36C10G18Q9140-0003017.docx

ATTACHMENT 1

SUBJECT : QUESTIONS/ANSWERS

RFQ No : 36C10G18Q9140 OPTION - Dental Patient Satisfaction Survey

ATTACHMENT 1

SUBJECT: QUESTIONS/ANSWERS

RFQ No: 36C10G18Q9140 OPTION - Dental Patient Satisfaction Survey

In real time as they are received

With GPO doing the printing and mailing of the surveys (including pre-paid postage BREs), could the government please confirm whether Offerors need to include an estimated return postage amount of the BRE returning to the Offeror or if the BRE return postage costs will also be linked to an account held by the GPO?

Please see the attached GPO contract

Buyer Item No. 1 Question

1. Does approximately 231 site level mean 231 dental office locations?

2. What is the definition of FTE? Is it Full Time Equivalent?

3. What is the definition of DDS? Is it Doctor of Dental Surgery?

4. Please explain DDS 45/year, 2-3 DDS 120/yr., etc. I need to determine the estimated volume of surveys.

Buyer Item No. 1 Response

1. Yes

2. Yes, Full Time Employee or Full Time Employee Equivalent

3. Yes

4. The sampling methodology is stated in the PWS

Buyer Item No. 2 Question

1. Is the requirement to have the surveys emailed to patients after the service is completed or is the patient to complete the survey before leaving the office with the use of a tablet or other mobile device?

2. For the reporting tool, is multichannel access required, such as web and an app?

3. Is it a requirement for each dental office location to have access to the web portal to review reports?

Buyer Item No. 2 Response

1. Survey is mailed via USPS

2. Yes

3. Yes

1. For the Benchmarking, will the VHS supply the data it wants to compare and benchmark against, such as age, race, gender, geographic location, etc.? How will the 1000 civilians be identified?

1. Gender, Self-reported Race, Hispanic Ethnicity, Age Group, Self-Reported Health Status, Self-Reported Dental Health Status and Self-Reported Education. The offeror will create a custom external referent benchmark for the DPSS.

Can offerors use GSA PSS Schedule 874-1 (formerly MOBIS) to respond to this solicitation?

Yes, you are able to provide a quote utilizing your GSA PSS Schedule 874-1 if you believe this pricing is most advantageous to the Government. However, please note that this solicitation is listed as full and open, and vendors can submit non-contract pricing.

/////////////////////////////////////////// LAST LINE & END OF DOCUMENT //////////////////////////////////////////// image1.emf

284-S.PDF

Program 284-S Page 1 of 41

Specifications by DLL

Reviewed by AGENCY

U.S. GOVERNMENT PUBLISHING OFFICE

Washington, DC

GENERAL TERMS, CONDITIONS, AND SPECIFICATIONS

For the Procurement of

VA Survey Mailers as requisitioned from the U.S. Government Publishing Office (GPO) by the

U.S. Department of Veterans Affairs (VA)

Single Award

TERM OF CONTRACT: The term of this contract is for the period beginning Date of Award and ending

January 31, 2019, plus up to four (4) optional 12-month extension period(s) that may be added in accordance with the "OPTION TO EXTEND THE TERM OF THE CONTRACT" clause in Section 1 of this contract.

BID OPENING: Bids shall be publicly opened at 11:00 a.m., prevailing Washington, DC time, on December 8, 2017.

Required post-award implementation and certification of VA security requirements will take place from

Date of Award through January 31, 2018 or later. Actual production begins upon completion of the certification, no earlier than February 1, 2018.

BID SUBMISSION: Submit bid in pre-addressed envelope furnished with solicitation or send to: U.S.

Government Publishing Office, Bid Section, Room C-848, Stop: CSPS, 732 North Capitol Street, NW, Washington, DC 20401. Facsimile bids in response to this solicitation are permitted. Facsimile bids may be submitted directly to the GPO Bid Section, Fax No. (202) 512-1782. The program number and bid opening date must be specified with the bid. Refer to Facsimile Bids in Solicitation Provisions of GPO Contract Terms, GPO

Publication 310.2, as revised June 2001. Hand delivered bids are to be taken to: GPO Bookstore, 710 North

Capitol Street, NW, Washington, DC, between the hours of 8:00 a.m. and 4:00 p.m., prevailing Washington, DC, time, Monday through Friday. The contractor is to follow the submission instructions posted in the Bid

Submission/Opening area. If further instruction or assistance is required, call (202) 512-0526.

BIDDERS, PLEASE NOTE: These specifications have been extensively revised; therefore, all bidders are cautioned to familiarize themselves with all provisions of these specifications before bidding.

Abstracts of contract prices are available at https://www.gpo.gov/how-to-work-with-us/vendors/contract-pricing

For information of a technical nature call David Love (202) 512-0310 (No collect calls).

VA Survey Mailers Page 2 of 41

284-S (01/19)

SECTION 1. - GENERAL TERMS AND CONDITIONS

GPO CONTRACT TERMS: Any contract which results from this Invitation for Bid will be subject to the applicable provisions, clauses, and supplemental specifications of GPO Contract Terms (GPO Publication 310.2, effective

December 1, 1987 (Rev. 6-01)) and GPO Contract Terms, Quality Assurance through Attributes Program for Printing and Binding (GPO Publication 310.1, effective May 1979 (Rev. August 2002)).

GPO Contract Terms (GPO Publication 310.2) – https://www.gpo.gov/docs/default-source/forms-and-standards-files-for-vendors/terms.pdf.

GPO QATAP (GPO Publication 310.1) – https://www.gpo.gov/docs/default-source/forms-and-standards-files-for-vendors/qatap.pdf.

DISPUTES: GPO Publication 310.2, GPO Contract Terms, Contract Clause 5. Disputes, is hereby replaced with the June 2008 clause found at: ttps://www.gpo.gov/docs/default-source/forms-and-standards-files-for-vendors/contractdisputes.pdf.

SUBCONTRACTING: Subcontracting is allowed for manufacturing of the envelopes only.

GPO IMPRINT REQUIREMENTS: The GPO imprint requirement, GPO Contract Terms, Supplemental

Specifications, No. 9, is waived.

QUALITY ASSURANCE LEVELS AND STANDARDS: The following levels and standards shall apply to these specifications:

Product Quality Levels:

(a) Printing (page related) Attributes -- Level III.

(b) Finishing (item related) Attributes -- Level III.

(c) Exception: For F-1. Trim Size: Level I applies – On surveys a variance of no more than 1/16” or less on either side of the 11” dimension is allowed; final product cannot be larger than 8-1/2 x 11”.

(d) Exception: For P-5. Text and Illustration Image Position: Level II applies.

Inspection Levels (from ANSI/ASQC Z1.4):

(a) Non-destructive Tests - General Inspection Level I.

(b) Destructive Tests - Special Inspection Level S-2.

Specified Standards: The specified standards for the attributes requiring them shall be:

Attribute Specified Standard

P-7. Type Quality and Uniformity O.K. Proofs/Average type dimension/

Electronic media

P-9. Solid and Screen Tint Color Match Pantone Matching System

Prior to award, contractor may be required to provide information related to specific equipment that will be used for production.

OPTION TO EXTEND THE TERM OF THE CONTRACT: The Government has the option to extend the term of this contract for a period of 12 months by written notice to the contractor not later than 30 days before the contract expires. If the Government exercises this option, the extended contract shall be considered to include this clause, except, the total duration of the contract may not exceed five (5) years as a result of, and including, any extension(s) added under this clause. Further extension may be negotiated under the “EXTENSION OF CONTRACT TERM” clause. See also “ECONOMIC PRICE ADJUSTMENT” for authorized pricing adjustment(s).

VA Survey Mailers Page 3 of 41

EXTENSION OF CONTRACT TERM: At the request of the Government, the term of any contract resulting from this solicitation may be extended for such period of time as may be mutually agreeable to the GPO and the contractor.

ECONOMIC PRICE ADJUSTMENT: The pricing under this contract shall be adjusted in accordance with this clause, provided that in no event will any pricing adjustment be made that would exceed the maximum permissible under any law in effect at the time of the adjustment.

There will be no adjustment for orders placed during the first period specified below. Pricing will thereafter be eligible for adjustment during the second and any succeeding performance period(s). For each performance period after the first, a percentage figure will be calculated as described below and that figure will be the economic price adjustment for that entire next period. Pricing adjustments under this clause are not applicable to reimbursable postage or transportation costs, or to paper, if paper prices are subject to adjustment by separate clause elsewhere in this contract.

For the purpose of this clause, performance under this contract will be divided into successive periods. The first period will extend from Date of Award to January 31, 2019 and the second and any succeeding period(s) will extend for

12 months from the end of the last preceding period, except that the length of the final period may vary. The first day of the second and any succeeding period(s) will be the effective date of the economic price adjustment for that period.

Pricing adjustments in accordance with this clause will be based on changes in the seasonally adjusted “Consumer

Price Index For All Urban Consumers - Commodities Less Food” (Index) published monthly in the CPI Detailed

Report by the U.S. Department of Labor, Bureau of Labor Statistics.

The economic price adjustment will be the percentage difference between Index averages as specified in this paragraph. An index called the variable index will be calculated by averaging the monthly Indexes from the 12-month interval ending three (3) months prior to the beginning of the period being considered for adjustment. This average is then compared to the average of the monthly Indexes for the 12-month interval ending October 31, 2017, called the base index. The percentage change (plus or minus) of the variable index from the base index will be the economic price adjustment for the period being considered for adjustment.

The Government will notify the contractor by contract modification specifying the percentage increase or decrease to be applied to invoices for orders placed during the period indicated. The contractor shall apply the percentage increase or decrease against the total price of the invoice less reimbursable postage or transportation costs and separately adjusted paper prices. Payment discounts shall be applied after the invoice price is adjusted.

If the Government exercises an option, the extended contract shall be considered to include this economic price adjustment clause.

Note: Economic price adjustments are not cumulative and are to be applied to original bid prices only.

SECURITY – PRIVACY REQUIREMENTS:

General - All contractors and contractor personnel shall be subject to the Federal laws, regulations, standards and VA

Directives and Handbooks, regarding information system security as delineated in this contract. Contractors must follow policies and procedures outlined in VA Directive 6500, Information Security Program and its handbooks to ensure appropriate security controls are in place.

SECURITY REQUIREMENTS: Protection of Confidential Information

(a) The contractor shall restrict access to all confidential information obtained from the Department of Veterans

Affairs in the performance of this contract to those employees and officials who need it to perform the contract.

Employees and officials who need access to confidential information for performance of the contract will be determined at the Post-Award Conference between the Contracting Officer and the responsible contractor representative.

(b) The contractor shall process all confidential information obtained from VA in the performance of this contract under the immediate supervision and control of authorized personnel, and in a manner that will protect the confidentiality of the records in such a way that unauthorized persons cannot retrieve any such records.

VA Survey Mailers Page 4 of 41

(c) The contractor shall inform all personnel with access to the confidential information obtained from VA in the performance of this contract of the confidential nature of the information and the safeguards required to protect this information from improper disclosure.

(d) For knowingly disclosing information in violation of the Privacy Act, the contractor and the contractor employees may be subject to the criminal penalties as set forth in 5 U.S.C Section 552a (i)(1), which is made applicable to contractors by 5 U.S.C. 552a (m)(1) to the same extent as employees of the VA. For knowingly disclosing confidential information as described in section 1106 of the Social Security Act (42 U.S.C. 1306), the contractor and contractor’s employees may also be subject to the criminal penalties as set forth in that provision.

(e) The contractor shall assure that each contractor employee with access to confidential information knows the prescribed rules of conduct, and that each contractor employee is aware that he/she may be subject to criminal penalties for violations of the Privacy Act.

(f) All confidential information obtained from VA for use in the performance of this contract shall, at all times, be stored in an area that is physically safe from unauthorized access. (See “PRE-AWARD SURVEY, Security

Control Plan - Production Area” for more information.)

(g) The Government reserves the right to conduct on-site visits to review the contractor’s documentation and in-house procedures for protection of confidential information. (See “PRE-AWARD SURVEY” for more information.)

SECURITY REQUIREMENTS:

This contract has been designated Public Trust Position Level 1 (Limited). Due to the sensitive nature of the information contained in the products produced under this contract, contractor employees performing under this contract will be subject to a thorough civil and criminal background check. “Performing under this contract” is defined as working on-site at a VA facility (including visiting the VA site for any reason) or having access to Government programmatic or sensitive information.

The contractor shall submit a completed Background Investigation Request Worksheet (Attachment A) for each contractor employee who will be working on this contract within seven (7) calendar days of contract award. VA will process all required background checks. Contractor employees are required to be fingerprinted within 14 calendar days of contract award, unless otherwise notified by VA. It is the responsibility of the contractor to ensure fingerprint cards are processed through their local police departments or other authorized fingerprinters. VA will provide additional information on fingerprinting requirements at contract award.

The general requirements as listed above are required of any new and current contractor employees performing contract work, and any project supervisors and management officials who have access to Government sensitive information.

The contractor is responsible for updating the background investigation template as personnel are added to the contract. The contractor must submit the updated roster to the Contracting Officer within seven (7) calendar days after the added personnel are approved by VA. The background investigation forms and fingerprinting must be completed within seven (7) calendar days of the personnel being added to the contract.

Access to VA Information and VA Information System –

1. A contractor shall request logical (technical) and/or physical access to VA information and VA information systems for employees only to the extent necessary: (1) to perform the services specified in the contract; (2) to perform necessary maintenance functions for electronic storage or transmission media necessary for performance of the contract; and, (3) for individuals who first satisfy the same conditions, requirements and restrictions that comparable VA employees must meet in order to have access to the same type of VA information.

VA Survey Mailers Page 5 of 41

2. All contractor employees working with VA Sensitive Information are subject to the same investigative requirements as those of regular VA appointees or employees who have access to the same types of information. The level of background security investigation will be in accordance with VA Directive 0710, Handbook 0710, which are available at: http://www1.va.gov/vapubs/, and VHA Directive 0710 and implementing Handbook 0710.01 which are available at: http://www1.va.gov/vhapublications/index.cfm.

Contractors are responsible for screening their employees. The following are VA’s approved policy exceptions for meeting VA’s background screenings/investigative requirements for certain types of contractors:

Contract personnel not accessing VA information resources such as personnel hired to maintain the medical facility grounds; construction contracts; utility system contractors; etc.

Contract personnel with limited and intermittent access to equipment connected to facility networks on which no VA sensitive information is available, including contractors who install, maintain, and repair networked building equipment, such as fire alarm; heating, ventilation, and air conditioning equipment;

elevator control systems, etc. If equipment to be repaired is located within sensitive areas of a VA facility

(e.g., computer room/communications closets), VA IT staff must escort contractors while on site.

Contract personnel with limited and intermittent access to equipment connected to facility networks on which limited VA sensitive information may reside including medical equipment. Contractors who install, maintain, and repair networked medical equipment such as CT scanners, EKG systems, ICU monitoring, etc. In this case, Veterans Health Administration facilities must have a duly executed VA business associate agreement (BAA) in place with the contractor in accordance with the VHA Handbook

1600.01, Business Associates, to assure compliance with the Health Insurance Portability and

Accountability Act of 1996 (HIPAA) in addition to this contract. Contract personnel, if on site, must be escorted by VA IT staff.

3. Contract personnel who require access to national security programs must have a valid security clearance.

The National Industrial Security Program (NISP) was established by Executive Order 12829 to ensure that cleared U.S. defense industry safeguards the classified information in their possession while performing work on contracts, programs, bids, or research and development efforts. Defense Security Service (DSS) administers the NISP on behalf of the Department of Defense and 23 other federal agencies within the

Executive Branch. VA will verify clearance through DSS.

VA Information Custodial Requirements –

1. Information made available to the contractor by VA for the performance and/or administration of this contract or information developed by the contractor in performance and/or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the

Contracting Officer. This clause expressly limits the contractor’s rights to use data as described in Rights in

Data - General, Federal Acquisition Regulation (FAR) 52.227-14(d) (1).

2. Information generated by a contractor as a part of the contractor’s normal business operations, such as medical records created in the course of providing treatment, is subject to a review by the Office of General Counsel

(OGC) to determine if the information is the property of VA and subject to VA policy. If the information is determined by OGC to not be the property of VA, the restrictions required for VA information will not apply.

3. VA information will NOT be commingled with any other data on the contractor’s information systems/media storage systems in order to ensure VA requirements related to data protection and media sanitization can be met. VA also reserves the right to conduct IT resource inspections to ensure data separation and on-site inspection of information destruction/media sanitization procedures to ensure they are in compliance with VA policy requirements.

4. Prior to termination or completion of this contract, the contractor will not destroy information received from

VA or gathered or created by the contractor in the course of performing this contract without prior written approval by VA.

http://www1.va.gov/vapubs/ http://www1.va.gov/vhapublications/index.cfm

VA Survey Mailers Page 6 of 41

Any data destruction done on behalf of VA by a contractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and

Information Management and its Handbook 6300.1 Records Management Procedures, and applicable VA

Records Control Schedules. These Directives are available at: http://www1.va.gov/vapubs/.

5. The contractor will receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with the terms of the contract and applicable Federal and VA information confidentiality and security laws, regulations and policies. Applicable Federal information security regulations include all Federal

Information Processing Standards (FIPS) and Special Publications (SP) issued by the National Institute of

Standards and Technology (NIST). If Federal or VA information confidentiality and security laws, regulations and policies become applicable to the VA information or information systems after execution of the contract, or if NIST issues or updates applicable FIPS after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations and policies, including FIPS or SP, in this contract.

6. Contractors collecting, storing, or disseminating personal identifiable information (PII) or protected health information (PHI) data must conform to all pertinent regulations, laws, and VA directives related to privacy.

Contractors must provide access for VA privacy reviews and assessments and provide appropriate documentation as directed.

Note: Personally identifiable information is defined as any information which can be used to distinguish or trace and individual’s identity, such as their name, social security number, Veterans identification number, biometric records, etc., alone or when combined with other personal or identifying information which is linked or linkable to a specific individual, such as date and place of birth, mother’s maiden name, etc.

7. The contractor shall not make copies of VA information except as necessary to perform the terms of the agreement or to preserve electronic information stored on contractor electronic storage media for restoration in case any electronic equipment or data used by the contractor needs to be restored to an operating state.

8. If VA determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for the Government to terminate the contract for default or terminate for cause under the GPO Printing Procurement Regulations (GPO Publication 305.3).

9. If a Veterans Health Administration (VHA) contract is terminated for cause, the associated business associate agreement (BAA) will also be terminated and appropriate actions taken in accordance with VHA Handbook

1600.01 Business Associates.

10. Contractor will store, transport or transmit VA sensitive information in an encrypted form, using a VA-approved encryption application that meets the requirements of NIST’s FIPS 140-2 standard.

11. The contractor’s firewall and Web services security controls, if applicable, shall meet or exceed VA’s minimum requirements. VA directives are available on the VA directives Web site at http://www1.va.gov/vapubs/.

12. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor may use and disclose VA information only in two other situations: (1) in response to a qualifying order of a court of competent jurisdiction; or, (2) with VA’s prior written approval. The contractor will refer all requests for, demands for production of, or inquiries about, VA information and information systems to VA for response.

13. Notwithstanding the provision above, the contractor shall NOT release medical quality assurance records protected by 38 U.S.C. 5705 or records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse, or infection with human immunodeficiency virus protected under 38 U.S.C. 7332 under any circumstances, including in response to a court order, and shall immediately refer such court orders or other inquiries to VA for response.

14. The contractor will not use technologies banned in VA in meeting the requirements of the contract (e.g., Bluetooth enabled devices).

VA Survey Mailers Page 7 of 41

Information System Design and Development –

1. Information systems that are designed or developed for, or on behalf of, VA at non-VA facilities shall comply with all VA policies developed in accordance with Federal Information Security Management Act (FISMA), Health Insurance Portability and Accountability Act (HIPAA), NIST, and related VA security and privacy control requirements for Federal information systems. This includes standards for the protection of electronic PHI, outlined in 45 C.F.R. Part 164, Subpart C, information and system security categorization level designations in accordance with FIPS 199 and FIPS 200 with implementation of all baseline security controls commensurate with the FIPS 199 system security categorization (reference Appendix D of VA Handbook 6500, VA Information Security Program). During the development cycle, a privacy impact assessment will be completed, provided to the VA representative, and approved by the VA Privacy Service in accordance with VA Privacy Impact Assessment Handbook 6500.3.

2. The security controls must be designed, developed, approved by VA, and implemented in accordance with the provisions of VA security system development life cycle as outlined in NIST Special Publication 800-37 and VA Handbook 6500.

3. The contractor will be required to design, develop, or operate a System of Records on individuals to accomplish an agency function subject to the Privacy Act of 1974, (as amended), Public Law 93-579, December 31, 1974 (5 U.S.C.552a) and applicable agency regulations. Violation of the Privacy Act may involve the imposition of criminal and civil penalties.

Note: Contractor is to retain records for a period of no less than 120 calendar days subsequent to the date of the check tendered for final payment by the GPO.

4. The contractor agrees to –

a. Comply with the Privacy Act of 1974 (the Act) and the agency rules and regulations issued under the Act in the design, development, or operation of any system of records on individuals to accomplish an agency function when the contract specifically identifies the systems of records; and the design, development, or operation work that the contractor is to perform;

b. Include the Privacy Act notification contained in this contract in every solicitation and resulting subcontract and in every subcontract awarded without a solicitation, when the work statement in the proposed subcontract requires the redesign, development, or operation of a system of records on individuals that is subject to the Act; and,

c. Include this Privacy Act clause, including this subparagraph (3), in all subcontracts awarded under this contract which requires the design, development, or operation of such a system of records.

5. In the event of violations of the Act, a civil action may be brought against the agency involved when the violation concerns the design, development, or operation of a system of records on individuals to accomplish an agency function, and criminal penalties may be imposed upon the officers or employees of the agency when the violation concerns the operation of a system of records on individuals to accomplish an agency function. For purposes of the Act, when the contract is for the operation of a system of records on individuals to accomplish an agency function, the contractor is considered to be an employee of the agency.

6. “Operation of a system of records” means performance of any of the activities associated with maintaining the system of records, including the collection, use, and dissemination of records.

7. “Record” means any item, collection, or grouping of information about an individual that is maintained by an agency, including, but not limited to, education, financial transactions, medical history, and criminal or employment history and contains the person’s name, or the identifying number, symbol, or other identifying particular assigned to the individual, such as a fingerprint or voiceprint, or a photograph.

8. “System of records on individuals” means a group of any records under the control of any agency from which information is retrieved by the name of the individual or by some identifying number, symbol, or other identifying particular assigned to the individual.

VA Survey Mailers Page 8 of 41

Information System Hosting, Operation, Maintenance and/or Use –

1. For information systems that are hosted, operated, maintained, or used on behalf of VA at non-VA facilities, contractors are fully responsible and accountable for ensuring compliance with all HIPAA, Privacy Act, FISMA, NIST, FIPS, and VA security and privacy directives and handbooks. The contractor security control procedures must be identical, not equivalent, to those procedures used to secure VA systems (see Attachment

B, “Contractor Rules of Behavior”). A privacy impact assessment (PIA) must also be provided to the VA representative and approved by VA Privacy Service prior to operational approval. All external Internet connections involving VA information must be reviewed and approved by VA prior to implementation.

2. Adequate security controls for collecting, processing, transmitting, and storing of personally identifiable information, as determined by the VA Privacy Service, must be in place, tested, and approved by VA prior to hosting, operation, maintenance, or use of the information system, or systems by or on behalf of VA. These security controls need to be stated within the PIA and supported by a risk assessment. If these controls are determined not to be in place, or inadequate, a Plan of Action and Milestones (POA&M) must be submitted and approved prior to the collection of PII.

3. Outsourcing (contractor facility/contractor equipment/contractor staff) of systems or network operations, telecommunications services, or other managed services requires certification and accreditation of the contractor’s systems in accordance with NIST Special Publication 800-37 and VA Handbook 6500 and a privacy impact assessment of the contractor’s systems prior to operation of the systems. Government-owned

(Government facility/Government equipment), contractor-operated systems, third party or business partner networks require a system interconnection agreement and a memorandum of understanding (MOU) which detail what data types will be shared, who will have access, and the appropriate level of security controls for all systems connected to VA networks.

4. The contractor must adhere to all FISMA, FIPS, and NIST standards related to the annual FISMA security controls assessment and review and update the PIA. Any deficiencies noted during this assessment must be provided to the VA Contracting Officer and the Information Security Officer (ISO) for entry into VA’s Plan of Action and Milestone management process. The contractor will use VA’s POA&M process to document planned remedial actions to address any deficiencies in information security policies, procedures, and practices, and the completion of those activities. Security deficiencies must be corrected within the timeframes approved by the Government. Contractor procedures will be subject to periodic, unannounced assessments by VA officials. The physical security aspects associated with contractor activities will also be subject to such assessments. As updates to the system occur, an updated PIA must be submitted to the VA

Privacy Service through the VA representative for approval.

5. All electronic storage media used on non-VA leased or owned IT equipment that is used to store, process, or access VA sensitive information must have all VA sensitive information removed, cleared, sanitized, or destroyed in accordance with VA policies and procedures upon: (1) completion or termination of the contract or (2) disposal or return of the IT equipment by the contractor or any person acting on behalf of the contractor, whichever is earlier.

6. Contractor must have physical and environmental security controls to protect system, buildings and related infrastructures from individuals and environmental threats. Building physical security requirements will meet or exceed the physical security standards and practices as established with VA Directives and Handbook 0730, Security and Law Enforcement. There will be an Annual physical security survey conducted. Specific requirements and options are found in VA Directive and Handbook 0730 appendix B (Agent Cashier).

Security Incident Investigation –

1. The term “security incident” means an event that has, or could have, resulted in unauthorized access to, loss of, or damage to VA assets or sensitive information, or an action that breaches VA security procedures. The contractor shall immediately notify the GPO and VA representative and simultaneously, the designated

ISO/Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor has access.

VA Survey Mailers Page 9 of 41

2. To the extent known by the contractor, the contractor’s notice to GPO and VA will identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the VA information/assets were placed at risk or compromised), and any other information that the contractor considers relevant.

3. The contractor will simultaneously report the incident to the appropriate law enforcement entity(ies) of jurisdiction, including the GPO and VA Offices of the Inspector General and Security and Law Enforcement, in instances of theft or break-in or other criminal activity. The contractor and its employees will cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The contractor will cooperate with VA in any civil litigation to recover VA information, obtain monetary, or other compensation from a third party for damages arising from any incident, or obtain injunctive relief against any third party arising from, or related to, the incident.

4. To the extent practicable, the contractor shall mitigate any harmful effects on individuals whose VA

Information was accessed or disclosed in a security incident. In the event of a data breach with respect to any

VA sensitive information processed or maintained by the contractor under the contract, the contractor is responsible for liquidated damages to be paid to VA.

5. If a security incident (as described above) occurs at the contractor’s facility, the actual damage to the

Government for the incident will be difficult or impossible to determine. Therefore, pursuant to the

“Liquidated Damages” clause (GPO Contract Terms, Publication 310.2), in lieu of actual damages, the contractor shall pay to the Government as fixed, agreed, and liquidated damages for each record, or part thereof, involved in the incident, the amount set forth below. Liquidated damages will be assessed against that record, or part thereof, which has been compromised. Liquidated damages will not be assessed against that record or part thereof that has not been compromised. The amount of damages will be computed at $37.50 per record, or part thereof, compromised; provided that the minimum amount of liquidated damages shall not be less than $5.00 for the entire order and not more than 50% of the total value of the entire order. The total damages assessed against a contractor shall in no case exceed 50% of the total value of the entire order.

Payment of an order will be withheld until evidence of steps taken to prevent the recurrence of a security incident has been taken.

Security Controls Compliance Testing –

On a periodic basis, VA, including the Office of Inspector General, reserves the right to evaluate any or all of the security controls and privacy practices implemented by the contractor under the clauses contained within this contract.

With 10 workday’s notice, at the request of the Government, the contractor will fully cooperate and assist in a

Government-sponsored security controls assessment at each location wherein VA information is processed or stored, or information systems are developed, operated, maintained, or used on behalf of VA, including those initiated by the

Office of Inspector General. The Government may conduct a security control assessment on shorter notice (to include unannounced assessments) determined by VA in the event of a security incident or at any other time.

Security Training –

1. All contractor employees requiring access to VA sensitive information and/or VA information systems shall complete the following before being granted access to VA networks or sensitive information:

Sign and acknowledge understanding of, and responsibilities for, compliance with the Contractor Rules of Behavior (Attachment B) relating to access to VA information and information systems;

Successfully complete VA Cyber Security Awareness training and annual refresher training as required;

Successfully complete VA General Privacy training and annual refresher training as required; and

Successfully complete any additional cyber security or privacy training, as required for VA personnel with equivalent information system access.

VA Survey Mailers Page 10 of 41

2. The contractor shall provide to the Contracting Officer a copy of the training certificates for each applicable employee (for the required training as stated above) within seven (7) calendar days of notification of contract award and annually thereafter, as required.

These online courses are located at the following web site: https://www.tms.va.gov.

3. Failure to complete this mandatory training within the timeframe required will be grounds for suspension or termination of all physical and/or electronic access privileges and removal from work on the contract until such time as the training is completed.

Contractor Personnel Security –

1. All contractor employees who require access to the Department of Veterans Affairs’ computer systems shall be the subject of a background investigation and must receive a favorable adjudication from the VA Security and Investigations Center (07C). The level of background security investigation shall be in accordance with

VA Directive 0710, dated May 18, 2007, and is available at:

http://www1.va.gov/vhapublications/ViewPublication.asp?pub_ID=1569 (VA Handbook 0710, Appendix A, and Tables 1 - 3).

Appropriate Background Investigation (BI) forms shall be provided upon contract award and are to be completed and returned to the VA Security and Investigations Center (07C) within three (3) calendar days for processing. Contractor shall be notified by 07C when the BI has been completed and adjudicated. If the security clearance investigation is not completed prior to the start date of the contract, the employee shall not work on the contract while the security clearance is being processed. Work will commence as soon as the contractor and the contractor employee receives an email message that states the following: “We show that the background investigation request on the individual listed below has been completed, and the case has been initiated by the Security Investigations Center.” When the case is completed, all adjudicative paperwork will be returned to the requesting office. The contractor can provide this email to the Station ISO as proof the investigation has been initiated and access can be granted. This notice does NOT ensure completion of VetPro or other required security training. Those individuals that require VetPro Credentialing or additional security training must receive those completion notifications from the proper authority prior to start date of contract.

2. The investigative history for contractor personnel working under this contract must be maintained in the databases of either the Office of Personnel Management (OPM) or the Defense Security Service (DSS).

Should the contractor use a vendor other than OPM or DSS to conduct investigations, the investigative company must be certified by OPM/DSS to conduct contractor investigations.

Background Investigation – The position sensitivity impact for this effort has been designated as Low Risk and the level of background investigation is NACI.

Contractor Responsibilities –

1. The contractor shall bear the expense of obtaining background investigations. If the investigation is conducted by OPM through the VA, the contractor shall reimburse the VA within 30 calendar days of receipt of invoice from VA.

2. Background investigations from investigating agencies other than OPM/DSS are permitted if the agencies possess an OPM and Defense Security Service certification. The Vendor Cage Code number must be provided to the Security and Investigations Center (07C), which shall verify the information and advise the Contracting

Officer whether access to the computer systems can be authorized.

3. The contractor shall prescreen all personnel requiring access to the computer systems to ensure they maintain a U.S. citizenship and are able to read, write, speak, and understand the English language.

4. After contract award but prior to contract performance, the contractor shall submit a completed Background

Investigation Request Worksheet (Attachment A) for each contractor employee who will be working on this contract.

5. The contractor, when notified of an unfavorable determination by the Government, shall withdraw the employee from consideration from working under the contract.

https://www.tms.va.gov/ http://www1.va.gov/vhapublications/ViewPublication.asp?pub_ID=1569

VA Survey Mailers Page 11 of 41

6. Failure to comply with the contractor personnel security requirements may result in termination of the contract for default.

7. Further, the contractor shall be responsible for the actions of all individuals provided to work for the VA under this contract. In the event that damages arise from work performed by contractor provided personnel, under the auspices of this contract, the contractor shall be responsible for all resources necessary to remedy the incident.

Government Responsibilities –

1. The VA Security and Investigations Center (07C) shall provide the necessary forms to the contractor or to the contractor’s employees after receiving a list of names and addresses.

2. Upon receipt, the VA Security and Investigations Center (07C) shall review the completed forms for accuracy and forward the forms to OPM to conduct the background investigation. The VA facility shall pay for investigations conducted by the OPM in advance. In these instances, the contractor shall reimburse the VA facility within 30 calendar days of receipt of invoice from VA.

3. The VA Security and Investigations Center (07C) shall notify the VA representative and contractor after adjudicating the results of the background investigations received from OPM.

4. The VA representative will ensure that the contractor provides evidence that investigations have been completed or are in the process of being requested.

ELECTRONIC AND INFORMATION TECHNOLOGY STANDARDS:

Intranet/Internet –

1. The contractor shall comply with the U.S. Department of Veterans Affairs Directive 6102 and VA Handbook

6102 (Internet/Intranet Services).

2. VA Directive 6102 sets forth policies and responsibilities for the planning, design, maintenance support, and any other functions related to the administration of a VA Internet/Intranet Service Site or related service

(hereinafter referred to as “Internet”). This directive applies to all organizational elements in the Department.

This policy applies to all individuals designing and/or maintaining VA Internet Service Sites, including but not limited to, full time and part time employees, contractors, interns, and volunteers. This policy applies to all VA Internet/Intranet domains and servers that utilize VA resources. This includes, but is not limited to, va.gov and other extensions such as, “.com, .eddo, .mil, .net, .org,” and personal Internet service pages managed from individual workstations.

3. VA Handbook 6102 establishes Department-wide procedures for managing, maintaining, establishing, and presenting VA Internet/Intranet Service Sites or related services (hereafter referred to as “Internet”). The handbook implements the policies contained in VA Directive 6102, Internet/Intranet Services. This includes, but is not limited to, File Transfer Protocol (FTP), Hypertext Markup Language (HTML), Simple Mail

Transfer Protocol (SMTP), Web pages, Active Server Pages (ASP), e-mail forums, and list servers.

4. VA Directive 6102 and VA Handbook 6102 are available at:

Internet/Intranet Services Directive 6102 http://www.va.gov/vapubs/viewPublication.asp?Pub_ID=409&FType=2

Internet/Intranet Services Handbook 6102 http://www.va.gov/vapubs/viewPublication.asp?Pub_ID=410&FType=2

5. Internet/Intranet Services Handbook 6102 Change 1 – updates VA’s cookie use policy, Section 508 guidelines, guidance on posting of Hot Topics, approved warning notices, and minor editorial errors.

Internet/Intranet Services Handbook 6102 Change 1 is available at:

6. In addition, any technologies that enable a Network Delivered Application (NDA) to access or modify resources of the local machine that are outside of the browser’s “sand box” are strictly prohibited.

http://www.va.gov/vapubs/viewPublication.asp?Pub_ID=409&FType=2

VA Survey Mailers Page 12 of 41

Specifically, this prohibition includes signed-applets or any ActiveX controls delivered through a browser’s session.

Note: ActiveX is expressly forbidden within the VA while .NET is allowed only when granted a waiver by the VA CIO PRIOR to use.

7. JavaScript is the preferred language standard for developing relatively simple interactions (i.e., forms validation, interactive menus, etc.) and Applets (J2SE APIs and Java Language) for complex network delivered applications.

SECTION 508 COMPLIANCE:

1. The contractor shall comply with Section 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended by the Workforce Investment Act of 1998 (P.L. 105-220), August 7, 1998.

2. In December 2000, the…