DA01--Benefits Enterprise Services (VA-25-00006417)

Questions & Answers / Clarifications

This document contains questions and answers related to the Benefits Enterprise Services (BES) procurement, providing clarifications on the Performance Work Statement (PWS) and acquisition strategy.

• Transition-In Planning: The VA will consider using transition plans as part of the evaluation approach. Strategic objectives are in the PWS, and operations metrics are in the SLA. Product backlogs will not be provided due to sensitive information.
• Team Composition: Offerors must propose their own team compositions consistent with the PWS requirements; the PWS outlines general team structures.
• Evaluation Process: The Government will consider a two-step evaluation process (e.g., using case studies) and will post the final decision with the solicitation.
• Basis of Award: The Government will consider recommendations regarding evaluation approaches, including Highest Technically Rated Reasonably Priced (HTRRP) or price realism analysis, but expects cost/price savings in proposals.
• Shared Services Teams: Shared Service team requirements will not be added to the PWS. Scope not aligning with defined BES teams will be competed separately.
• UAT Environments: UAT environments will adhere to Production Service Level Targets.
• System Teams: System teams will primarily support products, not individual environments.
• Terminology Updates: PWS terminology has been updated to reflect modern version control systems (e.g., "commit and push code") and to replace "Disaster Recovery Plans" with "Incident Response Plans."
• Data Analytics: PWS has been updated to further define data analytics requirements at the portfolio level.
• Vulnerability Management: PWS sections on vulnerability management have been updated for consistency with Addendum B regarding remediation timelines.
• Software Licenses: Software licenses are managed in a spreadsheet; non-standard VA software is the contractor's responsibility.
• Agile Software: JIRA is currently used for PI Planning.
• AI/ML Operations: VA is exploring AI use cases for infrastructure and application enhancement.
• Critical Systems: A list of critical/bedrock systems and their owning product lines is provided.

Several recommendations regarding evaluation approaches, team structures, and terminology have been considered and incorporated into the PWS or will be addressed in the final solicitation. Offerors should review the updated PWS sections for specific changes. The VA is contemplating the use of Alliant 2 and FAR Part 16.5 procedures for the procurement.

Performance Work Statement (PWS)

This PWS outlines the requirements for providing portfolio-level technical management and coordination to develop and provide secure Benefits Enterprise Services (BES) architecture, engineering, solutions, services, and data for the Department of Veterans Affairs (VA) Office of Information & Technology (OIT). The goal is to ensure reliable, secure, and seamless delivery of benefits and services to Veterans.

• Provide portfolio and product line technical management, maintaining strategy-to-execution alignment.

• Support business needs intake, prioritization, and delivery through epics and initiatives.

• Deliver Agile software development iterations and Continuous Integration/Continuous Delivery (CI/CD) pipelines.

• Provide DevSecOps (DSO) product support services for the BAM Portfolio, Benefits Integration Platform (BIP), and associated Product Lines and Products.

• Transition legacy systems functionality and data to BIP and decommission legacy systems.

• Support System Teams and Agile Development Teams for operations, maintenance, and development.

• Offer optional services including additional System Teams, Agile Development Teams, Help Desk Support, Training Team, and Transition Out Support.

• Adherence to Service Level Targets for availability, recovery time, and incident response.

• Monthly Status Reports detailing progress, risks, issues, and contract-related matters.

• Agile Development Data and Statistics Reports, Sprint Review Reports, and Release Quality Metrics Reports.

• Base period of 12 months with four (4) 12-month option periods, for a total potential of 60 months.

• Performance will be at Contractor facilities.

• Compliance with VA Enterprise and IT Frameworks, including the VA Technical Reference Model (TRM), Zero Trust principles, FICAM, and IPv6.

• Adherence to security and privacy requirements, including background investigations for personnel.

• Use of VA-approved SDLC tools and repositories.

• Support for VA’s Veteran-Focused Integration Process (VIP) and Product Line Management (PLM).

Other / Unclassified

This document provides an update regarding the "Benefits Enterprise Services" procurement (Solicitation Number: 36C10B25Q0057). Market research has concluded, and the government has reviewed RFI responses, making necessary adjustments to the Performance Work Statement (PWS) and addressing vendor questions. The government anticipates soliciting this requirement under GSA Alliant 2.

• Solicitation Release: Expected in Q4 FY 2025.
• Award: Estimated for Q1 FY 2026.
• Procurement Vehicle: GSA Alliant 2.
• Key Documents Attached:
  • Benefits Enterprise Services_PWS_RFI Loopback
  • BES RFI QA_Final

Request for Information (RFI)

This RFI is for planning purposes to gather information for the VA's acquisition strategy and potential refinement of the Performance Work Statement (PWS) for Benefits Enterprise Services (BES). It is not a solicitation, and no contract will be awarded based on this RFI. The government is not obligated to acquire any described products or services, and no payment will be made for submitted information.

• Set-Aside Consideration: Responses may influence set-aside decisions, particularly for Veteran Small Business Certification (VetCert) certified Service-Disabled Veteran-Owned Small Businesses (SDVOSBs) and Veteran Owned Small Businesses (VOSBs). SDVOSB/VOSB companies must be registered and certified in the SBA's VetCert database.

• NAICS Code: 541512, Computer Systems Design Services.

• Page Limitation: 15 pages. No marketing materials are allowed.

• Response Content: Generic capability statements are not accepted. Responses must address capabilities specific to the draft PWS and include:

  • Company Name, Address, POC, Contact Info
  • Company Business Size and Status
  • For SDVOSBs/VOSBs: Intent and ability to meet VAAR 852.219-73 requirements (not paying more than 50% to non-SDVOSBs), available personnel/financial resources, proposed team members, and subcontracting plans.
  • NAICS codes, Socioeconomic data, UEI, Existing Contractual Vehicles.
  • Detailed capabilities and experience in:
    • DevSecOps Product Support, modernization, AI, and ML.
    • Information security and quality management across the SDLC.
    • Collaborative platform architecture development and hosting.
    • Portfolio-level requirements management and business value alignment.
    • CI/CD pipeline implementation and test automation.
    • Site Reliability Engineering (SRE) practices (Zero Trust, proactive monitoring).
    • Managing large-scale DevSecOps product teams and execution across agile teams.
    • Transitioning large-scale modernization efforts, providing feedback on technical milestones and schedule risks for the BES contract transition from the current BID Task Order (VA118-16-D-1007 36C10B21N10070021), including ~15 System Teams and ~230 Agile Development Teams.
  • Feedback on the sufficiency of the draft PWS for technical requirements.

• Due Date: December 2, 2024, 1:00 PM EST.

• Submission Method: Email to Vanessa Woodward (vanessa.woodward@va.gov), Sarah Kuna (sarah.kuna@va.gov), and Dana Newcomb (dana.newcomb@va.gov).

• Subject Line: "Benefits Enterprise Services"

• Marking: "Proprietary Information" if applicable.

• Email Size Limit: 5 MB.

• The VA intends to award the BES contract in the final year of the current task order to allow for a potential 6-month transition period, aiming for full service transition by May 18, 2026.

Other / Unclassified

This document is an administrative update to a Request for Information (RFI) related to the Benefits Enterprise Services opportunity (VA-25-00006417).

The government has increased the RFI response page limitation from 15 pages to 20 pages. This change is relevant to potential bidders who may be preparing to respond to the RFI, as it provides additional space for their submissions.

Other / Unclassified

This document is VA Directive 6551, "VA ENTERPRISE DESIGN PATTERNS," dated March 17, 2016. It establishes mandatory policy for the use of Enterprise Design Patterns in the development and management of all VA information technology (IT) systems. These patterns are capability guidance documents that identify repeatable, best practice approaches to address recurring technical challenges, aiming to improve IT security, advance agile interoperability, enhance information sharing, and reduce total lifecycle costs.

This directive mandates the use of Enterprise Design Patterns for all VA IT projects. It outlines the purpose, policy, responsibilities, and definitions related to these patterns. Key aspects include:

• Purpose: To guide the development of IT systems using standardized, repeatable best practices, supporting enterprise-wide capabilities and consistent technical solutions.
• Policy: All projects under the Veteran-focused Integration Process (VIP) must evaluate and leverage Enterprise Design Patterns to achieve technical solutions aligned with VA's Enterprise Technical Architecture (ETA) Compliance Criteria.
• Responsibilities: The Office of Information and Technology (OI&T) Architecture, Strategy, and Design (ASD) is responsible for developing, approving, and maintaining these patterns. Project teams are responsible for evaluating and complying with them.
• Availability: Approved and published Enterprise Design Patterns are located at http://www.techstrategies.oit.va.gov/docs_design_patterns.asp.

For bidders, this document signifies a requirement for IT projects to adhere to established Enterprise Design Patterns, which will likely influence technical requirements, solution architectures, and potentially performance work statements and source selection criteria in future solicitations.

Other / Unclassified

This document is a presentation summarizing the September 2021 revision of IRS Publication 1075, "Safeguards: Protecting Federal Tax Information (FTI)." It outlines the key changes and updates to the publication, which supersedes the November 2016 version. The presentation covers an overview of general updates, specific changes by area (FTI, Physical Security, Cybersecurity, NIST 800-53), and next steps.

This document is relevant to potential bidders who may be involved in providing services related to the safeguarding of Federal Tax Information (FTI). It details updated requirements and standards for:

• FTI Handling: Includes new requirements for FTI logs and visitor access logs, emphasizing retention periods and required information.
• Physical Security: Updates on minimum protection standards for Multifunction Devices (MFDs) and High-Volume Printers.
• Cybersecurity: Expands the security controls catalog, introduces new control families (Personally Identifiable Information Processing and Transparency, Supply Chain Risk Management), and details updates to incident response, insider threat programs, awareness training, and supply chain risk management.
• Background Investigations: Changes reinvestigation frequency from every 10 years to every 5 years, and specifies requirements like fingerprinting and local law checks.
• Disclosure Awareness Training: Mandates training on organizational authority, authorized uses, disclosure to external parties, and consequences of unauthorized access, use, or disclosure.

The document also highlights that the revised publication will be effective approximately six months after its publication. Feedback on the changes can be submitted to SafeguardReports@irs.gov.

Form / Attachment / Pricing Sheet

This document provides a list and descriptions of the application systems that support the Veterans Appeals Product Line. It details the systems used to manage and process Veteran Appeals, offering modern technology solutions.

• Caseflow: Manages appeals and integrates with VA systems (VACOLS, VBMS, BIS) and Lighthouse API.

• ARMS (Appeals Resource Management System): A database and web application for managing employee and resource data. Currently nearing end of life and not in use.

• IDT (Interactive Decision Template): A Microsoft Word macro template to streamline decision writing, quality review, digital signatures, and companion letter generation.

• VACOLS (Veterans Appeals Control and Locator System): Receives data from MPI and PAID, and sends data to eBenefits and VRM.

• Languages/Tools: Red Hat Enterprise Linux, Ruby on Rails, DynaTrace, Paceart Optima, Knapsack Pro, DataDog, GitHub, Tableau, Envoy, Gzip, Nokogiri, Slack, Confluence, Metabase, HAProxy, Redis, Jira, DIFFUTILS, OpenSSH, nodeJS, Datadog, Terraform, Ansible, Venafi, Dynatrace, Rails, Postgresql, Oracle DB, Sentry, Python, OpenSSL, LogStash, React, Ruby, nginx, Jenkins, ScienceLogic, MSVBA, Oracle RDBMS, PowerBuilder, 11G Instant Client.

• Integrated with: Pexip, Box, Webex.

This document is relevant for bidders as it outlines the existing technology landscape and systems within the Veterans Appeals Product Line. Understanding these systems, their functionalities, and their integrations is crucial for developing proposals that align with the government's current infrastructure and future needs for supporting Veteran Appeals processing and management.

Form / Attachment / Pricing Sheet

This document, "Memorials DevSecOps Application Systems Product List," provides a comprehensive overview of the technology solutions and systems managed by the Memorial Benefits and Services (MBS) Products division within the National Cemetery Administration (NCA). It details various systems that support NCA programs and services, focusing on digitization, modernization, automation, and interoperability to enhance services for Veterans and their families.

• Memorial Benefits and Management System (MBMS): Supports the National Cemetery Scheduling Office (NCSO) and individual cemeteries for scheduling burials, managing monument orders, and overall cemetery management. Includes modules like Case Management, Eligibility, and Outreach (CaMEO) and Cemetery Regulations, Reports and Testing (CeRRT).
• Memorial Enterprise Letters (MEL): Enables the creation and automated management of letters for suspending or denying applications for government headstones, markers, or medallions, reducing reliance on IT support.
• Veteran Legacy Memorial (VLM): An interactive online platform honoring Veterans, allowing public contributions to memorial pages, viewing of headstone images, and burial records. It is a cloud-based platform aligning with the President’s Management Agenda.
• Business Intelligence National Cemetery Administration (BINCA): Utilizes Tableau Server for self-service analytics, data visualization, and decision-making support for NCA leadership.
• Burial Operations Support System - Enterprise (BOSS-E): A plan to transition users from 10 legacy sub-systems into MBMS and other solutions, leading to the decommissioning of systems like BOSS, AMAS, NGL, and others.
• Individual System Details: Descriptions of specific legacy systems being consolidated or replaced, including BOSS, AMAS, EOAS, NGL, WebPMC, DBS, KGL, GAR, and MADSS, outlining their functions and criticality.
• Technology Stack: Lists software languages and tools used, including Apache, AWS services, Docker, Java Enterprise Edition, Kubernetes, Oracle Database, Python, Salesforce, Spring Security, and Tableau Server.

This document is crucial for bidders as it outlines the existing technology landscape and future modernization efforts within the NCA's Memorial Benefits and Services division. Understanding these systems, their functionalities, and the technologies employed provides insight into potential future contract requirements, integration needs, and areas where new solutions or support may be sought. It helps bidders assess their capabilities and alignment with the NCA's technological infrastructure and strategic goals.

Form / Attachment / Pricing Sheet

This document, "0001 BIA DevSecOps Application Systems Product List.docx," provides a comprehensive overview of the application systems within the Benefits Integration and Administration (BIA) product line. It details the systems, their descriptions, and their current or planned technological environments. This information is crucial for potential bidders to understand the existing infrastructure and technology stack that the BIA product line utilizes or is transitioning to.

• System Acronyms and Names: Lists key systems such as BEP (Benefits Enterprise Platform), BIP (Benefits Integration Platform), CSS (Common Security Services), CRP (VBA Corporate Database), VD2 (VBA Data Warehouse), and VD3 (Performance Analysis and Integrity Business Intelligence).
• System Descriptions: Provides details on the function, data sources, deployment locations (AITC, VAEC AWS GovCloud), technologies used (e.g., APIs, databases, cloud-native tools, .NET, Java), and modernization efforts for each system.
• Technology Stack: Includes an extensive list of software languages, tools, and platforms employed across the BIA product line, such as Ansible, Apache, AWS services, Docker, Kubernetes, Java, .NET, Oracle Database, and Tableau.

This document helps bidders understand the technical landscape of the BIA product line. It highlights the systems that are undergoing modernization, migration to cloud environments (AWS GovCloud), and adoption of cloud-native technologies. Understanding these systems, their interdependencies, and the technologies in use is essential for proposing relevant solutions, identifying potential integration points, and assessing the technical environment for any related opportunities within the BIA product line.

Form / Attachment / Pricing Sheet

This document, "0002 CP DevSecOps Application Systems Product List.docx," lists and describes the application systems that are part of the C&P DevSecOps suite. This suite supports VBA's modernization efforts by integrating functionalities into VBMS, increasing cloud-based product utilization, standardizing record sharing, and retiring legacy systems.

• VBMS (Veteran Benefit Management System): A paperless claims processing system for compensation and pension claims, including a document repository, workload management, correspondence tools, fiduciary management, rating features, and an awards module.
• AMIE (Automated Medical Information Exchange): Facilitates electronic interchange of veteran information between VBA Regional Offices and VA medical facilities.
• CLAIMS: Provides user authentication and interfaces with various systems critical to veteran care, including CAPRI, Suicide Hotline/Veterans Crisis Line, VRAM, JLV, VistAWeb, and Web VRAM.
• RONA-B (Release of Name and Address Benefits): Supports VA Enterprise Records Service by managing the accuracy and quality of information and facilitating information management for authorized requests of veteran names and addresses.
• VADS (Veterans Assistance Discharge System): A mainframe batch process to automate the entry of former service members into the VA system, notify them of entitlements, and gather statistics.
• CAPRI (Compensation and Pension Record Interchange): Supports exam management workflows and assists Rating Specialists in building rating decision documentation.
• VETSNET Suite: A comprehensive suite of applications facilitating the entire C&P claims process, including financial and accounting (FAS), personnel information exchange (PIES), awards processing (MAP-D), legacy data inquiry (SHARE), statement of the case generation (SOC/SSOC), name and address requests (RONA), and letter generation (PCGL).
• Software Languages & Tools: A comprehensive list of programming languages, cloud services (AWS Govcloud, FEDRAMP), CI/CD tools, databases, operating systems, and development tools used in the DevSecOps environment.

This list provides potential bidders with insight into the technology stack and existing systems that are part of the C&P DevSecOps modernization effort. Understanding these components can help bidders assess their capabilities and tailor their proposals to align with the government's current and future technology landscape.

Request for Information (RFI)

This RFI is for planning purposes only to gather information for the "Benefits Enterprise Services (BES)" effort. The government is not obligated to acquire any products or services described and will not pay for information submitted. Responses will help the VA refine its acquisition strategy and Performance Work Statement (PWS).

• NAICS Code: 541512 (Computer Systems Design Services)

• Response Date: December 2, 2024, 1:00 PM EST

• Submission: Via email to vanessa.woodward@va.gov, sarah.kuna@va.gov, and dana.newcomb@va.gov. Subject line: "Benefits Enterprise Services". Max email size: 5 MB.

• Page Limit: 15 pages. No marketing materials allowed.

• Company Information: Name, Address, POC, Phone, Fax, Email, Business Size/Status, UEI.

• SDVOSB/VOSB Intent: For SDVOSBs and VOSBs, detail intent and ability to meet VAAR 852.219-73 requirements (contractor will not pay more than 50% to non-SDVOSBs). Include available personnel, financial resources, proposed team members, and subcontracting percentages for the set-aside requirement.

• Capabilities: Detailed descriptions of experience in:

  • Comprehensive DevSecOps Product Support, including modernization, AI, and ML.
  • Information security and quality management across the SDLC.
  • Collaborative platform architecture development and hosting for data sharing.
  • Portfolio-level requirements management and alignment with business value.
  • CI/CD pipeline implementation and test automation.
  • Site Reliability Engineering (SRE) practices (Zero Trust, proactive monitoring).
  • Managing multiple large-scale DevSecOps product teams and execution across 230+ agile teams.
  • Transitioning large-scale, complex modernization efforts (similar to the BAM Portfolio).

• PWS Feedback: Provide feedback on whether the draft PWS sufficiently details technical requirements. If not, provide recommendations for improvement.

Set-aside decisions may be made based on the availability of certified SDVOSBs and VOSBs capable of providing the services. SDVOSB/VOSB companies must be registered and certified in the SBA's VetCert database.

The VA intends to award the BES contract to accommodate a potential 6-month transition period, ensuring services are fully transitioned by May 18, 2026. Responses should detail experience transitioning similar large-scale modernization efforts.

• Draft Benefits Enterprise Services PWS
• Product List attachments for BIA, CP, Memorials, EVRE, and Veterans Appeals
• Relevant Directives (6500, 6551, 6517, 6404)
• Safeguards Publication

Form / Attachment / Pricing Sheet

This document, "EVRE DevSecOps Application Systems Product List," provides a comprehensive list of software languages and tools utilized within the Enterprise Management of Payments, Workload, and Reporting (eMPWR-VA) system. The eMPWR-VA system has replaced the legacy Finance and Accounting System (FAS) and includes enhanced capabilities such as a modern web-based UI, workflow management, business intelligence, and integration with other VA systems.

• System Name: Enterprise Management of Payments, Workload, and Reporting (eMPWR-VA)
• System Description: Replaced FAS legacy functionality, offering modern features and integrations.
• Software Languages: C++, Java, Oracle JAVA, PL/SQL, Scripting languages (Bash, Python), UNIX Shell Script.
• Software Tools: Amazon Web Services (AWS DMS, AWS RDS, AWS GovCloud, EC2, etc.), AnyPoint Platform (API Portal, Connectors, Exchange, Studio), Compado, Dimensions, Docker, Fortify, GIT, Jdeveloper, Jenkins, JIRA, Microsoft JET Engine Database, Microsoft Visual Studio, MuleSoft, Oracle Server, Oracle RDBMS, Oracle Reports Builder, Postman, RoboHelp, Rogue Wave, SalesForce (including Sandboxes and Shield, SaaS Platform), Selenium, SiteMinder, Solaris, Tableau (Desktop, Prep, Server), Tuxedo Server, VA GitHub, Visio, Visual Basic 6.

This product list is crucial for potential bidders as it details the technology stack and development environment for the eMPWR-VA system. Understanding these tools and languages will help vendors assess their capability to support, maintain, or develop within this specific technological framework. It informs decisions regarding resource allocation, skill requirements, and potential integration challenges for any related opportunity.

Other / Unclassified

This document is VA Directive 6404, dated February 23, 2016, titled "VA SYSTEMS INVENTORY (VASI)". It establishes the VA Systems Inventory (VASI) as the authoritative source for VA Information Technology (IT) Systems. The directive outlines the objectives, principles, roles, and responsibilities for the utilization, management, and sustainment of the VASI. It aims to manage current capabilities, prevent duplicative development efforts, and facilitate future planning for efficient and effective use of VA resources to deliver an integrated and interoperable information environment.

Key aspects include:

• Establishing VASI as the authoritative data source (ADS) for VA IT Systems.
• Aggregating identifying and descriptive information of VA IT Systems.
• Defining VA organizational roles and responsibilities for VASI management.
• Specifying criteria for registering VA business capabilities in VASI.
• Outlining responsibilities for various offices, including the Office of Information and Technology (OI&T), Service Delivery and Engineering (SDE), Product Development (PD), Office of Information Security (OIS), and Information Technology Resource Management (ITRM).
• Referencing related directives, policies, and definitions.
• Providing system identification criteria in Appendix A and implementation sources in Appendix B.

This directive is relevant to potential bidders as it establishes the framework and requirements for how VA manages and inventories its IT systems. Understanding this directive can provide insight into VA's IT infrastructure, data management practices, and the importance of system integration and interoperability, which may be relevant for IT-focused opportunities or for understanding the environment in which proposed solutions will operate.

Other / Unclassified

This document is VA Directive 6517, "Risk Management Framework for Cloud Computing Services," reissued on November 15, 2016. It establishes the Department of Veterans Affairs (VA) policy for adopting cloud computing services, aligning with the VA Cloud Computing Strategy and the Federal "Cloud First" policy. The directive outlines policy, roles, and responsibilities for evaluating and selecting secure cloud computing services for the VA.

This directive is relevant to potential bidders as it sets the framework and requirements for how the VA will procure and utilize cloud computing services. It mandates that all new technology solutions and existing solutions undergoing development, modernization, or enhancement must use cloud computing solutions, with specific criteria for exceptions. It also details the various roles and responsibilities within the VA for cloud computing, including the VA CIO, Cloud Broker, and Central Cloud Consumer, which may inform vendors on who to engage with and what processes to expect when offering cloud-based solutions to the VA. The document references numerous federal laws, OMB mandates, and NIST standards that bidders must be aware of when proposing cloud services.

Performance Work Statement (PWS)

This Performance Work Statement (PWS) outlines the requirements for providing portfolio-level technical management and coordination to develop and deliver secure Benefits Enterprise Services (BES) architecture, engineering, solutions, services, and data for the Department of Veterans Affairs (VA) Office of Information & Technology (OIT), Benefits and Memorials (BAM) Portfolio. The goal is to enhance the digital experience for Veterans by ensuring reliable, secure, and seamless delivery of benefits and services.

• Provide portfolio and product line management, maintaining strategy-to-execution alignment.

• Support business needs intake, prioritization, and execution through initiatives and epics.

• Manage dependencies, inputs, and outputs for integrated efforts.

• Streamline benefits systems and data for improved scalability and availability.

• Provide Development, Security, and Operations (DevSecOps) product support for the BAM Portfolio, Benefits Integration Platform (BIP), and associated Product Lines and Products.

• Deliver Agile software development iterations and Continuous Integration/Continuous Delivery (CI/CD).

• Provide training and help desk support.

• Transition legacy systems functionality and data to BIP and decommission legacy systems.

• Utilize lean scaled agile frameworks (e.g., SAFe) and blend development, security, operations, infrastructure, and architecture.

• Continuously improve solutions through configuration, enhancements, bug fixes, monitoring, testing, and analytics.

• Support requirements management, security, quality, compliance, automation, and customer-centric product usability.

• Adherence to Service Level Targets for system availability, recovery time, incident response, and monitoring.

• Compliance with Section 508 ICT Standards.

• Performance metrics will be monitored via a Quality Assurance Surveillance Plan (QASP).

• Period of Performance: One (1) 12-month base period with four (4) 12-month Option Periods.

• Place of Performance: Contractor facilities.

• Transition support from bid to BES during the base period.

• Adherence to numerous VA and Federal regulations, directives, and standards related to information security, privacy, Section 508, and agile development.

• Position/Task Risk Designation Levels require specific background investigations.

• Government Furnished Equipment (GFE) will be limited to laptops for network access; contractors must provide other IT accessories.

• Optional tasks include additional Product System Teams, Agile Development Teams, Help Desk Support, Training Teams, and Transition Support.

Other / Unclassified

This document is VA Directive 6500, "VA CYBERSECURITY PROGRAM," dated February 24, 2021. It reissues a previous directive to establish and maintain a VA cybersecurity and privacy program to protect VA information and IT systems. The directive outlines the program's structure, policies, and responsibilities, aligning with federal statutes and NIST guidelines.

While this document is an internal VA directive and not a solicitation, it establishes the foundational cybersecurity and privacy framework that governs VA's IT systems and data. Understanding this directive can provide insight into the security and privacy requirements that VA-related systems and services must adhere to, which may indirectly influence future contract requirements or expectations for vendors working with VA.

Key aspects include:

• Establishment of a Risk Executive Function and Information Security Knowledge Service.
• Alignment with NIST Cybersecurity Framework and Executive Order 13800.
• Definition of five core cybersecurity functions: Identify, Protect, Detect, Respond, and Recover.
• Detailed responsibilities for various VA offices and personnel regarding cybersecurity and privacy.
• References to numerous federal statutes, NIST publications, and other VA policies.