TSMPS PWS Draft.docx

Telehealth, Scheduling, Mobile Platform Services

VA-2600046665

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Office of Information & Technology Digital Service Delivery (DSD) Telehealth and Scheduling

Telehealth, Scheduling, & Mobile Platform Services (TSMPS)

Date: January 19, 2026

VA-26-00046665

PWS Version Number: 1.0

Contents

BACKGROUND

The Department of Veterans Affairs (VA), Office of Information & Technology (OIT), Digital Service Delivery (DSD) strives to provide high quality, effective, and efficient Information Technology (IT) services to those responsible for providing care to the Veterans at the point-of-care as well as throughout all the points of the Veterans’ health care in an effective, timely and compassionate manner. VA depends on Information Management/Information Technology (IM/IT) systems to meet mission goals.

Upon award of this contract, the VA Enterprise Cloud Mobile Application Platform (VAEC-MAP), formerly known as the Mobile Application Environment (MAE), that is managed by the Office of Information and Technology (OIT) Health Product Delivery Services (PDS) Telehealth and Scheduling Product Line (TASPL), commonly referred to as VAEC-MAP or the Telehealth and Scheduling Platform (TAS-P), will be rebranded to the Telehealth, Scheduling, and Mobile Platform (TSMP). To align with this change, the VA’s System of Record Notices (SORN) will be updated to reflect the new naming convention.

VAEC-MAP is a cloud-hosted Infrastructure as a Service (IaaS) and Platform as a Service (PaaS) solution that provides a secure, scalable, and resilient foundation for hosting mobile applications, shared services, and web components accessible via mobile devices.

VAEC-MAP currently supports more than 300 applications and services, including VA mission-critical systems, delivering capabilities to over 250,000 VA staff members and millions of Veterans each month.

APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. “Federal Information Security Modernization Act of 2014”

2. Federal Information Processing Standards (FIPS) Publication 140-3, “Security Requirements for Cryptographic Modules”, March 22, 2019

3. FIPS Pub 199. “Standards for Security Categorization of Federal Information and Information Systems,” February 2004

4. FIPS Pub 200, “Minimum Security Requirements for Federal Information and Information Systems,” March 2006

5. FIPS Pub 201-3, “Personal Identity Verification of Federal Employees and Contractors,” January 2022

6. 10 U.S.C. § 2224, "Defense Information Assurance Program", as amended

7. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

8. Public Law 109-461 (P.L. 109-461), Veterans Benefits, Health Care, and Information Technology Act of 2006, as amended, Title IX, Information Security Matters

9. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”, as amended

10. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, https://www.va.gov/vapubs/index.cfm

11. VA Handbook 0710, “Personnel Security and Suitability Program,” May 2, 2016, https://www.va.gov/vapubs/index.cfm

12. VA Directive 6102, “Internet/Intranet Services,” August 5, 2019

13. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and Guidelines,” as amended

14. Office of Management and Budget (OMB) Circular A-130, “Managing Federal Information as a Strategic Resource,” July 28, 2016

15. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed Services (CHAMPUS)”, as amended

16. NIST SP 800-66 Rev. 2, “Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule: A Cybersecurity Resource Guide,” February 2024

17. 45 C.F.R Parts 160 and 164, Subparts A and E, the Standards for Privacy of Individually Identifiable Health Information (“Privacy Rule”); and 45 C.F.R. Parts 160 and 164, Subparts A and C, the Security Standard (“Security Rule”); as amended

18. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended

19. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

20. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021 (see VA NOTICE 24-18, dated September 27, 2024, “Update to VA Directive 6500 Cybersecurity Program”, and VA Notice 25-07, dated 3/18/25, “Amending VA Directive 6500 to incorporate M-24-15”)

21. VA Handbook 6500, “Risk Management Framework for VA Information Systems VA Information Security Program,” February 24, 2021 (see VA Notice 25-01, dated October 15, 2024, “Update to VA Handbook 6500 Risk Management Framework for VA Information Systems VA Information Security Program”, and VA Notice 25-06, dated 3/18/25, “Amending VA Directive 6500 to incorporate M-24-15”)

22. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI),” June 30, 2023

23. VA Handbook 6500.6, “Contract Security,” March 12, 2010 (see VA Notice 24-12, dated April 22, 2024, “Update to VA Handbook 6500.6, Contract Security, Appendix C VA Information and Information System Security/Privacy Language For Inclusion Into Contracts, As Appropriate”)

24. VA Handbook 6500.8, “Information System Contingency Planning,” March 25, 2025

25. VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018

26. VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017

27. OIT Process Asset Library (PAL), OIT Process Asset Library.

28. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

29. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014

30. VA Directive 6510, “VA Identity, Credential and Access Management,” September 3, 2024

31. VA Handbook 6510, “VA Identity, Credential and Access Management,” September 27, 2024

32. VA Directive and Handbook 6513, “Secure External Connections,” October 12, 2017

33. VA Directive 6300, “Records and Information Management,” September 21, 2018

34. VA Handbook, 6300.1, “Records Management Procedures,“ March 24, 2010

35. NIST SP 800-37 Rev 2, “Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy,” December 2018

36. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020)

37. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015

38. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” March 24, 2014

39. OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005

40. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019

41. OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008

42. Federal Identity, Credential, and Access Management (FICAM) Architecture, June 30, 2023 (FICAM Architecture (idmanagement.gov))

43. NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access,“ June 2018

44. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, “Digital Identity Guidelines,” updated March 02, 2020

45. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014

46. VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

47. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

48. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

49. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

50. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019

51. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008

52. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (P.L. 110–140), December 19, 2007

53. Section 104 of the Energy Policy Act of 2005, (P.L. 109–58), August 8, 2005

54. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 2, 2001

55. VA Directive 0057, “VA Environmental Management Program,” October 25, 2022

56. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

57. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

58. “Veteran Focused Integration Process (VIP) Guide 4.0,” March 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

59. VA Memorandum “Proper Use of Email and Other Messaging Services,” January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

60. “Product Line Management Transformation Playbook” version 3.1, August 2023, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

61. NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020

62. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol Version 6 (IPv6),” November 19, 2020

63. Social Security Number (SSN) Fraud Prevention Act of 2017

64. Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23, 2018

65. C.F.R Title 15 Part 7, “Securing the Information and Communications Technology and Services (ICTS) Supply Chain”, as amended

66. Executive Order 14028, “Executive Order on Improving the Nation's Cybersecurity,” May 12, 2021, https://bidenwhitehouse.archives.gov/briefing-room/presidential-actions/2025/01/16/executive-order-on-strengthening-and-promoting-innovation-in-the-nations-cybersecurity/

67. OMB Memorandum M-22-09, “Moving the U.S. Government Toward Zero Trust Cybersecurity Principles”, January 26, 2022, https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf.

68. NIST SP 800-52 Revision 2, “Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations

69. OMB M-22-18, “Enhancing the Security of the Software Supply Chain through Secure Software Development Practices,” September 14, 2022

70. OMB M-23-16, “Update to Memorandum M-22-18,” June 9, 2023

71. OMB M-21-31, “Improving the Federal Government’s Investigative and Remediation Capabilities Related to Cybersecurity Incidents,” August 27, 2021

72. NIST SP 800-88 Revision 1 “Guidelines for Media Sanitization,” December 2014

73. CISA Binding Operational Directive (BOD) 19-02: “Vulnerability Remediation Requirements of Internet-Accessible Systems,” April 29, 2019, BOD 19-02: Vulnerability Remediation Requirements for Internet-Accessible Systems | CISA

74. CISA BOD 22-01: “Reducing the Significant Risk of Known Exploited Vulnerabilities,” November 3, 2021, BOD 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities | CISA

75. CISA BOD 23-01: Improving Asset Visibility and Vulnerability Detection on Federal Networks.” Cybersecurity & Infrastructure Security Agency (CISA), BOD 23-01: Improving Asset Visibility and Vulnerability Detection on Federal Networks | CISA

76. VA Directive 6550, Pre-Procurement Assessment and Implementation of Medical Devices/Systems, June 03, 2019

77. VA Memorandum, “VA Security Controls,” January 17, 2025, https://www.voa.va.gov/DocumentView.aspx?DocumentID=5010

SCOPE OF WORK

Our Nation’s Veterans deserve the highest standard of medical care, and this award will demand the uncompromising, high-quality services to support the customers and mission critical Telehealth, Scheduling, and Mobile applications who make that care possible.

The Vendor shall provide the services, personnel, and subject matter expertise required to engineer, operate, secure, maintain, and support the Telehealth, Scheduling, and Mobile Platform (TSMP) twenty-four (24) hours a day, seven (7) days a week. TSMP is a Department of Veterans (VA) Enterprise Cloud (VAEC) Amazon Web Service (AWS) GovCloud hosted environment that delivers secure, modern, containerized application development, testing, and production hosting capabilities using AWS Elastic Kubernetes Service (EKS).

TSMP enables DevSecOps practices to include Continuous Integration/Continuous Delivery (CI/CD) and supports 12-factor application principles across multiple Virtual Private Clouds (VPCs) and EKS environments. These environments are built from a standardized baseline Amazon Machine Image (AMI) and leverage AWS-managed services to ensure consistency, security, and scalability.

TSMP provides platform services to over 300 applications and services (see Appendix A: TSMP Platform Services for a current list) delivering capabilities to over 250,000 VA staff members and millions of Veterans each month. Given the mission-critical nature of these applications and services, it is imperative that they are supported by highly skilled platform service personnel and teams capable of maintaining 99.995% incident-free availability.

The Contractor shall provide qualified teams and resources to operate and maintain the platform services in the following areas of responsibility:

· Program and Project Management

· Architecture, Engineering, and Maintenance

· Platform and Application Monitoring

· Incident Management

· DevSecOps And Site Reliability Engineering

· Risk Management Framework, Security, and Authority to Operate

· Software License Management

The Contractor shall support an anticipated annual growth rate of up to 20 percent without additional TSMPS cost. If platform growth exceeds 20 percent in any given year, then optional tasks may be executed, as authorized by the Government, to ensure continued uninterrupted platform operations and service levels.

PERFORMANCE PERIOD

The Period of Performance (PoP) shall be twelve (12) months with four (4) 12-month option periods and six (6) optional tasks. The overall Period of Performance shall not exceed 57 months.

Any work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO). (If required, the CO may designate the Contractor to work during holidays and weekends)

There are 11 Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, five are set by date:

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

PLACE OF PERFORMANCE

Tasks under this PWS shall be performed at Contractor facilities. The Contractor shall identify the Contractor’s place of performance in their proposal submission.

TRAVEL

The Government anticipates travel under this effort to perform the tasks associated with the effort, as well as to attend program-related meetings or conferences throughout the PoP. Include all estimated travel costs in your firm-fixed price line items. These costs will not be directly reimbursed by the Government.

The total estimated number of trips in support of the program related meetings for this effort is four, one trip every quarter. Anticipated locations include the following, estimated at five days in duration:

To be determined by vendor location.

Travel shall be in accordance with the Federal Travel Regulations (FTR) and requires advanced concurrence by the COR. Contractor travel within the local commuting area will not be reimbursed.

SPECIFIC TASKS AND DELIVERABLES

Due to the mission-critical nature of the applications and services hosted and supported by the Platform Services under this contract, the requirement to deliver safe, secure, and reliable services to the Nation’s Veterans twenty-four (24) hours a day, seven (7) days a week, and the minimal tolerance for error, the Contractor shall ensure that assigned personnel possess expert-level qualifications, demonstrated experience, and specialized skillsets necessary to successfully perform all tasks and responsibilities required under this award at the highest professional standard.

The Contractor shall ensure that all Subject Matter Experts (SMEs) assigned to this award are continuously cross trained on TSMP infrastructure, architecture, and system dependencies. SMEs shall be required to gain and maintain an expert level of TSMP domain knowledge within 90 days of the contract award. SMEs shall maintain the capability to rapidly identify, diagnose, and resolve application and platform issues in order to minimize service disruption and limit any impact to TSMP capabilities and services.

Given the size and complexity of the VA, policies, procedures, and organizational structures are subject to frequent change. The Contractor shall ensure that all assigned personnel remain continuously compliant with all applicable and evolving VA policies, procedures, standards, training requirements, and directives for the duration of the contract and across all tasks and deliverables.

The Contractor shall operate and manage the platform using Agile and Scaled Agile Framework (SAFe) methodologies. The Contractor shall align all Sprint cycles, Program Increment (PI) planning, and associated Agile ceremonies with the TASPL cadence and governance.

The Contractor shall ensure that all personnel remain current on industry and federal best practices, architectural and design patterns, emerging technologies, and modern engineering methods relevant to platform capability and service operations. The Contractor shall proactively identify, recommend, and support the adoption of appropriate improvements through a continuous improvement process that enhances platform performance, security, reliability, availability and maintainability.

The Contractor shall ensure that all personnel performing work under this award maintain a customer-service-centric mindset, recognizing the mission-critical nature and magnitude of the services provided and their direct impact on VA staff and Veterans.

The Contractor shall support all modernization of infrastructure and tooling as approved by VA.

The Contractor shall ensure that all deliverables are completed on schedule and are accurate, error-free, and professionally formatted.

PROJECT MANAGEMENT

PROGRAM AND PROJECT MANAGEMENT

The Contractor shall provide qualified Program and Project Management personnel to effectively manage all aspects of the contract, including, but not limited to, onboarding, planning, execution, operations, communications, coordination, training, reporting, and day-to-day activities. These services shall be performed in an efficient, organized, and disciplined manner consistent with industry and VA’s best practices.

The Contractor shall ensure that staffing levels, roles, and skillsets are sufficient to meet all contract requirements and to produce deliverables that are accurate, timely, and professional in quality and presentation.

The Contractor shall provide Program and Project Management Subject Matter Experts (SMEs) who shall be available to attend required meetings, respond to Government inquiries, report on required deliverables, provide expert guidance, and support decision-making as needed throughout the period of performance.

SMEs shall be available during normal Government business hours and able to respond to urgent issues as required to support mission needs.

CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, timeline, and tools to be used in execution of the contract. The CPMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks, and resource support. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPMP shall be concurred upon and updated in accordance with Section B of the contract. The Contractor shall update and maintain the VA PM approved CPMP throughout the PoP.

Deliverable:

A. Contractor Project Management Plan

REQUIREMENTS AND SERVICE REQUEST INTAKE

The Contractor shall establish, implement, maintain, and document VA approved policies and procedures ensuring that all requirements and service requests are processed through VA approved toolsets (currently Jira).

The Contractor shall establish, document, and enforce processes and procedures that reduce barriers and complexity for stakeholders requesting assistance, services, and/or communication with TSMP personnel, ensuring ease of access, clarity of request paths, and timely engagement.

The Contractor shall provide stakeholder training at least once a PI to ensure all stakeholders have clear instructions and expectations for TSMP Requirements and Service Request intake.

The Contractor shall ensure service requests are acknowledged and resolved IAW with the following Minimum Service Request Response Time standards:

Table 5.A - Service Request Response Times

Days N/A

The Contractor shall use the following severity classifications when determining Service Request severity:

· Critical: Any emergent situation or patient safety issue as identify by VA or any unapproved degradation or disruption to production capabilities, services, or applications supported by TSMP, regardless of whether the root cause is attributable to TSMP.

· High: Any situation that poses a risk of unapproved degradation or disruption to production capabilities, services, or applications supported by TSMP, regardless of whether the root cause is attributable to TSMP (e.g. a service degradation or disruption that occurred and self-corrected, where the root cause has not been identified and control measures have not been implemented to ensure the degradation or disruption does not occur again).

· Medium: Any unplanned situation requiring elevated visibility or coordination to meet stakeholder expectations.

· Low: Any standard or routine request to modify existing capabilities or services that does not introduce new functionality. Requests for new capabilities, services, or functionality shall be submitted as a new requirement and follow the TASPL Intake process.

The Contractor shall ensure that all staff members are trained and prepared to recognize the urgency of Critical and High Service Requests and to immediately take all feasible actions to minimize impacts to production capabilities, services, and applications. The Contractor shall proactively and timely communicate and coordinate with all authorized entities necessary to limit impacts to Veteran services.

The Contractor shall provide a weekly Requirements and Service Request Report that lists all Requirements and Service Requests, associated response times, and whether each response met the applicable minimum standard. All response times that fail to meet the minimum standard shall be clearly identified and summarized on the first page of the report.

Deliverables:

A. Requirements and Service Request Intake Stakeholder Training (every PI) B. Requirements and Service Request Response Time and Trend Report (weekly)

FORECASTS, MILESTONES, AND SPRINT PLANS

Within thirty (30) days of contract award, the Contractor shall develop and deliver the following planning artifacts in accordance with TASPL standards (Appendix B: TASPL Milestone Guide):

· Five (5)-Year Forecast

· One (1)-Year Forecast

· Program Increment (PI) Executive-Level Milestones

· PI Product Line Milestones

· Sprint Plans

The Contractor shall obtain formal approval from the VA Product Manager and TASPL leadership for each of the above artifacts prior to execution.

The Contractor shall continuously update, maintain, and manage the Five (5)-Year Forecast, One (1)-Year Forecast, PI Executive-Level Milestones, PI Product Line Milestones, and Sprint Plans throughout the Period of Performance (POP), ensuring alignment with approved scope, priorities, and dependencies.

The Contractor shall provide a monthly forecast review of both the Five (5)-Year and One (1)-Year Forecasts to the VA Product Manager and Product Line Leadership, including updates to scope, schedule, risks, and assumptions.

The Contractor shall provide a weekly review of milestones and Sprint Plans to the VA Product Manager and Product Line Leadership, to include progress status, variances, risks, and recommended corrective actions.

Deliverables:

A. 5-Year Forecast B. 1-Year Forecast C. PI Executive Level Milestones D. PI Product Line Milestones E. Sprint Plans F. Monthly Forecast Review G. Weekly Milestone & Sprint Plan Review

CAPABILITIES AND SERVICES DOCUMENT

Within forty-five (45) days of contract award, the Contractor shall develop and deliver a comprehensive Capabilities and Services document that describes all capabilities and services provided by the TSMP environment. The document shall, at a minimum, identify applicable points of contact, governing standards, service descriptions, and operational expectations for each capability and service.

The Contractor shall maintain the Capabilities and Services document as a living artifact and update it on a continual basis to ensure accuracy and alignment with current platform capabilities, services, and governance.

Deliverables:

A. Capabilities and Services Document

PLATFORM DEPENDENCY LIST

Within forty-five (45) days of contract award, the Contractor shall develop and deliver a comprehensive Platform Dependency List that details all platform dependencies. The list shall, at a minimum, identify applicable points of contact and escalation procedures, governing standards, service descriptions, and operational expectations for each dependency.

The Contractor shall maintain the Platform Dependency List as a living artifact and update it on a continual basis to ensure accuracy and alignment with current platform dependencies.

Deliverables:

A. Platform Dependency List

STAFF ROSTER

Within thirty (30) days of contract award, the Contractor shall develop and deliver a complete and accurate staffing roster to the VA Project Manager and Product Line Leadership. The staffing roster shall include, at a minimum, assigned roles, skillsets, and points of contact for all Contractor personnel supporting the contract.

The Contractor shall maintain the staffing roster as a living document and update it on a daily basis throughout the entire Period of Performance (POP) to ensure it reflects current staffing levels, assignments, and changes.

Deliverables:

A. Staff Roster

AGILE CEREMONIES

The Contractor shall proactively engage in Program Increment (PI) Planning for all TSMP Capabilities and Services and ensure that designated SREs participate alongside their supported application teams to address infrastructure dependencies, reliability considerations, capacity planning, and operational readiness.

The Contractor shall conduct a backlog refinement (grooming) session with the VA Product Owner and/or designated representative prior to the start of each Sprint to review, prioritize, and refine backlog items in preparation for Sprint Planning.

The Contractor shall conduct Sprint Planning prior to the commencement of each Sprint to define Sprint goals, scope, commitments, and task assignments in alignment with approved priorities.

The Contractor shall conduct daily stand-up (Scrum) meetings and shall provide the VA Product Manager with a daily stand-up report that, at a minimum, identifies the following:

· Work completed since the previous stand-up

· Work planned for the current day

· Any blockers, risks, or impediments impacting progress

The Contractor shall conduct an end-of-Sprint demo to validate and demonstrate that all planned Sprint work has been completed and meets acceptance criteria.

The Contractor shall conduct a Sprint Retrospective following the completion of each Sprint to assess performance, identify lessons learned, and define improvement actions. The Contractor shall provide a Sprint Retrospective report to the VA Product Manager documenting outcomes, action items, and assigned responsibilities.

Deliverables:

A. Prioritized Backlog (each sprint) B. Updated Sprint Plan (each sprint) C. Daily Scrum Report D. Sprint Demo (each sprint) E. Sprint retrospective report (each sprint)

MONTHLY TSMPS DELIVERABLES REPORT

Within thirty (30) days of contract award, the Contractor shall begin submitting a monthly TSMPS Deliverables Report that documents the status of all deliverables required under this award. Any deliverable that is late, inaccurate, or not approved by the VA shall be clearly identified and summarized on the first page of the report.

Deliverables:

A. TSMPS Deliverables Report (Monthly)

TSMP CLOUD COST ANALYTICS

Within ninety (90) days of contract award, the Contractor shall begin submitting a monthly Cloud Cost Report to the PM/COR that itemizes cloud costs for each TSMP-hosted or TSMP-provided application, service, and capability. The report shall clearly identify month-over-month cost variances and include expert analysis and specific recommendations to reduce costs without degrading required reliability or performance levels.

Deliverables:

A. Monthly Cloud Cost Report

AD HOC DATA COLLECTION AND REPORTS

The Contractor shall maintain sufficient staffing levels and appropriate skillsets to support ad hoc data collection, analysis, and reporting requests. Such requests shall be completed within a reasonable timeframe as determined by the Contracting Officer’s Representative (COR) and TSMP leadership.

Deliverables:

A. Ad hoc Data Reports (as needed)

ARCHITECTURE, ENGINEERING, AND MAINTENANCE

The Contractor shall provide personnel with the subject matter expertise and technical skillsets necessary to operate, enhance, secure, and ensure the reliability of the cloud-hosted Kubernetes platform (AWS Elastic Kubernetes Service (EKS)). This includes, but is not limited to, management of nodes, clusters, networking, storage, and all supporting capabilities and services.

The Contractor shall provide all adaptive, perfective, preventive, and corrective maintenance required to ensure performance objectives are met for all TSMP capabilities and services.

The Contractor shall ensure that architecture, engineering, and maintenance services achieve and maintain the following availability objectives:

· 99.995 percent incident-free availability for all capabilities and services supporting mission-critical applications

· 99.95 percent incident-free availability for all capabilities and services supporting non-mission-critical applications

For the purposes of these performance objectives, incident-free availability shall be calculated in minutes by dividing the total duration of qualifying incidents by the total number of minutes in the applicable measurement period.

An incident shall be defined as any unapproved service degradation or service disruption that could have been prevented by actions of TSMP personnel. Preventable actions include, but are not limited to, proper planning, training, configuration management, change control, monitoring, and/or improved communication or coordination with the Government or other entities.

The Contractor shall maintain adequate staffing levels with appropriately qualified and experienced personnel to perform all architecture, engineering, and maintenance activities and to consistently meet all performance objectives across the TSMP environment. Required expertise includes, but is not limited to, the following technologies and services:

· AWS EKS clusters

· AWS managed services (e.g., ElastiCache, RDS, DocumentDB, Kinesis, MSK, Athena)

· EC2-based services and platforms (e.g., Consul, Vault, MongoDB, Atlassian, Active Directory, Nexus, Postfix)

· Public Key Infrastructure (PKI) Configurations and Management

The Contractor shall ensure the following architecture, engineering, and maintenance standards are continuously met:

· Fewer than 1 percent of pod evictions per month are attributable to insufficient resource allocation

· 100 percent of cluster add-ons (e.g., CoreDNS, kube-proxy, Container Network Interface) remain within one minor version of the EKS cluster version

· Node failures are detected and remediated (cordon, drain, and replace) within 30 minutes

· Greater than 95 percent of nodes run the approved Amazon Machine Image (AMI)

· 99.995 percent cross-VPC connectivity availability

· Elastic Block Store (EBS) volumes do not exceed 80 percent utilization for more than one (1) hour

· Amazon EFS and FSx file systems maintain backup policies with 100 percent compliance

· Autoscaling policies and monitoring alarms are configured such that no production workload experiences CPU, memory, threads, or other resource saturation exceeding 80 percent for more than five (5) minutes

· No database failures due to storage exhaustion or backup interruptions

· In the event of database failure, data loss shall be less than or equal to 15 minutes

· Database will retain 15-minute snapshots for 7 days with retrieval time equal to and no greater than 1 minute

· Daily snapshots (1x/24hrs) are retained for 30 days and retrievable within 1 minute

· Monthly snapshots (1x/month) are retained for 60 days and retrievable within 1 minute

· Monthly snapshots that are retained for a period greater than 90 days are transferred to long-term storage and retrievable within 24 hours.

· 100 percent of platform components are integrated with centralized logging and monitoring solutions

· No product or platform change is implemented without conducting sufficient post-deployment production testing to validate that services are not degraded or disrupted

For all platform infrastructure and supporting software services, including but not limited to container orchestration (EKS), service mesh (Istio), databases, and event streaming services, the Contractor shall ensure:

· All services operate on software versions approved by the VA Technical Reference Model (TRM)

· No services operate on software that has reached end of support (EOS) or end of life (EOL)

· No services operate on software versions more than one minor version behind the latest release

The performance of all Architecture, Engineering, and Maintenance standards shall be calculated for all TSMP individual capabilities and services. These metrics shall be evaluated and enforced monthly and over the full Period of Performance (POP), with each period required to independently meet established performance objectives.

The Contractor shall provide Architecture, Engineering, and Maintenance Subject Matter Experts (SMEs) who shall be available to attend meetings, respond to inquiries, and provide technical guidance and recommendations as required.

SMEs shall be available during normal Government business hours and able to respond to urgent issues as required to support mission needs.

ARCHITECTURE PACKAGE

Within sixty (60) days of contract award, the Contractor shall deliver a comprehensive TSMP architecture package that includes end-to-end detailed architecture artifacts, high-level design (HLD) documents, and low-level design (LLD) documents. All documentation shall be professional in appearance, presentation-ready, and suitable for Government briefings. All architecture must be consistent with VA Enterprise Architecture guidelines.

The HLD documents shall be written to clearly communicate all TSMP components, services, and interactions to non-technical stakeholders, while the LLD documents shall provide the technical depth required to support engineering, operations, and maintenance activities.

The architecture package shall account for current and planned future data flows, system integrations, functional and non-functional requirements, and all supporting infrastructure components.

The Contractor shall update the Architecture Package at least every PI and as necessary to account for major architectural changes.

All architecture documents shall be reviewed and approved by the TASPL Technical Director or an authorized representative.

Deliverables:

A. Architecture Package

ARCHITECTURE, ENGINEERING, AND MAINTENANCE ASSESSMENT

Within forty-five (45) days of contract award, the Contractor shall conduct and deliver a comprehensive Architecture, Engineering, and Maintenance Assessment that identifies existing risks, gaps, vulnerabilities, opportunities for improvement, and any deficiencies across the platform. The assessment shall include prioritized recommendations, proposed remediation actions, and associated timelines for resolving all identified issues.

The Contractor shall update the Architecture, Engineering, and Maintenance Assessment each Program Increment (PI) to reflect changes in platform architecture, risk posture, and remediation status, and shall brief all updates to the VA Product Manager.

Deliverables:

A. Architecture, Engineering, and Maintenance Assessment B. Architecture, Engineering, and Maintenance Assessment briefing (each PI)

MAINTENANCE PLAN

Within forty-five (45) days of contract award, the Contractor shall develop and deliver a comprehensive Maintenance Plan for all Platform Services. The Maintenance Plan shall be provided in both narrative and graphical formats and shall, at a minimum, document the maintenance schedule, key milestones, recurring tasks and cadence, identified risks, and the resources required to sustain, operate, and maintain all platform services.

The Maintenance Plan shall be submitted to the TSMP Product Manager for review and shall require formal approval prior to implementation.

Deliverables:

A. Maintenance Plan

PROGRAM INCREMENT SOFTWARE VERSION POSTURE REPORT

The Contractor shall provide a Software Version Posture Report during each Program Increment (PI). The report shall account for all software products, tools, and platforms used by TSMP teams in the delivery, operation, and support of TSMP capabilities and services. All out of compliance software versions shall be clearly identified on the first page of the report.

At a minimum, the Software Version Posture Report shall include the following for each software component:

Software name and vendor

· License type and license start and expiration dates

· Current deployed version

· Latest available vendor-supported version

· Vendor-published end-of-support and end-of-life dates

· Planned upgrade or remediation windows, including identified technical, operational, and security risks

The Contractor shall plan and execute software upgrades in a phased and controlled manner, progressing through sandbox, staging, and production environments. Each upgrade shall include documented validation procedures, success criteria, and rollback plans to ensure service continuity and minimize risk to Production services.

All upgrade activities and deviations from vendor supported versions shall be documented, tracked, and made available to the Government upon request.

Deliverables:

A. Program Increment Software Version Posture Report

SECRETS MANAGEMENT

The Contractor shall implement and operate centralized secrets management (e.g., AWS Secrets Manager, HashiCorp Vault, Kubernetes secrets) for platform and application workloads.

The Contractor shall ensure automated rotation for 100% of production secrets where the target system supports automation and rotates all non-automated secrets at least every 90 days.

ENVIRONMENT CONFIGURATION MANAGEMENT

The Contractor shall implement and maintain consistent, automated configuration management for all container runtime environments, namespaces, clusters, cloud infrastructure resources, and network controls through Infrastructure-as-Code (IaC) practices.

The Contractor shall ensure that 100 percent (100%) of environment configuration, including but not limited to Kubernetes clusters, virtual private clouds (VPCs), subnets, identity and access management (IAM), security groups, routing, and related cloud resources, is provisioned and managed exclusively through approved IaC tooling (e.g., Terraform). Manual configuration changes in production environments are prohibited except when executed through an approved break-glass procedure, which must be documented and remediated back into IaC.

The Contractor shall maintain a code review and approval cycle time of no more than three (3) business days for all IaC changes.

The Contractor shall perform automated configuration drift detection at least weekly. Any identified production environment configuration drift shall be remediated within three (3) business days. At no time shall configuration drift affect more than ten percent (10%) of production resources.

The Contractor shall ensure that all environment changes are fully validated in non-production environments prior to deployment to production. Following production deployment, the Contractor shall conduct post-deployment validation and testing to confirm system stability and verify that no adverse impacts have been introduced.

CERTIFICATE MANAGEMENT

The Contractor shall manage and maintain all Public Key Infrastructure (PKI) operations, including TLS certificate issuance, renewal, rotation, storage, and integrity, for all platform capabilities, services, and applications throughout the Period of Performance (POP). These activities shall be performed in a manner that ensures zero disruption to production services.

The Contractor shall ensure the following certificate management requirements are met at all times:

· One hundred percent (100%) of TLS certificates are renewed no later than thirty (30) days prior to expiration

· All TSMP certificates shall be issued, renewed, and rotated using approved automated mechanisms (e.g., AWS Certificate Manager (ACM), HashiCorp Vault, Istio Certificate Authority). Manual certificate issuance or renewal is prohibited unless a documented, certificate-specific justification is submitted and approved

· Any invalid, expired, or misconfigured certificates identified in production environments are remediated immediately (24 hours a day, 7 days a week) to prevent service degradation or outages

The Contractor shall maintain a complete and accurate inventory of all certificates, including ownership, usage, expiration dates, and renewal mechanisms. Inventory accuracy shall be maintained at one hundred percent (100%) and validated through monthly audits.

The Contractor shall ensure all certificates comply with current Government-approved TLS protocols and cipher suite standards. Any exceptions shall be documented and reported to the Government within five (5) business days of non-compliance, along with recommended mitigation actions and a remediation timeline.

CONFIGURATION & CHANGE CONTROL

The Contractor shall provide configuration management and change control services for all changes to the platform and supporting services, including but not limited to Amazon Elastic Kubernetes Service (EKS), Istio service mesh, and Amazon Relational Database Service (RDS).

The Contractor shall support application teams operating under approved DevSecOps pipelines and procedures, which maintain independent change control processes.

The Contractor shall facilitate daily Change Control Board (CCB) meetings to review, document, and present applicable change requests to VA leadership for approval.

The Contractor shall ensure that one hundred percent (100%) of production changes are executed within Government-approved change windows, unless emergency or exception approval is explicitly authorized by the Government.

The Contractor shall submit change requests no later than three (3) business days prior to any planned production change, unless an alternate timeline is approved in writing by the Government.

The Contractor shall ensure all VA Change Control Policies and Standards are met to include integration with ServiceNow and Change Approval Board teams.

The Contractor shall ensure that documented backout and rollback plans are prepared and approved for one hundred percent (100%) of production changes prior to implementation.

The Contractor shall perform and document comprehensive post-implementation production verification testing within two (2) hours of completing each production change. Test results and validation outcomes shall be recorded in the associated change record.

The Contractor shall provide advance notification of all planned production changes to relevant Government stakeholders, including impacted application teams, in accordance with established communication procedures.

The Contractor shall deliver weekly change summary reports to the Government, detailing planned and executed changes, approval status, outcomes, incidents, emergency changes, and any deviations from approved change procedures.

Deliverables:

A. Production Change Notifications B. Weekly Change Summary

SCHEDULING EVENT BUS

Within 180 days of contract award, the Contractor shall deliver to production a Scheduling Event Bus that will provide a scalable, secure, and highly available event-driven integration framework to support enterprise scheduling…