D.1 ATTACHMENT A_36C10X21Q0219_STATEMENT OF OBJECTIVES_A00001 (tracked changes).docx

Statement of Objectives Embedding CX through Certification & Programming for the VA Community

Statement of objectives Veterans Experience Office Office of Enterprise Measurement and Design Blanket Purchase Agreement for Embedding CX through Certification & Programming for the VA Community

BACKGROUND

Scaling Customer Experience (CX) across Government is codified in legislation and VA policy through 38 Code of Federal Regulation (CFR) and compliance with Office of Management and Budget (OMB) Circular A-11 – Managing Customer Experience and Improving Service. Towards this end, the Veterans Experience Office (VEO) has been building the CX Institute (VACXi), an initiative to create a best-in-class CX institute with the goal of upskilling Department of Veterans Affairs (VA) employees, setting organizational standard practices, and hardwiring a CX oriented mindset into the products, services, and experiences that we create with our customers.

An in-house CX Institute will have a direct impact on the VA by:

· Reducing cost spent on external CX trainings and reliance on outside CX consultants.

· Creating high-quality, culturally relevant programming tailored to VA staff.

· Improving CX capabilities designed to accelerate VA mission and goals.

· Creating organizational change through shifting mindsets towards CX and changing the way we work.

· Provide a seamless pathway for partnerships and collaboration with Veteran community programs.

Objective:

As an offering in the VACXi, VEO is interested in expanding learning opportunities across VA in the form of an industry-recognizable Human Centered Design (HCD) Certification for VA employees to gain awareness, understanding, and new skills in CX and HCD to reach our Government CX goals; a fellowship for VA employees providing the opportunity for selected teams to focus on a project-based learning framework; and a CX certification offering for Veterans to learn CX and HCD skills for an in-demand industry.

Development of these offerings will allow VEO to expand reach across the VA and scale program offerings to meet options for in-person and on-demand, online approach helping to meet the goals of A-11, as well as priorities of VA leadership. VEO seeks a human centered design firm that has developed certifications for executive-level audiences and market facing learning products for institutions of similar scale to the VA. The institute would be leveraging the experience needed in developing digital technology-based, engaging learning opportunities and learning from leaders in industry.

SCOPE OF WORK

The Contractor shall support VEO in developing, testing, training, and delivering CX certification curriculum, fellowship programming, and experiential learning experiences to meet the needs of embedding CX into the VA mindsets, practices, and culture. Our aim is to provide highly engaging curriculum utilizing various technological platforms and facilitation types.

For all tasks, the selected contractor shall be required to provide all necessary licensing, rights, and curriculum in order for VEO to share methods, slide modules, content, and other artifacts (handouts, templates, videos, etc.) necessary to conduct CX engagements and to administer training to others in VA.

CONTRACT TYPE

This is a single-award BPA with one or more orders expected during the performance period. Firm Fixed Price orders will be issued under the terms and conditions of this BPA.

PERIOD OF PERFORMANCE

The period of performance is one 60-month base period with no option periods.

PLACE OF PERFORMANCE

[To be determined by the contractor’s quoted approach to accomplishing the Government’s objectives. However, it is anticipated that performance will be at the contractor’s primary facility.]

TRAVEL

[To be determined by the contractor’s quoted approach to accomplishing the Government’s objectives. However, travel is not anticipated.]

PROGRAM/PROJECT MANAGEMENT

The contractor shall provide program/project management support for each call order award from kickoff to closeout. For each order, the contractor shall be responsible for creating and maintaining a Project Management Plan (PMP) that lays out the Contractor’s approach, timeline, and tools to be used in execution of the order. The PMP shall describe how the Contractor manages and schedules Contractor resources, manages communications with Contractor resources and Government points of contact (POCs), and manages project change and risk.

The PMP shall take the form of both a narrative and graphic format that displays the schedule, milestones, risks and resource support. The PMP shall also include how the Contractor shall coordinate and execute reporting requirements as identified within the schedule of deliverables.

The Contractor shall monitor performance against the PMP and report any deviations. The report shall also identify any problems that arose and a description of how the problems were resolved. If problems have not been completely resolved, the Contractor shall provide an explanation including their plan and timeframe for resolving the issue. It is expected that the Contractor will keep in communication with VA accordingly so that issues that arise are transparent to both parties to prevent escalation of outstanding issues.

The initial baseline PMP shall be concurred upon by the COR and updated by the Contractor monthly or otherwise as directed by the Government thereafter. The Contractor shall update and maintain the PMP throughout the schedule of this contract.

Deliverables: [To be determined by the contractor’s quoted approach to accomplishing the Government’s objectives.]

PERFORMANCE OBJECTIVES (required results)

Task 1.1: certification refinememt The VA looks to respondents to present novel and/or proven approaches and industry best practices around establishing leadership and reporting norms, align on objectives, discuss current and evolving priorities, and develop an overall strategy to reach CX certification and fellowship program goals.

· Create a virtual or in-person “War Room” space for the VEO design team to collaborate and work together.

· Support the VACXi leadership to define its aspirational vision for the CX certification, strategic objectives, an actionable plan to deliver on their strategy, and the measures and Key Performance Indicators (KPIs) aligned around what services they provide and how they will measure success and be accountable for delivering value to internal customers through the VACXi.

· Provide Learning framework: Define the right learning stages that make sense for CX HCD certification and fellowship program with different audience types.

· Instill Capabilities, competencies, and skills: Define VEOs taxonomy and skills needed to deliver at each learning stage and audience types.

· Define a Future state (to-be): Define VEOs aspirational vision to accomplish the goals of the CX HCD certifications per audience type and fellowship program. Determine capabilities and competencies across certifications and program.

· Define the Current state (as-is): Conduct a VA high level CX assessment and map CX understanding and practicing efforts across the VA landscape to help identify gaps and opportunities -- creating a bird’s eye view of the current capability.

· Propose How to get there: Define strategic objectives, an actionable plan, and the measures and KPIs to guide necessary to build a certification and fellowship program that will accomplish the future state vision.

Deliverables: [To be determined by the contractor’s quoted approach to accomplishing the Government’s objectives.] Task 1.2: Certification DevelopMENT In an effort to provide maximum flexibility to support Veterans and the evolving needs of the VA, the specific deliverables and acceptance criteria will be defined outlined in the contractor furnished roadmap outlining the path forward to developing this certification.

· Develop CX HCD certification for first priority audience with the goal to provide content that is accessible to a wide audience through an on-demand approach and light facilitation.

· Design, develop, prototype, and test CX HCD Certification curriculum that will enable VA employees to quickly understand, diagnose, and frame a CX problem and approach.

· Training format will be flexible to meet options for in-person and online training delivery to be housed in VA’s system.

· Testing and evaluation of the low-fidelity CX HCD certification prototype with a small segment of VA employees.

· Production of a high-fidelity CX HCD certification.

Deliverables: [To be determined by the contractor’s quoted approach to accomplishing the Government’s objectives.] Task 1.3 Facilitation delivery training Train VEO Enterprise Measurement and Design (EMD) staff on first priority audience CX HCD certification and facilitation delivery to create an initial bench of facilitators within the VA, as well as build standard baseline capacity across the EMD team.

· Develop preliminary train-the-trainer materials to utilize in training the EMD staff, as well as be the initial set up to the CX Institute train the trainer program.

· Upskill specific competency areas in EMD staff for delivering CX HCD certification across the VA administrations. This training will establish the initial bench of trainers for the certification program to be expanded as we scale.

· Facilitate lunch & learn type field trips (in person or virtually) with organizations trailblazing in CX/HCD and have intimate discussion with CX and design leaders across industries.

Deliverables: [To be determined by the contractor’s quoted approach to accomplishing the Government’s objectives.]

Task 1.4: Pilot Certification Pilot first priority audience CX HCD Certification with EMD trained facilitators and VA employees to gather feedback, evaluate, refine pilot, and finalize deliverable of CX HCD Certification for the first primary audience.

· Finalize all content, material, technology needs to create a final curriculum package for use in CX Institute delivery.

· Hand off and socialization with the EMD team for full understanding on all products produced.

· All documents, outputs, and deliverables, including in process materials and final products associated with Tasks 9.1 through 9.4 to be delivered to EMD team.

Deliverables: [To be determined by the contractor’s quoted approach to accomplishing the Government’s objectives.]

Task 2.1: develop cx institute fellowship model In conjunction with the CX HCD Certification, develop a CX Institute Fellowship Program that allows teams of individuals to be trained through the certification and complete a project-based initiative for VA.

· Design, develop, prototype, and test CX Fellowship program that will enable VA employees to participate in team-based project models for VA focused CX initiatives.

1. Design and development of low-fidelity CX fellowship prototype for team-based project delivery on VA high priority initiatives.

1. Testing and evaluation of the low-fidelity CX fellowship prototype with a small segment of VA employees.

1. Production of a high fidelity CX prototype.

Deliverables: [To be determined by the contractor’s quoted approach to accomplishing the Government’s objectives.]

Task 2.2: Pilot the CX Institute Fellowship model With EMD facilitators, pilot the CX Institute Fellowship model for (up to 2) teams of VA employees to gather feedback, refine, and finalize the program.

· Pilot high-fidelity fellowship model with (up to 2) project teams to gather feedback, evaluate, and refine the fellowship model.

1. Finalize all content, material, technology needs to create a final fellowship package for use in CX Institute delivery.

1. Hand off and socialization with the EMD team for full understanding on all products produced.

· Pilot Evaluation feedback and findings.

DELIVERABLES: [To be determined by the contractor’s quoted approach to accomplishing the Government’s objectives.] Task 3.1: DEVELOP CX CERTIFICATION FOR SECONDARY PRIORITY AUDIENCE In an effort to provide maximum flexibility to support Veterans and the evolving needs of VA, develop CX Certification for secondary priority audience, defined by TASK 9.1 and outlined in the roadmap, with the goal to provide content that is accessible to a wide audience through an on-demand approach and light facilitation.

· Design, develop, prototype, and test low-fidelity CX HCD Certification prototype curriculum that will enable the Veteran audience to quickly understand, diagnose, and frame a CX problem and approach. This could include digital, paper, and/or video-based materials.

· Design and development of low-fidelity CX HCD certification prototype including on-demand lessons using technology platforms, virtual and in-person facilitation lessons, as well as handouts, workbooks, and other material created for curriculum delivery.

· Testing and evaluation of the low-fidelity CX HCD certification prototype with a small segment of VA employees.

· Production of a high-fidelity CX HCD certification.

DELIVERABLES: [To be determined by the contractor’s quoted approach to accomplishing the Government’s objectives.] Task 3.2: Facilitation delivery sECOND PRIORITY AUDIENCE Train EMD Staff on second priority audience CX HCD Certification and Facilitation delivery to create an initial bench of facilitators within the VA, as well as build standard baseline capacity across the EMD Team.

1. Develop preliminary train-the-trainer materials to utilize in training the EMD staff, as well as be the initial set up to the VACXi train-the-trainer program.

1. Upskill specific competency areas in EMD staff for delivering CX HCD certification across the VA administrations. This training will provide the skills needed for EMD staff and the VACXi bench of trainers to deliver this certification.

DELIVERABLES: [To be determined by the contractor’s quoted approach to accomplishing the Government’s objectives.] Task 3.3: PILOT SECOND PRIORITY AUDIENCE CERTIFICATION Pilot second priority audience Certification with EMD trained facilitators and VA employees to gather feedback, evaluate, refine pilot, and finalize final deliverable of CX Certification for the first primary audience.

· Finalize all content, material, and technology needs to create a final curriculum package for use in VACXi delivery.

· Hand off and socialization with the EMD team for full understanding on all products produced.

DELIVERABLES: [To be determined by the contractor’s quoted approach to accomplishing the Government’s objectives.]

KEY PERSONNEL

Certain skilled and experienced professional and/or technical personnel are essential for accomplishing the work to be performed. These individuals are defined as “Key Personnel” whose experience biographies shall be submitted and marked by the Contractor as “Key Personnel”. Substitutions shall only be accepted if in compliance with the “Substitution of Key Personnel” provision identified below.

The following labor category is defined as Key Personnel and, except in cases where individuals commit criminal conduct or violations of company policy, shall not be removed, diverted, or replaced from work without notifying the CO and COR.

Any personnel that the Contractor offers as substitutes shall have the ability and qualifications equal to or better than the key personnel who are being replaced. The Contractor shall submit a complete resume for the proposed substitute and any other information requested by the CO needed to approve or disapprove the proposed substitution. The CO will evaluate such requests and promptly notify the contractor of approval or disapproval thereof in writing.

[Key personnel to be determined by the contractor’s quoted approach to accomplishing the Government’s objectives.]

sCHEDULE OF DELIVERABLES The below Schedule of Deliverables outline work product delivery deadlines expected by the government. This list is not exhaustive of all project milestones that will be captured in the Project Management Plan. All deliverables are electronic unless otherwise noted. Note: Deliverables with due dates falling on a weekend or holiday shall be submitted the following Government workday after the weekend or holiday. (CAD = Call Order Award Date, Days = Calendar Days).

[ Deliverable Schedule to be determined by the contractor’s quoted approach to accomplishing the Government’s objectives.]

PERFORMANCE METRICS

The Government will utilize a Quality Assurance Surveillance Plan throughout the life of the contract to ensure that the Contractor is performing the services required by this contract in an acceptable manner. The Government reserves the right to alter or change the surveillance methods in the QASP at its own discretion. A Performance Based Servicer Assessment Survey may be used in combination with the QASP to assist the Government in determining acceptable performance levels.

[The specific requirements, standards, methods and outcomes of the government’s QASP will be determined at a later date and informed by the contents and plans laid out in offerors’ responses. ]

All requirements laid out in the QASP will be regularly reviewed and assigned one of the following two results:

Acceptable Performance – The Government will document acceptable performance in accordance with the chart above. Any report may become a part of the supporting documentation for any contractual action.

Unacceptable Performance – When unacceptable performance occurs, the COR will inform the CO. This will always be in writing although when circumstances necessitate immediate verbal communication, that communication will be followed in writing. The COR will document the discussion and place it in the COR file.

When the CO determines formal written communication is required, the COR will prepare a Contract Discrepancy Report (CDR) and present it to the Contractor's program manager.

The Contractor shall acknowledge receipt of the CDR in writing to the CO. The CDR will state how long after receipt the Contractor has to take corrective action. The CDR will also specify if the Contractor is required to prepare a corrective action plan to document how the Contractor shall correct the unacceptable performance and avoid a recurrence. The CO shall review the Contractor's corrective action plan to determine acceptability.

Any CDRs may become a part of the supporting documentation for any contractual action deemed necessary by the CO.

QUALITY ASSURANCE SURVEILANCE PLAN (QASP)

[QASP to be determined by the contractor’s quoted approach to accomplishing the Government’s objectives.]

GOVERNMENT FURNISHED PROPERTY

Government Furnished property is not anticipated.

sECURITY Contractor Personnel Security

All contract employees who require access to the VA site(s) and/or access to VA local area network (LAN) systems shall be the subject of a background investigation and must receive a favorable adjudication from the VA Security and Investigations Center (SIC). These requirements are applicable to all subcontractor personnel requiring the same level of Background Investigation. Contractors shall meet the appropriate background investigation requirements in accordance with VA Directive and Handbook 0710, Personnel Security and Suitability Program.

The contract employee level of background investigation required for this effort is NACI Tier 1.

Contractor Responsibilities

1 The Contractor shall prescreen all of its personnel requiring access to the computer systems to ensure they maintain the appropriate Background Investigation, and are able to read, write, speak, and understand the English language.

2 The Contractor shall bear the expense of obtaining background investigations. The cost of background investigations is based on the current Defense Counterintelligence Security Agency (DSCA) rate at the time the application is processed. Fiscal Year 2021 rates are as follows: Tier 1 $466 or Reciprocals are $93.

3 Within five business days after award, the Contractor shall provide a roster of Contractor and Subcontractor employees to the COR to begin their background investigations. The roster shall contain the Contractor’s Full Name, Full Social Security Number, Date of Birth, Place of Birth, and individual background investigation level requirement.

4 The Contractor should coordinate the location of the nearest VA fingerprinting office through the COR. Only electronic fingerprints are authorized.

5 The contractor will provide all necessary forms to initiate background investigation. These should be submitted to the COR within 5 business days after award.

6 The Contractor personnel will receive an email notification from the Security Adjudication Center (SAC); through the Electronics Questionnaire for Investigations Processes (e-QIP) identifying the website link that includes detailed instructions regarding completion of the investigation documents (SF85, SF85P, or SF 86).

The Contractor personnel shall submit all required information related to their background investigations utilizing the Office of Personnel Management’s (OPM) Electronic Questionnaire for Investigations Processing (e- QIP).

7 The Contractor is to certify and release the e-QIP document, print and sign the signature pages, and send them to the COR for electronic submission to the SAC. These should be submitted to the COR within 3 business days of receipt of the e- QIP notification email.

8 The Contractor shall be responsible for the actions of all personnel provided to work for VA under this contract. If damages arise from work performed by Contractor provided personnel, under the auspices of this contract, the Contractor shall be responsible for all resources necessary to remedy the incident.

9 A Contractor may be granted unescorted access to VA facilities and/or access to VA Information Technology resources (network and/or protected data) with a favorably adjudicated Special Agreement Check (SAC) or “Closed, No Issues” (SAC) fingerprint results, training delineated in VA Handbook 6500.6 (Appendix C, Section 9), and, the signed “Contractor Rules of Behavior.” However, the Contractor will be responsible for the actions of the Contractor personnel they provide to perform work for VA. The investigative history for Contractor personnel working under this contract must be maintained in the database of the Office of Personnel Management (OPM).

10 The Contractor, when notified of an unfavorably adjudicated background investigation on a Contractor employee as determined by the Government, shall withdraw the employee from consideration in working under the contract.

11 Failure to comply with the Contractor personnel security investigative requirements may result in termination of the contract for default.

GENERAL

Contractors, contractor personnel, subcontractors, and subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security.

The C&A requirements do not apply. Security Accreditation Package is not required.

ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS

A contractor/subcontrator shall request logical (technical) or physical access to VA information and VA information systems for their employees, subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order.

All contractors, subcontractors, and third-party servicers and associates working with VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures.

Contract personnel who require access to national security programs must have a valid security clearance. National Industrial Security Program (NISP) was established by Executive Order 12829 to ensure that cleared U.S. defense industry contract personnel safeguard the classified information in their possession while performing work on contracts, programs, bids, or research and development efforts. The Department of Veterans Affairs does not have a Memorandum of Agreement with Defense Security Service (DSS). Verification of a Security Clearance must be processed through the Special Security Officer located in the Planning and National Security Service within the Office of Operations, Security, and Preparedness.

Custom software development and outsourced operations must be located in the U.S. to the maximum extent practical. If such services are proposed to be performed abroad and are not disallowed by other VA policy or mandates, the contractor/subcontractor must state where all non-U.S. services are provided and detail a security plan, deemed to be acceptable by VA, specifically to address mitigation of the resulting problems of communication, control, data protection, and so forth. Location within the U.S. may be an evaluation factor.

The contractor or subcontractor must notify the Contracting Officer immediately when an employee working on a VA system or with access to VA information is reassigned or leaves the contractor or subcontractor’s employ. The Contracting Officer must also be notified immediately by the contractor or subcontractor prior to an unfriendly termination.

VA INFORMATION CUSTODIAL LANGUAGE

1. Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the contractor/subcontractor's rights to use data as described in Rights in Data

- General, FAR 52.227-14(d) (1).

VA information should not be co-mingled, if possible, with any other data on the contractors/subcontractor’s information systems or media storage systems in order to ensure VA requirements related to data protection and media sanitization can be met. If co-mingling must be allowed to meet the requirements of the business need, the contractor must ensure that VA’s information is returned to the VA or destroyed in accordance with VA’s sanitization requirements. VA reserves the right to conduct on site inspections of contractor and subcontractor IT resources to ensure data security controls, separation of data and job duties, and destruction/media sanitization procedures are in compliance with VA directive requirements.

Prior to termination or completion of this contract, contractor/subcontractor must not destroy information received from VA, or gathered/created by the contractor in the course of performing this contract without prior written approval by the VA. Any data destruction done on behalf of VA by a contractor/subcontractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self-certification by the contractor that the data destruction requirements above have been met must be sent to the VA Contracting Officer within 30 days of termination of the contract.

The contractor/subcontractor must receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with the terms of the contract and applicable Federal and VA information confidentiality and security laws, regulations and policies. If Federal or VA information confidentiality and security laws, regulations and policies become applicable to the VA information or information systems after execution of the contract, or if NIST issues or updates applicable FIPS or Special Publications (SP) after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations and policies in this contract.

The contractor/subcontractor shall not make copies of VA information except as authorized and necessary to perform the terms of the agreement or to preserve electronic information stored on contractor/subcontractor electronic storage media for restoration in case any electronic equipment or data used by the contractor/subcontractor needs to be restored to an operating state. If copies are made for restoration purposes, after the restoration is complete, the copies must be appropriately destroyed.

If VA determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12.

If a VHA contract is terminated for cause, the associated BAA must also be terminated and appropriate actions taken in accordance with VHA Handbook 1600.01, Business Associate Agreements. Absent an agreement to use or disclose protected health information, there is no business associate relationship.

The contractor/subcontractor must store, transport, or transmit VA sensitive information in an encrypted form, using VA-approved encryption tools that are, at a minimum, FIPS 140-2 validated.

The contractor/subcontractor’s firewall and Web services security controls, if applicable, shall meet or exceed VA’s minimum requirements. VA Configuration Guidelines are available upon request.

Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor/subcontractor may use and disclose VA information only in two other situations: (i) in response to a qualifying order of a court of competent jurisdiction, or (ii) with VA’s prior written approval. The contractor/subcontractor must refer all requests for, demands for production of, or inquiries about, VA information and information systems to the VA contracting officer for response.

Notwithstanding the provision above, the contractor/subcontractor shall not release VA records protected by Title 38 U.S.C. 5705, confidentiality of medical quality assurance records and/or Title 38 U.S.C. 7332, confidentiality of certain health records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse, or infection with human immunodeficiency virus. If the contractor/subcontractor is in receipt of a court order or other requests for the above-mentioned information, that contractor/subcontractor shall immediately refer such court orders or other requests to the VA contracting officer for response.

For service that involves the storage, generating, transmitting, or exchanging of VA sensitive information but does not require C&A or an MOU-ISA for system interconnection, the contractor/subcontractor must complete a Contractor Security Control Assessment (CSCA) on a yearly basis and provide it to the COR.

SECURITY INCIDENT INVESTIGATION

1. The term “security incident” means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. The contractor/subcontractor shall immediately notify the COR and simultaneously, the designated ISSO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/subcontractor has access.

To the extent known by the contractor/subcontractor, the contractor/subcontractor’s notice to VA shall identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the VA information or assets were placed at risk or compromised), and any other information that the contractor/subcontractor considers relevant.

With respect to unsecured protected health information, the business associate is deemed to have discovered a data breach when the business associate knew or should have known of a breach of such information. Upon discovery, the business associate must notify the covered entity of the breach. Notifications need to be made in accordance with the executed business associate agreement.

In instances of theft or break-in or other criminal activity, the contractor/subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG and Security and Law Enforcement. The contractor, its employees, and its subcontractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The contractor/subcontractor shall cooperate with VA in any civil litigation to recover VA information, obtain monetary or other compensation from a third party for damages arising from any incident, or obtain injunctive relief against any third party arising from, or related to, the incident.

SECURITY CONTROLS COMPLIANCE TESTING

On a periodic basis, VA, including the Office of Inspector General, reserves the right to evaluate any or all of the security controls and privacy practices implemented by the contractor under the clauses contained within the contract. With 10 working-day’s notice, at the request of the government, the contractor must fully cooperate and assist in a government-sponsored security controls assessment at each location wherein VA information is processed or stored, or information systems are developed, operated, maintained, or used on behalf of VA, including those initiated by the Office of Inspector General. The government may conduct a security control assessment on shorter notice (to include unannounced assessments) as determined by VA in the event of a security incident or at any other time.

TRAINING

1. All contractor employees and subcontractor employees requiring access to VA information and VA information systems shall complete the following before being granted access to VA information and its systems:

(1) Sign and acknowledge (either manually or electronically) understanding of and responsibilities for compliance with the Contractor Rules of Behavior, Appendix E relating to access to VA information and information systems;

(2) Successfully complete the VA Privacy and Information Security Awareness and Rules of Behavior training and annually complete required security training;

(3) Successfully complete the appropriate VA privacy training and annually complete required privacy training; and

(4) Successfully complete any additional cyber security or privacy training, as required for VA personnel with equivalent information system access, as requested by the VA COR.

The contractor shall provide to the VA COR a copy of the training certificates and certification of signing the Contractor Rules of Behavior for each applicable employee within 1 week of the initiation of the contract and annually thereafter, as required.

Failure to complete the mandatory annual training and sign the Rules of Behavior annually, within the timeframe required, is grounds for suspension or termination of all physical or electronic access privileges and removal from work on the contract until such time as the training and documents are complete.

ADDENDUM A – ADDITIONAL VA REQUIREMENTS, CONSOLIDATED

VA Enterprise Architecture Compliance The applications, supplies, and services furnished under this contract must comply with One-VA Enterprise Architecture (EA), available at http://www.ea.oit.va.gov/index.asp in force at the time of issuance of this contract, including the Program Management Plan and VA's rules, standards, and guidelines in the Technical Reference Model/Standards Profile (TRMSP). VA reserves the right to assess contract deliverables for EA compliance prior to acceptance.

VA Internet and Intranet Standards:

The Contractor shall adhere to and comply with VA Directive 6102 and VA Handbook 6102, Internet/Intranet Services, including applicable amendments and changes, if the Contractor’s work includes managing, maintaining, establishing and presenting information on VA’s Internet/Intranet Service Sites. This pertains but is not limited to: creating announcements; collecting information; databases to be accessed, graphics and links to external sites.

Internet/Intranet Services Directive 6102 is posted at (copy and paste the following URL to browser): http://www1.va.gov/vapubs/viewPublication.asp?Pub_ID=409&FType=2

Internet/Intranet Services Handbook 6102 is posted at (copy and paste following URL to browser): http://www1.va.gov/vapubs/viewPublication.asp?Pub_ID=410&FType=2

Notice of the Federal Accessibility Law Affecting All Electronic and Information Technology Procurements (Section 508)

On August 7, 1998, Section 508 of the Rehabilitation Act of 1973 was amended to require that when Federal departments or agencies develop, procure, maintain, or use Electronic and Information Technology, that they shall ensure it allows Federal employees with disabilities to have access to and use of information and data that is comparable to the access to and use of information and data by other Federal employees. Section 508 required the Architectural and Transportation Barriers Compliance Board (Access Board) to publish standards setting forth a definition of electronic and information technology and the technical and functional criteria for such technology to comply with Section 508. These standards have been developed and published with an effective date of December 21, 2000. Federal departments and agencies shall develop all Electronic and Information Technology requirements to comply with the standards found in 36 CFR 1194.

Section 508 – Electronic and Information Technology (EIT) Standards

The Section 508 standards established by the Architectural and Transportation Barriers Compliance Board (Access Board) are incorporated into, and made part of all VA orders, solicitations and purchase orders developed to procure Electronic and Information Technology (EIT). These standards are found in their entirety at: http://www.section508.gov and http://www.section508.gov/acquisition-regulations. A printed copy of the standards will be supplied upon request. The Contractor shall comply with the technical standards as marked:

_x_§ 1194.21 Software applications and operating systems _x_§ 1194.22 Web-based intranet and internet information and applications _x_§ 1194.23 Telecommunications products _x_§ 1194.24 Video and multimedia products _x_§ 1194.25 Self-contained, closed products _x_§ 1194.26 Desktop and portable computers _x_§ 1194.31 Functional Performance Criteria _x_§ 1194.41 Information, Documentation, and Support A1.1. Equivalent Facilitation Alternatively, offerors may propose products and services that provide equivalent facilitation, pursuant to Section 508, subpart A, §1194.5. Such offerors will be considered to have provided equivalent facilitation when the proposed deliverables result in substantially equivalent or greater access to and use of information for those with disabilities.

A1.2. Compatibility with Assistive Technology The Section 508 standards do not require the installation of specific accessibility-related software or the attachment of an assistive technology device. Section 508 requires that the EIT be compatible with such software and devices so that EIT can be accessible to and usable by individuals using assistive technology, including but not limited to screen readers, screen magnifiers, and speech recognition software.

A1.3. Representation of Conformance In order to be considered eligible for award, offerors must submit the Government Product Accessibility Template (GPAT) to verify Section 508 conformance of their products and/or services. The GPAT will be incorporated into the resulting contract.

A1.4. Acceptance and Acceptance Testing

Deliverables resulting from this solicitation will be accepted based in part on satisfaction of the identified Section 508 standards’ requirements for accessibility and must include a final/updated GPAT and final test results demonstrating Section 508 compliance.

Deliverables should meet applicable accessibility requirements and should not adversely affect accessibility features of existing EIT technologies. The Government reserves the right to independently test for 508 Compliance before delivery. The Contractor shall be able to demonstrate 508 Compliance upon delivery.

Automated test tools and manual techniques are used in the VA Section 508 compliance assessment. Additional information concerning tools and resources can be found at http://www.section508.va.gov/section508/Resources.asp.

Deliverable:

A. Updated GPAT B. Final Section 508 Compliance Test Results