36C10B19R0046-027.docx

36C10B19R0046

PART I - THE SCHEDULE1. THIS CONTRACT IS A RATED ORDER

RATING

PAGE OF

PAGES

UNDER DPAS (15 CFR 700)

2. CONTRACT NUMBER

3. SOLICITATION NUMBER

4. TYPE OF SOLICITATION

5. DATE ISSUED

6. REQUISITION/PURCHASE NUMBER

SEALED BID (IFB)

NEGOTIATED (RFP)

7. ISSUED BY

CODE

8. ADDRESS OFFER TO

(If other than Item 7) NOTE: In sealed bid solicitations "offer" and "offeror" mean "bid" and "bidder".

9. Sealed offers in original and _____________________________ copies for furnishing the supplies or services in the Schedule will be received at the place specified in Item 8, or if handcarried, in the depository located in Until local time _______________________ (Hour) (Date) CAUTION - LATE Submissions, Modifications, and Withdrawals: See Section L, Provision No. 52.214-7 or 52.215-1. All Offers are subject to all terms and conditions contained in this solicitation.

A. NAME

B. TELEPHONE (NO COLLECT CALLS)

C. E-MAIL ADDRESS

AREA CODE

NUMBER

EXT.

(X)

SEC.

DESCRIPTION

PAGE(S)

(X)

SEC.

DESCRIPTION

PAGE(S)

PART I - THE SCHEDULE

PART II - CONTRACT CLAUSES

A

SOLICITATION/CONTRACT FORM

I

CONTRACT CLAUSES

B

SUPPLIES OR SERVICES AND PRICES/COSTS

PART III - LIST OF DOCUMENTS, EXHIBITS AND OTHER ATTACH.

C

DESCRIPTION/SPECS./WORK STATEMENT

J

LIST OF ATTACHMENTS

D

PACKAGING AND MARKING

PART IV - REPRESENTATIONS AND INSTRUCTIONS

E

INSPECTION AND ACCEPTANCE

F

DELIVERIES OR PERFORMANCE

G

CONTRACT ADMINISTRATION DATA

L

INSTR., CONDS., AND NOTICES TO OFFERORS

H

SPECIAL CONTRACT REQUIREMENTS

M

EVALUATION FACTORS FOR AWARD

K

REPRESENTATIONS, CERTIFICATIONS AND OTHER

STATEMENTS OF OFFERORS

NOTE: Item 12 does not apply if the solicitation includes the provisions at 52.214-16, Minimum Bid Acceptance Period.

12. In compliance with the above, the undersigned agrees, if this offer is accepted within ________ calendar days (60 calendar days unless a different period is inserted by the offeror) from the date for receipt of offers specified above, to furnish any or all items upon which prices are offered at the price set opposite each item, delivered at the designated point(s), within the time specified in the schedule.

13. DISCOUNT FOR PROMPT PAYMENT

10 CALENDAR DAYS (%)

20 CALENDAR DAYS (%)

30 CALENDAR DAYS (%)

CALENDAR DAYS (%)

(See Section I, Clause No. 52-232-8)

14. ACKNOWLEDGEMENT OF AMENDMENTS

AMENDMENT NO.

DATE

AMENDMENT NO.

DATE

(The offeror acknowledges receipt of amendments to the SOLICITATION for offerors and related documents numbered and dated:

DUNS:

DUNS+4:

CODE

FACILITY

16. NAME AND TITLE OF PERSON AUTHORIZED TO SIGN OFFER

15A. NAME AND

ADDRESS OF

OFFEROR

(Type or print)

15B. TELEPHONE NUMBER

17. SIGNATURE

18. OFFER DATE

AREA CODE

NUMBER

EXT.

15C. CHECK IF REMITTANCE ADDRESS IS DIFFERENT FROM

ABOVE - ENTER SUCH ADDRESS IN SCHEDULE

19. ACCEPTED AS TO ITEMS NUMBERED

20. AMOUNT

21. ACCOUNTING AND APPROPRIATION

22. AUTHORITY FOR USING OTHER THAN FULL AND OPEN COMPETITION:

23. SUBMIT INVOICES TO ADDRESS SHOWN IN

ITEM

(4 copies unless otherwise specified) 10 U.S.C. 2304(a) ( ) 41 U.S.C. 253(c) ( )

24. ADMINISTERED BY (If other than Item 7)

25. PAYMENT WILL BE MADE BY

CODE

CODE

PHONE:

FAX:

26. NAME OF CONTRACTING OFFICER (Type or print)

27. UNITED STATES OF AMERICA

28. AWARD DATE

IMPORTANT - Award will be made on this Form, or on Standard Form 26, or by other authorized official written notice.

(Signature of Contracting Officer)

(REV. 9-97)

10. FOR INFORMATION CALL:

11. TABLE OF CONTENTS

AUTHORIZED FOR LOCAL REPRODUCTION

STANDARD FORM 33

Previous edition is unusable Prescribed by GSA-FAR (48 CFR) 53.214(c)

SOLICITATION, OFFER AND AWARD

SOLICITATION

OFFER (Must be fully completed by offeror) AWARD (To be completed by Government) N/A 36C10B19R0046 X Department of Veterans Affairs Technology Acquisition Center 23 Christopher Way Eatontown NJ 07724 Department of Veterans Affairs Technology Acquisition Center 23 Christopher Way Eatontown NJ 07724 T4NG.Onramp@va.gov See Attached Table of Contents X X X X X X X X X X X X X Department of Veterans Affairs Technology Acquisition Center 23 Christopher Way Eatontown NJ 07724 Department of Veterans Affairs Technology Acquisition Center Financial Services Center PO Box 149971 Austin TX 78714-8971

SECTION A - SOLICITATION/CONTRACT FORM

SF 33 SOLICITATION, OFFER AND A

CONTENTS

SECTION B - SUPPLIES OR SERVICES AND PRICE/COSTS

B.1 GOVERNING LAW

Federal law and regulations, including the Federal Acquisition Regulations (FAR), shall govern this Contract/Order. Commercial license agreements may be made a part of this Contract/Order but only if both parties expressly make them an addendum hereto, as permitted by FAR 12.212. If the commercial license agreement is not made an addendum, it shall not apply, govern, be a part of or have any effect whatsoever on the Contract/Order; this includes, but is not limited to, any agreement embedded in the computer software (clickwrap), any agreement that is otherwise delivered with or provided to the Government with the commercial computer software or documentation (shrinkwrap), or any other license agreement otherwise referred to in any document. If a commercial license agreement is made an addendum, only those provisions addressing data rights regarding the Government’s use, duplication and disclosure of data (e.g., restricted computer software) are included and made a part of this Contract/Order, and only to the extent that those provisions are not duplicative or inconsistent with Federal law, Federal regulation, the incorporated FAR clauses and the provisions of this Contract/Order; those provisions in the commercial license agreement that do not address data rights regarding the Government’s use, duplication and disclosure of data shall not be included or made a part of the Contract/Order. Federal law and regulation including, without limitation, the Contract Disputes Act (41 U.S.C. § 7101 et seq.), the Anti-Deficiency Act (31 U.S.C. § 1341 et seq.), the Competition in Contracting Act (41 U.S.C. § 3301 et seq.), the Prompt Payment Act (31 U.S.C. § 3901 et seq.), Contracts for Data Processing or Maintenance (38 USC § 5725), and FAR clauses 52.212-4, 52.227-14, 52.227-19 shall supersede, control, and render ineffective any inconsistent, conflicting, or duplicative provision in any commercial license agreement. In the event of conflict between this Clause and any provision in the Contract/Order or the commercial license agreement or elsewhere, the terms of this Clause shall prevail. The Contractor shall deliver to the Government all data first produced under this Contract/Order with unlimited rights as defined by FAR 52.227-14. Claims of patent or copyright infringement brought against the Government as a party shall be defended by the U.S. Department of Justice (DOJ). 28 U.S.C. § 516. At the discretion of DOJ, the Contractor may be allowed reasonable participation in the defense of the litigation. Any additional changes to the Contract/Order must be made by modification (Standard Form 30) and shall only be effected by a warranted Contracting Officer. Nothing in this Contract/Order or any commercial license agreement shall be construed as a waiver of sovereign immunity.

B.2 HYBRID CONTRACT TYPE

The contract type is a hybrid containing: Firm-fixed-Price (FFP), Time-and-Materials (T&M)/Labor-hour (LH), Cost reimbursement (CR) line items.

B.3 PRICE SCHEDULE:

NOTE: FOR PROPOSAL PURPOSES ONLY, CLIN PRICING IS NOT REQUIRED IN SECTION B OF THIS SOLICITATION.

All price proposals must be submitted in the format provided at Section J, Attachment 001. The deliverables associated with Contract Line Item Numbers (CLIN) 1004 through 1010 shall be submitted for each task order and included in the price/cost of each task order. The specific deliverables under CLINs 1004 through 1010 will not be set forth under individual Task Orders.

PRICE SCHEDULE

SECURITY CLASS: Determined at Task Order Level This CLIN is to provide Information Technology (IT) services and incidental supplies on a FFP basis for a period of 60 months from date of award in accordance with (IAW) the Transformation Twenty-One Total Technology Next Generation (T4NG) Performance Work Statement (PWS) set forth in Section C.

Specific requirements and pricing shall be set forth under individual Task Orders.

Inspection, Acceptance, and Free on Board (FOB) Point shall be specified by incorporating the appropriate clauses from Sections E and F on each individual Task Order.

The delivery or performance schedule shall be determined on each individual Task Order.

SECURITY CLASS: Determined at Task Order Level This CLIN is to provide IT services and incidental supplies on a T&M/LH basis for a period of 60 months from date of award IAW the T4NG PWS set forth in Section C.

Specific requirements and pricing shall be set forth under individual Task Orders.

Inspection, Acceptance, and FOB Point shall be specified by incorporating the appropriate clauses from Sections E and F on each individual Task Order.

SECURITY CLASS: Determined at Task Order Level This CLIN is to provide IT services and incidental supplies on a CR basis for a period of 60 months from date of award IAW the T4NG PWS set forth in Section C.

Specific requirements and pricing shall be set forth under individual Task Orders.

Inspection, Acceptance, and FOB Point shall be specified by incorporating the appropriate clauses from Sections E and F on each individual Task Order.

Monthly Status Report shall be provided IAW Section C, PWS, Paragraph 8.1.1(A) and (B)(C)(D) and (E), and Section J Attachment 003 when applicable to Task Order contract type.

FOB Point: Destination Inspection/Acceptance: Destination

Contract Performance Report shall be provided IAW Section C, PWS, Paragraph 8.1.2 (A) and (B), and Section J Attachments 004 (T&M) and 005 (CR) when applicable to Task Order contract type. Report not applicable for FFP Task Orders.

Government Furnished Equipment Status Report shall be provided IAW Section C, PWS, Paragraph 8.1.3 (A-K) and Section J, Attachment 006.

Personnel Contractor Manpower Report shall be provided IAW Section C, PWS, Paragraph 8.1.4 (A-S) and Section J, Attachments 007 and 008.

Contractor Staff Roster shall be provided IAW Section C, PWS, Paragraph 8.1.5 and Section J, Attachment 009.

Small Business Participation Report shall be provided IAW Section H, clause H-4 Small Business Participation Requirements, and Section J, Attachment 010.

Veterans Employment Certification Report IAW Section H, clause H-5 and Section J, Attachment 011.

Contract Maximum/Minimum Ceiling:

IAW Section I, clause 52.216-22 entitled, “Indefinite Quantity” the Maximum value of the T4NG contract is $22.3 Billion. IAW Section I, clause 52.216-22 entitled, “Indefinite Quantity” the Minimum guaranteed value under the T4NG On-ramp contract is $250,000. The Government intends to compete initial orders to the maximum extent possible; however, the Government reserves the right to award initial orders on a sole source basis pursuant to FAR 16.505(b)(2)(i)(D) at amounts which may exceed the minimum guaranteed value.

The ceiling price as set forth in Section I, clause 52.232-7 entitled, “Payments under Time-and-Materials and Labor-Hour contracts” will be established for each individual Time-and Materials Task Order.

SECTION C - DESCRIPTION/SPECIFICATIONS/STATEMENT OF WORK

Performance Work Statement (PWS) for the

Transformation Twenty-One Total Technology Next Generation (T4NG) Program

DATE: JANUARY 25, 2019

Department of Veterans Affairs Office of Procurement, Acquisition and Logistics Technology Acquisition Center (TAC)

Contents

1.0 SCOPE

This PWS establishes the requirements for Contractor-provided solutions in support of IT. Contractor-provided solutions may support the Department of Veterans Affairs (VA) and other Federal Agencies. The Contractor shall provide total IT services solutions including the following functional areas: program management, strategy, enterprise architecture and planning; systems/software engineering; software technology demonstration and transition; test and evaluation; independent verification and validation; enterprise network; enterprise management framework; operations and maintenance; cybersecurity; training; IT facilities; and other solutions encompassing the entire range of IT and Health IT requirements, to include software and hardware incidental to the solution. Accordingly, Task Orders may include acquisitions of software and IT products. T4NG is not intended as a mechanism to solely purchase IT products. Such products may be purchased to the extent that those products are necessary to deliver the solution required. These services, as well as related IT products, may encompass the entire life-cycle of a system. Moreover, services and related products covered under this contract shall be global in reach and the Contractors must be prepared to provide services and deliverables worldwide.

This PWS provides general requirements. Specific requirements shall be defined in individual Task Orders. Functional area requirements are described in Section 4.0 and are not mutually exclusive for Task Order requirements. Requirements may fall within one specific functional area but in many cases, the requirements will encompass and apply across and within multiple functional areas to provide the total life cycle solution.

2.0 APPLICABLE DOCUMENTS

The Contractor shall comply with the documents listed below. Additional documents may be listed in individual Task Orders.

1. 44 U.S.C. § 3541-3549, “Federal Information Security Management Act (FISMA) of 2002”

2. “Federal Information Security Modernization Act of 2014”

3. Federal Information Processing Standards (FIPS) Publication 140-2, “Security Requirements For Cryptographic Modules”

4. FIPS Pub 199. Standards for Security Categorization of Federal Information and Information Systems, February 2004

5. FIPS Pub 200, Minimum Security Requirements for Federal Information and Information Systems, March 2016

6. FIPS Pub 201-2, “Personal Identity Verification of Federal Employees and Contractors,” August 2013

7. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

8. Public Law 109-461, Veterans Benefits, Health Care, and Information Technology Act of 2006, title IX Information Security Matters

9. 10 U.S.C. § 2224, "Defense Information Assurance Program"

10. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”

11. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, (http://www1.va.gov/vapubs/)

12. VA Handbook 0710, “Personnel Security and Suitability Program,” May 2, 2016 (http://www1.va.gov/vapubs/)

13. VA Directive 6102 (Internet/Intranet Services), July 15, 2008 (http://www1.va.gov/vapubs/)

14. VA Handbook 6102 (Internet/Intranet Services), July 15, 2008 (http://www1.va.gov/vapubs/)

15. Health Insurance Portability and Accountability Act (HIPAA); 45 CFR Part 160, 162, and 164; Health Insurance Reform: Security Standards; Final Rule dated February 20, 2003

16. VHA Handbook 1605.05, Business Associate Agreements, July 22, 2014(http://www.va.gov/vhapublications/)

17. 36 C.F.R. Part 1194 “Electronic and Information Technology Accessibility Standards,” July 1, 2003

18. Office of Management and Budget Circular A-130, “Managing Federal Information as a Strategic Resource”, July 28, 2016

19. U.S.C. Section 552a, as amended

20. Title 32 CFR 199, “Civilian Health and Medical Program of the Uniformed Services (CHAMPUS)”

21. An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule, October 2008

22. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. Section § 794d), as amended, January 18, 2017

23. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

24. VA Directive 6500, “Managing Information Security Risk: VA Information Security Program,” September 20, 2012 (http://www1.va.gov/vapubs/)

25. VA Handbook 6500, “Risk Management Framework for VA Information Systems – Tier 3: VA Information Security Program,” March 10, 2015 (http://www1.va.gov/vapubs/)

26. VA Handbook 6500.1, “Electronic Media Sanitization,” November 3, 2008 (http://www1.va.gov/vapubs/)

27. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI)”, July 28, 2016 (http://www1.va.gov/vapubs/)

28. VA Handbook 6500.3, “Assessment, Authorization, And Continuous Monitoring Of VA Information Systems,” February 3, 2014

29. VA Handbook, 6500.5, Incorporating Security and Privacy in System Development Lifecycle,” March 22, 2010 (http://www1.va.gov/vapubs/)

30. VA Handbook 6500.6, “Contract Security,” March 12, 2010 (http://www1.va.gov/vapubs/)

31. VA Handbook 6500.8, “Information System Contingency Planning”, April 6, 2011 (http://www1.va.gov/vapubs/)

32. Office of Information and Technology (OI&T) Process Asset Library (PAL) https://www.va.gov/process/. Reference Process Maps at https://www.va.gov/process/maps.asp and Artifact templates at https://www.va.gov/process/artifacts.asp

33. National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53 Rev 4, Security and Privacy Controls for Federal Information Systems and Organizations, January 22, 2015 (http://csrc.nist.gov/publications/PubsSPs.html)

34. Federal Travel Regulation (FTR) (www.gsa.gov/federaltravelregulation)

35. One-VA Technical Reference Model (TRM) (https://www.va.gov/trm/TRMHomePage.aspx)

36. Federal Segment Architecture Methodology (FSAM) v1.0, December 2008

37. VA Directive 6508, Implementation of Privacy Threshold Analysis and Privacy Impact Assessment, October 15, 2014 (http://www1.va.gov/vapubs/)

38. VA Handbook 6508.1, “Procedures for Privacy Threshold Analysis and Privacy Impact Assessment,” July 30, 2015

39. VA Handbook 6510, “VA Identity and Access Management”, January 15, 2016

40. VA Directive 6300, Records and Information Management, February 26, 2009 (http://www1.va.gov/vapubs/)

41. VA Handbook, 6300.1, Records Management Procedures, March 24, 2010 (http://www1.va.gov/vapubs/)

42. NIST SP 800-37 Rev 1, Guide for Applying the Risk Management Framework to Federal Information Systems: a Security Life Cycle Approach, June 5, 2014

43. OMB Memorandum, “Transition to IPv6”, September 28, 2010

44. OMB Memorandum “Security Authorization of Information Systems in Cloud Computing Environments” December 8, 2011 (FedRAMP Policy Memorandum)

45. VA Directive 6609, “Mailing of Sensitive Personal Information”, May 20, 2011 (http://www1.va.gov/vapubs/)

46. VA Enterprise Technology Strategic Plan, February 28, 2014

47. VA Directive 0735, Homeland Security Presidential Directive 12 (HSPD-12) Program, October 26, 2015 (http://www1.va.gov/vapubs/)

48. VA Handbook 0735, Homeland Security Presidential Directive 12 (HSPD-12) Program, March 24, 2014 (http://www1.va.gov/vapubs/)

49. OMB Memorandum M-06-18, Acquisition of Products and Services for Implementation of HSPD-12, June 30, 2006

50. OMB Memorandum 04-04, E-Authentication Guidance for Federal Agencies, December 16, 2003

51. OMB Memorandum 05-24, Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors, August 5, 2005

52. OMB memorandum M-11-11, “Continued Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors, February 3, 2011

53. OMB Memorandum, Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation, May 23, 2008

54. Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance, December 2, 2011

55. NIST SP 800-116 Rev 1, Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access, June 2018

56. OMB Memorandum M-07-16, Safeguarding Against and Responding to the Breach of Personally Identifiable Information, May 22, 2007

57. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, Digital Identity Guidelines, June 2017

58. NIST SP 800-157, Guidelines for Derived PIV Credentials, December 2014

59. NIST SP 800-164, Guidelines on Hardware-Rooted Security in Mobile Devices (Draft), October 2012

60. Draft National Institute of Standards and Technology Interagency Report (NISTIR) 7981 Mobile, PIV, and Authentication, March 2014

61. VA Memorandum, VAIQ #7100147, Continued Implementation of Homeland Security Presidential Directive 12 (HSPD-12), April 29, 2011 (https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

62. IAM Identity Management Business Requirements Guidance document, May 2013, (https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

63. VA Memorandum “Mandate to meet PIV Requirements for New and Existing Systems” (VAIQ# 7712300), June 30, 2015, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4846

64. Trusted Internet Connections (TIC) Reference Architecture Document, Version 2.2, Federal Interagency Technical Reference Architectures, Department of Homeland Security, June 19, 2017, https://www.dhs.gov/sites/default/files/publications/TIC_Ref_Arch_v2.2_2017.pdf

65. OMB Memorandum M-08-05, “Implementation of Trusted Internet Connections (TIC), November 20, 2007

66. OMB Memorandum M-08-23, Securing the Federal Government’s Domain Name System Infrastructure, August 22, 2008

67. VA Memorandum, VAIQ #7497987, Compliance – Electronic Product Environmental Assessment Tool (EPEAT) – IT Electronic Equipment, August 11, 2014 (reference Document Libraries, EPEAT/Green Purchasing Section, https://www.voa.va.gov/documentlistpublic.aspx?NodeID=552)

68. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (Public Law 110–140), December 19, 2007

69. Section 104 of the Energy Policy Act of 2005, (Public Law 109–58), August 8, 2005

70. Executive Order 13834, “Efficient Federal Operations”, dated May 17, 2018

71. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 2, 2001

72. VA Directive 0058, “VA Green Purchasing Program”, July 19, 2013 (http://www1.va.gov/vapubs/)

73. VA Handbook 0058, “VA Green Purchasing Program”, July 19, 2013 (http://www1.va.gov/vapubs/)

74. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote Access”, January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

75. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

76. VA Memorandum, “Implementation of Federal Personal Identity Verification (PIV) Credentials for Federal and Contractor Access to VA IT Systems”, (VAIQ# 7614373) July 9, 2015, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

77. VA Memorandum “Mandatory Use of PIV Multifactor Authentication to VA Information System” (VAIQ#7613595), June30, 2015, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

78. VA Memorandum “Mandatory Use of PIV Multifactor Authentication for Users with Elevated Privileges” (VAIQ#7613597), June30, 2015; https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

79. “Veteran Focused Integration Process (VIP) Guide 3.1”, April 2018, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

80. “VIP Release Process Guide”, Version 1.4, May 2016, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4411

81. “POLARIS User Guide”, Version 1.9, March 2017, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4412

82. VA Memorandum “Use of Personal Email (VAIQ #7581492)”, April 24, 2015, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

3.0 GENERAL REQUIREMENTS

The Contractor shall provide and/or acquire the services, hardware, and software required by individual Task Orders pursuant to the general requirements specified below.

3.1 Contract Type

This is an Indefinite Delivery/Indefinite Quantity (IDIQ) Multiple Award Task Order (MATO) contract. Individual Task Orders shall be issued on a performance-based T&M, CR, and/or FFP basis.

3.2 Ordering Period

The ordering period for the T4NG On-Ramp contract shall be approximately five (5) years commencing on the award effective date and ending March 6, 2026.

3.3 Hours of Work

Work at a Government site shall not take place on Federal holidays or weekends unless directed by the CO. The Contractor may also be required to support 24/7 operations 365 days per year as identified in individual Task Orders.

There are ten (10) Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, four are set by date:

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six (6) are set by a day of the week and month:

3.4 Place of Performance

The place of performance shall be identified in individual Task Orders. Locations will be Government or non-Government sites within the continental United States (CONUS) and/or outside the continental United States (OCONUS). Locations may include but are not limited to Federal, State, VA, or military data centers, facilities, regional offices, benefits delivery centers, medical treatment facilities, health clinics and Tricare facilities as defined in individual Task Orders.

3.5 Travel

Travel shall be IAW individual Task Order requirements. Travel details must be provided to and approved by the CO’s Representative (COR) or the Government designee prior to the commencement of travel. All travel shall be IAW the Federal Travel Regulations (FTR). OCONUS travel may require additional authorization and approvals as specified in the individual Task Order.

3.6 Materials, Equipment and Locations

3.6.1 Government-Furnished

Government Furnished Property (GFP) which includes Government Furnished Material (GFM), Government Furnished Information (GFI), and Government Furnished Equipment (GFE) may be provided and shall be identified in the individual Task Order. The Contractor shall be responsible for conducting all necessary examinations, inspections, maintenance, and tests upon receipt. The Contractor shall be responsible for reporting all inspection results, maintenance actions, losses, and damage to the Government through the VA Technology Acquisition Center (TAC) website.

VA may provide VA specific software as appropriate and required in individual Task Orders. The Contractor may utilize VA provided software development and test accounts, document and requirements repositories and others as required for the development, storage, maintenance and delivery of products. Contractors shall comply with VA security policies and procedures with respect to protecting sensitive data. See Section 6.0 for detailed security requirements.

3.6.2 Contractor-Acquired

The Contractor shall acquire and/or provide any hardware and/or software required to accomplish each Task Order that is not provided as GFP. Software integrity shall be maintained by the Contractor within the licensing agreement of the producer until such software is delivered to the Government, or otherwise disposed of IAW Government direction. Items delivered to the Government shall be approved by the Government in advance of purchase and shall be in compliance with PWS paragraphs 3.8 and A3.0. See Section 6.0 for detailed security requirements.

3.6.3 Non-Developmental Items and Commercial Processes

Non-Developmental Items (NDI), Commercial-Off-The-Shelf (COTS) and Government-Off-The-Shelf (GOTS) products shall be used to the maximum extent. The Contractor shall apply commercially available and industry best processes, standards and technologies to the maximum extent.

3.6.4 Connectivity

VA will provide connectivity to VA specific systems/network as required for execution of the task via VA approved remote access technology. Currently this may include but is not limited to Citrix Access Gateway (CAG), site-to-site VPN, or VA Remote Access Security Compliance Update Environment (RESCUE). This remote access will provide connectivity to VA specific software such as Veterans Health Information System and Technology Architecture (VistA), Electronic Health Record Modernization (EHRM), ServiceNow, ClearQuest, PAL, Primavera, and Remedy, including appropriate seat management and user licenses. VA may install equipment at the Contractor’s site to ensure security requirements are in place. The Contractor must meet the requirements of VA Handbook 6500 and will bear the cost to provide connectivity to VA. Other connectivity to VA systems may be authorized as appropriate in individual Task Orders.

3.6.5 Facilities

Work may be performed at either a Government or non-Government facility. Each Task Order shall delineate the location requirements.

3.6.5.1 Government Facilities

Certain Government office or laboratory space may be made available for performance of individual Task Orders. Contractors may be required to establish operations and support Government locations and shall comply with VA and/or Federal assessment and authorization (A&A) requirements. Such facilities shall be specified in the individual Task Order.

3.6.5.2 Non-Government Facilities

Personnel may perform at Contractor or remote facilities if specified in the individual task order. Contractors may be required to establish operations and support Contractor facilities and shall comply with VA and/or Federal A&A requirements. Such facilities shall be specified in the individual Task Order. The Contractor shall disclose specific facility information during the Request for Task Execution Plan (RTEP) process. All facilities shall be approved by VA and in compliance with PWS paragraph 6.0, Security and Privacy.

3.6.6 Warranty

Items acquired under this contract may require warranty protection. Commercial warranties shall be transferred to the Government. The type of warranty and extent of coverage shall be determined on an individual Task Order basis.

3.6.7 Marking, Handling, Storage, Preservation, Packaging, Tracking & Shipping The Contractor shall establish/maintain procedures IAW VA Handbook 6500 and VA Directive 6609 for handling, storage, preservation, packaging, marking, tracking and shipping to protect the quality of products and prevent damage, loss, deterioration, degradation or substitution of products.

3.6.8 Export Control

The Contractor shall comply with all applicable laws and regulations regarding export-controlled information and technology and shall not use, distribute, transfer or transmit technology (even if incorporated into products, software or other information) except in compliance with such laws and regulations. In addition, the Contractor shall plan for, obtain, and maintain any and all export licensing required to satisfy individual Task Order requirements.

3.7 Safety and Environmental

Safety and environmental procedures shall be identified in individual Task Order requirements.

The Contractor shall comply with the Office of Federal Sustainability Acquisition and Electronics Stewardship initiatives as identified in individual Task Orders IAW the policies referenced at https://www.sustainability.gov/resources-eo-efo.html

3.8 Enterprise and IT Framework

3.8.1 VA Technical Reference Model

For VA specific task orders, the Contractor shall support the VA enterprise management framework. In association with the framework, the Contractor shall comply with OI&T Technical Reference Model (VA TRM) and consider the VA Enterprise Technology Strategic Plan. The VA TRM is one component within the overall Enterprise Architecture (EA) that establishes a common vocabulary and structure for describing the IT used to develop, operate, and maintain enterprise applications. Moreover, the VA TRM, which includes the Standards Profile and Product List, serves as a technology roadmap and tool for supporting OI&T.

3.8.2 Federal Identity, Credential, And Access Management (FICAM)

The Contractor shall ensure Commercial Off-The-Shelf (COTS) product(s), software configuration and customization, and/or new software are Personal Identity Verification (PIV) card-enabled by accepting HSPD-12 PIV credentials using VA Enterprise Technical Architecture (ETA), https://www.ea.oit.va.gov/EAOIT/VA_EA/Enterprise_Technical_Architecture.asp, and VA Identity and Access Management (IAM) approved enterprise design and integration patterns, http://www.techstrategies.oit.va.gov/enterprise_dp.asp. The Contractor shall ensure all Contractor delivered applications and systems comply with the VA Identity, Credential, and Access Management policies and guidelines set forth in the VA Handbook 6510 and align with the Federal Identity, Credential, and Access Management Roadmap and Implementation Guidance v2.0.

The Contractor shall ensure all Contractor delivered applications and systems provide user authentication services compliant with the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-63-3, VA Handbook 6500 Appendix F, “VA System Security Controls,” and VA IAM enterprise requirements for direct, assertion based authentication, and/or trust based authentication, as determined by the design and integration patterns. Direct authentication at a minimum must include Public Key Infrastructure (PKI) based authentication supportive of PIV card and/or Common Access Card (CAC), as determined by the business need.

The Contractor shall ensure all Contractor delivered applications and systems conform to the specific Identity and Access Management PIV requirements set forth in the Office of Management and Budget (OMB) Memoranda M-04-04, M-05-24, M-11-11, and NIST Federal Information Processing Standard (FIPS) 201-2. OMB Memoranda M-04-04, M-05-24, and M-11-11 can be found at: https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/omb/memoranda/fy04/m04-04.pdf, https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/omb/memoranda/fy2005/m05-24.pdf, and https://obamawhitehouse.archives.gov/sites/default/files/omb/memoranda/2011/m11-11.pdf respectively. Contractor delivered applications and systems shall be on the FIPS 201-2 Approved Product List (APL). If the Contractor delivered application and system is not on the APL, the Contractor shall be responsible for taking the application and system through the FIPS 201 Evaluation Program.

The Contractor shall ensure all Contractor delivered applications and systems support:

1. Automated provisioning and are able to use enterprise provisioning service.

2. Interfacing with VA’s Master Veteran Index (MVI) to provision identity attributes, if the solution relies on VA user identities. MVI is the authoritative source for VA user identity data.

3. The VA defined unique identity (Secure Identifier [SEC ID] / Integrated Control Number [ICN]).

4. Multiple authenticators for a given identity and authenticators at every Authenticator Assurance Level (AAL) appropriate for the solution.

5. Identity proofing for each Identity Assurance Level (IAL) appropriate for the solution.

6. Federation for each Federation Assurance Level (FAL) appropriate for the solution, if applicable.

7. Two-factor authentication (2FA) through an applicable design pattern as outlined in VA Enterprise Design Patterns.

8. A Security Assertion Markup Language (SAML) implementation if the solution relies on assertion based authentication. Additional assertion implementations, besides the required SAML assertion, may be provided as long as they are compliant with NIST SP 800-63-3 guidelines.

9. Authentication/account binding based on trusted Hypertext Transfer Protocol (HTTP) headers is the solution relies on Trust based authentication.

10. Role Based Access Control.

11. Auditing and reporting capabilities.

12. Compliance with VAIQ# 7712300 Mandate to meet PIV requirements for new and existing systems. https://www.voa.va.gov/DocumentView.aspx?DocumentID=4846 The required Assurance Levels for this specific effort are Identity Assurance Level 3, Authenticator Assurance Level 3, and Federation Assurance Level 3.

3.8.3 Internet Protocol Version 6 (Ipv6)

The Contractor solution shall support the latest Internet Protocol Version 6 (IPv6) based upon the directives issued by the Office of Management and Budget (OMB) on August 2, 2005 (https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/omb/memoranda/fy2005/m05-22.pdf) and September 28, 2010 (https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/egov_docs/transition-to-ipv6.pdf). IPv6 technology, in accordance with the USGv6 Profile, NIST Special Publication (SP) 500-267 (https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication500-267.pdf), the Technical Infrastructure for USGv6 Adoption (https://www.nist.gov/programs-projects/usgv6-program), and the NIST SP 800 series applicable compliance () shall be included in all IT infrastructures, application designs, application development, operational systems and sub-systems, and their integration. In addition to the above requirements, all devices shall support native IPv6 and/or dual stack (IPv6 / IPv4) connectivity without additional memory or other resources being provided by the Government, so that they can function in a mixed environment. All public/external facing servers and services (e.g. web, email, DNS, ISP services, etc.) shall support native IPv6 and/or dual stack (IPv6/ IPv4) users and all internal infrastructure and applications shall communicate using native IPv6 and/or dual stack (IPv6/ IPv4) operations. Guidance and support of improved methodologies which ensure interoperability with legacy protocol and services in dual stack solutions, in addition to OMB/VA memoranda, can be found at: https://www.voa.va.gov/documentlistpublic.aspx?NodeID=282.

3.8.4 Trusted Internet Connection (TIC)

The Contractor solution shall meet the requirements outlined in Office of Management and Budget Memorandum M08-05 mandating Trusted Internet Connections (TIC) (https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/omb/memoranda/fy2008/m08-05.pdf), M08-23 mandating Domain Name System Security (NSSEC) (https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/omb/memoranda/fy2008/m08-23.pdf), and shall comply with the Trusted Internet Connections (TIC) Reference Architecture Document, Version 2.0 https://www.dhs.gov/sites/default/files/publications/TIC_Ref_Arch_v2.2_2017.pdf.

3.8.5 Standard Computer Configuration

The Contractor IT end user solution that is developed for use on standard VA computers shall be compatible with and be supported on the standard VA operating system, currently Windows 10 (64bit), Internet Explorer 11, and Office 365 ProPlus. Applications delivered to the VA and intended to be deployed to Windows 10 workstations shall be delivered as a signed .msi package with switches for silent and unattended installation and updates shall be delivered in signed .msp file formats for easy deployment using System Center Configuration Manager (SCCM) VA’s current desktop application deployment tool. Signing of the software code shall be through a vendor provided certificate that is trusted by the VA using a code signing authority such as Verizon/Cybertrust or Symantec/VeriSign. The Contractor shall also ensure and certify that their solution functions as expected when used from a standard VA computer, with non-admin, standard user rights that have been configured using the United States Government Configuration Baseline (USGCB) and Defense Information Systems Agency (DISA) Secure Technical Implementation Guide (STIG) specific to the particular client operating system being used.

3.8.6 Enterprise Management Framework

The Enterprise Management Framework (EMF) provides an enterprise-wide view of VA IT systems comprised of tools, reports, databases, dashboards, and analytics. EMF enables OI&T to view the health and performance of systems and provides intelligent analysis and trending that enables proactive enterprise system management. Performance, availability, user experience and reliability of IT service delivery is improved as OI&T is able to make strategic, operational and investment decisions based on real-time information.

EMF supports a unified enterprise service management model including release management, configuration management, change management, and incident management aligned with industry standard IT Infrastructure Library (ITIL) service management best practices. The EMF Federated Data Repository (FDR) includes the implementation of a foundational component. The EMF FDR is a national repository that collects enterprise IT management data from VA Managed Data Repositories (MDRs) and integrates with existing VA monitoring and performance systems.

Additional frameworks may be specified in individual task orders.

3.8.7 Authoritative Data Sources

The VA Enterprise Architecture Repository (VEAR) is one component within the overall Enterprise Architecture (EA) that establishes the common framework for data taxonomy for describing the data architecture used to develop, operate, and maintain enterprise applications. The Contractor shall comply with the department’s Authoritative Data Source (ADS) requirement that VA systems, services, and processes throughout the enterprise shall access VA data solely through official VA ADSs where applicable, see below. The Information Classes which compose each ADS are located in the VEAR, in the Data & Information domain. The Contractor shall ensure that all delivered applications and system solutions support:

1. Interfacing with VA’s Master Veteran Index (MVI) to provision identity attributes, if the solution relies on VA user identities. MVI is the authoritative source for VA user identity data.

2. Interfacing with Capital Asset Inventory (CAI) to conduct real property record management actions, if the solution relies on real property records data. CAI is the authoritative source for VA real property record management data.

3. Interfacing with electronic Contract Management System (eCMS) for access to contract, contract line item, purchase requisition, offering vendor and vendor, and solicitation information above the micro-purchase threshold, if the solution relies on procurement data. ECMS is the authoritative source for VA procurement actions data.

4. Interfacing with HRSmart Human Resources Information System to conduct personnel action processing, on-boarding, benefits management, and compensation management, if the solution relies on personnel data. HRSmart is the authoritative source for VA personnel information data.

5. Interfacing with Vet360 to access personal contact information, if the solution relies on VA Veteran personal contact information data. Vet360 is the authoritative source for VA Veteran Personal Contact Data.

6. Interfacing with VA/Department of Defense (DoD) Identity Repository (VADIR) for determining eligibility for VA benefits under Title 38, if the solution relies on qualifying active duty military service data. VADIR is the authoritative source for Qualifying Active Duty military service in the VA.

3.9 Development Methodologies

The Contractor may support a Service-Oriented Architecture (SOA) that is a flexible set of design principles used during the phases of systems development and integration which will be specified at the task order level. The deployed SOA-based architecture will be deployed on a secure, scalable, interoperable and dynamic platform that has the end to end visibility and manageability from application services to the networking components level and that can be used within multiple domains.

For VA specific task orders, the Contractor shall support VA efforts IAW the Veteran Focused Integration Process (VIP). VIP is a Lean-Agile framework that services the interest of Veterans through the efficient streamlining of activities that occur within the enterprise. The VIP Guide can be found at https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371. The VIP framework creates an environment delivering more frequent releases through a deeper application of Agile practices.