PAGE 1 OF 1. REQUISITION NO.

2. CONTRACT NO. 3. AWARD/EFFECTIVE DATE 4. ORDER NO. 5. SOLICITATION NUMBER 6. SOLICITATION ISSUE DATE

a. NAME b. TELEPHONE NO. (No Collect Calls) 8. OFFER DUE DATE/LOCAL

TIME

9. ISSUED BY CODE 10. THIS ACQUISITION IS UNRESTRICTED OR SET ASIDE: % FOR:

SMALL BUSINESS

HUBZONE SMALL

BUSINESS

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

WOMEN-OWNED SMALL BUSINESS

(WOSB) ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

EDWOSB

8(A)

NAICS:

SIZE STANDARD:

11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

SEE SCHEDULE

12. DISCOUNT TERMS

13a. THIS CONTRACT IS A

RATED ORDER UNDER

DPAS (15 CFR 700)

13b. RATING

14. METHOD OF SOLICITATION

RFQ IFB RFP

15. DELIVER TO CODE 16. ADMINISTERED BY CODE

17a. CONTRACTOR/OFFEROR CODE FACILITY CODE 18a. PAYMENT WILL BE MADE BY CODE

TELEPHONE NO. UEI: EFT:

PHONE: FAX:

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN OFFER

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK BELOW IS CHECKED

SEE ADDENDUM

19. 20. 21. 22. 23. 24.

ITEM NO. SCHEDULE OF SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

(Use Reverse and/or Attach Additional Sheets as Necessary)

25. ACCOUNTING AND APPROPRIATION DATA 26. TOTAL AWARD AMOUNT (For Govt. Use Only)

27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1, 52.212-4. FAR 52.212-3 AND 52.212-5 ARE ATTACHED. ADDENDA ARE ARE NOT ATTACHED.

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA ARE ARE NOT ATTACHED

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN _______________ 29. AWARD OF CONTRACT: REF. ___________________________________ OFFER

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND DATED ________________________________. YOUR OFFER ON SOLICITATION

DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY (BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE

ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED SET FORTH HEREIN IS ACCEPTED AS TO ITEMS:

30a. SIGNATURE OF OFFEROR/CONTRACTOR 31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER)

30b. NAME AND TITLE OF SIGNER (TYPE OR PRINT) 30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER (TYPE OR PRINT) 31c. DATE SIGNED

AUTHORIZED FOR LOCAL REPRODUCTION (REV. NOV 2021)

PREVIOUS EDITION IS NOT USABLE Prescribed by GSA - FAR (48 CFR) 53.212

7. FOR SOLICITATION

INFORMATION CALL:

STANDARD FORM 1449

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL PRODUCTS AND COMMERCIAL SERVICES

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 30

36C10B26Q0130 04-22-2026

William Waterhouse, Contract Specialist 848.377.5097 04-28-2026

1000 EDT

36C10B

Department of Veterans Affairs

Technology Acquisition Center

23 Christopher Way

Eatontown NJ 07724

X 100

X

541519

150 Employees

N/A

X

See Delivery Schedule

36C10B

Technology Acquisition Center

23 Christopher Way

Eatontown NJ 07724

TBD

36C10A

Technology Acquisition Center

Financial Services Center

PO Box 149971

Austin TX 78714-8971

See CONTINUATION Page

TITLE: Enterprise ID.me Software Subscriptions and Support

See Schedule B

Alternate POC: Kendra.Casebolt@va.gov

Brand Name: ID.me

X X

KENDRA M. CASEBOLT

Contracting Officer

36C10B26Q0130

Table of Contents

SECTION B - CONTINUATION OF SF 1449 BLOCKS

B.1 CONTRACT ADMINISTRATION DATA

B.2 GOVERNING LAW CLAUSE

B.3 SOFTWARE LICENSE, SOFTWARE MAINTENANCE, AND SOFTWARE

TECHNICAL SUPPORT

B.4 PRICE SCHEDULE

B.5 PRODUCT DESCRIPTION

ADDENDUM B – VA INFORMATION AND INFORMATION SYSTEM SECURITY/PRIVACY

LANGUAGE

SECTION C - CONTRACT CLAUSES

C.1 NASA SEWP V RFQ INTRODUCTORY LANGUAGE

C.2 52.252-2 CLAUSES INCORPORATED BY REFERENCE (FEB 1998)

C.3 FAR 52.209-6 PROTECTING THE GOVERNMENT'S INTEREST WHEN

SUBCONTRACTING WITH CONTRACTORS DEBARRED, SUSPENDED, PROPOSED

FOR DEBARMENT, OR VOLUNTARILY EXCLUDED (DEVIATION) (NOV 2025)

C.4 FAR 52.217-7 OPTION FOR INCREASED QUANTITY-SEPARATELY PRICED

LINE ITEM (MAR 1989)

C.5 52.217-8 OPTION TO EXTEND SERVICES (NOV 1999)

C.6 52.217-9 OPTION TO EXTEND THE TERM OF THE CONTRACT (MAR 2000) .52

C.7 VAAR LIQUIDATED DAMAGES—REIMBURSEMENT FOR DATA BREACH

COSTS (FEB 2023) ALTERNATE I (FEB 2023)

C.8 VAAR 852.239-76 INFORMATION AND COMMUNICATION TECHNOLOGY

ACCESSIBILITY (FEB 2023)

C.9 MANDATORY WRITTEN DISCLOSURES

SECTION D - CONTRACT DOCUMENTS, EXHIBITS, OR ATTACHMENTS

SECTION E - SOLICITATION PROVISIONS

NEW SOLICITATION NOTICE

E.1 52.252-1 SOLICITATION PROVISIONS INCORPORATED BY REFERENCE

(FEB 1998)

E.2 52.209-5 CERTIFICATION REGARDING RESPONSIBILITY MATTERS

(DEVIATION) (NOV 2025)

E.3 52.209-7 INFORMATION REGARDING RESPONSIBILITY MATTERS

(DEVIATION) (NOV 2025)

E.4 52.209-11 REPRESENTATION BY CORPORATIONS REGARDING

DELINQUENT TAX LIABILITY OR A FELONY CONVICTION UNDER ANY FEDERAL

LAW (DEVIATION) (NOV 2025)

E.5 52.216-1 TYPE OF CONTRACT (DEVIATION) (OCT 2025)

E.6 52.233-2 SERVICE OF PROTEST (DEVIATION) (NOV 2025)

E.7 BASIS FOR AWARD

E.8 SUBMISSION INSTRUCTIONS

SECTION B - CONTINUATION OF SF 1449 BLOCKS

B.1 CONTRACT ADMINISTRATION DATA

1. Contract Administration: All contract administration matters will be handled by the following individuals:

a. CONTRACTOR: TBD

b. GOVERNMENT: Contracting Officer 36C10B

Technology Acquisition Center 23 Christopher Way Eatontown NJ 07724

2. CONTRACTOR REMITTANCE ADDRESS: All payments by the Government to the contractor will be made in accordance with (IAW):

[X] 52.232-33, Payment by Electronic Funds Transfer—System For Award Management, or

[] 52.232-36, Payment by Third Party

3. INVOICES: Invoices shall be submitted in arrears:

a. Quarterly []

b. Semi-Annually []

c. Other [X] After Government acceptance of Deliverables in Section B.4 - Price Schedule and IAW Section B.5 - Product Description

4. GOVERNMENT INVOICE ADDRESS: All Invoices from the contractor shall be submitted electronically IAW VA Acquisition Regulation (VAAR) Clause 852.232-72 Electronic Submission of Payment Requests.

ACKNOWLEDGMENT OF AMENDMENTS: The offeror acknowledges receipt of amendments to the Solicitation numbered and dated as follows:

AMENDMENT NO DATE

B.2 GOVERNING LAW CLAUSE

Federal law and regulations, including the Federal Acquisition Regulations (FAR), shall govern this Contract/Order. Commercial license agreements may be made a part of this Contract/Order but only if both parties expressly make them an addendum hereto. If the commercial license agreement is not made an addendum, it shall not apply, govern, be a part of or have any effect whatsoever on the Contract/Order; this includes, but is not limited to, any agreement embedded in the computer software (clickwrap), any agreement that is otherwise delivered with or provided to the Government with the commercial computer software or documentation (shrinkwrap), or any other license agreement otherwise referred to in any document. If a commercial license agreement is made an addendum, only those provisions addressing data rights regarding the Government’s use, duplication and disclosure of data (e.g., restricted computer software) are included and made a part of this Contract/Order, and only to the extent that those provisions are not duplicative or inconsistent with Federal law, Federal regulation, the incorporated FAR clauses and the provisions of this Contract/Order;

those provisions in the commercial license agreement that do not address data rights regarding the Government’s use, duplication and disclosure of data shall not be included or made a part of the Contract/Order. Federal law and regulation including, without limitation, the Contract Disputes Act (41 U.S.C. § 7101 et seq.), the Anti- Deficiency Act (31 U.S.C. § 1341 et seq.), the Competition in Contracting Act (41 U.S.C.

§ 3301 et seq.), the Prompt Payment Act (31 U.S.C. § 3901 et seq.), Contracts for Data Processing or Maintenance (38 USC § 5725), Source Code Harmonization and Reuse in Information Technology Act “SHARE IT Act” (P.L. 118-187), and FAR clauses 52.212-4, 52.227-14 shall supersede, control, and render ineffective any inconsistent, conflicting, or duplicative provision in any commercial license agreement. In the event of conflict between this clause and any provision in the Contract/Order or the commercial license agreement or elsewhere, the terms of this clause shall prevail. The Contractor shall deliver to the Government all data first produced under this Contract/Order with unlimited rights as defined by FAR 52.227-14, this includes any custom code developed for the purpose of performing under this contract. Claims of patent or copyright infringement brought against the Government as a party shall be defended by the U.S.

Department of Justice (DOJ) in accordance with 28 U.S.C. § 516; at the discretion of DOJ, the Contractor may be allowed reasonable participation in the defense of the litigation. Any additional changes to the Contract/Order must be made by modification (Standard Form 30) and shall only be made by a warranted Contracting Officer. Nothing in this Contract/Order or any commercial license agreement shall be construed as a waiver of sovereign immunity.

B.3 SOFTWARE LICENSE, SOFTWARE MAINTENANCE, AND SOFTWARE

TECHNICAL SUPPORT

(1). Definitions.

a) Licensee. The term “licensee” shall mean the U.S. Department of Veterans Affairs (“VA”) and is synonymous with “Government.”

b) Licensor. The term “licensor” shall mean the Contractor having the necessary license or ownership rights to deliver license, software maintenance and support of the computer software being acquired. The term “Contractor” is the party identified in Block 17a on the SF1449. If the Contractor is a reseller and not the Licensor, the Contractor remains responsible for performance under this Contract/Order.

c) Software. The term “software” shall mean the licensed computer software product(s) cited in the Schedule of Supplies/Services.

d) Maintenance. The term “maintenance” is the process of enhancing and optimizing software, as well as remedying defects. It shall include all new fixes, patches, releases, updates, versions and upgrades, as further defined below.

e) Technical Support. The term “technical support” refers to the range of services providing assistance for the software via the telephone, email, a website or otherwise.

f) Release or Update. The term “release” or “update” are terms that refer to a revision of software that contains defect corrections, minor enhancements, or improvements of the software’s functionality. This is usually designated by a change in the number to the right of the decimal point (e.g., from Version 5.3 to 5.4). An example of an update is the addition of new hardware.

g) Version or Upgrade. The term “version” or “upgrade” are terms that refer to a revision of software that contains new or improved functionality. This is usually designated by a change in the number to the left of the decimal point (e.g., from Version 5.4 to 6).

(2). Software License.

a) Notwithstanding any contrary provisions contained in the Contractor’s standard commercial license or lease agreement, the Contractor agrees that the Government will have the rights that are set forth in paragraph (e) of this clause to use, duplicate or disclose any commercial computer software delivered under this contract. The terms and provisions of this contract shall comply with Federal laws and the Federal Acquisition Regulation.

b) Unless otherwise stated in the Schedule of Supplies/Services, the Product Description, the software license provided to the Government is a perpetual, nonexclusive license to use the software.

c) The Government may use the software in a networked environment.

d) All limitations of software usage are expressly stated in the Schedule of

Supplies/Services and the Product Description.

e) The commercial computer software delivered under this contract may not be used, reproduced, or disclosed by the Government except as provided below or as expressly stated otherwise in this contract. The commercial computer software may be-

i. Used or copied for use with the computer(s) for which it was acquired, including use at any Government installation or agency to which the computer(s) may be transferred;

ii. Used or copied for use with a backup computer if any computer for which it was acquired is inoperative;

iii. Reproduced for safekeeping (archives) or backup purposes;

iv. Modified, adapted, or combined with other computer software;

v. Disclosed to and reproduced for use by support service Contractors or their subcontractors, subject to the same restrictions set forth in this contract; and

vi. Used or copied for use with a replacement computer.

f) Unauthorized Obligations.

i. Except as stated in paragraph (ii), when any supply or service acquired under this contract is subject to any commercial supplier agreement (as defined in 502.101) that includes any language, provision, or clause requiring the Government to pay any future fees, penalties, interest, legal costs or to indemnify the Contractor or any person or entity for damages, costs, fees, or any other loss or liability that would create an Anti-Deficiency Act violation ( 31 U.S.C. 1341), the following shall govern:

1) Any such language, provision, or clause is unenforceable against the Government.

2) Neither the Government nor any Government authorized end user shall be deemed to have agreed to such clause by virtue of it appearing in the commercial supplier agreement.

If the commercial supplier agreement is invoked through an “I agree” click box or other comparable mechanism (e.g., “click-wrap” or “browse-wrap” agreements), execution does not bind the Government or any Government authorized end user to such clause.

3) Any such language, provision, or clause is deemed to be stricken from the commercial supplier agreement.

ii. Paragraph (u)(1) of this clause does not apply to indemnification or any other payment by the Government that is expressly authorized by statute and specifically authorized under applicable agency regulations and procedures.

g) Commercial supplier agreements unenforceable clauses.

https://www.acquisition.gov/gsam/part-502#GSAM_502_101 http://uscode.house.gov/browse.xhtml;jsessionid=114A3287C7B3359E597506A31FC855B3

i. This agreement is a part of a contract between the commercial supplier and the U.S. Government for the acquisition of the supply or service that necessitates a license or other similar legal instrument (including all contracts, task orders, and delivery orders under FAR 12).

ii. End user. This agreement shall bind the ordering activity as end user but shall not operate to bind a Government employee or person acting on behalf of the Government in his or her personal capacity.

iii. Law and disputes. This agreement is governed by Federal law. Any language purporting to subject the U.S. Government to the laws of a U.S. state, U.S. territory, district, or municipality, or a foreign nation, except where Federal law expressly provides for the application of such laws, is hereby deleted.

1) Any language requiring dispute resolution in a specific forum or venue that is different from that prescribed by applicable Federal law is hereby deleted. Any dispute regarding the license grant or usage limitations shall be resolved in accordance with the Disputes Clause incorporated in FAR 52.212-4(d).

2) Any language prescribing a different time period for bringing an action than that prescribed by applicable Federal law in relation to a dispute is hereby deleted.

3) Continued performance. The supplier or licensor shall not unilaterally revoke, terminate or suspend any rights granted to the Government except as allowed by this contract. If the supplier or licensor believes the ordering activity to be in breach of the agreement, it shall pursue its rights under the Contract Disputes Act or other applicable Federal statute while continuing.

4) Arbitration; equitable or injunctive relief. In the event of a claim or dispute arising under or relating to this agreement, a binding arbitration shall not be used unless specifically authorized by agency guidance, and equitable or injunctive relief, including the award of attorney fees, costs or interest, may be awarded against the U.S. Government only when explicitly provided by statute (e.g., Prompt Payment Act or Equal Access to Justice Act).

iv. Updating terms. After award, the contractor may unilaterally revise commercial supplier agreement terms if they are not material. A material change is defined as:

1) Terms that change Government rights or obligations;

2) Terms that increase Government prices;

3) Terms that decrease overall level of service; or

4) Terms that limit any other Government right addressed elsewhere in this contract.

5) For revisions that will materially change the terms of the contract, the revised commercial supplier agreement must be incorporated into the contract using a bilateral modification.

6) Any agreement license terms or conditions unilaterally revised subsequent to award that are inconsistent with any material term or provision of this contract shall not be enforceable against the Government, and the Government shall not be deemed to have consented to them.

v. No automatic renewals. If any license or service tied to periodic payment is provided under this agreement (e.g., annual software maintenance or annual lease term), such license or service shall not renew automatically upon expiration of its current term without prior express consent by an authorized Government representative.

vi. Indemnification. Any clause of this agreement requiring the commercial supplier or licensor to defend or indemnify the end user is hereby amended to provide that the U.S. Department of Justice has the sole right to represent the United States in any such action, in accordance with 28 U.S.C. 516.

vii. Audits. Any clause of this agreement permitting the commercial supplier or licensor to audit the end user's compliance with this agreement is hereby amended as follows:

1) Discrepancies found in an audit may result in a charge by the commercial supplier or licensor to the ordering activity.

Any resulting invoice must comply with the proper invoicing requirements specified in the underlying Government contract or order.

2) This charge, if disputed by the ordering activity, will be resolved in accordance with FAR 52.212-4(d); no payment obligation shall arise on the part of the ordering activity until the conclusion of the dispute process.

3) Any audit requested by the contractor will be performed at the contractor's expense, without reimbursement by the Government.

(3). Software Maintenance and/or Technical Support.

a) If the Government desires to continue software maintenance and support beyond the period of performance identified in this Contract/Order, the Government will issue a separate contract or order for maintenance and support. Conversely, if a contract or order for continuing software maintenance and technical support is not received, the Contractor is neither authorized nor permitted to renew any of the previously furnished services.

https://www.acquisition.gov/gsam/part-552#GSAM_552_212_4

b) The Contractor shall provide software support services, which includes periodic updates, enhancements and corrections to the software, and reasonable technical support, all of which are customarily provided by the Contractor to its commercial customers to cause the software to perform according to its specifications, documentation or demonstrated claims.

c) Any telephone support provided by Contractor shall be at no additional cost.

d) The Contractor shall provide all maintenance services in a timely manner in accordance with the Contractor’s customary practice or as defined in the Product Description. However, prolonged delay (exceeding two business days) in resolving software problems will be noted in the Government’s various past performance records on the Contractor (e.g., www.cpars.gov).

e) If the Government allows the maintenance and support to lapse and subsequently wishes to reinstate it, any reinstatement fee charged shall not exceed the amounts that would have been charged if the Government had not allowed the subscription to lapse.

(4). Disabling Software Code.

The Government requires delivery of computer software that does not contain any code that will, upon the occurrence or the nonoccurrence of any event, disable the software. Such code includes but is not limited to a computer virus, restrictive key, node lock, time-out, or other function, whether implemented by electronic, mechanical, or other means, which limits or hinders the use or access to any computer software based on residency on a specific hardware configuration, frequency of duration of use, or other limiting criteria. If any such disabling code is present, the Contractor agrees to indemnify the Government for all damages suffered as a result of a disabling caused by such code, and the contractor agrees to remove such code upon the Government’s request at no extra cost to the Government. Inability of the Contractor to remove the disabling software code will be considered an inexcusable delay and a material breach of contract, and the Government may exercise its right to terminate for cause. In addition, the Government is permitted to remove the code as it deems appropriate and charge the Contractor for consideration for the time and effort expended in removing the code.

(5). Manuals and Publications.

Upon Government request, the Contractor shall furnish the most current version of the user manual and publications for all products/services provided under this Contract/Order at no cost.

http://www.cpars.gov/

B.4 PRICE SCHEDULE

Any resulting contract will be awarded on a firm-fixed-price basis as defined by FAR Subpart 16.202. Accordingly, the Offeror’s shall ensure that any and all costs associated with the Offeror’s proposed application(s), software products, software solution, and/or system, shall be included in the Offeror’s proposed firm-fixed price, and shall serve as the Offeror’s firm-fixed price for the entire period of performance of any resulting contract. No additional costs or fees relative to the Offeror’s proposed application(s), software products, software solution, and/or system including, but not limited to, licensing costs and any associated licensing maintenance required for the development, delivery, integration, operation, and/or maintenance of the Offeror’s proposed solution will be allowed, accepted, and/or paid by the Government.

NOTE: Offerors are instructed to complete Section B.4 and submit with their quote.

Offerors are cautioned that alterations to the line items as specified below may render quotes unacceptable and therefore, ineligible for award. Please be advised that any successful Offeror’s Section B.4 submitted in response to this solicitation will be incorporated into any resulting award and thereby serve as the Offeror’s firm-fixed-pricing for the entire period of performance of any resultant contract.

All questions shall be directed to the Contract Specialist, William Waterhouse at William.Waterhouse@va.gov and Contracting Officer, Kendra M. Casebolt at Kendra.Casebolt@va.gov, prior to the closing date and time specified in Block 8 on page 1 of SF 1449.

Inspection and Acceptance: DESTINATION

BASE PERIOD

Period of Performance shall be 12-months from effective date of award

All products/services shall be in accordance with Section B.5 PRODUCT DESCRIPTION titled, “Enterprise ID.me Software Subscriptions and Support,” dated March 10, 2026, PD Version Number: 2.0

*NSP = Not Separately Priced

CLIN Description / Part Number (P/N) QTY Unit Unit Price Extended Price

0001 Credential Broker License - Annual Active and Passive Broker Credential Broker Subscription

P/N: IDME-CBL-0004

1 EA $ $

0002 IT Identity Proofing: New Users Subscription

IT Funded: The Subscriptions shall be governed by the application. Examples of applications are provided below.

ITOPS/password Lighthouse (APIs) VA.gov

P/N: IDME-LOA3I-0004S

Up to 600,000

EA $ $

0003 Identity Proofing Renewal Users Subscription

IT Funded: Renewal User licenses (LOA3 / IAL2), covering previously identity proofed users (at VA or any other agency) who do not have an active license and access VA services.

P/N: IDME-LOA3R-0001S

Up to 4,250,000

EA $ $

0004 Deliverable: Bi-weekly Snapshot Report.

Due 7 days After Receipt of Order (ARO) and bi-weekly thereafter.

Electronic submission to: VA PM, COR, CO.

1 LT *NSP *NSP

0005 Deliverable: Monthly Subscription Usage Report

Due 30 days ARO and due monthly thereafter.

Electronic submission to: VA PM, COR, CO

1 LT *NSP *NSP

0006 Deliverable: Service Level Agreement (SLA) Monitoring Plan

Due monthly

Electronic submission to: VA PM, COR, CO

1 LT *NSP *NSP

0007 Deliverable: SLA Report

Due monthly

Electronic submission to: VA PM, COR, CO

1 LT *NSP *NSP

0008 Deliverable: User Support Report

Due monthly

Electronic submission to: VA PM, COR, CO

1 LT *NSP *NSP

0009 Deliverable:MFA Monthly Status Report

Due monthly

Electronic submission to: VA PM, COR, CO

1 LT *NSP *NSP

TOTAL BASE PERIOD $

BASE PERIOD OPTIONAL TASKS

These optional tasks may be exercised in accordance with (IAW) FAR 52.217-7, Option for Increased Quantity-Separately Priced Line Item (MAR 1989), at the Government’s discretion, at any time, multiple times, and from time to time, during the BASE PERIOD, up to the maximum quantity specified for CLINs 0010 - 0013. CLINs 0014 and 0015 may be exercised, at the Government’s discretion, at any time, and only one time each, during the

BASE PERIOD.

All products/services shall be IAW Section B.5 PRODUCT DESCRIPTION titled, “Enterprise ID.me Software Subscriptions and Support,” dated March 10, 2026, PD Version Number: 2.0

CLIN Description / Part Number (P/N) QTY Unit Unit Price Extended Price

0010 IT Optional Task - Identity Proofing:

New Users Subscription

P/N: IDME-LOA3I-0004S

Up to 400,000

EA $ $

0011 IT Optional Task - Identity Proofing:

Renewal Users Subscription

P/N: IDME-LOA3R-0001S

Up to 2,000,000

EA $ $

0012 IT Optional Task - Identity Proofing:

New Users Subscription

P/N: IDME-IAL2I-0004S

Up to 60,000

EA $ $

0013 IT Optional Task - Identity Proofing:

Renewal Users Subscription

P/N: IDME-IAL2R-0001S

Up to 90,000

EA $ $

0014 MFA Event increase by 5 million

P/N: IDME-AAL2-007

1 EA $ $

0015 MFA Event increase by 10 million

P/N: IDME-AAL2-008

1 EA $ $

TOTAL BASE PERIOD OPTIONAL TASKS $

OPTION PERIOD 1

This 12-Month option period may be exercised in accordance with (IAW) FAR 52.217-9 Option to Extend the Term of the Contract (MAR 2000). Work shall not commence until, and unless, a formal modification is issued by the Contracting Officer. If exercised, this option period shall commence immediately upon the expiration of the BASE PERIOD.

All products/services shall be IAW Section B.5 PRODUCT DESCRIPTION titled, “Enterprise ID.me Software Subscriptions and Support,” dated March 10, 2026, PD Version Number: 2.0

CLIN Description / Part Number (P/N) QTY Unit Unit Price Extended Price

1001 Credential Broker License - Annual Active and Passive Broker Credential Broker Subscription

P/N: IDME-CBL-0004

1 EA $ $

1002 IT Identity Proofing: New Users Subscription

IT Funded: The Subscriptions shall be governed by the application. Examples of applications are provided below.

ITOPS/password Lighthouse (APIs) VA.gov

P/N: IDME-IAL2I-0004S

Up to 580,000

EA $ $

1003 Identity Proofing Renewal Users Subscription

IT Funded: Renewal User licenses (LOA3 / IAL2), covering previously identity proofed users (at VA or any other agency) who do not have an active license and access VA services.

P/N: IDME-IAL2R-0001S

Up to 4,550,000

EA $ $

1004 Deliverable: Bi-weekly Snapshot Report.

When VA exercises the Option period the report will be due bi-weekly.

Electronic submission to: VA PM, COR, CO.

1 LT *NSP *NSP

1005 Deliverable: Monthly Subscription Usage Report

When VA exercises the Option period the report will be due monthly.

Electronic submission to: VA PM, COR, CO

1 LT *NSP *NSP

1006 Deliverable: Service Level Agreement (SLA) Monitoring Plan

When VA exercises the Option period the report will be due monthly.

Electronic submission to: VA PM, COR, CO

1 LT *NSP *NSP

1007 Deliverable: SLA Report

When VA exercises the Option period the report will be due monthly.

Electronic submission to: VA PM, COR, CO

1 LT *NSP *NSP

1008 Deliverable: User Support Report

When VA exercises the Option period the report will be due monthly.

Electronic submission to: VA PM, COR, CO

1009 Deliverable:MFA Monthly Status Report

When VA exercises the Option period the report will be due monthly.

Electronic submission to: VA PM, COR, CO

1 LT *NSP *NSP

TOTAL OPTION PERIOD 1 $

OPTION PERIOD 1 OPTIONAL TASKS

These optional tasks may be exercised in accordance with (IAW) FAR 52.217-7, Option for Increased Quantity-Separately Priced Line Item (MAR 1989), at the Government’s discretion, at any time, multiple times, and from time to time, during OPTION PERIOD 1, up to the maximum quantity specified for CLINs 1010 and 1011. CLINs 1012 and 1013 may be exercised, at the Government’s discretion, at any time, and only one time each, during

OPTION PERIOD 1.

All products/services shall be IAW Section B.5 PRODUCT DESCRIPTION titled, “Enterprise ID.me Software Subscriptions and Support,” dated March 10, 2026, PD Version Number: 2.0

CLIN Description / Part Number (P/N) QTY Unit Unit Price Extended Price

1010 IT Optional Task - Identity Proofing:

New Users Subscription

P/N: IDME-IAL2I-0004S

Up to 460,000

EA $ $

1011 IT Optional Task - Identity Proofing:

Renewal Users Subscription

P/N: IDME-IAL2R-0001S

Up to 2,090,000

EA $ $

1012 MFA Event increase by 5 million

P/N: IDME-AAL2-007

1 EA $ $

1013 MFA Event increase by 10 million

P/N: IDME-AAL2-008

TOTAL OPTION PERIOD 1 OPTIONAL TASKS $

OPTION PERIOD 2

This 12-Month option period may be exercised in accordance with (IAW) FAR 52.217-9 Option to Extend the Term of the Contract (MAR 2000). Work shall not commence until, and unless, a formal modification is issued by the Contracting Officer. If exercised, this option period shall commence immediately upon the expiration of OPTION PERIOD 1.

All products/services shall be IAW Section B.5 PRODUCT DESCRIPTION titled, “Enterprise ID.me Software Subscriptions and Support,” dated March 10, 2026, PD Version Number: 2.0

*NSP – Not Separately Priced

CLIN Description / Part Number (P/N) QTY Unit Unit Price Extended Price

2001 Credential Broker License - Annual Active and Passive Broker Credential Broker Subscription

2002 IT Identity Proofing: New Users Subscription

IT Funded: The Subscriptions shall be governed by the application. Examples of applications are provided below.

ITOPS/password Lighthouse (APIs) VA.gov

P/N: IDME-IAL2I-0004S

Up to 560,000

EA $ $

2003 Identity Proofing Renewal Users Subscription

IT Funded: Renewal User licenses (LOA3 / IAL2), covering previously identity proofed users (at VA or any other agency) who do not have an active license and access VA services.

P/N: IDME-IAL2R-0001S

Up to 4,840,000

EA $ $

2004 Deliverable: Bi-weekly Snapshot Report.

When VA exercises the Option period the report will be due bi-weekly.

Electronic submission to: VA PM, COR, CO.

1 LT *NSP *NSP

2005 Deliverable: Monthly Subscription Usage Report

When VA exercises the Option period the report will be due monthly.

Electronic submission to: VA PM, COR, CO

1 LT *NSP *NSP

2006 Deliverable: Service Level Agreement (SLA) Monitoring Plan

When VA exercises the Option period the report will be due monthly.

Electronic submission to: VA PM, COR, CO

1 LT *NSP *NSP

2007 Deliverable: SLA Report

When VA exercises the Option period the report will be due monthly.

Electronic submission to: VA PM, COR, CO

1 LT *NSP *NSP

2008 Deliverable: User Support Report

When VA exercises the Option period the report will be due monthly.

Electronic submission to: VA PM, 2009 Deliverable:MFA Monthly Status Report

When VA exercises the Option period the report will be due monthly.

Electronic submission to: VA PM, COR, CO

1 LT *NSP *NSP

TOTAL OPTION PERIOD 2 $

OPTION PERIOD 2 OPTIONAL TASKS

These optional tasks may be exercised in accordance with (IAW) FAR 52.217-7, Option for Increased Quantity-Separately Priced Line Item (MAR 1989), at the Government’s discretion, at any time, multiple times, and from time to time, during OPTION PERIOD 2, up to the maximum quantity specified for CLINs 2010 and 2011. CLINs 2012 and 2013 may be exercised, at the Government’s discretion, at any time, and only one time each, during

OPTION PERIOD 2.

All products/services shall be IAW Section B.5 PRODUCT DESCRIPTION titled, “Enterprise ID.me Software Subscriptions and Support,” dated March 10, 2026, PD Version Number: 2.0

CLIN Description / Part Number (P/N) QTY Unit Unit Price Extended Price

2010 IT Optional Task - Identity Proofing:

New Users Subscription

P/N: IDME-IAL2I-0004S

Up to 460,000

EA $ $

2011 IT Optional Task - Identity Proofing:

Renewal Users Subscription

P/N: IDME-IAL2R-0001S

Up to 2,090,000

EA $ $

2012 MFA Event increase by 5 million

P/N: IDME-AAL2-007

1 EA $ $

2013 MFA Event increase by 10 million

P/N: IDME-AAL2-008

1 EA $ $

TOTAL OPTION PERIOD 2 OPTIONAL TASKS $

OPTION PERIOD 3

This 12-Month option period may be exercised in accordance with (IAW) FAR 52.217-9 Option to Extend the Term of the Contract (MAR 2000). Work shall not commence until, and unless, a formal modification is issued by the Contracting Officer. If exercised, this option period shall commence immediately upon the expiration of OPTION PERIOD 2.

All products/services shall be IAW Section B.5 PRODUCT DESCRIPTION titled, “Enterprise ID.me Software Subscriptions and Support,” dated March 10, 2026, PD Version Number: 2.0

*NSP – Not Separately Priced

CLIN Description / Part Number (P/N) QTY Unit Unit Price Extended Price

3001 Credential Broker License - Annual Active and Passive Broker Credential Broker Subscription

3002 IT Identity Proofing: New Users Subscription

IT Funded: The Subscriptions shall be governed by the application. Examples of applications are provided below.

ITOPS/password Lighthouse (APIs) VA.gov

P/N: IDME-IAL2I-0004S

Up to 540,000

EA $ $

3003 Identity Proofing Renewal Users Subscription

IT Funded: Renewal User licenses (LOA3 / IAL2), covering previously identity proofed users (at VA or any other agency) who do not have an active license and access VA services.

P/N: IDME-IAL2R-0001S

Up to 5,120,000

EA $ $

3004 Deliverable: Bi-weekly Snapshot Report.

When VA exercises the Option period the report will be due bi-weekly.

Electronic submission to: VA PM, COR, CO.

1 LT *NSP *NSP

3005 Deliverable: Monthly Subscription Usage Report

When VA exercises the Option period the report will be due monthly.

Electronic submission to: VA PM, COR, CO

1 LT *NSP *NSP

3006 Deliverable: Service Level Agreement (SLA) Monitoring Plan

When VA exercises the Option period the report will be due monthly.

Electronic submission to: VA PM, COR, CO

1 LT *NSP *NSP

3007 Deliverable: SLA Report

When VA exercises the Option period the report will be due monthly.

Electronic submission to: VA PM, COR, CO

1 LT *NSP *NSP

3008 Deliverable: User Support Report

When VA exercises the Option period the report will be due monthly.

Electronic submission to: VA PM, 3009 Deliverable:MFA Monthly Status Report

When VA exercises the Option period the report will be due monthly.

Electronic submission to: VA PM, COR, CO

1 LT *NSP *NSP

TOTAL OPTION PERIOD 3 $

OPTION PERIOD 3 OPTIONAL TASKS

These optional tasks may be exercised in accordance with (IAW) FAR 52.217-7, Option for Increased Quantity-Separately Priced Line Item (MAR 1989), at the Government’s discretion, at any time, multiple times, and from time to time, during OPTION PERIOD 3, up to the maximum quantity specified for CLINs 3010 and 3011. CLINs 3012 and 3013 may be exercised, at the Government’s discretion, at any time, and only one time each, during

OPTION PERIOD 3.

All products/services shall be IAW Section B.5 PRODUCT DESCRIPTION titled, “Enterprise ID.me Software Subscriptions and Support,” dated March 10, 2026, PD Version Number: 2.0

CLIN Description / Part Number (P/N) QTY Unit Unit Price Extended Price

3010 IT Optional Task - Identity Proofing:

New Users Subscription

P/N: IDME-IAL2I-0004S

Up to 460,000

EA $ $

3011 IT Optional Task - Identity Proofing:

Renewal Users Subscription

P/N: IDME-IAL2R-0001S

Up to 2,090,000

EA $ $

3012 MFA Event increase by 5 million

P/N: IDME-AAL2-007

1 EA $ $

3013 MFA Event increase by 10 million

P/N: IDME-AAL2-008

TOTAL OPTION PERIOD 3 OPTIONAL TASKS $

TOTAL ORDER VALUE

(Total Base + Total All Option Periods + Total All Optional Tasks)

B.5 PRODUCT DESCRIPTION

PRODUCT DESCRIPTION (PD)

DEPARTMENT OF VETERANS AFFAIRS

Office of Information & Technology Office of the Chief Technology Officer

Enterprise ID.me Software Subscriptions and Support

Date: March 10, 2026

VA-26-00012041

PD Version Number: 2.0

DEFINITIONS

a) “User” shall mean the end user of an application relying upon ID.me as a CSP. These applications may be those developed by VA or 3rd-party applications enabled via APIs developed by VA.

B) “NIST 800-63 Standards” shall mean National Institute of Standards and Technology (NIST) 800-63-2 Level of Assurance (LOA) 1, 2, and 3 standards, NIST 800-63-3 Identity Assurance Level (IAL) 1, 2 and Authenticator Assurance Level (AAL) 1, 2, and 3 standards, and any subsequent NIST 800-63 publications or revisions which may be released during the period of performance.

c) “MFA Event” shall mean any successful occurrence of a user being authenticated using any ID.me MFA option.

d) “Issue” shall mean (i) a reproducible defect or combination of defects in ID.me services that results in a material loss of functionality or (ii) loss of availability to access the services functioning as agreed to and designed by VA and ID.me. Issues are classified as follows:

i. “Severity 1 Issue” is defined as the ID.me platform being unavailable to all users during Operating Hours,

ii. “Severity 2 Issue” is defined as one (1) or more material parts – but not the entirety – of the ID.me platform being unavailable to all users during Operating Hours, and

iii. “Severity 3 Issue” is defined as all other issues with the ID.me, such as general defects in the ID.me solution that have a reasonable temporary workaround or do not affect the user’s ability to utilize the ID.me (e.g. a cosmetic bug is found in the system).

e) “Sandbox Environment” shall mean an ID.me provided environment that is used with the intent of development of, and integration with, VA systems and enabled applications with test users. There shall be no real user data or Personally Identifiable Information (PII) in this environment.

f) “Production Environment” shall mean an ID.me provided environment that is integrated with existing production VA environments with the intent of providing CSP functionality for real users.

g) "Operating Hours" shall mean 24 hours per day, 7 days per week for the production environment and 7am-9pm ET Monday-Friday excluding holidays for the sandbox environment.

h) “On-Call Hours” shall mean support required outside of normal Operating Hours.

i) “Trusted Referee” shall mean a trained ID.me employee that can verify a user’s identity through a remote video call.

j) “Relying Party” shall mean offices within the Department of Veterans Affairs including, but not limited to, the Office of the CTO, Infrastructure Operations, and the Enterprise Service Desk.

k) “Identity Providers” shall mean other credential service providers or identity brokers including, but not limited to, ID.me, Login.gov, and Okta.

1.0 PRODUCT REQUIREMENTS

The Department of Veterans Affairs (VA) Office of Information Technology, Office of the Chief Technology Officer (OCTO) has a requirement for renewal of the current ID.me Identity and Access Management (IAM) Credential Service Provider (CSP) Software-as-a-Service (SaaS) solution which includes an annual Credential Brokers license and new and renewal user identity proofing subscriptions. Specifically, VA requires renewal of the yearly Credential Broker license, which allows up to 125 million Multi-Factor Authentication (MFA) events in the Base Period and in each Option Period, as well as maintenance and help desk support.

The ID.me CSP SaaS solution allows Veterans to verify their identity, via the required identity proofing subscriptions, as well as authenticate them when they require access to secure VA systems like VA.gov and the VA Health and Benefits mobile app. The current ID.me IAM CSP SaaS solution is an integral part of VA’s overall Digital Modernization Strategy. ID.me supports VA’s compliance with Office of Management and Budget (OMB) Memo 19-17, which requires federal agencies to leverage existing credentials, use federal or commercial shared services, and use credentials that are in compliance with National Institute of Standards and Technology (NIST) 800-63. ID.me supports VA compliance with Executive Orders 14249, 14247, and 14271, which prioritize fraud reduction and usage of commercially available solutions.

Specifically, the ID.me Credential Broker License allows VA to utilize the ID.me’s platform for authentication, including up to 125 million MFA events per year. An MFA event is when a Veteran uses the ID.me solution to access a secure VA application or website. The Broker License also provides Veterans publicly available customer support, including an inbound and outbound call center, video chat, live chat, and email channels as well as maintenance that includes software updates, patches, and fixes.

Escalation support channels shall be available for VA employees, contractors, and designated representatives. Help desk inquiries associated with VA will be prioritized across general support, escalations, and fraud investigations. The required support shall ensure the ID.me CSP solution continually meets NIST 800-63-2 Level of Assurance (LOA) 1, 2, 3 and accredited at NIST800-63-3 Identity Assurance Level 1, 2 and Authenticator Assurance Level (AAL) (1, 2, and 3 throughout the period of performance and shall be compliant with a minimum of Web Content Accessibility Guidelines (WCAG) 2.1 Level A and Level AA accessibility standards.

The ID.me CSP SaaS solution shall include Trusted Referee support that provides a remote video chat option to assist users in verifying their identity, as well as an in-person proofing option with staff at specific locations (e.g. Veteran Services Organizations) who are able to verify Veterans, etc., when the online tool is not capable or where the Veteran prefers an in-person interaction.

The period of performance for this effort shall be a 12-month base period with three 12-month option periods, as well as Optional Tasks in the base and each option period to be exercised at the Government’s discretion.

Some of the current VA use cases include the following:

VA.gov

VA.gov offers Veterans a single front door to VA benefits and services, in alignment with VA’s digital modernization strategy. VA.gov currently serves millions of Veterans, offering a single place to access benefits, scheduling, status updates, and forms. The sign-in page supports sign-in functionality for a number of other web and mobile tools at VA.

VA API Platform (VAP)

VAP enabled 3rd-party application support to internal VA data and systems in 2019 using the ID.me CSP as part of its overall implementation of the OAuth 2.0 standard.

This integration enables key applications such as Apple iPhone HealthKit, Humetrix, and MyLinks to access a Veteran’s health history to access benefits claims submissions data and allows Veterans to verify their status for usajobs.gov Veterans’ Preference processing of job applicants. VA requires maintenance, support, and expansion of the ID.me CSP solution that meets NIST 800-63-2 LOA 1, 2, 3 and accredited at NIST 800- 63-3 IAL 1, 2 and AAL 1, 2, and 3. Such levels of identity proofing ensure secure and accurate access to PII, Protected Health Information (PHI), and sensitive data critical to Government identification of Veterans receiving and accessing VA benefits and services.

The ID.me CSP solution shall include a Credential Broker License and Identity Proofing User Subscriptions. Maintenance shall include software updates, patches, and fixes.

User support for an unlimited number of sign-in, identity proofing, and MFA tickets shall be provided.

User Support channels shall include inbound phone support via direct routing from VA call centers, outbound phone support from ID.me, outbound video chat from ID.me, publicly available live chat, publicly available chatbot, publicly available inbound ticket submission, inbound escalation email and ticket submission from VA staff (va.support@id.me and customersupport@id.me) on behalf of Veterans, and outbound email from ID.me. Help desk tickets associated with VA will be moved to the top of the queue across general support, escalations, and fraud investigations. The time to connect with a user via phone support shall be measured during normal call center hours, which are 10:30AM-7:00PM Eastern Time.

All VA users shall be permitted to access the ID.me CSP solution, including users located outside of the continental United States. To ensure the accessibility of the ID.me CSP solution to all VA users, the solution shall be compliant with a minimum of WCAG

2.1 Level A and Level AA accessibility standards.

Data provided by VA or users to ID.me shall not be used for any purposes without the explicit consent of the user. A user shall receive an email confirmation if explicit consent is granted and be offered self-service options to opt-out for commercial purposes. All publicly accessible terms, policies, and agreements shall clearly delineate between the ID.me CSP solution and any other commercial offerings.

VA requires additional ID.me subscriptions and Identity Proof Subscriptions, throughout the Base Period and/or Option Periods, to support the users of applications being migrated to the ID.me solution, as well as renewal subscriptions for existing users to mailto:va.support@id.me mailto:customersupport@id.me support user authentications for VA Single Sign-On Enterprise (SSOe), VA.gov, and

VAP.

The Contractor shall provide a Bi-weekly Snapshot Report including subscription issuances and renewals consumed by each integration. In addition, the Contractor shall provide a Monthly Subscription Usage Report that details the issuance of new users, renewal users, key attributes that pertain to tracking used, and unused subscriptions across each billing period to allow for forecasting and user management.

Deliverables

A. Bi-weekly Snapshot Report (due 7 days ARO and due bi-weekly thereafter) B. Monthly Subscription Usage Report (due 30 days ARO and due monthly thereafter)

1.1 SERVICE LEVEL AGREEMENT

Each month, the Contractor shall ensure all services be available and functional to serve user requests at no less than 99.9% availability during Operating Hours for the production environment, and 99.0% availability during Operating Hours for the Sandbox environment.

In addition to availability, the Contractor shall provide a mechanism to determine performance anomalies using methodologies and metrics best suited to ID.me’s service and support capabilities. Anomalies outside the definition of acceptable performance, as defined in the Service Level Agreement (SLA) Monitoring Plan, and as delivered by ID.me, shall be included in the unavailable time documented in the SLA.

Services that are faulted due to an external entity shall have trouble tickets logged with the responsible party, with all outage time attributable to the Contractor tracked until a ticket is logged with the responsible entity. An automated test, IAW the VA-approved SLA Monitoring Plan, with an execution frequency of no more than 300 seconds, and the logged reports of execution, including timing details, of that test shall be provided in the SLA Report. For any faulted services attributed to an external entity the Contractor shall include a record of the faulty services that was issued to the responsible party in the SLA report.

This record shall include the time that it was filed, and if resolved, the time of resolution.

Any maintenance window outages associated with external entities shall include a record of the notification that was distributed to VA Stakeholders, and the time which the record was distributed.

The following list of exclusions applies to this SLA:

• Any interruptions attributable to VA software, hardware, or network connectivity

• Any disruption of third-party services reasonably necessary for ID.me service (e.g., AWS)

• Factors outside of ID.me’s reasonable control (for example, natural disaster, war, acts of terrorism, riots, government action, or a network or device failure external to ID.me including at Customer’s site or between Customer’s site and ID.me’s networks); and

• Any large-scale Internet outages, including, but not limited to, internet outages affecting large regions or numbers of users due to technical issues, cyber-attacks, natural disasters, or government action.

Deliverables:

A. SLA Monitoring Plan (due monthly) B. SLA Report (due monthly)

1.2 ISSUE RESOLUTION

Should the Contractor be made aware of functional and performance Issues either by VA or through internal monitoring systems, the Contractor will respond to and resolve all identified Issues in accordance with the timeframes set forth below. The Contractor shall be responsible for determining the Severity Level of Issues with its components using the definitions provided above.

Table 1: Issue Resolution Requirements

Issue Severity

Operating Hours Initial Response Time

Operating Hours Resolution Time

On-Call Hours Initial Response Time

On-Call Hours Resolution Time

Severity 1 Issue

Within 30 minutes Within 2 hours Within 1 hour Within 4 hours

Severity 2 Issue

Within 2 hours Within 1 Business Day

Start of the next Business Day

Within 1 Business Day (by 5 p.m. of next Business Day)

Severity 3 Issue

Within 1 Business Day

Next available software release

By end of business the next

Business Day

Next available software release or as otherwise agreed to by VA and the Contractor

1.3 USER SUPPORT AND ESCALATION

The Contractor shall ensure user support is available to end users via multiple channels during Operating Hours. Support shall be timely, dependent on channel:

a) The Contractor’s monthly average non-automated response time to users requesting support via email or web form shall be no more than 24 hours.

Additionally, 90% of total…