36C10D26Q0031.docx

36C10D26Q0031

PAGE 1 OF

1. REQUISITION NO.

2. CONTRACT NO.

3. AWARD/EFFECTIVE DATE

4. ORDER NO.

5. SOLICITATION NUMBER

6. SOLICITATION ISSUE DATE

a. NAME

b. TELEPHONE NO. (No Collect Calls)

8. OFFER DUE DATE/LOCAL

TIME

9. ISSUED BY

CODE

10. THIS ACQUISITION IS

UNRESTRICTED OR

SET ASIDE:

% FOR:

SMALL BUSINESS

HUBZONE SMALL

BUSINESS

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

WOMEN-OWNED SMALL BUSINESS

(WOSB) ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

EDWOSB

8(A)

NAICS:

SIZE STANDARD:

11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

SEE SCHEDULE

12. DISCOUNT TERMS

13a. THIS CONTRACT IS A

RATED ORDER UNDER

DPAS (15 CFR 700)

13b. RATING

14. METHOD OF SOLICITATION

RFQ

IFB

RFP

15. DELIVER TO

CODE

16. ADMINISTERED BY

CODE

17a. CONTRACTOR/OFFEROR

CODE

FACILITY CODE

18a. PAYMENT WILL BE MADE BY

CODE

TELEPHONE NO.

UEI:

EFT:

PHONE:

FAX:

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN OFFER 18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK BELOW IS CHECKED

SEE ADDENDUM

19.

20.

21.

22.

23.

24.

ITEM NO.

SCHEDULE OF SUPPLIES/SERVICES

QUANTITY

UNIT

UNIT PRICE

AMOUNT

(Use Reverse and/or Attach Additional Sheets as Necessary)

25. ACCOUNTING AND APPROPRIATION DATA

26. TOTAL AWARD AMOUNT (For Govt. Use Only) 27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1, 52.212-4. FAR 52.212-3 AND 52.212-5 ARE ATTACHED. ADDENDA

ARE

ARE NOT ATTACHED.

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA

ARE

ARE NOT ATTACHED

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN _______________

29. AWARD OF CONTRACT: REF. ___________________________________ OFFER

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND

DATED ________________________________. YOUR OFFER ON SOLICITATION

DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY

(BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE

ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED

SET FORTH HEREIN IS ACCEPTED AS TO ITEMS:

30a. SIGNATURE OF OFFEROR/CONTRACTOR 31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER) 30b. NAME AND TITLE OF SIGNER (TYPE OR PRINT) 30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER (TYPE OR PRINT) 31c. DATE SIGNED

AUTHORIZED FOR LOCAL REPRODUCTION

(REV. NOV 2021)

PREVIOUS EDITION IS NOT USABLE

Prescribed by GSA - FAR (48 CFR) 53.212

7. FOR SOLICITATION

INFORMATION CALL:

STANDARD FORM 1449

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL PRODUCTS AND COMMERCIAL SERVICES

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 30

VA

36C10D26Q0031 02-18-2026 H. David Carter 407-497-6108 03-03-2026 14:00

EST

00101 Department of Veterans Affairs Veterans Benefits Administration Acquisition Directorate 1800 G Street NW Washington

DC

20006 X X Y 561611 $25 Million N/A X 00101 Department of Veterans Affairs Veterans Benefits Administration Philadelphia Insurance Services 5000 Wissahickon Ave.

Philadelphia

PA

19144 00101 Department of Veterans Affairs Veterans Benefits Administration Acquisition Directorate 1800 G Street NW Washington

DC

20006

TBD

TBD

TBD

All invoices must be e-mailed to:

http://tungsten-network.com/veterans-affairs-us/

See CONTINUATION Page The contractor shall provide services defined in the Performance Work Statement (PWS) for Beneficiary Locator Services contained herein.

See Price/Cost Schedule for applicable period of performance quantities and pricing.

Invoicing: ALL invoices must be emailed to http://tungsten-network.com/veterans-affairs-us/ See CONTINUATION Page Include Obligation Number: 36C10D26XTBDX on ALL invoices.

X X X Harrison Carter

VA-VBA-2024-0005

Table of Contents

SECTION B - CONTINUATION OF SF 1449 BLOCKS

B.1 CONTRACT ADMINISTRATION DATA

1. Contract Administration: All contract administration matters will be handled by the following individuals:

a. CONTRACTOR: TBD

TBD

TBD

TBD

b. GOVERNMENT: Contracting Officer 36C10D Department of Veterans Affairs Veterans Benefits Administration Acquisition Directorate 1800 G Street NW Washington DC 20006

2. CONTRACTOR REMITTANCE ADDRESS: All payments by the Government to the contractor will be made in accordance with:

3. INVOICES: Invoices shall be submitted in arrears:

4. GOVERNMENT INVOICE ADDRESS: All Invoices from the contractor shall be submitted electronically in accordance with VAAR Clause 852.232-72 Electronic Submission of Payment Requests.

ACKNOWLEDGMENT OF AMENDMENTS: The offeror acknowledges receipt of amendments to the Solicitation numbered and dated as follows:

36C10D26Q0031

Page 1 of Page 1 of Performance Work Statement

Beneficiary Locator Services

For

Veteran Administration – Insurance Service and Operations Center

(VA INS)

BACKGROUND

VA Insurance Service and Operations Center (INS) offers valuable insurance benefits that provide Veterans with peace of mind and financial security for their beneficiaries. VA INS is responsible for the administration of seven government life insurance programs, which provide $1.5T in total coverage to 5.5 million Veterans, Service members, and their families.

In accordance with the Faster Payment to Veteran’s Survivors Act of 2022 (Public Law No. 117-313), VA INS requires locator and outreach services to assist with locating difficult to find beneficiaries and establishing contact with beneficiaries to facilitate the completion of claims. These services shall include obtaining current contact information for named beneficiaries, conducting research to identify possible alternate beneficiaries, obtaining current contact information for alternate beneficiaries, and conducting outreach to beneficiaries to provide information to facilitate completing claims.

The locator and outreach services will allow VA INS employees to efficiently and effectively disburse payments to beneficiaries who are entitled to VA Insurance proceeds faster and improve the accuracy and timeliness of claims processing.

As of September 18, 2025, VA INS has the following inventory of claims that may require locator and outreach services:

Timeframe Since Veteran’s Date of Death Inventory

APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. Faster Payment to Veteran’s Survivors Act of 2022 (Public Law No. 117-313)

2. 44 U.S.C. § 3551, “Federal Information Security Management Act (FISMA) as amended”

3. Federal Information Processing Standards (FIPS) Publication 140-3, “Cryptographic Module Validation Program Management Manual” Oct 16, 2025, ver. 2.6

4. FIPS Pub 201-3, “Personal Identity Verification (PIV) of Federal Employees and Contractors,” Jan 24, 2022

5. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

6. Department of Veterans Affairs (VA) Directive 0710, “Personnel Security Program,” Sep 8, 2025

7. VA Directive 6102 “Internet and Intranet Services,” Aug 5, 2019, VA Web Governance (https://digital.va.gov/web-governance/)

8. U.S. Access Board, “ICT Accessibility 508 Standards and 255 Guidelines,” January 18, 2017

9. OMB Circular A-130, “Managing Information as a Strategic Resource,” July 28, 2016; National Institute of Standards and Technology (NIST) (https://www.nist.gov) and Federal Information Security Modernization Act (FISMA Reform) December 18,2014. PL 113-283, 128 Stat. 3075 (https://www.congress.gov/113/plaws/publ283/PLAW-113publ283.pdf)

10. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended by the Workforce Investment Act of 1998 (P.L. 105-220), August 7, 1998

11. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004 and FIPS 201-3 Personal Identity Verification (PIV) of Federal Employees and Contractors (https://csrc.nist.gov/publications/detail/fips/201/3/final)

12. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021

13. Project Management Accountability System (PMAS) portal (reference PWS References -Technical Library at https://www.voa.va.gov/)

14. OIT ProPath Process Methodology (reference PWS References -Technical Library and ProPath Library links at https://www.voa.va.gov/) NOTE: In the event of a conflict, OIT ProPath takes precedence over other processes or methodologies.

15. Technical Reference Model (TRM) (reference at http://trm.oit.va.gov/TRMHomePage.asp

16. National Institute Standards and Technology (NIST) Special Publications, Cryptographic Module Validation Program (CMVP)

17. VA Directive 6300, Records and Information Management, September 21, 2018 (https://www.va.gov/vapubs/Search_action.cfm)

18. VA Handbook, 6300.1, Records Management Procedures, March 24, 2010 (https://www.va.gov/vapubs/Search_action.cfm) In addition, the Government intends to include the following FAR clauses in the solicitation/contract. Contractor performance under this PWS shall comply with these clauses:

• FAR 52.204-21 (Basic Safeguarding of Covered Contractor Information Systems)

• FAR 52.239-1 (Privacy or Security Safeguards)

• FAR 52.224-1 and 52.224-2 (Privacy Act) – applicable if the Contractor will operate a system of records or handle Privacy Act records on behalf of VA

• FAR 52.204-24 (representation), FAR 52.204-25 (Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment), and FAR 52.204-27 (Prohibition on a ByteDance Covered Application)

• FAR 52.217-9 (Option to Extend the Term of the Contract) and, if applicable,

• FAR 52.217-8 (Option to Extend Services)

• FAR 52.224-1 (Privacy Act Notification)

• FAR 52.224-2 (Privacy Act)

• FAR 52.227-14 (Rights in Data—General), if data rights need clarification for deliverables

These clauses are binding contract requirements; the activities, safeguards, and deliverables specified in this PWS are to be performed in a manner consistent with, and compliant to, these provisions.

SCOPE OF WORK

The Contractor shall provide all resources necessary to accomplish the deliverables as described in this performance work statement (PWS), except as may be otherwise specified. The purpose of this solicitation is to provide beneficiary locator and outreach services for VA INS’s oldest pending death claims, difficult to find beneficiaries, and/or liability accounts.

PERFORMANCE DETAILS

PERFORMANCE PERIOD

The period of performance is one 6-month base period followed by four 12-month option periods. During the base period, VA INS will provide the Contractor with a minimum of 1000 cases including cases selected from each tier as described below in Table 1. VA INS will evaluate the effectiveness of the contractor’s locator and outreach services during the base period to determine if option period will be renewed and to estimate volumes of cases from each tier to be referred for locator and outreach services in subsequent option periods. Success criteria is defined in section 5.2.6.

Any work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO).

PLACE OF PERFORMANCE

Tasks under this PWS shall be performed off site at the contractor’s location(s).

TRAVEL

The Government does not anticipate travel to perform the tasks associated with the effort, or to attend program-related meetings or conferences throughout the period of performance (PoP). These costs will not be directly reimbursed by the Government.

SPECIFIC TASKS AND DELIVERABLES

The Contractor shall perform the following:

PROJECT MANAGEMENT

CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, timeline and tools to be used in execution of the contract. The CPMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks and resource support. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPMP shall be concurred upon and updated monthly thereafter. The Contractor shall update and maintain the VA PM approved CPMP throughout the period of performance.

Deliverable:

A. Contractor Project Management Plan

REPORTING REQUIREMENTS

The Contractor shall provide the Contracting Officer’s Representative (COR) with Monthly Progress Reports in electronic form in Microsoft Word and/or PDF formats. The report shall include detailed instructions/explanations for each required data element, to ensure that data is accurate and consistent. These reports shall reflect data as of the last day of the preceding month.

The Monthly Progress Reports shall cover all work completed during the reporting period and work planned for the subsequent reporting period. The report shall also identify any problems that arose and a description of how the problems were resolved. If problems have not been completely resolved, the Contractor shall provide an explanation including their plan and timeframe for resolving the issue. The Contractor shall monitor performance against the CPMP and report any deviations. It is expected that the Contractor will keep in communication with VA accordingly so that issues that arise are transparent to both parties to prevent escalation of outstanding issues.

The Monthly Progress Report shall also include: (a) training completion certificates for any new Contractor/Subcontractor personnel onboarded that month (cybersecurity, privacy, HIPAA, Rules of Behavior), (b) a running log of VA-approved outreach templates (letters, emails, call scripts) and any updates, and (c) the applicable Accessibility Conformance Report (VPAT/ACR) upon delivery of any new EIT artifacts.

Deliverable:

A. Monthly Progress Report

TECHNICAL KICKOFF MEETING

The Contractor shall hold a technical kickoff meeting within 10 days after TO award. The Contractor shall present, for review and approval by the Government, the details of the intended approach, work plan, and project schedule for each effort. The Contractor shall specify dates, locations (can be virtual), agenda (shall be provided to all attendees at least five calendar days prior to the meeting), and pertinent information. The Contractor shall invite the Contracting Officer (CO), Contract Specialist (CS), COR, and the VA PM.

BENEFICIARY LOCATOR AND OUTREACH SERVICES

SELECTION AND REFERRAL OF CLAIMS CASES

VA INS, at its sole discretion, will select cases from its inventory of unpaid pending death awards and provide Contractor with available relevant information to refer cases for each tier of locator and outreach services described below. The Contractor shall implement a solution to allow VA INS to easily transmit and receive data files containing Veteran/Beneficiary information (Veteran Name, Veteran Name SSN, Veteran Name DOB, last known address, phone number, email, PDF images of Beneficiary Designation Forms, etc. as available) through a secure/encrypted method (i.e. SFTP, HTTPS, etc.) to initiate the process of locator and outreach services for selected cases. The Contractor shall ensure the safeguarding of all personally identifiable information (PII) in strict adherence to all applicable VA Privacy and Information Security Policies and Federal Information Security standards.

During the base period, VA INS plans to select a minimum of 1000 cases from its inventory of claims from the Tiers listed in Table 1. For both Tier 1 and Tier 2 cases, VA INS plans to leverage Contractor’s locator and outreach services to perform Electronic Address Search (Ref. 5.2.5.A) to obtain current contact information for listed beneficiaries; Death Determination (Ref. 5.2.5.B) to confirm the living status of listed beneficiaries; deliver Claims Outreach Mailings (Ref. 5.2.5.C) to notify beneficiaries and provide instructions to submit claims; and Reporting on Updated Information and Results (Ref. 5.2.5.D) to report back to VA INS on all activities and results. For Tier 3 cases, VA INS plans to leverage Contractor’s locator and outreach services to perform In-Depth Expert Search / Research Services (Ref. 5.2.5.E) to find potential alternate beneficiaries in accordance with the Faster Payment to Veteran’s Survivors Act of 2022 (Public Law No. 117-313); to deliver Claims Outreach Mailings (Ref. 5.2.5.C) to notify potential alternate beneficiaries and provide instructions to submit claims; and Reporting on Updated Information and Results (Ref. 5.2.5.D) report back to VA INS on all activities and results.

VA INS at its sole discretion will determine the criteria for how cases are selected and will control the selection of cases from its inventory to decide which cases to refer to Contractor for locator and outreach services.

Table 1. Tier Classification and Required Services

· Death Determination

· Claims Outreach Mailings

· Reporting on Updated Information and Results

· Death Determination

· Claims Outreach Mailings

· Reporting on Updated Information and Results

· Claims Outreach Mailings

· Reporting on Updated Information and Results

PRIMARY BENFICIARY LOCATOR AND OUTREACH (Tier 1) Cases classified as Tier 1 include cases that have been pending six months to one year after the Veteran’s date of death. For Tier 1 cases, the Contractor will use an Electronic Address Search (Ref. 5.2.5.A) to locate the primary beneficiary(ies). The Contractor will also utilize Death Determination (Ref. 5.2.5.B) to determine the living status of the primary beneficiary(ies). If the primary beneficiary(ies) is located and determined to be living, the Contractor will use Claims Outreach Mailings (Ref. 5.2.5.C), to complete outreach to the primary beneficiary(ies). The Contractor will provide Reporting on Updated Information and Results (Ref. 5.2.5.D) to VA Insurance Service documenting all efforts to locate and provide outreach to the primary beneficiary(ies).

CONTINGENT BENFICIARY LOCATOR AND OUTREACH (Tier 2) Cases in which the named primary beneficiary(ies) is deceased, or more than one year has passed since the date of death of the insured Veteran, are classified as Tier 2 cases. For Tier 2 cases, the Contractor will use an Electronic Address Search (Ref. 5.2.5.A) to locate the contingent beneficiary(ies). The Contractor will also utilize Death Determination (Ref. 5.2.5.B) to determine the living status of the contingent beneficiary(ies). If the contingent beneficiary(ies) is located and determined to be living, the Contractor will use Claims Outreach Mailings (Ref. 5.2.5.C), to complete outreach to the contingent beneficiary(ies). The Contractor will provide Reporting on Updated Information and Results (Ref. 5.2.5.D) to VA Insurance Service documenting all efforts to locate and provide outreach to the contingent beneficiary(ies).

ALTERNATE BENEFICIARY LOCATOR AND OUTREACH (Tier 3) For cases in which all named primary and contingent beneficiaries are deceased or more than two years have passed since the date of death of the insured Veteran, the Contractor shall employ expert research capabilities leveraging information resources such as public records databases, commercial financial credit reporting services, court documents, voter registration records, property assessments, genealogy databases, etc. to identify and obtain current contact information for possible alternate beneficiaries. As specified in the Faster Payment to Veteran’s Survivors Act of 2022 (Public Law No. 117-313), alternate beneficiaries may include the surviving spouse of the insured, children of the insured, descendants of deceased children, parents of the insured, survivors of the parents, duly appointed executor or administrator of the estate of the insured person, or other next of kin of the insured entitled under the laws of domicile of the insured person at the time of death.

Once an alternate beneficiary is located, the Contractor will use Claims Outreach Mailings (Ref. 5.2.5.C), to complete outreach to the alternate beneficiary(ies). The Contractor will provide Reporting on Updated Information and Results (Ref. 5.2.5.D) to VA Insurance Service documenting all efforts to locate and provide outreach to the alternate beneficiary.

DEFINITIONS FOR REQUIRED SERVICES IN TABLE 1

A. Electronic Address Search: The Contractor will leverage electronic databases and internet resources to identify individual beneficiaries and locate their mailing address, phone numbers, email addresses and other contact information.

B. Death Determination: The Contractor will leverage electronic databases and internet resources to confirm the living status of listed beneficiaries. If a beneficiary is determined to be deceased, Contract will cross-reference two or more sources to verify accuracy. Sources for verification of a death include but are not limited to: Social Security Death Index; state death records; obituaries; background check services; and genealogy services, such as Ancestry.com and FamilySearch.org. Contractor will provide to VA INS all documentation showing proof of death of the beneficiary.

C. Claims Outreach Mailings: The Contractor shall conduct outreach services to identified beneficiaries including mailing letters, sending emails, and/or placing phone calls to establish contact and to provide instructions and assistance in completing VA’s required claims documentation (VAF 29-4125, Death Certificate, VAF-29-541, Letters testamentary, letters of administration, etc.). All outreach services will provide the VA INS website for submitting a claim application online. When communicating with possible beneficiaries, the Contractor and/or its representatives shall clearly identify themselves as a Contractor working on behalf of the VA to locate possible beneficiaries who may be entitled to claim the proceeds of the deceased Veteran’s government life insurance. The Contractor shall provide VA INS with samples and obtain written approval from the VA’s COR for all letter templates, email templates, and/or call scripts to be used to conduct outreach services prior to initiating contact with any beneficiaries on behalf of VA INS. The Contractor shall notify VA INS of any substantive changes to these artifacts and seek approval before proceeding with any such changes. The Contractor shall assist beneficiaries with the completion of required claims documentation by providing instructions, explaining requirements and procedures and answering questions.

The Contractor will set up a mailing address/PO Box specifically for VA INS outreach mailings. The Contractor will process any mail returned to this mailing address/PO Box. Upon receiving mail returned to sender, the Contractor will use the Electronic Address Search (Ref. 5.2.5.A) attempt to find a new address. If a new address is located, the Contractor will resend the outreach mailing.

The Contractor will make a maximum of three attempted contacts with each identified beneficiary.

D. Reporting on Updated Information and Results: The Contractor will report on the status of cases sent to them by VA INS monthly. As part of the monthly report, the Contractor will include a list showing any letter and/or email templates that were sent to identified beneficiaries. The list will include pertinent details, such as the date of communication, recipient, and name of letter or email template that was sent to identified beneficiaries. The report will be provided to VA INS no later than the last business days of each month.

E. In-Depth Expert Search / Research Services, to include Next of Kin Search and Genealogy Search:

SUCCESS CRITERIA

No charges shall incur for cases where successful results are not reported.

Successful results for each tier are listed below.

A. Tier 1: The Contractor will locate, confirm the living status of the primary beneficiary and provide outreach mailings for 90% of the Tier 1 cases assigned to the Contractor.

B. Tier 2: The Contractor will locate, confirm the living status of the contingent beneficiary and provide outreach mailings for 90% of the Tier 2 cases assigned to the Contractor.

C. Tier 3: The Contractor will locate an alternate beneficiary and provide outreach mailings that lead to a claim application being submitted to VA Insurance Service for 70% of the Tier 3 cases assigned to the Contractor.

OPTION PERIOD TASKS

When an Option Period is exercised by VA, all tasks in the following sub-sections shall apply:

A. Section 0 PROJECT MANAGEMENT B. Section 5Error! Reference source not found.2 BENEFICIARY LOCATOR AND OUTREACH SERVICES

GENERAL REQUIREMENTS

ENTERPRISE AND IT FRAMEWORK

The Contractor shall support the VA enterprise management framework and comply with the OIT Technical Reference Model (One-VA TRM) and One-VA Enterprise Architecture (EA). The Contractor solution shall support the latest Internet Protocol Version 6 (IPv6) in accordance with current OMB and NIST guidance; dual-stack operation (IPv4/IPv6) is expected where needed to ensure interoperability.

The Contractor’s end-user solution intended for use on standard VA computers shall be compatible with current VA desktop standards (Windows 10/11), modern browsers (Microsoft Edge [Chromium] and equivalent), and Microsoft 365 Apps. Applications delivered to VA shall be provided in signed, enterprise-deployable packages suitable for VA endpoint management tools (e.g., Microsoft Configuration Manager and/or Microsoft Intune). Software code signing shall use a VA-trusted authority.

The Contractor shall ensure their solution functions as expected under standard, non-administrative user profiles configured to current federal security configuration baselines (e.g., CIS Benchmarks, DISA STIGs, and applicable NIST guidance). The Contractor shall support VA’s VIP/PMAS incremental development approach and utilize ProPath for process conformance, artifacts, and schedule governance.

POSITION/TASK RISK DESIGNATION LEVEL(S) AND CONTRACTOR PERSONNEL SECURITY REQUIREMENTS

POSITION/TASK RISK DESIGNATION LEVEL(S)

The position sensitivity and the level of background investigation commensurate with the required level of access for the following tasks within the Performance Work Statement are:

Position Sensitivity and Background Investigation Requirements

The Tasks identified above and the resulting Position Sensitivity and Background Investigation requirements identify, in effect, the Background Investigation requirements for Contractor individuals, based upon the tasks the particular Contractor individual will be working. The submitted Contractor Staff Roster must indicate the required Background Investigation Level for each Contractor individual based upon the tasks the Contractor individual will be working, in accordance with their submitted proposal.

CONTRACTOR PERSONNEL SECURITY REQUIREMENTS

Contractor Responsibilities:

1. The Contractor shall prescreen all personnel requiring access to the computer systems to ensure they maintain the appropriate Background Investigation, and are able to read, write, speak and understand the English language.

1. The Contractor shall bear the expense of obtaining background investigations.

1. Within 3 business days after award, the Contractor shall provide a roster of Contractor and Subcontractor employees to the COR to begin their background investigations. The roster shall contain the Contractor’s Full Name, Full Social Security Number, Date of Birth, Place of Birth, and individual background investigation level requirement (based upon Section 6.2 Tasks).

1. The Contractor should coordinate the location of the nearest VA fingerprinting office through the COR. Only electronic fingerprints are authorized.

1. For a Low Risk designation the following forms are required to be completed: 1.OF-306 and 2. DVA Memorandum – Electronic Fingerprints. For Moderate or High Risk the following forms are required to be completed: 1. VA Form 0710 and 2. DVA Memorandum – Electronic Fingerprints. These should be submitted to the COR within 5 business days after award.

1. The Contractor personnel will receive an email notification from the Security and Investigation Center (SIC), through the Electronics Questionnaire for Investigations Processes (e-QIP) identifying the website link that includes detailed instructions regarding completion of the investigation documents (SF85, SF85P, or SF 86). The Contractor personnel shall submit all required information related to their background investigations utilizing the Office of Personnel Management’s (OPM) Electronic Questionnaire for Investigations Processing (e-QIP).

1. The Contractor is to certify and release the e-QIP document, print and sign the signature pages, and send them to the COR for electronic submission to the SIC. These should be submitted to the COR within 3 business days of receipt of the e-QIP notification email.

1. The Contractor shall be responsible for the actions of all personnel provided to work for VA under this contract. In the event that damages arise from work performed by Contractor provided personnel, under the auspices of this contract, the Contractor shall be responsible for all resources necessary to remedy the incident.

1. A Contractor may be granted unescorted access to VA facilities and/or access to VA Information Technology resources (network and/or protected data) with a favorably adjudicated Special Agreement Check (SAC) or “Closed, No Issues” (SAC) finger print results, training delineated in VA Handbook 6500.6 (Appendix C, Section 9), and, the signed “Contractor Rules of Behavior.” However, the Contractor will be responsible for the actions of the Contractor personnel they provide to perform work for VA. The investigative history for Contractor personnel working under this contract must be maintained in the database of the Office of Personnel Management (OPM).

1. The Contractor, when notified of an unfavorably adjudicated background investigation on a Contractor employee as determined by the Government, shall withdraw the employee from consideration in working under the contract.

1. Failure to comply with the Contractor personnel security investigative requirements may result in termination of the contract for default.

METHOD AND DISTRIBUTION OF DELIVERABLES

The Contractor shall deliver documentation in electronic format, unless otherwise directed in Section B of the solicitation/contract. Acceptable electronic media include: MS Word 2003/2007/2010/2013/2016, MS Excel 2000/2003/2007/2010/2013/2016, MS PowerPoint 2003/2007/2010/2013/2016, MS Project 2000/2003/2007/2010/2013/2016, MS Visio 2000/2002/2003/2007/2010/2013/2016, and Adobe Postscript Data Format (PDF).

PERFORMANCE METRICS

The table below defines the Performance Standards and Acceptable Performance Levels for Objectives associated with this effort.

1. Technical Needs

Shows clear understanding of requirements.

All requirements’ deadlines are met per the PWS.

Satisfactory or higher, measured on a yearly basis

Products completed, reviewed, delivered in timely manner Notifies customer in advance of potential problems Satisfactory or higher, measured on a yearly basis

Personnel possess necessary knowledge, skills and abilities to perform tasks Satisfactory or higher, measured on a yearly basis

Services/products delivered were of desired quality Satisfactory or higher, measured on a yearly basis

5. Maintenance Support

Response to phone calls and software maintenance visits within PWS timeframes 95% of the time, measured on a yearly basis

The Government will utilize a Quality Assurance Surveillance Plan (QASP) throughout the life of the contract to ensure that the Contractor is performing the services required by this PWS in an acceptable manner. The Government reserves the right to alter or change the surveillance methods in the QASP at its own discretion. A Performance Based Service Assessment Survey will be used in combination with the QASP to assist the Government in determining acceptable performance levels.

FACILITY/RESOURCE PROVISIONS

The Government will provide office space, telephone service and system access when authorized contract staff work at a Government location as required in order to accomplish the Tasks associated with this PWS. All procedural guides, reference materials, and program documentation for the project and other Government applications will also be provided on an as-needed basis.

The Contractor shall request other Government documentation deemed pertinent to the work accomplishment directly from the Government officials with whom the Contractor has contact. The Contractor shall consider the COR as the final source for needed Government documentation when the Contractor fails to secure the documents by other means. The Contractor is expected to use common knowledge and resourcefulness in securing all other reference materials, standard industry publications, and related materials that are pertinent to the work.

VA will provide access to VA specific systems/network as required for execution of the task via remote access technology (e.g. Citrix Access Gateway (CAG), site-to-site VPN, or VA Remote Access Security Compliance Update Environment (RESCUE)). This remote access will provide access to VA specific software such as Veterans Health Information System and Technology Architecture (VistA), ClearQuest, ProPath, Primavera, and Remedy, including appropriate seat management and user licenses. The Contractor shall utilize Government-provided software development and test accounts, document and requirements repositories, etc. as required for the development, storage, maintenance and delivery of products within the scope of this effort. The Contractor shall not transmit, store or otherwise maintain sensitive data or products in Contractor systems (or media) within the VA firewall IAW VA Handbook 6500.6 dated March 12, 2010. All VA sensitive information shall be protected at all times in accordance with local security field office System Security Plans (SSP’s) and Authority to Operate (ATO)’s for all systems/LAN’s accessed while performing the tasks detailed in this PWS. For detailed Security and Privacy Requirements refer to ADDENDUM A and ADDENDUM B.

GOVERNMENT FURNISHED PROPERTY

Not Applicable

ADDENDUM A

Supply Chain & Clause Enforcement:

Contractor systems and deliverables must not include or rely on covered telecommunications/video surveillance equipment or services, nor any prohibited covered application, consistent with FAR 52.204-25 and FAR 52.204-27. Security obligations under FIPS 140-3 and applicable NIST Special Publications are enforced via FAR 52.204-21 (Basic Safeguarding) and FAR 52.239-1 (Privacy or Security Safeguards).

Cyber and Information Security Requirements for VA IT Services The Contractor shall ensure adequate LAN/Internet, data, information, and system security in accordance with VA standard operating procedures and standard PWS language, conditions, laws, and regulations. The Contractor’s firewall and web server shall meet or exceed VA minimum requirements for security. All VA data shall be protected behind an approved firewall. Any security violations or attempted violations shall be reported to the VA Program Manager and VA Information Security Officer as soon as possible. The Contractor shall follow all applicable VA policies and procedures governing information security, especially those that pertain to certification and accreditation.

Contractor supplied equipment, PCs of all types, equipment with hard drives, etc. for contract services must meet all security requirements that apply to Government Furnished Equipment (GFE) and Government Owned Equipment (GOE). Security Requirements include: a) VA Approved Encryption Software must be installed on all laptops or mobile devices before placed into operation, b) Bluetooth equipped devices are prohibited within VA; Bluetooth must be permanently disabled or removed from the device, c) VA approved anti-virus and firewall software, d) Equipment must meet all VA sanitization requirements and procedures before disposal. The COR, CO, the Project Manager, and the Information Security Officer (ISO) must be notified and verify all security requirements have been adhered to.

Each documented initiative under this contract incorporates VA Handbook 6500.6, “Contract Security,” March 12, 2010 by reference as though fully set forth therein. The VA Handbook 6500.6, “Contract Security” shall also be included in every related agreement, contract or order. The VA Handbook 6500.6, Appendix C, is included in this document as Addendum B.

Training requirements: The Contractor shall complete all mandatory training courses on the current VA training site, the VA Talent Management System (TMS), and will be tracked therein. The TMS may be accessed at https://www.tms.va.gov. If you do not have a TMS profile, go to https://www.tms.va.gov and click on the “Create New User” link on the TMS to gain access.

Contractor employees shall complete a VA Systems Access Agreement if they are provided access privileges as an authorized user of the computer system of VA.

VA Enterprise Architecture Compliance The applications, supplies, and services furnished under this contract must comply with One-VA Enterprise Architecture (EA), available at http://www.ea.oit.va.gov/index.asp in force at the time of issuance of this contract, including the Program Management Plan and VA's rules, standards, and guidelines in the Technical Reference Model/Standards Profile (TRMSP). VA reserves the right to assess contract deliverables for EA compliance prior to acceptance.

A1.1. VA Internet and Intranet Standards:

The Contractor shall adhere to and comply with VA Directive 6102 and VA Handbook 6102, Internet/Intranet Services, including applicable amendments and changes, if the Contractor’s work includes managing, maintaining, establishing and presenting information on VA’s Internet/Intranet Service Sites. This pertains, but is not limited to: creating announcements; collecting information; databases to be accessed, graphics and links to external sites. The Contractor shall ensure 508 conformance for all public-facing content by providing review to and obtaining approval from the COR.

Internet/Intranet Services Directive 6102 is posted at (copy and paste the following URL to browser): http://www1.va.gov/vapubs/viewPublication.asp?Pub_ID=409&FType=2

Internet/Intranet Services Handbook 6102 is posted at (copy and paste following URL to browser): http://www1.va.gov/vapubs/viewPublication.asp?Pub_ID=410&FType=2

Notice of the Federal Accessibility Law Affecting All Electronic and Information Technology Procurements (Section 508) On August 7, 1998, Section 508 of the Rehabilitation Act of 1973 was amended to require that when Federal departments or agencies develop, procure, maintain, or use Electronic and Information Technology, that they shall ensure it allows Federal employees with disabilities to have access to and use of information and data that is comparable to the access to and use of information and data by other Federal employees. Section 508 required the Architectural and Transportation Barriers Compliance Board (Access Board) to publish standards setting forth a definition of electronic and information technology and the technical and functional criteria for such technology to comply with Section 508. These standards have been developed are published with an effective date of December 21, 2000. Federal departments and agencies shall develop all Electronic and Information Technology requirements to comply with the standards found in 36 CFR 1194.

Section 508 / ICT Accessibility Requirements:

The Contractor shall ensure conformance to the 2017 ICT Refresh (36 CFR Part 1194) and WCAG 2.1 AA for all electronic content, software, web applications, documents, and multimedia produced under this contract. The Contractor shall provide an Accessibility Conformance Report (VPAT/ACR) for each applicable deliverable and incorporate remediation plans where gaps are identified. The Government reserves the right to test and verify accessibility conformance prior to acceptance..

Physical Security & Safety Requirements:

The Contractor and their personnel shall follow all VA policies, standard operating procedures, applicable laws and regulations while on VA property. Violations of VA regulations and policies may result in citation and disciplinary measures for persons violating the law.

1. The Contractor and their personnel shall wear visible identification at all times while they are on the premises.

2. VA does not provide parking spaces at the work site; the Contractor must obtain parking at the work site if needed. It is the responsibility of the Contractor to park in the appropriate designated parking areas. VA will not invalidate or make reimbursement for parking violations of the Contractor under any conditions.

3. Smoking is prohibited inside/outside any building other than the designated smoking areas.

4. Possession of weapons is prohibited.

5. The Contractor shall obtain all necessary licenses and/or permits required to perform the work, with the exception of software licenses that need to be procured from a Contractor or contractor in accordance with the requirements document. The Contractor shall take all reasonable precautions necessary to protect persons and property from injury or damage during the performance of this contract.

6. The Contractor shall ensure all personnel working on this contract completes necessary security training (TMS; VA Handbook 6500.6) an include completion status as part of the monthly progress report (PWS paragraph 5.1.2) Confidentiality and Non-Disclosure The Contractor shall follow all VA rules and regulations regarding information security to prevent disclosure of sensitive information to unauthorized individuals or organizations.

The Contractor may have access to Protected Health Information (PHI) and Electronic Protected Health Information (EPHI) that is subject to protection under the regulations issued by the Department of Health and Human Services, as mandated by the Health Insurance Portability and Accountability Act of 1996 (HIPAA); 45 CFR Parts 160 and 164, Subparts A and E, the Standards for Privacy of Individually Identifiable Health Information (“Privacy Rule”); and 45 CFR Parts 160 and 164, Subparts A and C, the Security Standard (“Security Rule”). Pursuant to the Privacy and Security Rules, the Contractor must agree in writing to certain mandatory provisions regarding the use and disclosure of PHI and EPHI.

1. The Contractor will have access to some privileged and confidential materials of VA. These printed and electronic documents are for internal use only, are not to be copied or released without permission, and remain the sole property of VA. Some of these materials are protected by the Privacy Act of 1974 (revised by PL 93-579) and Title 38. Unauthorized disclosure of Privacy Act or Title 38 covered materials is a criminal offense.

2. The VA Contracting Officer will be the sole authorized official to release in writing, any data, draft deliverables, final deliverables, or any other written or printed materials pertaining to this contract. The Contractor shall release no information. Any request for information relating to this contract presented to the Contractor shall be submitted to the VA Contracting Officer for response.

3. Contractor personnel recognize that in the performance of this effort, Contractor personnel may receive or have access to sensitive information, including information provided on a proprietary basis by carriers, equipment manufacturers and other private or public entities. Contractor personnel agree to safeguard such information and use the information exclusively in the performance of this contract. Contractor shall follow all VA rules and regulations regarding information security to prevent disclosure of sensitive information to unauthorized individuals or organizations as enumerated in this section and elsewhere in this Contract and its subparts and appendices.

4. Contractor shall limit access to the minimum number of personnel necessary for contract performance for all information considered sensitive or proprietary in nature. If the Contractor is uncertain of the sensitivity of any information obtained during the performance this contract, the Contractor has a responsibility to ask the VA Contracting Officer.

5. Contractor shall train all of their employees involved in the performance…