36C10X21Q0011 0001_1.docx

Contract Opportunity Amendment to a Previous Combined Solicitation

PRODUCT SERVICE CODE

SUBJECT

CONTRACTING OFFICE'S

ZIP-CODE

SOLICITATION NUMBER

BASE NOTICE TYPE

RESPONSE DATE/TIME/ZONE

ARCHIVE

DAYS AFTER THE RESPONSE DATE

RECOVERY ACT FUNDS

SET-ASIDE

NAICS CODE

CONTRACTING OFFICE

ADDRESS

POINT OF CONTACT

(POC Information Automatically Filled from User Profile Unless Entered)

DESCRIPTION

See Attachment

AGENCY'S URL

URL DESCRIPTION

AGENCY CONTACT'S EMAIL

ADDRESS

EMAIL DESCRIPTION

ADDRESS

POSTAL CODE

COUNTRY

ADDITIONAL INFORMATION

GENERAL INFORMATION

PLACE OF PERFORMANCE

* = Required Field Contract Opportunity Amendment to a Previous Combined Solicitation Update RFQ due date, update PWS remove 10 miles requirement 21703 36C10X21Q0011 10-28-2020 14:00

EASTERN TIME, NEW YORK, USA

N 493190 Strategic Acquisition Center - Frederick Department of Veterans Affairs 5202 Presidents Court, Suite 103 Frederick MD 21703 Contract Specialist Riley Bender riley.bender@va.gov 240-215-0580 Department of Veterans Affairs Austin Information and Technology Center 1615 Woodward Street Austin

TX

78772

USA

https://www.va.gov

VA

Amend RFQ to extend solicitation due date to 10/28/2020, 14:00 ET and to update B.2 PERFORMANCE WORK STATEMENT Section 5.3 Facility Requirements to remove that the facility shall be located 10 miles from AITC.

5. PROJECT NUMBER (if applicable)

CODE

7.

ADMINISTERED BY

2. AMENDMENT/MODIFICATION NUMBER

CODE

6. ISSUED BY

8. NAME AND ADDRESS OF CONTRACTOR

4. REQUISITION/PURCHASE REQ. NUMBER

3. EFFECTIVE DATE

9A. AMENDMENT OF SOLICITATION NUMBER

9B. DATED

PAGE OF

PAGES

10A. MODIFICATION OF CONTRACT/ORDER NUMBER

10B. DATED

BPA NO.

1. CONTRACT ID CODE

FACILITY CODE

CODE

Offers must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended, by one of the following methods:

The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offers

E. IMPORTANT:

is extended,

(a) By completing Items 8 and 15, and returning __________ copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted; or (c) By separate letter or electronic communication which includes a reference to the solicitation and amendment numbers. FAILURE

OF YOUR

ACKNOWLEDGMENT TO BE RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY is not extended.

12. ACCOUNTING AND APPROPRIATION DATA

(REV. 11/2016)

is required to sign this document and return ___________ copies to the issuing office.

is not, A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE CONTRACT ORDER NO. IN ITEM 10A.

15C. DATE SIGNED

B. THE ABOVE NUMBERE

D CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES

SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(b).

RESULT IN REJECTION OF YOUR

OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by letter or electronic communication, provided each letter or electronic communication makes reference to the solicitation and this amendmen t, and is received prior to the opening hour and date specified.

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER

Contractor

16C. DATE SIGNED

14. DESCRIPTION OF AMENDMENT/MODIFICATION

16B. UNITED

STATES OF AMERICA

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15A. NAME AND TITLE OF SIGNER

16A. NAME AND TITLE OF

CONTRACTING OFFICER

15B. CONTRACTOR/OFFEROR

STANDARD FORM 30

PREVIOUS EDITION NOT USABLE

Prescribed by GSA - FAR (48 CFR) 53.243 (Type or print) (Type or print) (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

(Number, street, county, State and ZIP Code) (If other than Item 6) (Specify type of modification and authority) (such as changes in paying office, appropriation date, etc.)

(If required)

(SEE ITEM 11)

(SEE ITEM 13)

(X)

CHECK

ONE

13. THIS ITEM APPLIES ONLY TO MODIFICATIONS OF CONTRACTS/ORDERS,

IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF

SOLICITATIONS

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

(Signature of person authorized to sign) (Signature of Contracting Officer) See Block 16C

21-HW0055

36C10X Strategic Acquisition Center - Frederick Department of Veterans Affairs 5202 Presidents Court, Suite 103 Frederick MD 21703 36C10X Strategic Acquisition Center - Frederick Department of Veterans Affairs Presidents Court, Suite 103 Frederick MD 21703 To all Offerors/Bidders

36C10X21Q0011 10-21-2020

X x x

10/28/2020, 14:00 ET

See CONTINUATION Page The purpose of this amendment is to extend the solicitation closing date as outlined in Block #11 and to update B.2 PERFORMANCE WORK STATEMENT Section 5.3 Facility Requirements to remove that the facility shall be located 10 miles from AITC.

There are no other changes to the solicitation.

B.2 PERFORMACE WORK STATEMENT

BACKGROUND

The mission of the Department of Veterans Affairs (VA), Office of Information and Technology (OI&T), Infrastructure Operations (IO) is to provide benefits and services to Veterans of the United States. In meeting these goals, OI&T strives to provide high quality, effective, and efficient Information Technology (IT) services to those responsible for providing care to Veterans at the point-of-care as well as throughout all the points of the Veterans’ health care in an effective, timely, and compassionate manner. VA depends on Information Technology systems to meet mission goals.

The proposed action is for a Firm-Fixed-Price (FFP) contract for transportation and offsite storage of disaster recovery materials, in the form of backup media tapes and tubs, for IO. The required services will enable IO to ensure that primary mission-essential functions will continue to be performed in the event of a wide range of emergencies, including localized acts of nature, accidents, and technological or attack-related emergencies. The request is for a one-year obligation with a period of performance starting 11/01/20 and ending 10/31/21.

1.0 SCOPE OF WORK

The Contractor shall provide the safe and secure storage of disaster recovery materials in a storage facility. The Contractor shall provide secure transportation of the materials from the Austin Information Technology Center (AITC) to the Contractor’s storage facility on a daily basis. In the event of a catastrophic event at the AITC, the Contractor shall provide secure transportation of the materials from the Contractor’s storage facility to the designated location specified by EIS Contracting Officer’s Representative (COR).

2.0 PERFORMANCE DETAILS

2.1 PERFORMANCE PERIOD

The PoP shall be 11/01/2020 through 10/31/2021 with an additional 4 (four) options years.

Any work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO).

There are ten (10) Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, four are set by date:

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

3.0 PLACE OF PERFORMANCE

Tasks under this PWS shall be performed at Contractor facilities with the only exception being the transferring of disaster recovery materials between the Contractor’s storage facility and the AITC located at 1615 Woodward Street, Austin, TX 78772 or another designated location in the event of an emergency or test. The default Continuity of Operations (COOP) location for AITC is the SunGard Data Center at 8025 N Interstate Highway 35, Austin, TX 78753, although this location is subject to change at any time per AITC leadership guidance.

4.0 TRAVEL

The Government anticipates travel under this effort in order to transfer disaster recovery materials between the Contractor’s storage facility and AITC. Include all estimated travel costs in your FFP line items. These costs will not be directly reimbursed by the Government.

5.0 SPECIFIC TASKS AND DELIVERABLES

The Contractor shall perform the following:

The Contractor shall provide the storage of disaster recovery materials in an offsite storage facility. The Contractor shall store all VA materials in a vault in the Contractor’s storage facility (refer to Section 5.5 Facility Requirements for vault and facility requirements). The disaster recovery materials consist of backup tapes and packing documentation, as tubs containing DR COOP supplies (paper and pens). There are two types of backup tapes: slotted tapes and litigation tapes. Slotted tapes are allowed to be removed from their storage container and stored individually in slots at the Contractor’s storage facility. The litigation tapes are stored in locked one cubic foot and three cubic foot tubs provided by VA. The litigation tapes shall remain in the locked storage containers while at the Contractor’s storage facility.

The volume of slotted tapes will vary during the month. The average volume of slotted tapes is 9000 (+/- 1,000). There are approximately 84,000 (+/- 500) litigation tapes in 700 (+/- 10) tubs that shall be stored at the Contractor’s storage facility and a subset of the total number of tubs shall be rotated weekly. There are currently an additional 357 permanently locked tubs containing tapes which are no longer in circulation that shall be stored at the Contractor’s storage facility, as well as an assortment of Red and Blue Turtle cases (one cubic foot tubs), which average 52 (+/- five) per year that shall be stored at the Contractor’s storage facility and a subset of the total number of Turtle cases shall be rotated weekly. The number of slotted tapes and tubs are anticipated to grow approximately 15 percent per year. In addition, there are 6 DR COOP tubs which will need to be stored at the contractor facility.

The Contractor shall provide pricing on a per tape per month storage basis for slotted tapes and per tub per month pricing for litigation tapes & DR COOP materials stored in locked tubs.

5.0.1 INITIAL RELOCATION OF DISASTER RECOVERY MATERIALS

Currently, all tapes are stored in slotted tape racks, one cubic foot locked tubs, and three cubic foot locked tubs at the incumbent contractor’s facility in the Austin area. Within four days of contract award, the Contractor shall inventory all Government-owned tapes, tubs, locks, shipping containers (there are currently nine), and any other property owned by AITC and relocate them to the Contractor’s storage facility and store them in the vault.

5.0.2 The Contractor shall transport all tapes in locked storage containers. AITC will supply the containers and locks. The Contractor shall provide two copies of shipping and receiving receipts: one for AITC records and one for the Contractor’s storage facility’s records. The Contractor shall pick up the disaster recovery material to be stored from AITC on a daily basis, including weekends and holidays. Once picked up, the Contractor shall transport the AITC material to the Contractor’s storage facility within one hour. The Contractor shall also return stored materials to AITC on a daily basis according to the return date marked on each slotted tape and tub. Pickups and deliveries shall be made at AITC's loading dock. The only exceptions to using the AITC loading dock are after hour (4:30 p.m. – 8:00 a.m. Central Time (CT)) recalls with delivery of one tub or less, then the AITC West entrance may be used.

The Contractor shall call an AITC point of contact upon arrival for pickups and deliveries. The Contractor shall call in the following order:

1. Computer Operations – Tape pool telephone number: 512-326-6526

2. PM – Jason Wescott telephone number: 512-981-4845

3. COR – Julia Negahnquet telephone number: 512-326-6079

4. AITC Service Desk telephone number: 512-326-6780

For procedural changes, the Contractor shall contact the COR. If the COR is not available, the Contractor shall contact the Chief, Tape Management Operations, Jason Wescott at telephone number 512-981-4845.

Whenever motorized transportation is used to transport the material, the Contractor shall secure the material with straps to minimize shifting of the containers and damage to AITC materials. All AITC materials shall be transported in environmentally controlled vehicles.

a. Pickup and delivery schedule

The Contractor shall pick up the material from AITC between 1:00 p.m. and 4:00 p.m. Central Time (CT) each day (Sunday through Saturday). This time frame may change depending on the availability of the materials for pickup. If the materials will not be available until after 2:00 p.m. CT, AITC personnel will notify the Contractor by 12:00 p.m. CT of the delay and provide an approximate time they will be ready. Materials may be picked up earlier than the three-hour time frame when coordinated between AITC and the Contractor.

1. Monday: The Contractor shall perform two pickups from AITC and one delivery to AITC every Monday. The first pickup shall be between 9:00 a.m. and 10:00 a.m. CT with no delivery of returning tapes from the Sunday processing. The Contractor shall make the second pickup and deliver the tubs containing the tapes picked up on the previous Sunday to AITC between 3:00 p.m. and 4:00 p.m. CT.

2. Tuesday: The Contractor shall pick up tubs containing tapes from AITC and deliver the previous Monday’s tapes to AITC. In addition, the Contractor shall return the tubs containing the tapes from the prior week to AITC.

3. Wednesday through Sunday: The Contractor shall pick up tubs containing tapes from AITC and deliver the previous day’s tapes to AITC.

5.0.3 PROCESSING OF DISASTER RECOVERY MATERIALS

The slotted tapes shall be processed daily in order to keep the inventory current. The following three listings will be provided by AITC for the Contractor to manage these slotted tapes.

1. Picking List for Vault (Slotted Tapes) This list contains the tapes that the Contractor shall return to AITC the next day. The list indicates Volume Serial (VOLSER) number, which is also indicated on the front of each tape, and the return date of the tape(s) which is identified on the label on top of the tape. The Contractor shall load the tapes on the Picking List into tubs, placing them in order from the oldest date to the most recent date, and return them to AITC the following day. (This does not apply with litigation tapes stored in locked tubs.)

2. Distribution List for Vault (Slotted Tapes) This list contains the tapes AITC is giving to the Contractor for storage. The list shows the VOLSER number, which is also denoted on the front of each tape, and return date indicating when the tape shall be returned to AITC. The Contractor shall pick up the Distribution List and the tapes on the list from AITC daily and shall store them in the vault of the Contractor’s storage facility.

Note: If for some reason there is more than one day’s worth of tapes to be processed, it shall be processed in sequence starting with the earliest day first: Monday’s Picking and Distribution lists first, then Tuesday’s Picking and Distribution lists second, etc. (This does not apply with litigation tapes stored in locked tubs.)

3. Inventory List (Slotted Tapes) This list is an inventory of the entire library of slotted tapes sorted by VOLSER. No processing is necessary from the Inventory List. This list shall be used for inventory control by the Contractor and for locating tapes requested to be returned to AITC by authorized personnel. (This does not apply with litigation tapes stored in locked tubs.)

5.0.4 INVENTORY

A complete inventory will be conducted at least semi-annually by AITC. This is to ensure the accuracy of the current inventory at the Contractor’s storage facility. Additional inventories will be conducted by AITC’s COR as needed. The Contractor shall support these inventories by allowing AITC personnel access to the inventory in the Contractor’s storage facility.

5.2 Recall of stored materials

5.2.1 RECALL RESPONSE TIME

During an emergency, VA may request disaster recovery materials be recalled to AITC. The Contractor shall deliver the disaster recovery materials to AITC within the following response times, 24 hours a day, seven days a week. VA will provide the priority level/response time when requesting a recall.

5.2.2 Tape Recalls

In the event of system failures, a request will be made for tapes to be returned to AITC. These recall requests are authorized by the personnel listed on the Director Authorized Tape Recall Letter. These are the only personnel with authority to recall tapes from the Contractor’s storage facility. A password shall also be required for any tape recall. The password will be provided to the Contractor on the Director Authorized Tape Recall Letter. The Contractor shall provide the recall to AITC only if the recall request is received from personnel listed on the Director Authorized Tape Recall Letter and the requestor provides a valid password. The Contractor shall notify AITC’s COR or AITC service desk if personnel not authorized to recall tapes request tapes to be returned or a password is incorrect or not given. With litigation tapes stored in locked tubs, the entire tub shall be recalled, and the Contractor shall deliver the tub to AITC. Recalled tapes shall be delivered to AITC. The Contractor shall only release the recalled tapes to an individual listed on the Director Authorized Tape Recall Letter personnel list.

5.2.3 Declared Disaster Procedures

In the event of a disaster, VA will notify the Contractor of a disaster and the Contractor shall prepare the tapes which AITC deems necessary for delivery to AITC provided “hot site” within four hours of notification. The Contractor shall not prepare AITC recovery tapes for shipment until the authorization to declare a disaster has been verified as outlined in the procedures below. The Contractor shall provide secure transportation of the materials from the Contractor’s storage facility to the designated location specified by AITC’s COR. If a location specified by AITC is more than 20 miles from AITC, transportation shall be provided by FedEx White Glove Service at the expense of AITC. FedEx White Glove Service pickup and delivery will be coordinated by AITC.

a. Declaration of Disaster An authorization list to declare a disaster will be provided upon contract award. Only AITC management personnel listed on the Director Authorized Tape Recall Letter authorization list can declare a disaster. The Director Authorized Tape Recall Letter will also contain the password.

b. Disaster Notification Telephone Call If a telephone call is received from someone indicating a declaration of disaster, the Contractor shall record the following:

1. Name of person making call

2. Phone number they can be reached

3. Time and date call received

4. Any characteristics of caller i.e. male, female, young, middle age, older, race, origin, if identifiable, excited, calm, etc. Note: These characteristics need only be recorded if the password is not provided or an incorrect password is provided from the calling party.

c. Password The Contractor shall perform the disaster procedures only after receiving a declaration of disaster from a person on the Director Authorized Tape Recall Letter and after receiving a valid password from the person declaring the disaster. Under no circumstances shall procedures for preparing AITC recovery tapes for shipment be executed until the proper password is received from the party calling. No amount of coercion, persuasion, or pleading from the caller shall be reason for not receiving the correct password from the caller.

If the correct password is not provided (either lack of password or incorrect password), the Contractor shall terminate these procedures and document in writing and report the information gathered to the Contractor employee’s management. The Contractor’s management shall immediately notify AITC Disaster Recovery Procedure Coordinator during normal duty hours (8:00 a.m. through 4:30 p.m.), Monday through Friday. If the call is received during other than normal duty hours, the Contractor’s management shall notify AITC Service Desk and shall make a follow up call the next normal working day to AITC Tape Coordinator. Should AITC be destroyed, the Contractor shall contact AITC Tape Management Operations Chief or the COR immediately. AITC Tape Management Operations Chief and COR contact information will be supplied to the Contractor after contract award.

The password associated with the Director Authorized Tape Recall Letter will be updated every 90 days or when any AITC personnel listed retires from or leaves AITC. This new Director Authorized Tape Recall Letter, with new passwords, will be forwarded to the Contractor.

d. Verification Return Call If the correct password is obtained from the caller, the Contractor shall issue a return call within five minutes after termination of the original call. The Contractor shall request to speak to the person who made the original call to verify they did indeed make a request to declare a disaster. If for some reason that person is not available, the Contractor shall request that person return their call as soon as possible to verify the declaration of a disaster. If after one hour no return call has been received, the Contractor shall notify AITC Tape Coordinator.

e. Preparation for Shipment When verification of a disaster declaration has been completed, the Contractor shall precede with the procedures for shipment of AITC’s recovery tapes.

1. “Hot Site” Location/Shipping Information The current “hot site” for AITC is SunGard Availability Services, 8025 N Interstate Highway 35, Austin, TX 78753, (512) 518-6244.

2. Procedures Once an authorized declaration of disaster has been verified by the Contractor, the Contractor shall perform the procedures for preparing AITC recovery tapes for shipment to the “hot site” location as follows:

i. Litigation Tapes in Locked Tubs Inventory The Contractor shall load the tubs into shipping containers designed to hold these tubs.

ii. Slotted Tape Inventory The Contractor shall pull the entire slotted tape inventory and place them in tubs for shipment. The Contractor shall load all tubs for shipment in the shipping containers.

Since AITC will be in a disaster situation, no special listing can be provided. The Contractor shall pull all slotted tapes in sequence starting with rack one and load them into tubs; this will enable the “hot site” to find tapes when they arrive at the “hot site”. The Contractor shall place these tubs of tapes in the seven shipping containers designed for shipping of these tubs.

iii. Return of Files:

Depending on the extent of disaster, the return and disposition of all files from the “hot site” will be made by the COR.

5.3 Facility Requirements

The Contractor shall provide the safe and secure storage of AITC’s disaster recovery materials in a facility that meets the following requirements.

a. Certification The facility shall have a National Archives and Records Administration (NARA) certification.

b. General Structure The facility shall be constructed with non-combustible materials and building elements, including roof, walls, columns, and floors. The building shall be located a minimum of five feet above and 100 feet from any 100 year flood plain area, or be protected by an appropriate flood wall. The facility shall be in accordance with current regional building codes to provide protection from building collapse or failure from a wind load. The facility shall be located a minimum of 10 miles from AITC. The fire resistive rating of the building roof assembly shall be a minimum of one hour. The building shall be constructed in compliance with all national and local building codes (National Electrical Code (NEC), Uniform Mechanical Code (UMC), Uniform Building Code (UBC), and National Fire Code (NFC)).

The facility shall contain a vault that shall be made of concrete and shall have a roof independent of the building roof. The Contractor shall store all of AITC disaster recovery materials in the vault. Openings in the vault envelope shall be minimal and protected by fire door/dampers and security devices. Within the vault, there shall be no strong electromagnetic fields present, such as electrical bus bars and transformers.

c. Fire Protection System The facility shall be protected by a fully supervised wet sprinkler and fire alarm system designed and installed by a certified/licensed company. In addition, the vault shall be protected by a disaster recovery type fire protection system. The Contractor’s storage facility shall have an automatic notification system to a 24-hour per day, seven days per week, offsite monitoring company, which notifies local fire/police response units in the event of an alarm. The fire alarm system shall have a backup power source. The Contractor shall have the fire monitoring systems checked monthly for proper operation by licensed fire technicians or technicians trained by the system manufacturer. The Contractor shall provide copies of inspection test reports on request to verify the systems are maintained per local codes and manufacturer guidelines.

d. Environmental The vault storage shall be thermostatically controlled. The Contractor shall store the disaster recovery materials at 70 degrees Fahrenheit, plus or minus five degrees Fahrenheit and at or below 55 percent relative humidity. The Contractor shall check the temperature and humidity of the area daily. The Contractor shall notify VA immediately in the event that the temperature or humidity is out of the acceptable ranges. The environmental monitoring system shall have a backup power source. The Contractor shall have the environmental monitoring system checked monthly for proper operation by licensed technicians trained by the system manufacturer.

e. Facility Maintenance The Contractor shall not store hazardous materials in any part of the Contractor’s storage facility. The building shall be maintained in compliance with all national and local building codes (NEC, UMC, UBC, and NFC). The Contractor shall have an effective pest control program in place. All grass areas around the perimeter of the building shall be mowed as necessary to achieve an unobstructed view of all building lines. Exterior lighting shall be maintained at all times. The Contractor shall provide proof of compliance with these requirements upon request.

5.4 Security Requirements

The Contractor’s storage facility shall have an active security program including required access cards for entrance to the vault, ability to alert personnel that the vault door is not closed, and the ability to retrieve historical entry data of the vault, intrusion detection with 24 hour per day monitoring, surveillance cameras, physical intrusion barriers, and an access auditing method. The security systems shall have a backup power source and be checked semi-annually for proper operation by trained technicians.

The Contractor shall ensure that all visitors to the Contractor’s facility present valid Government-issued photo identification (such as a state issued driver’s license). The Contractor shall escort visitors authorized by the Contractor to enter the area where AITC's materials are stored. The Contractor shall issue authorized visitors an access badge and each visitor’s name shall be logged on a separate log sheet when they enter and leave the facility. The person escorting the visitor(s) shall maintain constant observation of the visitor(s) to ensure they do not access AITC’s materials.

The Contractor shall not move AITC's materials to another location without specific authorization from an authorized AITC person, except in an emergency, in which case the Contractor shall notify AITC of the location within four hours of the material being moved. Emergency examples include fire, flood, tornado, hurricane, etc.

The Contractor shall be available by phone or pager 24 hours per day to facilitate declaration of an emergency.

The Contractor shall perform background checks on all Contractor personnel who will have access to AITC's materials. The Contractor shall use a commercially available service to solicit relevant background information. Background checks shall review the past five years of each person's criminal, financial, and living history. Any personnel having a Class A or B misdemeanor, or any felony conviction, or with obvious financial difficulties (such as excessive debts, failure to pay, and bankruptcy) shall not be permitted access to AITC's materials. Additionally, any personnel with any moving traffic violation during the previous three years shall not be permitted to transport AITC's materials via motor vehicle. The Contractor shall retain all information discovered during their background check for the duration of the contract and allow review by AITC security personnel when requested.

The Contractor employees shall be required to provide verification of identity by state issued driver’s license at AITC before materials will be released to them. The Contractor shall provide the names, dates of birth, and social security numbers of all Contractor employees who will have access to AITC's materials to AITC before allowing them access to the materials.

Access cards shall be required for Contractor employees to access the area in which AITC materials are stored. The Contractor shall only issue access cards to Contractor employees whom the Contractor determines are suitable following a background check. To ensure individual accountability, access cards shall not be shared, loaned, or given to any other person. Persons authorized to access the area where AITC materials are stored shall not allow another person to enter the area during the time they have the door open (also known as “tailgating”), except for authorized visitors.

The Contractor shall ensure that a control/logging system is implemented to document the transfer of the materials between all parties. The Contractor shall provide chain-of-custody signatures to/from AITC and the Contractor’s storage facility.

In the event of a mechanical failure of a transport vehicle, the driver shall remain with the vehicle until the Contractor transfers the materials to another vehicle. Drivers shall be provided with a means to summon assistance (e.g. two-way radio, cellular phone, etc.) and a portable fire extinguisher.

The access control system shall have the capability for generating reports listing each person who entered the vault area during any specified time period. The Contractor shall provide such reports to AITC security personnel within 24 hours of request. Access control through the main entrance into the facility shall be maintained by a two tier access policy.

Materials stored at the Contractor’s storage facility will include Federal Tax Information (FTI). This FTI media shall be shipped to the Contractor’s storage facility in double locked containers. Therefore, the Contractor’s storage facility shall comply with all applicable requirements of the most recent issue of Internal Revenue Service (IRS) Publication 1075. This document is available at http://www.irs.gov/pub/irs-pdf/p1075.pdf.

The Contractor shall not use any reference to VA such as "Department of Veterans Affairs", "VA", “Veterans Administration”, “Austin Information Technology Center", or "AITC" in any advertising materials.

The Contractor shall carry insurance/bonding in the amount to cover damage or loss of AITC materials (i.e. tapes, tape racks, and all other material provided by AITC) plus the cost of recreating damaged computer files. (This insurance/bonding would typically be in amounts of $500,000 - $750,000).

4. CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, timeline and tools to be used in execution of the contract. The CPMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks and resource support. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPMP shall be concurred upon and updated in accordance with Section B of the contract. The Contractor shall update and maintain the VA PM approved CPMP throughout the PoP.

GENERAL REQUIREMENTS

ENTERPRISE AND IT FRAMEWORK

FEDERAL IDENTITY, CREDENTIAL, AND ACCESS MANAGEMENT (FICAM)

The Contractor shall ensure Commercial Off-The-Shelf (COTS) product(s), software configuration and customization, and/or new software are Personal Identity Verification (PIV) card-enabled by accepting HSPD-12 PIV credentials using VA Enterprise Technical Architecture (ETA), https://www.ea.oit.va.gov/EAOIT/VA_EA/Enterprise_Technical_Architecture.asp, and VA Identity and Access Management (IAM) approved enterprise design and integration patterns, https://www.oit.va.gov/library/recurring/edp/index.cfm. The Contractor shall ensure all Contractor delivered applications and systems comply with the VA Identity, Credential, and Access Management policies and guidelines set forth in the VA Handbook 6510 and align with the Federal Identity, Credential, and Access Management Roadmap and Implementation Guidance v2.0.

The Contractor shall ensure all Contractor delivered applications and systems provide user authentication services compliant with the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-63-3, VA Handbook 6500 Appendix F, “VA System Security Controls”, and VA IAM enterprise requirements for direct, assertion based authentication, and/or trust based authentication, as determined by the design and integration patterns. Direct authentication at a minimum must include Public Key Infrastructure (PKI) based authentication supportive of PIV card and/or Common Access Card (CAC), as determined by the business need.

The Contractor shall ensure all Contractor delivered applications and systems conform to the specific Identity and Access Management PIV requirements set forth in the Office of Management and Budget (OMB) Memoranda M-04-04, M-05-24, M-11-11, and NIST Federal Information Processing Standard (FIPS) 201-2. OMB Memoranda M-04-04, M-05-24, and M-11-11 can be found at: https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/omb/memoranda/fy04/m04-04.pdf, https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/omb/memoranda/fy2005/m05-24.pdf, and https://obamawhitehouse.archives.gov/sites/default/files/omb/memoranda/2011/m11-11.pdf respectively. Contractor delivered applications and systems shall be on the FIPS 201-2 Approved Product List (APL). If the Contractor delivered application and system is not on the APL, the Contractor shall be responsible for taking the application and system through the FIPS 201 Evaluation Program.

The Contractor shall ensure all Contractor delivered applications and systems support:

1. Automated provisioning and are able to use enterprise provisioning service.

2. Interfacing with VA’s Master Veteran Index (MVI) to provision identity attributes, if the solution relies on VA user identities. MVI is the authoritative source for VA user identity data.

3. The VA defined unique identity (Secure Identifier [SEC ID] / Integrated Control Number [ICN]).

4. Multiple authenticators for a given identity and authenticators at every Authenticator Assurance Level (AAL) appropriate for the solution.

5. Identity proofing for each Identity Assurance Level (IAL) appropriate for the solution.

6. Federation for each Federation Assurance Level (FAL) appropriate for the solution, if applicable.

7. Two-factor authentication (2FA) through an applicable design pattern as outlined in VA Enterprise Design Patterns.

8. A Security Assertion Markup Language (SAML) implementation if the solution relies on assertion based authentication. Additional assertion implementations, besides the required SAML assertion, may be provided as long as they are compliant with NIST SP 800-63-3 guidelines.

9. Authentication/account binding based on trusted Hypertext Transfer Protocol (HTTP) headers if the solution relies on Trust based authentication.

10. Role Based Access Control.

11. Auditing and reporting capabilities.

12. Compliance with VIEWS 00155984, PIV Logical Access Policy Clarification https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896.

The required Assurance Levels for this specific effort are Identity Assurance Level 3, Authenticator Assurance Level 3, and Federation Assurance Level 3.

SECURITY AND PRIVACY REQUIREMENTS

POSITION/TASK RISK DESIGNATION LEVEL(S)

In accordance with VA Handbook 0710, Personnel Security and Suitability Program, the position sensitivity and the level of background investigation commensurate with the required level of access for the following tasks within the PWS are:

Position Sensitivity and Background Investigation Requirements by Task

The Tasks identified above and the resulting Position Sensitivity and Background Investigation requirements identify, in effect, the Background Investigation requirements for Contractor individuals, based upon the tasks the particular Contractor individual will be working. The submitted Contractor Staff Roster must indicate the required Background Investigation Level for each Contractor individual based upon the tasks the Contractor individual will be working, in accordance with their submitted proposal.

CONTRACTOR PERSONNEL SECURITY REQUIREMENTS

Contractor Responsibilities:

1. The Contractor shall prescreen all personnel requiring access to the computer systems to ensure they maintain the appropriate Background Investigation, and are able to read, write, speak and understand the English language.

Within 3 business days after award, the Contractor shall provide a roster of Contractor and Subcontractor employees to the COR to begin their background investigations in accordance with the PAL template artifact. The Contractor Staff Roster shall contain the Contractor’s Full Name, Date of Birth, Place of Birth, individual background investigation level requirement (based upon Section 6.2 Tasks), etc. The Contractor shall submit full Social Security Numbers either within the Contractor Staff Roster or under separate cover to the COR. The Contractor Staff Roster shall be updated and provided to VA within 1 day of any changes in employee status, training certification completion status, Background Investigation level status, additions/removal of employees, etc. throughout the Period of Performance. The Contractor Staff Roster shall remain a historical document indicating all past information and the Contractor shall indicate in the Comment field, employees no longer supporting this contract. The preferred method to send the Contractor Staff Roster or Social Security Number is by encrypted e-mail. If unable to send encrypted e-mail, other methods which comply with FIPS 140-2 are to encrypt the file, use a secure fax, or use a traceable mail service.

1. The Contractor should coordinate with the location of the nearest VA fingerprinting office through the COR. Only electronic fingerprints are authorized. The Contractor shall bring their completed Security and Investigations Center (SIC) Fingerprint request form with them (see paragraph d.4. below) when getting fingerprints taken.

b. The Contractor shall ensure the following required forms are submitted to the COR within 5 days after contract award:

1) Optional Form 306

2) Self-Certification of Continuous Service

3) VA Form 0710

4) Completed SIC Fingerprint Request Form The Contractor personnel shall submit all required information related to their background investigations (completion of the investigation documents (SF85, SF85P, or SF 86) utilizing the Office of Personnel Management’s (OPM) Electronic Questionnaire for Investigations Processing (e-QIP) after receiving an email notification from the Security and Investigation Center (SIC).

The Contractor employee shall certify and release the e-QIP document, print and sign the signature pages, and send them encrypted to the COR for electronic submission to the SIC. These documents shall be submitted to the COR within 3 business days of receipt of the e-QIP notification email. (Note: OPM is moving towards a “click to sign” process. If click to sign is used, the Contractor employee should notify the COR within 3 business days that documents were signed via e-QIP).

1. The Contractor shall be responsible for the actions of all personnel provided to work for VA under this contract. In the event that damages arise from work performed by Contractor provided personnel, under the auspices of this contract, the Contractor shall be responsible for all resources necessary to remedy the incident.

1. A Contractor may be granted unescorted access to VA facilities and/or access to VA Information Technology resources (network and/or protected data) with a favorably adjudicated Special Agreement Check (SAC), completed training delineated in VA Handbook 6500.6 (Appendix C, Section 9), signed “Contractor Rules of Behavior”, and with a valid, operational PIV credential for PIV-only logical access to VA’s network. A PIV card credential can be issued once your SAC has been favorably adjudicated and your background investigation has been scheduled by OPM. However, the Contractor will be responsible for the actions of the Contractor personnel they provide to perform work for VA. The investigative history for Contractor personnel working under this contract must be maintained in the database of OPM.

1. The Contractor, when notified of an unfavorably adjudicated background investigation on a Contractor employee as determined by the Government, shall withdraw the employee from consideration in working under the contract.

Failure to comply with the Contractor personnel security investigative requirements may result in loss of physical and/or logical access to VA facilities and systems by Contractor and Subcontractor employees and/or termination of the contract for default.

Identity Credential Holders must follow all HSPD-12 policies and procedures as well as use and protect their assigned identity credentials in accordance with VA policies and procedures, displaying their badges at all times, and returning the identity credentials upon termination of their relationship with VA.

Deliverable:

A. Contractor Staff Roster

METHOD AND DISTRIBUTION OF DELIVERABLES

The Contractor shall deliver documentation in electronic format, unless otherwise directed in Section B of the solicitation/contract. Acceptable electronic media include: MS Word 2000/2003/2007/2010, MS Excel 2000/2003/2007/2010, MS PowerPoint 2000/2003/2007/2010, MS Project 2000/2003/2007/2010, MS Access 2000/2003/2007/2010, MS Visio 2000/2002/2003/2007/2010, AutoCAD 2002/2004/2007/2010, and Adobe Postscript Data Format (PDF).

PERFORMANCE METRICS

The table below defines the Performance Standards and Acceptable Levels of Performance associated with this effort.

2. Efficient and effective in meeting requirements

3. Meets technical needs and mission requirements

4. Provides quality services/products

5. Incorporates “ease of use” Human Centered Design principles in any software developed.

Satisfactory or higher

2. Products completed, reviewed, delivered in accordance with the established schedule

3. Notifies customer in advance of potential problems Satisfactory or higher

2. Personnel possess necessary knowledge, skills and abilities to perform tasks Satisfactory or higher

The COR will utilize a Quality Assurance Surveillance Plan (QASP) throughout the life of the contract to ensure that the Contractor is performing the services required by this PWS in an acceptable level of performance. The Government reserves the right to alter or change the surveillance methods in the QASP at its own discretion. A Performance Based Service Assessment will be used by the COR in accordance with the QASP to assess Contractor performance.

ADDENDUM A – ADDITIONAL VA REQUIREMENTS, CONSOLIDATED

Cyber and Information Security Requirements for VA IT Services The Contractor shall ensure adequate LAN/Internet, data, information, and system security in accordance with VA standard operating procedures and standard PWS language, conditions, laws, and regulations. The Contractor’s firewall and web server shall meet or exceed VA minimum requirements for security. All VA data shall be protected behind an approved firewall. Any security violations or attempted violations shall be reported to the VA Program Manager and VA Information Security Officer as soon as possible. The Contractor shall follow all applicable VA policies and procedures governing information security, especially those that pertain to certification and accreditation.

Contractor supplied equipment, PCs of all types, equipment with hard drives, etc. for contract services must meet all security requirements that apply to Government Furnished Equipment (GFE) and Government Owned Equipment (GOE). Security Requirements include: a) VA Approved Encryption Software must be installed on all laptops or mobile devices before placed into operation, b) Bluetooth equipped devices are prohibited within VA; Bluetooth must be permanently disabled or removed from the device, unless the connection uses FIPS 140-2 (or its successor) validated encryption, c) VA approved anti-virus and firewall software, d) Equipment must meet all VA sanitization requirements and procedures before disposal. The COR, CO, the PM, and the Information Security Officer (ISO) must be notified and verify all security requirements have been adhered to.

Each documented initiative under this contract incorporates VA Handbook 6500.6, “Contract Security,” March 12, 2010 by reference as though fully set forth therein. The VA Handbook 6500.6, “Contract Security” shall also be included in every related agreement, contract or order. The VA Handbook 6500.6, Appendix C, is included in this document as Addendum B.

Training requirements: The Contractor shall complete all mandatory training courses on the current VA training site, the VA Talent Management System (TMS) 2.0, and will be tracked therein. The TMS 2.0 may be accessed at https://www.tms.va.gov/SecureAuth35/ . If you do not have a TMS 2.0 profile, go to https://www.tms.va.gov/SecureAuth35/ and click on the “Create New User” link on the TMS 2.0 to gain access.

Contractor employees shall complete a VA Systems Access Agreement if they are provided access privileges as an authorized user of the computer system of VA.

VA Enterprise Architecture Compliance The applications, supplies, and services furnished under this contract must comply with VA Enterprise Architecture (EA), available at http://www.ea.oit.va.gov/index.asp in force at the time of issuance of this contract, including the Program Management Plan and VA's rules, standards, and guidelines in the Technical Reference Model/Standards Profile (TRMSP). VA reserves the right to assess contract deliverables for EA compliance prior to acceptance.

Section 508 – Information and Communication Technology (ICT) Standards

The Section 508 standards established by the Access Board are incorporated into, and made part of all VA orders, solicitations and purchase orders developed to procure ICT. These standards are found in their entirety at: https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines. A printed copy of the standards will be supplied upon request.

Federal agencies must comply with the updated Section 508 Standards beginning on January 18, 2018. The Final Rule as published in the Federal Register is available from the Access Board: https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule.

The Contractor shall comply with “508 Chapter 2: Scoping Requirements” for all electronic ICT and content delivered under this contract. Specifically, as appropriate for the technology and its functionality, the Contractor shall comply with the technical standards marked here:

Physical Security & Safety Requirements:

The Contractor and their personnel shall follow all VA policies, standard operating procedures, applicable laws and regulations while on VA property. Violations of VA regulations and policies may result in citation and disciplinary measures for persons violating the law.

1. The Contractor and their personnel shall wear visible identification at all times while they are on the premises.

2. VA…