36C10B24R0005 0002 Amendment - FINAL.pdf

5. PROJECT NUMBER (if applicable)

CODE 7. ADMINISTERED BY

2. AMENDMENT/MODIFICATION NUMBER

CODE

6. ISSUED BY

8. NAME AND ADDRESS OF CONTRACTOR

4. REQUISITION/PURCHASE REQ. NUMBER 3. EFFECTIVE DATE

9A. AMENDMENT OF SOLICITATION NUMBER

9B. DATED

PAGE OF PAGES

10A. MODIFICATION OF CONTRACT/ORDER NUMBER

10B. DATED

BPA NO. 1. CONTRACT ID CODE

FACILITY CODE CODE

Offers must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended, by one of the following methods:

The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offers

E. IMPORTANT:

is extended,

(a) By completing Items 8 and 15, and returning __________ copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted; or (c) By separate letter or electronic communication which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR

ACKNOWLEDGMENT TO BE RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY is not extended.

12. ACCOUNTING AND APPROPRIATION DATA

(REV. 11/2016)

is required to sign this document and return ___________ copies to the issuing office. is not, A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE CONTRACT ORDER NO. IN ITEM 10A.

15C. DATE SIGNED

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES

SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(b).

RESULT IN REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by letter or electronic communication, provided each letter or electronic communication makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER

Contractor

16C. DATE SIGNED

14. DESCRIPTION OF AMENDMENT/MODIFICATION

16B. UNITED STATES OF AMERICA

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15A. NAME AND TITLE OF SIGNER 16A. NAME AND TITLE OF CONTRACTING OFFICER

15B. CONTRACTOR/OFFEROR

STANDARD FORM 30 PREVIOUS EDITION NOT USABLE

Prescribed by GSA - FAR (48 CFR) 53.243

(Type or print) (Type or print)

(Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

(Number, street, county, State and ZIP Code)

(If other than Item 6)

(Specify type of modification and authority)

(such as changes in paying office, appropriation date, etc.)

(If required)

(SEE ITEM 11)

(SEE ITEM 13)

(X)

CHECK

ONE

13. THIS ITEM APPLIES ONLY TO MODIFICATIONS OF CONTRACTS/ORDERS,

IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

(Signature of person authorized to sign) (Signature of Contracting Officer)

1 104

A0002

VA-23-00053369

36C10B

Department of Veterans Affairs

Technology Acquisition Center

23 Christopher Way

Eatontown NJ 07724

36C10B

Department of Veterans Affairs

Technology Acquisition Center

23 Christopher Way

Eatontown NJ 07724

To all Offerors/Bidders

36C10B24R0005

11-29-2023

X

X X

Thursday, December 21, 2023 at 10AM EST.

See Continuation Page

Troy Loveland

Contracting Officer

CONTINUATION PAGE FOR AMENDMENT 0002

The following are a summary of the changes made in Amendment 0002:

1. RFP due date is hereby extended to Thursday December 21, 2023 at 10AM EST.

2. Added By Reference Clause 52.204-4, “Printed or Copied Double-Sided on Postconsumer

Fiber Content Paper” (May 2011) under Section C.1.

3. Revisions to Section E.10

4. Revisions to Section B.3. PWS

5. Updates made to Attachment 0001- Price Evaluation Spreadsheet now titled Attachment

0001- Price Evaluation SpreadsheetV2

6. All other terms and conditions from RFP 36C10B24R0005 remain unchanged and in full force effect.

A.2 COMBINED SYNOPSIS/SOLICITATION

This is a combined synopsis/solicitation for commercial items prepared in accordance with the format in Subpart 12.6, as supplemented with additional information included in this notice.

This announcement constitutes the only solicitation; proposals are being requested and an additional solicitation will not be issued.

(i) Request for Proposal (RFP) 36C10B24R0005

(ii) The solicitation document and incorporated provisions and clauses are those in effect through Federal Acquisition Circular 2023-06

(iii) Notice of total Service-Disabled Veteran-Owned Small Business (SDVOSB) set-aside

(iv) See Section B below for the Price Schedule.

(v) See Section B below for the Performance Work Statement.

(vi) The ordering period for the basic contract shall be five years. Freight-On-Board

(FOB) is Destination.

(vii) The provision at 52.212-1, “Instructions to Offerors -- Commercial,” applies to this acquisition. See Section E below for addenda.

(viii) The provision at 52.212-2, “Evaluation -- Commercial Items,” does not apply to this acquisition. See Section E below for the Basis for Award and Proposal Submission

Instructions.

(ix) Offerors shall include a completed copy of the provision at 52.212-3, “Offeror

Representations and Certifications -- Commercial Items,” with its offer. See Section E below for addenda.

(x) The clause at 52.212-4, “Contract Terms and Conditions -- Commercial Items,” and its Alternate I, applies to this acquisition. See Section C below for the addenda.

(xi) The clause at 52.212-5, “Contract Terms and Conditions Required To Implement

Statutes Or Executive Orders -- Commercial Items,” applies to this acquisition. See

Section C below for the addenda.

(xii) See Section B below regarding requirements for Software License, Maintenance, and Technical Support.

(xiii) Please contact Contract Specialist Mike Frank Michael.frank@va.gov, and Contracting

Officer Troy Loveland, Troy.Loveland@va.gov, for information regarding the solicitation.

B.3 PERFORMANCE WORK STATEMENT

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Office of Information & Technology

Office of the Chief Technology Officer

Secure, Performant, Reliable, and User-Centered Experiences

(SPRUCE)

Indefinite Delivery Indefinite Quantity (IDIQ) Contract

Date: 11/28/202312/14/2023

VA-23-00053369

PWS Version Number: 2.21

1.0 OBJECTIVE

The Department of Veterans Affairs (VA) Secure, Performant, Reliable, and User-Centered

Experiences (SPRUCE) is a frictionless vehicle through which VA can acquire top-quality professionals and industry partners to deliver exceptional user experiences. The SPRUCE

Indefinite Delivery Indefinite Quantity (IDIQ) contract connects VA employees with best-in-class industry partners to deliver high-quality digital products in accordance with Office of

Information Technology (OIT) Working Principles.

OIT Working Principles:

• Embrace “Better, Faster, Safer” – Deliver more value by building momentum through continuous, incremental, well-tested changes.

• Automate When Possible – Adapt out processes, our organization, and our technology to automate away manual, error-prone, and tedious work.

• Deliver What Matters – Maximize results for Veterans by working with our users and stakeholders to prioritize work based on what will drive the biggest impact to the outcomes that matter.

• Encourage a Safe and Transparent Culture of Learning – Nurture and build a culture around exploration, collaboration, and innovation – all while celebrating success along the way.

• Trust and Empower Focused Teams of Experts – Foster empowered teams of specialists to take ownership of their products and services.

• Standardize and Re-Use – Create an organization that collaborates on winning approaches, reuses processes and technology, and maximizes shared knowledge and resources.

SPRUCE supports VA’s digital modernization initiatives by ensuring VA has streamlined access to the modern commercial services required to deliver excellent products to VA’s internal and external users. Successfully delivering such products often requires VA to obtain commercial delivery services supported by teams with capabilities in: Software development and operation;

Technical advising and architecture planning; Service design and user research studies; Data science and data analytics; Product support operations.

The objective of this effort is to provide VA with a method to obtain such delivery services.

Specifically, SPRUCE will meet the following goals:

1. Give VA streamlined access to exceptional companies that specialize in the development of digital services using modern technologies.

2. Create a contract mechanism that promotes rapid delivery, applying private sector best practices, and measurable outcomes.

3. Scale the success accomplished in the current Customer Experience, DevOps and Agile

Releases (CEDAR) IDIQ while expanding access to exceptional vendors with more diverse skillsets and enabling larger task orders as appropriate.

4. Ensure VA can rapidly adopt commercial technology and design-industry best practices such as those described in the Office of Management and Budget’s (OMB’s) Digital

Services Playbook.

This effort is consistent with several initiatives to strengthen Federal technology and acquisition practices including but not limited to:

1. The March 2023 National Cybersecurity Strategy, which focused on ensuring a defensible, resilient digital economy where it is costlier to attack systems than defend them, where sensitive or private information is secure and protected, and where neither incidents nor errors cascade into catastrophic, systemic consequences. Ultimately, technology companies and software manufacturers must be held accountable for the safety and security of the products and devices delivered to the Government.

2. The Executive Order on Transforming Federal Customer Experience and Service

Delivery to Rebuild Trust in Government of December 2021 focused on increasing the quality and equity of customer experiences with Government services.

3. The 21st Century Integrated Digital Experience Act of December 2018 aimed to improve the digital experience for government customers and reinforce existing requirements for federal public websites.

4. The Office of Federal Procurement Policy’s (OFPP’s) December 2017 memo encouraging strategic sourcing and strategies to drive performance such as developing common standards and practices in contracts.

5. The Digital Services Playbook, released by OMB in August 2014, as a best-practices guide for agencies to use when developing effective digital services.

6. The TechFAR Handbook, released by OFPP in August 2014, as a guide to the procurement of agile design and development services within the Information

Technology (IT) Consulting, IT Outsourcing, and IT Security Categories.

2.0 SCOPE

The SPRUCE IDIQ contract vehicle will provide VA with commercial, streamlined delivery services and teams. The contractor(s) shall provide VA with expert teams that shall consistently deliver viable digital solutions in support of VA’s strategic mission and objectives.

The specific nature of the capabilities required for each team will be articulated at the Task Order level. However, it is expected that a typical delivery team requested under the SPRUCE IDIQ will require multi-disciplinary teams with members having expertise in: software development and operations, technical advising and architecture planning, service design and user research studies, data science and data analytics, and product support operations (task orders may include multiple functional areas). Task Orders will be limited to a total value of $50M, including options. SPRUCE will have a total ordering ceiling of $2,442,037,228.80.

3.0 APPLICABLE DOCUMENTS

The Contractor shall comply with the documents listed below. Additional documents may be listed in individual Task Orders.

1. The U.S. Digital Services Playbook (https://playbook.cio.gov/)

2. “Federal Information Security Modernization Act of 2014”

3. Federal Information Processing Standards (FIPS) Publication 140-2, “Security

Requirements For Cryptographic Modules”

4. FIPS Pub 199. Standards for Security Categorization of Federal Information and Information Systems, February 2004 https://playbook.cio.gov/

5. FIPS Pub 200, Minimum Security Requirements for Federal Information and

Information Systems, March 2006

6. FIPS Pub 201-2, “Personal Identity Verification of Federal Employees and

Contractors,” August 2013

7. VA Directive and Handbook 6102, “Internet/Intranet Services,” August 5, 2019

8. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021

9. VA Handbook 6500, “Risk Management Framework for VA Information Systems

VA Information Security Program,” February 24, 2021

10. VA Handbook 6500.5, “Incorporating Security and Privacy in System Development

Lifecycle”, March 22, 2010

11. VA Handbook 6500.6, VA Information and Information System Security/Privacy

Language, including all Appendices, dated March 12, 2010

12. “Completing the Transition to Internet Protocol Version 6 (IPv6):

https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-07.pdf

13. USGv6 Program (https://www.nist.gov/programs-projects/usgv6-program/usgv6-revision-1)

14. NIST Special Publication (SP) 500-267B Revision 1 “USGv6 Profile”

(https://doi.org/10.6028/NIST.SP.500-267Br1)

15. NIST SP 800-119 “Guidelines for the Secure Deployment of IPv6”

(https://doi.org/10.6028/NIST.SP.800-119)

16. Office of Management and Budget Memorandum (OMB) M-19-26, “Update to the

Trusted Internet Connections (TIC) Initiative“ (https://www.whitehouse.gov/wp-content/uploads/2019/09/M-19-26.pdf),

17. VA Directive 6513 “Secure External Connections”

18. TIC 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

3.1 Development Methodologies

The contractor’s support and solutions shall follow the practices described in the Digital Services

Playbook (https://playbook.cio.gov). The contractor shall be thoroughly familiar with the concepts in each play and implement them in its approaches and support. The contractor shall design, develop, configure, customize and deploy solutions to some of VA’s most pressing challenges. Once deployed, the contractor shall provide production support of the solution as required. The contractor shall provide support to projects that are building brand new systems as well as projects that are building on top of, or replacing, existing systems. The contractor shall be thoroughly familiar with current and emerging technologies, Software-as-a-Service products, services, various programming languages and processes required to deliver high-quality products.

The Contractor shall:

General

1. Deliver high-quality, usable, functional products that help users accomplish their tasks.

2. Follow the Digital Services Playbook (https://playbook.cio.gov).

3. Cultivate positive, trusting, and cooperative working relationships with all persons supporting the work, including government employees and other vendors.

https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-07.pdf file://///R04.med.va.gov/V03/EAS/Users/vhaeasWymbsk/TEMPLATES--NEW%20TAC%20PROCESS/PWS%20TEMPLATE%20(DO%20NOT%20TOUCH)%20-%20In%20Process%20Revisions/DO%20NOT%20TOUCH%20(next%20version/IPv6/(https:/www.nist.gov/programs-projects/usgv6-program/usgv6-revision-1 file://///R04.med.va.gov/V03/EAS/Users/vhaeasWymbsk/TEMPLATES--NEW%20TAC%20PROCESS/PWS%20TEMPLATE%20(DO%20NOT%20TOUCH)%20-%20In%20Process%20Revisions/DO%20NOT%20TOUCH%20(next%20version/IPv6/(https:/www.nist.gov/programs-projects/usgv6-program/usgv6-revision-1 https://doi.org/10.6028/NIST.SP.500-267Br1 https://doi.org/10.6028/NIST.SP.800-119 https://www.whitehouse.gov/wp-content/uploads/2019/09/M-19-26.pdf https://www.whitehouse.gov/wp-content/uploads/2019/09/M-19-26.pdf https://www.cisa.gov/publication/tic-30-core-guidance-documents https://www.cisa.gov/publication/tic-30-core-guidance-documents https://playbook.cio.gov/

4. Participate in Communities of Practice (CoP) activities for Product, Design, Engineering, and Data where applicable.

Product

5. Work in self-contained, cross-functional teams capable of delivering complete products, including research, design, architecture, engineering, support, and documentation.

6. Incorporate agile practices and ceremonies into all work, such as sprint planning, daily standups, sprint review, retrospective, user stories/epics, backlog grooming, and estimating activities.

7. Establish goals, objectives, key performance metrics, and make bets to improve user outcomes. Bets are hypotheses that could impact established metrics and they encourage acceptance of uncertainty in the software development process.

8. Push new features and incremental improvements to production early and often, applying phased release practices with product health and performance targets.

9. Build applications and platforms with the intent of enhancing and sustaining that application until relieved by the Government or another team.

10. Collect customer feedback, hold product impact reviews, provide or support tiered troubleshooting and on-call operations, and complete postmortem incident reports.

11. Measure and improve performance against DevOps Research and Assessment (DORA) metrics including deployment frequency, lead time for changes, change failure rate, and time to restore service.

Design

12. Understand the users' entire experience. Create personas, customer journeys, service blueprints, problem space definitions, affinity maps, and flow diagrams (as appropriate) to ensure the digital service is cohesive with the offline experience.

13. Actively involve users in the design of digital solutions by incorporating best practices for design, user research, and usability testing.

14. Personalize solutions for the user by leveraging known information to create a seamless, tailored user experience.

15. Optimize for mobile-first and ensure all solutions are equally available on both mobile and desktop.

16. Follow all user interface design and content guidelines and standards defined in the VA

Design System and VA Content Style Guide (https://design.va.gov/) including the use of plain language to maintain a consistent look, feel, and voice across public facing sites and services.

17. Incorporate robust accessibility principles into design, development, and testing for all web applications to deliver high-quality digital experiences to all users that meet or exceed current W3C Web Content and Accessibility Guidelines (WCAG).

Engineering

18. Use widely adopted or industry-standard programming languages and frameworks.

19. Follow software development best practices including peer review, test coverage, portability, and clear documentation.

https://design.va.gov/

20. Run unit tests, integration tests, functional tests, load tests, and accessibility tests on

100% of functionality delivered.

21. Leverage cloud-based infrastructure, platforms, and services to improve scalability, reliability, performance, and maintainability.

22. Continuously integrate code from development teams, run automated testing, promote code through multiple environments, and automate high frequency deployments.

23. Monitor infrastructure health, application performance, and user outcomes. Ensure observability of the system/application/service status and leverage alerting integrations.

24. Maintain the confidentiality, integrity, and availability of sensitive information, including user information by following widely accepted or industry-standard methods, including

Zero Trust security principles.

25. Ensure configuration and sensitive data, including data the VA defines as sensitive, are not present in source code.

26. Deliver all code not containing configuration or sensitive data to an open-source repository. Share your documentation, development processes, and lessons learned publicly.

27. Use established VA internal tools including source code management, team communication, developer toolkits, and analytics products.

28. Make use of existing platforms to build and deploy software, such as the VA.gov

Platform and Lighthouse Delivery Infrastructure, wherever possible.

29. Adopt and follow VA API standards contained in the Lighthouse Hub

(https://hub.lighthouse.va.gov/docs/default/component/lighthouse-api-standards/).

30. Make application data available for use across the VA enterprise with versioned RESTful application programming interfaces (APIs) and discoverability in the Lighthouse API hub

(https://hub.lighthouse.va/catalog) where applicable.

31. Design health-related services to meet Fast Healthcare Interoperability Resources (FHIR) standards where applicable.

3.2 Quality Assurance

The performance of SPRUCE contract holders will be measured in two contexts. One will be at the Task Order (TO) level using metrics specific to the nature of work required on the TO (for instance, a TO for a web-based application may use metrics like customer satisfaction, system uptime, submission errors, etc.). The second context will be at the overall SPRUCE base contract level used to meet Contractor Performance Information requirements (e.g. Contract

Performance Assessment Reporting System (CPARS)) in accordance with Federal Acquisition

Regulation (FAR) Part 42.15. In some cases, the Government may specify required metrics for a specific TO Quality Assurance Surveillance Plan (QASP), while in other cases Contract Holders may be asked to propose metrics as part of their Task Execution Plans (TEPs), which may or may not be used for TO evaluation purposes. It is the Government’s preference, when appropriate and practical, that performance information be provided via real-time tools (e.g.

dashboards) made available to the Government rather than via separate paper or electronic reports.

https://hub.lighthouse.va.gov/docs/default/component/lighthouse-api-standards/ https://hub.lighthouse.va/catalog

4.0 TECHNICAL FUNCTIONAL AREAS

Individual TO may encompass more than one functional area listed below. Efforts to be performed by the Contractor under this contract are of such a nature that they may create a potential and/or actual organizational conflict of interest as contemplated by Subpart 9.5 of the

FAR. Contractor personnel may be required to sign a non-disclosure agreement.

1. Software development and operation. Build, improve, innovate, and run custom, open-source products across the OIT ecosystem. Leverage existing VA infrastructure and platforms including VA Enterprise Cloud, VA.gov, Clinical Decision Support, Lighthouse Application Programming Interfaces (API) Gateway, and others. May include

(but not limited to): responsive web applications; API; prototypes and SaaS pilots; mobile applications; and internal claims processing and health applications.

2. Technical advising and architecture planning. Provide expert technical guidance and

IT operations support to OIT personnel in the execution of their portfolio or product line priorities. Provide architecture planning services and stand-up operational frameworks for delivery. May include (but not limited to) supporting innovation from commercial practices, engineering operations, analysis of alternatives, and systems and boundaries disambiguation.

3. Service design and user research studies. Measure and define the service delivery landscape and create plans for implementing VA digital services. May include (but not limited to) problem definition, ethnographic studies, and qualitative and quantitative research.

4. Data science and data analytics. Define and implement data access, integration, and organization systems to exchange critical data between VA systems and enable new applications. May include (but not limited to) data modeling, machine learning, and natural language processing.

5. Product support operations. Provide product and program level support for VA systems, primarily for internal user applications. May include (but not limited to):

program planning; business case analysis; user management and permissions; onboarding and training; and internal helpdesk support.

5.0 DELIVERABLES

5.1 Products

All products shall be delivered to the Government locations and accepted by authorized

Government personnel as specified in the individual Task Orders. Inspection and acceptance criteria shall be specifically identified in each Task Order. The COR shall be notified of any discrepancies found during acceptance inspection upon identification. All custom-developed code shall be developed as Open Source Software (OSS) and made available in a public repository unless it contains sensitive data as defined by VA.

5.2 Data

The Government shall receive Unlimited Rights to intellectual property first produced and delivered in the performance of this contract in accordance with (IAW) FAR 52.227-14, Rights

In Data-General (May 2014). This includes all rights to source code and any and all documentation created in support thereof. License rights in any Commercial Computer Software shall be governed by FAR 52.227-19, Commercial Computer Software License (DEC 2007).

Any data delivered shall be submitted and protected IAW VA Handbook 6500.

6.0 REPORTING AND MEETING REQUIREMENTS

6.1.1 T&M Status Report

The Contractor shall submit a Time and Materials (T&M) Status Report for each T&M TO.

This Task Order report shall be unique to each Task Order. This report is not required for

Firm Fixed Price (FFP) TO.

For Each T&M TO, indicate:

1. Expenditures for the reporting period by labor, material and Other Direct Costs (ODC)

2. Burn Rate and when funding is expected to run out given current Burn Rate

3. Labor costs shall be separated/differentiated by the assigned numbering system for contract, TO and labor category, entity (Prime or Subcontractor), rates and hours

4. Material costs and ODCs shall be identified by type, and subcontractor (as applicable), and discussed briefly to indicate for what the material and/or ODC was used

5. Total task expenditures for the fiscal year to date, indicated as total, labor, materials and

ODCs

6. Total task expenditures since task award, indicated as total, labor, materials and ODCs

7. The Contract Performance Report as set forth in Section D, Attachment 002– TM Labor

Hour Status Report, shall be submitted monthly via the Acquisition Task Order

Management System (ATOMS) portal.

6.1.2 Delivery and Monitoring Report and Roster:

The Contractor shall provide a single monthly report, detailing and providing links to all stories, epics, and other work completed. This includes a plain language description of all work accepted by the Government Product Owner and COR at the end of each sprint. This report shall include, in plain language, additional details about the project status, sprint team velocity, sprint team goal completion, and highlight project risks. The report shall also highlight and provide links to key infrastructure and application monitoring data. The report shall also include details with links to documentation for any critical incidents or outage events that resulted in service outages or significant service degradations. The Contractor shall attach or provide links to postmortem documentation for all critical incidents or outage events. Should there not be any reported incidents during the reporting period, a link to the relevant monitoring tools is sufficient. The specific data points and format of this monthly report shall be determined by the Contractor in collaboration with the Government Product Owner and COR. The Delivery and Monitoring

Report and Roster shall be uploaded to a VA provided SharePoint. Lastly, the Contractor shall submit a roster to the COR in accordance, that includes the Status of Government Furnished

Equipment (GFE) in accordance with the following:

The Contractor shall also provide, and maintain, a TO TM Labor Hour Status Report utilizing the template (Attachment 002 - TM Labor Hour Status Report), which includes data on all

Contractor and Subcontractor personnel employed under each TO to begin and maintain their background investigations. The Contractor Staff Roster shall be continuously updated, with notification to the COR within one day of any changes in employee status, training certification completion status, Background Investigation level status, additions/removal of employees, etc., throughout the Period of Performance. The Contractor Staff Roster should indicate which employees are active or inactive. For inactive employees, the roster should indicate the date the employee was separated from the Task Order and their credentials returned to the COR.

Contractors are responsible for ensuring the COR is aware of all offboarded contractor personnel and ensure a request is sent to VA to remove the personnel’s access to any VA systems within 24 hours (to include Slack, SOCKS proxy, and GitHub) when the employee is not being onboarded to a different task order immediately.

The Contractor shall include the following items:

1. Task Order

2. Project Name

3. Employee Name

4. Contractor’s Full Name

5. Whether Contractor is Prime or Subcontractor

6. Email Address

7. Place of Birth

8. Date of Birth

9. Security/Privacy Training Completion Dates

10. Risk Designation-individual background investigation level requirement (Refer to

Section 4.6 of the Task Order Performance Work Statement (PWS) for investigative requirements by task)

11. Status of Background Investigation and/or Clearance, including if an existing Clearance exists

12. The Contractor shall submit full Social Security Numbers either within the Contractor

Staff Roster or under separate cover to the COR. The preferred method to send the

Contractor Staff Roster or Social Security Number is by encrypted e-mail. If unable to send encrypted e-mail, other methods which comply with FIPS 140-2 are to encrypt the file, use a secure fax, or use a traceable mail service.

13. Labor Category

14. Facility location

15. Tour of Duty Schedules (e.g. Monday through Friday, 9:00 am to 5:00 pm)

16. Universal Unique Identifier UUID (Badge Number bottom right of back of badge)

17. Facility where badge was issued

18. Badge Expiration Date

19. Project supported

20. Date Disassociated from Contract (for employees who no longer support this contract)

21. Date Badge Returned to COR

22. Contractor Rules of Behavior

23. VA Cyber Security Awareness and Rules of Behavior Training

24. Annual VA Privacy Training

25. If GFE assigned,

a. Type of Equipment

b. VA Bar Code

c. Location

d. Value

e. Total Number of Pieces

f. Total Value of Equipment

g. Anticipated Transfer Date to Government and its Location

6.2 Meetings and Reviews

For successful management and contract surveillance, the following meetings and reviews are required.

6.2.1 Post-Award Conferences

The Government intends to convene a one-time Post-Award Conference with each awardee within 60 days after contract award. The CO shall notify all Prime Contractors of a specific date, location and agenda within approximately 30 days after contract award.

6.2.2 Prime Contractor Deep Dives

The Government intends to convene regular deep-dive meetings with the Prime contractors to discuss opportunities to improve delivery quality and culture on the SPRUCE IDIQ vehicle.

These meetings will be scheduled by the Government with at least five (5) business days’ notice.

The Prime contractors are expected to escalate blockers, share lessons learned, and highlight opportunities to improve the VA delivery environment.

6.2.3 Quarterly Collective Prime Program Reviews

VA shall host a quarterly Prime Program Review with the designated Prime Program Manager

(PM) and other attendees as appropriate. Dates, locations, and agenda shall be specified at least five (5) calendar days prior to the meeting.

7.0 GENERAL REQUIREMENTS

The Contractor shall provide and/or acquire the services, hardware, and software required by individual TO pursuant to the general requirements specified below.

7.1 Contract Type

This is an IDIQ Multiple Award Task Order (MATO) contract. Individual TOs shall be issued on a performance-based T&M/Labor Hour and/or FFP basis.

7.2 Place of Performance

It is expected that contractor’s teams will be required to frequently interact with system users and program staff in support of this contract and the task orders placed against it. Support will be required at Government facilities (on-site) and at non-Government facilities (offsite). Specific site locations will be defined at the TO level. The Government anticipates that most of the work will occur in the contiguous United States (CONUS). For support provided at Government facilities, the Government may provide space and equipment (e.g., phone, desktop computer and peripherals, desk and accessories, etc.) for Contractor personnel. The Contractor personnel may be required to work offsite (i.e. at the prime or subcontractor facilities) when adequate workspace is not available at the Government site.

7.3 Travel

Travel shall be IAW individual TO requirements. Travel details must be provided to, and approved by, the TO COR or the Government designee prior to the commencement of travel.

All travel shall be IAW the Federal Travel Regulations.

7.4 Government-Furnished Materials

The Government has multiple remote access solutions available to include Citrix Access

Gateway (CAG), Site-to-Site Virtual Private Network (VPN), and RESCUE VPN.

The Government’s issuance of GFE is limited to Contractor personnel requiring direct access to the network to: development environments; install, configure and run Technical Reference

Model (TRM) approved software and tools (e.g., Oracle, Fortify, Eclipse, SoapUI, WebLogic, LoadRunner); upload/download/manipulate code, run scripts, and apply patches; configure and change system settings; check logs, troubleshoot/debug, and test/QA. Government Furnished

Property (GFP) may also include Government Furnished Material (GFM), Government

Furnished Information (GFI), and GFE and shall be identified in the individual TO.

7.5 Contractor-Acquired Materials

The Contractor shall acquire and/or provide any hardware and/or software required to accomplish each TO that is not provided as GFP. If the Contractor provides software as part of an individual TO, software integrity shall be maintained by the Contractor in accordance with the licensing terms of the manufacturer/producer until such software is delivered to the Government, or otherwise disposed of IAW Government direction. Items delivered to the Government shall be approved by the Government in advance of purchase and be in accordance with all applicable

VA security requirements. Please note: this section is required for contractor acquired materials, including commercial software, used during contract performance. However, this does not apply to open-source code delivered under the contract scope which will be provided in accordance with FAR

52.227-14.

7.6 Warranty

Items acquired under this contract may require warranty protection. Commercial warranties shall be transferred to the Government. The type of warranty and extent of coverage shall be determined on an individual TO basis.

7.7 One-VA Technical Reference Model

The Contractor shall comply with VA’s OI&T Technical Reference Model (VA TRM) when applicable.

8.0 SECURITY AND PRIVACY

8.1 Information Security and Privacy Security Requirements

The Contractor shall comply with VA security requirements IAW VA Handbook 6500.6

“Contract Security” and Addendums A, B, and C. Addendum B may be tailored at TO level.

8.2 Personnel Security Requirements

The Contractor(s) shall comply with all personnel security requirements included in this contract and any unique organization security requirements described in each TO. All contractor personnel who require access to VA sensitive information/computer systems shall be subject to background investigations and must receive a favorable background investigation from VA prior to beginning work on each project.All Contractor personnel who require access to VA sensitive information/computer systems shall be subject to background investigations and must receive a favorable background investigation from VAprior to TO award(?).

The position sensitivity risk designation [LOW, MODERATE, and HIGH] and associated level of background investigation [Tier 1, Tier 2, and Tier 4] for each TO PWS task shall be designated accordingly, as identified within each TO PWS. The level and process of background security investigations for Contractors must be IAW VA Directive and Handbook 0710, “Personnel Security and Suitability Program.”

a. The Contractor shall prescreen all personnel requiring access to the computer systems to ensure they maintain the appropriate security risk designation(?), and are can read, write, speak and understand the English language.

b. Contractors shall ensure they comply with the requirements of Section 6.1.3 above for all awarded TO.

c.b. The Contractor should coordinate the location of the nearest VA fingerprinting office through the COR. Only electronic fingerprints are authorized. The Contractor shall bring their completed Security and Investigations Center (SIC) Fingerprint request form with them (see paragraph d.4 below) when getting fingerprints taken.

d.c. The Contractor shall ensure the following required forms are submitted to the COR within 5 days after contract award:

1. Optional Form 306

2. Self-Certification of Continuous Service

3. VA Form 0710

4. Completed Security and Investigations Center (SIC) Fingerprint Request

Form e.d. The Contractor personnel shall submit all required information related to their background investigations (completion of the investigation documents (SF85, SF85P, or

SF 86) utilizing the Office of Personnel Management’s (OPM) Electronic Questionnaire for Investigations Processing (e-QIP) after receiving an email notification from the

Security and Investigation Center (SIC).

f.e. The Contractor employee shall certify and release the e-QIP document, print and sign the signature pages, and send them encrypted to the COR for electronic submission to the

SIC. These documents shall be submitted to the COR within 3 business days of receipt of the e-QIP notification email. (Note: OPM is moving towards a “click to sign” process. If click to sign is used, the Contractor employee should notify COR within 3 business days that documents were signed via eQIP).

g.f. The Contractor shall be responsible for the actions of all personnel employed by the

Contractor provided to work for VA under this contract. In the event that damages arise from work performed by Contractor provided personnel under the auspices of this contract, the Contractor shall be responsible for all resources necessary to remedy the incident.

h.g.If the background investigation determination is not completed prior to the start date of work identified in each TO, a Contractor may be granted unescorted access to VA facilities and/or access to VA Information Technology resources (network and/or protected data) with a favorably adjudicated Special Agreement Check (SAC), completed training delineated in VA Handbook 6500.6 (Appendix C, Section 9), signed “Contractor

Rules of Behavior”, and with a valid, operational PIV credential for PIV-only logical access to VA’s network. A PIV card credential can be issued once the SAC has been favorably adjudicated and the background investigation has been scheduled by OPM.

However, the Contractor remains responsible for the actions of the Contractor personnel provided to perform work for VA. The investigative history for Contractor personnel working under this contract must be maintained in the database of the Office of Personnel

Management (OPM).

i.h. The Contractor, when notified of an unfavorably adjudicated background investigation on a Contractor employee, shall remove the employee from all work under the contract.

j.i. Failure to comply with the Contractor personnel security investigative requirements may result in loss of physical and/or logical access to VA facilities and systems by Contractor and Subcontractor employees and/or termination of the contract for cause or default.

k.j. Identity Credential Holders must follow all HSPD-12 policies and procedures as well as use and protect their assigned identity credentials in accordance with VA policies and procedures, displaying their badges at all times, and returning the identity credentials upon termination of their relationship with VA.

8.3 Incident Reporting and Management

The Contractor shall inform the COR, VA PM and assigned local Information Security Officer

(ISO) of any security events and the Privacy Officer (PO) for any privacy violations within one hour of occurrence. Contractor will provide updates on the reported security/privacy events until closed by the ISO/PO.

8.4 Security and Privacy Awareness Training

The Contractor shall complete the initial security and privacy awareness training and accept the

VA Contractor Rules of Behavior (ROB) within two days of TO award in the VA Talent

Management System (TMS). The Contractor shall complete the annual security and privacy awareness training and accept the VA Contractor ROB prior to expiration in the VA TMS.

9.0 CONTRACT MANAGEMENT

9.1 Task Order COR

A COR shall be designated for each TO. The COR shall be designated by the CO and duties will be delegated in a designation letter. The COR is the Requiring Activity’s designated representative. The COR designated for each TO shall provide the Contractor access to all available Government furnished information, facilities, material, equipment, and/or services as required to accomplish each TO. Contract surveillance duties shall be defined and accomplished

IAW each TO QASP.

9.2 Contractor Program Management

The Contractor shall establish a single management focal point, the PM, to accomplish the administrative, managerial and financial aspects of this contract and all subsequent TOs. This individual shall be identified to the CO/COR(?) as the focal point for all programmatic issues.

9.3 Task Order Management and Award

The VA ATOMS portal shall be utilized for the award of each TO.

9.4 Pre-Award Task Order Procedures

9.4.1 Request for Task Execution Plan (RTEP) Process

Upon identification of the need for a TO, a tracking number shall be assigned and the CO shall issue a RTEP to the Contract Holders. In some cases, prior to issuance of a formal RTEP, a

Request for Information (RFI) or other market research request may be released to assist the

Government in gathering industry feedback to inform RTEPs.

9.4.2 Task Execution Plan

Fair opportunity requirements shall be IAW applicable statutes, regulations, and case law. The

Government’s RTEP does NOT constitute an authorization to start work.

Within seven (7) work days of receipt of the RTEP, or unless otherwise specified within an

RTEP, the interested Contractor holders shall submit one Task Execution Plan (TEP) IAW the format provided below unless otherwise specified by the CO in the RTEP. The following information shall be provided and submitted into the ATOMS portal:

A. In addition to the information requested within an RTEP, the following shall be addressed in every TEP.

1. Proposal Summary Volume including*:

a. RTEP number

b. Date submitted

c. Contractor’s name, Unique Entity Identifier (UEI) and Commercial and

Government Entity (CAGE) Code

d. Contractor point of contact information for questions

e. Subcontractor(s) shall be identified by name, UEI and CAGE Code at all tiers (as applicable)

f. Proposed start and finish dates

g. Proposed total price/cost

h. Any Assumptions should be listed here including but not limited to Price and

Technical

i. Offerors’ acknowledgement that any Offeror-imposed terms and conditions which deviate from the Government’s material terms and conditions established by the

RTEP may will render the Offeror’s proposal Unacceptable, and thus ineligible for award.

j. Duration for which proposal is valid (minimum 90 days)

k. VAAR 852.209-70 is in effect for all RTEPs issued and the contractor should provide a statement IAW VAAR 852.209-70(b), when applicable

l. Acknowledgement of Amendments.

m. Contractors will be responsible for identifying any personnel subject to the Service

Contract Act (SCA), and their corresponding region (state/county), within their

TEP, as well as provide appropriate and up to date Wage Determinations.

n. Include certification required by VAAR Clause 852.219-75 as an addendum to the proposal summary (this can be in PDF or Microsoft Word Format included in the summary volume or done as a separate addendum document).

*Please Note: Nothing shall be included in this volume other than what is requested to be in this Section (8.3.2.A) unless otherwise specified within an RTEP.

B. The following shall be addressed only for FFP tasks (please note this does not apply to T&M orders and specific guidance will be provided in each T&M RTEP):

A price proposal volume shall be submitted in Microsoft Excel spreadsheet format and shall contain the following:

1. The first tab shall be a summary to include a top-level rollup of the total dollars and percentages by labor, materials, travel, ODCs, and total TO price. All prices shall be rounded to the nearest cent (two decimal places). The Government reserves the right to correct any rounding errors identified in the Offeror’s TEP.

2. The Summary tab shall also include a breakout of the total price by dollars, percentages, and socio-economic status for the Prime and each proposed Subcontractor. This breakout must clearly demonstrate that Offeror’s proposal meets the set-aside requirement in accordance with 13 CFR §125.6.

3. Labor shall further be proposed by labor categories, labor rates, and hours. A separate tab shall be used for the Prime and each Subcontractor for all labor proposed. Include a total of all hours proposed by period of performance and optional tasks(s).

4. The Contractor shall submit a completed Price Schedule including all priced line items for the base period and any options. The Contractor shall complete the actual Price

Schedule document included in the RTEP and submit that document in its original format with their TEP.

5. Offerors are hereby advised that any Pricing Assumptions which deviate from the

Government’s requirements or material terms and conditions established by the RTEP, may will render the Offeror’s proposal Unacceptable, and thus ineligible for award. Any pricing assumptions should be included in the summary volume only.

6. “Information Other than Cost or Pricing Data” may be required where there is not

“adequate price competition” as defined in FAR 15.403-1(c).

7. The Contractor shall notify the Government when using Department of Labor (DoL) labor categories. The notice shall provide what county and state the work is being performed in, and what labor categories are bid.

C. The following pertains to the preparation and submission of all TEPs:

1. Contractors are NOT to submit past performance as a part of their TEP, unless specified in the RTEP.

2. TEP Format (3 sections, items a, b, and c below) a Proposal Summary Volume

i. PDF format b Technical Volume i PDF format (unless otherwise specified in the RTEP or when there are page limitations \ ii No marketing materials; information relevant to the requirement only c Price/Cost Volume

i. Shall be provided in Microsoft Excel with the exception of the Price Schedule

ii. All Prime and Subcontractor Labor costs, Material costs, Travel, and ODCs must:

(a) Include (using MS Excel) a Summary Tab for Cost roll-up, and separate

Tabs for Base Period and any Option;

(b) Include separate tabs for Subcontractor(s)

(c) Clearly state when using DOL labor categories, including in what County and State the work shall be performed, and what labor category(s) are proposed, including a copy of the applicable DOL Wage Determination for the relevant location and period of performance

iii. For any TO awarded without Fair Opportunity, all Prime and Subcontractor

Labor costs, Material costs, travel, and ODCs must be proposed per c. i and c. ii above. “Information other than cost or pricing data” may be required where there is not “adequate price competition” as defined in FAR 15.403-1(c).

3. Page Limitations. When page limitations are specified in the RTEP, the following format shall apply to the Technical Volume:

The Technical Volume shall be submitted as a MS Word, Office 365 file only. Page size shall be no greater than 8 1/2" x 11". The top, bottom, left and right margins shall be a minimum of one inch each. Font size shall be no smaller than 12-point. Times New

Roman fonts are required. Characters shall be set at no less than normal spacing and

100% scale. Tables and Illustrations are not subject to the font and spacing requirements.

All proposal pages, including those containing Tables or Illustrations shall comply with the margin requirements. Tables and Illustrations shall be legible at 100% zoom. If a

Table or Illustration is illegible at 100% zoom, then the entire Table or Illustration will be deemed to be in violation and will not be evaluated. Line spacing shall be set at no less than single space. Page numbers, company logos, and headers and footers may be within the page margins ONLY, and are not bound by the 12-point font requirement. Footnotes to text shall not be used. If the Offeror submits annexes, documentation, attachments, or the like, not specifically required by this solicitation, such will count against the Offeror’s page limitations unless otherwise indicated in the specific Volume instructions. Pages in violation of these instructions, either by exceeding the margin, font or spacing restrictions or by exceeding the total page limit for a particular volume, will not be evaluated. Pages not evaluated due to violation of the margin, font or spacing restrictions will not count against the page limitations. The page count will be determined by counting the pages in the order they come up in the print layout view. The Cover Page and Table of Contents are not included in the page count however any additional matrices, appendices, or acronym lists, etc. will count against page limitation.