36C10E19Q0249-001.docx

PAGE 1 OF

1. REQUISITION NO.

2. CONTRACT NO.

3. AWARD/EFFECTIVE DATE

4. ORDER NO.

5. SOLICITATION NUMBER

6. SOLICITATION ISSUE DATE

a. NAME

b. TELEPHONE NO. (No Collect Calls)

8. OFFER DUE DATE/LOCAL

TIME

9. ISSUED BY

CODE

10. THIS ACQUISITION IS

UNRESTRICTED OR

SET ASIDE:

% FOR:

SMALL BUSINESS

HUBZONE SMALL

BUSINESS

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

WOMEN-OWNED SMALL BUSINESS

(WOSB) ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

EDWOSB

8(A)

NAICS:

SIZE STANDARD:

11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

SEE SCHEDULE

12. DISCOUNT TERMS

13a. THIS CONTRACT IS A

RATED ORDER UNDER

DPAS (15 CFR 700)

13b. RATING

14. METHOD OF SOLICITATION

RFQ

IFB

RFP

15. DELIVER TO

CODE

16. ADMINISTERED BY

CODE

17a. CONTRACTOR/OFFEROR

CODE

FACILITY CODE

18a. PAYMENT WILL BE MADE BY

CODE

TELEPHONE NO.

DUNS:

DUNS+4:

PHONE:

FAX:

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN OFFER 18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK BELOW IS CHECKED

SEE ADDENDUM

19.

20.

21.

22.

23.

24.

ITEM NO.

SCHEDULE OF SUPPLIES/SERVICES

QUANTITY

UNIT

UNIT PRICE

AMOUNT

(Use Reverse and/or Attach Additional Sheets as Necessary)

25. ACCOUNTING AND APPROPRIATION DATA

26. TOTAL AWARD AMOUNT (For Govt. Use Only) 27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1, 52.212-4. FAR 52.212-3 AND 52.212-5 ARE ATTACHED. ADDENDA

ARE

ARE NOT ATTACHED.

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA

ARE

ARE NOT ATTACHED

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN _______________

29. AWARD OF CONTRACT: REF. ___________________________________ OFFER

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND

DATED ________________________________. YOUR OFFER ON SOLICITATION

DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY

(BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE

ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED

SET FORTH HEREIN IS ACCEPTED AS TO ITEMS:

30a. SIGNATURE OF OFFEROR/CONTRACTOR 31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER) 30b. NAME AND TITLE OF SIGNER (TYPE OR PRINT) 30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER (TYPE OR PRINT) 31c. DATE SIGNED

AUTHORIZED FOR LOCAL REPRODUCTION

(REV. 2/2012)

PREVIOUS EDITION IS NOT USABLE

Prescribed by GSA - FAR (48 CFR) 53.212

7. FOR SOLICITATION

INFORMATION CALL:

STANDARD FORM 1449

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 30

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

VA

07-26-2019 36C10E19Q0249 07-26-2019 Stuart W. Stovall 540-597-1145 08-12-2019

5:00PM

00101 Department of Veterans Affairs VBA Office of Admin. and Fac.

Acquisition Division 1800 G. Street N.W.

Washington DC 20006 X X Y 518210 $32.5 Million Net 30 N/A X Department of Veterans Affairs Veterans Benefits Administration Office of Financial Management (OFM) 1800 G. Street N.W., RM 630M Washington DC 20006 00101 Department of Veterans Affairs VBA Office of Admin. and Fac.

Acquisition Division 1800 G. Street N.W.

Washington DC 20006

All Invoices must be submitted to the VA Financial Service Center via the online website below.

https://www.tungsten-network.com/veteran -affairs-us/ See CONTINUATION Page The Department of Veterans Affairs (VA), Veterans Benefits Administration (VBA), Office of Financial Management (OFM) to obtain a contractor to provide all resources necessary to accomplish the deliverables described in the Statement of Work to include Datawatch Swarm or equivalent Software as a Service (SaaS) product per the terms and conditions of the attached Statement of Work and Contract Clauses/Provisions within.

Base Period of Performance: TBD

VBA POC/COR: TBD

Invoicing: All Invoices must be Submitted Electronically, via https://www.tungsten-network.com/veterans-affairs-us/ Obligation Number: TBD must be listed on the Invoice An E-mail notification must be sent to the VA POC/COR and CO when each Invoice is submitted.

See CONTINUATION Page 101-3690151-5854-309300-2580 020043G00 Obligation Number: TBD X X X Stuart W. Stovall

VBA14L2-69370

Table of Contents

SECTION B - CONTINUATION OF SF 1449 BLOCKS

B.1 CONTRACT ADMINISTRATION DATA

1. Contract Administration: All contract administration matters will be handled by the following individuals:

b. GOVERNMENT: Stuart W. Stovall, Contracting Officer Department of Veterans Affairs VBA Office of Admin. and Fac. - Acquisition Division VBA Specialized & Commodities Team Telephone #: 540-597-1145 E-mail Address: Stuart.Stovall@va.gov

2. CONTRACTOR REMITTANCE ADDRESS: All payments by the Government to the contractor will be made in accordance with:

3. INVOICES: Invoices shall be submitted in arrears:

4. GOVERNMENT INVOICE ADDRESS: All Invoices from the contractor shall be submitted electronically in accordance with VAAR Clause 852.232-72 Electronic Submission of Payment Requests.

All Invoices must be submitted to the VA Financial Service Center via the online website below.

https://www.tungsten-network.com/veteran-affairs-us/ ACKNOWLEDGMENT OF AMENDMENTS: The offeror acknowledges receipt of amendments to the Solicitation numbered and dated as follows:

B.2 PRICE/COST SCHEDULE

ITEM INFORMATION

The Contractor shall provide all resources necessary to accomplish the deliverables described in the Statement of Work (Task 1.0) for 142 users of Datawatch Swarm or equal as provided as a Software as a Service (SaaS) product.

Contract Period: Base - 12 Months POP Begin: TBD POP End:

The Contractor shall provide all resources necessary to accomplish the deliverables described in the Statement of Work (Task 2.0) for Professional Support Services.

Contract Period: Base – 12 Months

The Contractor shall provide all resources necessary to accomplish the deliverables described in the Statement of Work (Task 3.0) for Professional Training.

Travel to conduct training (Section H) - 3 Trips, Hines, IL, Austin, TX and Washington, DC.

The Contractor shall provide all resources necessary to accomplish the deliverables described in the Statement of Work (Task 1.0) for 142 users of Datawatch Swarm or equal as provided as a Software as a Service (SaaS) product.

Contract Period: Option 1 – 12 Months

The Contractor shall provide all resources necessary to accomplish the deliverables described in the Statement of Work (Task 2.0) for Professional Support Services.

The Contractor shall provide all resources necessary to accomplish the deliverables described in the Statement of Work (Task 3.0) for Unlimited access to Datawatch eLearning tools including Datawatch Designer Training and Monarch Complete Fundamentals (Or Equivalent) ONLY.

The Contractor shall provide all resources necessary to accomplish the deliverables described in the Statement of Work (Task 1.0) for 142 users of Datawatch Swarm or equal as provided as a Software as a Service (SaaS) product.

Contract Period: Option 2 – 12 Months

The Contractor shall provide all resources necessary to accomplish the deliverables described in the Statement of Work (Task 2.0) for Professional Support Services.

The Contractor shall provide all resources necessary to accomplish the deliverables described in the Statement of Work (Task 3.0) for Unlimited access to Datawatch eLearning tools including Datawatch Designer Training and Monarch Complete Fundamentals (Or Equivalent) ONLY.

The Contractor shall provide all resources necessary to accomplish the deliverables described in the Statement of Work (Task 1.0) for 142 users of Datawatch Swarm or equal as provided as a Software as a Service (SaaS) product.

Contract Period: Option 3 – 12 Months

The Contractor shall provide all resources necessary to accomplish the deliverables described in the Statement of Work (Task 2.0) for Professional Support Services.

The Contractor shall provide all resources necessary to accomplish the deliverables described in the Statement of Work (Task 3.0) for Unlimited access to Datawatch eLearning tools including Datawatch Designer Training and Monarch Complete Fundamentals (Or Equivalent) ONLY

The Contractor shall provide all resources necessary to accomplish the deliverables described in the Statement of Work (Task 1.0) for 142 users of Datawatch Swarm or equal as provided as a Software as a Service (SaaS) product.

Contract Period: Option 4 – 12 Months

The Contractor shall provide all resources necessary to accomplish the deliverables described in the Statement of Work (Task 2.0) for Professional Support Services.

The Contractor shall provide all resources necessary to accomplish the deliverables described in the Statement of Work (Task 3.0) for Unlimited access to Datawatch eLearning tools including Datawatch Designer Training and Monarch Complete Fundamentals (Or Equivalent) ONLY.

REQUEST FOR QUOTATION - 36C10E19Q0249

Page 1 of Page 1 of

STATEMENT OF WORK

A. GENERAL INFORMATION

Hours of operation are defined as Monday through Friday, 7:30 AM ‐ 5:30 PM. Any work to be performed at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO).

There are 10 Federal holidays set by law (USC Title 5 Section 6103) that VA follows.

Under current definitions, four (4) are set by date:

If any of the above falls on a Saturday, then Friday shall be observed as a holiday.

Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six (6) are set by a day of the week and month:

5. Type of Contract: Firm Fixed Price

6. Place of Performance: The primary place of performance shall be at the contractor’s facility however due to the preponderance of training that is central to the VBA Finance Center in Hines, Illinois, ALAC in Austin, TX and OFM Central Office in Washington DC, there is a requirement to have a robust communications management structure in place for the Customer Service Account Manager, and the Program Manager for administrative coordination with the Contracting Officer Representative (COR) and identified Government Program Manager in order to mitigate risk and provide communication to the government.

B. CONTRACT AWARD MEETING

The contractor shall not commence performance on the tasks in this SOW until the CO has conducted a kick off meeting or has advised the contractor that a kick off meeting is waived.

C. GENERAL REQUIREMENTS

1. The Contractor shall provide a detailed Project Management Plan (PMP) with their quote and shall update that plan as required throughout the contract period of performance. The PMP will address only the work specific to this contract. It shall define the roles and responsibilities of contractor’s Customer Service Account Manager, and assigned Program and Project managers. The Contractor shall document their Standard Operating Procedures (SOP) for completion of the specific tasks in this SOW. The VBA Project team should be briefed on the PMP which provides the Contractors detailed plan for completing the required deliverables. The contractor's plan shall be responsive to this SOW and describe, in further detail, the approach to be used for each aspect of the contract as defined in the quote. An updated PMP and SOP are due within 30 days after contract award effective date.

2. For every task, the Contractor shall identify in writing all necessary subtasks, associated costs by task, and together with associated sub-milestone dates. The Contractor's subtask structure shall be reflected in the quote and detailed project management plan (PMP).

3. All written deliverables will be phrased in layperson language. Statistical and other technical terminology will not be used without providing a glossary of terms.

4. Where a written milestone deliverable is required in draft form, VBA will complete their review of the draft deliverable within 15 calendar days from date of receipt. The Contractor shall have 10 calendar days to deliver the final deliverable from date of receipt of the government’s comments.

5. All Contractor personnel who will have access to veterans’ claims information, for the purposes such as; implementation and testing of data models, shall complete a background investigation and sign a confidentiality statement agreeing to protect the veterans’ data and privacy. The VBA Contracting Officer Representative (COR) for this contract will provide the Contractor the background investigation paperwork and a copy of the required confidentiality statement.

6. All deliverables, except where specified otherwise, shall be provided in one electronic copy to the COR. All deliverables shall be delivered via software compatible (type and version) with that used by the VBA and shall become the sole property of the VBA upon creation.

7. The Contractor shall not deliver to the VBA any proprietary products or information, software, tools or systems unless specifically specified in an Enterprise Term License Agreement. Company financial information provided in invoices and other documents are exempted from this requirement. If the contractor believes further exemption is required to this requirement as necessary for effective or efficient execution of this contract, the contractor shall request a specific exception in writing to the COR and shall not provide the proprietary tools or information until written approval is received from the Contracting Officer (CO).

8. The Contractor will decorate the systems according to the 508 standards and bring them into compliance for major violations within this standard. Section 508 of the Workforce Rehabilitation Act is a law that requires federal agencies and their contractors to make their electronic and information technology accessible to those with disabilities. It outlines the minimum acceptable standards, such as “the use of text labels or descriptors for graphics and certain format elements.”

D. SPECIFIC MANDATORY TASKS AND ASSOCIATED DELIVERABLES

Description of Tasks and Associated Deliverables: The Contractor shall provide the specific deliverables described below within the performance period stated in Section A.4 of this SOW, although the components may be modified at any time by VBA through the CO / COR to reflect the results of needs assessment and learning analysis and changes in VBA training requirements. The Contractor shall identify all assumptions as to scope of required activities and number and type of components along with their technical approach.

Task 1.0: The contractor shall provide VBA with subscription access to Datawatch Swarm or equal. VBA requires subscriptions for 142 users. Swarm is Software as a Service, produced and managed by Datawatch, hosted on web service data centers. The subscriptions shall provide the users the ability to create and share data models within OFM authorized users. Along with access to the service, the Service Level Agreement shall define and guarantee 99.95% uptime availability for customer access. In addition to the Datawatch Swarm or equal, the contractor shall provide at a minimum the following features and capabilities:

· Dedicated Customer Service Account Manager

· 24x7 telephone support

· Unlimited Storage

· Global Deployment

· Subscriptions– Granted access to the software for the term of the contract and the subscriptions can be re-assigned to another user on a need basis.

· Maintenance and Support - Covered for the entire period of performance as part of the ETLA

· Upgrades to latest versions are implemented immediately as they are made available by the software provider

· Skill based Training: Ability to develop and implement models

· Reporting: Customizable reports on various parameters and axis and the ability to filter reports on various criteria.

· Job Aids and Training guide: Learning content that allows users to get help even as they are doing their job. Ability to get to the job aid without having to enroll into a training again.

· FEDRAMP Approved

· Cloud Infrastructure: AWS hosting

· Security: SSO through SAML

· HTTPs

· Encryption of databases

· Security: Certifications

· SOC 2 Security and Availability

· ISO 27001

· Scalability

· Ability to Improve operational productivity by capturing, sharing and analyzing data, consolidating reports, and pulling key data from legacy reports in pdf, csv, txt and other formats for financial analysis, operations management, and external reporting.

· Include self-service data preparation tools to rapidly combine and analyze data from a variety of sources, specifically the ability to:

· Manipulate and prepare data into usable, functional formats and correct or remove any bad data

· Combine and enrich data with other datasets for detailed analysis or process improvements

· Enable non-IT users to repeat processes as many times as necessary to add or subtract data sources as needed and allow users to extract and blend a variety of data from disparate data sources they typically would have access to.

· Provide content repository to securely store, manage and control access to:

· Source content that gets utilized by accountants, analysts, and management

· Reusable models for data extraction and preparation routines

· Prepared data for portal-based access

· Visualizations and dashboards created

Task 2.0: The contract shall provide Professional Support Services to include:

· Solution Architecture to address issues of (1) high availability and disaster recovery, (2) scalability, (3) custom security requirements, and (4) system integration

· Design support to work with designated VBA persons on building and implementing desired initial models.

Task 3.0: The contract shall provide professional training to include:

· On-site Training, hands-on training for users at all levels for each of the VBA sites including: OFM Central Office, D.C; ALAC, Austin, TX; and VBAFC, Hines, IL.

· One-on-one training with designated representatives from each of the three sites to build and implement 15 initial models.

· Unlimited access to Datawatch eLearning tools including Datawatch Designer Training and Monarch Complete Fundamentals (Or Equal).

E. SCHEDULE FOR DELIVERABLES

1. The Contractor shall complete a schedule for deliverables with a specified Delivery Date for every deliverable.

Assigned Customer Service Account Manager

Subscriptions– Granted access to the software

Job Aids

Training guide

On-site Training – Hines, IL

On-site Training – Washington, DC

On-site Training – Austin, TX

One-on-one training - Initial models – Hines, IL

One-on-one training - Initial models – Washington, DC

One-on-one training - Initial models – Austin, TX eLearning Tools

2. Unless otherwise specified, the number of draft copies and the number of final copies shall be the same.

3. If for any reason the scheduled time for a deliverable cannot be met, the Contractor is required to explain why (include the original deliverable due date) in writing to the COR and CO, including a firm commitment of when the work shall be completed. This notice to the COR and CO shall cite the reasons for the delay, the impact on the overall contract and provide a corrective plan of action with a get-well date. The COR and CO will then review the facts and issue a response in accordance with applicable regulations.

F. CHANGES TO STATEMENT OF WORK

Any changes to this SOW shall be authorized and approved only through written correspondence from the CO. A copy of each change will be kept in a project folder along with all other products of the project. Costs incurred by the contractor through the actions of parties other than the CO shall be borne by the Contractor.

G. REPORTING REQUIREMENTS

1. The Contractor shall provide the Contracting Officer Representative (COR) with monthly written progress reports. Monthly reports are due to the COR no later than the fifth business day of the month. The Program Management Review (PMR), unless otherwise specified by the COR will be held the second Tuesday or Wednesday of each month as designated by the COR throughout the project’s duration. The PMR slides are due to the COR no later than three business days prior to the scheduled monthly PMR.

2. The Contractor shall provide the COR with the following reports initially within 15 business days after completion of the kickoff meeting, and thereafter biweekly delivered via email. Required biweekly documentation consists of:

Work Breakdown Structure and Schedule updated and submitted to include task breakdown to the fourth level of detail, milestones, ODC pre-approval dates, and travel pre-approval dates. The WBSS shall delivered to the COR in Microsoft Project ™ format and a PowerPoint ™ format.

3. The progress report shall cover all work completed during the preceding month and shall present the work to be accomplished during the subsequent month. This report shall also identify any problems during the conversion / migration of course content period concentrating on problems that arose and a statement explaining how the problem was resolved. This report shall also identify any problems that have arisen but have not been completely resolved with an explanation. The report shall also provide complete, detailed financial reports.

H. TRAVEL

Travel is required for the conduct of training for VBA designated staff addressed in this Statement of Work. The Government estimates a maximum of 3 trips for one contractor supporting General Training and implementation at the VBAFC, Hines IL, the ALAC, Austin TX, and OFM, Washington D.C. Coordination for actual training events date, time and schedule will be discussed at the Kick – off meeting. Travel requirements may change due to a number of factors, such as project requirements resulting from analysis, or changes in location of travel due to VBA operational requirements. Travel and per diem shall be reimbursed in accordance with Federal Acquisition Regulation Part 31.206-45. Each contractor invoice must include copies of all receipts that support the travel costs claimed in the invoice. Travel must be pre-approved by the COR prior to scheduling actual travel arrangements. Travel must be priced separately in the price schedule. Local travel within a 50-mile radius from the contractor’s facility is considered the cost of doing business and will not be reimbursed. This includes travel, subsistence, and associated labor charges for travel time. Travel performed for personal convenience and daily travel to and from work at the contractor’s facility will not be reimbursed. Travel, subsistence, and associated labor charges for travel time for travel beyond a 50-mile radius of the contractor’s facility are authorized on a case-by-case basis and must be pre-approved by the COR

I. GOVERNMENT RESPONSIBILITIES

The Government will provide access to VBA procedural guides, reference materials, field sites, and named Administrators and trainee personnel required for user training and support.

J. CONTRACTOR EXPERIENCE REQUIREMENTS – KEY PERSONNEL

K. Contractor Personnel Security All contract employees who require access to the VA site(s) and/or access to VA local area network (LAN) systems shall be the subject of a background investigation and must receive a favorable adjudication from the VA Security and Investigations Center (SIC). These requirements are applicable to all subcontractor personnel requiring the same level of Background Investigation.

The level of background security investigation will be in accordance with VA Directive 0710 dated September 10, 2004 and is available at http://www1.va.gov/vapubs/viewPublication.asp?Pub_ID=487&FType=2

Background Investigation The contract employee level of background investigation required for this effort is: NACI.

Contractor Responsibilities

1. Immediately after contract award, the COR will provide the Contractor with the following background investigation documents to be completed by the Contractor and returned to the COR to begin the background investigation process for all contract employees working on the contract who will have access to VA facilities, VA systems, or privacy data:

a. Background Investigation Request Worksheet

b. Optional Form 306 – Declaration of Federal Employment

c. Fingerprint Request Form

2. Upon receipt of the above-stated documents from the COR, the VSC will perform preliminary onboarding review and process the request through the SIC. Upon notification of favorable fingerprint results by the VSC, the contractor may begin work while the background investigation is ongoing. Thereafter, the Contractor will receive an email notification from the SIC identifying the website link that includes detailed instructions regarding completion of the background clearance application process in the Electronic Questionnaires for Investigations Processing (e-QIP) system. E-QIP is an online, Internet accessible system where the contractor employee shall complete the security questionnaire required for OPM to process the background investigation.

3. Contractors who have a current favorable background investigation previously conducted by OPM or Defense Security Service (DSS) may be accepted through reciprocation. When a previous clearance is currently held, it does not preclude the vendor from submitting a complete Background Investigation Package as stated above to the COR immediately after contract award for all contract employees who will be working on the contract.

4. The Contractor shall prescreen all personnel who require access to VA site(s) and/or access to VA LAN systems to ensure they maintain a U.S. citizenship or Alien Registration that authorizes them to work in the U.S. and are able to read, write, speak and understand the English language.

5. Contract performance shall not commence before:

· The VSC has confirmed favorable fingerprint results, or

· SIC confirms that it has received the Contractor’s investigative documents, the documents are complete, and that the investigation information has been released to OPM for scheduling of the background investigation, or

· VSC or the SIC has confirmed that the verified investigation will be reciprocated.

6. The COR will notify and forward the Contractor a copy of the Certificate of Eligibility (Form 4236) if the investigation has been reciprocated. The Contractor, if notified of an unfavorable adjudication by the Government, shall withdraw the employee from consideration from working under the contract. Failure to comply with the Contractor personnel security requirements may result in termination of the contract for default.

7. The Contractor shall be responsible for the actions of those contract and subcontract employees they provide to perform work for VA. In the event damage arises from work performed by Contractor personnel, under the auspices of the contract, the Contractor will be responsible for resources necessary to remedy the incident.

8. Should the Contractor use a vendor other than OPM or DSS to conduct investigations, the investigative company must be certified by OPM/DSS to conduct Contractor investigations. The Vendor Cage Code number must be provided to the VA SIC, which will verify the information and conclude whether access to the Government’s site(s) and/or VA LAN systems can be granted.

9. The investigative history for Contractor personnel working under this contract must be maintained in the databases of either OPM or the Defense Industrial Security Clearance Organization (DISCO).

Government Responsibilities

1. After the SIC has adjudicated the background investigation package from the Contractor, the SIC will send an e-mail notification to the Contractor and their POC identifying the e-QIP website link that includes detailed instructions regarding completion of the background clearance application process and the level of background that was requested.

2. Upon receipt of required investigative documents, SIC will review the investigative documents for completion and initiate the background investigation by forwarding the investigative documents to OPM to conduct the background investigation. If the investigative documents are not complete, the SIC will notify the vendor of deficiencies and include corrective instructions.

3. VA will pay for investigations and reciprocals processed through the VA SIC and conducted by OPM in advance, however, the Contractor shall reimburse the full cost of background investigations/reciprocals to VA within 30 days of Bill of Collections from VA. VA shall send up to three plus one final delinquent notice to the Contractor. If the Contractor does not adhere to the Bill of Collections, future invoices may be subject to be offset by VA to recoup background investigation costs and may be considered grounds for default.

4. The COR will notify and forward the Contractor a copy of the Certificate of Investigation when the background investigation has been favorably adjudicated or a Certificate of Eligibility (Form 4236) if the investigation has been reciprocated. The COR will also notify the Contractor of an unfavorable adjudication by the Government.

L. CONFIDENTIALITY AND NONDISCLOSURE

It is agreed that:

1. The preliminary and final deliverables and all associated working papers, application source code, and other material deemed relevant by the VA which has been generated by the Contractor in the performance of this contract are the exclusive property of the U.S. Government and shall be submitted to the COR at the conclusion of the contract.

2. The CO will be the sole authorized official to release verbally or in writing, any data, the draft deliverables, the final deliverables, or any other written or printed materials pertaining to this contract. No information shall be released by the contractor. Any request for information relating to this contract presented to the contractor shall be submitted to the CO for response.

3. Press releases, marketing material or any other printed or electronic documentation related to this project, shall not be publicized without the written approval of the CO.

Space Left Blank Intentionally

REQUEST FOR QUOTATION - 36C10E19Q0249

SECTION C - CONTRACT CLAUSES

INFORMATION SECURITY REQUIREMENTS

C.1 IT CONTRACT SECURITY

VA INFORMATION AND INFORMATION SYSTEM SECURITY/PRIVACY

1. GENERAL

Contractors, contractor personnel, subcontractors, and subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security.

2. ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS

a. A contractor/subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order.

b. All contractors, subcontractors, and third-party servicers and associates working with VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures.

c. Contract personnel who require access to national security programs must have a valid security clearance. National Industrial Security Program (NISP) was established by Executive Order 12829 to ensure that cleared U.S. defense industry contract personnel safeguard the classified information in their possession while performing work on contracts, programs, bids, or research and development efforts. The Department of Veterans Affairs does not have a Memorandum of Agreement with Defense Security Service (DSS). Verification of a Security Clearance must be processed through the Special Security Officer located in the Planning and National Security Service within the Office of Operations, Security, and Preparedness.

d. Custom software development and outsourced operations must be located in the U.S. to the maximum extent practical. If such services are proposed to be performed abroad and are not disallowed by other VA policy or mandates, the contractor/subcontractor must state where all non-U.S. services are provided and detail a security plan, deemed to be acceptable by VA, specifically to address mitigation of the resulting problems of communication, control, data protection, and so forth. Location within the U.S. may be an evaluation factor.

e. The contractor or subcontractor must notify the Contracting Officer immediately when an employee working on a VA system or with access to VA information is reassigned or leaves the contractor or subcontractor's employ. The Contracting Officer must also be notified immediately by the contractor or subcontractor prior to an unfriendly termination.

3. VA INFORMATION CUSTODIAL LANGUAGE

a. Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the contractor/subcontractor's rights to use data as described in Rights in Data - General, FAR 52.227-14(d) (1).

b. VA information should not be co-mingled, if possible, with any other data on the contractors/subcontractor's information systems or media storage systems in order to ensure VA requirements related to data protection and media sanitization can be met. If co-mingling must be allowed to meet the requirements of the business need, the contractor must ensure that VA's information is returned to the VA or destroyed in accordance with VA's sanitization requirements. VA reserves the right to conduct on site inspections of contractor and subcontractor IT resources to ensure data security controls, separation of data and job duties, and destruction/media sanitization procedures are in compliance with VA directive requirements.

c. Prior to termination or completion of this contract, contractor/ subcontractor must not destroy information received from VA, or gathered/ created by the contractor in the course of performing this contract without prior written approval by the VA. Any data destruction done on behalf of VA by a contractor/subcontractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self-certification by the contractor that the data destruction requirements above have been met must be sent to the VA Contracting Officer within 30 days of termination of the contract.

d. The contractor/subcontractor must receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with the terms of the contract and applicable Federal and VA information confidentiality and security laws, regulations and policies. If Federal or VA information confidentiality and security laws, regulations and policies become applicable to the VA information or information systems after execution of the contract, or if NIST issues or updates applicable FIPS or Special Publications (SP) after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations and policies in this contract.

e. The contractor/subcontractor shall not make copies of VA information except as authorized and necessary to perform the terms of the agreement or to preserve electronic information stored on contractor/subcontractor electronic storage media for restoration in case any electronic equipment or data used by the contractor/subcontractor needs to be restored to an operating state. If copies are made for restoration purposes, after the restoration is complete, the copies must be appropriately destroyed.

f. If VA determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12.

g. If a VHA contract is terminated for cause, the associated BAA must also be terminated and appropriate actions taken in accordance with VHA Handbook 1600.01, Business Associate Agreements. Absent an agreement to use or disclose protected health information, there is no business associate relationship.

h. The contractor/subcontractor must store, transport, or transmit VA sensitive information in an encrypted form, using VA-approved encryption tools that are, at a minimum, FIPS 140-2 validated.

i. The contractor/subcontractor's firewall and Web services security controls, if applicable, shall meet or exceed VA's minimum requirements. VA Configuration Guidelines are available upon request.

j. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor/subcontractor may use and disclose VA information only in two other situations: (i) in response to a qualifying order of a court of competent jurisdiction, or (ii) with VA's prior written approval. The contractor/subcontractor must refer all requests for, demands for production of, or inquiries about, VA information and information systems to the VA contracting officer for response.

k. Notwithstanding the provision above, the contractor/subcontractor shall not release VA records protected by Title 38 U.S.C. 5705, confidentiality of medical quality assurance records and/or Title 38 U.S.C. 7332, confidentiality of certain health records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse, or infection with human immunodeficiency virus. If the contractor/subcontractor is in receipt of a court order or other requests for the above mentioned information, that contractor/subcontractor shall immediately refer such court orders or other requests to the VA contracting officer for response.

l. For service that involves the storage, generating, transmitting, or exchanging of VA sensitive information but does not require C&A or an MOU-ISA for system interconnection, the contractor/subcontractor must complete a Contractor Security Control Assessment (CSCA) on a yearly basis and provide it to the COR.

4. INFORMATION SYSTEM DESIGN AND DEVELOPMENT

a. Information systems that are designed or developed for or on behalf of VA at non-VA facilities shall comply with all VA directives developed in accordance with FISMA, HIPAA, NIST, and related VA security and privacy control requirements for Federal information systems. This includes standards for the protection of electronic PHI, outlined in 45 C.F.R. Part 164, Subpart C, information and system security categorization level designations in accordance with FIPS 199 and FIPS 200 with implementation of all baseline security controls commensurate with the FIPS 199 system security categorization (reference Appendix D of VA Handbook 6500, VA Information Security Program). During the development cycle a Privacy Impact Assessment (PIA) must be completed, provided to the COR, and approved by the VA Privacy Service in accordance with Directive 6507, VA Privacy Impact Assessment.

b. The contractor/subcontractor shall certify to the COR that applications are fully functional and operate correctly as intended on systems using the VA Federal Desktop Core Configuration (FDCC), and the common security configuration guidelines provided by NIST or the VA. This includes Internet Explorer 7 configured to operate on Windows XP and Vista (in Protected Mode on Vista) and future versions, as required.

c. The standard installation, operation, maintenance, updating, and patching of software shall not alter the configuration settings from the VA approved and FDCC configuration. Information technology staff must also use the Windows Installer Service for installation to the default "program files" directory and silently install and uninstall.

d. Applications designed for normal end users shall run in the standard user context without elevated system administration privileges.

e. The security controls must be designed, developed, approved by VA, and implemented in accordance with the provisions of VA security system development life cycle as outlined in NIST Special Publication 800-37, Guide for Applying the Risk Management Framework to Federal Information Systems, VA Handbook 6500, Information Security Program and VA Handbook 6500.5, Incorporating Security and Privacy in System Development Lifecycle.

f. The contractor/subcontractor is required to design, develop, or operate a System of Records Notice (SOR) on individuals to accomplish an agency function subject to the Privacy Act of 1974, (as amended), Public Law 93-579, December 31, 1974 (5 U.S.C. 552a) and applicable agency regulations. Violation of the Privacy Act may involve the imposition of criminal and civil penalties.

g. The contractor/subcontractor agrees to:

(1) Comply with the Privacy Act of 1974 (the Act) and the agency rules and regulations issued under the Act in the design, development, or operation of any system of records on individuals to accomplish an agency function when the contract specifically identifies:

(a) The Systems of Records (SOR); and

(b) The design, development, or operation work that the contractor/ subcontractor is to perform;

(1) Include the Privacy Act notification contained in this contract in every solicitation and resulting subcontract and in every subcontract awarded without a solicitation, when the work statement in the proposed subcontract requires the redesign, development, or operation of a SOR on individuals that is subject to the Privacy Act; and

(2) Include this Privacy Act clause, including this subparagraph (3), in all subcontracts awarded under this contract which requires the design, development, or operation of such a SOR.

h. In the event of violations of the Act, a civil action may be brought against the agency involved when the violation concerns the design, development, or operation of a SOR on individuals to accomplish an agency function, and criminal penalties may be imposed upon the officers or employees of the agency when the violation concerns the operation of a SOR on individuals to accomplish an agency function. For purposes of the Act, when the contract is for the operation of a SOR on individuals to accomplish an agency function, the contractor/subcontractor is considered to be an employee of the agency.

(1) "Operation of a System of Records" means performance of any of the activities associated with maintaining the SOR, including the collection, use, maintenance, and dissemination of records.

(2) "Record" means any item, collection, or grouping of information about an individual that is maintained by an agency, including, but not limited to, education, financial transactions, medical history, and criminal or employment history and…