V5 DRAFT- ePerformance Updated.docx

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Office of Human Resources Management Human Resources Information Technology

Enterprise Performance Management System

Date: November 12, 2024

VA-25-00013231

PWS Version Number: 1.4

Contents

BACKGROUND

U.S. Department of Veterans Affairs (VA) identified support for requirements to continually reduce and potentially eliminate manually intensive business processes to improve efficiency and standardization for VA’s performance management function.

The Performance Management System automates the management of employee performance guidance and business workflow (i.e. planning, developing, monitoring, rating, and rewarding employee contributions), including sending completed performance forms directly to the electronic Official Personnel Folder (eOPF) as stated in Handbook VA 5013. As a system of record, the Performance Management System provides consistency in automated business processes and optimize process improvements throughout VA. The automated system results in improved organizational performance, increased employee productivity and retention, and a clearer understanding by employees of the importance of their contributions to the VA’s organizational goals and objectives, an attribute critical to effectively serving our Veterans.

Enterprise Performance Management System (ePerformance) is within the Enterprise Human Capital Management (HCM) portfolio and has been identified as a capability to be adopted within the HCM Modernization platform. VA is seeking continued sustainment of the current ePerformance solution to maintain continuity of capabilities until the HCM modernization.

APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. 44 U.S.C. § 3541-3549, “Federal Information Security Management Act (FISMA) of 2002”

2. “Federal Information Security Modernization Act of 2014”

3. Federal Information Processing Standards (FIPS) Publication 140-2, “Security Requirements For Cryptographic Modules”

4. FIPS Pub 199. Standards for Security Categorization of Federal Information and Information Systems, February 2004

5. FIPS Pub 200, Minimum Security Requirements for Federal Information and Information Systems, March 2016

6. FIPS Pub 201-2, “Personal Identity Verification of Federal Employees and Contractors,” August 2013

7. 10 U.S.C. § 2224, "Defense Information Assurance Program"

8. Carnegie Mellon Software Engineering Institute, Capability Maturity Model® Integration for Development (CMMI-DEV), Version 1.3 November 2010; and Carnegie Mellon Software Engineering Institute, Capability Maturity Model® Integration for Acquisition (CMMI-ACQ), Version 1.3 November 2010

9. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

10. Public Law 109-461, Veterans Benefits, Health Care, and Information Technology Act of 2006, Title IX, Information Security Matters

11. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”

12. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, http://www.va.gov/vapubs/

13. VA Handbook 0710, Personnel Security and Suitability Security Program, May 2, 2016, http://www.va.gov/vapubs

14. VA Directive and Handbook 6102, “Internet/Intranet Services,” July 15, 2008

15. 36 C.F.R. Part 1194 “Electronic and Information Technology Accessibility Standards,” July 1, 2003

16. Office of Management and Budget (OMB) Circular A-130, “Managing Federal Information as a Strategic Resource,” July 28, 2016

17. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed Services (CHAMPUS)”

18. An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule, October 2008

19. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended, January 18, 2017

20. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

21. VA Directive 6500, “Managing Information Security Risk: VA Information Security Program,” September 20, 2012

22. VA Handbook 6500, “Risk Management Framework for VA Information Systems – Tier 3: VA Information Security Program,” March 10, 2015

23. VA Handbook 6500.1, “Electronic Media Sanitization,” November 03, 2008

24. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI)”, July 28, 2016

25. VA Handbook 6500.3, “Assessment, Authorization, And Continuous Monitoring Of VA Information Systems,” February 3, 2014

26. VA Handbook 6500.5, “Incorporating Security and Privacy in System Development Lifecycle”, March 22, 2010

27. VA Handbook 6500.6, “Contract Security,” March 12, 2010

28. VA Handbook 6500.8, “Information System Contingency Planning”, April 6, 2011

29. OI&T Process Asset Library (PAL), https://www.va.gov/process/ . Reference Process Maps at https://www.va.gov/process/maps.asp and Artifact templates at https://www.va.gov/process/artifacts.asp

30. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

31. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014

32. VA Handbook 6508.1, “Procedures for Privacy Threshold Analysis and Privacy Impact Assessment,” July 30, 2015

33. VA Handbook 6510, “VA Identity and Access Management”, January 15, 2016

34. VA Directive 6300, Records and Information Management, February 26, 2009

35. VA Handbook, 6300.1, Records Management Procedures, March 24, 2010

36. NIST SP 800-37 Rev 1, Guide for Applying the Risk Management Framework to Federal Information Systems: a Security Life Cycle Approach, June 5, 2014

37. NIST SP 800-53 Rev. 4, Security and Privacy Controls for Federal Information Systems and Organizations, January 22, 2015

38. OMB Memorandum, “Transition to IPv6”, September 28, 2010

39. VA Directive 0735, Homeland Security Presidential Directive 12 (HSPD-12) Program, October 26, 2015

40. VA Handbook 0735, Homeland Security Presidential Directive 12 (HSPD-12) Program, March 24, 2014

41. OMB Memorandum M-06-18, Acquisition of Products and Services for Implementation of HSPD-12, June 30, 2006

42. OMB Memorandum 04-04, E-Authentication Guidance for Federal Agencies, December 16, 2003

43. OMB Memorandum 05-24, Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors, August 5, 2005

44. OMB memorandum M-11-11, “Continued Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors, February 3, 2011

45. OMB Memorandum, Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation, May 23, 2008

46. Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance, December 2, 2011

47. NIST SP 800-116 Rev 1, Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access, June 2018

48. OMB Memorandum M-07-16, Safeguarding Against and Responding to the Breach of Personally Identifiable Information, May 22, 2007

49. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, Digital Identity Guidelines, June 2017

50. NIST SP 800-157, Guidelines for Derived PIV Credentials, December 2014

51. NIST SP 800-164, Guidelines on Hardware-Rooted Security in Mobile Devices (Draft), October 2012

52. Draft National Institute of Standards and Technology Interagency Report (NISTIR) 7981 Mobile, PIV, and Authentication, March 2014

53. VA Memorandum, VAIQ #7100147, Continued Implementation of Homeland Security Presidential Directive 12 (HSPD-12), April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

54. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

55. VA Memorandum “Mandate to meet PIV Requirements for New and Existing Systems” (VAIQ# 7712300), June 30, 2015, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4846

56. Trusted Internet Connections (TIC) Reference Architecture Document, Version 2.2, Federal Interagency Technical Reference Architectures, Department of Homeland Security, June 19, 2017, https://www.dhs.gov/sites/default/files/publications/TIC_Ref_Arch_v2.2_2017.pdf

57. OMB Memorandum M-08-05, “Implementation of Trusted Internet Connections (TIC), November 20, 2007

58. OMB Memorandum M-08-23, Securing the Federal Government’s Domain Name System Infrastructure, August 22, 2008

59. VA Memorandum, VAIQ #7497987, Compliance – Electronic Product Environmental Assessment Tool (EPEAT) – IT Electronic Equipment, August 11, 2014 (reference Document Libraries, EPEAT/Green Purchasing Section, https://www.voa.va.gov/documentlistpublic.aspx?NodeID=552)

60. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (Public Law 110–140), December 19, 2007

61. Section 104 of the Energy Policy Act of 2005, (Public Law 109–58), August 8, 2005

62. Executive Order 13834, “Efficient Federal Operations”, dated May 17, 2018

63. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 2, 2001

64. VA Directive 0058, “VA Green Purchasing Program”, July 19, 2013

65. VA Handbook 0058, “VA Green Purchasing Program”, July 19, 2013

66. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote Access”, January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

67. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

68. VA Memorandum, “Implementation of Federal Personal Identity Verification (PIV) Credentials for Federal and Contractor Access to VA IT Systems”, (VAIQ# 7614373) July 9, 2015, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

69. VA Memorandum “Mandatory Use of PIV Multifactor Authentication to VA Information System” (VAIQ# 7613595), June 30, 2015, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

70. VA Memorandum “Mandatory Use of PIV Multifactor Authentication for Users with Elevated Privileges” (VAIQ# 7613597), June 30, 2015; https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

71. “Latest Veteran Focused Integration Process (VIP) Governance and Guide https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

72. “VIP Release Process Guide”, Version 1.4, May 2016, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4411

73. “POLARIS User Guide”, Version 1.9, March 2017, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4412

74. VA Memorandum “Use of Personal Email (VAIQ #7581492)”, April 24, 2015, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

75. NIST SP 800-60, Guide for Mapping Types of Information and Information Systems to Security Categories, August 2008 https://csrc.nist.gov/pubs/sp/800/60/v1/r1/final

76. 0750 Performance Appraisal Process Flowchart, Attachment A

77. Title 5 (and Hybrid Title 38) Performance Form – VA 0750, Attachment B

78. Title 38 Proficiency Report Form – VA Form 10-2623, Attachment C

79. Title 38 Proficiency Report Form – VA Form 10-2623a, Attachment D

80. ECF Performance Form – VA Form 3482e (unique to VHA), Attachment E

81. Office of Personnel Management’s (OPM) Index Data Feed Interface Control Document, Attachment F

82. 2623a Proficiency Report Process Flowchart, Attachment G

83. ECF Performance Appraisal Process Flowchart, Attachment H

84. VA Handbook 5013 Performance Management System, March 27, 2015, Attachment I

85. VA Handbook 5017 Employee Recognition and Award, June 3, 2019, Attachment J

86. Enterprise Performance Management Business Requirements Document (BRD), Attachment K

87. VA Population Document, Attachment L

SCOPE OF WORK

The Contractor shall sustain and maintain capabilities and provide training for the Commercial-off-the-Shelf (COTS) Software as a Service (SaaS) Enterprise-wide Performance Management Software solution currently supporting VA’s population of approximately 485,000, and scalable up to approximately 550,000 personnel.

Currently, there are 121,000 Title 38 Employees; 360,000 Title 5 Employees, and 15 Senior Executive Service (SES) Employees, See attachment L (numbers above have been rounded up for ease).

Specifically, the Contractor shall sustain the features, within the current COTS SaaS Enterprise-wide Performance Management System solution. All activities should align to the Agile based approach in accordance with the VA Office of Information and Technology (OIT) Veteran-Focused Integration Process (VIP) for employees falling under United States Code (USC) Title 5, USC Title 38, and Senior Executive Service (SES) employees.

The Contractor shall provide operation and maintenance support through the life of the project for the deployed COTS/SaaS solution as it pertains to each type of employee. Such support and maintenance also encompass any additional Optional Tasks exercised by VA.

The COTS SaaS solution is subscription based and will not require any servers hosted within VA. Users access the system via a website and no software shall be downloaded onto VA computers.

PERFORMANCE DETAILS

PERFORMANCE PERIOD

The Period of Performance (PoP) shall be a12-month Base Period, with four 12-month Option Periods, and 6 Optional Tasks. The total PoP for this contract shall not exceed 66 months, inclusive of all Options and Optional Tasks.

There are eleven (11) Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, five are set by date:

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

PLACE OF PERFORMANCE

Tasks under this PWS shall be performed at Contractor facilities.

Contractor shall ensure Help Desk services are provided at a minimum during VA Core business hours from 6:00 a.m. to 6:30 p.m. Eastern Standard Time (EST), Monday through Friday. The ePerformance system shall be operational, in accordance with the SLA (PWS 5.9.2), 24 x 7 x 365.

TRAVEL

The Government may anticipate one travel trip to perform certain tasks associated with the effort, as well as to attend program-related meetings or conferences throughout the PoP. Contractors may be required to perform additional site-visits (CONUS only) to government and non-government facilities to conduct user research or stakeholder engagement.

Travel shall be considered a separate CLIN and will be reimbursed on a Time and Materials basis through exercising Optional tasks on this contract. All travel must be in accordance with the Federal Travel Regulations (FTR) and requires advanced approval by the COR. Contractor travel within the local commuting area will not be reimbursed.

SPECIFIC TASKS AND DELIVERABLES

PROJECT MANAGEMENT

The Contractor shall provide project management support during the entire lifecycle of the project to include ongoing operation and maintenance of the Performance Management System, and assistance with the management of system-related information as needed. The Contractor shall adhere to and be required to follow Veteran Focused Integration Process (VIP) and be responsible for all articles required under this governance process.

The Contractor shall maintain the Project Management Plan (PMP) that addresses project schedule, work breakdown structure (WBS), outlines goals and objectives, priorities, roles and responsibilities, resource management, risk, issues and mitigation, test strategy, change management strategy, and change control activities. The draft PMP shall be delivered at the Contract Kick-Off Meeting. The Contractor shall deliver an updated PMP based on Government input. The PMP shall be finalized and approved by the Government Program Manager, COR, and VA PM. The PMP shall be a living document used to manage this project and shall be maintained by the Contractor for Government approval. The PMP shall be updated quarterly to align with changes to the original Government approved plan.

The Contractor shall coordinate and lead bi-weekly (every two weeks) Project Status Meetings with a project advisory group comprised of key VA and VA contractor technical, functional, and change management subject matter experts (SMEs).

Briefing materials shall be submitted three business days before a meeting. The Contractor shall provide bi-weekly Project Status Meeting Minutes for each meeting.

The Contractor shall submit a Monthly Progress Report (MPR) addressing the status of all active efforts. Initially at the Kick-Off Meeting, and then prior to the start of each month of the contract performance, the Contractor shall meet with the VA PM and COR to discuss the work, and all deliverables, to be completed in the upcoming month for the Base Period (paragraph 5.9), and Optional Task 1 “Additional Subscriptions” (paragraph 5.10), Optional Task 2 “Additional Training” (paragraph 5.11), Optional Task 3 “Additional Virtual Training Refresher” (paragraph 5.12) and Optional Task 4 “Release Training Documentation” (paragraph 5.13), if exercised. The VA PM and COR will determine with the Contractor the work to be completed, including specific deliverables due that month, and include the work in the MPR. Payment for the upcoming month will be tied to successful completion of all Tasks including all deliverables to which the parties agreed at the start of the month.

The report shall cover progress made during the prior month for the work to which the parties agreed prior to the month starting along with the delivery of all required deliverables for the month. Payment will be approved upon Government acceptance of the MPR detailing satisfactory completion of all agreed to work and acceptance of any deliverables. Additionally, the MPR shall provide a status of the program/project health. The MPR shall also contain the following information, at a minimum:

1. Updated project schedule

2. Accomplishments

3. Risks, issues, dependencies, and mitigation plan

4. Action Items

5. Notes of status meetings

6. New system users by month

7. Contractor Staff Roster (providing updates as they occur, including personnel and security requirements, required TMS Training, and background investigations)

Deliverables:

A. PMP

B. Project Status Meeting Minutes C. Monthly Progress Report

TECHNICAL KICKOFF MEETING

A technical kickoff meeting shall be held within 10 days after TO award. The technical kickoff meeting shall be virtual via Microsoft Teams. The Contractor shall coordinate the date and time with the Contracting Officer (CO), as the Post-Award Conference Chairperson, the VA PM (Co-Chairperson), the Contract Specialist (CS), and the COR. The Contractor shall provide a draft agenda to the CO and VA PM at least five calendar days prior to the meeting. Upon Government approval of a final agenda, the Contractor shall distribute to all meeting attendees. During the kickoff-meeting, the Contractor shall present, for review and approval by the Government, the details of the intended approach, work plan, and project schedule for each effort via a Microsoft Office PowerPoint presentation. At the conclusion of the meeting, the Contractor shall update the presentation with a final slide entitled “Summary Report” which shall include notes on any major issues, agreements, or disagreements discussed during the kickoff meeting and the following statement “As the Post-Award Conference Chairperson, I have reviewed the entirety of this presentation and assert that it is an accurate representation and summary of the discussions held during the Technical Kickoff Meeting for “Performance Management System”. The Contractor shall submit the final updated presentation to the CO for review and signature within three calendar days after the meeting. The Contractor shall also work with the CS and the Government’s designated note taker, to prepare and distribute the Meeting Minutes of the kickoff meeting to the CO, COR and all attendees within three calendar days after the meeting. The Contractor shall obtain concurrence from the CS on the content of the Meeting Minutes prior to distribution of the document.

VETERAN FOCUSED INTEGRATION PROCESS (VIP)

The Contractor shall support VA efforts in accordance with the Veteran Focused Integration Process (VIP). VIP is a Lean-Agile framework that services the interest of Veterans through the efficient streamlining of activities that occur within the enterprise. The VIP Guide can be found at https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371. The VIP framework creates an environment delivering more frequent releases through a deeper application of Agile practices. In parallel with a single integrated release process, VIP will increase cross-organizational and business stakeholder engagement, change management, provide greater visibility into projects, increase Agile adoption and institute a predictive delivery cadence. VIP is now the single authoritative process that IT projects must follow to ensure development and delivery of IT products.

Required VIP documentation includes the following and shall be delivered by the Contractor: Service Level Agreement (SLA)/Operational Level Agreement (OLA), Version Description Document (VDD), Production Operations Manual (POM), Responsible Accountable Consulted Informed (RACI) Chart, User Guides, Defect Log/Test Execution, Test Execution Previous Release/Sprint Regression, Test Plan and Cases, Release/Sprint Plan and Work Items, Compliance Evidence Verification, and Risk Log as data entered in the Approved VA Tool.

Deliverables:

A. Service Level Agreement (SLA)/Operational Level Agreement (OLA) B. Version Description Document (VDD) C. Production Operations Manual (POM) D. Responsible Accountable Consulted Informed (RACI) Chart E. User Guides F. Defect Log/Test Execution G. Test Plan and Cases H. Release, Sprint Plan and Work Items I. Compliance Evidence Verification J. Risk Log

BUSINESS REQUIREMENTS

The Contractor shall sustain the COTS SaaS solution without disruption of service and delivery as a result of acquisition activities. The Contractor shall sustain the following requirements for the VA Enterprise Performance Management System as well as all requirements found in Attachment K:

1. Accommodates multiple Performance Management (PM) processes supporting various hiring authorities (e.g., Title 5, Title 38, and ECF);

· Title 5 (and Hybrid Title 38) Performance Form – VA 0750

· Title 38 Proficiency Report Form – VA Form 10-2623

· Title 38 Proficiency Report Form – VA Form 10-2623a

· ECF Performance Form – VA Form 4382e (unique to VHA)

2. Supports the collection of historical records that are kept for long-term retention and used for future reference and regulatory compliance

· Complies with the Office of Personnel Management (OPM)\GOVT-2 records retention regulation for System of Record Notice (SORN)

3. Provides for management-approved threshold(s), requirement(s), or expectation(s) that employees must meet to be appraised at particular levels of performance

4. Supports the ability to identify critical and non-critical elements

5. Enables the user to make changes or alterations of a PM plan

6. Alerts users of an action being performed throughout the PM lifecycle

7. Has the ability to support interchange of information through interfaces (e.g. application programming interfaces) with the systems listed in PWS Section 5.4 below.

8. Grants access to users or groups the ability and permissions to read, write, modify, delete and other transactions specific to a PM system

9. Drives PM initiatives to align all plan types associated with different stages of a PM lifecycle

10. Tracks user activity as well as activity history related to specific PM-associated documents

11. Supports off-cycle performance events such as early close out, changes in elements, and quarterly reviews

12. Provides for standard and ad-hoc reporting

13. Supports workflows

14. Accommodates a single Enterprise-wide set of goals, as well as a separate set of cascading organization goals that are specific to each Administration’s performance standards

15. Data sourced from the authorized system of record, HR Smart

16. Reverse feed of ePerformance values to HR Smart The Contractor shall maintain and provide a COTS SaaS Solution Subscription user status update in each Monthly Progress Report identifying current Subscription usage for the COTS SaaS solution.

NO HARM REQUIREMENTS

Due to the timing of this acquisition, it is imperative to minimize any disruption to the VA business. VA Administrations will be in the middle of mid-year performance evaluations within the current solution.

ACCESS REQUIREMENTS

The Contractor shall provide a solution which meets the following Access Requirements:

1. Personal Identity Verification (PIV) login enabled;

2. Supports Single Sign On (SSO) with necessary Authority To Operate (ATO) prior to testing;

3. Accessible via Microsoft Edge and Google Chrome;

4. Accessible in accordance with the Service Level Agreement Standards in PWS Section 5.9.2 except for periodic scheduled system maintenance;

5. Secures access directly to the database tables for purposes of data warehousing, SQL (structured query language) querying, backup, and archiving;

6. Provides failover to automatically and transparently redirect the user requests from the failed or down server to the backup system that mimics the operation of the primary system;

7. Enforces automatic logout after specified period of inactivity;

8. Utilizes roles to manage access to specific data, functionality and cases;

9. Meets VA protection standards required for privacy data and sensitive material;

10. Supports the use of digital signatures from a user’s PIV.

USABILITY REQUIREMENTS

The Contractor shall provide a solution which meets the following Usability Requirements:

1. Drop down menus and "pick lists" whenever possible to ensure validity and consistency of entered data;

2. Use "save as you go" to minimize lost data occurrences;

3. Use data validation rules whenever possible.

4. Search function to assist users in finding content;

5. Ad Hoc Reporting capabilities;

6. Access control capabilities;

7. Data archiving capabilities;

8. Upload/Import and Export file capabilities;

9. System notification alerts on changes or actions;

10. Digital signature capabilities;

11. Edit and modification capabilities;

12. Visual queuing capability to indicate plan progress;

13. Electronic submission of documentation to external locations

REPORTING/QUERYING

The Contractor shall provide a solution with the following Reporting/Querying capabilities:

1. Creation of ad-hoc queries based on system data fields and up to 10 standard “canned” reports.

2. Save and Export capability in varied formats (e.g. Portable Data Format (.pdf), Word, Excel, Text).

3. Generate administration-related reports such as user lists, access role assignments, access logs, and audit trail reports.

SECTION 508 COMPLIANCE

The Contractor shall provide a solution which is Section 508 compliant in accordance with Addendum A, Section A3.1. New requirements should specifically call out 508 testing prior to release of new capabilities to Production.

The Contractor shall support all audit and testing conducted by the VA Section 508 team, to achieve initial approval for production, and throughout the life of the contract. The Contractor shall be required to prepare any necessary Plan of Action and Milestone (POA&M) documents to address and remediate all defects found through 508 testing and/or audit. The Contractor shall support the Section 508 approval process and provide any necessary inputs requested or required by the Section 508 office.

Deliverables:

A. Plan of Action & Milestone (POA&M)

AUTHORITY TO OPERATE

The Contractor shall maintain an Authority To Operate (ATO) at Federal Information Security Management Act (FISMA) level Moderate in accordance with the guidance in VA Handbook 6500 no later than 6-months after date of award.

The Contractor shall provide all necessary submissions required by VA process to include obtaining any necessary access required for VA portals (e.g. Risk Vision). VA’s policies and standards concerning information security shall be confirmed by VA Security before the system is authorized for use by VA.

The Contractor shall ensure the system complies with FIPS 199, NIST 800-60 and operates in compliance with FedRAMP requirements and/or that it will be hosted and managed within a FedRAMP-approved environment.

COTS SOLUTION SUBSCRIPTIONS

VA requires a number of subscriptions necessary to support all VA employees (as listed in Attachment L). As VA hires additional staff, the Contractor shall provide additional subscriptions in accordance with PWS 5.10 (Optional Task 1).

REQUIREMENTS ELABORATION AND CONFIGURATION

BUSINESS ANALYSIS SUPPORT

The Contractor shall provide business analysis support to define, validate and configure additional functionality and enhancements to the Enterprise Performance Management System solution in accordance with the VA VIP.

The Contractor shall facilitate and execute requirements gathering sessions with the VA PM to refine and finalize the Government’s initial Performance Management Business Requirements Document (BRD) – Attachment N. The Contractor shall deliver a Requirements Traceability Matrix (RTM) based on the final BRD.

Based on the Final BRD and the RTM, the contractor shall participate in the Government’s IPT documenting the business process workflow for the VA performance management process.

The Contractor shall provide a Configuration Management Plan and shall address configuration change control support to ensure that the processes, changes, and approval stages are documented for hardware and software considerations, management, and maintenance of updates.

The Contractor shall perform a configuration audit at the time of system delivery. The Contractor shall confirm to the Government that the configured system is installed and performing in accordance with the requirements of its detailed design in the BRD.

The Contractor shall provide a System Configuration Audit Report detailing the results of the audit within 10 business days of system delivery. Any design or configuration defects should be highlighted with a mitigation approach and estimated time of remediation.

Deliverables:

A. Requirements Traceability Matrix (RTM) B. Final BRD C. Configuration Management Plan D. System Configuration Audit Report

INTEROPERABILITY

The Contractor shall provide an automated solution with interface functionalities that include data import and export capabilities that utilize a modern approach such as Application Programming Interface (API) capability. Any changes to these interfaces regarding data transmission once deployed shall be managed under Operations and Maintenance.

The Contractor shall provide necessary interface functionality for the transmission of all VA identified data in the Enterprise Performance Management System to the VA designated warehouse (Human Resources Priority and Allocations System (HRPAS)), the VA Authorized Employee Data system (HR·Smart), and to OPM’s Employee Official Personnel Folder (eOPF).

The interface functionality between the Enterprise Performance Management Solution and the designated warehouse (HRPAS) shall be bi-directional. HRPAS will transmit this data to HR Smart. The solution shall enable near real time transmission of performance rating data to HR·Smart. The data transmitted to HR·Smart shall support the processing of HR actions such as performance awards and automatic within-grade increases. The data transmitted from HR·Smart to the Enterprise Performance Management System shall support the establishment of employee records and/or update employee data needed to build a performance management record in the Enterprise Performance Management System. The data fields transmitted from HR·Smart to the Enterprise Performance Management shall include at a minimum:

Name Expansion, Last + Name Expansion, Suffix

Station Number Duty Station Code Department ID Cost Center

DUTY_STATION

DEPARTMENT_ID

COST_CENTER

grade_entry_dt

Salary Payable + Market Pay

Career (Competitive Service Permanent), Title 38, etc.

Z_T38_NURSE_LEVEL – refers to the level of the nurse; education and degree -Nurse Level 01 -Nurse Level 02 -Nurse Level 03

on ever table except PERSON

EMPL_APPT_NUM

The Contractor’s Enterprise Performance Management System solution shall provide the necessary functionality for the transmission of all VA annual performance appraisal documents to OPM’s electronic Official Personnel Folder (eOPF). The solution shall allow for varying end of year performance cycles as defined by the VA.

The Contractor shall establish all necessary approvals for connectivity including, at a minimum, any Enterprise Security Change Control Board (ESCCB) required processes and completion of any appropriate documentation necessary for interfaces under VA governance/authority. Work products may include, at a minimum, input into a Memorandum of Understanding (MOU) - Interconnection Security Agreement (ISA). The Contractor shall develop an Interface Control Document (ICD) for the Enterprise Performance Management System.

Deliverable:

A. ICD

SYSTEM TESTING

The Contractor shall develop and maintain a Test Plan that outlines the test strategy, testing objectives, resources required for testing, including the test schedule and necessary test deliverables, to be provided no later than 30 days after COR/PM acceptance of the BRD and RTM, and must be approved by the VA COR and PM. The Test Plan shall be updated as required during the period of performance. The Contractor shall include a Test Strategy section which demonstrates the strategy to provide testing support to ensure that the configured system meets the requirements in accordance with the BRD and RTM, is fully operable/interoperable with all necessary interfaces in place, defect free, and compliant with Section 508 standards and regulations.

The Contractor shall provide test plan data following the templates and data requirements appropriate for each test purpose appropriate to each phase of development.

The Testing Plan shall address the testing of all items in the RTM (PWS Section 5.3.1) and, at a minimum, the testing types listed below at least 45 business days before government performed Independent Verification & Validation (IV&V). The Contractor shall coordinate with the VA IV&V team on all testing activities. The minimum requirements for testing are identified below and the Contractor shall support the testing required under VA OIT VIP:

1. Accessibility Testing

2. Functional Testing

3. Integration testing

4. Interoperability

5. IV&V

6. Performance

7. Regression

8. Reliability

9. Security

10. System Testing

11. User acceptance testing (UAT) The Contractor shall provide, and make available to the Government, access to the test environment for the purpose of staging at least 3 business days in advance of all testing.

The Contractor shall provide Test Results demonstrating traceability to all requirements and provide an updated RTM. Test Results shall be delivered daily during UAT.

Deliverables:

A. Test Plan B. Updated RTM C. Test Results

SYSTEM TRAINING

The Contractor shall provide training and deliver training plans and training materials. All materials shall be delivered to the Government with the ability to address and make updates requested by the Government and be utilized in the VA Talent Management System (TMS). All final materials shall be submitted in duplicate and Section 508 compliant; one document in PDF format and one document in Word format. All future updates to training materials shall be furnished by the Contractor under Operations and Maintenance (PWS Task 5.8).

Specifically, the Contractor shall provide electronic user guides and helpdesk training documentation, to include a training presentation, facilitator guide, participant guide, training activity sheets and guides for the Performance System no later than 30 days prior to the initial system deployment. The Contractor shall be responsible for ensuring that all training materials and training documentation are Section 508 compliant and remain updated throughout the performance period as updates to the system occur. At the end of the performance period, all documentation shall be transferred to the Government PM and COR.

Deliverables:

A. Training Plan B. Training Materials (Training Presentation, FAQ, User Guide, Facilitator Guide, Training Manual, Participant Guide, Training Activity Sheets and Activity guides)

SYSTEM DOCUMENTATION

The Contractor shall provide a Risk Management Log (also known as a Risk Register). The Risk Management Log shall be maintained by the Contractor as a living document and shall be reviewed at the Bi-weekly Project Status meeting and attached to the Monthly progress report. (PWS Section 5.1).

The Contractor shall provide support for system documentation and system architecture artifacts in accordance with the Government Approved Project Management Plan and the VIP Process.

The Contractor shall develop and implement a Deployment, Installation, and Back-Out and Rollback Plan in accordance with OIT VIP. At a minimum, the plan shall include the requirement to save data for the backup and recovery of information stored on the cloud storage infrastructure to meeting related SLAs and the retention of records as required by VA Handbook 6300.1 (“Records Management Procedures”) and VA Directive 6300, (“Records and Information Management”), which must be approved by the VA PM/COR.

Deliverables:

A. Risk Management Log, Deployment, Installation, Back-Out and Rollback Plan

OPERATIONS AND MAINTENANCE SUPPORT

The Contractor shall provide Operations and Maintenance support of the Enterprise Performance Management System. Maintenance support includes, at a minimum, all COTS SAAS system maintenance and system configuration/change requests, bug defect software, operating system, network, or environment changes/updates necessary to support the EMPS solution in accordance with the SLA. The Contractor shall ensure compliance with the agreed to SLA (PWS Task 5.8.2 below) for all system related requirements under the SLA.

The Contractor shall deliver an Operation and Maintenance Plan that catalogs all the services and system performance reporting and metrics to be provided under O&M.

The Contractor shall ensure the system continues to comply with FIPS 199, NIST 800-60 and operates in compliance with FedRAMP requirements, or be hosted/managed within a FedRAMP-approved environment. The Contractor shall perform all necessary activities to maintain an ATO at a categorization of “Moderate”.

The Contractor shall perform all software maintenance, including installation, testing, adding or amending business rules/processes, and deploying software upgrades and patches to the solution.

Additionally, the Contractor shall manage all subscriptions necessary for the ePerformance solution to provide VA real time information on the number and status of all active subscriptions.

The Contractor shall utilize an Agile and Change Management methodology to conduct sustainment operations in accordance with OIT VIP. The Contractor shall support product backlog reviews and refinement of configuration requirements for system changes.

The Contractor shall provide system and database administration for the Enterprise Performance Management System. The administration functions shall include software technical support and interface functionality to the configured solution to include Bug fixes and Change requests/enhancements.

The Contractor shall provide advanced notice to project managers via email on system outages 48 hours prior to scheduled outages.

The Contractor shall prepare and execute the deployment of all system maintenance releases monthly and provide Release Notes and submit the release notes to the VA PM for review and provide a finalized version, if anything changed during the release process. The Contractor shall update the Configuration Management Plan quarterly.

The Contractor shall have a Disaster Recovery capability to return system services to acceptable performance criteria within 12 hours of failure.

The Contractor shall ensure the system remains compliant with all Federal Law or Policy changes that occur during the life of the contract, at no additional charge to the Government.

Deliverables:

A. Operations and Maintenance Plan B. Release Notes C. User guides

HELP DESK SUPPORT

The Contractor shall provide Tier 2 and Tier 3 Help Desk support at a minimum during VA Core business hours from 6:00 a.m. to 6:30 p.m. Eastern Standard Time (EST), Monday through Friday, which shall at a minimum include:

a. A detailed Help Desk Support Plan that includes SOPs and SLAs for the support provided;

b. Providing help to authorized users;

c. Managing and tracking all environment outages;

d. Managing Help Desk request fulfillment, access management, and planned and preventive maintenance;

e. Providing input and technical support to VA help/service desks on all layers until resolution;

f. Notifying the VA PM of scheduled maintenance windows per the proposed SLA;

g. Coordinating with VA for network outage, reconfiguration, and network troubleshooting issues;

h. Help Desk Report including the number of tickets opened, number of tickets closed, status of remaining open tickets, and outages.

The Contractor shall respond to Tier 2 and Tier 3 tickets in accordance with the Service Level Agreement (SLA) listed in Table 1 below.

Table 1. SLA Response Times…