Messaging Services,”

January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

40. NIST SP 800-88 Revision 1 “Guidelines for Media Sanitization,” December

41. VA Memorandum, “VA Security Controls,” January 17, 2025, https://www.voa.va.gov/DocumentView.aspx?DocumentID=5010

42. VA Memorandum, “Delegation of Authority for Critical Veteran Services Initiatives (VIEWS 13018712)” dated April 9, 2025 (Provided as contract attachment)

3.0 SCOPE OF WORK

The Contractor shall provide project management and agile software development services to digitize the identified forms and build them on VA.gov as well as a solution to efficiently and securely validate and process attachments within VA's forms on the VA.gov platform. Forms shall be made to use VA.gov’s existing design system, content style guide, forms system, and claims systems. The Contractor shall provide a shippable product that is both functional and compliant with security and accessibility requirements under each sprint. A shippable product is defined as one that has been deployed to a production-like environment, validated through testing, tested for resiliency, and determined, with Government approval, to be operable and available for end-user acceptance. The Contractor shall also provide optional sustainment services in support of the deployed forms.

The Contractor shall provide VA with two-week iterations of agile software delivery. The agile delivery iterations shall be supported by a multi-disciplinary team(s) with appropriate skillsets to support all or a mix of the following services: Technical advising and architecture planning, Service design and user research studies, Data science and data analytics, and/or Product support operations.

Before each two-week iteration, during iteration/sprint planning and continuously throughout the period of performance, the Contractor shall propose “sprint goal(s)” for the upcoming sprint which details the specific work items and deliverables to be completed during the sprint and shall gain approval on the proposed “sprint goal(s)” from the product owner and Contracting Officer’s Representative (COR) prior to the start of each sprint. The “sprint goal(s)” defined during sprint planning will be informed by a continuously prioritized backlog of work items towards the goals and outcomes listed in the PWS. The Contractor’s invoice for that sprint will be certified when the “sprint goal(s)” has been approved by the Product Owner and COR. Any item(s) that were initially included in the approved “sprint goal(s), but not delivered, must be discussed with the Product Owner/COR to ensure their removal from the “sprint goal” was appropriate and justified, prior to the invoice being certified.

3.1 OUTCOMES

The vision is an effortless online experience for Veterans or survivors to easily apply and receive their benefits within 1 business day.

No submissions are lost / all submissions reach downstream systems for processing as expected.

Increase in the quantity of claims forms received electronically.

Increase in the quantity of claims forms received digitally (i.e. where they do not just generate a PDF but where data is received along with the form). Reduction of offramps associated with data validation errors or where applications were received without the necessary inputs.

Reduction in average days to complete for Compensation and Pension benefits.

Submissions received from users revalidated as compatible with VA systems and validated for accuracy.

Increase security of form submissions and data validation procedures.

3.2 RELEVANT DOCUMENTATION

All applicable documents in section 2.0 of this PWS apply in addition to the following:

Find-a-Form Tool: https://www.va.gov/find-forms/ VA Design System: https://design.va.gov/ VA.gov Platform Forms Library: https://depo-platform-documentation.scrollhelp.site/developer-docs/va-forms-library-overview 21st Century IDEA: https://digital.gov/resources/21st-century-integrated-digital-experience-act/

Executive Order Improving Our Nation Through Better Design

4.0 PERFORMANCE DETAILS

4.1 PERFORMANCE PERIOD

The period of performance (PoP) shall be a 12-month base period from the time of award with two optional tasks. There are no option periods on the contract.

Any work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO).

There are 11 Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, five are set by date:

New Year's Day January 1 Juneteenth June 19 Independence Day July 4 Veterans Day November 11 Christmas Day December 25

If any of the above falls on a Saturday, then Friday shall be observed as a holiday.

Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

Martin Luther King's Birthday Third Monday in January Washington's Birthday Third Monday in February Memorial Day Last Monday in May Labor Day First Monday in September Columbus Day Second Monday in October Thanksgiving Fourth Thursday in November

4.2 PLACE OF PERFORMANCE

Tasks under this PWS shall be performed at Contractor facilities. The Contractor shall identify the Contractor’s place of performance in their proposal submission.

4.3 TRAVEL

The Government anticipates travel under this effort to perform the tasks associated with the effort, as well as to attend program-related meetings to include collaboration with subject matter experts and business representatives within multiple VA Offices in addition to other contracts performing work directly related to the scope of this contract throughout the PoP. Include all estimated travel costs in your firm-fixed price line items.

These costs will not be directly reimbursed by the Government.

The total estimated number of trips in support of the program-related meetings for this effort is four. Anticipated locations include the following, estimated at 2 to 3 days in duration:

1. VA Central Office (VACO), 810 Vermont Avenue, NW, Washington DC 20420

5.0 SPECIFIC TASKS AND DELIVERABLES

The Contractor shall perform the following:

5.1 PROJECT MANAGEMENT

5.1.1 CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, timeline, and tools to be used in execution of the contract. The CPMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks, and resource support. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPMP shall be concurred upon and updated in accordance with Section B of the contract. The Contractor shall update and maintain the VA PM approved CPMP throughout the PoP.

Deliverable:

A. Contractor Project Management Plan

5.1.2 REPORTING REQUIREMENTS

The Contractor shall manage the contract using agile best practices and provide the COR and Government team with direct access to current project status via a live Program Status Dashboard (e.g. Atlassian) or similar interface. The information provided shall include detailed instructions/explanations for data elements, to ensure that data is accurate and consistent.

The dashboard shall include current status shall cover all work completed during the reporting period and work planned for the subsequent reporting period. The information provided shall also identify any problems that arose and a description of how the problems were resolved. If problems have not been completely resolved, the Contractor shall provide an explanation including their plan and timeframe for resolving the issue.

The information provided shall also include an itemized list of all Information and Communication Technology (ICT) deliverables and their current Section 508 conformance status. The Contractor shall monitor performance against the CPMP and report any deviations. It is expected that the Contractor will keep in communication with VA accordingly so that issues that arise are transparent to both parties to prevent escalation of outstanding issues.

A. Program Status Dashboard

5.2 DIGITIZING NEW FORMS

For each of the forms identified within this PWS, the Contractor shall research, develop, and deliver digitized forms that drive toward the VA’s objectives and shall adhere to the following requirements and best practices.

5.2.1 REQUIREMENTS FOR DIGITAL INTAKE

The System Shall:

1. Provide a user-friendly, intuitive interface for Veterans or survivors to submit claims.

2. Adhere to VA.gov standards and design guidelines.

3. Ensure the User Interface adapts to varying screen sizes and devices, ensuring a responsive design.

4. Ensure the interface includes accessible features, adhering to Section 508 standards.

5. Implement clear instructions and guidance throughout the claims submission process.

6. Allow users to save progress and resume incomplete claims submissions.

7. Include automated workflows for processing submitted claims, reducing the need for manual intervention.

8. Implement backend rules to route claims to the appropriate processing queues based on complexity.

9. Ensure that high complexity claims trigger additional verification steps.

10. Integrate with VA.gov’s real-time tracking status for users, allowing them to monitor the progress of their claims.

11. Ensure integration with the Veterans Submission Tracing System.

12. Integrate into VA’s automated workflows for processing submitted claims, reducing the need for manual intervention.

13. Integrate with existing dashboards for VA staff to monitor system usage and performance.

14. Ensure the system complies with all relevant federal regulations and standards, including Section 508 for accessibility.

15. Maintain alignment with VA’s policies and best practices for web applications.

16. Ensure large and/or complex forms have multiple data fields with conditional logic based on user input and allow attachments, such as supporting documents and evidence.

17. Ensure medium-complex forms have data fields with standard processing rules.

18. Ensure small forms or low complexity have basic data fields and minimal processing rules for straightforward submissions.

19. Ensure that all forms, regardless of complexity, have validation rules and checks to ensure data accuracy

5.2.2 REQUIREMENTS FOR SPRINT TEAMS

The teams must:

1. Work in tandem with VA's internal team and stakeholders to ensure alignment of goals and objectives.

2. Follow best practices in coding standards, version control, and code reviews to maintain high-quality code.

3. Utilize existing VA.gov continuous integration (CI) and continuous deployment (CD) pipelines for automated testing and delivery.

4. Ensure that the codebase is well-documented to facilitate future maintenance and enhancements.

5. Implement test-driven development (TDD) and behavior-driven development (BDD) approaches.

6. Conduct comprehensive testing, including unit tests, integration tests, system tests, and user acceptance tests (UAT).

7. Perform regression testing to verify that new changes do not adversely affect existing functionality.

8. Gather feedback from actual users during UAT to inform improvements and identify pain points.

9. Implement changes based on user feedback to enhance the usability and functionality of the system.

10. Provide ongoing support during and after each sprint to address any issues or concerns raised by users.

11. Maintain clear and comprehensive documentation of all user stories, tasks, code, and system architecture.

12. Create user guides, administrative guides, and technical manuals to support system deployment and maintenance.

13. Ensure effective knowledge transfer to VA's internal teams to enable smooth handover and continued operation.

14. Provide transparency through real-time Project Status Dashboard and sprint review meetings.

15. Implement metrics to measure system performance, user satisfaction, and overall project health.

16. Identify, evaluate, and manage risks throughout the development lifecycle.

17. Implement mitigation strategies for identified risks to avoid potential project delays or issues.

18. Maintain a risk register and review it regularly during sprint planning and review meetings.

19. Ensure that all development activities comply with VA's security policies, privacy regulations, and federal standards.

20. Implement security best practices in coding, testing, and deployment to safeguard user data and system integrity.

21. Conduct regular security audits and vulnerability assessments as part of the sprint cycles.

22. Foster open and effective communication within the team and with VA stakeholders.

23. Use collaboration tools such as Jira, Confluence, Slack, or Microsoft Teams to manage tasks and facilitate communication.

24. Hold regular sprint retrospectives to review team performance, identify improvements, and implement changes.

5.2.3 BEST PRACTICES

The Contractor shall:

Implement changes to the relevant digitized Forms as VBA makes changes to the paper form. Conduct and synthesize discovery and usability testing on digitized forms to inform future changes.

Reduce usage of “backup” form and evidence submission pathways and cases of total failure of form and evidence submissions.

Identify and implement more opportunities to pre-fill data on the forms for Veterans and adjudicators, reducing the burden of manual entry.

Improve form/product findability, consistency, and Information Architecture (IA) across VA.gov and the mobile app.

Create relevant interview-style forms with focus on Veteran experience and technical modernization.

Increase the traceability of form and evidence submissions end-to-end, for users, employees, and product development teams via transaction tracing, visibility on dashboards, and other solutions.

5.2.4 AI UTILIZATION AND GUIDANCE

The Contractor is strongly encouraged to explore and incorporate AI technologies to enhance the design, development, and delivery of VA.gov coding for forms and data validation processes. Utilizing AI should be viewed as a valuable tool to improve accuracy, efficiency, and innovation within the formal deliverables.

Specifically:

The Contractor is encouraged to propose AI-based approaches for developing initial VA.gov form coding components.

The Contractor is also encouraged to leverage AI technologies to enhance validation capabilities, particularly for the January 30th delivery milestone focused on data validation improvements.

All proposed AI use cases must undergo review and approval by VA.gov before implementation. The VA reserves the right to accept or decline AI-inclusive designs based on risk, compliance, and alignment with VA standards.

The Contractor must include a clear description of any intended AI tools, approaches, and anticipated benefits in their design submissions. The VA will evaluate these proposals as part of the technical evaluation process. Regardless of the outcome, all proposals involving AI will be retained in project documentation and considered for future adoption.

5.2.5 Form VA 21-534EZ

The contractor shall provide agile sprint teams to digitize the form VA 21-534EZ Application for Dependency and Indemnity Compensation. The Minimal Viable Product

(MVP) is the initial required functionality (e.g. a guided interview-style format) to be delivered in production, and shall be agreed upon by the Project Team and VA. The Contractor shall design, develop, test, and deliver Enhanced Forms that build upon the Guided Interview MVP by incorporating iterative improvements in form flow, logic, content, data elements, integrations, and user experience, including incorporation of additional data to reduce automation off-ramps and minimize manual intervention, ensuring alignment with Veteran needs and program objectives.

Note: the government has additional artifacts and backlog to initiate this project that will be made available after award.

Deliverables:

A. Minimal Viable Product - Production-ready Source Code and Implementation on VA.gov -Form VA-21-534EZ

B. Enhanced Form – Production-ready Source Code and Implementation on VA.gov

-VA-21-534EZ

5.2.6 Form VA 21-8416

The contractor shall provide agile sprint teams to digitize the form VA 21-8416 Medical Expense Report. The MVP is the initial required functionality (e.g. a guided interview-style format) to be delivered in production, and shall be agreed upon by the Project Team and VA. The Contractor shall design, develop, test, and deliver Enhanced Forms that build upon the Guided Interview MVP by incorporating iterative improvements in form flow, logic, content, data elements, integrations, and user experience, including incorporation of additional data to reduce automation off-ramps and minimize manual intervention, ensuring alignment with Veteran needs and program objectives.

Deliverables:

A. Minimal Viable Product- Production-ready Source Code and Implementation on VA.gov -Form VA-21-8416

B. Enhanced Completed Form - Production-ready Source Code and Implementation on VA.gov -Form VA-21-8416.

5.2.7 COMMON UNSTRUCTURED ATTACHMENTS

The VA often receives electronic PDF attachments submitted alongside structured forms and forms data. Due to the lack of consistent templates and potentially lower quality of these unstructured documents, data must be intelligently extracted in order for submitter data confirmation and the facilitation of downstream automation activities.

Examples of common unstructured attachments are:

Certificate of Release or Discharge from Active Duty Death Certificate Marriage Certificate/License Birth Certificate Funeral Bill/Expenses Divorcee Decree Adoption Decree

The VA requires a solution to efficiently and securely validate and process attachments within VA's forms on the VA.gov platform. The solution is to build a Common Attachment Validator Component that ensures compliance with federal standards, VA security protocols, and accessibility requirements.

5.2.7.1 COMMON ATTACHMENT VALIDATOR REQUIREMENTS

1. The Contractor shall research, design, develop, and deliver a Common Attachment Validator Component and workflow that meets VA's objectives, adheres to federal standards, compliance mandates, and VA security requirements.

2. The Contractor shall develop a common set of functional and non-functional requirements for a Common Attachment Validator Component adopting a standardized and reusable design pattern (reference: https://design.va.gov/patterns/)

3. The Contractor shall host the Common Attachment Validator Component functionality within the VA.gov platform, ensuring that it can be reused in future development and expansion of VA.gov forms.

4. The Common Attachment Validator Component should enable data extraction from an end-user validation of the documents specified in 5.2.7.

5. The Contractor shall implement near real-time intelligent document processing solution capable of automatically extracting structured and unstructured data from a variety of uploaded document types using VA-approved FedRAMP-authorized cloud-native services (e.g., AWS Textract). For the minimum viable product, VA is not contemplating the acquisition of new software licenses.

6. The Contractor shall develop a front-end data validation interface based on VA.gov templates and design patterns, enhancing the final product to meet the needs of this requirement. Users shall be able to review, accept, or modify extracted values (reference: https://design.va.gov/patterns/ask-users-for/files).

7. The Contractor shall generate VA Form 27-4138 when a user-modified change is made, ensuring completion through VA’s existing electronic signature workflow. This form shall be appended to the final submission post-end user confirmation and electronically routed for inclusion in the Veteran’s electronic claims record. (reference:

https://design.va.gov/patterns/ask-users-for/signature).

8. The Contractor shall establish foundational validation requirements across VA forms, including mandatory fields, schema validation, strict formatting rules, logical consistency checks, and compliance with regulated rules (e.g., ZIP/state matching, Federal ID formats).

9. The Contractor shall implement security and compliance requirements, including server-side validation, input sanitization, cryptographic PII checks, malicious attempt tracking, bot detection, and error-message obfuscation.

10. The Contractor shall implement privacy and data integrity safeguards, including prevention of unnecessary PII entry, encryption of submissions, application of checksums for identifiers, and ensuring schema-only payload acceptance.

11. The Contractor shall design for operational and governance controls, including version-controlled schemas, compatibility validations, authoritative API reference checks (e.g., USPS, SSN, Income), fail-closed behavior, and continuous monitoring for abuse.

12. The Contractor shall support accessibility and user experience requirements, including inline validation, plain language guidance, multilingual error messages, and screen reader compatibility.

13. The Contractor shall map uploaded form data to standardized schemas, render key/value pairs in the user interface, and enable submitter validation and correction for backend VBA system submission.

14. The Contractor shall design and document the data validation engine architecture in coordination with VA governance and support and deliver updates to VA.gov's existing Authority to Operate (ATO) documentation if required.

15. The Contractor shall deliver a MVP in production on VA.gov by Veterans Day, November 11, 2025.

16. The Contractor shall document all Common Attachment Validator Component Package artifacts in VA's public GitHub repositories, including source code, architecture, requirements, user workflows, and API definitions, validation rules library, schema definitions, security requirements specification, test plans, deployment record, production release notes, and ATO package.

Deliverables:

A. Common Attachment Validator Component MVP Production Ready Source Code and Package.

B. Common Attachment Validator Enhanced Component – Product Ready Source Code and Package

5.3 MINIMAL SUSTAINMENT OF DEPLOYED FORMS AND COMMON

ATTACHMENT VALIDATOR COMPONENT – OPTIONAL TASK ONE

VA may exercise this Optional Task for minimal maintenance and operational sustainment support for any form or the common attachment validator component after deployment to production. This Optional Task will be exercised in increments per 2-week sprint, per form or the common attachment validator component, and may be exercised multiple times, and from time to time, not to exceed a total of 59 times within the period of performance.

The Contractor shall:

1. Integrate with automated monitoring tools to continually track the performance and availability of the system.

2. Implement alerting mechanisms to promptly notify support staff of any issues or anomalies.

3. Conduct regular system health checks and perform routine maintenance tasks to ensure optimal performance.

4. Establish a bug tracking system to log and prioritize reported issues or defects.

The Contractor shall provide a monthly Bug and Issue Log identifying all critical bugs and issues, including their resolution status.

5. Allocate resources to promptly address and resolve critical bugs that affect system functionality.

6. Implement a streamlined process for identifying, fixing, and deploying patches for discovered vulnerabilities or issues. The Contractor shall provide a monthly Update and Patches Summary Report documenting significant updates and patches applied, including brief descriptions of changes made.

7. Perform regular security audits to ensure the system remains compliant with VA security policies and federal regulations. The Contractor shall provide a monthly Security Audit Report summarizing any security vulnerabilities identified and actions taken to mitigate them.

8. Update security protocols and practices as needed to counter new threats or vulnerabilities.

9. Ensure continued adherence to data encryption standards for both data in transit and at rest.

10. Ensure a response time commitment for addressing support requests, such as resolving critical issues within 24 hours.

11. Maintain documentation and knowledge bases with updated FAQs and troubleshooting guides to assist users.

12. Implement regular data backup procedures to safeguard user submissions and system data.

13. Ensure data backup copies are securely stored and easily retrievable in case of data loss or corruption.

14. Develop and regularly test a disaster recovery plan to ensure quick restoration of the system in case of major incidents.

15. Implement minimal yet impactful enhancements based on user feedback without disrupting core functionality.

16. Monitor usage analytics to understand user behavior and enhance the user experience where necessary.

17. Maintain updated technical documentation covering system architecture, configuration, and maintenance procedures.

18. Ensure detailed recovery procedures and protocols are documented and accessible to support staff.

Deliverables:

A. Bug and Issue Log B. Update and Patch Summary Report C. Security Audit Report

5.4 TRANSITION SUPPORT – OPTIONAL TASK TWO

Transition of a product to a new contractor or the Government is sometimes necessary.

It is critical to the continued functionality of products that all contractors are diligent in transitions between teams to ensure there is no disruption in Veteran services. The most important factors in these transitions are the availability of well-written documentation and good faith communications. This optional task shall be for a period of two months, if exercised by the Government. The Contractor must submit a Transition Support Package within (7) days upon optional task exercise. The Transition Support Package shall consist of at least the following, and is critical to the successful transition, and must be available in the relevant GitHub repository:

1. All documentation

2. All access to the platform (if applicable) and anything interacting with the platform or application, for which the incoming vendor will require access

In consultation with the relevant Product Owner and COR, the Contractor shall create a list of all relevant stakeholders, both inside and outside VA (if relevant). The contractor shall ensure frank and open communication between all staff of the existing and incoming contractors. At a minimum, the outgoing contractor shall ensure the incoming contractor has access to the following:

1. Product documentation including product…