36C10B23R0024 0001.docx

36C10B23R0024

5. PROJECT NUMBER (if applicable)

CODE

7.

ADMINISTERED BY

2. AMENDMENT/MODIFICATION NUMBER

CODE

6. ISSUED BY

8. NAME AND ADDRESS OF CONTRACTOR

4. REQUISITION/PURCHASE REQ. NUMBER

3. EFFECTIVE DATE

9A. AMENDMENT OF SOLICITATION NUMBER

9B. DATED

PAGE OF

PAGES

10A. MODIFICATION OF CONTRACT/ORDER NUMBER

10B. DATED

BPA NO.

1. CONTRACT ID CODE

FACILITY CODE

CODE

Offers must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended, by one of the following methods:

The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offers

E. IMPORTANT:

is extended,

(a) By completing Items 8 and 15, and returning __________ copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted; or (c) By separate letter or electronic communication which includes a reference to the solicitation and amendment numbers. FAILURE

OF YOUR

ACKNOWLEDGMENT TO BE RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY is not extended.

12. ACCOUNTING AND APPROPRIATION DATA

(REV. 11/2016)

is required to sign this document and return ___________ copies to the issuing office.

is not, A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE CONTRACT ORDER NO. IN ITEM 10A.

15C. DATE SIGNED

B. THE ABOVE NUMBERE

D CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES

SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(b).

RESULT IN REJECTION OF YOUR

OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by letter or electronic communication, provided each letter or electronic communication makes reference to the solicitation and this amendmen t, and is received prior to the opening hour and date specified.

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER

Contractor

16C. DATE SIGNED

14. DESCRIPTION OF AMENDMENT/MODIFICATION

16B. UNITED

STATES OF AMERICA

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15A. NAME AND TITLE OF SIGNER

16A. NAME AND TITLE OF

CONTRACTING OFFICER

15B. CONTRACTOR/OFFEROR

STANDARD FORM 30

PREVIOUS EDITION NOT USABLE

Prescribed by GSA - FAR (48 CFR) 53.243 (Type or print) (Type or print) (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

(Number, street, county, State and ZIP Code) (If other than Item 6) (Specify type of modification and authority) such as changes in paying office, appropriation date, etc.)

(If required)

(SEE ITEM 11)

(SEE ITEM 13)

(X)

CHECK

ONE

13. THIS ITEM APPLIES ONLY TO MODIFICATIONS OF CONTRACTS/ORDERS,

IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF

SOLICITATIONS

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

(Signature of person authorized to sign) (Signature of Contracting Officer)

VA-23-00029851

36C10B Department of Veterans Affairs Technology Acquisition Center 23 Christopher Way Eatontown NJ 07724 36C10B Department of Veterans Affairs Technology Acquisition Center 23 Christopher Way Eatontown NJ 07724 To all Offerors/Bidders

36C10B23R0024 08-16-2023

X X X

This solicitation has been amended to correct Description posted in SAM and due dates. No further changes to the RFP.

Respon ses due 8-21-2023 at 1:00PM EST

Matthew Newel Contracting Officer

Table of Contents

SECTION B - CONTINUATION OF SF 1449 BLOCKS

B.1 GOVERNING LAW

Federal law and regulations, including the Federal Acquisition Regulations (FAR), shall govern this Contract/Order. Commercial license agreements may be made a part of this Contract/Order but only if both parties expressly make them an addendum hereto. If the commercial license agreement is not made an addendum, it shall not apply, govern, be a part of or have any effect whatsoever on the Contract/Order; this includes, but is not limited to, any agreement embedded in the computer software (clickwrap), any agreement that is otherwise delivered with or provided to the Government with the commercial computer software or documentation (shrinkwrap), or any other license agreement otherwise referred to in any document. If a commercial license agreement is made an addendum, only those provisions addressing data rights regarding the Government’s use, duplication and disclosure of data (e.g., restricted computer software) are included and made a part of this Contract/Order, and only to the extent that those provisions are not duplicative or inconsistent with Federal law, Federal regulation, the incorporated FAR clauses and the provisions of this Contract/Order; those provisions in the commercial license agreement that do not address data rights regarding the Government’s use, duplication and disclosure of data shall not be included or made a part of the Contract/Order. Federal law and regulation including, without limitation, the Contract Disputes Act (41 U.S.C. § 7101 et seq.), the Anti-Deficiency Act (31 U.S.C. § 1341 et seq.), the Competition in Contracting Act (41 U.S.C. § 3301 et seq.), the Prompt Payment Act (31 U.S.C. §3901 et seq.), Contracts for Data Processing or Maintenance (38 USC § 5725), and FAR clauses 52.212-4, 52.227-14, 52.227-19 shall supersede, control, and render ineffective any inconsistent, conflicting, or duplicative provision in any commercial license agreement. In the event of conflict between this Clause and any provision in the Contract/Order or the commercial license agreement or elsewhere, the terms of this Clause shall prevail. Claims of patent or copyright infringement brought against the Government as a party shall be defended by the U.S. Department of Justice (DOJ). 28 U.S.C. § 516. At the discretion of DOJ, the Contractor may be allowed reasonable participation in the defense of the litigation. Any additional changes to the Contract/Order must be made by contract/order modification (Standard Form 30) and shall only be effected by a warranted Contracting Officer. Nothing in this Contract/Order or any commercial license agreement shall be construed as a waiver of sovereign immunity.

B.2 SOFTWARE LICENSE, MAINTENANCE AND TECHNICAL SUPPORT

(1) Definitions.

(a) Licensee. The term “licensee” shall mean the U.S. Department of Veterans Affairs (“VA”) and is synonymous with “Government.”

(b) Licensor. The term “licensor” shall mean the contractor having the necessary license or ownership rights to deliver license, software maintenance and support of the computer software being acquired. The term “contractor” is the party identified in Block 17a on the SF1449. If the contractor is a reseller and not the Licensor, the contractor remains responsible for performance under this order.

(c) Software. The term “software” shall mean the licensed computer software product(s) cited in the Schedule of Supplies/Services.

(d) Maintenance. The term “maintenance” is the process of enhancing and optimizing software, as well as remedying defects. It shall include all new fixes, patches, releases, updates, versions and upgrades, as further defined below.

(e) Technical Support. The term “technical support” refers to the range of services providing assistance for the software via the telephone, email, a website or otherwise.

(f) Release or Update. The term “release” or “update” are terms that refer to a revision of software that contains defect corrections, minor enhancements or improvements of the software’s functionality. This is usually designated by a change in the number to the right of the decimal point (e.g., from Version 5.3 to 5.4). An example of an update is the addition of new hardware.

(g) Version or Upgrade. The term “version” or “upgrade” are terms that refer to a revision of software that contains new or improved functionality. This is usually designated by a change in the number to the left of the decimal point (e.g., from Version 5.4 to 6).

(2) Software License

(a) Unless otherwise stated in the Schedule of Supplies/Services, the Performance Work Statement or Product Description, the software license provided to the Government is a perpetual, nonexclusive license to use the software

(b) The Government may use the software in a networked environment.

(c) Any dispute regarding the license grant or usage limitations shall be resolved in accordance with the Disputes Clause incorporated in FAR 52.212-4(d).

(d) All limitations of software usage are expressly stated in the Schedule of Supplies/Services and the Performance Work Statement/Product Description.

(3) Software Maintenance and Technical Support

(a) If the Government desires to continue software maintenance and support beyond the period of performance identified in this contract or order, the Government will issue a separate contract or order for maintenance and support. Conversely, if a contract or order for continuing software maintenance and technical support is not received the contractor is neither authorized nor permitted to renew any of the previously furnished services.

(b) The contractor shall provide software support services, which includes periodic updates, enhancements and corrections to the software, and reasonable technical support, all of which are customarily provided by the contractor to its commercial customers so as to cause the software to perform according to its specifications, documentation or demonstrated claims.

(c) Any telephone support provided by contractor shall be at no additional cost.

(d) The contractor shall provide all maintenance services in a timely manner in accordance with the contractor’s customary practice or as defined in the Performance Work Statement/Product Description. However, prolonged delay (exceeding 2 business days) in resolving software problems will be noted in the Government’s various past performance records on the contractor (e.g., www.ppirs.gov).

(e) If the Government allows the maintenance and support to lapse and subsequently wishes to reinstate it, any reinstatement fee charged shall not exceed the amounts that would have been charged if the Government had not allowed the subscription to lapse.

(4) Disabling Software Code. The Government requires delivery of computer software that does not contain any code that will, upon the occurrence or the nonoccurrence of any event, disable the software. Such code includes but is not limited to a computer virus, restrictive key, node lock, time-out or other function, whether implemented by electronic, mechanical, or other means, which limits or hinders the use or access to any computer software based on residency on a specific hardware configuration, frequency of duration of use, or other limiting criteria. If any such disabling code is present, the contractor agrees to indemnify the Government for all damages suffered as a result of a disabling caused by such code, and the contractor agrees to remove such code upon the Government’s request at no extra cost to the Government. Inability of the contractor to remove the disabling software code will be considered an inexcusable delay and a material breach of contract, and the Government may exercise its right to terminate for cause. In addition, the Government is permitted to remove the code as it deems appropriate and charge the Contractor for consideration for the time and effort expended in removing the code.

(5) Manuals and Publications. Upon Government request, the contractor shall furnish the most current version of the user manual and publications for all products/services provided under this contract or order at no cost.

B.3 CONTRACT ADMINISTRATION DATA

1. Contract Administration: All contract administration matters will be handled by the following individuals:

a. CONTRACTOR: To be determined

2. CONTRACTOR REMITTANCE ADDRESS: All payments by the Government to the contractor will be made in accordance with:

3. INVOICES: Invoices shall be submitted in arrears:

4. GOVERNMENT INVOICE ADDRESS: All Invoices from the contractor shall be submitted electronically in accordance with VAAR Clause 852.232-72 Electronic Submission of Payment Requests.

5. ACKNOWLEDGMENT OF AMENDMENTS: The offeror acknowledges receipt of amendments to the Solicitation numbered and dated as follows:

B.4 PRICE SCHEDULE

Offerors are instructed to complete Section B.4 and submit with their response.

Offerors are cautioned that alterations to the line items as specified below may render proposal unacceptable. All questions shall be directed to the Contract Specialist, Luis Lozada-Santiago, luis.lozada-santiago@va.gov and Contracting Officer, Matthew Newell, matthew.newell@va.gov prior to the closing date and time specified in the Request for Proposal (RFP).

Inspection: Destination Acceptance: Destination

Base Period (12 Months)

CLIN

DESCRIPTION

Product Service Code (PSC): DA10

Due: At time of award

PSC: DA10

Due: 45 days after award

***If Data Security Categorization is High Impact, this will be due 85 days after award***

10% of the total price for CLIN 0001 can be invoiced after successful delivery of the SSP.

PSC: DA10

Due: 30 days after award

PSC: DA10

Due: 90 days after award

***If Data Security Categorization is High Impact, this will be due 130 days after award***

20% of the total price for CLIN 0001 can be invoiced after successful completion of the 3PAO SAP.

PSC: DA10

Due: 140 days after award

***If Data Security Categorization is High Impact, this will be due 180 days after award***

PSC: DA10

Due: At time of award.

PSC: DA10

Due: At time of award.

PSC: DA10

Optional Task 1

FAR 52.217-7, Option for Increased Quantity – Separately priced Line Item (MAR 1989) may be exercised at any time and from time to time up to the quantity set forth in CLIN 1001 and SLIN’s 1002-1 and 1002-2. Work shall not commence until, and unless, a formal modification is issued by the Contracting Officer

CLIN

DESCRIPTION

Due: 30 days after exercise of optional task

PSC: DA10

This Firm-Fixed Price (FFP) CLIN includes all labor, materials, travel, and deliverables required for the successful completion of the services detailed in PD section 2.1 inclusive of all of its subparagraphs.

Due: 30 days after exercise of optional task

PSC: DA10

Due: 30 days after exercise of optional task.

PSC: DA10

Due: 30 days after exercise of optional task. And weekly thereafter.

PSC: DA10

Optional Task 2

FAR 52.217-7, Option for Increased Quantity – Separately priced Line Item (MAR 1989) may be exercised at any time and from time to time up to the quantity set forth in CLIN 2001. Work shall not commence until, and unless, a formal modification is issued by the Contracting Officer

CLIN

Due: 30 days after exercise of optional task

PSC: DA10

Optional Task 3

FAR 52.217-7, Option for Increased Quantity – Separately priced Line Item (MAR 1989) may be exercised at any time and from time to time up to the quantity set forth in CLIN 3001. Work shall not commence until, and unless, a formal modification is issued by the Contracting Officer

CLIN

The Contractor shall provide a blended hourly rate for additional configuration services up to the not to exceed (NTE) amount.

Due: 30 days after exercise of optional task

PSC: DA10

NTE

Option Period 1

This 12-month option period may be exercised IAW FAR 52.217-9, Option to Extend the Term of the Contract (MAR 2000). Work shall not commence until, and unless, a formal modification is issued by the Contracting Officer. If exercised, this option shall commence immediately after expiration of the Base Period.

CLIN

Period of Performance (POP): 12 Months

PSC: DA10

This Firm-Fixed Price (FFP) CLIN includes all labor, materials, travel, and deliverables required for the successful completion of the services detailed in PD section 2.1 inclusive of all of its subparagraphs.

Due: 30 days after exercise of optional task

PSC: DA10

Due: 30 days after exercise of option and weekly thereafter.

PSC: DA10

Option Period 2

This 12-month option period may be exercised IAW FAR 52.217-9, Option to Extend the Term of the Contract (MAR 2000). Work shall not commence until, and unless, a formal modification is issued by the Contracting Officer. If exercised, this option shall commence immediately after expiration of Option Period 1.

CLIN

POP: 12 Months

PSC: DA10

This Firm-Fixed Price (FFP) CLIN includes all labor, materials, travel, and deliverables required for the successful completion of the services detailed in PD section 2.1 inclusive of all of its subparagraphs.

Due: 30 days after exercise of optional task

PSC: DA10

Due: 30 days after exercise of option and weekly thereafter.

PSC: DA10

Option Period 3

This 12-month option period may be exercised IAW FAR 52.217-9, Option to Extend the Term of the Contract (MAR 2000). Work shall not commence until, and unless, a formal modification is issued by the Contracting Officer. If exercised, this option shall commence immediately after expiration of Option Period 2.

CLIN

POP: 12 Months

PSC: DA10

This Firm-Fixed Price (FFP) CLIN includes all labor, materials, travel, and deliverables required for the successful completion of the services detailed in PD section 2.1 inclusive of all of its subparagraphs.

Due: 30 days after exercise of optional task

PSC: DA10

Due: 30 days after exercise of option and weekly thereafter.

PSC: DA10

Option Period 4

This 12-month option period may be exercised IAW FAR 52.217-9, Option to Extend the Term of the Contract (MAR 2000). Work shall not commence until, and unless, a formal modification is issued by the Contracting Officer. If exercised, this option shall commence immediately after expiration of Option Period 3.

CLIN

POP: 12 Months

PSC: DA10

Due: 30 days after exercise of option and weekly thereafter.

PSC: DA10

36C10B23R0024

Page 1 of Page 1 of Page 1 of

B.5 PRODUCT DESCRIPTION

PRODUCT DESCRIPTION (PD)

DEPARTMENT OF VETERANS AFFAIRS

Office of Information & Technology Pathology and Laboratory Medicine

Pathology and Laboratory Medicine National Database Solution

Date: 7-25-2023

VA-23-00029851

PD Version Number: 1.8

1.0 BACKGROUND

The Department of Veterans Affairs (VA), Office of Information & Technology (OIT), Pathology and Laboratory Medicine (PLM) and National Radiology Program (NRP) strive to provide high quality, effective, and efficient Information Technology (IT) services to those responsible for providing care to the Veterans at the point-of-care as well as throughout all the points of the Veterans’ health care in an effective, timely and compassionate manner. VA depends on Information Management/Information Technology (IM/IT) systems to meet mission goals.

The mission of the Pathology and Laboratory Medicine is to ensure clinical laboratories in the VA perform at high quality and set the standard for the practice of laboratory medicine for our Veterans. The mission of the National Enforcement Office is to oversee and enforce the Clinical Laboratory Improvement Act of 1988 as well as those portions of the Public Health Services Act, Health Insurance Portability and Accountability Act (HIPAA), Health Information Technology for Economic and Clinical Health (HITECH) Act, Maintaining Internal Systems and Strengthening Integrated Outside Network (MISSION) Act, and the Coronavirus Aid, Relief, and Economic Security (CARES) Act related to laboratory services ensuring quality of services provided by VA clinical laboratories are in compliance with regulatory, accreditation, and policy guidelines. This acquisition is necessary to move the program office mission forward and to aid the clinical laboratories in improving their performance and quality.

The current PLM database is over 20 years old and no longer can handle the complex issue of the modern accreditation model nor the need for data to drive innovation and performance improvement. The unique nature of the VA accreditation program that not only acts as the VA Clinical Laboratory Improvement Amendments (CLIA) provider but also performs on site audits the VA requires laboratory accreditation software to support these activities.

2.0 OPTIONAL TASK 1 - COMMERCIAL-OFF-THE-SHELF (COTS) PRODUCT REQUIREMENTS

The VA PLM Services require a cloud-based Software as a Service (SaaS) solution to manage the lifecycle of Laboratory accreditation and CLIA processes. This solution must allow for –

· Configuration of up to 160 facility accounts, these 160 facility accounts would organize up to 1100 different CLIA accreditation cycles and audit activities associated within account. Each account would have multiple users with role-based data access.

· Configuration of a centralized administrative or super user account that can view/manage and manipulate data within all accounts. This account must have up to 20 users.

· Solution must be able to support up to 10 concurrent users within accounts

· Configuration or filtering option to view/manage data in VA defined regions

· Accommodate VA Active Directory synchronization or connection to support account creation. VA Active Directory synchronization must be a native function without additional on premises devices.

· The migration of current CLIA information

· The migration of current Laboratory Accreditation data

· Communication method between central office and facility accounts

· Uploading of documents into solution associated with laboratory accreditation or CLIA lifecycle, file size may be up to 5 MB

· Allow storage of lifecycle information and documents that minimally meet VA record retention guidelines.

· Manage the lifecycle of laboratory accreditation including:

· Configured VA standards portal/tool

· Audit scheduling feature

· Audit findings uploading/access feature

· Audit workflow process

· Corrective action response submission method

· Audit completion communication and tracking

· Manage the lifecycle of CLIA initiation/change/renewal including:

· Configured application

· Submission workflow process

· Configured VA CLIA certificates/letters of acknowledgement

· CLIA workflow with notices/alerts when action needed

· Solution must be combatable with VHA government furnished equipment.

· The solution must allow for future customization as needs expand.

· Training for VA employees provided by a qualified professional. Training must occur no later than 10 days after solution goes live, shall be conducted virtually and be custom to user roles.

This solution shall not have any protected health information (PHI/PII) stored or submitted to the solution.

Deliverables:

A. SaaS and configuration for laboratory accreditation/CLIA solution

2.1 OPTIONAL TASK 1 - CONFIGURATION PROJECT MANAGEMENT REQUIREMENTS

Configuration Kick-off Meeting

The Contractor shall conduct a Kick-off Meeting with the VA Program Manager (PM), COR, and Implementation Manager to discuss configuration schedule. This meeting may be held in conjunction with the post award conference, if applicable. The Contractor shall also present the Master Configuration Scheduled and Configuration Weekly Progress Report format for review and approval by the Government.

Master Configuration Schedule

The Contractor shall provide a Master Configuration Schedule that outlines the order, estimated time frame, information needed from National Enforcement Office, and other configuration details. The Master Configuration Schedule progress and changes shall be tracked using Configuration Weekly Progress Report and be communicated to the COR and Program Manager as part of the Weekly Progress report. The Master Configuration Schedule shall be submitted in Microsoft Excel Format and shall clearly identify each configuration step.

Configuration Weekly Progress Report

The Contractor shall provide a Configuration Weekly Progress Report which shall identify the items configured and status of configuration schedule. In addition, the Configuration Weekly Progress Report shall identify any problems and provide a description of how the problems were resolved/addressed. If problems have not been completely resolved, the Contractor shall provide an explanation and status of resolution. Configuration Weekly Progress Reports shall be submitted in Microsoft Excel Format and shall clearly identify the status of each configuration step.

Deliverables:

A. Master Configuration Schedule B. Configuration Weekly Progress Report

3.0 ASSESSMENT, AUTHORIZATION AND CONTINUOUS MONITORING (BASE PERIOD)

Based on FedRAMP classification only one subsection of 3.0 will apply – 3.1.1, 3.1.2 or 3.1.3.

3.1.1 IF THE SOLUTION IS NOT FEDRAMP AUTHORIZED

The information system solution selected by the Contractor shall comply with the Federal Information Security Management Act (FISMA).

The Contractor shall comply with FedRAMP requirements as mandated by Federal laws and policies, including making available any documentation, physical access, and logical access needed to support this requirement.

The Contractor shall provide a SaaS product as defined by the following criteria: Software as a Service (SaaS) is an application delivery model in which the application is hosted on a cloud infrastructure outside the security boundary of VA and is provided to the Cloud Service Customer (CSC) over the internet. The CSC uses the SaaS offering via a thin-client interface, such as a web-browser or a program interface. The CSC subscribes to the SaaS offering and is only responsible for limited application configuration settings. The Cloud Service Provider (CSP) offering the application is responsible for management of the application, safeguarding of data stored or processed by the application, and all elements of the underlying infrastructure.

In order to qualify as SaaS for use at VA, and to align with Federal Risk and Authorization Management Program (FedRAMP) requirements, the hosting for the offering must conform to the NIST 800-145 definition of Cloud Computing and thus contain following key characteristics:

· On-Demand Self-Service: The CSP fully automates the provisioning of both the customer interface and the underlying cloud components of the SaaS offering. In some cases, to the CSP may provision internal resources manually, while providing the CSC an automated interface to request and track the service.

· Broad Network Access: The SaaS capabilities are available over the internet or over a network that is available from all access points the CSC requires. The SaaS offering is accessible through common platforms (e.g., mobile phones, tablets, laptops, and workstations).

· Resource Pooling: The computing infrastructure supporting the SaaS offering is shared among more than one CSC using a multi-tenant model, and resources are dynamically assigned depending on customer demand.

· Rapid Elasticity: Computing capabilities are automatically provisioned and released in a manner that scales with customer demand. In some cases, the scaling of resources may not be fully automated, but it should be fast enough to support the needs of the CSC, which the CSC would have to define.

· Measured Service: Resource usage, such as storage, processing, bandwidth, and user activity are measured and reported on in a manner that is relevant to the SaaS offering.

The SaaS offering must be hosted within the United States and data stored/processed/transmitted within the offering must remain within the United States. CSPs should be aware of FedRAMP and ready to partner with VA through the SaaS FedRAMP Authorization process.

Following guidance from the Federal CIO, VA will utilize existing JAB ATO or agency ATO issued by another agency as a starting point for FedRAMP requirements. If neither of those exist, VA will sponsor FedRAMP ATO. VA will be using the FedRAMP baselines as a starting point, since they are specifically tailored for cloud services.

The Contractor shall, where applicable, assist with the VA ATO Process at to help achieve agency authorization of the cloud service or migrated application (add Impact level for customer. This should be done by DTC).

The Contractor shall complete a FedRAMP System Security Plan (SSP) and supporting documentation within 45 calendar days after contract award. (If Data Security Categorization is High Impact, this will be due 85 calendar days after contract award.)

The Contractor shall complete a Third-Party Assessment Organization (3PAO) Security Assessment Plan (SAP) within 90 calendar days after contract award. (If Data Security Categorization is High Impact, this will be due after 130 calendar days after contract award.)

The Contractor shall complete a 3PAO Security Assessment Report (SAR) within 140 calendar days after contract award. (If Data Security Categorization is High Impact, this will be due 180 calendar days after contract award.)

The Contractor shall afford VA access to the Contractor’s and Cloud Service Provider’s (CSP) facilities, installations, technical capabilities, operations, documentation, records, and databases.

If new or unanticipated threats or hazards are discovered by either VA or the Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party in accordance with the security addendum B.

The Contractor shall not release any data without the consent of VA in writing. All requests for release must be submitted in writing to the Contracting Officer’s Representative (COR)/Contracting Officer (CO).

For live VA data to be used in this system, a FedRAMP Authorization and Agency ATO will be required.

Deliverables:

A. FedRAMP System Security Plan (SSP) and supporting documentation B. VA Implementation Diagram: This is a VA specific architecture diagram demonstrating the proposed implementation of this system at VA (VAID) C. 3PAO Security Assessment Plan (SAP) D. 3PAO Security Assessment Report (SAR)

3.1.2 IF THE SOLUTION IS FEDRAMP AUTHORIZED BUT NOT VA FEDRAMP AUTHORIZED

The information system solution selected by the Contractor shall comply with the Federal Information Security Management Act (FISMA).

The Contractor shall comply with FedRAMP requirements as mandated by Federal laws and policies, including making available any documentation, physical access, and logical access needed to support this requirement.

The Contractor shall, where applicable, assist with the VA ATO Process to help achieve agency authorization of the cloud service or migrated application.

The Contractor shall provide IRP scenario within 14 days and complete Table-Top exercise within 21 days of award unless current VA IRP can be provided.

The Contractor shall provide a System Boundary Diagram that demonstrates implementation and any proposed VA interconnections including required ports and protocols at the time award.

The Contractor shall complete a FedRAMP System Security Plan (SSP) and supporting documentation at the time of award.

The Contractor shall complete a Third-Party Assessment Organization (3PAO) Security Assessment Plan (SAP) at the time of award.

The Contractor shall complete a 3PAO Security Assessment Report (SAR) at the time of award.

The Contractor shall afford VA access to the Contractor’s and Cloud Service Provider’s (CSP) facilities, installations, technical capabilities, operations, documentation, records, and databases.

If new or unanticipated threats or hazards are discovered by either VA or the Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party in accordance with the security addendum B.

The Contractor shall not release any data without the consent of VA in writing. All requests for release must be submitted in writing to the Contracting Officer’s Representative (COR)/Contracting Officer (CO).

In order for live VA data to be used in this system, a FedRAMP Authorization and Agency ATO will be required.

Deliverables

A. System Boundary Diagram B. FedRAMP System Security Plan (SSP) and supporting documentation C. 3PAO Security Assessment Plan (SAP) D. 3PAO Security Assessment Report (SAR)

3.1.3 IF THE SOLUTION IS FEDRAMP AUTHORIZED AND VA FEDRAMP AUTHORIZED

The information system solution selected by the Contractor shall comply with the Federal Information Security Management Act (FISMA) and have a current VA authorization.

The Contractor shall comply with FedRAMP requirements as mandated by Federal laws and policies, including making available any documentation, physical access, and logical access needed to support this requirement.

The Contractor shall, where applicable, assist with the VA ATO Sustainment Process to help maintain health and quality of agency authorization of the cloud service or migrated application.

The Contractor shall provide access to FedRAMP authorized and VA authorized environment.

The Contractor shall afford VA access to the Contractor’s and Cloud Service Provider’s (CSP) facilities, installations, technical capabilities, operations, documentation, records, and databases.

If new or unanticipated threats or hazards are discovered by either VA or the Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party in accordance with the security addendum B.

The Contractor shall not release any data without the consent of VA in writing. All requests for release must be submitted in writing to the Contracting Officer’s Representative (COR)/Contracting Officer (CO).

In order for live VA data to be used in this system, access must be provided to the FedRAMP Authorized and Agency Authorized environment.

The Contractor shall participate in monthly Agency and FedRAMP Sustainment meetings.

The Contractor shall participate monitoring and reoccurring security artifacts, including monthly POAM reports.

Deliverables A. Dates for current ATO expiration, due at award B. Most recent monthly POAM (Plan of Action and Milestones) finding reports.

4.0 OPTIONAL TASK 2 – MAMMOGRAPHY ACCREDITATION

Expand the VA PLM Services cloud-based SaaS solution to manage the lifecycle of Mammography accreditation. This task configuration must allow for:

· Adding additional accreditation cycle to existing facility accounts

· Configuration of a centralized administrative or super user account of the Mammography accreditation process account that can view/manage and manipulate data within mammography accounts. This account must have up to 10 users.

· The migration of current Mammography accreditation data

· Communication method between central office and facility accounts

· Uploading of documents into solution associated with mammography accreditation.

· Allow storage of lifecycle information and documents that minimally meet VA record retention guidelines.

· Manage the lifecycle of Mammography accreditation including:

· Configured application

· Submission workflow process

· Audit findings uploading/access feature

· Audit workflow process

· Corrective action response submission method

· Configured VA Mammography certificates

· Workflow with notices/alerts when action needed

· The solution must allow for future customization as needs expand.

· Training for VA employees provided by a qualified professional. Training must occur no later than 10 days after solution goes live, shall be conducted virtually and be custom to user roles.

This solution shall not have any protected health information (PHI/PII) stored or submitted to the solution.

Deliverables:

A. SaaS configuration for mammography accreditation

5.0 OPTIONAL TASK 3 – ADDITIONAL CONFIGURATION

Expand the VA PLM/Diagnostic Services cloud-based SaaS solution for additional configuration.

The solution may require additional configuration based on user feedback or to comply with changing government needs. The Contractor shall continue to provide improvements through the release of additional software configuration as agreed upon and exercised through the award of optional tasks. Any requirements for additional configuration work shall be coordinated in advance with the government and be mapped to a formal requirement. This optional task may be exercised any time and from time to time up to the not to exceed price throughout the base and option periods of performance.

The specific scope of functionality to be delivered for each optional task exercise will be agreed to by the VA PM and COR prior to the exercise of this optional task based on current priorities. Prior to each exercise of this Optional Task, the Contractor shall provide a short description of what work will be completed, a list of all deliverables, and a schedule for implementation including milestones for delivery. The Government will review and agree to the proposed additional configuration, after which a modification will be made to the contract exercising the option and reducing the available ceiling on the line item accordingly. The Contractor shall ensure that the resources provided possess skillsets necessary to analyze business needs and identify solutions compatible with the existing architecture and to successfully deliver the requirements of this Task.

Deliverables:

A. Additional SaaS configuration

6.0 SECTION 508 COMPLIANCE

NOTICE OF THE FEDERAL ACCESSIBILITY LAW AFFECTING ALL INFORMATION AND COMMUNICATION TECHNOLOGY (ICT) PROCUREMENTS (SECTION 508)

On January 18, 2017, the Architectural and Transportation Barriers Compliance Board (Access Board) revised and updated, in a single rulemaking, standards for electronic and information technology developed, procured, maintained, or used by Federal agencies covered by Section 508 of the Rehabilitation Act of 1973, as well as our guidelines for telecommunications equipment and customer premises equipment covered by Section 255 of the Communications Act of 1934. The revisions and updates to the Section 508-based standards and Section 255-based guidelines are intended to ensure that information and communication technology (ICT) covered by the respective statutes is accessible to and usable by individuals with disabilities.

6.1 SECTION 508 – INFORMATION AND COMMUNICATION TECHNOLOGY (ICT) STANDARDS

The Section 508 standards established by the Access Board are incorporated into, and made part of all VA orders, solicitations and purchase orders developed to procure ICT. These standards are found in their entirety at: https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines. A printed copy of the standards will be supplied upon request.

Federal agencies must comply with the updated Section 508 Standards beginning on January 18, 2018. The Final Rule as published in the Federal Register is available from the Access Board: https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule.

The Contractor shall comply with “508 Chapter 2: Scoping Requirements” for all electronic ICT and content delivered under this contract. Specifically, as appropriate for the technology and its functionality, the Contractor shall comply with the technical standards marked here:

6.2 COMPATABILITY WITH ASSISTIVE TECHNOLOGY

The standards do not require installation of specific accessibility-related software or attachment of an assistive technology device. Section 508 requires that ICT be compatible with such software and devices so that ICT can be accessible to and usable by individuals using assistive technology, including but not limited to screen readers, screen magnifiers, and speech recognition software.

6.3 ACCEPTANCE AND ACCEPTANCE TESTING

Deliverables resulting from this solicitation will be accepted based in part on satisfaction of the Section 508 Chapter 2: Scoping Requirements standards identified above.

The Government reserves the right to test for Section 508 Compliance before delivery. The Contractor shall be able to demonstrate Section 508 Compliance upon delivery.

7.0 GENERAL REQUIREMENTS

7.1 SOCIAL SECURITY NUMBER (SSN) REDUCTION

The Contractor solution shall support the Social Security Number (SSN) Fraud Prevention Act (FPA) of 2017 which prohibits the inclusion of SSNs on any document sent by mail. The Contractor support shall also be performed in accordance with Section 240 of the Consolidated Appropriations Act (CAA) 2018, enacted March 23, 2018, which mandates VA to discontinue using SSNs to identify individuals in all VA information systems as the Primary Identifier. The Contractor shall ensure that any new IT solution discontinues the use of SSN as the Primary Identifier to replace the SSN with the Integrated Control Number (ICN) in all VA information systems for all individuals. The Contractor shall ensure that all Contractor delivered applications and systems integrate with the VA Master Person Index (MPI) for identity traits to include the use of the ICN as the Primary Identifier. The Contractor solution may only use a Social Security Number to identify an individual in an information system if and only if the use of such number is required to obtain information VA requires from an information system that is not under the jurisdiction of VA.

7.2 INTERNET PROTOCOL VERSION 6 (IPV6)

The Contractor solution shall support Internet Protocol Version 6 (IPv6) based upon the memo issued by the Office of Management and Budget (OMB) on November 19, 2020 (https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-07.pdf). IPv6 technology, in accordance with the USGv6 Program (https://www.nist.gov/programs-projects/usgv6-program/usgv6-revision-1), NIST Special Publication (SP) 500-267B Revision 1 “USGv6 Profile” (https://doi.org/10.6028/NIST.SP.500-267Br1), and NIST SP 800-119 “Guidelines for the Secure Deployment of IPv6” (https://doi.org/10.6028/NIST.SP.800-119), compliance shall be included in all IT infrastructures, application designs, application development, operational systems and sub-systems, and their integration. In addition to the above requirements, all devices shall support native IPv6 and dual stack (IPv6 / IPv4) connectivity without additional memory or other resources being provided by the Government, so that they can function in a mixed environment. All public/external facing servers and services (e.g. web, email, DNS, ISP services, etc.) shall support native IPv6 and dual stack (IPv6 / IPv4) users and all internal infrastructure and applications shall communicate using native IPv6 and dual stack (IPv6 / IPv4) operations.

8.0 POINTS OF CONTACT

VA Program Manager:

Contracting Officer’s Representative:

Contracting Officer:

Contract Specialist:

9.0 INFORMATION SECURITY CONSIDERATIONS:

The Assessment and Authorization (A&A) requirements do not apply and a Security Accreditation Package is not required.

All VA sensitive information shall be protected at all times in accordance with local security field office System Security Plans (SSP’s) and Authority to Operate (ATO)’s for all systems/LAN’s accessed while performing the tasks detailed in this Product Description.

a. A prohibition on unauthorized disclosure: “Information made available to the Contractor or Subcontractor by VA for the performance or administration of this contract or information developed by the Contractor/Subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA.” This clause expressly limits the Contractor/Subcontractor’s rights to use data as described in Rights in Data – General, FAR 52.227-14(d).(1).

b. A requirement for data breach notification: Upon discovery of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the Contractor/Subcontractor has access, the Contractor/Subcontractor shall immediately notify the COR and simultaneously, the designated ISO, and Privacy Officer for the contract. The term “security incident” means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. See VA Handbook 6500.6, Appendix C, paragraph 6.a.

c. A requirement to pay liquidated damages in the event of a data breach: “In the event of a data breach or privacy incident involving SPI the contractor processes or maintains under this contract, the contractor shall be liable to VA for liquidated damages for a specified…