Performance Work Statement.pdf

Using Gaming to Increase Social Connection and VA access among Younger Veterans

1. Introduction. VA’s National Strategy for Preventing Veteran Suicide (2018-2028) defined a broad vision for implementation of a public health approach to end suicide.

Within VA’s national strategy, promoting connectedness (Goal 3) and evaluation (strategic direction 4) of programs remain a key goal in VA’s efforts to prevent suicide.

Moreover, In VA’s Suicide Prevention 2.0, community-based activities remain a prominent feature and critical to the VA’s Public Health Model for Suicide Prevention. In support of this, VA Bedford Healthcare System staff are seeking to bolster this mission through developing and evaluating community-based social intervention.

2. Scope or Purpose. The “Using Gaming to Increase Social Connection and VA access among Younger Veterans” project is approved and funded by the Office of Mental Health and Suicide Prevention (OMHSP) as a suicide prevention demonstration project. The demonstration project seeks to develop and evaluate a social intervention that utilizes gaming to increase social connection among Veterans. This project promotes social connectedness which is a protective factor against Veteran suicide. Through in-person and online gaming events (10 total, 8 in year 1), an online and in-person community will be created to 1) connect Veterans to one another and 2) enhance their knowledge and access to VA information and resources. Information gathered through this project will help develop guidance to VA and community organizations for sustainable solutions to enhance Veteran connectedness and decrease loneliness and social isolation through gaming.

The project requires a vendor who that can provide consulting services, facilitate gaming events, online platform management, content expertise in Veteran gaming culture and event production, and mental health evaluation expertise. Specifically, to assist with developing and evaluation social intervention through gaming to meet Office of Mental Health and Suicide Prevention (OMHSP) goals. The vendor will develop strategic outreach strategies (e.g., Instagram post) to reach potential stakeholders and promote the gaming events. The vendor will be responsible for coordinating, marketing, and implementation online and in-person gaming events (10 total), and assistance with protocol development, and evaluative (non-research) data collection. The vendor will manage selected venues and lead social intervention and assist in evaluation procedures.

Other requirements include successful completion of similar tasks in the past. A vendor who has successfully fostered a community for Veterans with a common interest in video and tabletop games. Moreover, an organization that has facilitated in-person and online gaming events in the Massachusetts area and worked with Veteran serving organizations, VA hospitals, student Veteran organizations, and experience in mental health sectors would best serve the needs of this project.

3. Period of Performance. The contract period of performance will be for one year starting at time of award. There is another 1-year option for this contract.

https://www.mentalhealth.va.gov/suicide_prevention/docs/Public_health_model_for_suicide_prevention.pdf

4. Place of Performance. The place of performance will be in the Contractor’s facility.

From time-to-time, contractors will be required to work at event locations in the Massachusetts area.

5. Travel. Not Applicable.

6. Task statement.

The A&A requirements do not apply, and that a Security Accreditation Package is not required Task 1: Contractor Project Management Plan. The Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, timeline, and tools to be used in execution of this contract. The CPMP should take the form of both a narrative and graphic format that displays the approach to overall management of the task and requirements engaged, i.e. schedule, milestones, risks and resource support. The initial baseline CPMP shall be concurred upon and updated monthly thereafter. The Contractor shall update and maintain the VA COR approved CPMP throughout the period of performance.

• Task 1 Deliverable - A Contract Project Management Plan

Task 2: Build Process and Protocol Development. The contractor shall assist in developing of protocol with VA project staff. This will include intervention content and evaluation procedures related to in-person and online platform content, and process for administering and collecting participant information. Moreover, this will include suicide risk mitigation procedures including triage and properly recognizing signs of distress and conducting a suicide risk assessment or intervening appropriately.

Task 2 Deliverables:

• Task 2A - In-Person Gaming Event Implementation Recommendations Report o Report will include suicide risk mitigating elements and detailed explanation of intervening procedures.

• Task 2B – Online Gaming Event Implementation Recommendations Report o Report will include suicide risk mitigating elements and detailed explanation of intervening procedures.

Task 3: In-person and Online Event Implementation Management. The contractor will identify, initiate, obtain and manage space for, and implement gaming events and be responsible for the successful production of in-person and online events as well as communication of event outcomes. The contractor will utilize its knowledge of Massachusetts gaming and organizational partners to implement gaming interventions through the length of the contract. Moreover, the contractor will relay observable and qualitative feedback on risk factors and protective factors for suicide that were impacted by gaming events.

Task 3 Deliverables:

• Task 3A - Weekly Report – Updates on event progress

• To include observable and qualitative feedback on risk factors, protective factors for suicide.

• Task 3B - Monthly Report – Provide project analysis and assessment of positive progress and transparent challenges related to the project

• To include Summary of event progress for the month including related observable and qualitative feedback on risk factors, protective factors for suicide.

• Task 3C- Gaming production and report

Task 4: Communications. The contractor will advise on strategic communications (e.g., Announcement Placements) (discussed through monthly contact). The contractor will perform professional services to identify outreach opportunities. The contractor will assist with the development of content.

Task 4 Deliverables:

• Task 4A - Strategic Communications Plan Recommendation – outreach plan, announcement approach, etc.

• Task 4B - Strategic Communications Summary Report

• Task 4C – Design and place one Social Media Post per event

Task 5: Guidebook and Manuscript Development. The contractor will advise and assist with guidebook development. The contractor will assist with procedural guidance and the development of content. The contractor will assist in the development clinical intervention techniques within the context of the gaming platform to include moderation of online content, specifically for an at-risk Veteran population (e.g., PTSD or suicidal thoughts), identifying those who are at risk for mental health challenges, and proper care escalation techniques.

Task 5 Deliverables:

• Task 5A – Advise on Gaming guidebook content

• Task 5B – Revise Outline of the Guidebook

• Task 5C – Assist with revision of Guidebook draft

• Task 5D – Assist with manuscript development

• Task 5E – Assist in development clinical intervention techniques for at-risk Veteran population (e.g. PTSD or suicidal thoughts)

7. Delivery Schedule. [Complete the table below based on deliverables defined above]

Task Deliverable Quantity Delivery

Date

Task 1A Contract Project Management Plan

1 5 days after award

Task 2A In-Person Gaming Event Implementation Recommendations Report

1 2 Weeks after award

Task 2B Online Gaming Event Implementation Recommendations Report

1 3 Weeks after award

Task 3A Weekly Report – Updates on event progress

Weekly TBD

Task 3B Monthly Report – Provide project analysis Monthly TBD Task 3C Provide report on gaming event 8 (year 1) TBD Task 4A Strategic Communications

Plan Recommendation – outreach plan, announcement approach, etc.

1 TBD

Task 4B Strategic Communications Summary Report

1 TBD

Task 4C One Social Media Post per Event 8 (year 1) TBD Task 5A Advise on Gaming guidebook content 1 TBD Task 5B Revise Outline of the Guidebook 1 TBD Task 5C Assist with revision of Guidebook draft 1 TBD Task 5D Assist with manuscript development 1 TBD

8. Government-Furnished Information, Equipment, and Facilities. [If applicable, specify.

Justification may be requested for GFE.]

9. Security Requirements. The A&A requirements do not apply, and a Security Accreditation Package is not required.

10. Task Order Quality Assurance Surveillance Plan (QASP). [Complete table below based on requirements, and edit the surrounding paragraphs as appropriate. It is the responsibility of the TO COR to ensure review and contractor compliance with these standards.]

The Government shall evaluate the contractor's performance in accordance with the Quality Assurance Surveillance Plan (QASP). This plan is primarily focused on what the government must do to ensure the contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rates.

Deliverable or Requirement

Performance Standard

Surveillance Method

Outcome

Delivery of Services]

Services shall be provided in accordance with the Deliverable Schedule 100% of the time

100% inspection. The TO COR will review each Deliverable for quality/timeliness according to criteria established in this TO.

Poor performance may result in issuance of a Contractor Discrepancy Report (CDR), as outlined in Section

5.2 of the IDIQ contract. The contractor’s performance on this TO will be reported to the Contractor

Performance Assessment Reporting System (CPARS) on an annual basis.

The CO and COR will make use of information from CDRs, as well as any additional knowledge and information available to them with respect to the contractor’s performance, to complete the CPARS.

The Government will not pay for services that do not conform or do not meet performance standards, or have not been properly rendered.

The contractor will be given an opportunity to correct non-conforming services at no cost to the Government if the services are non-conforming or the contract requirement is unacceptable.

The Contractor’s performance on this task order will be reported on an annual basis to the Contractor Performance Assessment Reporting System (CPARS). Poor performance may result in issuance of a Contractor Discrepancy Report (CDR), as outlined in Section 5.2 of the IDIQ contract. The CO and COR will make use of information from CDRs, as well as any additional knowledge and information available to them with respect to the contractor’s performance, to complete the CPARS. The Government will not pay for services that do not conform or do not meet performance standards, or have not been properly rendered. The contractor will be given an opportunity to correct non-conforming services at no cost to the Government if the services are non-conforming or the contract requirement is unacceptable.

ATTACHMENT E. VA HANDBOOK 6500.6 SECURITY CHECKLIST

(as found in Appendix A of the Handbook)

CHECKLIST FOR INFORMATION SECURITY IN THE INITIATION PHASE OF

ACQUISITIONS

1. BACKGROUND

In accordance with VA policy, contractors’ storage, generation, transmission or exchanging of VA sensitive information requires appropriate security controls to be in place. The VA Information Security Program policy – VA Directive and Handbook 6500 and additional 6500 series directives and handbooks - provide the framework for security within VA.

2. INSTRUCTIONS

This checklist must be completed at the initiation of all IT service acquisitions, statements of work, third-party service agreements and any other legally binding agreement in order to determine what, if any, security and privacy controls are necessary specifically as it relates to the VAAR security clause. OGC guidance should be sought on data ownership issues, as necessary. The checklist can also be used for other types of contracts, if appropriate or needed. In order to successfully complete this checklist, each question below must be addressed in coordination with all members of the local Acquisition Team including: the Procurement Requestor or Program Manager from the program office or facility, the Contracting Officer Representative (COR), the Information Security Officer (ISO), the Contracting Officer (CO) from the program office or facility’s servicing Acquisition office, and the Privacy Officer (PO). The ISO is the arbitrator if there are questions or disagreements on the appropriate answers.

1. Is this an acquisition or purchase of only commodities or goods (e.g. equipment or software)?

If yes, then the security clause is not required as long as VA sensitive information is not involved.

If no, then proceed to the next question.

Yes No

2. Does the contract involve “VA sensitive information?” (See

3. PROCEDURES a.)

If yes, proceed to next question.

If no, then the security clause is not required.

3. Will this acquisition require services of contractor personnel?

If no, proceed to question 5.

If yes, proceed to next question.

4. Will the personnel perform a function that requires access to a VA system or VA sensitive information (e.g., system administrator privileged access to a VA system, or contractor systems or processes that utilize VA sensitive information)?

NOTE: See 3.a. under PROCEDURES regarding contracts and agreements concerning medical treatment for Veterans.

If the answer above is no, then proceed to the next question.

If yes, then VA security policies apply. Contracting Officials need to work with the Program Manager or (procurement requestor), COTR, PO, and ISO to:

i. Include the appropriate risk designation of the contractors based on the PDAT determination.

ii. Incorporate the security clause (Appendix B) into the contract involved and the appropriate security/privacy language outlined in Appendix C into the solicitation.

iii. Determine if protected health information is disclosed or accessed and if a BAA is required.

5. Will this acquisition require use of a contractor-owned Information Technology (IT) system or computer assets, and

a. The IT system hardware components are located at an offsite contractor facility; and

b. The IT system is not connected to a VA network; and

c. The contractor has exclusive administrative control to the components; and

d. The purpose of the requirement for the system is to process or store VA information on behalf of the VA.

If any of the answers to 5a-5d are no, proceed to the next question.

If yes, then VA security policies apply. Incorporate the clause from Appendix B and the appropriate security/privacy language from Appendix C respectively into the solicitation and contract and initiate planning for the certification and accreditation of the contractor system(s). Contracting Officials need to work with the COR and ISO to:

• Determine the security impact of the IT system as High, Moderate, or Low per 6500 Handbook, Information Security Program.

• Ensure Contractor understanding of the IT security requirements for certification and accreditation (authorization) (C&A) of the contractor system. See VA Handbook 6500.3, Certification and Accreditation.

• Ensure that the proper VA Management Official is appointed by the Certification Program Office to formally authorize operation of the system in accordance with VA Handbook 6500 and 6500.3.

• Enforce contractor performance (timely submission of deliverables, compliance with personnel screening requirements, maintenance of secure system configurations and participation in annual IT Federal Information Security Management Act (FISMA) assessments to ensure compliance with FISMA requirements).

• Ensure yearly FISMA assessments are completed and uploaded into SMART.

6. Will this acquisition require services that involve connection of one or more contractor-owned IT devices (such as a laptop computer or remote connection from a contractor system) to a VA internal trusted (i.e., non-public) network?

If no, then include a statement in the SOW that “The C&A requirements do not apply, and that a Security Accreditation Package is not required: and proceed to the next question.

If yes, then incorporate the security clause from Appendix B and the appropriate security/privacy language from Appendix C respectively into the solicitation and contract.

Contracting Officials need to work with the COR and the ISO to:

• Ensure contractor understands and implements the IT security requirements for system interconnection documents required per the Memorandum of Understanding or Interconnection Agreement (MOU-ISA). The standard operating procedure (SOP) and a template for a MOU-ISA are located on the Information Protection Risk Management (IPRM) Portal and can be provided to the contractor.

• Ensure contractor understands their participation in IT security requirements for C&A of the VA system to which they connect.

• Enforce contractor performance (timely submission of deliverables, compliance with personnel screening requirements, and appropriate termination activity as appropriate).

7. Is the acquisition a service that involves the storage, generating, transmitting, or exchanging of VA sensitive information but does not require C&A or a MOU-ISA for system interconnection?

If no, then specify the mechanism/documentation used to ensure the VA sensitive information is protected.

If yes, then incorporate the security clause and the appropriate security language from Appendices B and C into the solicitation and contract. The COR needs to:

• Ensure that a Contractor Security Control Assessment (CSCA) is completed within 30 days of contract approval and yearly on the renewal date of the contract.

• Ensure that the CSCA is sent to the ISO and the OCS Certification Program Office for review to ensure that appropriate security controls are being implemented in service contracts.

• Ensure a copy of the CSCA is maintained in the Security Management and Reporting Tool (SMART) database. COR will provide a copy of the completed CSCA to ISO for uploading into SMART database.

The contractor will not be storing VA sensitive information. There will be no sensitive information in need of protection.

3. SIGNATURES

Please provide the name and telephone number of each Acquisition Team member who participated in completing this checklist. By signing this checklist, the Contracting Officer is representing that Security was considered for this requirement through coordination with members of the Acquisition Team including the program or requesting office's IT Security point of contact.

(1) Contracting Officer Representative:

Name: Phone:

Signature: Date:

(2) Information Security Officer:

(3) Contracting Officer:

(4) Procurement Requestor/Program Manager:

Title:

(5) Privacy Officer:

(6) Other Team Members participating in the acquisition (e.g., Records Management Officer/Compliance Officer):

Name: Phone:

Title:

ATTACHMENT E. VA HANDBOOK 6500.6 SECURITY CHECKLIST