36C10B23R0011_5.docx

36C10B23R0011

GENERAL INFORMATION

SET-ASIDE

Technology Acquisition Center

23 Christopher Way Eatontown NJ 07724

POINT OF CONTACT*

T4NG2.TAC@va.gov T4NG2.TAC@va.gov

PLACE OF PERFORMANCE

ADDRESS

POSTAL CODE

COUNTRY

ADDITIONAL INFORMATION

AGENCY’S URL

URL DESCRIPTION

AGENCY CONTACT’S EMAIL ADDRESS

DESCRIPTION

Transformation Twenty-One Total Technology Next Generation 2 Second Draft Request for Proposal February 14, 2023 ---

The Department of Veterans Affairs (VA) Technology Acquisition Center (TAC) located at 23 Christopher Way, Eatontown, NJ intends to issue a solicitation for the Transformation Twenty-One Total Technology 2 (T4NG2) effort.

This Request for Proposal (RFP) is posted in a DRAFT format. In response to the DRAFT RFP, the Government will accept questions and comments submitted to T4NG2.TAC@va.gov no later than 1 p.m. Eastern Standard Time on February 21, 2023. The subject line should clearly read: “Questions in response to Second DRAFT T4NG2 RFP”. Any questions/comments submitted by potential Offerors will be treated on a non-attribution basis and considered source selection sensitive.

In addition to the Second Draft RFP, please see attached Questions and Answers. Potential Offerors are cautioned that you may not see your exact submission as duplicative question(s) and/or suggestion(s) may have been removed. If you feel your question was missed for any reason, VA kindly requests you resubmit your question(s).

Offerors are cautioned that the RFP is a DRAFT that is subject to change. Lastly, the information documented in the Questions and Answers is subject to change as the solicitation continues to evolve. Therefore, the information contained within the Questions and Answers does not take precedence to the forthcoming final T4NG2 solicitation.

Modification to a Previous Notice Modification to a Previous Notice

Modification to a Previous Notice

1. THIS CONTRACT IS A RATED ORDER

RATING

PAGE OF

PAGES

UNDER DPAS (15 CFR 700)

2. CONTRACT NUMBER

3. SOLICITATION NUMBER

4. TYPE OF SOLICITATION

5. DATE ISSUED

6. REQUISITION/PURCHASE NUMBER

SEALED BID (IFB)

NEGOTIATED (RFP)

7. ISSUED BY

CODE

8. ADDRESS OFFER TO

(If other than Item 7) NOTE: In sealed bid solicitations "offer" and "offeror" mean "bid" and "bidder".

9. Sealed offers in original and _____________________________ copies for furnishing the supplies or services in the Schedule will be received at the place specified in Item 8, or if handcarried, in the depository located in Until local time _______________________ (Hour) (Date) CAUTION - LATE Submissions, Modifications, and Withdrawals: See Section L, Provision No. 52.214-7 or 52.215-1. All Offers are subject to all terms and conditions contained in this solicitation.

A. NAME

B. TELEPHONE (NO COLLECT CALLS)

C. E-MAIL ADDRESS

AREA CODE

NUMBER

EXT.

(X)

SEC.

DESCRIPTION

PAGE(S)

(X)

SEC.

DESCRIPTION

PAGE(S)

PART I - THE SCHEDULE

PART II - CONTRACT CLAUSES

A

SOLICITATION/CONTRACT FORM

I

CONTRACT CLAUSES

B

SUPPLIES OR SERVICES AND PRICES/COSTS

PART III - LIST OF DOCUMENTS, EXHIBITS AND OTHER ATTACH.

C

DESCRIPTION/SPECS./WORK STATEMENT

J

LIST OF ATTACHMENTS

D

PACKAGING AND MARKING

PART IV - REPRESENTATIONS AND INSTRUCTIONS

E

INSPECTION AND ACCEPTANCE

F

DELIVERIES OR PERFORMANCE

G

CONTRACT ADMINISTRATION DATA

L

INSTR., CONDS., AND NOTICES TO OFFERORS

H

SPECIAL CONTRACT REQUIREMENTS

M

EVALUATION FACTORS FOR AWARD

K

REPRESENTATIONS, CERTIFICATIONS AND OTHER

STATEMENTS OF OFFERORS

NOTE: Item 12 does not apply if the solicitation includes the provisions at 52.214-16, Minimum Bid Acceptance Period.

12. In compliance with the above, the undersigned agrees, if this offer is accepted within ________ calendar days (60 calendar days unless a different period is inserted by the offeror) from the date for receipt of offers specified above, to furnish any or all items upon which prices are offered at the price set opposite each item, delivered at the designated point(s), within the time specified in the schedule.

13. DISCOUNT FOR PROMPT PAYMENT

10 CALENDAR DAYS (%)

20 CALENDAR DAYS (%)

30 CALENDAR DAYS (%)

CALENDAR DAYS (%)

(See Section I, Clause No. 52-232-8)

14. ACKNOWLEDGEMENT OF AMENDMENTS

AMENDMENT NO.

DATE

AMENDMENT NO.

DATE

(The offeror acknowledges receipt of amendments to the SOLICITATION for offerors and related documents numbered and dated:

DUNS:

DUNS+4:

CODE

FACILITY

16. NAME AND TITLE OF PERSON AUTHORIZED TO SIGN OFFER

15A. NAME AND

ADDRESS OF

OFFEROR

(Type or print)

15B. TELEPHONE NUMBER

17. SIGNATURE

18. OFFER DATE

AREA CODE

NUMBER

EXT.

15C. CHECK IF REMITTANCE ADDRESS IS DIFFERENT FROM

ABOVE - ENTER SUCH ADDRESS IN SCHEDULE

19. ACCEPTED AS TO ITEMS NUMBERED

20. AMOUNT

21. ACCOUNTING AND APPROPRIATION

22. AUTHORITY FOR USING OTHER THAN FULL AND OPEN COMPETITION:

23. SUBMIT INVOICES TO ADDRESS SHOWN IN

ITEM

(4 copies unless otherwise specified) 10 U.S.C. 2304(a) ( ) 41 U.S.C. 253(c) ( )

24. ADMINISTERED BY (If other than Item 7)

25. PAYMENT WILL BE MADE BY

CODE

CODE

PHONE:

FAX:

26. NAME OF CONTRACTING OFFICER (Type or print)

27. UNITED STATES OF AMERICA

28. AWARD DATE

IMPORTANT - Award will be made on this Form, or on Standard Form 26, or by other authorized official written notice.

(Signature of Contracting Officer)

(REV. 9-97)

10. FOR INFORMATION CALL:

11. TABLE OF CONTENTS

AUTHORIZED FOR LOCAL REPRODUCTION

STANDARD FORM 33

Previous edition is unusable Prescribed by GSA-FAR (48 CFR) 53.214(c)

SOLICITATION, OFFER AND AWARD

SOLICITATION

OFFER (Must be fully completed by offeror) AWARD (To be completed by Government) N/A 36C10B23R0011 X Department of Veterans Affairs Technology Acquisition Center 23 Christopher Way Eatontown NJ 07724 Department of Veterans Affairs Technology Acquisition Center 23 Christopher Way Eatontown NJ 07724

T4NG2.TAC@va.gov See Attached Table of Contents X X X X X X X X X X X X X Department of Veterans Affairs Technology Acquisition Center 23 Christopher Way Eatontown NJ 07724 Department of Veterans Affairs Technology Acquisition Center Financial Services Center PO Box 149971 Austin TX 78714-8971

)PART I - THE SCHEDULE

SECTION A - SOLICITATION/CONTRACT FORM

SF 33 SOLICITATION, OFFER AND A

CONTENTS

SECTION B - SUPPLIES OR SERVICES AND PRICE/COSTS

B.1 GOVERNING LAW

Federal law and regulations, including the Federal Acquisition Regulations (FAR), shall govern this Contract/Order. Commercial license agreements may be made a part of this Contract/Order but only if both parties expressly make them an addendum hereto, as permitted by FAR 12.212. If the commercial license agreement is not made an addendum, it shall not apply, govern, be a part of or have any effect whatsoever on the Contract/Order; this includes, but is not limited to, any agreement embedded in the computer software (clickwrap), any agreement that is otherwise delivered with or provided to the Government with the commercial computer software or documentation (shrinkwrap), or any other license agreement otherwise referred to in any document. If a commercial license agreement is made an addendum, only those provisions addressing data rights regarding the Government’s use, duplication and disclosure of data (e.g., restricted computer software) are included and made a part of this Contract/Order, and only to the extent that those provisions are not duplicative or inconsistent with Federal law, Federal regulation, the incorporated FAR clauses and the provisions of this Contract/Order; those provisions in the commercial license agreement that do not address data rights regarding the Government’s use, duplication and disclosure of data shall not be included or made a part of the Contract/Order. Federal law and regulation including, without limitation, the Contract Disputes Act (41 U.S.C. § 7101 et seq.), the Anti-Deficiency Act (31 U.S.C. § 1341 et seq.), the Competition in Contracting Act (41 U.S.C. § 3301 et seq.), the Prompt Payment Act (31 U.S.C. § 3901 et seq.), Contracts for Data Processing or Maintenance (38 USC § 5725), and FAR clauses 52.212-4, 52.227-14, 52.227-19 shall supersede, control, and render ineffective any inconsistent, conflicting, or duplicative provision in any commercial license agreement. In the event of conflict between this clause and any provision in the Contract/Order or the commercial license agreement or elsewhere, the terms of this clause shall prevail. The Contractor shall deliver to the Government all data first produced under this Contract/Order with unlimited rights as defined by FAR 52.227-14. Claims of patent or copyright infringement brought against the Government as a party shall be defended by the U.S. Department of Justice (DOJ) in accordance with 28 U.S.C. § 516; at the discretion of DOJ, the Contractor may be allowed reasonable participation in the defense of the litigation. Any additional changes to the Contract/Order must be made by modification (Standard Form 30) and shall only be made by a warranted Contracting Officer. Nothing in this Contract/Order or any commercial license agreement shall be construed as a waiver of sovereign immunity.

B.2 HYBRID CONTRACT TYPE

The contract type is a hybrid containing: Firm-fixed-Price (FFP), Time-and-Materials (T&M)/Labor-hour (LH), Cost reimbursement (CR) line items. Resulting task orders may include incentive and/or award term arrangements.

B.3 PRICE SCHEDULE:

NOTE: FOR PROPOSAL PURPOSES ONLY, CLIN PRICING IS NOT REQUIRED IN SECTION B OF THIS SOLICITATION.

All price proposals must be submitted in the format provided at Section J, Attachment 001. The deliverables associated with Contract Line Item Numbers (CLIN) 0004 through 0011 shall be submitted for each task order and included in the price/cost of each task order. The specific deliverables under CLINs 0004 through 0011 will not be set forth under individual Task Orders.

PRICE SCHEDULE

BASE PERIOD

SECURITY CLASS: Determined at Task Order Level This CLIN is to provide Information Technology (IT) services and incidental supplies on a FFP basis for a period of 60 months from date of award in accordance with (IAW) the Transformation Twenty-One Total Technology Next Generation Two (T4NG2) Performance Work Statement (PWS) set forth in Section C.

Specific requirements and pricing shall be set forth under individual Task Orders.

Inspection, Acceptance, and Free on Board (FOB) Point shall be specified by incorporating the appropriate clauses from Sections E and F on each individual Task Order.

The delivery or performance schedule shall be determined on each individual Task Order.

SECURITY CLASS: Determined at Task Order Level This CLIN is to provide IT services and incidental supplies on a T&M/LH basis for a period of 60 months from date of award IAW the T4NG2 PWS set forth in Section C.

Specific requirements and pricing shall be set forth under individual Task Orders.

Inspection, Acceptance, and FOB Point shall be specified by incorporating the appropriate clauses from Sections E and F on each individual Task Order.

SECURITY CLASS: Determined at Task Order Level This CLIN is to provide IT services and incidental supplies on a CR basis for a period of 60 months from date of award IAW the T4NG2 PWS set forth in Section C.

Specific requirements and pricing shall be set forth under individual Task Orders.

Inspection, Acceptance, and FOB Point shall be specified by incorporating the appropriate clauses from Sections E and F on each individual Task Order.

Quarterly Status Report shall be provided IAW Section C, PWS, Paragraph 8.1.1(A) and (B)(C)(D) and (E), and Section J Attachment 003 when applicable to Task Order contract type.

FOB Point: Destination Inspection/Acceptance: Destination

Contract Performance Report shall be provided IAW Section C, PWS, Paragraph 8.1.2 (A) and (B), and Section J Attachments 004 (T&M) and 005 (CR) when applicable to Task Order contract type. Report not applicable for FFP Task Orders.

Government Furnished Equipment Status Report shall be provided IAW Section C, PWS, Paragraph 8.1.3 (A-K) and Section J, Attachment 006.

Personnel Contractor Manpower Report shall be provided IAW Section C, PWS, Paragraph 8.1.4 (A-S) and Section J, Attachment 008.

Contractor Staff Roster shall be provided IAW Section C, PWS, Paragraph 8.1.5 and Section J, Attachment 009.

Small Business Participation Report shall be provided IAW Section H, clause H-4 Small Business Participation Requirements, and Section J, Attachment 010.

Veterans Employment Certification Report IAW Section H, clause H-5 and Section J, Attachment 011.

Final Section 508 Compliance Test Results IAW PWS Paragraph 8.1, Reporting Requirements.

Option Period One This 60-month option period may be exercised at the Government’s discretion IAW FAR 52.217-9, Option to Extend the Term of the Contract (MAR 2000). Work shall not commence until, and unless, a formal modification is issued by the Contracting Officer (CO). If exercised, this option shall commence immediately after expiration of the base period.

PRICE SCHEDULE

OPTION PERIOD

SECURITY CLASS: Determined at Task Order Level This CLIN is to provide IT services and incidental supplies on a FFP basis for a period of 60 months from date of option exercise IAW the T4NG2 PWS set forth in Section C.

Specific requirements and pricing shall be set forth under individual Task Orders.

Inspection, Acceptance, and Free on Board (FOB) Point shall be specified by incorporating the appropriate clauses from Sections E and F on each individual Task Order.

SECURITY CLASS: Determined at Task Order Level This CLIN is to provide IT services and incidental supplies on a T&M/LH basis for a period of 60 months from date of option exercise IAW the T4NG2 PWS set forth in Section C.

Specific requirements and pricing shall be set forth under individual Task Orders.

Inspection, Acceptance, and FOB Point shall be specified by incorporating the appropriate clauses from Sections E and F on each individual Task Order.

SECURITY CLASS: Determined at Task Order Level This CLIN is to provide IT services and incidental supplies on a CR basis for a period of 60 months from date of option exercise IAW the T4NG2 PWS set forth in Section C.

Specific requirements and pricing shall be set forth under individual Task Orders.

Inspection, Acceptance, and FOB Point shall be specified by incorporating the appropriate clauses from Sections E and F on each individual Task Order.

Quarterly Status Report shall be provided IAW Section C, PWS, Paragraph 8.1.1(A) and (B)(C)(D) and (E), and Section J Attachment 003 when applicable to Task Order contract type.

Task Order Level

Quarterly Contract Performance Report shall be provided IAW Section C, PWS, Paragraph 8.1.2 (A) and (B), and Section J Attachments 004 (T&M) and 005 (CR) when applicable to Task Order contract type. Report not applicable for FFP Task Orders.

Quarterly Government Furnished Equipment Status Report shall be provided IAW Section C, PWS, Paragraph 8.1.3 (A-K) and Section J, Attachment 006.

Quarterly Personnel Contractor Manpower Report shall be provided IAW Section C, PWS, Paragraph 8.1.4 (A-S) and Section J, Attachment 008.

Due within thee (3) business days of Task Order award. Contractor Staff Roster shall be provided IAW Section C, PWS, Paragraph 8.1.5 and Section J, Attachment 009.

Quarterly Small Business Participation Report shall be provided IAW Section H, clause H.4 Small Business Participation Requirements, PWS Paragraph 8.1.6 and Section J, Attachment 010.

Quarterly Veterans Employment Certification Report IAW Section H, clause H.5, PWS Paragraph 8.1.7 and Section J, Attachment 011.

Final Section 508 Compliance Test Results IAW PWS Paragraph 8.1, Reporting Requirements.

Contract Maximum/Minimum Ceiling:

IAW Section I, clause 52.216-22 entitled, “Indefinite Quantity” the maximum overall value of the T4NG2 contract for both the base period and options is $60.7 Billion. IAW Section I, clause 52.216-22 entitled, “Indefinite Quantity” the Minimum guaranteed value under the T4NG2 contract is $1,000. The Government may award initial orders at the time of the basic contract award on a sole source basis pursuant to FAR 16.505(b)(2)(iv) in the amount of $1,000; however, the Government reserves the right to award initial orders at amounts which may exceed the minimum guaranteed value. The initial order, in the amount of $1,000, may require the Contractor to deliver a report that addresses aspects including, but not limited to, the following: 1) A brief narrative on the skills and expertise of the prime and each subcontractor, and which functional area(s) each is performing as identified in PWS Paragraph 4.0 and its subparagraphs; 2) The Contractor’s approach to recognize, react to and correct problems that may arise in the performance of a task order or the basic contract. This approach shall include an escalation plan for any problems that do arise; 3) The Contractor’s organizational chart that includes titles and names of respective individuals; 4) The Contractor’s processes to capture performance and contract metrics that will ensure execution of individual task orders in accordance with schedule, cost and technical requirements.; and, 5) The Contractor’s approach to maintain and exceed its Small Business Participation and Veterans Employment metrics. There will be no guaranteed minimum order for the option period, if exercised.

The ceiling price as set forth in Section I, clause 52.232-7 entitled, “Payments under Time-and-Materials and Labor-Hour contracts” will be established for each individual Time-and Materials Task Order.

36C10B23R0011

SECTION C - DESCRIPTION/SPECIFICATIONS/STATEMENT OF WORK

Performance Work Statement (PWS) for the

Transformation Twenty-One Total Technology Next Generation (T4NG)2 Program

DATE: February 14, 2023 Department of Veterans Affairs Office of Procurement, Acquisition and Logistics Technology Acquisition Center (TAC)

Version History

Contents

1.0 SCOPE

This PWS establishes the requirements for Contractor-provided solutions and services in support of Information Technology (IT). Contractor-provided solutions may support the Department of Veterans Affairs (VA) and other Federal Agencies. The Contractor shall provide total IT service solutions to include the following functional areas: program management, strategy, enterprise architecture and planning; systems/software engineering; software technology demonstration and transition; test and evaluation; independent verification and validation; enterprise network; enterprise management framework; operations and maintenance; cybersecurity; training; IT facilities; and other solutions encompassing the entire range of IT and Health IT requirements, to include software and hardware incidental to the solution. Accordingly, Task Orders may include acquisitions of software and IT products. T4NG is not intended as a mechanism to solely purchase IT products. Such products may be purchased to the extent that those products are necessary to deliver the solution required. IT services, as well as related IT products, may encompass the entire life-cycle of a system. Moreover, IT services and related products covered under this contract shall be global in reach and the Contractors must be prepared to provide services and deliverables worldwide.

This PWS provides general requirements. Specific requirements shall be defined in individual Task Orders. Functional area requirements are described in Section 4.0 and are not mutually exclusive for Task Order requirements. Requirements may fall within one specific functional area but in many cases, the requirements will encompass and apply across and within multiple functional areas to provide the total life cycle solution.

2.0 APPLICABLE DOCUMENTS

The Contractor shall comply with the documents listed below. Additional documents may be listed in individual Task Orders.

1. 44 U.S.C. § 3541-3549, “Federal Information Security Management Act (FISMA) of 2002”

2. “Federal Information Security Modernization Act of 2014”

3. Federal Information Processing Standards (FIPS) Publication 140-2, “Security Requirements for Cryptographic Modules”

4. FIPS Pub 199. “Standards for Security Categorization of Federal Information and Information Systems,” February 2004

5. FIPS Pub 200, “Minimum Security Requirements for Federal Information and Information Systems,” March 2006

6. FIPS Pub 201-2, “Personal Identity Verification of Federal Employees and Contractors,” August 2013

7. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

8. Public Law 109-461, Veterans Benefits, Health Care, and Information Technology Act of 2006, title IX Information Security Matters

9. 10 U.S.C. § 2224, "Defense Information Assurance Program"

10. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”

11. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, (https://www.va.gov/vapubs/index.cfm)

12. VA Handbook 0710, “Personnel Security and Suitability Program,” May 2, 2016 (https://www.va.gov/vapubs/index.cfm)

13. VA Directive 6102 (Internet/Intranet Services), August 5, 2019 (https://www.va.gov/vapubs/index.cfm)

14. VA Handbook 6102 (Internet/Intranet Services), August 5, 2019 (https://www.va.gov/vapubs/index.cfm)

15. Health Insurance Portability and Accountability Act (HIPAA); 45 CFR Part 160, 162, and 164; Health Insurance Reform: Security Standards; Final Rule dated February 20, 2003

16. VHA Directive 1605.05, Business Associate Agreements, November 17, 2020, (https://www.va.gov/vhapublications/ViewPublication.asp?pub_ID=9178)

17. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and Guidelines,” January 18, 2017

18. Office of Management and Budget Circular A-130, “Managing Federal Information as a Strategic Resource,” July 28, 2016

19. U.S.C. Section 552a, as amended

20. Title 32 CFR 199, “Civilian Health and Medical Program of the Uniformed Services (CHAMPUS)”

21. NIST SP 800-66 Rev. 1, “An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule,” October 2008

22. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. Section § 794d), as amended, January 18, 2017

23. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

24. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021 (https://www.va.gov/vapubs/index.cfm)

25. VA Handbook 6500, “Risk Management Framework for VA Information Systems – Tier 3: VA Information Security Program,” February 24, 2021 (https://www.va.gov/vapubs/index.cfm)

26. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI),” March 12, 2019 (https://www.va.gov/vapubs/index.cfm)

27. VA Handbook, 6500.5, Incorporating Security and Privacy into the System Development Lifecycle,” March 22, 2010 (https://www.va.gov/vapubs/index.cfm)

28. VA Handbook 6500.6, “Contract Security,” March 12, 2010 (https://www.va.gov/vapubs/index.cfm)

29. VA Handbook 6500.8, “Information System Contingency Planning,” April 6, 2011 (https://www.va.gov/vapubs/index.cfm)

30. VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018

31. VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017

32. Office of Information and Technology (OIT) Process Asset Library (PAL) https://www.va.gov/process/. Reference Process Maps at https://www.va.gov/process/maps.asp and Artifact templates at https://www.va.gov/process/artifacts.asp

33. National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53 Rev 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020)

34. Federal Travel Regulation (FTR) (www.gsa.gov/federaltravelregulation)

35. One-VA Technical Reference Model (TRM) (https://www.va.gov/trm/TRMHomePage.aspx)

36. Federal Segment Architecture Methodology (FSAM) v1.0, December 2008

37. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014 (https://www.va.gov/vapubs/index.cfm)

38. VA Handbook 6508.1, “Procedures for Privacy Threshold Analysis and Privacy Impact Assessment,” July 30, 2015

39. VA Handbook 6510, “VA Identity and Access Management,” January 15, 2016

40. VA Directive and Handbook 6513, “Secure External Connections,” October 12, 2017 (https://www.va.gov/vapubs/index.cfm)

41. VA Directive 6300, “Records and Information Management,” September 21, 2018 (https://www.va.gov/vapubs/index.cfm)

42. VA Handbook, 6300.1, “Records Management Procedures,” March 24, 2010 (https://www.va.gov/vapubs/index.cfm)

43. NIST SP 800-37 Rev 2, “Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy,” December 2018

44. OMB Memorandum “Security Authorization of Information Systems in Cloud Computing Environments,” December 8, 2011 (FedRAMP Policy Memorandum)

45. VA Directive 6609, “Mailing of Sensitive Personal Information,” May 20, 2011 (https://www.va.gov/vapubs/index.cfm)

46. VA Enterprise Technology Strategic Plan, February 28, 2014

47. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015 (https://www.va.gov/vapubs/index.cfm)

48. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” March 24, 2014 (https://www.va.gov/vapubs/index.cfm)

49. OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005

50. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019

51. OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008

52. Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance, December 2, 2011, (NOTE: Part A of the FICAM Roadmap and Implementation Guidance, v2.0, was replaced in 2015 with an updated Architecture (https://arch.idmanagement.gov/#what-is-the-ficam-architecture)

53. NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access,” June 2018

54. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, “Digital Identity Guidelines,” updated March 02, 2020

55. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014

56. NIST SP 800-164, “Guidelines on Hardware-Rooted Security in Mobile Devices (Draft),” October 2012

57. VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

58. IAM Identity Management Business Requirements Guidance document, May 2013, (https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

59. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

60. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

61. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019

62. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008

63. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (Public Law 110–140), December 19, 2007

64. Section 104 of the Energy Policy Act of 2005, (Public Law 109–58), August 8, 2005

65. Executive Order 13834, “Efficient Federal Operations,” dated May 17, 2018

66. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 2, 2001

67. VA Directive 0058, “VA Green Purchasing Program,” July 19, 2013 (https://www.va.gov/vapubs/index.cfm)

68. VA Handbook 0058, “VA Green Purchasing Program,” July 19, 2013 (https://www.va.gov/vapubs/index.cfm)

69. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

70. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

71. “Veteran Focused Integration Process (VIP) Guide 4.0,” January 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

72. VA Memorandum “Proper Use of Email and Other Messaging Services,” January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

73. “DevSecOps Product Line Management Playbook” version 2.0, May 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

74. NIST SP 500-267B Revision 1, ”USGv6 Profile,” November 2020

75. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol Version 6 (IPv6),“ November 19, 2020

76. Social Security Number (SSN) Fraud Prevention Act of 2017

77. Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23, 2018

78. VA Enterprise Cloud (VAEC) Technical Reference Guide, July 2018 version 1.3

3.0 GENERAL REQUIREMENTS

The Contractor shall provide and/or acquire the services, hardware, and software required by individual Task Orders pursuant to the general requirements specified below.

3.1 Contract Type

This is an Indefinite Delivery/Indefinite Quantity (IDIQ) Multiple Award Task Order (MATO) contract. Individual Task Orders shall be issued on a performance-based T&M, CR, and/or FFP basis.

3.2 Ordering Period

The ordering period for the basic contract shall be five years with one five-year option.

3.3 Hours of Work

Generally, work at a Government site shall not take place on Federal holidays or weekends unless directed by the CO or individual Task Order; however, the Contractor may be required to support 24/7 operations 365 days per year as identified in individual Task Orders.

There are eleven (11) Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, five are set by date:

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

3.4 Place of Performance

The place of performance shall be identified in individual Task Orders. Locations can be Government or non-Government sites within the continental United States (CONUS) and/or outside the continental United States (OCONUS). Locations may include but are not limited to Federal, State, VA, or military data centers, facilities, regional offices, benefits delivery centers, medical treatment facilities, health clinics and Tricare facilities as defined in individual Task Orders.

3.5 Travel

Travel shall be in accordance with (IAW) individual Task Order requirements. Travel details must be provided to and approved by the CO’s Representative (COR) or the Government designee prior to the commencement of travel. All travel shall be IAW the Federal Travel Regulations (FTR). OCONUS travel may require additional authorization and approvals as specified in the individual Task Order.

3.6 Materials, Equipment and Locations

3.6.1 Government-Furnished

Government Furnished Property (GFP) which includes Government Furnished Material (GFM), Government Furnished Information (GFI), and Government Furnished Equipment (GFE) may be provided and shall be identified in the individual Task Order. The Contractor shall be responsible for conducting all necessary examinations, inspections, maintenance, and tests upon receipt. The Contractor shall be responsible for reporting all inspection results, maintenance actions, losses, and damage to the Government through the VA Technology Acquisition Center (TAC) website.

VA may provide VA-specific software as appropriate and required in individual Task Orders. The Contractor may utilize VA-provided software development and test accounts, document and requirements repositories and others as required for the development, storage, maintenance, and delivery of products. Contractors shall comply with VA security policies and procedures with respect to protecting sensitive data. See Section 6.0 for detailed security requirements.

3.6.2 Contractor-Acquired

The Contractor shall acquire and/or provide any hardware and/or software required to accomplish each Task Order that is not provided as GFP. Software integrity shall be maintained by the Contractor within the licensing agreement of the producer until such software is delivered to the Government, or otherwise disposed of IAW Government direction. Items delivered to the Government shall be approved by the Government in advance of purchase and shall be in compliance with PWS paragraphs 3.8 and A3.0. See Section 6.0 for detailed security requirements.

3.6.3 Non-Developmental Items and Commercial Processes

Non-Developmental Items (NDI), Commercial-Off-The-Shelf (COTS) and Government-Off-The-Shelf (GOTS) products shall be used to the maximum extent. The Contractor shall apply commercially available and industry best processes, standards, and technologies to the maximum extent.

3.6.4 Connectivity

VA will provide connectivity to VA-specific systems/network as required for execution of the task via VA approved remote access technology. Currently this may include but is not limited to Citrix Access Gateway (CAG), Azure Virtual Desktop, site-to-site VPN, or VA Remote Access Security Compliance Update Environment (RESCUE).