VATAS Performance Work Statement 1-11-24.pdf

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Office of Finance Financial Services Center

VA Time and Attendance System Operations and Maintenance

Date: December 13, 2023

VA-24-00014040

Task Order PWS Version Number: 0.1

VATAS Operations and Maintenance

CONTENTS

1.0 BACKGROUND

2.0 APPLICABLE DOCUMENTS

3.0 SCOPE OF WORK

3.1 ORDER TYPE

4.0 PERFORMANCE DETAILS

4.1 PERFORMANCE PERIOD

4.2 PLACE OF PERFORMANCE

4.3 TRAVEL

5.0 SPECIFIC TASKS AND DELIVERABLES

5.1 PROJECT MANAGEMENT

5.1.1 CONTRACTOR PROJECT MANAGEMENT PLAN

5.1.2 TECHNICAL KICKOFF MEETING

5.1.3 PROJECT COMMUNICATION PLAN

5.1.4 RISK MANAGEMENT PLAN

5.1.5 QUALITY ASSURANCE PLAN

5.1.6 PROJECT STATUS MEETINGS

5.1.7 PROGRAM MANAGEMENT REVIEWS

5.1.8 VATAS INTEGRATED PRODUCT TEAM SUPPORT

5.2 OPERATIONS AND MAINTENANCE (O&M)

5.2.1 O&M PLANNING AND REPORTING

5.2.2 CONFIGURATION MANAGEMENT

5.2.3 SYSTEM ADMINISTRATION

5.2.4 APPLICATION ADMINISTRATION

5.2.5 DATABASE ADMINISTRATION

5.2.6 NETWORK ADMINISTRATION

5.2.7 PERFORMANCE MANAGEMENT

5.2.8 APPLICATION ARCHITECTURE

5.2.9 VATAS SLA REQUIREMENTS

5.3 INCIDENT MANAGEMENT

5.3.1 DISASTER RECOVERY (DR) AND CONTINUITY OF OPERATIONS

5.4 VATAS ENHANCEMENTS and DEFECT REMEDIATION

5.4.1 SOFTWARE ENHANCEMENT TESTING

5.4.2 USER ACCEPTANCE TESTING (UAT)

5.5 VATAS AUTHORITY TO OPERATE (ATO)

5.6 TIER 2 and TIEr 3 help desk support

5.7 Annual Software License Renewals

5.8 ADDITIONAL LICENSE Quantities (OPTIONAL TASK)

5.9 OPTION PERIOD ONE

5.10 OPTION PERIOD TWO

5.11 OPTION PERIOD THREE

5.12 OPTION PERIOD FOUR

5.13 TRANSITION OUT (OPTIONAL TASK)

6.0 GENERAL REQUIREMENTS

6.1 ENTERPRISE AND IT FRAMEWORK

6.1.1 VA TECHNICAL REFERENCE MODEL

6.1.2 FEDERAL IDENTITY, CREDENTIAL, AND ACCESS MANAGEMENT

(FICAM)

6.1.3 INTERNET PROTOCOL VERSION 6 (IPV6)

6.1.4 TRUSTED INTERNET CONNECTION (TIC)

6.1.5 STANDARD COMPUTER CONFIGURATION

6.1.6 VETERAN FOCUSED INTEGRATION PROCESS (VIP) AND PRODUCT

LINE MANAGEMENT (PLM)

6.1.7 PROCESS ASSET LIBRARY (PAL)

6.1.8 AUTHORITATIVE DATA SOURCES

6.1.9 SOCIAL SECURITY NUMBER (SSN) REDUCTION

6.1.10 SOFTWARE AND LICENSING REQUIREMENTS

6.2 SECURITY AND PRIVACY REQUIREMENTS

6.2.1 POSITION/TASK RISK DESIGNATION LEVEL(S)

6.2.2 CONTRACTOR PERSONNEL SECURITY REQUIREMENTS

6.3 METHOD AND DISTRIBUTION OF DELIVERABLES

6.4 PERFORMANCE METRICS

6.5 FACILITY/RESOURCE PROVISIONS

6.6 GOVERNMENT FURNISHED PROPERTY

6.7 SHIPMENT OF HARDWARE OR EQUIPMENT

7.0 ADDENDUM A – ADDITIONAL VA REQUIREMENTS, CONSOLIDATED

8.0 ADDENDUM B – VA INFORMATION AND INFORMATION SYSTEM

SECURITY/PRIVACY LANGUAGE

9.0 ATTACHMENTS

9.1 Attachment 1:

9.2 Attachment 2

1.0 BACKGROUND

The Department of Veterans Affairs (VA) Financial Services Center (FSC) provides a wide range of accounting, financial, and administrative services to VA and other government agencies. Enterprise-wide time and attendance reporting that supports payroll and personnel benefits for approximately 600,000 Title 5 and Title 38 VA user profiles is among the primary financial services managed by the FSC.

The current Veterans Affairs Time and Attendance System (VATAS) operates on the

United Kronos Group (UKG) application of GovTA version ukg-govta-1.3.9.

Supplemental enhancements are also made on Lentech’s application of Automation

Station version automationStation_v554. “VATAS” is inclusive of both GovTA and

Automation Station. The scope of work includes web application deployment, administration, maintenance, training, help-desk, and capability enhancements. The

VATAS solution is currently hosted in the VA Enterprise Cloud (VAEC).

Time and attendance functions for all VA employees are now managed in VATAS.

VATAS is a one-way batch interface with HRSmart, Human Resources Payroll Application Services (HRPAS) and Defense Finance and Accounting Service (DFAS) Defense Civilian Pay System (DCPS). VATAS performs these specific functions:

• Creates new employee profiles, updates and edits current employee profiles.

• Configures employee groupings, including duty stations and time and leave (T&L) groups, configures tours of duty.

• Processes employee leave requests, overtime/compensation time requests, and environmental differential request.

• Tracks leave balances.

• Processes timesheets for current pay periods and corrected timesheets for prior pay periods.

• Validates entered timesheets information against VA business rules.

• Provides exception reports to identify data anomalies and provides standard reports to support management analysis.

• Transmits timesheet information via the Source Data Automation (SDA) to

DCPS.

• Imports HRSMART data such as personnel transactions, leave and pay entitlements.

• HRPAS imports leave balances file and leave expiration.

• Configures holidays, tours of duty, and duty stations, leave and pay entitlements and Time and Leave groups. Table maintenance.

The VATAS/HRSmart and VATAS/DCPS interfaces are governed by Interconnection Security Agreements (ISA) between VA and the incumbent Contractor, and VA and DFAS, respectively. The ISA specifies the technical and security requirements as well as the purpose, methodology, and approvals for the interconnection. The ISA also identifies the basic components and the methods and levels of interconnectivity. The sensitivity categorization is High for the data exchanged through the VATAS/HRSmart interface, and High for the VATAS/DCPS interface. The Contractor maintains these documents and provides upon request.

HRSmart is an automated Human Resources (HR) application that processes personnel actions, benefits, entitlements, timesheet profile data, and training data. HRSmart provides HR and payroll staff direct access to review and update employee payroll related data. The VATAS/HRSmart interface utilizes a one-way, Secure File Transfer Protocol (SFTP) from HRSmart to VATAS. HRSmart is under the direction of Center for Enterprise Human Resource Information Services (CEHRIS).

HRPAS is an automated HR application that transmits duty station, leave import and leave expiration import from HRPAS to VATAS. HRPAS is managed by Austin Information Technology Center (AITC) under CEHRIS.

DCPS is the DFAS payroll system used by the Department of Defense and other government agencies (including VA). The system maintains pay and leave entitlement records, deductions and withholdings, and time and attendance data. The VATAS/DCPS interface utilizes a one-way, SFTP from VATAS to DCPS via a standard file format, referred to as the Systems Data Automation (SDA) file. The SDA file contains time and attendance data. Based on the SDA file data, DCPS creates individual payroll transactions that are forwarded to the U.S. Treasury for check or electronic funds transfer payments to VA employees. Connection is needed to Defense Information Systems Agency (DISA) to pass information through to DCPS.

For the purposes of this contract, “VA” is defined as the Contracting Officer’s Representative (COR), Product Management Office (PMO) Project Manager, Financial Payroll Service (FPS) Business representative, and other additional VA stakeholders as required.

The Authority to Operate (ATO) is titled, “VA Time and Attendance System – Cloud (VATAS)” renewed on an annual basis In the March timeframe.

There are multiple environments that will be supported under O&M for VATAS Software.

For the purpose of the PWS, “Environments” refer to all of the following environments:

Sandbox, Test, Pre-Production, Production and Development.

2.0 APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. US Code: Title 05: Part III: Subpart A: Chapter 21

2. US Code: Title 38: Chapter 43

3. Software Engineering Institute: Secure Coding Standards

4. VA Handbook 5007: Pay Administration

5. VA Handbook 5011: Hours of Duty and Leave

6. VA Enterprise Cloud Technical Reference Guide, Version 1.3 July 2018

7. “Veteran Focused Integration Process Guide 1.0”, December 2015, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

8. “VIP Release Process Guide”, Version 1.0, December 2015, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4411

9. POLARIS User Guide”, Version 1.2, February 2016, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4412

10. DCPS SDA and T&A Specifications, https://dfas4dod.dfas.mil/systems/dcps/consolid/dcpsmanuals.htm

11. Attachment A: Defect and Enhancement List

12. Attachment B: VATAS Backlog in Progress BRD

13. Attachment C: VATAS Design

14. Attachment D: VATAS Internal/External Interface

15. Attachment 1: VA Authority to Operate Requirements

16. Attachment 2: Process Flow: ATO Issuance Process

17. 44 U.S.C. § 3541-3549, “Federal Information Security Management Act

(FISMA) of 2002”

18. “Federal Information Security Modernization Act of 2014”

19. Federal Information Processing Standards (FIPS) Publication 140-2, “Security Requirements for Cryptographic Modules”

20. FIPS Pub 199. “Standards for Security Categorization of Federal Information and Information Systems,” February 2004

21. FIPS Pub 200, “Minimum Security Requirements for Federal Information and

Information Systems,” March 2006

22. FIPS Pub 201-2, “Personal Identity Verification of Federal Employees and

Contractors,” August 2013

23. 10 U.S.C. § 2224, "Defense Information Assurance Program"

24. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

25. Public Law 109-461, Veterans Benefits, Health Care, and Information

Technology Act of 2006, Title IX, Information Security Matters

26. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”

27. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, https://www.va.gov/vapubs/index.cfm

28. VA Handbook 0710, “Personnel Security and Suitability Program,” May 2, 2016, https://www.va.gov/vapubs/index.cfm

29. VA Directive and Handbook 6102, “Internet/Intranet Services,” August 5,

30. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and Guidelines,” January 18, 2017

31. Office of Management and Budget (OMB) Circular A-130, “Managing Federal

Information as a Strategic Resource,” July 28, 2016 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4411 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4412 https://dfas4dod.dfas.mil/systems/dcps/consolid/dcpsmanuals.htm https://www.va.gov/vapubs/index.cfm https://www.va.gov/vapubs/index.cfm http://www.va.gov/vapubs http://www.va.gov/vapubs

32. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed Services (CHAMPUS)”

33. NIST SP 800-66 Rev. 1, “An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule,” October 2008

34. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended, January 18, 2017

35. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

36. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021

37. VA Handbook 6500, “Risk Management Framework for VA Information

Systems VA Information Security Program,” February 24, 2021

38. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI),” March 12, 2019

39. VA Handbook 6500.5, “Incorporating Security and Privacy into the System Development Lifecycle,” March 22, 2010

40. VA Handbook 6500.6, “Contract Security,” March 12, 2010

41. VA Handbook 6500.8, “Information System Contingency Planning,” April 6,

42. VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018

43. VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017

44. OIT Process Asset Library (PAL), https://www.va.gov/process/ . Reference

Process Maps at https://www.va.gov/process/maps.asp and Artifact templates at https://www.va.gov/process/artifacts.asp

45. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

46. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014

47. VA Handbook 6508.1, “Procedures for Privacy Threshold Analysis and Privacy Impact Assessment,” July 30, 2015

48. VA Handbook 6510, “VA Identity and Access Management,” January 15,

49. VA Directive and Handbook 6513, “Secure External Connections,” October 12, 2017

50. VA Directive 6300, “Records and Information Management,” September 21,

51. VA Handbook, 6300.1, “Records Management Procedures,“ March 24, 2010

52. NIST SP 800-37 Rev 2, “Risk Management Framework for Information

Systems and Organizations: A System Life Cycle Approach for Security and Privacy,” December 2018

53. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020)

54. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015 https://www.va.gov/process/ https://www.va.gov/process/maps.asp https://www.va.gov/process/artifacts.asp https://www.va.gov/trm/TRMHomePage.aspx

55. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-

12) Program,” March 24, 2014

56. OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005

57. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019

58. OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008

59. Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance, December 2, 2011, (NOTE: Part A of the FICAM Roadmap and Implementation Guidance, v2.0, was replaced in 2015 with an updated Architecture (https://arch.idmanagement.gov/#what-is-the-ficam-architecture)

60. NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access,“ June 2018

61. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, “Digital Identity Guidelines,” updated March 02, 2020

62. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014

63. NIST SP 800-164, “Guidelines on Hardware-Rooted Security in Mobile

Devices (Draft),” October 2012

64. Draft National Institute of Standards and Technology Interagency Report

(NISTIR) 7981, “Mobile, PIV, and Authentication,” March 2014

65. VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland

Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

66. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

67. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

68. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

69. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019

70. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008

71. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (Public Law 110–140), December 19, 2007

72. Section 104 of the Energy Policy Act of 2005, (Public Law 109–58), August 8, 2005

73. Executive Order 13834, “Efficient Federal Operations,” dated May 17, 2018

74. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August

2, 2001

75. VA Directive 0058, “VA Green Purchasing Program,” July 19, 2013 https://arch.idmanagement.gov/#what-is-the-ficam-architecture https://arch.idmanagement.gov/#what-is-the-ficam-architecture https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514 https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896 https://www.cisa.gov/publication/tic-30-core-guidance-documents

76. VA Handbook 0058, “VA Green Purchasing Program,” July 19, 2013

77. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote

Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

78. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

79. “Veteran Focused Integration Process (VIP) Guide 4.0,” January 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

80. VA Memorandum “Proper Use of Email and Other Messaging Services,”

January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

81. “DevSecOps Product Line Management Playbook” version 2.0, May 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

82. NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020

83. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol

Version 6 (IPv6),” November 19, 2020

84. Social Security Number (SSN) Fraud Prevention Act of 2017

85. Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23,

3.0 SCOPE OF WORK

The Contractor shall provide services to include architecture and design, planning, software development, testing, implementation, operations and maintenance licensing to support the ongoing sustainment of VATAS. The Contractor shall be responsible for managing VATAS in the VA Enterprise Cloud (VAEC) and conform to all VAEC Policies and recommendations.

3.1 ORDER TYPE

The base effort shall be proposed on a hybrid Firm Fixed Price (FFP) basis and Time and Materials (T&M) basis. PWS tasks 5.1-5.3, and 5.5-5.7 shall be performed on a FFP basis. PWS task 5.4 shall be performed on a T&M basis. There are optional FFP tasks for additional licenses and transition-out activities and a Time and Materials (T&M) task for additional software development.

4.0 PERFORMANCE DETAILS

4.1 PERFORMANCE PERIOD

The period of performance (PoP) shall be 12 months from date of award, with four (4) 12-month options periods. Optional Tasks include additional license procurement, software development and transition out activities.The overall PoP of the TO, including the exercise of any optional tasks, shall not exceed 60-months.

https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371 https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

4.2 PLACE OF PERFORMANCE

Tasks under this PWS shall be performed at Contractor or remote facilities within the Continental United States (CONUS). The Contractor shall identify the Contractor’s place of performance in their proposal submission.

4.3 TRAVEL

The Government anticipates travel under this effort to attend the Contract kick-off meeting in the base period and an annual program status meeting each option period thereafter. Travel for performance of this TO shall be included in the contract FFP. The location of the 1 trip expected in the base year and one trip expected in each option period is Austin, TX, and the expected duration for each trip is 1 day.

5.0 SPECIFIC TASKS AND DELIVERABLES

The Contractor shall perform the following:

5.1 PROJECT MANAGEMENT

5.1.1 CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, timeline and tools to be used in execution of this TO effort. The CPMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks and resource support. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPMP shall be concurred upon and updated monthly throughout the PoP.

Deliverable:

A. Contractor Project Management Plan

5.1.2 TECHNICAL KICKOFF MEETING

A technical kickoff meeting shall be held within 10 days after TO award. The Contractor shall coordinate the date, time, and location with the Contracting Officer (CO), as the Post-Award Conference Chairperson, the VA PM, as the Co-Chairperson, the Contract Specialist (CS), COR, and VA stakeholders. The Contractor shall provide a draft agenda to the CO and VA at least five (5) calendar days prior to the meeting. Upon Government approval of a final agenda, the Contractor shall distribute to all meeting attendees. During the kickoff-meeting, the Contractor shall present, for review and approval by the Government, the details of the intended approach, work plan, and project schedule for each effort via a Microsoft Office PowerPoint presentation. At the conclusion of the meeting, the Contractor shall update the presentation with a final slide entitled “Summary Report” which shall include notes on any major issues, agreements, or disagreements discussed during the kickoff meeting and the following statement “As the Post-Award Conference Chairperson, I have reviewed the entirety of this presentation and assert that it is an accurate representation and summary of the discussions held during the Technical Kickoff Meeting for the VATAS Operations & Maintenance (O&M) services.” The Contractor shall submit the final updated presentation to the CO for review and signature within three (3) calendar days after the meeting. The Contractor shall also work with the CS, the Government’s designated note taker, to prepare and distribute the meeting minutes of the kickoff meeting to the CO, COR and all attendees within three (3) calendar days after the meeting. The Contractor shall obtain concurrence from the CS on the content of the meeting minutes prior to distribution of the document.

5.1.3 PROJECT COMMUNICATION PLAN

The Contractor shall develop, maintain, and execute a Project Communication Plan (PCP). The PCP shall be a written document that describes when (i.e., frequency), where (i.e., medium) and how (i.e., method) the Contractor shall interact and communicate with VA stakeholders. The PCP shall identify the boundaries of their authority and name an alternate if that individual should not be available.

A. Project Communications Plan

5.1.4 RISK MANAGEMENT PLAN

The Contractor shall:

a. Develop, maintain, and implement a project Risk Management Plan (RMP). The

RMP shall identify knowable circumstances that may have a negative impact on the VATAS program, describe the potential impacts, and assert measures to either reduce/eliminate that potential or minimize the impact. The RMP shall include a risk register and depict how the Contractor will assist in risk identification, prioritization, planning, mitigation, and tracking.

b. Collaborate with project stakeholders to identify, prioritize, scope, bound, resource and assess courses of actions related to program risks.

c. The Contractor shall analyze and report all risk items and their disposition in the risk register as part of the RMP.

A. Risk Management Plan

5.1.5 QUALITY ASSURANCE PLAN

a. Develop a Quality Assurance (QA) Plan. The QA Plan shall identify the

Contractor’s IT quality control standards, goals and the verification and validation methods that will be used to measure achievement of the goals. The QA Plan shall be maintained and updated throughout the period of performance to remain current.

b. Implement quality standards governing program management, design, development, review, validation and administration in the production and execution of all system/software components and technical efforts.

A. Quality Assurance Plan

5.1.6 PROJECT STATUS MEETINGS

The Contractor shall conduct a weekly Project Status Meeting (PSM). This may be either by teleconference or meeting; attendees must, at a minimum, include VA representatives in order to review technical accomplishments, challenges and issues as well as a weekly Help Desk/VATAS Reports and Analysis meeting. During PSMs, the Contractor shall prepare, present, and discuss with the VA specific technical issues including, but not limited to, change meeting action items, deliverable status, configuration management update (to include sleep modes), VATAS Tier 2 Help Desk update, incident reporting, development (enhancements/defects) Integrated Master Schedule (IMS) update, and request status, issue/action Item status, schedule progress in the CPMP and other relevant concerns. Meetings shall be held as scheduled unless a schedule change is authorized by the VA. Meetings cannot be canceled without concurrence from VA. The Contractor shall provide meeting minutes to the VA within three (3) business days of each meeting.

5.1.7 PROGRAM MANAGEMENT REVIEWS

The Contractor shall conduct virtual Program Management Reviews (PMRs) on a quarterly basis, or as agreed to by both the VA and Contractor PM. One PMR will be conducted in person in Austin TX annually as agreed to by both the VA and Contractor PM. During PMRs, the Contractor shall present project deliverables, status and progress updates to the VA and system stakeholders. Furthermore, the Contractor shall present information on any activities that will impact VATAS. Examples of these activities are system upgrades or updates, system patches, and hardware replacements or upgrades. The Contractor shall present a PMR Brief discussing all of the above information as well as provide a copy electronically to the VA within two (2) business days of completion of the PMR.

A. PMR Brief

5.1.8 VATAS INTEGRATED PRODUCT TEAM SUPPORT

The Contractor shall participate in the Government-led VATAS Integrated Product Team (IPT). This includes attendance at the weekly IPT meeting and the weekly Risk Meeting.

The purpose of the IPT is to review key project activities and topics, summarize their effects, and advise the Government PMs on potential future project courses of action.

The IPT will be composed of VATAS stakeholders including VA representatives. The Contractor shall provide technical support to the VATAS IPT in the form of technical discussions and presentations related to VATAS engineering efforts. Engineering efforts include project accomplishments, potential lessons learned, risk items and mitigation efforts, technical assessments, technical planning, and quality improvement initiatives. IPT meetings may be supported via teleconferencing or other distributed collaboration methods. VATAS IPT meetings are approximately 1 hour in duration and conducted on a weekly basis.

5.2 OPERATIONS AND MAINTENANCE (O&M)

The Contractor shall provide O&M for the VATAS system.

5.2.1 O&M PLANNING AND REPORTING

a. Review and update the existing O&M Plan. The Contractor shall update the

O&M Plan to include the concepts, methods and resources that shall be utilized to provide the required O&M support for VATAS.

b. Perform VATAS O&M activities identified below in accordance with the approved

O&M Plan.

c. Provide a summary of monthly O&M activities and statistics as part of the CPMP.

d. Provide license utilization summary counts for UKG software, third party software, and any Cloud provider software solutions utilized for VATAS sustainment in a quarterly License Capacity Report.

e. Provide sustainment plan that includes but is not limited to VAEC Cloud, GovTA version release updates, Network / Server release updates, and all associated version / release upgrades.

A. Updated O&M Plan

B. License Capacity Report

C. Sustainment Plan

5.2.2 CONFIGURATION MANAGEMENT

a. Review and update the existing Project Configuration Management Plan (CMP).

The CMP shall be reviewed quarterly by VA representatives with changes incorporated upon COR approval. The CMP is a document that specifies the

Change Control Process and the lifecycle management of Configuration Items

(CI). Change Control consists of the formal procedures used to ensure that changes are executed in a controlled and coordinated manner. CIs include code modules, architecture models, project documentation, technical models, and other deliverables referenced in this PWS.

b. Review, update and maintain a project Change Control Process (CCP) and document this business process in the CMP. The CCP shall be inclusive of a

FSC Change Control Board (CCB). FSC VATAS participation at the FSC CCB shall include the PM, and/or their delegate.

c. Establish, coordinate and provide technical support to the FSC CCB. The

Contractor shall support the FSC CCB by attending weekly CCB meetings, capturing engineering change proposals, and contributing to program discussions. The Contractor shall document and manage the tracking and status of engineering change proposals (ECPs) and provide an information summary in the CPMP.

d. Update the status of pending ECPs tracked in the FSC Help Desk system for submitted, approved, denied or pending ECPs.

e. Provide CI’s for Configuration Management (CM) system.

f. Review and update build processes and procedures that follow a disciplined and controlled build methodology to support project releases. The Contractor shall review and update the build process that provides for the re-creation of any deployment or engineering system application baseline at any time. The

Contractor shall apply the CM process to track and manage all software builds, release candidates, and deployable releases. The Contractor shall be expected to participate in all pre-deployment meetings and post-mortems for deployment that are rolled back or are deployed with issues. The Contractor shall update the

CM system for all new releases.

g. Ensure that no production activity commences without prior approval from the

FSC CCB and Enterprise CCB.

h. For releases, update the training environment at the same time as production.

i. Resolve bugs and defects by proactively monitoring VATAS; implement continuous communication with VA, Payroll HR Services Division (PHRSD)

VATAS Reports and Analysis (VATAS R&A).

j. Tune VATAS for optimal reliability by monitoring support and application logs and providing recommendations for handling vendor-reported criticality and other known threats.

Deliverables:

A. Configuration Management Plan Update

5.2.3 SYSTEM ADMINISTRATION

The Contractor shall perform the processes related to implementation and sustainment of VATAS hardware, software, and operating systems, particularly changes to configuration that are released to the environment. The Contractor shall:

a. Update the System Administration Guide for changes

b. Create user authorizations and profiles

c. Notify the COR of scheduled system outages/preventative maintenance 30 days prior to the outage and/or maintenance activities

d. Provide power monitoring (UPS and generator) for Contractor hosted equipment

e. Monitor and maintain system logs

f. Perform secure file transfers

g. Process backups and restores

h. Ensure VATAS related hardware and software are running at an optimal level

i. Address any issues related to the VATAS hardware and software

5.2.4 APPLICATION ADMINISTRATION

The Contractor shall monitor and inform the VA the status of the UKG GovTA license subscriptions and Lentech Automation Station to ensure that additional licenses, renewals, version upgrades, and COTS patches/upgrades are implemented as required.

5.2.4.1 VATAS Application Administration

The Contractor shall provide ongoing application administration support including:

a. Establishing backup schedules

b. Establishing monitoring requirements and parameters

c. Implementing software upgrades

d. Configuring and installing software patches / version updates, scripts and parameter settings

e. Tuning VATAS to resolve application performance issues

f. Updating Application Data Interface Diagrams

g. Monitoring application logs

h. Ensuring that all VATAS data is retained, accessible and editable throughout the period of performance of the TO.

i. Complete restoration of row reduction maintenance after-hours 5 nights a week, Monday - Friday excluding federal holidays. Row reduction deletions, restorations and outages includes customized analysis and reporting, requiring flagging/unflagging of specific groups and/or individuals in production, to include any non-production environments (example, pre-production, training, test etc.)

as required. Specifically, this entails:

i. Placing all applicable application servers into maintenance mode

ii. Ensuring no GovTA jobs are running that would negatively be impacted if applications are stopped

iii. Disabling application servers

iv. Running Row Reduction restore/delete operations

v. Restarting the application servers

vi. Moving the servers out of maintenance mode

vii. General monitoring for successful completion and preventative system/data compromise

viii. The contractor will complete an automated restoration when requested by the VA via the VA FSC Ticketing Portal (typically when restoration requires 101+ employees at one time).

A. Updated Application Data Interface Diagram

5.2.5 DATABASE ADMINISTRATION

The Contractor shall provide ongoing design, security, administration, and problem resolution for all database functionality. The Contractor shall:

a. Allocate system storage for the database

b. Control and monitor user access to the Oracle database

c. Enroll users (including VA Admins) and maintain connection to service layer access security

d. Implement and maintain operational scripts

e. Implement database security and upgrades/patches

f. Maintain operational database management tools

g. Maintain record of database operational event logs

h. Monitor and optimize database performance

i. Provide operational database schedules

Specifically, the Contractor shall provide system-level database administration including software installation and maintenance, backup and recovery, and writing and maintaining scripts to automate tasks in support of customer database environments. The Contractor shall perform the following tasks:

a. Provide database storage management and develop, maintain, and track database storage for reporting and trend analysis

b. Manage database communication software configuration, installation, and maintenance

c. Open, track, and manage to resolution all database problems and incidents

d. Generate automated security notifications for security exceptions per

Government security policy and procedures

e. Monitor database(s) including, but not limited to, review of audit logs, alert logs, trace files, logs, etc., and generate automatic trouble tickets for problems

f. Provide support to application database administrators for database performance tuning, nonstandard backups, and non-RDBMS relational database components

g. Implement and administer database management tools across all database instances including ensuring the availability of performance metrics and historical data for trending and reporting over a minimum of 12 months

h. Define and execute database performance and tuning scripts and keep database running at optimal performance for the agency’s workload

i. Maintain consistency of non-sizing and non-platform specific database parameters and system settings across all like instances according to established software development life cycle (SDLC)

j. Maintain documentation for all database instance parameters and system settings

k. Execute all database system-level changes (initialization parameters)

l. Execute database creation, configuration, and refresh

m. Perform database patch activities, to include the following:

i. Patch database software as needed according to established SDLC

ii. Execute security patches according to Government policy

iii. Execute out of band patches as needed

n. Perform database upgrades, to include the following:

i. Perform assessments in the test environment for database upgrades and present an upgrade plan for approval by the Government

ii. Apply all upgrades in development and test environments prior to implementing into production

iii. Perform major upgrades in accordance with industry standards

iv. Perform minor upgrades in accordance with industry standards

o. Perform database backup and recovery activities (activities performed in recovery), to include the following:

i. Save selected database archive logs off to a secondary storage medium to provide alternate Recovery Point Objective (RPO) capability to support Business Continuity goals

ii. Meet the performance targets for data backup and restoration requirements

iii. Design, document, and execute database backup in accordance with the Government’s policies and procedures outlined in the contingency and DR plans

iv. Automate maintenance operations, such as backups during off-hours or during maintenance windows

v. Perform database restores from export dumps or backups

5.2.6 NETWORK ADMINISTRATION

The Contractor shall maintain the VATAS network structure including:

a. Manage network setup and configuration

b. Monitor network and identify and work with VA to resolve issues as they occur.

c. Make network structure updates as required for network changes and connectivity issues.

d. Create and maintain updates to Network and Application Topology Diagram

(Physical Connection Service Layer) for VAEC.

1. Network and Application Topology Diagram (Physical Connection Service Layer)

5.2.7 PERFORMANCE MANAGEMENT

The Contractor shall ensure that the uptime requirements of the system are met, monitor services, and proactively respond to system demands

a. Update and maintain the VATAS Performance Management Plan

b. Collect system statistics and monitor system availability to ensure VATAS meets VA SLA requirements as defined in PWS section 5.2.9.

c. Isolate performance issues to the application

d. Develop and implement availability and performance improvements to meet

VA SLA requirements

e. Monitor application software performance

f. Monitor database server performance

g. Monitor hardware performance

h. Monitor operating system performance

i. Report incidents/problems for capacity or performance threshold events to VA

Stakeholders and include (FSCVATASCommunication@va.gov) within 1 hour of discovery.

j. Resolve capacity/performance issues and notify FPS Senior Management

(FSCPayrollServices@va.gov), FSC Director, IT Chief, VA PM, designated

VA representatives and COR of expected resolution timeframe.

k. Provide a Quarterly Solution Performance Report that summarizes solution availability, usage, events and incidents, improvement opportunities, risks and issues, status, action plans, and planned and actual resolution timelines.

l. Review all usage of cloud computing services provided by VAEC. The

Contractor shall submit and implement Quarterly Resource Utilization

Optimization Plans on how to best optimize the environment to reduce the costs associated with resource utilization (including but not limited to sleep schedule, budget, etc.).

m. Provide a breakdown of all costs by solution, environment, and utilization. The

Contractor shall report on utilization of each class of resource as a percentage of provisioned capacity in a Monthly Utilization Report. The

Contractor shall, as part of its Monthly Utilization Report, include the total infrastructure expenditure and total number of request services for Cloud

Resource Optimization.

n. Create and maintain a dashboard tool that is not limited to the display of timesheet status, licenses count and server health.

A. Quarterly Solution Performance Report

B. Quarterly Resource Utilization Optimization Plan

C. Monthly Utilization Report

D. Dashboard Tool mailto:FSCVATASCommunication@va.gov

5.2.7.1 VATAS PAY PERIOD AND REPORT PERFORMANCE

The production environment consists of six servers plus two reports servers. The production reports servers shall be used for storing archived data, pulling reports and data analysis. The production servers shall maintain the current pay period plus 39 pay periods (PP) that are actionable, correctible, and transmittable to DFAS. Eventually the threshold of 39 PP will ramp up to 65 PP plus current pay period as FSC purchases additional PP from DFAS. Data analytic software will be provided by VA. The reports servers have historical data to include the 39 PP plus current pay period; as adjustments, corrections, updates are made on the Production servers the reports servers shall mirror the Production data.

The Contractor shall ensure that the Production Servers:

a. Maintains the current threshold of 39 PP plus current pay period with the ability to ramp up to 65 PP plus current pay period.

b. Provides the capability to retrieve timesheets from the production reports servers.

c. Provides the capability to complete actions on all timesheets for 39 PP plus current pay period and beyond (once retrieved from reports servers).

d. Maintains all pay period timesheets on the reports server as deemed by the VA

5.2.8 APPLICATION ARCHITECTURE

The Contractor shall provide ongoing Application Architecture support. Application Architecture is the single point of responsibility for the application solution from a functional perspective. The Contractor shall be accountable for monitoring application capacity and scalability. The Contractor shall maintain the following application architecture technical documentation:

a. Application Data Interface Diagram

b. Network Topology Diagram (Physical Connection Service Layer).

c. System Profile

A. Application Data Interface Diagram

B. Network Topology Diagram (Physical Connection Service Layer).

C. System Profile

5.2.9 VATAS SLA REQUIREMENTS

The Contractor shall ensure the VATAS solution meets the following SLA requirements:

a. VATAS System Availability: The system shall be available at least 99.9 percent of the scheduled operational time. Operational time is defined as 24 hours per day, seven (7) days a week, 365 days per year, excluding scheduled maintenance outages. The Contractor shall inform the FPS Senior

Leadership (FSCPayrollServices@va.gov), FSC Director, IT Chief, and VA representatives of any downtimes for planned or unplanned maintenance to include technical refreshes, upgrades, patches, or security updates. The

Contractor shall ensure that all system maintenance updates, or new versions are implemented in such a way that each update or version in no way compromises current functionality. The Contractor shall schedule system maintenance outages between 8 p.m. and 5 a.m. Eastern Standard Time

(EST). Regular scheduled outages shall not occur more than once per week and shall be set up at least seven (7) days in advance for maintenance and/or system upgrades to the greatest extent practical unless deemed emergent due to System compromise or imminent failure. A system maintenance outage to perform a row reduction restoration will occur 5 nights a week, Monday - Friday excluding federal holidays in order to support required maintenance of VATAS timesheets records.

b. Average page response time for up to 100,000 concurrent users shall be no more than 3 seconds.

c. 99 percent successful export of SDA files to DCPS is required. Contractor shall collaborate with VA, DISA and/or DFAS to fix and resubmit all rejected

SDA files within three (3) hours of notification of rejection (or manually based on VA discretion).

d. Provide SLA dashboard within 30 days of award showing metrics for:

availability (ex. Application front end(s), database server(s) and instances, network availability, authentication failures, outages

(scheduled/unscheduled), time to first byte, time to last byte, page refresh time, concurrent user connections to application server, number of used licenses, failed connections to application and database servers, connection status to database server(s) from application server(s), load balancers, and to

VA’s Domain Name Servers(DNS).

e. SLA Report: quantity of VATAS or VATAS system (ex. OS, Load balancer, network, 3rd party application) tickets in process and completed, ticket response time highest and average, average ticket resolution time. Report shall be provided weekly.

i. IT Support tickets shall be entered into existing VA Service Now help desk ticketing system if:

1. There is a VA Wide VATAS Outage due to a VATAS specific issue, a ticket shall be entered.

2. The issue is outside of VATAS control but impacts VATAS, a ticket shall be entered to let the VA helpdesk be aware VATAS is impacted and possibly needs a Major Incident Management team to assist in resolving.

f. Provide notification via email to (FSCVATASCommunication@va.gov), with copy of Service Now ticket, within 30 minutes of unscheduled system outages to VA.

g. Provide notification via email (FSCVATASCommunication@va.gov), with update of the unscheduled outage Service Now ticket, identifying system availability being restored for FPS.

h. Provide after action report for all unscheduled downtimes NLT 24 hours after detection.

i. Provide notification via email, with copy of Service Now ticket, at least 7 calendar days prior to non-routine scheduled system outages and maintenance to VA for outage approval.

5.3 INCIDENT MANAGEMENT

The Contractor shall provide incident, issues, and problem management including all activities associated with restoring normal service operation as quickly as possible and minimizing the adverse impact on VA operations to ensure that the best possible levels of service quality and availability are maintained. Problem management shall also include minimizing the adverse impact of incidents and problems on the business that are caused by errors in the IT infrastructure and preventing the recurrence of incidents related to those errors. The Contractor shall develop, implement, and maintain a root cause analysis (RCA) document/process for each incident and perform the activities required to diagnose, analyze, recommend, and take corrective measures to prevent recurring problems and trends. Provide RCA Report NLT three (3) days after the incident and provide daily follow-up until issue has been fully resolved. Schedule a meeting with VA representatives after issue has been fully resolved. All incidents and issues shall be logged and tracked to completion.

The Contractor shall develop an Incident Response Plan.

The Contractor shall perform the following incident, issue, and problem management tasks:

a. Follow government incident and problem management policies and procedures.

b. Establish and maintain operations and service management quality assurance and control programs.

c. Coordinate user support activities with the PHRSD VATAS R&A.

d. Interface with various Government helpdesk personnel for incident and problem management and resolution activities (helpdesk coordination support)

e. Establish incident/problem classification by priority.

f. Establish and maintain incident/problem workflow, escalation, communication, and reporting processes.

g. Provide, configure, and operate an incident and problem management system that tracks incidents across all IT resources.

h. Use the Government approved incident and problem tracking system to allow for incident/problem monitoring and ad hoc reporting.

i. Manage the entire incident/problem lifecycle including detection, diagnosis, status reporting, repair, and recovery.

j. Ensure incident resolution activities conform to defined change control procedures.

k. Manage workflow of incidents including the involvement of third-party Contractors

(e.g., Contractors, public carriers, CSP, ISP, hardware, software, and network)

l. Coordinate and take ownership of problem resolution with the Government and third parties (e.g., ISP, hardware, software, and network)

m. Perform RCA and document the findings in the RCA Report

n. Maintain an incidents/issues log which includes root cause analysis (problem, impacts, resolution action plan), correction/mitigation actions and milestones, and status (actions pending, in-process, closed, mitigated)

o. Initiate and document problem resolution and mitigation actions through after-action reports to provide assurances that actions have been taken to prevent future reoccurrence.

p. Conduct proactive trend analysis to prioritize and identify recurring problems.

q. Report open incidents and issues.

r. Participate in problem review sessions and provide listing and status of problems categorized by problem impact as required.

s. Identify opportunities for improved operational performance and cost savings.

t. Perform incident analysis for problems within scope of control.

u. Support the Government contingency plans to assist in minimizing the adverse impact on business operations to ensure that the best possible levels of service quality and availability are maintained.

A. Incident Response Plan B. RCA Report

5.3.1 DISASTER RECOVERY (DR) AND CONTINUITY OF OPERATIONS

The Contractor shall provide DR and Backup of the VATAS solution in the VAEC environments. The Contractor shall ensure continuous operation of the VATAS solution in accordance with the SLA defined in PWS section 5.2.9.

2. Maintain a VAEC DR and Backup Plan for the VAEC VATAS solution that ensures no more than one (1) minute and twenty-seven (27) seconds of service disruption and is fully compatible with and leverages the VAEC CSP environment capabilities. The DR and Backup Plan shall include at a minimum:

i. Organizational preparedness including roles, responsibilities, and contact information.

ii. DR management and escalation processes including notification, declaration and testing guidelines, and notifications.

iii. DR Test Schedule.

b. Participate in DR test/exercises (scheduled and unscheduled simulations as well as real situations) and report the results in an After-Action Report.

c. Utilize VAEC General Support Services (GSS) when available and applicable in order to minimize cloud services costs and optimize operations.

The Contractor shall use native tools and capabilities of the VAEC environment.

d. Provide system details that include a detailed representation of key infrastructure and networking configurations and requirements.

e. Provide failover and failback procedures that include a step-by-step recovery and restoration process.

f. Collaborate in the design and implementation of a data backup solution and include the analytics and identification of data sizes of all systems such as databases and hosts, data retention, backup window/scheduling and archiving needs using results to create/update a design of a backup solution.

The Contractor shall provide backup and recovery of information stored by the VAEC VATAS solution to meet the related SLAs in PWS section 5.2.9 using native tools and…