Veterans Experience Services Eligibility and Enrollment - PWS Draft_Clean.docx

Veteran Experience Services Eligibility and Enrollment (VESEE)

VA-24-00101965

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Office of Information & Technology Product Engineering Services (PES) Veteran Experience Services (VES) Portfolio

Veteran Experience Services Eligibility and Enrollment (VESEE)

Date: August 23, 2024

VA-24-00101965

PWS Version Number: 1.0

Contents

BACKGROUND

The U.S. Department of Veterans Affairs (VA) continues its pursuit to make America’s Veterans a priority; to serve and honor the men and women who are America’s Veterans. VA is committed to five core values that define “who” we are and how we care for Veterans. The core values are Integrity, Commitment, Advocacy, Respect, and Excellence.

The VA is a sprawling, complex organization with thousands of products and systems that must work together to provide VA services. Most of these systems were built in isolation by different teams at different times. Systems have dozens of dependencies, are built in various tech stacks on separate infrastructure, use unique identifiers for transactions, and are subject to the inherent complexity of legislation and policy. The intricacies of this ecosystem are an obstacle to addressing Veteran, family member, and caregiver needs. The work within the PWS will aim to simplify this ecosystem where possible, address gaps, and architect services that will be resilient to technical and organizational change. The overarching goal of this work is to meet Veteran needs and improve outcomes, whether directly or indirectly.

The Eligibility and Enrollment Experience (EE) is a Product Line (PL) within the Veteran Experience Services (VES) Portfolio, Product Engineering Service Pillar (PES), Office of Information and Technology (OIT), the Department of Veterans Affairs (VA). This work focuses on the full end to end Eligibility and Enrollment experience of the Veteran, family member, caregiver, and our internal and external users.

We believe that Veterans, family members, and caregivers should be able to get the right benefit at the right time, no matter which channel they choose. Our mission is to become a federal leader in Customer Experience (CX) through our ability to anticipate our customers’ needs with measurement and respond to our customers’ problems with best-in-class product engineering. To be able to achieve both the vision, mission, and fulfill our commitment to the core values, we strive to ensure, Veterans share their information with VA once and update it when needed, we create a seamless experience for Veterans to get accurate, consistent, and timely information across channels, make it easier to discover and enroll in VA benefits, improve data collection process and analytics structure to understand gaps in the Veteran experience, and create operational processes that support our teams in effectively executing our work and sharing it with partners.

APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. 44 U.S.C. § 3541-3549, “Federal Information Security Management Act (FISMA) of 2002”

2. “Federal Information Security Modernization Act of 2014”

3. Federal Information Processing Standards (FIPS) Publication 140-2, “Security Requirements for Cryptographic Modules”

4. FIPS Pub 199. “Standards for Security Categorization of Federal Information and Information Systems,” February 2004

5. FIPS Pub 200, “Minimum Security Requirements for Federal Information and Information Systems,” March 2006

6. FIPS Pub 201-2, “Personal Identity Verification of Federal Employees and Contractors,” August 2013

7. 10 U.S.C. § 2224, "Defense Information Assurance Program"

8. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

9. Public Law 109-461, Veterans Benefits, Health Care, and Information Technology Act of 2006, Title IX, Information Security Matters

10. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”

11. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, https://www.va.gov/vapubs/index.cfm

12. VA Handbook 0710, “Personnel Security and Suitability Program,” May 2, 2016, https://www.va.gov/vapubs/index.cfm

13. VA Directive and Handbook 6102, “Internet/Intranet Services,” August 5, 2019

14. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and Guidelines,” January 18, 2017

15. Office of Management and Budget (OMB) Circular A-130, “Managing Federal Information as a Strategic Resource,” July 28, 2016

16. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed Services (CHAMPUS)”

17. NIST SP 800-66 Rev. 1, “An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule,” October 2008

18. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended, January 18, 2017

19. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

20. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021

21. VA Handbook 6500, “Risk Management Framework for VA Information Systems VA Information Security Program,” February 24, 2021

22. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI),” March 12, 2019

23. VA Handbook 6500.5, “Incorporating Security and Privacy into the System Development Lifecycle,” March 22, 2010

24. VA Handbook 6500.6, “Contract Security,” March 12, 2010

25. VA Handbook 6500.8, “Information System Contingency Planning,” April 6, 2011

26. VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018

27. VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017

28. OIT Process Asset Library (PAL), https://www.va.gov/process/ . Reference Process Maps at https://www.va.gov/process/maps.asp and Artifact templates at https://www.va.gov/process/artifacts.asp

29. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

30. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014

31. VA Handbook 6508.1, “Procedures for Privacy Threshold Analysis and Privacy Impact Assessment,” July 30, 2015

32. VA Handbook 6510, “VA Identity and Access Management,” January 15, 2016

33. VA Directive and Handbook 6513, “Secure External Connections,” October 12, 2017

34. VA Directive 6300, “Records and Information Management,” September 21, 2018

35. VA Handbook, 6300.1, “Records Management Procedures,“ March 24, 2010

36. NIST SP 800-37 Rev 2, “Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy,” December 2018

37. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020)

38. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015

39. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” March 24, 2014

40. OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005

41. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019

42. OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008

43. Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance, December 2, 2011, (NOTE: Part A of the FICAM Roadmap and Implementation Guidance, v2.0, was replaced in 2015 with an updated Architecture (https://arch.idmanagement.gov/#what-is-the-ficam-architecture)

44. NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access,“ June 2018

45. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, “Digital Identity Guidelines,” updated March 02, 2020

46. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014

47. NIST SP 800-164, “Guidelines on Hardware-Rooted Security in Mobile Devices (Draft),” October 2012

48. Draft National Institute of Standards and Technology Interagency Report (NISTIR) 7981, “Mobile, PIV, and Authentication,” March 2014

49. VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

50. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

51. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

52. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

53. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019

54. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008

55. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (Public Law 110–140), December 19, 2007

56. Section 104 of the Energy Policy Act of 2005, (Public Law 109–58), August 8, 2005

57. Executive Order 13834, “Efficient Federal Operations,” dated May 17, 2018

58. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 2, 2001

59. VA Directive 0058, “VA Green Purchasing Program,” July 19, 2013

60. VA Handbook 0058, “VA Green Purchasing Program,” July 19, 2013

61. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

62. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

63. “Veteran Focused Integration Process (VIP) Guide 4.0,” January 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

64. VA Memorandum “Proper Use of Email and Other Messaging Services,” January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

65. “DevSecOps Product Line Management Playbook” version 2.0, May 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

66. NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020

67. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol Version 6 (IPv6),” November 19, 2020

68. Social Security Number (SSN) Fraud Prevention Act of 2017

69. Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23, 2018

SCOPE OF WORK

Overview of Work The Contractor shall provide the following capability delivery lifecycle management, configuration, enhancement/development, data management, and operations and maintenance. The Contractor must adhere to VA 6500 policies, Service Level Agreements (SLA), and Authority to Operate (ATO) requirements including some products that are FISMA FedRAMP High classification, as well as some that are Moderate classification.

This PWS describes efforts to be delivered within the Eligibility and Enrollment Product Line (EE PL) and Veteran Experience Services (VES) Portfolio that will enable and support enterprise-wide improvements to customer experience and Veteran outcomes. The Contractor shall develop and iterate on existing and new platforms and systems with approaches that will be resilient to technical and organizational change and meeting Veteran, family member, caregiver, and internal and external end user needs across the agency instead of in silos.

The scope of services required includes the following functional areas and tasks:

a. Infrastructure Support

b. Desktop/ Help Desk Services

c. Application Production Support and Maintenance Services

d. Technical Writer Support

e. Enterprise Architecture (EA)

f. Data Modeling

g. Project Management

h. Product Management

i. Product Ownership

j. Project Coordination

k. Program Management

l. Quality Assurance

m. Testing

n. Change Management

o. Implementation Management

p. Release Management

q. Systems Analysis

r. Enterprise systems administration and integration

s. Systems Administration

t. Storage and backup Administration

u. Application Administration

v. Information Assurance

w. Web Application Security Assessment (WASA)

x. Cybersecurity

y. Privacy Services

z. Data Management

aa. System Design

ab. System Engineering

ac. Capacity Planning

ad. Network design

ae. Network administration

af. Cloud solution design and administration

ag. Support for Cloud-based systems, software, or applications

ah. Internal Security Monitoring & Alerting (ISMA)

ai. Threat Intelligence & Modeling (TIM)

aj. Support for Managed Service providers including but not limited to:

a. Software as a Service (SaaS)

b. Platform as a Service (PaaS)

c. Infrastructure as a Service (IaaS)

d. Database as a Service (DaaS)

ak. Support for migrating systems and applications from on-premises to a Cloud solution

al. Disaster Recovery (DR) and Information System Contingency Planning (ISCP) support

am. Electronic Data Interchange (EDI) Technical Support

an. Electronic Data Interchange (EDI) Administrative

ao. Business Analysis

ap. Human Center Design Research

aq. Human Center Design

ar. Proficiency in tools as defined by product teams. Below are some current examples, which are subject to change.

a. Slack

b. Mural

c. Jira

d. Confluence

e. CodeQL

f. Jenkins

g. GitHub

Eligibility Experience The Eligibility Experience consists of multiple products and systems that support the Veterans eligibility. In the eligibility experience, the scope of work spans across sustainment, enhancements, development, modernization, maintenance, and operations.

An example of one of our new initiatives in the eligibility experiences is development and enhancement of a standard platform enabling appropriate access to authoritative service member/Veteran data to provide organizational partners and other government agencies the right information to better serve those Veterans who are living within their area.

Enrollment Experience The Enrollment experience consists of multiple products and systems that manage the Veteran, family member, and caregiver enrollment. In the enrollment experience, the scope of work spans across sustainment, enhancements, development, and modernization, maintenance, and operations.

An example of some of our in-flight modernization efforts is re-platforming one of the current products architectures, which is a large, monolithic application built on the IBM WebLogic/ODM platform and has a User Interface (UI) built on the Apache Struts Framework and part of the effort is to continue to build out pieces of the application as microservices. Modernization is not viewed as a one and done. It is an ongoing, continuous improvement effort, driven by the Customer Experience. Other modernization efforts consist of migrating functionality from siloed applications into a more modernized platform, that provides a more seamless experience for the end users as well as directly or indirectly improving the Veteran, family member, and caregiver experience.

DEVSECOPS

Product Teams Product teams are specialized groups of cross-functional individuals dedicated to providing Products with Development Security Operations (DevSecOps) support which includes comprehensive operations, authority to operate for system security scans, security compliance, remediation of vulnerabilities, Secure Socket Layers (SSL) / Transport Layer Security (TLS) compliance and Zero Trust Architecture (ZTA), maintenance, and sustainment application system support services and building and supporting Agile Continuous Integration and Continuous Delivery (CI/CD) environment pipelines. These Teams provide Product specialty expertise, support for the continuous integration, automated builds, verification testing, automated build verification, delivery, automated deployment, and database support. Integration with government and commercial organization partners.

Agile Delivery Teams Agile Delivery Teams are groups of cross-functional individuals dedicated to providing software support services including solutioning, developing, implementing, and releasing high quality software code to production. Agile Delivery Teams regularly produce high quality value driven results in a cost effective, timely, and highly collaborative manner.

Shared Services Teams Shared Services Teams are comprised of individuals that provide specialty services to Product Teams. Shared Services Teams may provide governance, standards and management surrounding Portfolio and Product Line services to allow Systems and Agile Delivery Product Teams to focus on core functions while improving operational strategies and delivering best in class support tools. Shared Services Teams are structured as a centralized point of service and are focused on specialties or defined functions and in the interim of modernization efforts, may include support services for legacy Products (example: review Integration Control Registration).

Additional Considerations The efforts described in this PWS necessitate close collaboration with many teams across VA. VA is a vast enterprise with complex information and technology architecture as well as organizational structure. Eligibility and Enrollment Product Line and Veterans Experience Services Portfolio are only a couple of pieces relevant within the VA landscape; success in this work requires strong relationships, coordination, and deliberate trust building with numerous government and vendor teams. Partner programs and stakeholders may include Veterans Experience Office (VEO), Office of the Chief Technology Officer (OCTO), Software Product Management (SPM), Data & Analytics (DA) within PES, and many others including business stakeholders within Veterans Health Administration (VHA) and Veterans Benefits Administration (VBA). The efforts will have significant dependencies on these external teams.

PERFORMANCE DETAILS

PERFORMANCE PERIOD

The Period of Performance (PoP) shall be a base period of 12 months from date of award, with one 12-month option period(s) and 5 Optional Tasks. The total PoP for this contract shall not exceed 24 months, inclusive of all option periods and the optional 3-month Transition Out task. The PoP for each Optional Task shall not exceed 12-months per exercise.

Any work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO). (If required, the CO may designate the Contractor to work during holidays and weekends). The core and primary duty hours of operation for each location shall be Monday through Friday, 0630 – 1900 Local Time. Work hours shall be a standard five-day – eight-hour structure. The Contractor may be required to support meetings with Government personnel between the hours of 9 am to 5 pm EST.

For any task that requires support during specific timeframes or require 24/7/365 coverage, it will be noted within the individual task sections.

There are 11 Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, four are set by date:

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

CONTRACT TYPE

The effort shall be proposed on a Firm Fixed Price (FFP) basis, including optional tasks with a Time and Material (T&M) line item for travel.

PLACE OF PERFORMANCE

Tasks under this PWS shall be performed at Contractor facilities or locations within the United States determined by the Contractor. The Contractor shall identify the Contractor’s place of performance in their proposal submission. Work may be performed at remote locations with prior concurrence from the Contracting Officer’s Representative (COR).

TRAVEL OR SPECIAL REQUIREMENTS

The Government anticipates travel to perform the tasks associated with the effort, as well as to attend program-related meetings or conferences throughout the PoP.

Travel shall be proposed on a Time and Material basis. There will be 15 large trips of 20 people and 20 trips of 4 people or less per year to various US destinations.

Travel shall be in accordance with the Federal Travel Regulations and requires advanced concurrence by the COR. Contractor travel within the local commuting area will not be reimbursed by the Government. Also, not reimbursable are travel performed for personal convenience or daily travel to and from work at the Contractor’s facility.

SPECIFIC TASKS AND DELIVERABLES

The Contractor shall perform the following tasks and provide the specific deliverables described below within the performance period stated in Section 5.1 of this PWS. The Contractor shall apply the best practices inherent in Development, Security, and Operations (DevSecOps) methodology. The Contractor shall comply with the latest Policies, Guidebooks and Business/Alignment Epics.

Each Product(s) integration and development activity shall be performed via a common System Development Lifecycle (SDLC) process and contribute to the analysis, design, construction, testing, and deployment efforts using VA release management processes and artifacts to support each Product(s), as described in the following sections.

All releases into the production environment shall come through the product specific approved release process.

Backlog grooming and prioritization continued throughout the product life cycle for each product and shall be managed throughout the period of performance.

The Contractor shall utilize approved Process Asset Library (PAL) unless otherwise specified. When no PAL template exists, the Contractor shall recommend a process based on Industry best practices. The Contractor shall include only the content and artifacts that have been updated or developed in the target increment/build in deliverable Build Release Packages. When no change to a package component has occurred during an increment/build, unrelated or unchanged artifacts will not be included in the associated delivery packages. The Contractor shall provide a revision history with track changes on to allow for easy visibility of changes between package deliverables.

PROJECT MANAGEMENT

The Contractor shall execute the planning activities including Contractor onboarding activities, required training, project planning activities in this paragraph, required to support the base and all optional tasks.

CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, timeline, and tools to be used in execution of the contract. The CPMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks, and resource support. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPMP shall be concurred upon and updated in accordance with Section B of the contract. The Contractor shall update and maintain the VA PM approved CPMP throughout the PoP.

Deliverable:

A. Contractor Project Management Plan

REPORTING REQUIREMENTS

The Contractor shall provide the COR with Monthly Progress Reports in electronic form in Microsoft Word and Project formats. The report shall include detailed instructions/explanations for each required data element, to ensure that data is accurate and consistent. These reports shall reflect data as of the last day of the preceding Month.

The Monthly Progress Reports shall cover all work completed during the reporting period and work planned for the subsequent reporting period. The report shall also identify any problems that arose and a description of how the problems were resolved. If problems have not been completely resolved, the Contractor shall provide an explanation including their plan and timeframe for resolving the issue. The report shall also include an itemized list of all Information and Communication Technology (ICT) deliverables and their current Section 508 conformance status. The Contractor shall monitor performance against the CPMP and report any deviations. It is expected that the Contractor will keep in communication with VA accordingly so that issues that arise are transparent to both parties to prevent escalation of outstanding issues.

Deliverable:

A. Monthly Progress Report

TECHNICAL KICKOFF MEETING

A technical kickoff meeting shall be held within 10 days after TO award. The Contractor shall coordinate the date, time, and location (can be virtual) with the Contracting Officer (CO), as the Post-Award Conference Chairperson, the VA PM, as the Co-Chairperson, the Contract Specialist (CS), and the COR. The Contractor shall provide a draft agenda to the CO and VA PM at least five (5) calendar days prior to the meeting. Upon Government approval of a final agenda, the Contractor shall distribute to all meeting attendees. During the kickoff-meeting, the Contractor shall present, for review and approval by the Government, the details of the intended approach, work plan, and project schedule for each effort via a Microsoft Office PowerPoint presentation. At the conclusion of the meeting, the Contractor shall update the presentation with a final slide entitled “Summary Report” which shall include notes on any major issues, agreements, or disagreements discussed during the kickoff meeting and the following statement “As the Post-Award Conference Chairperson, I have reviewed the entirety of this presentation and assert that it is an accurate representation and summary of the discussions held during the Technical Kickoff Meeting for the <insert title of effort>.” The Contractor shall submit the final updated presentation to the CO for review and signature within three (3) calendar days after the meeting. The Contractor shall also work with the CS, the Government’s designated note taker, to prepare and distribute the meeting minutes of the kickoff meeting to the CO, COR and all attendees within three (3) calendar days after the meeting. The Contractor shall obtain concurrence from the CS on the content of the meeting minutes prior to distribution of the document.

Deliverable:

A. Summary Report B. Meeting Minutes

ONBOARDING

The Contractor shall manage the onboarding of its staff. Onboarding shall include steps to obtain a VA network and email account, complete training, initiate background investigations, and gain physical and logical access, which may include elevated privileges to the necessary development and test environments for the various systems to be enhanced.

A single Contractor Onboarding POC shall be designated by the Contractor who tracks the onboarding status of all Contractor personnel. The Contractor Onboarding POC shall be responsible for accurate and timely submission of all required VA onboarding paperwork to the COR or his/her onboarding designee. The Contractor shall be responsible for tracking the status of all their staff’s onboarding activities. This shall include VA Privacy and Information Security Awareness training, Rules of Behavior, fingerprints, background investigation submission and status, GFE request, signature for GFE, Personal Identity Verification (PIV) card, Active Directory account, Remote Access Request, Elevated Privileges Request per environment, VA Tools training, and any other information deemed necessary for tracking by the Contractor, VA OIT PM or COR.

KEY PERSONNEL

All personnel performing work shall possess expertise in the disciplines and technical areas as related to the tasks in the PWS. The Contractor shall provide key personnel with the qualifications listed below to support this effort and any additional key personnel it deems necessary to support the requirements of this PWS. These personnel shall not be removed from the Task Order without written notification to the CO.

It is the responsibility of the Contractor to provide personnel and subcontractors who have the required educational background, experience, security clearance, and access authorization or combination thereof to meet the labor category descriptions under this Task Order for the required PWS tasks.

If any change to the Key Personnel assigned to the labor categories identified below becomes necessary (initial staffing, substitutions or additions), the Contractor shall immediately notify the CO/COR/PM in writing, accompanied by the resume, if applicable, of the proposed replacement personnel who shall be of at least substantially equal ability and qualifications as the individual(s) currently performing in that category and that the proposed replacement meets or exceeds the qualifications designated for that Key Personnel position. It is expected that substitution or replacement of the personnel will not occur within the first six (6) months after date of TO award.

The Contractor agrees that it has a contractual obligation to mitigate the consequences of the loss of Key Personnel and shall promptly secure any necessary replacements in accordance with (IAW) this PWS section. Failure to replace a Key Personnel pursuant to this clause and without a break in performance of the labor category at issue shall be considered a condition endangering contract performance and may provide grounds for default termination.

The labor categories below are identified as Key Personnel. Key Personnel must meet the corresponding requirements identified in the Labor Description column below:

· Expertise in managing entire agile software development lifecycle for a project of at least one million dollars up to and including production delivery and some phase of post-delivery/warranty support.

· Expertise as a product manager accountable for delivery for at least 10 software professionals with a duration of greater than one year.

· Demonstrated success with delivering digital products.

Minimum Education Level

· Bachelors

Degree In

· Business Administration, Business Management, Computer Science, Information Systems, Information Resource Management, Industrial Engineering, Operations Research or related fields.

Minimum Experience

· 3 years

Substitutions

· A minimum of 5 years of relevant experience may be substituted for education

• Demonstrated knowledge and use of modern software development and Dev/Ops tools including GitHub and implementation of a Dev/Ops pipeline in a cloud environment.

· Chief Architect or Senior Engineer on a production system in one of the VAEC CSP Vendors Clouds

· Experience as a Software Engineer for at least one project in one of the VAEC’s Cloud Service Provider (CSP) Vendors Clouds.

Customer Support Subject Matter Expert

(SME)

Expertise

· Demonstrated knowledge and use of modern software development and Dev/Ops tools.

· Demonstrated success implementing and/or maintaining a customer support workflow, for all touch points including (but not limited to) managing new release communications, bug fixes, and support requests/questions.

Minimum Education Level

· High School or GED

Degree In

· NA

Minimum Experience

· 3 years

· Demonstrated release/delivery management on largescale deployments for at least five (5) years.

Demonstrated successful delivery of multiple large-scale deployments.

Minimum Education Level

· Bachelors

Degree In

· Business Administration, Business Management, Computer Science, Information Systems, Information Resource Management, Industrial Engineering, Operations Research or related fields.

Minimum Experience

· 3 years

Substitutions

· A minimum of 5 years of relevant experience may be substituted for education

· Expertise running a 24x7x365 Software based System for at least 6 months.

· Expertise with oversight of an operations team of at least 5 people for at least one year.

· Expertise in Incident Management for a software-based system.

· Expertise with oversight of a team running a trouble ticket system.

· Demonstrated success using modern DevOps methods and tools including automated testing tools and monitoring tools.

· Demonstrated ability to drive frequent release cycles (daily/weekly).

· Expertise with user focused designs and workflows based off of complex data models leveraging HCD market analysis, customer feedback and requirements, and user research analytics.

· Expertise in designing mock-ups and click-through prototypes, identifying streamlined UI opportunities incorporating emerging technology trends.

· Expertise in developing high-level requirements, conceptual diagrams, and visual interface designs.

· Expertise in creating key design deliverables specific to each product, such as scenarios and use-cases.

· Expertise with UI strategy and iterations with a focus on Human Centered Design (HCD) for at least five (5) years.

Minimum Education Level

· Bachelors

Degree In

· Business Administration, Business Management, Computer Science, Information Systems, Information

Resource Management, Industrial Engineering, Operations Research or related fields.

Minimum Experience

· 3 years

Substitutions

· Certifications in relevant UX Software plus a minimum of 3 years of relevant experience; or a minimum of 5 years of relevant experience may be substituted for education

User Experience Specialist Expertise

· Expertise with usability engineering strategy and at least five (5) years of relevant UX software experience including relevant certifications.

· Expertise in establishing and maintaining the vision of the overall user experience across all creative disciplines leveraging human-centered design, information architecture, usability, and other applicable best practices.

· Expertise in aligning deliverables with overall user experience strategies optimizing overall customer and end-user experience across all engagement and interactions.

· Expertise across standard UX Software. Minimum Education Level

· Bachelors

Degree In

· Business Administration, Business Management, Computer Science, Information Systems, Information Resource Management, Industrial Engineering, Operations Research or related fields.

Minimum Experience

· 5 years

Certifications in relevant UX software plus a minimum of 5 years of relevant experience or a minimum of 7 years of relevant experience may be substituted for education

Operations Research Analyst/Data Scientist III Expertise

· Experience conducting quantitative analysis using operations research tools, economics, and other quantitative techniques in the areas of procedural implementations and performance issues for at least five (5) years.

· Expertise in creating, deploying, maintaining and refining decision management models.

· Specialist in modeling and simulation functions or operations such as, but not limited to, exercises, plans, coordination, demonstrations, and instruction in applicable fields. Minimum Education Level

· Master’s

Degree In

· Business Administration, Business Management, Computer Science, Information Systems, Information Resource Management, Industrial Engineering, Operations Research or related fields.

Minimum Experience

· 5 years

Substitutions

· A minimum of 8 years of relevant experience may be substituted for education

Senior Enterprise Application Product Expert Expertise

• Assess, select, manage and implement enterprise application components, and to ensure that the technical solution solves the business problem as an organic part of the organization’s operational and functional baseline. Focus is in a specific product or technology family on multiple platforms, which is supplemented with a clear understanding of the business requirements and related applications issues. Supports technical strategies that will improve productivity across functional areas within the organization. Educates others with regard to product-specific best practices. Leads enterprise applications integration efforts and oversee the validation of associated work products. Provides work direction and guidance to other personnel; ensures accuracy of the work of other personnel, operates under deadlines, able to work on multiple tasks.

· conducts workflow analysis, technology assessments, and business-related studies to define business case plans and architecture strategies supporting long term sustainability and growth. The expert provides guidance and strategy for adoption of new technology products and processes optimizing developer, customer, and end-user experience.

Minimum Education Level

· Bachelors

Degree In

· Business Administration, Business Management, Computer Science, Information Systems, Operations Research or related fields.

Minimum Experience

· 5 years

· Certifications in relevant UX software plus a minimum of 5 years of relevant experience OR a minimum of 7 years of relevant experience may be substituted for education

· communication and coordination of activities between all teams, external and internal clients, and contract stakeholders pertaining to team products and product delivery to end-users.

Minimum Education Level

· Bachelors

Degree In

· Business Administration, Business Management, Computer Science, Information Systems, Information Resource Management, Industrial Engineering, Operations Research or related fields.

Minimum Experience

· 5 years

· A minimum of 8 years of relevant experience may be substituted for education

Principal Business Process ReEngineering (BPR) Specialist Expertise

· Expertise in providing group facilitation, interviewing, training, and providing additional forms of knowledge transfer.

Minimum Education Level

· Master’s Degree

Degree In

· Business Administration, Business Management, Computer Science, Information Systems, Information Resource Management, Industrial Engineering, Operations Research or related fields. Minimum Experience

· 10 years acting as an Executive Level Advisor and Senior Functional Leader to apply process improvement and re-engineering methodologies and principles to conduct process modernization projects.

· A minimum of 12 years of relevant experience may be substituted for education

PERSONNEL REQUIREMENTS

The Contractor shall provide at least one resource for each scrum team with Scaled Agile Framework (SAFe) certification and at least one Scrum Alliance Certified Scrum Master for every two active scrum teams.

The Contractor shall provide personnel with requisite skillsets to support the following functional areas for all products:

· Application/System Support – Tier 2 and 3 fault isolation and triage

· Application/System Administration

· Application/Systems Engineering

· Middleware Support

· Monitoring Tools Support

HUMAN CENTERED DESIGN

The Contractor shall utilize Human Centered Design (HCD) principles as part of all product development and operations efforts. While engaging in the following HCD activities, the Contractor shall:

1. Follow the United States Digital Service value: “Design with users, not for them.”;

2. Provide expert guidance on user experience (UX) design direction and strategy; and

3. Create and maintain documentation for all activities, recommendations, and decisions.

RISK MANAGEMENT

The Contractor shall support the efforts of the VA team to conduct risk management of all work performed under this TO and provide input to the product Risk Management registry within an approved VA tool maintained by VA.

DEVELOPMENT METHODOLOGY AND WORKING PRINCIPLES

The Contractor’s support and solutions shall follow the practices described in the Digital Services Playbook (https://playbook.cio.gov). The Contractor shall be familiar with the concepts in each play and implement them in its approaches and support. The Contractor shall deliver modern digital services that use DevSecOps techniques that embrace Continuous Integration / Continuous Delivery (CI/CD). The Contractor shall deliver secure and tested modern web application designs using automated testing frameworks.

The Contractor shall provide VA with teams that shall deliver viable, digital solutions in support of VA’s strategic mission and objectives. Specifically, the Contractor shall:

1. Deliver high-quality, functional products that are measured by user feedback from surveys, research, etc.

2. Follow the practices described in the “Digital Services Playbook” (https://playbook.cio.gov).

3. Be agile. Incorporate Agile methodologies and ceremonies into work, such as (but not limited to) sprint planning, daily scrum, sprint review, sprint retrospective, backlog grooming, and estimating activities.

4. Actively involve users in the design of all solutions. Incorporate best practices for modern user research and usability testing, such as (but not limited to) creating user personas, problem space definitions, affinity maps, user flow diagrams, wireframes, information architecture diagrams, design prototypes, user research plans, conversation guides, and user research synthesis.

5. Maintain a consistent look, feel, and voice across user facing sites and services. Incorporate best practices defined in the VA Design System and VA Content Style Guide (https://design.va.gov/).

6. Personalize solutions for the individual or team using the product (https://www.whitehouse.gov/briefing-room/presidential-actions/2021/12/13/executive-order-on-transforming-federal-customer-experience-and-service-delivery-to-rebuild-trust-in-government/; https://www.whitehouse.gov/wp-content/uploads/2018/06/s280.pdf)

7. Optimize web applications for mobile-first operation, with all solutions being equally available on both mobile and desktop whenever possible. Incorporate robust accessibility principles into design, development and testing for all web applications to deliver high-quality digital experiences to users of assistive devices.

8. Protect user information with best-in-class security, given the constraints of the environment.

9. Use DevSecOps techniques of CI/CD across all environments including, at a minimum, development, staging, and production. (http://github.com/department-of-veterans-affairs/va.gov-team/tree/master/platform/engineering/).

10. Use automated testing frameworks to create unit tests, integration tests, functional/black box tests, regression tests and load tests (or their equivalents as applicable) to test 100% of functionality delivered. Strive for compliance with Test Driven Development practices.

11. Ensure configuration and sensitive data, including data the VA defines as sensitive, are not present in source code, and are stored in encrypted credential management systems.

12. Deliver all code not containing configuration or sensitive data to an open-source repository per Office of Management and Budget Guidance M-16-21.

13. Cultivate a positive, trusting, and cooperative working relationship with the Government and all other vendors supporting this work.

14. Code deliverable needs to pass quality gates and/or exceptions approved by the product team.

Product TEAMS The Contractor shall provide Product Teams to enable DevSecOps Product support.

The team size required to provide the Product Team support shall be determined by VA based on its analysis. The Contractor shall have available to VA five (5) categories of team sizes. The required dedicated full-time employee (FTE) count for each team size is as follows:

*Note: Team sizes can be combined if required per Product need and would perform as a single team as directed by the PM/COR.

Operations and Infrastructure Services Each Product team shall comprehensively support the operations, sustainment, maintenance, security, accessibility, performance, core services, technical standards, architectural compliance, operational capability testing, audits, and reviews, integration with external systems, triage and resolution support of issues, monitoring, contingency, capacity planning, and recovery for its assigned Product.

The Contractor shall work in concert with Product Teams to achieve holistic and seamless DevSecOps product support in alignment with the VA Product Line Management (PLM) Playbook and the applicable working principles outlined in Section 5.0.

Key Performance Indicators baselines shall be established at the beginning of a PI, and incremental improvement towards DevSecOps maturity shall be agreed upon at the beginning of the PI and measured at the end of the PI.

Prior to each sprint, the Contractor and VA shall agree upon in writing a sprint cadence and a Definition of Done for the upcoming sprint increment, including required deliverables.

The Contractor shall use VA approved application Lifecyle management tools in accordance with best practices to provide a single authoritative project and product data and artifact repository. All product data and artifacts shall be managed in this data and artifact repository daily. All checked out artifacts shall be checked back in daily:

1. scheduled product sprints and backlog

2. product agile requirements

3. product risks and issues

4. product configurations and changes

5. product test plans and execution

6. product planning and engineering documentation

7. linkages to correlate requirements to change orders to configurable items to risks, impediments, and issues to test cases and test results to show full traceability

The Contractor shall show all Agile requirements, changes, tests performed and test results in approved VA project management tools to show evidence of code coverage and test coverage of all the requirements specified. This is required for VA to have high confidence in a fully documented, as evidenced by data in the tools, requirements traceability matrix.

The Contractor shall:

1. Perform all operation services and activities including performance and dashboard monitoring and inclusive of job scheduling and execution, backup and restore

2. Meet or exceed Product Specific SLA targets for mean time to resolve issues and operational incidents

3. Provide support to keep all environments in an operational state including application 24x7x365

4. Support the uptime of system operations 24x7x365

5. Support software releases during weekends (day and potentially nighttime hours) and monitoring/maintenance activities periodically during weeknights. VA estimates that regularly scheduled releases will occur twice a month. Emergency releases historically occur once a month

6. Provide “After-Hours” and weekend “On Call” support for network and external dependency tasks and to support coordinated activities and software releases. “After- Hours” is considered after 5 PM Eastern Time through 7 AM Eastern Time

7. Troubleshoot, respond, and resolve issues so to complete tickets escalated by the Help Desk and YourIT (ServiceNow) application.

8. Troubleshoot, respond, and resolve issues and associated tickets generated by automated alerts

9. Be the first line of defense for failed pipelines (production and non-production)

10. Detect, diagnose, and resolve issues and operational incidents within the Product specific SLA time frames

11. Support VA event management processes for critical and high priority incidents (including participation in Swift Action and Triage (SWAT) and publication of After-Action Reports)

12. Maintain incident metrics and supplementary data to detect patterns and trends and facilitate rapid diagnosis of previously observed incidents

13. Manage and track software licenses and maintenance agreements

14. Deploy and maintain automation to detect and generate alerts for lapses in system availability and material deviations from baseline system performance

15. Provide continuous improvement of monitoring and alerting to detect new failure points

16. Deploy and maintain dashboards depicting operational characteristics of the production environment, including but not limited to user experience (e.g. business transaction response times and error rates), availability, performance, utilization, and availability

17. Manage system performance and capacity for all products and platform components:

a. Establish a baseline for system performance and resource utilization

b. Establish reserve capacity…