36C10B24R0005 SPRUCE - FINAL to post.pdf

PAGE 1 OF 1. REQUISITION NO.

2. CONTRACT NO. 3. AWARD/EFFECTIVE DATE 4. ORDER NO. 5. SOLICITATION NUMBER 6. SOLICITATION ISSUE DATE

a. NAME b. TELEPHONE NO. (No Collect Calls) 8. OFFER DUE DATE/LOCAL

TIME

9. ISSUED BY CODE 10. THIS ACQUISITION IS UNRESTRICTED OR SET ASIDE: % FOR:

SMALL BUSINESS

HUBZONE SMALL

BUSINESS

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

WOMEN-OWNED SMALL BUSINESS

(WOSB) ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

EDWOSB

8(A)

NAICS:

SIZE STANDARD:

11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

SEE SCHEDULE

12. DISCOUNT TERMS

13a. THIS CONTRACT IS A

RATED ORDER UNDER

DPAS (15 CFR 700)

13b. RATING

14. METHOD OF SOLICITATION

RFQ IFB RFP

15. DELIVER TO CODE 16. ADMINISTERED BY CODE

17a. CONTRACTOR/OFFEROR CODE FACILITY CODE 18a. PAYMENT WILL BE MADE BY CODE

TELEPHONE NO. UEI: EFT:

PHONE: FAX:

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN OFFER

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK BELOW IS CHECKED

SEE ADDENDUM

19. 20. 21. 22. 23. 24.

ITEM NO. SCHEDULE OF SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

(Use Reverse and/or Attach Additional Sheets as Necessary)

25. ACCOUNTING AND APPROPRIATION DATA 26. TOTAL AWARD AMOUNT (For Govt. Use Only)

27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1, 52.212-4. FAR 52.212-3 AND 52.212-5 ARE ATTACHED. ADDENDA ARE ARE NOT ATTACHED.

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA ARE ARE NOT ATTACHED

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN _______________ 29. AWARD OF CONTRACT: REF. ___________________________________ OFFER

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND DATED ________________________________. YOUR OFFER ON SOLICITATION

DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY (BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE

ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED SET FORTH HEREIN IS ACCEPTED AS TO ITEMS:

30a. SIGNATURE OF OFFEROR/CONTRACTOR 31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER)

30b. NAME AND TITLE OF SIGNER (TYPE OR PRINT) 30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER (TYPE OR PRINT) 31c. DATE SIGNED

AUTHORIZED FOR LOCAL REPRODUCTION (REV. NOV 2021)

PREVIOUS EDITION IS NOT USABLE Prescribed by GSA - FAR (48 CFR) 53.212

7. FOR SOLICITATION

INFORMATION CALL:

STANDARD FORM 1449

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL PRODUCTS AND COMMERCIAL SERVICES

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 30

36C10B24R0005 11-29-2023

Mike Frank 848-377-5121 12-13-2023

3PM EST

36C10B

Department of Veterans Affairs

Technology Acquisition Center

23 Christopher Way

Eatontown NJ 07724

X 100

X

541519

$34M

N/A

X

See Delivery Schedule

36C10B

Technology Acquisition Center

36C10A

Technology Acquisition Center

Financial Services Center

PO Box 149971

Austin TX 78714-8971

See Continuation Page

X X

Troy Loveland

Contracting Officer

36C10B24R0005

Table of Contents

SECTION A

A.1 SF 1449 SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL PRODUCTS AND

COMMERCIAL SERVICES

A.2 COMBINED SYNOPSIS/SOLICITATION

A.3 GOVERNING LAW

A.4 SOFTWARE LICENSE, MAINTENANCE AND TECHNICAL SUPPORT:

SECTION B - CONTINUATION OF SF 1449 BLOCKS

B.1 CONTRACT ADMINISTRATION DATA

B.2 PRICE SCHEDULE

B.3 PERFORMANCE WORK STATEMENT

SECTION C - CONTRACT CLAUSES

C.1 52.252-2 CLAUSES INCORPORATED BY REFERENCE (FEB 1998)

C.2 52.203-16 – PREVENTING PERSONAL CONFLICTS OF INTEREST (JUN 2020)

C.3 52.204-21 BASIC SAFEGUARDING OF COVERED CONTRACTOR INFORMATION

SYSTEMS (NOV 2021)

C.4 52.212-5 CONTRACT TERMS AND CONDITIONS REQUIRED TO IMPLEMENT

STATUTES OR EXECUTIVE ORDERS—COMMERCIAL ITEMS (NOV 2023)

C.5 52.216-18 ORDERING (AUG 2020)

C.6 52.216-19 ORDER LIMITATIONS (OCT 1995)

C.7 52.216-22 INDEFINITE QUANTITY (OCT 1995)

C.8 52.227-19 COMMERCIAL COMPUTER SOFTWARE LICENSE (DEC 2007)

C.9 852.201-70, CONTRACTING OFFICER REPRESENTATIVE (DEC 2022)

C.10 852.203-70, COMMERCIAL ADVERTISING (MAY 2018)

C.11 852.204-70 PERSONAL IDENTITY VERIFICATION OF CONTRACTOR PERSONNEL

(MAY 2020)

C.12 852.212-71 GRAY MARKET AND COUNTERFEIT ITEMS (FEB 2023)

C.13 852.212-72 GRAY MARKET AND COUNTERFEIT ITEMS – INFORMATION

TECHNOLOGY MAINTENANCE ALLOWING OTHER-THAN-NEW PARTS (FEB 2023) . 60

C.14 852.219-73 VA NOTICE OF TOTAL SERVICE-DISABLED VETERAN-OWNED

SMALL BUSINESS SET-ASIDE (JAN 2023) (DEVIATION)

C.15 852.219-75 VA NOTICE OF LIMITATIONS ON SUBCONTRACTING-CERTIFICATE

OF COMPLIANCE FOR SERVICES AND CONSTRUCTION (JAN 2023) (DEVIATION)

C.16 852.232-72, ELECTRONIC SUBMISSION OF PAYMENT REQUESTS (NOV 2018) ... 64

C.17 ON-RAMP

C.18 OFF-RAMP

C.19 ORGANIZATIONAL CONFLICT OF INTEREST

C.20 INCORPORATION OF RATES AND LABOR DESCRIPTIONS

C.21 METRICS

SECTION D - CONTRACT DOCUMENTS, EXHIBITS, OR ATTACHMENTS

SECTION E - SOLICITATION PROVISIONS

E.1 52.252-1 SOLICITATION PROVISIONS INCORPORATED BY REFERENCE (FEB

1998)

E.2 52.204-24 REPRESENTATION REGARDING CERTAIN TELECOMMUNICATIONS

AND VIDEO SURVEILLANCE SERVICES OR EQUIPMENT (NOV 2021)

E.3 52.209-7 INFORMATION REGARDING RESPONSIBILITY MATTERS (OCT 2018) ... 73

E.4 52.212-3 OFFEROR REPRESENTATIONS AND CERTIFICATIONS—COMMERCIAL

PRODUCTS AND COMMERCIAL SERVICES (NOV 2023)

E.5 52.216-1 TYPE OF CONTRACT (APR 1984)

E.6 52.216-27 SINGLE OR MULTIPLE AWARDS (OCT 1995)

E.7 852.209-70, ORGANIZATIONAL CONFLICTS OF INTEREST (OCT 2020)

E.8 852.233-70, PROTEST CONTENT/ALTERNATIVE DISPUTE RESOLUTION (SEP 2018)

E.9 852.233-71, ALTERNATE PROTEST PROCEDURE (SEP 2018)

E.10 BASIS FOR AWARD AND PROPOSAL SUBMISSION INSTRUCTIONS

A.2 COMBINED SYNOPSIS/SOLICITATION

This is a combined synopsis/solicitation for commercial items prepared in accordance with the format in Subpart 12.6, as supplemented with additional information included in this notice.

This announcement constitutes the only solicitation; proposals are being requested and an additional solicitation will not be issued.

(i) Request for Proposal (RFP) 36C10B24R0005

(ii) The solicitation document and incorporated provisions and clauses are those in effect through Federal Acquisition Circular 2023-06

(iii) Notice of total Service-Disabled Veteran-Owned Small Business (SDVOSB) set-aside

(iv) See Section B below for the Price Schedule.

(v) See Section B below for the Performance Work Statement.

(vi) The ordering period for the basic contract shall be five years. Freight-On-Board

(FOB) is Destination.

(vii) The provision at 52.212-1, “Instructions to Offerors -- Commercial,” applies to this acquisition. See Section E below for addenda.

(viii) The provision at 52.212-2, “Evaluation -- Commercial Items,” does not apply to this acquisition. See Section E below for the Basis for Award and Proposal Submission

Instructions.

(ix) Offerors shall include a completed copy of the provision at 52.212-3, “Offeror

Representations and Certifications -- Commercial Items,” with its offer. See Section E below for addenda.

(x) The clause at 52.212-4, “Contract Terms and Conditions -- Commercial Items,” and its Alternate I, applies to this acquisition. See Section C below for the addenda.

(xi) The clause at 52.212-5, “Contract Terms and Conditions Required To Implement

Statutes Or Executive Orders -- Commercial Items,” applies to this acquisition. See

Section C below for the addenda.

(xii) See Section B below regarding requirements for Software License, Maintenance, and Technical Support.

(xiii) Please contact Contract Specialist Mike Frank Michael.frank@va.gov, and

Contracting Officer Troy Loveland, Troy.Loveland@va.gov, for information regarding the solicitation.

A.3 GOVERNING LAW

Federal law and regulations, including the Federal Acquisition Regulations (FAR), shall govern this Contract/Order. Commercial license agreements may be made a part of this Contract/Order but only if both parties expressly make them an addendum hereto, as permitted by FAR 12.212.

If the commercial license agreement is not made an addendum, it shall not apply, govern, be a part of or have any effect whatsoever on the Contract/Order; this includes, but is not limited to, any agreement embedded in the computer software (clickwrap), any agreement that is otherwise delivered with or provided to the Government with the commercial computer software or documentation (shrinkwrap), or any other license agreement otherwise referred to in any document. If a commercial license agreement is made an addendum, only those provisions addressing data rights regarding the Government’s use, duplication and disclosure of data (e.g., restricted computer software) are included and made a part of this Contract/Order, and only to the extent that those provisions are not duplicative or inconsistent with Federal law, Federal regulation, the incorporated FAR clauses and the provisions of this Contract/Order; those provisions in the commercial license agreement that do not address data rights regarding the

Government’s use, duplication and disclosure of data shall not be included or made a part of the

Contract/Order. Federal law and regulation including, without limitation, the Contract Disputes

Act (41 U.S.C. § 7101 et seq.), the Anti-Deficiency Act (31 U.S.C. § 1341 et seq.), the

Competition in Contracting Act (41 U.S.C. § 3301 et seq.), the Prompt Payment Act (31 U.S.C. §

3901 et seq.), Contracts for Data Processing or Maintenance (38 U.S.C. § 5725), and FAR clauses 52.212-4, 52.227-14, 52.227-19 shall supersede, control, and render ineffective any inconsistent, conflicting, or duplicative provision in any commercial license agreement. In the event of conflict between this clause and any provision in the Contract/Order or the commercial license agreement or elsewhere, the terms of this clause shall prevail. The Contractor shall deliver to the Government all data first produced under this Contract/Order with unlimited rights as defined by FAR 52.227-14. Claims of patent or copyright infringement brought against the

Government as a party shall be defended by the U.S. Department of Justice (DOJ) in accordance with 28 U.S.C. § 516; at the discretion of DOJ, the Contractor may be allowed reasonable participation in the defense of the litigation. Any additional changes to the Contract/Order must be made by modification (Standard Form 30) and shall only be made by a warranted Contracting

Officer. Nothing in this Contract/Order or any commercial license agreement shall be construed as a waiver of sovereign immunity.

A.4 SOFTWARE LICENSE, MAINTENANCE AND TECHNICAL SUPPORT:

(1). Definitions.

a) Licensee. The term “licensee” shall mean the U.S. Department of

Veterans Affairs (“VA”) and is synonymous with “Government.”

b) Licensor. The term “licensor” shall mean the Contractor having the necessary license or ownership rights to deliver license, software maintenance and support of the computer software being acquired. The term “Contractor” is the party identified in Block 17a on the SF1449. If the Contractor is a reseller and not the Licensor, the Contractor remains responsible for performance under this Contract/Order.

c) Software. The term “software” shall mean the licensed computer software product(s) cited in the Schedule of Supplies/Services.

d) Maintenance. The term “maintenance” is the process of enhancing and optimizing software, as well as remedying defects. It shall include all new fixes, patches, releases, updates, versions and upgrades, as further defined below.

e) Technical Support. The term “technical support” refers to the range of services providing assistance for the software via the telephone, email, a website or otherwise.

f) Release or Update. The term “release” or “update” are terms that refer to a revision of software that contains defect corrections, minor enhancements or improvements of the software’s functionality. This is usually designated by a change in the number to the right of the decimal point (e.g., from Version 5.3 to 5.4). An example of an update is the addition of new hardware.

g) Version or Upgrade. The term “version” or “upgrade” are terms that refer to a revision of software that contains new or improved functionality.

This is usually designated by a change in the number to the left of the decimal point (e.g., from Version 5.4 to 6).

(2). Software License.

a) Unless otherwise stated in the Schedule of Supplies/Services, the

Performance Work Statement or Product Description, the software license provided to the Government is a perpetual, nonexclusive license to use the software.

b) The Government may use the software in a networked environment.

c) Any dispute regarding the license grant or usage limitations shall be resolved in accordance with the Disputes Clause incorporated in FAR

52.212-4(d).

d) All limitations of software usage are expressly stated in the Schedule of

Supplies/Services and the Performance Work Statement/Product

Description.

(3). Software Maintenance and Technical Support.

a) If the Government desires to continue software maintenance and support beyond the period of performance identified in this Contract/Order, the

Government will issue a separate contract or order for maintenance and support. Conversely, if a contract or order for continuing software maintenance and technical support is not received, the Contractor is neither authorized nor permitted to renew any of the previously furnished services.

b) The Contractor shall provide software support services, which includes periodic updates, enhancements and corrections to the software, and reasonable technical support, all of which are customarily provided by the

Contractor to its commercial customers so as to cause the software to perform according to its specifications, documentation or demonstrated claims.

c) Any telephone support provided by Contractor shall be at no additional cost.

d) The Contractor shall provide all maintenance services in a timely manner in accordance with the Contractor’s customary practice or as defined in the Performance Work Statement or Product Description. However, prolonged delay (exceeding 2 business days) in resolving software problems will be noted in the Government’s various past performance records on the Contractor (e.g., www.cpars.gov).

e) If the Government allows the maintenance and support to lapse and subsequently wishes to reinstate it, any reinstatement fee charged shall not exceed the amounts that would have been charged if the Government had not allowed the subscription to lapse.

(4). Disabling Software Code. The Government requires delivery of computer software that does not contain any code that will, upon the occurrence or the nonoccurrence of any event, disable the software. Such code includes but is not limited to a computer virus, restrictive key, node lock, time-out or other function, whether implemented by electronic, mechanical, or other means, which limits or hinders the use or access to any computer software based on residency on a specific hardware configuration, frequency of duration of use, or other limiting criteria. If any such disabling code is present, the Contractor agrees to indemnify the Government for all damages suffered as a result of a disabling caused by such code, and the contractor agrees to remove such code upon the Government’s request at no extra cost to the Government. Inability of the Contractor to remove the disabling software code will be considered an inexcusable delay and a material breach of contract, and the Government may exercise its right to terminate for cause. In addition, the Government is permitted to remove the code as it deems appropriate and charge the Contractor for consideration for the time and effort expended in removing the code.

(5). Manuals and Publications. Upon Government request, the Contractor shall furnish the most current version of the user manual and publications for all products/services provided under this Contract/Order at no cost.

http://www.cpars.gov/

SECTION B - CONTINUATION OF SF 1449 BLOCKS

B.1 CONTRACT ADMINISTRATION DATA

(continuation from Standard Form 1449, Block 18A.)

1. Contract Administration: All contract administration matters will be handled by the following individuals:

a. CONTRACTOR: TBD

b. GOVERNMENT: Troy Loveland

Contracting Officer 36C10B

Department of Veterans Affairs

Technology Acquisition Center

2. CONTRACTOR REMITTANCE ADDRESS: All payments by the Government to the contractor will be made in accordance with:

[X] 52.232-33, Payment by Electronic Funds Transfer—System For Award

Management, or

[ ] 52.232-36, Payment by Third Party

3. INVOICES: Invoices shall be submitted in arrears:

a. Quarterly []

b. Semi-Annually []

c. Other [X] In accordance with each individual Task Order

4. GOVERNMENT INVOICE ADDRESS: All Invoices from the contractor shall be submitted electronically in accordance with VAAR Clause 852.232-72 Electronic Submission of

Payment Requests.

5. ACKNOWLEDGMENT OF AMENDMENTS: The offeror acknowledges receipt of amendments to the Solicitation numbered and dated as follows:

AMENDMENT NO DATE

B.2 PRICE SCHEDULE

BASE PERIOD

CLIN

DESCRIPTION

QTY

UNIT

UNIT

PRICE

TOTAL

PRICE

0001 Firm-Fixed Price Line Item

SECURITY CLASS: Determined at the Task

Order Level

This CLIN will provide commercial, streamlined agile delivery services and teams and incidental supplies on a Firm-Fixed-Price basis for a period of 60 months from date of award in accordance with (IAW) the Secure, Performant, Reliable, and User-Centered

Experiences (SPRUCE) Performance Work

Statement (PWS).

Specific requirements and pricing shall be set forth under each individual Task Order.

Inspection, Acceptance and FOB Points shall be determined at the Task Order Level.

The delivery or performance schedule shall be determined on each individual Task Order.

0002 Time-and-Materials/Labor-Hour Line Item

SECURITY CLASS: Determined at the Task

Order Level

This CLIN will provide commercial, streamlined agile delivery services and teams and incidental supplies on a Time-and-

Materials/Labor-Hour basis for a period of 60 months from date of award IAW the Secure, Performant, Reliable, and User-Centered

Experiences (SPRUCE) Performance Work

Statement (PWS).

Specific requirements and pricing shall be set forth under each individual Task Order.

Inspection, Acceptance and FOB Points shall be determined at the Task Order Level.

The delivery or performance schedule shall be determined on each individual Task Order.

0003 Time-and-Materials/Labor-Hour Status

Report

Time and Materials Status Report shall be provided IAW Section B.3, PWS, Paragraph

6.1.1 and Section D, Attachment 002 – TM

Labor Hour Status Report

FOB Point: Destination

Inspection: Destination

Acceptance: Destination

NSP NSP

Contract Maximum/Minimum Ceiling:

IAW Section C, clause 52.216-22, “Indefinite Quantity,” the Maximum Overall Value of the SPRUCE

IDIQ contracts is $2,442,037,228.80. IAW Section C, clause 52.216-22 entitled, “Indefinite Quantity” the Minimum guaranteed value under any SPRUCE contract is $250,000.00. The Government reserves the right to award initial orders at the time of the basic contract award on a sole source basis pursuant to

FAR 16.505(b)(2)(D) at amounts which may exceed the minimum guaranteed value. No order under the SPRUCE IDIQ shall be awarded in excess of $50,000,000.00.

The ceiling price as set forth in Section C, clause 52.212-4 “Contract Terms and Conditions-

Commercial Items, Alternate I,” paragraph (i)(3) will be established for each individual Time-and

Materials/Labor-Hour Task Order.

B.3 PERFORMANCE WORK STATEMENT

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Office of Information & Technology

Office of the Chief Technology Officer

Secure, Performant, Reliable, and User-Centered Experiences

(SPRUCE)

Indefinite Delivery Indefinite Quantity (IDIQ) Contract

Date: 11/28/2023

VA-23-00053369

PWS Version Number: 2.1

1.0 OBJECTIVE

The Department of Veterans Affairs (VA) Secure, Performant, Reliable, and User-Centered

Experiences (SPRUCE) is a frictionless vehicle through which VA can acquire top-quality professionals and industry partners to deliver exceptional user experiences. The SPRUCE

Indefinite Delivery Indefinite Quantity (IDIQ) contract connects VA employees with best-in-class industry partners to deliver high-quality digital products in accordance with Office of

Information Technology (OIT) Working Principles.

OIT Working Principles:

• Embrace “Better, Faster, Safer” – Deliver more value by building momentum through continuous, incremental, well-tested changes.

• Automate When Possible – Adapt out processes, our organization, and our technology to automate away manual, error-prone, and tedious work.

• Deliver What Matters – Maximize results for Veterans by working with our users and stakeholders to prioritize work based on what will drive the biggest impact to the outcomes that matter.

• Encourage a Safe and Transparent Culture of Learning – Nurture and build a culture around exploration, collaboration, and innovation – all while celebrating success along the way.

• Trust and Empower Focused Teams of Experts – Foster empowered teams of specialists to take ownership of their products and services.

• Standardize and Re-Use – Create an organization that collaborates on winning approaches, reuses processes and technology, and maximizes shared knowledge and resources.

SPRUCE supports VA’s digital modernization initiatives by ensuring VA has streamlined access to the modern commercial services required to deliver excellent products to VA’s internal and external users. Successfully delivering such products often requires VA to obtain commercial delivery services supported by teams with capabilities in: Software development and operation;

Technical advising and architecture planning; Service design and user research studies; Data science and data analytics; Product support operations.

The objective of this effort is to provide VA with a method to obtain such delivery services.

Specifically, SPRUCE will meet the following goals:

1. Give VA streamlined access to exceptional companies that specialize in the development of digital services using modern technologies.

2. Create a contract mechanism that promotes rapid delivery, applying private sector best practices, and measurable outcomes.

3. Scale the success accomplished in the current Customer Experience, DevOps and Agile

Releases (CEDAR) IDIQ while expanding access to exceptional vendors with more diverse skillsets and enabling larger task orders as appropriate.

4. Ensure VA can rapidly adopt commercial technology and design-industry best practices such as those described in the Office of Management and Budget’s (OMB’s) Digital

Services Playbook.

This effort is consistent with several initiatives to strengthen Federal technology and acquisition practices including but not limited to:

1. The March 2023 National Cybersecurity Strategy, which focused on ensuring a defensible, resilient digital economy where it is costlier to attack systems than defend them, where sensitive or private information is secure and protected, and where neither incidents nor errors cascade into catastrophic, systemic consequences. Ultimately, technology companies and software manufacturers must be held accountable for the safety and security of the products and devices delivered to the Government.

2. The Executive Order on Transforming Federal Customer Experience and Service

Delivery to Rebuild Trust in Government of December 2021 focused on increasing the quality and equity of customer experiences with Government services.

3. The 21st Century Integrated Digital Experience Act of December 2018 aimed to improve the digital experience for government customers and reinforce existing requirements for federal public websites.

4. The Office of Federal Procurement Policy’s (OFPP’s) December 2017 memo encouraging strategic sourcing and strategies to drive performance such as developing common standards and practices in contracts.

5. The Digital Services Playbook, released by OMB in August 2014, as a best-practices guide for agencies to use when developing effective digital services.

6. The TechFAR Handbook, released by OFPP in August 2014, as a guide to the procurement of agile design and development services within the Information

Technology (IT) Consulting, IT Outsourcing, and IT Security Categories.

2.0 SCOPE

The SPRUCE IDIQ contract vehicle will provide VA with commercial, streamlined delivery services and teams. The contractor(s) shall provide VA with expert teams that shall consistently deliver viable digital solutions in support of VA’s strategic mission and objectives.

The specific nature of the capabilities required for each team will be articulated at the Task Order level. However, it is expected that a typical delivery team requested under the SPRUCE IDIQ will require multi-disciplinary teams with members having expertise in: software development and operations, technical advising and architecture planning, service design and user research studies, data science and data analytics, and product support operations (task orders may include multiple functional areas). Task Orders will be limited to a total value of $50M, including options. SPRUCE will have a total ordering ceiling of $2,442,037,228.80.

3.0 APPLICABLE DOCUMENTS

The Contractor shall comply with the documents listed below. Additional documents may be listed in individual Task Orders.

1. The U.S. Digital Services Playbook (https://playbook.cio.gov/)

2. “Federal Information Security Modernization Act of 2014”

3. Federal Information Processing Standards (FIPS) Publication 140-2, “Security

Requirements For Cryptographic Modules”

4. FIPS Pub 199. Standards for Security Categorization of Federal Information and Information Systems, February 2004 https://playbook.cio.gov/

5. FIPS Pub 200, Minimum Security Requirements for Federal Information and

Information Systems, March 2006

6. FIPS Pub 201-2, “Personal Identity Verification of Federal Employees and

Contractors,” August 2013

7. VA Directive and Handbook 6102, “Internet/Intranet Services,” August 5, 2019

8. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021

9. VA Handbook 6500, “Risk Management Framework for VA Information Systems

VA Information Security Program,” February 24, 2021

10. VA Handbook 6500.5, “Incorporating Security and Privacy in System Development

Lifecycle”, March 22, 2010

11. VA Handbook 6500.6, VA Information and Information System Security/Privacy

Language, including all Appendices, dated March 12, 2010

12. “Completing the Transition to Internet Protocol Version 6 (IPv6):

https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-07.pdf

13. USGv6 Program (https://www.nist.gov/programs-projects/usgv6-program/usgv6-revision-1)

14. NIST Special Publication (SP) 500-267B Revision 1 “USGv6 Profile”

(https://doi.org/10.6028/NIST.SP.500-267Br1)

15. NIST SP 800-119 “Guidelines for the Secure Deployment of IPv6”

(https://doi.org/10.6028/NIST.SP.800-119)

16. Office of Management and Budget Memorandum (OMB) M-19-26, “Update to the

Trusted Internet Connections (TIC) Initiative“ (https://www.whitehouse.gov/wp-content/uploads/2019/09/M-19-26.pdf),

17. VA Directive 6513 “Secure External Connections”

18. TIC 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

3.1 Development Methodologies

The contractor’s support and solutions shall follow the practices described in the Digital Services

Playbook (https://playbook.cio.gov). The contractor shall be thoroughly familiar with the concepts in each play and implement them in its approaches and support. The contractor shall design, develop, configure, customize and deploy solutions to some of VA’s most pressing challenges. Once deployed, the contractor shall provide production support of the solution as required. The contractor shall provide support to projects that are building brand new systems as well as projects that are building on top of, or replacing, existing systems. The contractor shall be thoroughly familiar with current and emerging technologies, Software-as-a-Service products, services, various programming languages and processes required to deliver high-quality products.

The Contractor shall:

General

1. Deliver high-quality, usable, functional products that help users accomplish their tasks.

2. Follow the Digital Services Playbook (https://playbook.cio.gov).

3. Cultivate positive, trusting, and cooperative working relationships with all persons supporting the work, including government employees and other vendors.

https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-07.pdf file://///R04.med.va.gov/V03/EAS/Users/vhaeasWymbsk/TEMPLATES--NEW%20TAC%20PROCESS/PWS%20TEMPLATE%20(DO%20NOT%20TOUCH)%20-%20In%20Process%20Revisions/DO%20NOT%20TOUCH%20(next%20version/IPv6/(https:/www.nist.gov/programs-projects/usgv6-program/usgv6-revision-1 file://///R04.med.va.gov/V03/EAS/Users/vhaeasWymbsk/TEMPLATES--NEW%20TAC%20PROCESS/PWS%20TEMPLATE%20(DO%20NOT%20TOUCH)%20-%20In%20Process%20Revisions/DO%20NOT%20TOUCH%20(next%20version/IPv6/(https:/www.nist.gov/programs-projects/usgv6-program/usgv6-revision-1 https://doi.org/10.6028/NIST.SP.500-267Br1 https://doi.org/10.6028/NIST.SP.800-119 https://www.whitehouse.gov/wp-content/uploads/2019/09/M-19-26.pdf https://www.whitehouse.gov/wp-content/uploads/2019/09/M-19-26.pdf https://www.cisa.gov/publication/tic-30-core-guidance-documents https://www.cisa.gov/publication/tic-30-core-guidance-documents https://playbook.cio.gov/

4. Participate in Communities of Practice (CoP) activities for Product, Design, Engineering, and Data where applicable.

Product

5. Work in self-contained, cross-functional teams capable of delivering complete products, including research, design, architecture, engineering, support, and documentation.

6. Incorporate agile practices and ceremonies into all work, such as sprint planning, daily standups, sprint review, retrospective, user stories/epics, backlog grooming, and estimating activities.

7. Establish goals, objectives, key performance metrics, and make bets to improve user outcomes. Bets are hypotheses that could impact established metrics and they encourage acceptance of uncertainty in the software development process.

8. Push new features and incremental improvements to production early and often, applying phased release practices with product health and performance targets.

9. Build applications and platforms with the intent of enhancing and sustaining that application until relieved by the Government or another team.

10. Collect customer feedback, hold product impact reviews, provide or support tiered troubleshooting and on-call operations, and complete postmortem incident reports.

11. Measure and improve performance against DevOps Research and Assessment (DORA) metrics including deployment frequency, lead time for changes, change failure rate, and time to restore service.

Design

12. Understand the users' entire experience. Create personas, customer journeys, service blueprints, problem space definitions, affinity maps, and flow diagrams (as appropriate) to ensure the digital service is cohesive with the offline experience.

13. Actively involve users in the design of digital solutions by incorporating best practices for design, user research, and usability testing.

14. Personalize solutions for the user by leveraging known information to create a seamless, tailored user experience.

15. Optimize for mobile-first and ensure all solutions are equally available on both mobile and desktop.

16. Follow all user interface design and content guidelines and standards defined in the VA

Design System and VA Content Style Guide (https://design.va.gov/) including the use of plain language to maintain a consistent look, feel, and voice across public facing sites and services.

17. Incorporate robust accessibility principles into design, development, and testing for all web applications to deliver high-quality digital experiences to all users that meet or exceed current W3C Web Content and Accessibility Guidelines (WCAG).

Engineering

18. Use widely adopted or industry-standard programming languages and frameworks.

19. Follow software development best practices including peer review, test coverage, portability, and clear documentation.

https://design.va.gov/

20. Run unit tests, integration tests, functional tests, load tests, and accessibility tests on

100% of functionality delivered.

21. Leverage cloud-based infrastructure, platforms, and services to improve scalability, reliability, performance, and maintainability.

22. Continuously integrate code from development teams, run automated testing, promote code through multiple environments, and automate high frequency deployments.

23. Monitor infrastructure health, application performance, and user outcomes. Ensure observability of the system/application/service status and leverage alerting integrations.

24. Maintain the confidentiality, integrity, and availability of sensitive information, including user information by following widely accepted or industry-standard methods, including

Zero Trust security principles.

25. Ensure configuration and sensitive data, including data the VA defines as sensitive, are not present in source code.

26. Deliver all code not containing configuration or sensitive data to an open-source repository. Share your documentation, development processes, and lessons learned publicly.

27. Use established VA internal tools including source code management, team communication, developer toolkits, and analytics products.

28. Make use of existing platforms to build and deploy software, such as the VA.gov

Platform and Lighthouse Delivery Infrastructure, wherever possible.

29. Adopt and follow VA API standards contained in the Lighthouse Hub

(https://hub.lighthouse.va.gov/docs/default/component/lighthouse-api-standards/).

30. Make application data available for use across the VA enterprise with versioned RESTful application programming interfaces (APIs) and discoverability in the Lighthouse API hub

(https://hub.lighthouse.va/catalog) where applicable.

31. Design health-related services to meet Fast Healthcare Interoperability Resources (FHIR) standards where applicable.

3.2 Quality Assurance

The performance of SPRUCE contract holders will be measured in two contexts. One will be at the Task Order (TO) level using metrics specific to the nature of work required on the TO (for instance, a TO for a web-based application may use metrics like customer satisfaction, system uptime, submission errors, etc.). The second context will be at the overall SPRUCE base contract level used to meet Contractor Performance Information requirements (e.g. Contract

Performance Assessment Reporting System (CPARS)) in accordance with Federal Acquisition

Regulation (FAR) Part 42.15. In some cases, the Government may specify required metrics for a specific TO Quality Assurance Surveillance Plan (QASP), while in other cases Contract Holders may be asked to propose metrics as part of their Task Execution Plans (TEPs), which may or may not be used for TO evaluation purposes. It is the Government’s preference, when appropriate and practical, that performance information be provided via real-time tools (e.g.

dashboards) made available to the Government rather than via separate paper or electronic reports.

https://hub.lighthouse.va.gov/docs/default/component/lighthouse-api-standards/ https://hub.lighthouse.va/catalog

4.0 TECHNICAL FUNCTIONAL AREAS

Individual TO may encompass more than one functional area listed below. Efforts to be performed by the Contractor under this contract are of such a nature that they may create a potential and/or actual organizational conflict of interest as contemplated by Subpart 9.5 of the

FAR. Contractor personnel may be required to sign a non-disclosure agreement.

1. Software development and operation. Build, improve, innovate, and run custom, open-source products across the OIT ecosystem. Leverage existing VA infrastructure and platforms including VA Enterprise Cloud, VA.gov, Clinical Decision Support, Lighthouse Application Programming Interfaces (API) Gateway, and others. May include

(but not limited to): responsive web applications; API; prototypes and SaaS pilots; mobile applications; and internal claims processing and health applications.

2. Technical advising and architecture planning. Provide expert technical guidance and

IT operations support to OIT personnel in the execution of their portfolio or product line priorities. Provide architecture planning services and stand-up operational frameworks for delivery. May include (but not limited to) supporting innovation from commercial practices, engineering operations, analysis of alternatives, and systems and boundaries disambiguation.

3. Service design and user research studies. Measure and define the service delivery landscape and create plans for implementing VA digital services. May include (but not limited to) problem definition, ethnographic studies, and qualitative and quantitative research.

4. Data science and data analytics. Define and implement data access, integration, and organization systems to exchange critical data between VA systems and enable new applications. May include (but not limited to) data modeling, machine learning, and natural language processing.

5. Product support operations. Provide product and program level support for VA systems, primarily for internal user applications. May include (but not limited to):

program planning; business case analysis; user management and permissions; onboarding and training; and internal helpdesk support.

5.0 DELIVERABLES

5.1 Products

All products shall be delivered to the Government locations and accepted by authorized

Government personnel as specified in the individual Task Orders. Inspection and acceptance criteria shall be specifically identified in each Task Order. The COR shall be notified of any discrepancies found during acceptance inspection upon identification. All custom-developed code shall be developed as Open Source Software (OSS) and made available in a public repository unless it contains sensitive data as defined by VA.

5.2 Data

The Government shall receive Unlimited Rights to intellectual property first produced and delivered in the performance of this contract in accordance with (IAW) FAR 52.227-14, Rights

In Data-General (May 2014). This includes all rights to source code and any and all documentation created in support thereof. License rights in any Commercial Computer Software shall be governed by FAR 52.227-19, Commercial Computer Software License (DEC 2007).

Any data delivered shall be submitted and protected IAW VA Handbook 6500.

6.0 REPORTING AND MEETING REQUIREMENTS

6.1.1 T&M Status Report

The Contractor shall submit a Time and Materials (T&M) Status Report for each T&M TO.

This Task Order report shall be unique to each Task Order. This report is not required for

Firm Fixed Price (FFP) TO.

For Each T&M TO, indicate:

1. Expenditures for the reporting period by labor, material and Other Direct Costs (ODC)

2. Burn Rate and when funding is expected to run out given current Burn Rate

3. Labor costs shall be separated/differentiated by the assigned numbering system for contract, TO and labor category, entity (Prime or Subcontractor), rates and hours

4. Material costs and ODCs shall be identified by type, and subcontractor (as applicable), and discussed briefly to indicate for what the material and/or ODC was used

5. Total task expenditures for the fiscal year to date, indicated as total, labor, materials and

ODCs

6. Total task expenditures since task award, indicated as total, labor, materials and ODCs

7. The Contract Performance Report as set forth in Section D, Attachment 002– TM Labor

Hour Status Report, shall be submitted monthly via the Acquisition Task Order

Management System (ATOMS) portal.

6.1.2 Delivery and Monitoring Report and Roster:

The Contractor shall provide a single monthly report, detailing and providing links to all stories, epics, and other work completed. This includes a plain language description of all work accepted by the Government Product Owner and COR at the end of each sprint. This report shall include, in plain language, additional details about the project status, sprint team velocity, sprint team goal completion, and highlight project risks. The report shall also highlight and provide links to key infrastructure and application monitoring data. The report shall also include details with links to documentation for any critical incidents or outage events that resulted in service outages or significant service degradations. The Contractor shall attach or provide links to postmortem documentation for all critical incidents or outage events. Should there not be any reported incidents during the reporting period, a link to the relevant monitoring tools is sufficient. The specific data points and format of this monthly report shall be determined by the Contractor in collaboration with the Government Product Owner and COR. The Delivery and Monitoring

Report and Roster shall be uploaded to a VA provided SharePoint. Lastly, the Contractor shall submit a roster to the COR in accordance, that includes the Status of Government Furnished

Equipment (GFE) in accordance with the following:

The Contractor shall also provide, and maintain, a TO TM Labor Hour Status Report utilizing the template (Attachment 002 - TM Labor Hour Status Report), which includes data on all

Contractor and Subcontractor personnel employed under each TO to begin and maintain their background investigations. The Contractor Staff Roster shall be continuously updated, with notification to the COR within one day of any changes in employee status, training certification completion status, Background Investigation level status, additions/removal of employees, etc., throughout the Period of Performance. The Contractor Staff Roster should indicate which employees are active or inactive. For inactive employees, the roster should indicate the date the employee was separated from the Task Order and their credentials returned to the COR.

Contractors are responsible for ensuring the COR is aware of all offboarded contractor personnel and ensure a request is sent to VA to remove the personnel’s access to any VA systems within 24 hours (to include Slack, SOCKS proxy, and GitHub) when the employee is not being onboarded to a different task order immediately.

The Contractor shall include the following items:

1. Task Order

2. Project Name

3. Employee Name

4. Contractor’s Full Name

5. Whether Contractor is Prime or Subcontractor

6. Email Address

7. Place of Birth

8. Date of Birth

9. Security/Privacy Training Completion Dates

10. Risk Designation-individual background investigation level requirement (Refer to

Section 4.6 of the Task Order Performance Work Statement (PWS) for investigative requirements by task)

11. Status of Background Investigation and/or Clearance, including if an existing Clearance exists

12. The Contractor shall submit full Social Security Numbers either within the Contractor

Staff Roster or under separate cover to the COR. The preferred method to send the

Contractor Staff Roster or Social Security Number is by encrypted e-mail. If unable to send encrypted e-mail, other methods which comply with FIPS 140-2 are to encrypt the file, use a secure fax, or use a traceable mail service.

13. Labor Category

14. Facility location

15. Tour of Duty Schedules (e.g. Monday through Friday, 9:00 am to 5:00 pm)

16. Universal Unique Identifier UUID (Badge Number bottom right of back of badge)

17. Facility where badge was issued

18. Badge Expiration Date

19. Project supported

20. Date Disassociated from Contract (for employees who no longer support this contract)

21. Date Badge Returned to COR

22. Contractor Rules of Behavior

23. VA Cyber Security Awareness and Rules of Behavior Training

24. Annual VA Privacy Training

25. If GFE assigned,

a. Type of Equipment

b. VA Bar Code

c. Location

d. Value

e. Total Number of Pieces

f. Total Value of Equipment

g. Anticipated Transfer Date to Government and its Location

6.2 Meetings and Reviews

For successful management and contract surveillance, the following meetings and reviews are required.

6.2.1 Post-Award Conferences

The Government intends to convene a one-time Post-Award Conference with each awardee within 60 days after contract award. The CO shall notify all Prime Contractors of a specific date, location and agenda within approximately 30 days after contract award.

6.2.2 Prime Contractor Deep Dives

The Government intends to convene regular deep-dive meetings with the Prime contractors to discuss opportunities to improve delivery quality and culture on the SPRUCE IDIQ vehicle.

These meetings will be scheduled by the Government with at least five (5) business days’ notice.

The Prime contractors are expected to escalate blockers, share lessons learned, and highlight opportunities to improve the VA delivery environment.

6.2.3 Quarterly Collective Prime Program Reviews

VA shall host a quarterly Prime Program Review with the designated Prime Program Manager

(PM) and other attendees as appropriate. Dates, locations, and agenda shall be specified at least five (5) calendar days prior to the meeting.

7.0 GENERAL REQUIREMENTS

The Contractor shall provide and/or acquire the services, hardware, and software required by individual TO pursuant to the general requirements specified below.

7.1 Contract Type

This is an IDIQ Multiple Award Task Order (MATO) contract. Individual TOs shall be issued on a performance-based T&M/Labor Hour and/or FFP basis.

7.2 Place of Performance

It is expected that contractor’s teams will be required to frequently interact with system users and program staff in support of this contract and the task orders placed against it. Support will be required at Government facilities (on-site) and at non-Government facilities (offsite). Specific site locations will be defined at the TO level. The Government anticipates that most of the work will occur in the contiguous United States (CONUS). For support provided at Government facilities, the Government may provide space and equipment (e.g., phone, desktop computer and peripherals, desk and accessories, etc.) for Contractor personnel. The Contractor personnel may be required to work offsite (i.e. at the prime or subcontractor facilities) when adequate workspace is not available at the Government site.

7.3 Travel

Travel shall be IAW individual TO requirements. Travel details must be provided to, and approved by, the TO COR or the Government designee prior to the commencement of travel.

All travel shall be IAW the Federal Travel Regulations.

7.4 Government-Furnished Materials

The Government has multiple remote access solutions available to include Citrix Access

Gateway (CAG), Site-to-Site Virtual Private Network (VPN), and RESCUE VPN.

The Government’s issuance of GFE is limited to Contractor personnel requiring direct access to the network to: development environments; install, configure and run Technical Reference

Model (TRM) approved software and tools (e.g., Oracle, Fortify, Eclipse, SoapUI, WebLogic, LoadRunner); upload/download/manipulate code, run scripts, and apply patches; configure and change system settings; check logs, troubleshoot/debug, and test/QA. Government Furnished

Property (GFP) may also include Government Furnished Material (GFM), Government

Furnished Information (GFI), and GFE and shall be identified in the individual TO.

7.5 Contractor-Acquired Materials

The Contractor shall acquire and/or provide any hardware and/or software required to accomplish each TO that is not provided as GFP. If the Contractor provides software as part of an individual TO, software integrity shall be maintained by the Contractor in accordance with the licensing terms of the manufacturer/producer until such software is delivered to the Government, or otherwise disposed of IAW Government direction. Items delivered to the Government shall be approved by the Government in advance of purchase and be in accordance with all applicable

VA security requirements. Please note: this section is required for contractor acquired materials, including commercial software, used during contract performance. However, this does not apply to open-source code delivered under the contract scope which will be provided in accordance with FAR

52.227-14.

7.6 Warranty

Items acquired under this contract may require warranty protection. Commercial warranties shall be transferred to the Government. The type of warranty and extent of coverage shall be determined on an individual TO basis.

7.7 One-VA Technical Reference Model

The Contractor shall comply with VA’s OI&T Technical Reference Model (VA TRM) when applicable.

8.0 SECURITY AND PRIVACY

8.1 Information Security and Privacy Security Requirements

The Contractor shall comply with VA security requirements IAW VA Handbook 6500.6

“Contract Security” and Addendums A, B, and C. Addendum B may be tailored at TO level.

8.2 Personnel Security Requirements

The Contractor(s) shall comply with all personnel security requirements included in this contract and any unique organization security requirements described in each TO. All Contractor personnel who require access to VA sensitive information/computer systems shall be subject to background investigations and must receive a favorable background investigation from VAprior to TO award(?).

The position sensitivity risk designation [LOW, MODERATE, and HIGH] and associated level of background investigation [Tier 1, Tier 2, and Tier 4] for each TO PWS task shall be designated accordingly, as identified within each TO PWS. The level and process of background security investigations for Contractors must be IAW VA Directive and Handbook 0710, “Personnel Security and Suitability Program.”

a. The Contractor shall prescreen all personnel requiring access to the computer systems to ensure they maintain the appropriate security risk designation(?), and are can read, write, speak and understand the English language.

b. Contractors shall ensure they comply with the requirements of Section 6.1.3 above for all awarded TO.

c. The Contractor should coordinate the location of the nearest VA fingerprinting office through the COR. Only electronic fingerprints are authorized. The Contractor shall bring their completed Security and Investigations Center (SIC) Fingerprint request form with them (see paragraph d.4 below) when getting fingerprints taken.

d. The Contractor…