P02 RFI Draft PWS.docx

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Office of Information and Technology

Benefits, Appeals and Memorials

Loan Guaranty Service – Development, Security and Operations

Date: 06/10/2024

1.0 BACKGROUND

The mission of the Department of Veterans Affairs (VA), Office of Information and Technology (OIT), Enterprise Program Management Division is to provide benefits and services to Veterans of the United States by providing Product Line Management, oversight and overall leadership to software development projects, Commercial Off-The-Shelf (COTS), and Software as a Service (SaaS) implementations. In meeting these goals, OIT strives to provide high quality, effective, and efficient Information Technology (IT) services to those responsible for providing care to the Veterans at the point-of-care as well as throughout all the points of the Veterans’ journey in an effective, timely and compassionate manner. VA depends on Information Management/Information Technology systems to meet mission goals.

1.1 VA OIT PRODUCT LINE IT INNOVATION STRATEGY

In collaboration with the VA Home Loan Guaranty (LGY) Program, VA OIT is adopting a Product Line Management model (LGY Product Line) to organize work and resources in support of the customer, and in support of this model, the LGY Product Line is leaning into organizational alignment with the following IT goals:

· Establishing Core Teams Responsible for Organizational Agility: Establishing a Product Line Management model will help align investment decisions with strategic goals and utilize an agile approach to continuously improve customer experiences across the organization. This endeavor will boost efficiency to significantly change how LGY delivers experiences to Veterans and enable innovation within the enterprise to achieve strategic programmatic goals.

· Organizing Around Customer-Centric Value Streams: Organizing solution teams around customer-centric value streams will allow the LGY Product Line to deliver products and services that represent the need and voice of the customer, placing focus of the organization squarely on improving value for both external and internal customers. It considers both physical processes and the information systems used to manage and control them.

· Positioning Levers to Govern Standards and Share Priorities: Creating cross-cutting services that will help maintain a single source of truth and establish standards for continuous improvement.

Efforts are to sustain present systems that are fully functional and deployed as well as update one congressional mandate to decommission VA Special Purchase (VASP) and update to major versions of already in use software related to SalesForce and Linux.

The joint Veterans Benefits Administration (VBA)/OIT LGY Portfolio Team (not in the scope of this task order (TO)) and the LGY Development, Security and Operations (DevSecOps) teams, outlined in this Task Order, will align with VA OIT strategic goals by using an agile approach to continuously improve experiences across the organization. This endeavor will boost efficiency, significantly changing how VA delivers experiences to Veterans and employees, as well as enable innovation within the enterprise to achieve VA OIT strategic goals in the future.

The joint VBA/OIT LGY Product Line strategic goals for IT are:

· Efficiency: Reducing duplicative efforts and enabling faster progress toward achieving strategic goals.

· Collaboration: Promoting collaboration and cross-functional teams with both business and IT representation.

· Strategy: Developing an accessible roadmap with clear prioritization, aligned strategic outcomes and defined resource allocation.

· Agility: Adopting an agile, iterative approach to research, data-driven decision making, and plan adjustment as needed.

The structure of this TO is intended to create a partnership between the LGY Portfolio Team (not in the scope of this TO) and the DevSecOps teams to overcome current obstacles within VA OIT and, in doing so, reduce the burden of day-to-day tasks and enable increased bandwidth for modernization initiatives and delivery of long-term strategic objectives.

1.2 VA HOME LOAN GUARANTY PROGRAM SCOPE

VA LGY provides a guaranty on mortgage loans made by private lenders to eligible Veterans. This guaranty effectively eliminates the need for lenders to charge a down payment and helps Veterans afford homeownership. The VA guarantees that it will pay lenders a portion of losses that may be suffered as a result of borrower default. VA-guaranteed loans are available for the purchase, construction, or repair/rehabilitation of a home. This benefit is available to Veterans, certain members of the Selected Reserve, active duty service personnel and certain categories of spouses.

During any given month, LGY monitors several million active loans and is able to proactively intervene to prevent foreclosure, whenever possible. This service not only saves taxpayers billions of dollars each year but improves the lives and financial wellbeing of Veterans.

In cases of foreclosure, where the lender conveys the property to VA, LGY manages, markets, and sells these properties (via a contract with a private-sector vendor) so the proceeds from the sale help offset the cost of the foreclosure, the Veteran’s indebtedness associated with the foreclosed loan, and ultimately the government’s costs of new VA-guaranteed loans for other Veterans.

LGY also manages several loan programs where VA is the direct lender, as opposed to the guarantor. LGY offers direct loan financing to purchasers of VA-foreclosed properties, and to Native American Veterans seeking to purchase or refinance a home on Federal Trust lands.

Additionally, in some instances when a Veteran borrower’s VA-guaranteed loan is seriously delinquent, and the holder is not willing to offer further loss mitigation assistance, LGY has authority to make a direct loan to refund (repurchase) a VA-guaranteed loan from the holder, modify the loan terms (within existing standards) to be affordable, and place it into the Direct Loan portfolio.

In addition to home loans, LGY administers grants for home adaptations through the Specially Adapted Housing (SAH) program. SAH grants may be used in conjunction with the home loan guaranty benefit. Since 1948, SAH grants have helped provide a barrier-free living environment that can afford Veterans a level of independent living they may not otherwise enjoy.

1.3 VA HOME LOAN GUARANTY PROGRAM STRATEGIC MANAGEMENT FRAMEWORK

The mission of LGY is to maximize opportunities for Active Duty, National Guard, and Reserve Servicemembers, Veterans, and certain surviving spouses to obtain, retain, and adapt their homes by providing viable and fiscally responsible benefits in recognition of their service to the nation. LGY’s vision is to empower Veterans with information and access to innovative, high-quality products and services by providing a Veteran-focused experience, strengthening our partnerships, driving continuous performance improvements, and never forgetting who we serve.

LGY is committed to investing in initiatives that transform and improve service to Veterans and their families. LGY will continue to innovate and improve benefit delivery to Veterans and beneficiaries, enhancing their economic security and ensuring that VA Home Loan Program remains the product of choice.

LGY will move the Program into the future through increased transparency, improved public- private collaboration, and innovative solutions that increase Program participation and reduce Program risk.

The program operates with a clearly defined Project Management Office Charter, and a project governance structure which uses an Executive Steering Committee and Board of Directors, headed by the Executive Director, Loan Guaranty Service. Program strategic priorities, initiatives, and resource allocation decisions are made within this structure.

The program’s established Strategic Priorities through 2025 are illustrated in Figure 1. Figure 1: VA Home Loan Program Strategic Priorities Roadmap

Figure 1: VA Home Loan Program Strategic Priorities Roadmap

1.4 JOINT VA OIT/LGY PRODUCT LINE STRATEGIC VISION

VA OIT/LGY Product Line strategic vision is driven by LGY Business needs (See Figure 1; also, Attachment A -Transforming VA’s Loan Lifecycle) and OIT initiatives intended to align objectives and meet established strategic goals. The strategic vision lays the groundwork to consistently deliver value to the VA Home Loan Program while creating an environment to support a platform for greater user visibility, more clearly defined technical infrastructure, improved data management and analytic capabilities, and enhanced information security and accessibility.

Current Goals include:

· Enable Innovation: Implement streamlined modern platforms that allow for configurability to address industry changes and business goals, as well as Veteran and employee needs.

· Streamline Platforms and Services: Support shared enterprise data to enable data quality, deeper analytics, and efficient sharing and management across many platforms.

· Create and Sustain Robust Analytic Capabilities in the VA Home Loan Program that enable leaders to create Veteran-centric and fiscally sound policy and enhance positive Veteran outcomes.

· Promote Collaboration and Communication: Promote collaborative lean-agile processes to quickly build solutions accounting for human-centered design, business process re-design, technology trends, policy revisions and enterprise challenges.

· Instill Trust and Transparency: Build trust with transparency and implementation of the enterprise strategy across the LGY Product Line.

Current challenges and obstacles to meeting such goals include:

· Lack of Unified System: Fragmented solutions are causing inefficiencies, user fatigue, data quality and access issues, excessive dependencies and delays.

· Lack of Shared Services and Platforms: The current “stovepipe” development patterns result in duplicative platforms that create rather than reduce work. Many teams derive solutions to the same problems in a variety of different ways, proving highly inefficient.

· One-Off Solutions: There are numerous custom solutions with little support across the enterprise, resulting in high maintenance costs and lack of consistency.

· High Operational Costs: Outdated systems lacking support create additional work to keep them functional, resulting in increased operational costs.

· Unfit Data Architecture and Technology: Current data (and systems) architecture and technology are not fit for purpose of conducting many basic, and most all advanced analytics. The program seeks to enhance its ability to form complex insights across the full loan lifecycle and at the fine level of geography so that its leaders can more often make timely, fully-intelligent and proactive data-driven decisions.

· Limited Shared Vision or Strategy: Teams often work toward initiatives that compete with one another rather than work together to support the agency.

The future VA OIT/LGY Product line IT organization (Figure 2) will include several highly collaborative team structures with specific areas of responsibility. As noted above, LGY program strategic priorities, business needs, and initiatives will be established and provided to the VA OIT/LGY Product line for execution and collaboration with the LGY business line.

Figure 2: LGY IT Organization

1.5 LGY PORTFOLIO TEAMS (NOT IN THE SCOPE OF THIS TO)

The LGY Portfolio teams are focused on collaborating with the LGY business by assisting to identify and validate business needs, prioritizing large initiatives to fulfill those needs, overseeing the work, and validating whether the work meets the business need upon delivery. The Portfolio Teams are also engaged in overseeing and supporting initiatives/epics through initial business need definition, epic selection and prioritization, epic execution oversight (with emphasis on enterprise architecture), demand management and product innovation. The Portfolio Team is expected to provide perspective on product ownership across all backlog epics in context of business priorities.

1.6 FEDERATED SHARED SERVICES TEAMS

The Federated Shared Service Center is a dedicated unit (including people, processes and technologies) that is structured as a centralized point of service and is focused on defined business functions. These functions are supported by IT and IT services for multiple business units within the enterprise. Their purpose is to provide governance, standards and management surrounding Product Line services that can be utilized by Solution, Feature and System Teams, allowing them to focus on their core business while improving operational strategies and delivering best in class support tools. Examples of Federated Shared Services may include, but are not limited to, Data Analytics, DevSecOps, and Help Desk.

1.7 SOLUTION TEAMS

Solution Teams are intended to support the elaboration of epics to alternative solutions for large and complex systems. As shown in Figure 2, system or application level designs and build/buy decisions are crafted at this tier. Stronger focus is placed on capturing requirements on solution intent, early user and technical prototypes, business process modeling, and experience modeling. This team is also tasked with overseeing and supporting elaboration of epics into features and stories. Cross-team risk and dependency management along with large initiative agile program management are activities performed by Solution teams.

1.8 DELIVERY TEAMS

Delivery teams include Agile Release Train (ART) Leadership, Feature and System Teams. The ART Leadership team communicates a common business and technology mission and facilitates planning, commitment and release of features. The ART team will work with Feature and System Teams to execute Product Line Approved Epics while ensuring optimal flow, fostering innovation and ensuring continuous improvement. The Feature Teams are focused on creating tested, production ready code that meets acceptance criteria defined by the business and the Portfolio Team. Component design, unit and functional testing is commonly performed by the Feature Team members. System Teams build the Continuous Integration and Continuous Delivery (CI/CD) pipeline and work in tandem with the Feature Teams, providing support for the continuous delivery pipeline as well as database support and other specialty expertise required across multiple Feature Teams.

Success of the VA Home Loan program in the future relies heavily on its data architecture and ability to conduct many forms of data analytics. The program must be able to access and analyze its data across time and across the full lifecycle of the loan or of a Veteran’s interaction with the program; oftentimes in rapid fashion to meet Federal Government, Congressional, or auditor needs, or to react in time to housing and financial markets.

A business sample of a data analytics scenario is provided in Figure 3 below, which describes the steps, flow of data exchange and interactions between the agile teams, should the optional task be exercised. For myriad reasons, it is extremely important to the government that the timeline from ingestion to completion of a data analytics request (such as is outlined below) is minimized to the greatest extent possible, that the analysis can be replicated by others, and that the product is of high quality.

Figure 3: Data Analytics Scenario

VA requires a contractor with broad, state-of-the-art expertise in the Home Loan Mortgage Industry domain. VA will introduce increased efficiency and added value through new guidance such as the Product Line Management (PLM) Playbook. PLM will take OIT project management practice from its current project-oriented focus to full PLM Scaled Agile Framework (Scaled Agile) implementation. The PLM Playbook will replace the legacy Veteran- Focused Integration Process (VIP) Practices and Guide.

2.0 APPLICABLE DOCUMENTS

In the performance of tasks associated with this PWS; the Contractor shall comply with the following:

1. 44 U.S.C. § 3541-3549, “Federal Information Security Management Act (FISMA) of 2002”

2. “Federal Information Security Modernization Act of 2014”

3. Federal Information Processing Standards (FIPS) Publication 140-2, “Security Requirements For Cryptographic Modules”

4. FIPS Pub 199. Standards for Security Categorization of Federal Information and Information Systems, February 2004

5. FIPS Pub 200, Minimum Security Requirements for Federal Information and Information Systems, March 2016

6. FIPS Pub 201-2, “Personal Identity Verification of Federal Employees and Contractors,” August 2013

7. 10 U.S.C. § 2224, "Defense Information Assurance Program"

8. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

9. VA Directive 6500, “Managing Information Security Risk: VA Information Security Program,” September 20, 2012 10.

11. VA Handbook 6500, “Risk Management Framework for VA Information Systems – Tier 3: VA Information Security Program,” March 10, 2015

12. VA Handbook 6500.1, “Electronic Media Sanitization,” November 03, 2008

13. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI)”, July 28, 2016

14. VA Handbook 6500.3, “Assessment, Authorization, And Continuous Monitoring of VA Information Systems,” February 3, 2014

15. VA Handbook 6500.5, “Incorporating Security and Privacy in System Development Lifecycle”, March 22, 2010

16. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

17. NIST SP 800-53 Rev. 4, Security and Privacy Controls for Federal Information Systems and Organizations, January 22, 2015

18. VA Product Line Management (PLM) Playbook V1.0, October 2019

19. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”

20. OMB Guidance M-16-21

21. NIST SP 800-53 Rev. 4, Security and Privacy Controls for Federal Information Systems and Organizations, January 22, 2015

22. VA Memorandum “Use of Personal Email (VAIQ #7581492), April 24, 2015,

23. VA Memorandum “Updated VA Information Security Rules of Behavior (VAIQ #7823189)”, September 15, 2017

24. The Twelve Factor App https://12factor.net/

25. Th Agile Manifesto http://agilemanifesto.org/

26. The U.S. Digital Services Playbook https://playbook.cio.gov/

27. The TechFAR Hub https://techfarhub.cio.gov/

28. VA UX style Guide

29. VA Digital Services Handbook Research and Discovery Checklist https://department- of-veterans-affairs.github.io/va-digital-service-handbook/delivery/research-and- discovery/checklist

30. The Digital Analytics Program https://digital.gov/dap/

31. VA Design System https://design.va.gov/

32. United States Web Design System https://designsystem.digital.gov/

33. VA Developer Portal https://developer.va.gov/

34. Scaled Agile® for Lean Enterprises 5.0: https://www.scaledagileframework.com/Scaled Agile-for-lean-enterprises/

35. Attachment A – Transforming VA’s Loan Lifecycle

36. Attachment B - LGY DevSecOps Application List

37. Attachment C – LGY DevSecOps Tools List

38. Attachment D – PLM Playbook

39. Attachment E - T&M Labor Rate Table

3.0 SCOPE OF WORK

The Contractor shall provide sustainability of the existing deployed systems along with security and or help desk functions needed to keep the systems executing. Additionally, there will be three key focus areas that will need development efforts and those can be found in attachment (?)

3.1 ORDER TYPE

The effort shall be a hybrid Firm-Fixed-Price (FFP) and Time-and-Materials (T&M) order.

4.0 PERFORMANCE DETAILS

4.1 PERFORMANCE PERIOD

The Period of Performance (PoP) shall be 4months from date of award.

Any work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO). (If required, the CO may designate the Contractor to work during holidays and weekends).

There are 11 Federal holidays set by law (USC Title 5 Section 6103) that VA follows: Under current definitions, four are set by date:

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

4.2 PLACE OF PERFORMANCE

Efforts under this TO shall be performed at both Government and Contractor facilities. Space is available at the Austin Information Technology Center (AITC), 1615 Woodward St., Austin, TX 78741 for up to 20 FTEs and at VA facilities located on or near 1800 G Street NW, Washington, DC 20006 for up to 5 FTEs. The Contractor shall provide up to 25 onsite resources as determined necessary by VA. The Contractor shall identify the place of performance for offsite resources in their proposal submission.

4.3 TRAVEL

The Government anticipates no travel under this effort.

5.0 SPECIFIC TASKS AND DELIVERABLES

The Contractor shall use an agile approach to continuously improve experiences across the LGY platform and Product Line to provide greater user visibility, clearly defined technical infrastructure, improved capabilities, as well as information security and accessibility as directed by VA stakeholders in accordance with the Working Principles.

Working Principles are guidelines for governing the work described in sections 5.2.2 and 5.2.3 and the Optional Tasks. The principles shall be followed where applicable.

· Follow the practices described in the VA PLM Playbook.

· Follow the practices described in the U.S. Digital Services Playbook, Applicable Document.

· Leverage Cloud Native technologies and approaches where applicable

· Follow Salesforce deployment best practices, reduce constraints and dependencies on deployment of salesforce features.

· Incorporate Agile methodology into all work as detailed in the Agile Manifesto.

· Work iteratively by employing commonly used iterative ceremonies such as (but not limited to) sprint planning, daily scrum, sprint review, sprint retrospective, backlog grooming, and estimating.

· Incorporate user research and usability testing best practices into all solutions.

· Actively involve users in the design, building, and testing of all solutions.

· Whenever possible, personalize solutions for the individual using the service.

· Leverage existing VA identity and authentication systems when appropriate and in line with VA’s overall authentication strategy.

· Optimize all applicable products for mobile-first operation, with all solutions being equally usable on desktop applications.

· Protect user information with best-in-class security, given the constraints of the environment.

· Prioritize security over compliance.

· Incorporate robust accessibility principles into design, development and testing for all products to deliver high-quality digital experiences to users of assistive devices and follow compliance principles and best practices from Section 508.

· Follow principles for frameworks of Infrastructure as Code, Security as Code and Monitoring as Code.

· When possible adopt Robotic Process Automation (RPA).

· Utilize test driven development methodologies where appropriate.

· Ensure configuration and sensitive data, including data the VA defines as sensitive, are not present in source code, and are stored in encrypted credential management systems.

· Deliver all code as Open Source Software pursuant to Office of Management and Budget (OMB) Guidance M-16-21.

· Leverage open source technologies, where available, to quickly enable new features whenever possible.

COMMON ONGOING PRODUCT LIFECYCLE ACTIVITES

· Continuously deploy code into lower environments and regularly release code to production environments with a target of at least one production deployment per day.

· Maintain proficiency with VA software development tools.

· Integrate with external systems and other VA systems to access appropriate data. All integrations shall be configured to utilize automated testing and instrumentation with code, to discover and manage reliability issues.

· Use automation to implement all build, release, and deployment steps as versioned, tested, and source-controlled code.

· Develop, maintain, and communicate meaningful product metrics, Key Performance Indicators (KPIs), that are directly linked to the user need or problem the product is intended to address. This task includes identifying and measuring baseline metrics for comparison, process improvement and fostering of a mature LGY product delivery pipeline.

· Obtain and maintain a security posture that sustains existing controls in support of obtaining an authority to operate (ATO), authority to connect (ATC) or any other required security scans. This task includes compliance with Software Assurance Groups (SWA), software quality checks and scans, using VA approved tools for DB, Nessus and other required scans.

· Obtain and maintain a Section 508 compliant posture, which includes adhering to all accessibility standards, while performing, supporting and obtaining Section 508 certificates.

· Foster RPA.

· Establish and maintain integrated, cross-functional and cross-organizational (e.g. having Contractor and Government members) teams to enhance communication, share lessons learned, and facilitate rapid identification and mitigation of dependencies between various functional entities.

OPEN SOURCE/REUSE

The Contractor shall configure and develop all new LGY content including all technical data, source code, configurations, documentation or other information as Open Source Software pursuant to OMB Guidance M-16-21.

· Approach system design in an “out-of-the-box” manner, using best practice approaches or preconfigured solutions, including libraries, components, modules, or other preconfigured increments of software. When possible, code shall be drawn from the open source community with a focus on minimizing system customization through written code.

· Publish all components, source code, or software artifacts under an open source license on behalf of the Government for reuse in an open source manner. This also includes but is not limited to Infrastructure as Code, Security as Code and Monitoring as Code.

· Separate configuration and sensitive information from source code.

· Manage dependencies on other open source libraries and tools and provide recommendations to VA for continued use or updates. Implement in alignment with VA approved models.

· Maintain a list of LGY’s open source libraries and tools that are available for reuse.

Store source code, technical data, configurations, documentation in publicly accessible source control repositories approved by VA.

5.1 PROJECT MANAGEMENT (FFP)

5.1.1 CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, timeline and tools to be used in execution of this TO effort. The CPMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks and resource support. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPMP shall be concurred upon, by the VA Program Manager (PM), and updated in accordance with Section B of the TO throughout the PoP.

Deliverable:

A. Contractor Project Management Plan

5.1.2 REPORTING REQUIREMENTS

The Contractor shall deliver Monthly Status Reports and Key Performance Indicator Scorecards. These reports shall provide accurate, timely, and complete project information to support reporting requirements.

The Monthly Progress Status Report shall include the following data elements and reporting capability which shall address the below requirements:

a) Project Name.

b) Overview and description of the contract.

c) Overall high-level assessment of contract progress.

d) Billable travel for the reporting month, if applicable

e) Program Resources, and to what CLIN each resource is billing during the reporting month, including billable allocation, LCAT and program roll on and roll off dates.

f) All work in-progress and completed during the reporting period. This shall include all completed sprints for each team with validation of established Definition of Done criteria having been met.

g) Identification of any contract related issues uncovered during the reporting period and especially highlight those areas with a high probability of impacting schedule, cost or performance goals and their likely impact on schedule, cost, or performance goals.

h) Explanations for any unresolved issues, including possible solutions and any actions required of the Government and/or Contractor to resolve or mitigate any identified issue, including a plan and timeframe for resolution.

i) Status on previously identified issues, actions taken to mitigate the situation and/or progress made in rectifying the situation.

j) Work planned for the subsequent two reporting periods, when applicable

k) Provide expenditures based upon your proposed spend plan.

l) Workforce staffing data showing all Contractor personnel performing on the effort by task during the current reporting period.

m) Original schedule of deliverables at the start of each sprint and the corresponding deliverables made during the current reporting period.

n) Software licenses at or nearing end of life and software security certificates nearing expiration.

The Contractor shall use VA’s implementation of approved PLM Playbook or its successor project management tools to accomplish this reporting and provide a single Agile project/product lifecycle management tool to track execution details. The approved project management tool will be used to provide a single authoritative project and product data and artifact repository. All OIT project data and artifacts shall be managed in this data and artifact repository daily. All checked out artifacts shall be checked back in daily and any data updated daily. The tool will synchronize all changed information immediately for all team members to access work proficiently without the concern of working on aged or obsolete information.

The Contractor shall use VA’s application Lifecyle management approved tool in accordance with best practices to:

1. Input and manage scheduled project/product sprints and backlog

2. Input and manage project/product agile requirements

3. Input and manage project/product risks and issues

4. Input and manage project/product configurations and changes

5. Input and manage project/product test plans and execution

6. Input and manage project/product planning and engineering documentation

7. Input and manage linkages to correlate requirements to change orders to configurable items to risks, impediments, and issues to test cases and test results to show full traceability.

The Contractor shall show all Agile requirements, changes, tests performed and test results in approved VA project management tools to show evidence of code coverage and test coverage of all the requirements specified. This expectation will allow VA to have high confidence in a fully documented, as evidenced by data in the tools, requirements traceability matrix.

The Contractor shall provide the COR with Monthly Status Reports in electronic format. These reports shall reflect data as of the last day of the preceding month.

Deliverable:

A. Monthly Progress Status Report B. Key Performance Indicator Scorecard

5.1.3 ONBOARDING

The Contractor shall manage the onboarding of its staff. Onboarding Status Report shall include active and inactive roster of resources on the program, CLIN alignment, labor category, billable allocation, recorded status of required onboarding activities, escalations needed by COR for onboarding dependencies, steps to obtain a VA network and email account, complete training, initiate background investigations, and gain physical and logical access, which may include elevated privileges to the necessary development and test environments for the various systems to be enhanced.

A single Contractor Onboarding POC shall be designated by the Contractor who tracks the onboarding status of all Contractor personnel. The Contractor Onboarding POC shall be responsible for accurate and timely submission of all required VA onboarding paperwork to the COR or his/her onboarding designee. The Contractor shall be responsible for tracking the status of all their staff’s onboarding activities. The Contractor shall provide an Onboarding Status Report weekly which includes updates for all in-process staff, including any staff with outstanding onboarding requests for review by the COR and his/her onboarding designee.

Deliverable:

A. Onboarding Status Report

TRAINING REQUIREMENTS-PRIVACY AND HIPAA TRAINING

The Contractor shall submit all on-boarding paperwork and documentation as required by all applicable VA onboarding requirements, including but not limited to VA Directive 0710, as well as documentation specifically requested by the COR, to ensure the timely on-boarding of contractor staff.

Additionally, the Contractor shall submit all required Talent Management System (TMS) training certificates of completion for VA Privacy and Information Security Awareness and Rules of Behavior and Health Insurance Portability and Accountability Act (HIPAA) training and provide signed copies of the Contractor Rules of Behavior, Training, from Appendix C of the VA Handbook 6500.6, “Contract Security”.

The Contractor shall maintain 100% compliance for annual training requirements.

Deliverable:

A. TMS Training Certificates

5.1.4 PROJECT MANAGEMENT AND OVERSIGHT

In order to properly manage and oversee the tasks within the PWS, specific expertise and experience in program management and agile development related to each of the following sectors is required: housing finance and mortgage industry, Federal credit programs, and Veteran benefit program (or other Government benefit programs). Personnel shall have the requisite skills, experience, and certifications sufficient to perform the Contractor’s obligations under this PWS.

It is the responsibility of the Contractor to provide contractor support personnel and subcontractors who have the required educational background, experience, security clearance, and access authorization or combination thereof to meet the labor category descriptions under this TO for the required PWS tasks.

The Contractor shall not presume that the Government or its stakeholders will furnish any extensive training on the Agency, the VA Home Loan Program (LGY) business line, or the housing/mortgage markets, Federal credit programs, or governmental benefits programs.

5.2 LGY OPERATIONS

In addition to the key personnel identified in Section 5.1.6, the Contractor shall provide Scaled Agile System Teams to facilitate building, testing, operating, and certifying new and existing applications in the LGY Product Line. In addition, the Contractor shall establish a Help Desk to render end-user support in alignment with the VA PLM Playbook and the applicable working principles as outlined in Section 5.0.

5.2.1 SYSTEM TEAM (FFP)

The Contractor shall provide System Teams to perform LGY operational activities as defined below. Historically, System Teams have ranged from 3 to 5 members. The Contractor shall provide one System Team as part of the base requirement. It is anticipated that additional System Teams will be required throughout the 12-months. Additional System Teams may be added throughout the period of performance at the Government’s discretion per Optional Task 1 at Section 5.2.1.1. Each System Team shall be comprised of the appropriate distribution of cross functional roles with the requisite mix of labor categories, experience, skills and expertise to execute operations activities across the LGY product line. Table 2 below depicts labor categories utilized to establish estimating/pricing for Task Order formation; however, the Contractor may substitute any labor categories cited in the Contractor’s GSA Federal Supply Schedule Contract GS-35F-540GA necessary to accomplish the scope of an individual System Team (for example, the requirements of a given System Team may require a Security Analyst).

The Contractor shall coordinate with the VA Operations manager on an ongoing basis to establish the necessary taskings and associated deliverables for each System Team over a specified period of time. The Contractor shall invoice monthly based on the successful execution of two-week iterations of agreed-to operational activities by each System Team.

System Team Roles

· Scrum master can lead teams (3-5 FTE) of multiple skills and varying experiences

· Scrum master removes blockers and has experience in risk management and ROAM

· Certifications: Scrum Master certification

· Minimum 3 years leading DevSecOps teams

· Deep understanding of the DevSecOps concepts and has proven track record of leading continuous integration and continuous deployment for multiple technology stacks on Amazon Web Services (AWS).

· Able to come up with metrics to measure DevSecOps maturity and automate the collection of the same

· Deep expertise with the DevSecOps toolchain in alignment with Attachment C

· Certifications: AWS Solutions Architect (Professional) or DevSecOps Engineer (Professional)

Manipulation Language (DMLs) and tune for performance.

· Ability to learn the administrative needs for any new COTS product that is purchased.

· Possess deep expertise in scripting languages like Bash, Python and Groovy and are very skilled in troubleshooting deployment issues on AWS.

· Have minimum 3 years of experience managing resources on AWS.

· Possess deep expertise in many tools from the DevSecOps tool chain in alignment with Attachment C

· Working knowledge of fundamental Linux systems administration.

· Working knowledge of fundamental Windows Systems administration.

· Certifications: AWS Solutions Architect (Associate) or Developer (Associate)

Table 2: Roles – System Teams

System Team Tasks The Contractor shall:

1. Incorporate a Configuration Management plan into the development methodology in all LGY environments.

2. Automate all phases of software delivery via an instance of a CI/CD pipeline derived from an enterprise pipeline framework. The phases shall incorporate at a minimum:

a. Automated Unit Testing

b. Automated Builds

c. Automated Functional Testing

d. Support functional and regression testing, including test data conditioning

e. Automated Performance Testing f.

g. Automated Resiliency Testing

h. Automated 508 Compliance Testing

i. Automated Static and Dynamic Security Testing

j. Vector Penetration (Pen-Tests)

k. Web Accessibility (WASA) scans in compliance with top OWASP

l. Automated zero downtime deployments

m. Automated rollback

n. Automated deployment validation

3. Develop the CI/CD to support multiple technology stacks including (not limited to) Java, JavaScript frameworks, Sales Force, SQL, Python.

4. Develop the CI/CD to follow the quality controls set by the Enterprise for breaking builds.

5. Develop the CI/CD to ensure that the application proactively meets the security standards set by the Enterprise.

6. Develop the CI/CD to following Infrastructure as Code principles and ensure that all physical resources adhere to cloud compliance standards set by the Enterprise.

7. Operate using Monitoring as Code principles and ensure that observability of the application across all layers (infrastructure, OS, application etc.) is baked into the provisioning and deployment.

8. Collaborate with delivery teams to implement industry standards and best practices for feature toggles.

9. Capture DevSecOps metrics from the CI/CD pipeline specific to application to demonstrate compliance along with performance metrics.

10. Implement application specific DevSecOps dashboards that enable visualization of the metrics captured by the pipeline.

11. Enable the application delivery teams to trigger an automated production release by automating the change approval process.

12. Partner with the Product Line Team to create a DevSecOps roadmap for applications to achieve the maturity goals set for the organization by The Product Line.

13. Maintain Expertise in the DevSecOps tool chain (Example: Jenkins, Circle CI, GitHub, Nexus, Artifactory, Docker, Kubernetes, Sonar, Maven, Node package manager, Cloud Formation Templates, Terraform, Elastic Stack, App Dynamics)

14. Facilitate migration of DevSecOps functions from one tool to another (Ex. From Rational to another ALM tool)

15. Create and maintain multiple environments in the Amazon Web Services (AWS) Government Cloud, including but not limited to Dev (main line), Dev (point releases), Test (main line), Test (point releases), Partner Integration, Performance Testing, SQA, Staging, and Production.

a. Proactively apply OS and application patches.

b. Proactively monitor certificate expiration dates (and renew / update certificates accordingly).

c. Proactively monitor middleware / COTS / open source software releases and work with the ART to schedule required upgrades.

16. Provide database administration, which includes:

a. Installing and configuring database products and/or creating and configuring data- related AWS services.

b. Peer reviewing the DDL and DML created by feature teams.

c. Governing all changes made to the databases.

d.

e. Maintaining knowledge of Database Migration Tools (Ex. Liquibase, Flyway) and configuring the same.

f. Maintaining knowledge of how data is queried from the databases and tuning / optimizing database performance.

17. Provide administration and support for middleware Open Source and COTS products (e.g. application server, web server, content server, etc.)

18. Provide operational support for the LGY platform components:

a. Troubleshoot tickets escalated by the Help Desk.

b. Troubleshoot and respond to [tickets generated by] automated alerts.

c. Be the first line of defense for failed pipelines (production and non-production)

d. Detect, diagnose, and resolve operational incidents within the SLA time frames found in section 5.3.2, Table 8.

e. Support VA Event Management processes for Critical and High Priority Incidents (including participation in SWATs and publication of After-Action Reports).

f. Maintain incident metrics and supplementary data to detect patterns and trends and facilitate rapid diagnosis of previously observed incidents.

19. Deploy and maintain automation to detect and generate alerts for lapses in system availability and material deviations from baseline system performance.

20. Provide continuous improvement of monitoring and alerting to detect new failure points.

21. Deploy and maintain dashboards depicting operational characteristics of the production environment, including but not limited to user experience (e.g. business transaction response times and error rates), availability, performance, utilization, and availability.

22. Proactively manage system performance and capacity for all LGY platform components:

a. Establish a baseline for system performance and resource utilization.

b. Establish reserve capacity targets to accommodate spikes in real-time demand and organic growth.

c. Work with the customer to identify “key” business transactions for monitoring / optimization purposes.

d. Formulate and execute strategies to proactively maintain desired reserve capacity. Conduct periodic reviews of current and forecast system performance and resource utilization. Work with other relevant Agile Teams to evaluate / anticipate potential increases in demand due to new or changed business functionality, business practices / user behavior, or eco-system changes. Define criteria for identifying and prioritizing candidates for performance optimization (such as frequency of use, long response times, and high-resource utilization).

23. Proactively identify significant upgrades to components of the as-is architecture, and emerging “best in breed” technologies apropos to the building, testing, deployment, monitoring, an operation of the system. Work with the Product Owner and other relevant Agile teams to incorporate (and prioritize) significant upgrades and evolutionary changes in the product backlog.

24. Develop Source Code and have it Checked-into VA approved repository

25. Define, Develop and Deliver Application Monitoring Plan, including dashboards

26. Define, develop and deliver Automated Testing Reports

27. Define, develop and deliver Monitoring and DevSecOps Dashboards.

28. Develop and deliver Productions Operations Manual (POM)

29. Execute daily batch job monitoring for high and critical jobs and follow the incident management process for failures.

30. Facilitate Assessment and Authorization activities, including:

a. Attaining and maintaining an ATO – see Authority to Operate below.

b.

c. Supporting auditing activities (e.g. OIG, FISMA, periodic Security Controls Assessments, etc.)

d. Ensuring compliance with applicable laws, regulations, and standards, including providing evidence of compliance upon request. (See Section 2.0 Applicable Documents)

Authority to Operate (ATO) The ATO is granted based on the satisfactory evaluation of numerous required documents; demonstrable compliance with relevant laws, regulations and guidelines; demonstrable adherence to VA policies and procedures; and documented, consistent, and timely remediation of scan vulnerabilities and audit findings.

Required documents are uploaded to a VA-provided tool (eMASS). Vulnerability remediation status and tracking is performed using a VA-provided tool (ICAMP).

An ATO can be granted for a specific term. A “full ATO” is typically granted for a period of one to three years. A “conditional ATO” (ATOC) is typically granted for a term of four months.

An ATO can cover multiple applications operating with the same accreditation boundary. There are currently three distinct (full) ATO’s for applications in the LGY Product Line.

The scope of this work task includes:

· Continued renewal of the three existing LGY Product Line application ATOs; modified as necessary to accommodate material changes to application software, infrastructure, or new requirements, on an ongoing basis.

· Consolidation of existing ATO’s as LGY Product Line applications are migrated to a common accreditation boundary.

· Attainment of ATO coverage for additional LGY Product Line applications as the Product Line expands.

The Contractor shall:

1. Provide eMASS support, applicable documentation, and coordinate with data center partners to ensure consistency with all VA’s ATO requirements for certification to ensure the LGY Product Line meets VA’s information security policies and standards to ensure the successful completion of the Assessment and Authorization (A&A) process and obtain an ATO.

2. Support Field Security Services Information Security Officers (ISOs) and Office of Cyber Security (OCS) Security Control Assessment (SCA) team for assessment requirements as detailed in VA Directive and Handbook 6500 Information Security Program, VA Handbook 6500.3 Certification and Accreditation of VA Information Systems.

3. Conduct cybersecurity software code quality testing and validation of all software code and provide certified scan reports validating the required code quality to the extent possible.

4. Conduct and participate in vulnerability scans and tests or best practice quality checks or reviews as detailed in National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53 Rev 4 Recommended Security Controls for Federal Information Systems and Organizations, if/when requested by the COR. Security scanning shall be 5.

performed by multiple methods and is done multiple times throughout the course of a project with methods such as infiltration testing (WASA, Penetration Tests), code analysis tools (Fortify), etc.

6. Remediate critical and high vulnerabilities identified in government scans, quality checks or reviews / audits within required time frames based on Severity (Critical=30 days, High=60 days, Medium=90 days).

7. Create Plan of Actions and Milestones (POAM) for any finding or vulnerability that cannot be addressed or remediated within required time frames based on Severity.

8. Provide vulnerability scanning reports and assessments as detailed in NIST SP 800-30 Rev 1 Guide for Conducting Risk Assessments.

9. Identify, document, review, and maintain the A&A Artifacts as needed to support an ATO request in accordance with VA policy and Federal Law and guidelines, as detailed in NIST SP 800-37 Rev 1 Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach. Additionally, the Contractor shall update any aspect (e.g., documentation, code, etc.) of the development based on comments from the A&A review process conducted A&A Artifacts are called out in the list of System Team Deliverables (below).

Key Performance…