SOW-8-31-26.docx

RFP ATTACHMENT “A”

INDEPENDENT VERIFICATION AND VALIDATION (IV&V)

SCOPE OF WORK

Nevada Department of Motor Vehicles Digital Transformation Effort (DTE)

Contents

This document is incorporated into the solicitation as Attachment A and defines the Scope of Work for the Independent Verification and Validation (IV&V) assessment.

1. PURPOSE

The Nevada Department of Motor Vehicles (DMV) seeks an independent contractor to perform a fixed, one-time Independent Verification and Validation (IV&V) assessment of the current state of the Digital Transformation Effort (DTE). Ongoing or continuous IV&V monitoring is out of scope.

The assessment will provide DMV leadership with an objective, independent, and evidence-based evaluation of program governance, business alignment, architecture and solution design, integrations and data management, security and compliance, software development lifecycle (SDLC) and configuration management, testing and quality assurance, operational readiness, and related program risks.

The Contractor shall document findings, observations, risks, and evidence-based recommendations through the deliverables identified in Section 5 to support executive decision-making.

The Contractor shall maintain organizational independence throughout the engagement and shall not perform the activities identified as out of scope in Section 4.12.

1.1 Key Definitions

Governance: The structures, roles, decision rights, oversight, reporting, escalation paths, and controls used to direct and monitor DTE activities.

Action and Dependency Management: The processes used to identify, assign, track, resolve, and escalate actions and interdependencies that may affect delivery or assessment outcomes.

Risk Posture: The overall condition of identified risks, including their significance, potential impact, ownership, mitigation status, and trends.

Operational Readiness: The degree to which people, processes, technology, support arrangements, controls, and procedures are prepared to operate and sustain an approved capability.

Release Readiness: The degree to which a planned release has satisfied applicable requirements, testing, defect, security, deployment, support, and approval criteria necessary to proceed.

2. BACKGROUND

The Nevada DMV is executing a multi-year enterprise modernization initiative known as the Digital Transformation Effort (DTE). DTE includes cloud technologies, enterprise applications, legacy and mainframe modernization, integrations, data migration, testing, operational readiness, and supporting business transformation activities.

The IV&V assessment will provide independent insight into the current state of these modernization activities, including program health, readiness, and risk posture, to support executive decision-making.

3. OBJECTIVES

The objectives of this engagement are to:

3.1.3 Evaluate alignment of DTE governance, processes, deliverables, technical solutions, and implementation practices with approved requirements, project plans, standards, and business objectives.

3.1.2 Assess risks, issues, actions, dependencies, assumptions, and constraints affecting delivery and overall risk posture.

3.1.3 Evaluate architecture and design, integrations and data management, security and compliance, SDLC and configuration management, testing and quality assurance, and operational readiness.

3.1.4 Assess the quality, completeness, and sufficiency of program deliverables and supporting evidence.

3.1.5 Identify findings, observations, risks, strengths, concerns, and opportunities for improvement.

3.1.6 Provide evidence-based recommendations and clear reporting to support informed executive decision-making.

3.2 Independence Requirements

The Contractor shall maintain organizational independence throughout the duration of the engagement.

The Contractor shall:

The DMV reserves the right to determine whether an actual or perceived conflict of interest may impair the Contractor's ability to perform objective IV&V services.

4. SCOPE OF SERVICES

The Contractor shall perform IV&V assessment activities across DTE and associated modernization initiatives.

Assessment activities shall include independent verification, validation, reporting, executive communications, and evidence-based recommendations across the domains identified below.

4.1 Governance, Oversight, and IV&V Framework

The Contractor shall:

4.1.1 Assess governance structures and decision-making processes.

4.1.2 Evaluate risk, issue, action, dependency, and escalation management practices.

4.1.3 Assess executive reporting effectiveness.

4.1.4 Evaluate program controls and oversight mechanisms.

4.1.5 Assess compliance with approved governance processes.

4.1.6 Evaluate effectiveness of stakeholder communication and coordination.

4.2 Business Process and User Alignment

The Contractor shall:

4.2.1 Assess whether governance, deliverables, business processes, technical solutions, and implementation activities support approved DTE business objectives.

4.2.2 Evaluate stakeholder engagement, governance participation, communication, and business involvement throughout the modernization effort.

4.2.3 Assess readiness for implementation and adoption, including operational preparedness, training, transition planning, and organizational change readiness, as applicable.

4.2.4 Evaluate impacts on business processes and readiness to implement and operationalize approved capabilities.

4.2.5 Assess whether the modernization effort is positioned to achieve intended business outcomes and operational value.

4.3 Architecture and Design

The Contractor shall:

4.3.3 Assess technical design documentation.

4.3.4 Evaluate scalability, maintainability, extensibility, and supportability.

4.3.5 Assess architecture governance processes.

4.3.6 Evaluate technical risks associated with architecture and design decisions.

4.4 Integration and Data Management

The Contractor shall:

4.4.1 Assess enterprise integration approaches.

4.4.2 Evaluate interface designs and implementation strategies.

4.4.3 Assess data migration and conversion planning activities.

4.4.4 Evaluate data quality management approaches.

4.4.5 Assess interoperability considerations.

4.4.6 Evaluate integration readiness and associated risks.

4.5 Mainframe and Legacy Modernization

The Contractor shall:

4.5.1 Assess legacy modernization strategies.

4.5.2 Evaluate migration and transition approaches.

4.5.3 Assess modernization sequencing and dependency management.

4.5.4 Evaluate technical risks associated with legacy system transition.

4.5.5 Assess modernization readiness activities.

4.6 Security, Privacy, and Compliance

The Contractor shall:

4.6.1 Assess security governance activities.

4.6.2 Evaluate security requirements implementation.

4.6.3 Assess privacy and compliance considerations.

4.6.4 Evaluate security testing and validation approaches.

4.6.5 Assess risk management practices related to security and compliance.

4.6.6 Evaluate security readiness activities.

4.7 Software Development Lifecycle and Configuration Management The Contractor shall:

4.7.1 Assess software development lifecycle processes.

4.7.2 Evaluate configuration and change management practices.

4.7.3 Assess quality assurance activities.

4.7.4 Evaluate development and deployment controls.

4.7.5 Assess technical deliverables and supporting artifacts.

4.7.6 Evaluate technical debt management practices.

Technical Review Boundary: For purposes of REQ-44, the Contractor shall assess available secure code-review evidence, static-analysis results, configurations, infrastructure artifacts, and related technical evidence as appropriate to support IV&V conclusions. REQ-44 does not require the Contractor to execute static-analysis tooling or perform hands-on source-code analysis. Specific repository access and any Contractor-recommended tooling will be established following award based on the approved assessment approach and applicable State security requirements. Independent security penetration testing and independent security certification remain out of scope under Section 4.12.

4.8 Testing and Quality Assurance

The Contractor shall:

4.8.1 Assess testing strategies and plans.

4.8.2 Evaluate requirements traceability.

4.8.3 Assess test execution and defect management activities.

4.8.4 Evaluate quality assurance processes.

4.8.5 Assess release readiness criteria and evidence.

4.8.6 Evaluate overall testing effectiveness.

4.9 Operations and Operational Readiness

The Contractor shall:

4.9.1 Assess operational readiness activities.

4.9.2 Evaluate deployment and transition planning.

4.9.3 Assess support models and operational processes.

4.9.4 Evaluate production readiness.

4.9.5 Assess post-deployment support readiness.

4.9.6 Evaluate operational risks and mitigation strategies.

4.10 Requirements Compliance

The Contractor shall comply with and provide services necessary to satisfy the Nevada DMV IV&V Requirements Baseline.

The Nevada DMV IV&V Requirements Baseline (REQ-01 through REQ-65) is incorporated into this solicitation through Attachment B – Requirements Response Matrix.

Attachment B serves as the detailed performance specification for this engagement and includes the required vendor response fields. Proposers shall complete and submit Attachment B as required by solicitation.

Attachment C – Vendor Response Workbook shall be completed separately as required by the solicitation.

4.11 In-Scope Modernization Activities

The Contractor shall provide IV&V services for modernization activities associated with the Digital Transformation Effort (DTE), including but not limited to:

4.11.1 Program governance and oversight activities

4.11.2 Business process modernization activities

4.11.3 Enterprise architecture and solution design activities

4.11.4 Salesforce platform solutions

4.11.5 AWS-hosted solutions

4.11.6 Enterprise integration services and interfaces

4.11.7 Data migration, conversion, and data management activities

4.11.8 Legacy application and mainframe modernization efforts

4.11.9 Software development lifecycle activities

4.11.10 Testing and quality assurance activities

4.11.11 Security, privacy, and compliance activities

4.11.12 Deployment, operational readiness, and transition activities

4.11.13 Other modernization-related initiatives identified by the DMV during the period of performance

4.12 Out-of-Scope Activities

To preserve the Contractor’s independence, the following activities are outside the scope of this engagement. The Contractor shall not perform:

4.12.4 Configuration services

4.12.5 System integration services

4.12.10 Independent security certification activities

4.12.11 Procurement management activities

4.12.12 Any activity that would impair the Contractor's independence

4.13 Assessment Artifacts and Evidence

Depending on the applicable assessment domain and lifecycle stage, artifacts and evidence may include, but are not limited to:

4.13.1 Program and project plans, schedules, roadmaps, governance charters, decision records, and RAID records

4.13.2 Business requirements, process documentation, traceability records, and stakeholder materials

4.13.3 Enterprise and solution architecture, technical designs, and architecture decision records

4.13.4 Integration, interface, API, data migration, conversion, reconciliation, and data quality documentation

4.13.5 SDLC, configuration, change, release, deployment, and DevSecOps records

4.13.6 Test strategies, plans, scripts, results, defect records, quality metrics, and readiness evidence

4.13.7 Security, privacy, compliance, risk, and control documentation

4.13.8 Operational readiness, transition, training, support, runbook, and continuity materials

4.13.9 Implementation-vendor deliverables, status reports, dashboards, meeting records, and other evidence relevant to the IV&V conclusions

The specific evidence population will vary by domain, workstream, and lifecycle stage. The Contractor shall identify and request the evidence necessary to support its IV&V conclusions through the process defined in the approved Assessment Management Plan.

The State does not prescribe fixed quantities of artifacts, stakeholder interviews, environments, integrations, or other assessment items. Applicable quantities may vary by domain, workstream, lifecycle stage, and the evidence necessary to support the approved assessment methodology.

5. DELIVERABLES

The Contractor shall provide the deliverables identified below. Deliverables may be submitted individually or in combination, as appropriate to the approved assessment schedule and activities performed during the engagement.

Deliverable Schedule

Specific deliverable dates and milestones shall be established in the approved Assessment Management Plan and shall remain within the contract period.

The DMV reserves the right to request focused assessments, special studies, or executive briefings related to modernization activities during the contract period.

5.1 Assessment Management Plan

The Contractor shall develop and submit an Assessment Management Plan describing the approach that will be used to perform the Independent Verification and Validation (IV&V) assessment.

At a minimum, the Assessment Management Plan shall include:

5.1.1 Assessment objectives

5.1.2 Assessment methodology

5.1.3 Scope validation approach

5.1.4 Information and artifact request process

5.1.5 Stakeholder interview approach

5.1.6 Assessment activities and work plan

5.1.7 Schedule and milestones

5.1.8 Communication and reporting approach

5.1.9 Risk and issue management approach

5.1.10 Deliverable development approach

5.1.11 Assumptions and dependencies

5.1.12 Evidence collection and validation approach

5.1.13 Risk-based sampling methodology, rationale, and coverage approach, where sampling is used

5.1.14 System, repository, and environment access assumptions and requirements

5.1.15 Where risk-based sampling is used, the methodology shall be documented and provide sufficient coverage to support the IV&V conclusions and enable DMV to validate the resulting findings.

Specific system, repository, and environment access will be determined following award based on the approved assessment approach and applicable State security requirements. Unrestricted production access is not assumed. Access will be provided on a least-privilege basis, as necessary to perform approved assessment activities and subject to applicable security controls and clearances.

The Assessment Management Plan shall be submitted within a timeframe established by DMV following contract award and shall be reviewed and approved before substantive assessment activities begin.

5.2 Initial Assessment Report

The Contractor shall provide an initial assessment of the current state of DTE, including findings, observations, risks, strengths, concerns, and evidence-based recommendations. Timing shall be established in the approved Assessment Management Plan following initial discovery and evidence review.

5.3 Status Briefings

The Contractor shall provide status briefings at intervals established in the approved Assessment Management Plan. Briefings may include completed activities, preliminary observations, emerging risks, and planned next steps.

5.4 Executive Briefing

The Contractor shall provide an executive briefing summarizing significant findings, observations, risks, recommendations, and overall assessment conclusions near the conclusion of the assessment, in accordance with the approved assessment schedule.

5.5 Domain Assessment Reports

The Contractor shall provide focused assessment reports when requested by DMV for specific technical, operational, or governance areas. Timing shall be established in the approved Assessment Management Plan or coordinated with DMV when requested.

5.6 Readiness Assessment Reports

As applicable, the Contractor shall provide assessments for:

5.6.1 Testing Readiness

5.6.2 Deployment Readiness

5.6.3 Operational Readiness

5.6.4 Release Readiness

5.6.5 Go-Live Readiness

These assessments will be performed only if their corresponding project phase occurs during the engagement period.

5.7 Final IV&V Assessment Report

The Contractor shall provide a final report summarizing:

5.7.1 Engagement activities

5.7.2 Findings

5.7.3 Recommendations

5.7.4 Lessons learned

5.7.5 Risk trends

5.7.6 Overall assessment of the Digital Transformation Effort (DTE)

The Final IV&V Assessment Report shall serve as the comprehensive and final deliverable for the engagement and shall be submitted at the conclusion of the assessment in accordance with the approved assessment schedule.

6. REPORTING AND COMMUNICATION REQUIREMENTS

The Contractor shall:

6.1.1 Participate in Kickoff and discovery activities.

6.1.2 Participate in stakeholder interviews, workshops, and information-gathering sessions as required.

6.1.3 Provide status briefings in accordance with the approved Assessment Management Plan.

6.1.4 Present findings and recommendations to DMV leadership.

6.1.5 Escalate significant risks or concerns identified during the assessment.

6.1.6 Deliver reports and presentations in accordance with the approved assessment schedule.

Services may generally be performed remotely; however, limited onsite participation may be required. Onsite participation may be necessary for stakeholder interviews, workshops, executive briefings, or review of specific documents, data, or architecture when applicable State access or security requirements do not permit remote access. No minimum onsite commitment is specified. Specific onsite requirements will be coordinated following award based on the approved assessment approach and applicable State access requirements.

7. STAFFING REQUIREMENTS

The Contractor shall provide personnel with demonstrated experience in:

7.1.1 Public-sector digital transformation and modernization initiatives

7.2.1 Independent Verification and Validation

7.1.2 Enterprise architecture

7.1.3 Systems integration

7.1.4 Cloud technologies

7.1.5 Data migration and conversion

7.1.6 Testing and quality assurance

7.1.7 Security and compliance

7.1.8 Program governance

The Contractor shall identify key personnel and provide resumes and qualifications as part of its proposal.

Substitution of key personnel require DMV approval. Replacement personnel shall possess qualifications and experience equal to or greater than those of the individual being replaced.

8. PERFORMANCE STANDARDS

The Contractor shall:

8.1.1 Maintain independence throughout the engagement.

8.1.2 Use documented and repeatable assessment methodologies.

8.1.3 Support findings with objective evidence.

8.1.4 Deliver reports in accordance with the approved assessment schedule.

8.1.5 Maintain professional objectivity.

8.1.6 Provide actionable recommendations.

8.1.7 Escalate significant risks in a timely manner.

9. PERIOD OF PERFORMANCE

The anticipated period of performance shall be identified in the resulting contract.

The DMV reserves the right to extend services in accordance with contract provisions and available funding.

This contract provides a fixed, one-time independent assessment of the current state of the Digital Transformation Effort (DTE). No ongoing or continuous IV&V oversight is contemplated.

10. ACCEPTANCE CRITERIA

Deliverables shall be accepted when they:

10.1.1 Are submitted in accordance with the approved assessment schedule.

10.1.2. Address all required content.

10.1.2 Are complete and accurate.

10.1.3 Are supported by objective evidence.

10.1.4 Meet contract requirements.

Acceptance shall be performed by the DMV in consultation with designated business, technical, and program representatives.

Attachment B – Requirements Response Matrix Attachment B incorporates the Nevada DMV IV&V Requirements Baseline (REQ-01 through REQ-65) and provides the required vendor response fields.

Proposers shall complete and submit Attachment B as required by the solicitation.

Attachment C – Vendor Response Workbook shall be completed separately as required by the solicitation.