PAGE 1 OF 1. REQUISITION NO.

2. CONTRACT NO. 3. AWARD/EFFECTIVE DATE 4. ORDER NO. 5. SOLICITATION NUMBER 6. SOLICITATION ISSUE DATE

a. NAME b. TELEPHONE NO. (No Collect Calls) 8. OFFER DUE DATE/LOCAL

TIME

9. ISSUED BY CODE 10. THIS ACQUISITION IS UNRESTRICTED OR SET ASIDE: % FOR:

SMALL BUSINESS

HUBZONE SMALL

BUSINESS

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

WOMEN-OWNED SMALL BUSINESS

(WOSB) ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

EDWOSB

8(A)

NAICS:

SIZE STANDARD:

11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

SEE SCHEDULE

12. DISCOUNT TERMS

13a. THIS CONTRACT IS A

RATED ORDER UNDER

DPAS (15 CFR 700)

13b. RATING

14. METHOD OF SOLICITATION

RFQ IFB RFP

15. DELIVER TO CODE 16. ADMINISTERED BY CODE

17a. CONTRACTOR/OFFEROR CODE FACILITY CODE 18a. PAYMENT WILL BE MADE BY CODE

TELEPHONE NO. UEI: EFT:

PHONE: FAX:

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN OFFER

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK BELOW IS CHECKED

SEE ADDENDUM

19. 20. 21. 22. 23. 24.

ITEM NO. SCHEDULE OF SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

(Use Reverse and/or Attach Additional Sheets as Necessary)

25. ACCOUNTING AND APPROPRIATION DATA 26. TOTAL AWARD AMOUNT (For Govt. Use Only)

27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1, 52.212-4. FAR 52.212-3 AND 52.212-5 ARE ATTACHED. ADDENDA ARE ARE NOT ATTACHED.

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA ARE ARE NOT ATTACHED

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN _______________ 29. AWARD OF CONTRACT: REF. ___________________________________ OFFER COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND DATED ________________________________. YOUR OFFER ON SOLICITATION DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY (BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED SET FORTH HEREIN IS ACCEPTED AS TO ITEMS:

30a. SIGNATURE OF OFFEROR/CONTRACTOR 31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER)

30b. NAME AND TITLE OF SIGNER (TYPE OR PRINT) 30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER (TYPE OR PRINT) 31c. DATE SIGNED

AUTHORIZED FOR LOCAL REPRODUCTION (REV. NOV 2021)

PREVIOUS EDITION IS NOT USABLE Prescribed by GSA - FAR (48 CFR) 53.212

7. FOR SOLICITATION

INFORMATION CALL:

STANDARD FORM 1449

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL PRODUCTS AND COMMERCIAL SERVICES

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 30

36C10B26Q0228 05-04-2026

Keith Long, Keith.Long2@VA.gov 848-377-5348 05-11-2026

12:00 EDT

36C10B Department of Veterans Affairs Technology Acquisition Center

23 Christopher Way Eatontown NJ 07724

X

513210

$47 Million

N/A

X

See Delivery Schedule

36C10B

Department of Veterans Affairs Technology Acquisition Center

23 Christopher Way Eatontown NJ 07724

36C10A

Technology Acquisition Center Financial Services Center PO Box 149971 Austin TX 78714-8971

Title: Firely Simplifier Tool This is a Sole Source Acquisition

Type of Order: Firm Fixed Price

Points of Contact:

Matthew.J.Truex@va.gov, Contracting Officer Keith.Long2@va.gov, Contract Specialist

X X

Matthew J. Truex

RFQ# 36C10B26Q0228

Table of Contents

SECTION A

A.1 SF 1449 SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL PRODUCTS

AND COMMERCIAL SERVICES

SECTION B - CONTINUATION OF SF 1449 BLOCKS

B1. CONTRACT ADMINISTRATION DATA

B2. GOVERNING LAW CLAUSE

B3. SOFTWARE LICENSE, SOFTWARE MAINTENANCE AND SOFTWARE

TECHNICAL SUPPORT:

B4. PRICE SCHEDULE

B5. PRODUCT DESCRIPTION

SECTION C - CONTRACT CLAUSES

C.1 52.252-2 CLAUSES INCORPORATED BY REFERENCE (FEB 1998)

C.2 52.217-9 OPTION TO EXTEND THE TERM OF THE CONTRACT (MAR 2000)

C.3 52.226-3 ENCOURAGING CONTRACTOR POLICIES TO BAN TEXT

MESSAGING WHILE DRIVING (MAY 2024)

C.4 52.240-91 SECURITY PROHIBITIONS AND EXCLUSIONS (NOV 2025)

(DEVIATION)

C.5 VAAR 852.239-76 INFORMATION AND COMMUNICATION TECHNOLOGY

ACCESSIBILITY (FEB 2023)

SECTION D - CONTRACT DOCUMENTS, EXHIBITS, OR ATTACHMENTS

SECTION E - SOLICITATION PROVISIONS

E.1 52.252-1 SOLICITATION PROVISIONS INCORPORATED BY REFERENCE (FEB

1998)

E.2 52.209-5 CERTIFICATION REGARDING RESPONSIBILITY MATTERS (AUG 2020)

E.3 52.209-11 REPRESENTATION BY CORPORATIONS REGARDING DELINQUENT

TAX LIABILITY OR A FELONY CONVICTION UNDER ANY FEDERAL LAW (FEB 2016)

E.4 52.219-1 SMALL BUSINESS PROGRAM REPRESENTATIONS (FEB 2024)

E.5 52.233-2 SERVICE OF PROTEST (NOV 2025) DEVIATION)

E.6 52.229-11 TAX ON CERTAIN FOREIGN PROCUREMENTS—NOTICE AND

REPRESENTATION (JUN 2020)

E.7 52.240-90 SECURITY PROHIBITIONS AND EXCLUSIONS REPRESENTATIONS

AND CERTIFICATIONS (NOV 2025) (DEVIATION)

E.8 VAAR 852.233-71 ALTERNATE PROTEST PROCEDURE (OCT 2018)

E.9 BASIS FOR AWARD

E.10 SUBMISSION INSTRUCTIONS

SECTION B - CONTINUATION OF SF 1449 BLOCKS

B1. CONTRACT ADMINISTRATION DATA

1. Contract Administration: All contract administration matters will be handled by the following individuals:

a. CONTRACTOR:

b. GOVERNMENT: Contracting Officer 36C10B, Matthew J. Truex

Technology Acquisition Center

23 Christopher Way

Eatontown NJ 07724

2. CONTRACTOR REMITTANCE ADDRESS: All payments by the Government to the contractor will be made in accordance with:

[X] 52.232-33, Payment by Electronic Funds Transfer—System For Award Management, or

[] 52.232-36, Payment by Third Party

3. INVOICES: Invoices shall be submitted in arrears:

a. Quarterly []

b. Semi-Annually []

c. Other [X] See Section B.4

4. GOVERNMENT INVOICE ADDRESS: All Invoices from the contractor shall be submitted electronically in accordance with VAAR Clause 852.232-72 Electronic Submission of Payment Requests.

ACKNOWLEDGMENT OF AMENDMENTS: The offeror acknowledges receipt of amendments to the Solicitation numbered and dated as follows:

AMENDMENT NO DATE

B2. GOVERNING LAW CLAUSE

Federal law and regulations, including the Federal Acquisition Regulations (FAR), shall govern this Contract/Order. Commercial license agreements may be made a part of this Contract/Order but only if both parties expressly make them an addendum hereto, as permitted by FAR 12.212. If the commercial license agreement is not made an addendum, it shall not apply, govern, be a part of or have any effect whatsoever on the Contract/Order; this includes, but is not limited to, any agreement embedded in the computer software (clickwrap), any agreement that is otherwise delivered with or provided to the Government with the commercial computer software or documentation (shrinkwrap), or any other license agreement otherwise referred to in any document. If a commercial license agreement is made an addendum, only those provisions addressing data rights regarding the Government’s use, duplication and disclosure of data (e.g., restricted computer software) are included and made a part of this Contract/Order, and only to the extent that those provisions are not duplicative or inconsistent with Federal law, Federal regulation, the incorporated FAR clauses and the provisions of this Contract/Order; those provisions in the commercial license agreement that do not address data rights regarding the Government’s use, duplication and disclosure of data shall not be included or made a part of the Contract/Order. Federal law and regulation including, without limitation, the Contract Disputes Act (41 U.S.C. § 7101 et seq.), the Anti-Deficiency Act (31 U.S.C. § 1341 et seq.), the Competition in Contracting Act (41 U.S.C. § 3301 et seq.), the Prompt Payment Act (31 U.S.C. § 3901 et seq.), Contracts for Data Processing or Maintenance (38 USC § 5725), and FAR clauses 52.212-4, 52.227-14, 52.227-19 shall supersede, control, and render ineffective any inconsistent, conflicting, or duplicative provision in any commercial license agreement. In the event of conflict between this clause and any provision in the Contract/Order or the commercial license agreement or elsewhere, the terms of this clause shall prevail. The Contractor shall deliver to the Government all data first produced under this Contract/Order with unlimited rights as defined by FAR 52.227-14. Claims of patent or copyright infringement brought against the Government as a party shall be defended by the U.S. Department of Justice (DOJ) in accordance with 28 U.S.C. § 516; at the discretion of DOJ, the Contractor may be allowed reasonable participation in the defense of the litigation. Any additional changes to the Contract/Order must be made by modification (Standard Form 30) and shall only be made by a warranted Contracting Officer. Nothing in this Contract/Order or any commercial license agreement shall be construed as a waiver of sovereign immunity.

B3. SOFTWARE LICENSE, SOFTWARE MAINTENANCE AND SOFTWARE

TECHNICAL SUPPORT:

(1). Definitions.

1. Licensee. The term “licensee” shall mean the U.S. Department of Veterans Affairs (“VA”) and is synonymous with “Government.”

2. Licensor. The term “licensor” shall mean the Contractor having the necessary license or ownership rights to deliver license, software maintenance and support of the computer software being acquired. The term “Contractor” is the party identified in Block 17a on the SF1449. If the Contractor is a reseller and not the Licensor, the Contractor remains responsible for performance under this Contract/Order.

3. Software. The term “software” shall mean the licensed computer software product(s) cited in the Schedule of Supplies/Services.

4. Maintenance. The term “maintenance” is the process of enhancing and optimizing software, as well as remedying defects. It shall include all new fixes, patches, releases, updates, versions and upgrades, as further defined below.

5. Technical Support. The term “technical support” refers to the range of services providing assistance for the software via the telephone, email, a website or otherwise.

6. Release or Update. The term “release” or “update” are terms that refer to a revision of software that contains defect corrections, minor enhancements, or improvements of the software’s functionality. This is usually designated by a change in the number to the right of the decimal point (e.g., from Version 5.3 to 5.4). An example of an update is the addition of new hardware.

7. Version or Upgrade. The term “version” or “upgrade” are terms that refer to a revision of software that contains new or improved functionality. This is usually designated by a change in the number to the left of the decimal point (e.g., from Version 5.4 to 6).

(2). Software License.

1. Unless otherwise stated in the Schedule of Supplies/Services, the Performance Work Statement or Product Description, the software license provided to the Government is a perpetual, nonexclusive license to use the software.

2. The Government may use the software in a networked environment.

3. Any dispute regarding the license grant or usage limitations shall be resolved in accordance with the Disputes Clause incorporated in FAR 52.212-4(d).

4. All limitations of software usage are expressly stated in the Schedule of Supplies/Services and the Performance Work Statement/Product Description.

(3). Software Maintenance and/or Technical Support.

1. If the Government desires to continue software maintenance and support beyond the period of performance identified in this Contract/Order, the Government will issue a separate contract or order for maintenance and support. Conversely, if a contract or order for continuing software maintenance and technical support is not received, the Contractor is neither authorized nor permitted to renew any of the previously furnished services.

2. The Contractor shall provide software support services, which includes periodic updates, enhancements and corrections to the software, and reasonable technical support, all of which are customarily provided by the Contractor to its commercial customers to cause the software to perform according to its specifications, documentation or demonstrated claims.

3. Any telephone support provided by Contractor shall be at no additional cost.

4. The Contractor shall provide all maintenance services in a timely manner in accordance with the Contractor’s customary practice or as defined in the Performance Work Statement or Product Description. However, prolonged delay (exceeding two business days) in resolving software problems will be noted in the Government’s various past performance records on the Contractor (e.g., www.cpars.gov).

5. If the Government allows the maintenance and support to lapse and subsequently wishes to reinstate it, any reinstatement fee charged shall not exceed the amounts that would have been charged if the Government had not allowed the subscription to lapse.

(4). Disabling Software Code.

The Government requires delivery of computer software that does not contain any code that will, upon the occurrence or the nonoccurrence of any event, disable the software. Such code includes but is not limited to a computer virus, restrictive key, node lock, time-out, or other function, whether implemented by electronic, mechanical, or other means, which limits or hinders the use or access to any computer software based on residency on a specific hardware configuration, frequency of duration of use, or other limiting criteria. If any such disabling code is present, the Contractor agrees to indemnify the Government for all damages suffered as a result of a disabling caused by such code, and the contractor agrees to remove such code upon the Government’s request at no extra cost to the Government. Inability of the Contractor to remove the disabling software code will be considered an inexcusable delay and a material breach of contract, and the Government may exercise its right to terminate for cause. In addition, the Government is permitted to remove the code as it deems appropriate and charge the Contractor for consideration for the time and effort expended in removing the code.

(5). Manuals and Publications.

Upon Government request, the Contractor shall furnish the most current version of the user manual and publications for all products/services provided under this Contract/Order at no cost.

http://www.cpars.gov/

B4. PRICE SCHEDULE

All days referenced below shall be considered calendar days, unless otherwise noted. All items are Inspection/Acceptance/FOB Destination.

Inspection: Destination

Acceptance: Destination

Free on Board (FOB): Destination

Base Period The Period of Performance shall be 12 months from date of award

CLIN Description QTY/Unit of Issue

Unit Price Total Price

0001 Simplifier Enterprise Plus with SSO 1 $__________ $__________ 0002 Forge Seats 1 $__________ $__________ 0003 Projects 1 $__________ $__________ 0004 Simplified Maintenance 1 $__________ $__________

Total Base Period $__________ Option Period 1

This option may be exercised by the Government IAW Federal Acquisition Regulation (FAR) 52.217-9 Option to Extend the Term of Contract (MAR 2000). Work shall not commence until, and unless, a Formal modification is issued by the Contracting Officer. If exercised this option shall commence Immediately after expiration of the base period.

CLIN Description QTY/Unit of

Issue Unit Price Total Price

0001 Simplifier Enterprise Plus with SSO 1 $__________ $__________ 0002 Forge Seats 1 $__________ $__________ 0003 Projects 1 $__________ $__________ 0004 Simplified Maintenance 1 $__________ $__________

Total Option Period 1 $__________ Option Period 2

This option may be exercised by the Government IAW Federal Acquisition Regulation (FAR) 52.217-9 Option to Extend the Term of Contract (MAR 2000). Work shall not commence until, and unless, a Formal modification is issued by the Contracting Officer. If exercised this option shall commence Immediately after expiration of Option Period 1.

CLIN Description QTY/Unit of

Issue Unit Price Total Price

0001 Simplifier Enterprise Plus with SSO 1 $__________ $__________ 0002 Forge Seats 1 $__________ $__________ 0003 Projects 1 $__________ $__________ 0004 Simplified Maintenance 1 $__________ $__________

Total Option Period 2 $__________

Option Period 3

This option may be exercised by the Government IAW Federal Acquisition Regulation (FAR) 52.217-9 Option to Extend the Term of Contract (MAR 2000). Work shall not commence until, and unless, a Formal modification is issued by the Contracting Officer. If exercised this option shall commence Immediately after expiration of Option Period 2.

CLIN Description QTY/Unit of

Issue Unit Price Total Price

0001 Simplifier Enterprise Plus with SSO 1 $__________ $__________ 0002 Forge Seats 1 $__________ $__________ 0003 Projects 1 $__________ $__________ 0004 Simplified Maintenance 1 $__________ $__________

Total Option Period 3 $__________ Option Period 4

This option may be exercised by the Government IAW Federal Acquisition Regulation (FAR) 52.217-9 Option to Extend the Term of Contract (MAR 2000). Work shall not commence until, and unless, a Formal modification is issued by the Contracting Officer. If exercised this option shall commence Immediately after expiration of Option Period 3.

CLIN Description QTY/Unit of

Issue Unit Price Total Price

0001 Simplifier Enterprise Plus with SSO 1 $__________ $__________ 0002 Forge Seats 1 $__________ $__________ 0003 Projects 1 $__________ $__________ 0004 Simplified Maintenance 1 $__________ $__________

Total Option Period 4 $__________ Grand Total (including all options) $__________

B5. PRODUCT DESCRIPTION

DEPARTMENT OF VETERANS AFFAIRS

Digital Health Office

Office of Health Informatics (OHI)

Office of Clinical Informatics

Knowledge Based Systems (KBS)

Standards and Interoperability (S&I)

Firely Simplifier Tool

Date: February 10, 2026

VA-26-00034718

PD Version Number: 1.0

1.0 PRODUCT REQUIREMENTS

The contractor shall provide a Software-as-a-Service (SaaS) based Fast Healthcare Interoperability Resources (FHIR) specification development platform that provides integrated capabilities for collaborative authoring, standards conformance validation, version control, documentation generation, and publication of FHIR Implementation Guides (IGs) used by VA programs and external trading partners. Specifically, VA requires the SaaS tool to include the following capabilities: 1) Authoring and maintaining FHIR Application Program Interface (API) IGs and companion specifications; 2) Validation of FHIR artifacts against Health Level Seven (HL7) standards and profiles; 3) Integrated management of Structure Definitions, Value Sets, Code Systems, Capability Statements, test cases, and example resources; 4) Generation and publication of human-readable and machine-consumable specifications; 5) Enterprise collaboration, reuse, and lifecycle management of FHIR specifications. The Contractor shall provide SaaS subscription licenses for the Firely Simplifier platform, including associated maintenance, updates, and vendor-provided training. The products to be acquired include Simplifier Enterprise Plus with Single Sign-On (SSO), Forge Seats, Projects, and Simplifier Maintenance. The tool will be used by the VHA KBS S&I team, contractors, and VA programs to author, test, validate, manage, and publish HL7® FHIR® API IGs and companion specifications.

VA requires an integrated, web-based SaaS environment that enables collaborative FHIR standards development and ensures conformance with HL7 FHIR and related national interoperability standards. The required platform replaces the use of spreadsheets, text editors, and unsupported open-source tools, improving productivity and reducing rework and delays in standards development.

Simplifier Provides a graphical interface that enables the creation, validation, documentation, and publication of FHIR IGs in alignment with HL7 and related standards; relationship to forge, important clarification on data, and authoring workflow.

The period of performance includes one (1) 12-month base period with four (4) 12-month option periods.

1.1 Specific requirements

Specifically, VA requires the SaaS tool to include the following capabilities:

1) Authoring and maintaining FHIR API Implementation Guides and companion specifications;

2) Validation of FHIR artifacts against HL7 standards and profiles;

3) Integrated management of Structure Definitions, Value Sets, Code Systems, Capability Statements, test cases, and example resources;

4) Generation and publication of human-readable and machine-consumable specifications;

5) Enterprise collaboration, reuse, and lifecycle management of FHIR specifications.

2.0 NOTICE OF THE FEDERAL ACCESSIBILITY LAW AFFECTING

ALL INFORMATION AND COMMUNICATION TECHNOLOGY (ICT)

PROCUREMENTS (SECTION 508)

On January 18, 2017, the Access Board issued a final rule that updated accessibility requirements covered by Section 508 and refreshed guidelines for telecommunications equipment subject to Section 255 of the Communications Act. The final rule went into effect on January 18, 2018. The revisions and updates to the Section 508-based standards and Section 255-based guidelines are intended to ensure that information and communication technology (ICT) covered by the respective statutes is accessible to and usable by individuals with disabilities.

2.1 SECTION 508 – INFORMATION AND COMMUNICATION

TECHNOLOGY (ICT) STANDARDS

The Section 508 standards established by the Access Board are incorporated into, and made part of all VA orders, solicitations and purchase orders developed to procure ICT. These standards are found in their entirety at: Revised 508 Standards and 255 Guidelines (access-board.gov). A single PDF file version of the Revised Section 508 Standards and 255 Guidelines will be supplied upon request, or can be obtained from the Access Board website. Federal agencies must comply with the Rehabilitation Act of 1973, as amended.

The Contractor shall comply with “508 Chapter 2: Scoping Requirements” for all electronic ICT and content delivered under this contract. Specifically, as appropriate for the technology and its functionality, the Contractor shall comply with the technical standards marked here:

https://www.access-board.gov/ict/ https://www.access-board.gov/ict/

☒ E205 Electronic Content – (Accessibility Standard -WCAG 2.0 Level A and AA Guidelines)

☒ E204 Functional Performance Criteria ☒ E206 Hardware Requirements ☒ E207 Software Requirements ☒ E208 Support Documentation and Services Requirements

2.2 COMPATABILITY WITH ASSISTIVE TECHNOLOGY

The standards do not require installation of specific accessibility-related software or attachment of an assistive technology device. Section 508 requires that ICT be compatible with such software and devices so that ICT can be accessible to and usable by individuals using assistive technology, including but not limited to screen readers, screen magnifiers, and speech recognition software.

2.3 ACCEPTANCE AND ACCEPTANCE TESTING

Deliverables resulting from this solicitation will be accepted based in part on satisfaction of the Section 508 Chapter 2: Scoping Requirements standards identified above.

The Government reserves the right to test for Section 508 Compliance before delivery. The Contractor shall be able to demonstrate Section 508 Compliance upon delivery.

3.0 INFORMATION TECHNOLOGY USING SUSTAINABLE

PRODUCTS AND SERVICES

Not Applicable – Simplifier is a cloud-based Software-as-a-Service (SaaS) platform. No physical hardware or equipment is delivered under this contract, therefore sustainable product certifications (e.g., EPEAT, Energy Star, FEMP) do not apply.

4.0 SHIPMENT OF HARDWARE OR EQUIPMENT

Not Applicable – Simplifier is a cloud-based Software-as-a-Service (SaaS) platform. No physical hardware or equipment is delivered under this contract, therefore sustainable product certifications (e.g., EPEAT, Energy Star, FEMP) do not apply.

4.1 SPECIAL SHIPPING INSTRUCTIONS

Not Applicable – Simplifier is a fully cloud-hosted Software-as-a-Service (SaaS) platform. No hardware or physical equipment will be shipped, installed, or maintained under this contract.

4.2 NATIONAL ACQUISITIONS

Not applicable

5.0 GENERAL REQUIREMENTS

5.1 VA TECHNICAL REFERENCE MODEL

The Contractor shall comply with the VA OIT Technical Reference Model (VA TRM).

Compliance with the VA TRM is achieved by using only technologies and standards that are listed as approved for use in the VA TRM. The Contractor shall provide all necessary information requested by VA to ensure TRM approval is obtained prior to use on VA’s network.

5.2 ZERO TRUST – VA CRITICAL SECURITY CONTROLS

VA has established minimum mandatory security requirements and requires that any network connected software system or service must meet the VA Critical Security Controls as outlined in the VA Memorandum, “VA Security Controls”, https://www.voa.va.gov/DocumentView.aspx?DocumentID=5010. VA Critical Security Controls identify the minimum mandatory requirements that must be implemented across all VA enterprise infrastructure, cloud computing environments, information systems, networks, and specialized devices (medical devices/systems, special-purpose systems, and research scientific computing devices) that process, store, and/or transmit VA data. Effective July 1, 2025, the Contractor shall implement these VA Critical Security Controls, within any network connected software system or service prior to being authorized for use in the VA. This functional requirement is not negotiable, and Plan of Action & Milestones (POAM) will not be accepted in the event these controls cannot be implemented for new systems. Critical Security Controls are intended to increase VA’s security posture and provide security and privacy risk visibility into the VA network and is not a new requirement. The Contractor’s failure to maintain these VA Critical Controls after implementation will result in VA discontinuing the use of the system.

5.3 SOCIAL SECURITY NUMBER (SSN) REDUCTION

The Contractor solution shall support the Social Security Number (SSN) Fraud Prevention Act (FPA) of 2017 which prohibits the inclusion of SSNs on any document sent by mail. The Contractor support shall also be performed in accordance with Section 240 of the Consolidated Appropriations Act (CAA) 2018, enacted March 23, 2018, which mandates VA to discontinue using SSNs to identify individuals in all VA information systems as the Primary Identifier. The Contractor shall ensure that any new IT solution discontinues the use of SSN as the Primary Identifier to replace the SSN with the Integrated Control Number (ICN) in all VA information systems for all individuals. The Contractor shall ensure that all Contractor delivered applications and systems integrate with the VA Master Person Index (MPI) for identity traits to include the use of the ICN as the Primary Identifier. The Contractor solution may only use a Social Security Number to identify an individual in an information system if and only if the use of such number is required to obtain information VA requires from an information system that is not under the jurisdiction of VA.

5.4 INTERNET PROTOCOL VERSION 6 (IPV6)

The Contractor solution shall support IPv6-Only based upon the memo issued by the Office of Management and Budget (OMB) on November 19, 2020 (https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-07.pdf). Which defines IPv6-only as the state of an operational system or service when IPv4 protocol functions (addressing, packet forwarding) are not in use.

https://www.voa.va.gov/DocumentView.aspx?DocumentID=5010 https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-07.pdf https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-07.pdf

The NIST USGv6 profile defines technical requirements for a product to be capable of operating in IPv6-Only environments. IPv6-Only technology, in accordance with the USGv6 Program (https://www.nist.gov/programs-projects/usgv6-program/usgv6-revision-1), NIST Special Publication (SP) 500-267B Revision 1 “USGv6 Profile” (https://doi.org/10.6028/NIST.SP.500- 267Br1), and NIST SP 800-119 “Guidelines for the Secure Deployment of IPv6” (https://doi.org/10.6028/NIST.SP.800-119), compliance shall be included in all IT infrastructures, application designs, application development, operational systems and sub-systems, and their integration. In addition to the above requirements, all devices, applications, and systems shall support all applicable functionality on native IPv6-Only as well as dual stack (IPv6 / IPv4) connectivity without additional memory or other resources being provided by the Government, so that they can function in a mixed environment. All public/external facing servers and services (e.g., web, email, DNS, ISP services, etc.) shall support native IPv6-Only and dual stack (IPv6 / IPv4) users and all internal infrastructure and applications shall support using native IPv6-Only and dual stack (IPv6 / IPv4) for all functionality and operations.

5.5 SOFTWARE AND LICENSING REQUIREMENTS

Not applicable.

5.6 TRUSTED INTERNET CONNECTION (TIC)

The Contractor solution shall meet the requirements outlined in Office of Management and Budget Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative“ (https://www.whitehouse.gov/wp-content/uploads/2019/09/M-19-26.pdf), VA Directive 6513 “Secure External Connections”, and shall comply with the TIC 3.0 Core Guidance Documents, including all Volumes and TIC Use Cases, found at the Cybersecurity & Infrastructure Security Agency (CISA) (https://www.cisa.gov/publication/tic-30-core-guidance-documents.)

5.7 POSITION/TASK RISK DESIGNATION LEVEL(S)

In accordance with VA Handbook 0710, Personnel Security and Suitability Program, the position sensitivity and the level of background investigation commensurate with the required level of access for the following tasks within the PWS are:

Position Sensitivity and Background Investigation Requirements by Service Task/Item Number

Service Task / Item Number

Tier1 / Low Risk Tier 2 / Moderate Risk

Tier 4 / High Risk

1.0-1.1 ☒ ☐ ☐

The Tasks identified above and the resulting Position Sensitivity and Background Investigation requirements identify, in effect, the Background Investigation requirements for Contractor individuals, based upon the tasks the particular Contractor individual will be working. The submitted Contractor Staff Roster must indicate the required Background Investigation Level for each Contractor individual based upon the tasks the Contractor individual will be working, in accordance with their submitted proposal.

https://www.nist.gov/programs-projects/usgv6-program/usgv6-revision-1 https://doi.org/10.6028/NIST.SP.500-267Br1 https://doi.org/10.6028/NIST.SP.500-267Br1 https://doi.org/10.6028/NIST.SP.800-119 https://www.whitehouse.gov/wp-content/uploads/2019/09/M-19-26.pdf https://www.cisa.gov/publication/tic-30-core-guidance-documents

SECTION C - CONTRACT CLAUSES

C.1 52.252-2 CLAUSES INCORPORATED BY REFERENCE (FEB 1998)

This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. Also, the full text of a clause may be accessed electronically at this/these address(es):

https://www.acquisition.gov/browse/index/far https://www.va.gov/oal/library/vaar/

(End of Clause)

FAR

Number

Title Date

52.203-16 52.203-17 52.203-19

52.204-7 52.204-10

52.204-13

52.204-14 52.204-19

52.209-10

52.212-4

52.219.28 52.227-1 52.227-2 52.232-33 52.232040

PREVENTING PERSONAL CONFLICTS OF INTEREST

CONTRACTOR EMPLOYEE WHISTILEBLOWER RIGHTS

PROHIBITION ON REQUIRING CERTAIN INTERNAL

CONFIDENTIALITY AGREEMENTS OR STATEMENTS

SYSTEM OF AWARD MANAGEMENT

REPORTING EXECUTIVE COMPENSATION AND FIRST-

TIER SUBCONTRACT AWARDS

SYSTEM FOR AWARD MANAGEMENT—MAINTENANCE

(DEVIATION)

SERVICE CONTRACT REPORTING REQUIREMENTS

INCORPORATION BY REFERENCE OF

REPRESENTATIONS AND CERTIFICATIONS

PROHIBITION ON CONTRACTING WITH INVERTED

DOMESTIC CORPORATIONS

CONTRACT TERMS AND CONDITIONS-COMMERCIAL

PRODUCTS AND COMMERCIAL SERVICES

POST AWARD SMALL BUSINESS PROGRAM

REREPRESENATION

AUTHORIZATION AND CONSENT

PATENT AND COPY RIGHT INFRINGEMENT

PAYMENT BY EFT – SYSTEM OF AWARD MANAGEMENT

ACCELERATED PAYMENTS TO SMALL BUSINESS

JUN 2020

NOV 2023

JAN 2017

NOV 2024

JUN 2020

OCT 2025

OCT 2016

DEC 2014

NOV 2015

NOV 2023

JAN 2025

JUN 2020

JUN 2020

OCT 2018

MAR 2023

852.201-70 CONTRACTING OFFICER’S REPRESENTATIVE DEC 2022

852.203-70 COMMERCIAL ADVERTISING MAY 2018

852.222-71

852.232.72

COMPLIANCE WITH EXECUTIVE ORDER 13899

(DEVIATION) (APR 2025)

ELECTRONIC SUBMISSION OF PAYMENT REQUEST

APR 2025

NOV2018

852.239-70

852.239.71

852.239-72

SECURITY REQUIREMENTS FOR INFORMATION

TECHNOLOGY RESOURCES

INFORMATION SYSTEM SECURITY PLAN AND

ACCREDITATION

INFORMATION SYSTEM DESIGN AND DEVELOPMENT

FEB 2023

FEB 2023

FEB 2023

852.239-73 INFORMATION SYSTEM HOSTING, OPERATION,

MAINTENANCE, OR USE

FEB 2023

852.239-74 SECURITY CONTROLS COMPLIANCE TESTING FEB 2023

C.2 52.217-9 OPTION TO EXTEND THE TERM OF THE CONTRACT (MAR

2000)

(a) The Government may extend the term of this contract by written notice to the Contractor within the period of performance; provided that the Government gives the Contractor a preliminary written notice of its intent to extend at least 30 days before the contract expires. The preliminary notice does not commit the Government to an extension.

(b) If the Government exercises this option, the extended contract shall be considered to include this option clause.

© The total duration of this contract, including the exercise of any options under this clause, shall not exceed 60 Months.

(End of Clause)

C.3 52.226-3 ENCOURAGING CONTRACTOR POLICIES TO BAN TEXT

MESSAGING WHILE DRIVING (MAY 2024)

(a) Definitions. As used in this clause-

"Driving"–

(1) Means operating a motor vehicle on an active roadway with the motor running, including while temporarily stationary because of traffic, a traffic light, stop sign, or otherwise.

(2) Does not include operating a motor vehicle with or without the motor running when one has pulled over to the side of, or off, an active roadway and has halted in a location where one can safely remain stationary.

Text messaging means reading from or entering data into any handheld or other electronic device, including for the purpose of short message service texting, e-mailing, instant messaging, obtaining navigational information, or engaging in any other form of electronic data retrieval or electronic data communication. The term does not include glancing at or listening to a navigational device that is secured in a commercially designed holder affixed to the vehicle, provided that the destination and route are programmed into the device either before driving or while stopped in a location off the roadway where it is safe and legal to park.

(b) This clause implements Executive Order 13513, Federal Leadership on Reducing Text Messaging While Driving, dated October 1, 2009.

(c) The Contractor is encouraged to-

(1) Adopt and enforce policies that ban text messaging while driving-

(i) Company-owned or rented vehicles or Government-owned vehicles; or

(ii) Privately-owned vehicles when on official Government business or when performing any work for or on behalf of the Government.

(2) Conduct initiatives in a manner commensurate with the size of the business, such as-

(i) Establishment of new rules and programs or reevaluation of existing programs to prohibit text messaging while driving; and

(ii) Education, awareness, and other outreach to employees about the safety risks associated with texting while driving.

(d) Subcontracts. The Contractor shall insert the substance of this clause, including this paragraph (d), in all subcontracts that exceed the micro-purchase threshold, as defined in Federal Acquisition Regulation 2.101 on the date of subcontract award.

(End of clause)

C.4 52.229-12 Tax on Certain Foreign Procurements—Notice and Representation (Feb 2021)(a) Definitions. As used in this clause—

Foreign person means any person other than a United States person.

United States person, as defined in 26 U.S.C. 7701(a)(30), means–

(1) A citizen or resident of the United States;

(2) A domestic partnership;

(3) A domestic corporation;

(4) Any estate (other than a foreign estate, within the meaning of 26 U.S.C. 7701(a)(31)); and

(5) Any trust if-

(i) A court within the United States is able to exercise primary supervision over the administration of the trust; and

(ii) One or more United States persons have the authority to control all substantial decisions of the trust.

(b) This clause applies only to foreign persons. It implements 26 U.S.C. 5000C and its implementing regulations at 26 CFR 1.5000C-1 through 1.5000C-7.

(c)

(1) If the Contractor is a foreign person and has only a partial or no exemption to the withholding, the Contractor shall include the Department of the Treasury Internal Revenue Service Form W-14, Certificate of Foreign Contracting Party Receiving Federal Procurement Payments, with each voucher or invoice submitted under this contract throughout the period in which this status is applicable. The excise tax withholding is applied at the payment level, not at the contract level. The Contractor should revise each IRS Form W-14 submission to reflect the exemption (if any) that applies to that particular invoice, such as a different exemption applying. In the absence of a completed IRS Form W-14 accompanying a payment request, the default withholding percentage is 2 percent for the section 5000C https://www.acquisition.gov/far/2.101#FAR_2_101 https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title26-section7701&num=0&edition=prelim https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title26-section7701&num=0&edition=prelim https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title26-section5000C&num=0&edition=prelim withholding for that payment request. Information about IRS Form W-14 and its separate instructions is available via the internet at www.irs.gov/w14.

(2) If the Contractor is a foreign person and has indicated in its offer in the provision 52.229-11, Tax on Certain Foreign Procurements—Notice and Representation, that it is fully exempt from the withholding, and certified the full exemption on the IRS Form W-14, and if that full exemption no longer applies due to a change in circumstances during the performance of the contract that causes the Contractor to become subject to the withholding for the 2 percent excise tax then the Contractor shall–

(i) Notify the Contracting Officer within 30 days of a change in circumstances that causes the Contractor to be subject to the excise tax withholding under 26 U.S.C. 5000C; and

(ii) Comply with paragraph (c)(1) of this clause.

(d) The Government will withhold a full 2 percent of each payment unless the Contractor claims an exemption. If the Contractor enters a ratio in Line 12 of the IRS Form W- 14, the result of Line 11 divided by Line 10, the Government will withhold from each payment an amount equal to 2 percent multiplied by the contract ratio. If the Contractor marks box 9 of the IRS Form W-14 (rather than completes Lines 10 through 12), the Contractor must identify and enter the specific exempt and nonexempt amounts in Line 15 of the IRS Form W-14; the Government will then withhold 2 percent only from the nonexempt amount. See the IRS Form W-14 and its instructions.

(e) Exemptions from the withholding under this clause are described at 26 CFR 1.5000C-1(d)(5) through (7). Any exemption claimed and self-certified on the IRS Form W-14 is subject to audit by the IRS. Any disputes regarding the imposition and collection of the 26 U.S.C. 5000C tax are adjudicated by the IRS as the 26 U.S.C. 5000C tax is a tax matter, not a contract issue.

(f) Taxes imposed under 26 U.S.C. 5000C may not be—

(1) Included in the contract price; nor

(2) Reimbursed.

(g) A taxpayer may, for a fee, seek advice from the Internal Revenue Service (IRS) as to the proper tax treatment of a transaction. This is called a private letter ruling. Also, the IRS may publish a revenue ruling, which is an official interpretation by the IRS of the Internal Revenue Code, related statutes, tax treaties, and regulations. A revenue ruling is the conclusion of the IRS on how the law is applied to a specific set of facts. For questions relating to the interpretation of the IRS regulations go to https://www.irs.gov/help/tax-law-questions.

(End of clause) https://www.irs.gov/w14 https://www.acquisition.gov/far/52.229-11#FAR_52_229_11 https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title26-section5000C&num=0&edition=prelim https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title26-section5000C&num=0&edition=prelim https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title26-section5000C&num=0&edition=prelim https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title26-section5000C&num=0&edition=prelim https://www.irs.gov/help/tax-law-questions

C.4 52.240-91 SECURITY PROHIBITIONS AND EXCLUSIONS (NOV 2025)

(DEVIATION)

(a) Definitions. As used in this clause—

American Security Drone Act-covered foreign entity means an entity included on a list that the Federal Acquisition Security Council (FASC) develops and maintains and publishes in the System for Award Management (SAM) at https://www.sam.gov (section 1822 of Pub. L. 118-31, 41 U.S.C. 3901 note prec.).

Backhaul means intermediate links between the core network, or backbone network, and the small subnetworks at the edge of the network (e.g., connecting cell phones/towers to the core telephone network). Backhaul can be wireless (e.g., microwave) or wired (e.g., fiber optic, coaxial cable, Ethernet).

Covered application means the social networking service TikTok or any successor application or service developed or provided by ByteDance Limited or an entity owned by ByteDance Limited.

Covered article, as defined in 41 U.S.C. 4713(k), means:

(1) Information technology, as defined in 40 U.S.C. 11101, including cloud computing services of all types;

(2) Telecommunications equipment or telecommunications service, as those terms are defined in section 3 of the Communications Act of 1934 (47 U.S.C. 153);

(3) The processing of information on a Federal or non-Federal information system, subject to the requirements of the Controlled Unclassified Information program (see 32 CFR part 2002); or

(4) Hardware, systems, devices, software, or services that include embedded or incidental information technology.

Covered foreign country means The People’s Republic of China.

Covered telecommunications equipment or services means—

(1) Telecommunications equipment produced by Huawei Technologies Company or ZTE Corporation (or any subsidiary or affiliate of such entities);

(2) For the purpose of public safety, security of Government facilities, physical security surveillance of critical infrastructure, and other national security purposes, video surveillance and telecommunications equipment produced by Hytera Communications Corporation, Hangzhou Hikvision Digital Technology Company, or Dahua Technology Company (or any subsidiary or affiliate of such entities);

(3) Telecommunications or video surveillance services provided by such entities or using such equipment; or

(4) Telecommunications or video surveillance equipment or services produced or provided by an entity that the Secretary of Defense, in consultation with the Director of National Intelligence https://www.sam.gov or the Director of the Federal Bureau of Investigation, reasonably believes to be an entity owned or controlled by, or otherwise connected to, the government of a covered foreign country.

Critical technology means—

(1) Defense articles or defense services included on the United States Munitions List set forth in the International Traffic in Arms Regulations under subchapter M of chapter I of title 22, Code of Federal Regulations;

(2) Items included on the Commerce Control List set forth in Supplement No. 1 to part 774 of the Export Administration Regulations under subchapter C of chapter VII of title 15, Code of Federal Regulations, and controlled—

(i) Pursuant to multilateral regimes, including for reasons relating to national security, chemical and biological weapons proliferation, nuclear nonproliferation, or missile technology; or

(ii) For reasons relating to regional stability or surreptitious listening;

(3) Specially designed and prepared nuclear equipment, parts and components, materials, software, and technology covered by part 810 of title 10, Code of Federal Regulations (relating to assistance to foreign atomic energy activities);

(4) Nuclear facilities, equipment, and material covered by part 110 of title 10, Code of Federal Regulations (relating to export and import of nuclear equipment and material);

(5) Select agents and toxins covered by part 331 of title 7, Code of Federal Regulations, part 121 of title 9 of such Code, or part 73 of title 42 of such Code; or

(6) Emerging and foundational technologies controlled pursuant to section 1758 of the Export Control Reform Act of 2018 (50 U.S.C. 4817).

FASC-prohibited unmanned aircraft system means an unmanned aircraft system manufactured or assembled by an American Security Drone Act—covered foreign entity.

FASCSA order means any of the following orders issued under the Federal Acquisition Supply Chain Security Act (FASCSA) requiring removing covered articles from executive agency information systems or excluding one or more named sources or named covered articles from executive agency procurement actions, as described in 41 CFR 201-1.303(d) and (e):

(1) The Secretary of Homeland Security may issue FASCSA orders that apply to civilian agencies, to the extent not covered by paragraph (2) or (3) of this definition. This type of FASCSA order may be referred to as a Department of Homeland Security (DHS) FASCSA order.

(2) The Secretary of Defense may issue FASCSA orders that apply to the Department of Defense (DoD) and national security systems other than sensitive compartmented information systems. This type of FASCSA order may be referred to as a DoD FASCSA order.

(3) The Director of National Intelligence (DNI) may issue FASCSA orders that apply to the intelligence community and sensitive compartmented information systems, to the extent not covered by paragraph (2) of this definition. This type of FASCSA order may be referred to as a DNI FASCSA order.

Information technology, as defined in 40 U.S.C. 11101(6)—

(1) Means any equipment or interconnected system or subsystem of equipment, used in the automatic acquisition, storage, analysis, evaluation, manipulation, management, movement, control, display, switching, interchange, transmission, or reception of data or information by the executive agency, if the equipment is used by the executive agency directly or is used by a contractor under a contract with the executive agency that requires the use—

(i) Of that equipment; or

(ii) Of that equipment to a significant extent in the performance of a service or the furnishing of a product;

(2) Includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources; but

(3) Does not include any equipment acquired by a Federal contractor incidental to a Federal contract.

Intelligence community, as defined by 50 U.S.C. 3003(4), means the following—

(1) The Office of the Director of National Intelligence;

(2) The Central Intelligence Agency;

(3) The National Security Agency;

(4) The Defense Intelligence Agency;

(5) The National Geospatial-Intelligence Agency;

(6) The National Reconnaissance Office;

(7) Other offices within the Department of Defense for the collection of specialized national intelligence through reconnaissance programs;

(8) The intelligence elements of the Army, the Navy, the Air Force, the Marine Corps, the Coast Guard, the Federal Bureau of Investigation, the Drug Enforcement Administration, and the Department of Energy;

(9) The Bureau of Intelligence and Research of the Department of State;

(10) The Office of Intelligence and Analysis of the Department of the Treasury;

(11) The Office of Intelligence and Analysis of the Department of Homeland Security; or

(12) Such other elements of any department or agency as may be designated by the President, or designated jointly by the Director of National Intelligence and the head of the department or agency concerned, as an element of the intelligence community.

Interconnection arrangement means arrangements governing the physical connection of two or more networks to allow the use of another’s network to hand off traffic where it is ultimately delivered (e.g., connecting a customer of telephone provider A to a customer of telephone company B) or sharing data and other information resources.

Kaspersky Lab-covered article means any hardware, software, or service that—

(1) Is developed or provided by a Kaspersky Lab-covered entity;

(2) Includes any hardware, software, or service developed or provided in whole or in part by a Kaspersky Lab-covered entity; or

(3) Contains components using any hardware or software developed in whole or in part by a Kaspersky Lab-covered entity.

Kaspersky Lab-covered entity means—

(1) Kaspersky Lab;

(2) Any successor entity to Kaspersky Lab, including any change in name, e.g., “Kaspersky”;

(3) Any entity that controls, is controlled by, or is under common control with Kaspersky Lab;

or

(4) Any entity of which Kaspersky Lab has a majority ownership.

National security system, as defined in 44 U.S.C. 3552, means any information system (including any telecommunications system) used or operated by an agency or by a contractor of an agency, or other organization on behalf of an agency—

(1) The function, operation, or use of which involves intelligence activities; involves cryptologic activities related to national security; involves command and control of military forces; involves equipment that is an integral part of a weapon or weapons system; or is critical to the direct fulfillment of military or intelligence missions, but does not include a system that is to be used for routine administrative and business applications (including payroll, finance, logistics, and personnel management applications); or

(2)…