36C24224Q0908 0004.pdf

5. PROJECT NUMBER (if applicable)

CODE 7. ADMINISTERED BY

2. AMENDMENT/MODIFICATION NUMBER

CODE

6. ISSUED BY

8. NAME AND ADDRESS OF CONTRACTOR

4. REQUISITION/PURCHASE REQ. NUMBER 3. EFFECTIVE DATE

9A. AMENDMENT OF SOLICITATION NUMBER

9B. DATED

PAGE OF PAGES

10A. MODIFICATION OF CONTRACT/ORDER NUMBER

10B. DATED

BPA NO. 1. CONTRACT ID CODE

FACILITY CODE CODE

Offers must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended, by one of the following methods:

The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offers

E. IMPORTANT:

is extended,

(a) By completing Items 8 and 15, and returning __________ copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted; or (c) By separate letter or electronic communication which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGMENT TO BE RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY is not extended.

12. ACCOUNTING AND APPROPRIATION DATA

(REV. 11/2016)

is required to sign this document and return ___________ copies to the issuing office. is not, A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE CONTRACT ORDER NO. IN ITEM 10A.

15C. DATE SIGNED

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(b).

RESULT IN REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by letter or electronic communication, provided each letter or electronic communication makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER

Contractor

16C. DATE SIGNED

14. DESCRIPTION OF AMENDMENT/MODIFICATION

16B. UNITED STATES OF AMERICA

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15A. NAME AND TITLE OF SIGNER 16A. NAME AND TITLE OF CONTRACTING OFFICER

15B. CONTRACTOR/OFFEROR

STANDARD FORM 30 PREVIOUS EDITION NOT USABLE

Prescribed by GSA - FAR (48 CFR) 53.243

(Type or print) (Type or print)

(Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

(Number, street, county, State and ZIP Code)

(If other than Item 6)

(Specify type of modification and authority)

(such as changes in paying office, appropriation date, etc.)

(If required)

(SEE ITEM 11)

(SEE ITEM 13)

(X)

CHECK

ONE

13. THIS ITEM APPLIES ONLY TO MODIFICATIONS OF CONTRACTS/ORDERS,

IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

(Signature of person authorized to sign) (Signature of Contracting Officer)

1 21

561-24-2-240-0011

Department of Veterans Affairs Network Contracting Office (NCO) 2 2875 Union Road Suite 3500 Cheektowaga NY 14227

Department of Veterans Affairs Network Contracting Office (NCO) 2 2875 Union Road Suite 3500 Cheektowaga NY 14227

To all Offerors/Bidders

36C24224Q0908

07-31-2024

X

X X

See CONTINUATION Page

X 1

The purpose of this modification is to remove line items 0001, 0002, 0008, 1001, 1002, 1008, 2001, 2002, 2008, 3001, 3002, 3008, 4001, 4002, and 4008 other other line items were not renumbered.

The statement of work has also been updated (see below).

With those items noted, the bid dead has been extended to 08/28/2024 at 10:00 AM EST.

PLEASE SEND QUESTIONS AND BIDS TO BOTH MEGAN.ROSS3@VA.GOV AND TONY.CLEMENTE@VA.GOV.

MEGAN ROSS

CONTRACING OFFICER

A.1 PRICE/COST SCHEDULE

ITEM INFORMATION

ITEM

NUMBER

DESCRIPTION OF

SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

780.00 HR __________________ __________________

Project Manager Contract Period: Base POP Begin: 09-01-2024 POP End: 08-31-2025 PRINCIPAL NAICS CODE: 541990 - All Other Professional, Scientific, and Technical Services PRODUCT/SERVICE CODE: AF21 - Education, Training, Employment, and Social Services R&D Services; Training and Labor R&D; Basic Research

250.00 HR __________________ __________________

Technical Writer/Editor Contract Period: Base POP Begin: 09-01-2024 POP End: 08-31-2025 PRINCIPAL NAICS CODE: 541990 - All Other Professional, Scientific, and Technical Services PRODUCT/SERVICE CODE: AF21 - Education, Training, 1,020.00 HR __________________ __________________

Graphic Design Contract Period: Base POP Begin: 09-01-2024 POP End: 08-31-2025 PRINCIPAL NAICS CODE: 541990 - All Other Professional, Scientific, and Technical Services PRODUCT/SERVICE CODE: AF21 - Education, Training,

500.00 HR __________________ __________________

Website Support Contract Period: Base POP Begin: 09-01-2024 POP End: 08-31-2025 PRINCIPAL NAICS CODE: 541990 - All Other Professional, Scientific, and Technical Services PRODUCT/SERVICE CODE: AF21 - Education, Training, Social Media Support Contract Period: Base POP Begin: 09-01-2024 POP End: 08-31-2025 PRINCIPAL NAICS CODE: 541990 - All Other Professional, Scientific, and Technical Services PRODUCT/SERVICE CODE: AF21 - Education, Training, Contract Period: Option 1 POP Begin: 09-01-2025 POP End: 08-31-2026 PRINCIPAL NAICS CODE: 541990 - All Other Professional, Scientific, and Technical Services PRODUCT/SERVICE CODE: AF21 - Education, Training, Contract Period: Option 1 POP Begin: 09-01-2025 POP End: 08-31-2026 PRINCIPAL NAICS CODE: 541990 - All Other Professional, Scientific, and Technical Services PRODUCT/SERVICE CODE: AF21 - Education, Training, Contract Period: Option 1 POP Begin: 09-01-2025 POP End: 08-31-2026 PRINCIPAL NAICS CODE: 541990 - All Other Professional, Scientific, and Technical Services PRODUCT/SERVICE CODE: AF21 - Education, Training, Contract Period: Option 1 POP Begin: 09-01-2025 POP End: 08-31-2026 PRINCIPAL NAICS CODE: 541990 - All Other Professional, Scientific, and Technical Services PRODUCT/SERVICE CODE: AF21 - Education, Training, Contract Period: Option 1 POP Begin: 09-01-2025 POP End: 08-31-2026 PRINCIPAL NAICS CODE: 541990 - All Other Professional, Scientific, and Technical Services PRODUCT/SERVICE CODE: AF21 - Education, Training, Contract Period: Option 2 POP Begin: 09-01-2026 POP End: 08-31-2027 PRINCIPAL NAICS CODE: 541990 - All Other Professional, Scientific, and Technical Services PRODUCT/SERVICE CODE: AF21 - Education, Training, Contract Period: Option 2 POP Begin: 09-01-2026 POP End: 08-31-2027 PRINCIPAL NAICS CODE: 541990 - All Other Professional, Scientific, and Technical Services PRODUCT/SERVICE CODE: AF21 - Education, Training, Contract Period: Option 2 POP Begin: 09-01-2026 POP End: 08-31-2027 PRINCIPAL NAICS CODE: 541990 - All Other Professional, Scientific, and Technical Services PRODUCT/SERVICE CODE: AF21 - Education, Training, Contract Period: Option 2 POP Begin: 09-01-2026 POP End: 08-31-2027 PRINCIPAL NAICS CODE: 541990 - All Other Professional, Scientific, and Technical Services PRODUCT/SERVICE CODE: AF21 - Education, Training, Contract Period: Option 2 POP Begin: 09-01-2026 POP End: 08-31-2027 PRINCIPAL NAICS CODE: 541990 - All Other Professional, Scientific, and Technical Services PRODUCT/SERVICE CODE: AF21 - Education, Training, Contract Period: Option 3 POP Begin: 09-01-2027 POP End: 08-31-2028 PRINCIPAL NAICS CODE: 541990 - All Other Professional, Scientific, and Technical Services PRODUCT/SERVICE CODE: AF21 - Education, Training, Contract Period: Option 3 POP Begin: 09-01-2027

POP End: 08-31-2028 PRINCIPAL NAICS CODE: 541990 - All Other Professional, Scientific, and Technical Services PRODUCT/SERVICE CODE: AF21 - Education, Training, Contract Period: Option 3 POP Begin: 09-01-2027 POP End: 08-31-2028 PRINCIPAL NAICS CODE: 541990 - All Other Professional, Scientific, and Technical Services PRODUCT/SERVICE CODE: AF21 - Education, Training, Contract Period: Option 3 POP Begin: 09-01-2027 POP End: 08-31-2028 PRINCIPAL NAICS CODE: 541990 - All Other Professional, Scientific, and Technical Services PRODUCT/SERVICE CODE: AF21 - Education, Training, Contract Period: Option 3 POP Begin: 09-01-2027 POP End: 08-31-2028 PRINCIPAL NAICS CODE: 541990 - All Other Professional, Scientific, and Technical Services PRODUCT/SERVICE CODE: AF21 - Education, Training, Contract Period: Option 4 POP Begin: 09-01-2028 POP End: 08-31-2029 PRINCIPAL NAICS CODE: 541990 - All Other Professional, Scientific, and Technical Services

Contract Period: Option 4 POP Begin: 09-01-2028 POP End: 08-31-2029 PRINCIPAL NAICS CODE: 541990 - All Other Professional, Scientific, and Technical Services PRODUCT/SERVICE CODE: AF21 - Education, Training, Contract Period: Option 4 POP Begin: 09-01-2028 POP End: 08-31-2029 PRINCIPAL NAICS CODE: 541990 - All Other Professional, Scientific, and Technical Services PRODUCT/SERVICE CODE: AF21 - Education, Training, Contract Period: Option 4 POP Begin: 09-01-2028 POP End: 08-31-2029 PRINCIPAL NAICS CODE: 541990 - All Other Professional, Scientific, and Technical Services PRODUCT/SERVICE CODE: AF21 - Education, Training, Contract Period: Option 4 POP Begin: 09-01-2028 POP End: 08-31-2029 PRINCIPAL NAICS CODE: 541990 - All Other Professional, Scientific, and Technical Services

GRAND TOTAL __________________

CONTINUATION PAGE

1. Title:

Exposure Related Care Transformation Center (EXPRT) and the War Related Illness and Injury Study Center (WRIISC) Educational Communications

2. Purpose:

This procurement is seeking communications and educational services in order to provide Veterans, policymakers, providers and researchers with up-to-date information on military environmental exposures. Required services and products will include presentations, website and SharePoint updating, graphic-focused materials, advertisements and news briefs, web-based marketing campaigns, print newsletters, educational podcasts, information sheets and blogs among other materials. In addition, providing administration support for conferences including overseeing participants, travel, and continuing education. This includes coordinating with ILEAD and other stakeholders. Products will need to be consistent in their cohesive branding, clear messaging and innovative approaches which allow for EXPRT/WRIISC to educate Veterans and their health care teams. The demand for a large amount of new, high-quality products in a timely way is greater than can be delivered through staffing structures.

3. Background:

The EXPRT Center is located at the New Jersey War Related Illness and Injury Study Center. The EXPRT Center’s mission is to transform care and improve health for Veterans with military exposure concerns by accelerating research into action through education, implementation support, evaluation, and research.

Due to passage of the recent Sergeant First Class Heath Robinson Honoring Our Promise to Address Comprehensive Toxics Act of 2022 (referred as the “PACT act”), there is increasing attention on the need to communicate information, knowledge, and best practices to VA’s providers and Veterans around military environmental exposures. Additionally, a focus on military environmental exposures and related information is increasingly sought by policymakers that need concise and clear competing communications.

4. Scope:

The Vendor shall be able to perform a range of activities to support high quality communications (“new knowledge”) deliverables, including: i) graphic design for electronic and print materials, ii) digital and non-digital product development, to include website maintenance iii) development of communications activities and outreach campaigns. These deliverables shall span a variety of platforms to inform multiple key audiences (i.e., Veterans and their families, clinicians and scientists, academic collaborators and policymakers) about military environmental exposures.

5. Period of Performance:

The period of performance is one 12-month base period plus four option years.

6. Place of Performance:

Work will be performed offsite at the contractor’s facility for successful completion of required deliverables. Virtual meetings will be held at least weekly, along with a project kick-off and close-out meetings, lasting approximately 60 minutes each. Any additional meetings will be scheduled as needed. Meetings will be virtual using the Microsoft Teams or similar platform. Contractor must work within the VA secured electronic environment (Teams, SharePoint, etc.) to facilitate communications.

7. Travel:

Local travel within a 50-mile radius from the contractor’s and Government facility is considered the cost of doing business and will not be reimbursed.

8. Other Direct Costs (ODCs):

The Government anticipates that ODCs will be required to address the requirements.

ODCs are miscellaneous items such as suitable stock photography or printing as needed. ODCs will be reimbursed at contractor cost. Each contractor invoice must include copies of all receipts that support the ODCs claimed in the invoice and written substantiation for the incurred cost. The Contractor shall perform due diligence to ensure it incurs most‐favorable pricing prior to passing these costs on to the Government. Projected ODCs shall be reviewed by COR and authorized in advance by the Contracting Officer.

9. General Requirements:

The deliverables specified herein include plan and materials development, outreach, graphics support, evaluation design and support, multimedia development and support, and website development and support. Efforts shall include the development of a strategic communication plan that builds on communications efforts to date and is consistent with annual Center priorities for communication and outreach including development of multiple written materials; presentations and tool kits that are consistent with VA, VHA, and EXPRT/WRIISC strategic plans, policies, regulations, style guides, and publication standards. The Government will provide clarification on recommendations, requirements, templates, standards, and guidelines on all deliverables when clarification is not provided in this SOW prior to any action taken by the contractor. All work products developed by the contractor (formal and informal deliverables) shall become the property of the Government.

The contractor shall coordinate with the Contracting Officer Representative (COR) to schedule a Project Kick-Off Meeting with key staff; the VA PM and advisory group prior to commencing work. The contractor personnel shall also complete standard administrative tasks (e.g., background investigation forms, staff roster, mandatory training) as required.

The contractor shall prepare and submit progress reports to the COR and the VA PMs.

Monthly status reports shall be accompanied by a copy of that month’s invoice itemized by deliverable, as applicable. Progress reports shall include a narrative review of work accomplished during the reporting period itemized by project, significant events, problem areas, anticipated activity for the next reporting period, description of any travel or unique services provided, and other relevant information.

The contractor shall regularly participate in contract management meetings TBD. The contractor shall work with the VA COR to prepare the meeting agenda and prepare summary notes. Meetings will also be held to gather input from subject matter experts (SME), identify their needs, and translate the strategic communication plan into action. Reports, meeting agendas, and draft/final deliverables will be saved and tracked on the VA network using SharePoint and Microsoft Teams.

The contractor shall provide the specific deliverables described below within the performance period of the resulting contract. An outline for each product shall be created for review prior to developing content. All content shall be provided in draft and be subject to two rounds of revisions. Once written content is approved, layout and design can proceed again with two rounds of revisions. Where a written milestone deliverable is required in draft form, the VA COR and lead technical contact will complete a review of the draft deliverable and provide feedback within ten business days from date of receipt. The VA COR will provide approval for each final deliverable, or rejection of the final deliverable with summary reasons in writing within five business days.

10 Tasks

10.1 Task 1: Project Management

10.1.1. The vendor shall develop a project plan that outlines the overall strategic approach to the requested work. The plan should address:

ꞏ Deliverables and deadlines

ꞏ Resources needed

ꞏ Roles and responsibilities

ꞏ Monthly progress reports

ꞏ Weekly teleconferences

VA will review the proposed project plan and return it to the contractor within two weeks with comments and any adjustments that might need to be made. For initial drafts of other deliverables, VA will provide comments within 10 days of draft receipt.

10.2 Task Deliverables: Communication Materials and Product Development

10.2.1 Develop clear and visually appealing communication materials and products.

Proposed products to be created may include brochures, posters, information sheets, blogs, briefs, info graphics, audio or video education, reports, presentation materials for Veterans and scientific presentations, brochures, postcards, exhibits, etc., as well as graphic design products listed in task 10.4.

10.2.2 Using best practices, develop a range of content using concepts of effective risk communication, health care communications and scientific medical communications.

10.2.3 Work collaboratively and closely with EXPRT/WRIISC SME’s, etc. to research a topic, develop draft content for review, revisions, and approval, and develop recommendations to disseminate related information in appropriate formats and language suitable for intended audiences. Ensure 508 compliance.

10.2.4 Develop social media (e.g., Facebook, Twitter) content that appeals to targeted audiences, e.g., Veterans, VA clinicians, etc. Build on current social media presence and evaluate effectiveness of alternate strategies.

10.3 Task Deliverables: Website and SharePoint Support

10.3.1 Develop web content to more broadly and effectively appeal to targeted audiences considering customer’s usability, needs, and communications preferences.

Ensure website remains up to date.

10.3.2 Update/maintain/create content for WRIISC and EXPRT websites and SharePoints and continue to develop web pages or other standalone web content in conjunction with the WRIISC webmaster in versions compatible with both computer and mobile view.

10.4 Task Deliverables: Graphic Design

10.4.1 Develop digital images, illustrations, artwork photography, animations, videos, and other products for use in electronic (e.g., website, social media) and print materials (e.g., reports, articles, presentations, factsheets, newsletters). Ensure suitable access to digital photography for use in products and create as needed.

10.4.2 Utilize and document design principles and high-resolution imagery with appropriate copyright and 508 compliance (if necessary). The contractor shall be responsible for production and/or reproduction of these materials, as necessary, revisions, and approval, and develop recommendations to disseminate related information in appropriate formats and language suitable for intended audiences.

11. Personnel: Certain skilled experience professional and/or technical personnel are essential for accomplishing the work to be performed and provide the greatest value.

These are defined as key personnel and are those persons the contractor identifies and those whose résumés are submitted. The Contractor agrees that the key personnel roles shall not be removed, diverted, or replaced from work without coordination with the CO and COR. The following labor categories are defined as Key Personnel Roles:

a. Technical Writer(s): Assist in planning, editing and writing content for a variety of internal communications mediums. Collaborate with team members to assist with key message development and outreach strategies. ≥ 4 years of experience.

b. Graphic Designer(s): Experienced Graphic Designer; ≥ 4 years generating and manipulating graphic images, animations, sound, text and video into multimedia programs. Expert knowledge of current graphic design software to produce graphic art and visual materials for informative and instructional material. Prefer experience with military/Veteran populations and associated vernacular.

c. Web/SharePoint Support Specialist(s): Collaborates with team members to provide technical support and coordination for updates and maintenance. Troubleshoots any problems to determine causes and provide solutions. ≥ 4 years of experience.

d. Project Management Professional(s): The support professional may serve to facilitate meetings, prepare invoices, procure products and other associated administrative tasks.

12. Substitution of Key Personnel: All Contractor requests for approval of substitutions hereunder shall be submitted in writing to the COR and the Contracting Officer at least thirty (30) calendar days in advance of the effective date, whenever possible, and shall provide a detailed explanation of the circumstances necessitating the proposed substitution, a complete resume for the proposed substitute, and any other information requested by the Contracting Officer necessary to approve or disapprove the proposed substitution. New personnel shall not commence work until resumes are provided and accepted. The COR and the Contracting Officer will evaluate such requests and promptly notify the Contractor of approval or disapproval in writing.

The Contractor shall be responsible for managing and overseeing the activities of all Contractor contracted personnel, as well as sub-contractor efforts used in performance of this effort. The Contractor’s management responsibilities shall include all activities necessary to ensure the accomplishment of timely and effective support, performed in accordance with the requirements contained herein.

13. Information Security: The Contractor will require access to VA Information and VA Information Systems only to interact with subject matter experts, create content (e.g., VA’s web, SharePoint, Teams), and facilitate communication.

14. Security: The C&A requirements do not apply, and a Security Accreditation Package is not required

15. Government-Furnished Information, Equipment, and Facilities. The Government will provide access to information necessary for the execution of each task.

16. Security Requirements. The C&A requirements do not apply, and a Security Accreditation Package is not required

17. Task Order Quality Assurance Surveillance Plan (QASP).

The Government shall evaluate the contractor's performance in accordance with the Quality Assurance Surveillance Plan (QASP). This plan is primarily focused on what the government must do to ensure the contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rates.

Deliverable/Requirement Performance Standard

Surveillance Method

Outcome

Project Management

Milestones, and Schedule

Notifies customer of potential problems 95% of the time.

Submits Deliverables in accordance with the deliverable

100% Inspection of agreed upon milestones per the approved project plan.

100% Inspection of deliverables.

Notification occurs within two business days of potential issue when known in advance or within 24 hours of urgent problems, where schedule within (+/-) five business days with no more than five incidents of performance slippage.

less than two business days exist.

18. Organizational Conflict of Interest and non-disclosure requirements

If the Contractor is currently providing support or anticipates providing support to the VHA that creates or represents an actual or potential organizational conflict of interest (OCI), the Contractor shall immediately disclose this actual or potential OCI in accordance with FAR Part 9.5. The contractor is also required to complete and sign an Organizational Conflict of Interest Statement in which the Contractor (and any sub-contractors, consultants or teaming partners) agree to disclose information concerning the actual or potential conflict with any proposal for any solicitation relating to any work in the TO. All actual or potential OCI situations shall be handled in accordance with FAR Subpart 9.5.

19. Non-Disclosure Requirements

All Contractor personnel (to include sub-contractors, teaming partners, and consultants) who shall be personally and substantially involved in the performance of the TO issued which requires the contractor to act on behalf of or provide advice with respect to any phase of an agency procurement, as defined in FAR 3.104-4, shall execute and submit an “Employee/Contractor Non-Disclosure Agreement” Form. This is required prior to the commencement of any work on such TO and whenever replacement personnel are proposed under an ongoing TO. Any information obtained or provided in the performance of this TO is only to be used in the performance of the

TO.

20. GENERAL

Contractors, Contractor personnel, Subcontractors, and Subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security.

21. ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS

a) A Contractor/Subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, Subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order.

b) All Contractors, Subcontractors, and third-party servicers and associates working with VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for Contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures.

c) Contract personnel who require access to national security programs must have a valid security clearance. National Industrial Security Program (NISP) was established by Executive Order 12829 to ensure that cleared U.S. defense industry contract personnel safeguard the classified information in their possession while performing work on contracts, programs, bids, or research and development efforts. The Department of Veterans Affairs does not have a Memorandum of Agreement with Defense Security Service (DSS). Verification of a Security Clearance must be processed through the Special Security Officer located in the Planning and National Security Service within the Office of Operations, Security, and Preparedness.

d) Custom software development and outsourced operations must be located in the U.S. to the maximum extent practical. If such services are proposed to be performed abroad and are not disallowed by other VA policy or mandates, the Contractor/Subcontractor must state where all non-U.S. services are provided and detail a security plan, deemed to be acceptable by VA, specifically to address mitigation of the resulting problems of communication, control, data protection, and so forth. Location within the U.S. may be an evaluation factor.

e). The Contractor or Subcontractor must notify the Contracting Officer immediately when an employee working on a VA system or with access to VA information is reassigned or leaves the Contractor or Subcontractor’s employ. The Contracting Officer must also be notified immediately by the Contractor or Subcontractor prior to an unfriendly termination.

22. VA INFORMATION CUSTODIAL LANGUAGE

a) Information made available to the Contractor or Subcontractor by VA for the performance or administration of this contract or information developed by the Contractor/Subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the Contractor/Subcontractor's rights to use data as described in Rights in Data - General, FAR 52.227-14(d) (1).

b) VA information should not be co-mingled, if possible, with any other data on the Contractors/Subcontractor’s information systems or media storage systems in order to ensure VA requirements related to data protection and media sanitization can be met.

If co-mingling must be allowed to meet the requirements of the business need, the Contractor must ensure that VA’s information is returned to the VA or destroyed in accordance with VA’s sanitization requirements. VA reserves the right to conduct on site inspections of Contractor and Subcontractor IT resources to ensure data security controls, separation of data and job duties, and destruction/media sanitization procedures are in compliance with VA directive requirements.

c) Prior to termination or completion of this contract, Contractor/Subcontractor must not destroy information received from VA, or gathered/created by the Contractor in the course of performing this contract without prior written approval by the VA. Any data destruction done on behalf of VA by a Contractor/Subcontractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self-certification by the Contractor that the data destruction requirements above have been met must be sent to the VA Contracting Officer within 30 days of termination of the contract.

d) The Contractor/Subcontractor must receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with the terms of the contract and applicable Federal and VA information confidentiality and security laws, regulations and policies. If Federal or VA information confidentiality and security laws, regulations and policies become applicable to the VA information or information systems after execution of the contract, or if NIST issues or updates applicable FIPS or Special Publications (SP) after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations and policies in this contract.

e) The Contractor/Subcontractor shall not make copies of VA information except as authorized and necessary to perform the terms of the agreement or to preserve electronic information stored on Contractor/Subcontractor electronic storage media for restoration in case any electronic equipment or data used by the Contractor/Subcontractor needs to be restored to an operating state. If copies are made for restoration purposes, after the restoration is complete, the copies must be appropriately destroyed.

f) If VA determines that the Contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the Contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12.

g) If a VHA contract is terminated for cause, the associated BAA must also be terminated and appropriate actions taken in accordance with VHA Handbook 1600.01, Business Associate Agreements. Absent an agreement to use or disclose protected health information, there is no business associate relationship.

h) The Contractor/Subcontractor must store, transport, or transmit VA sensitive information in an encrypted form, using VA-approved encryption tools that are, at a minimum, FIPS 140-2 validated.

i) The Contractor/Subcontractor’s firewall and Web services security controls, if applicable, shall meet or exceed VA’s minimum requirements. VA Configuration Guidelines are available upon request.

j) Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the Contractor/Subcontractor may use and disclose VA information only in two other situations: (i) in response to a qualifying order of a court of competent jurisdiction, or (ii) with VA’s prior written approval. The Contractor/Subcontractor must refer all requests for, demands for production of, or inquiries about, VA information and information systems to the VA contracting officer for response.

k) Notwithstanding the provision above, the Contractor/Subcontractor shall not release VA records protected by Title 38 U.S.C. 5705, confidentiality of medical quality assurance records and/or Title 38 U.S.C. 7332, confidentiality of certain health records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse, or infection with human immunodeficiency virus. If the Contractor/Subcontractor is in receipt of a court order or other requests for the above mentioned information, that Contractor/Subcontractor shall immediately refer such court orders or other requests to the VA contracting officer for response.

l) For service that involves the storage, generating, transmitting, or exchanging of VA sensitive information but does not require C&A or an MOU-ISA for system interconnection, the Contractor/Subcontractor must complete a Contractor Security Control Assessment (CSCA) on a yearly basis and provide it to the COTR.

23. SECURITY INCIDENT INVESTIGATION

a) The term “security incident” means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. The Contractor/Subcontractor shall immediately notify the COTR and simultaneously, the designated ISO and Privacy

Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the Contractor/Subcontractor has access.

b) To the extent known by the Contractor/Subcontractor, the Contractor/Subcontractor’s notice to VA shall identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the VA information or assets were placed at risk or compromised), and any other information that the Contractor/Subcontractor considers relevant.

c) With respect to unsecured protected health information, the business associate is deemed to have discovered a data breach when the business associate knew or should have known of a breach of such information. Upon discovery, the business associate must notify the covered entity of the breach. Notifications need to be made in accordance with the executed business associate agreement.

d) In instances of theft or break-in or other criminal activity, the Contractor/Subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG and Security and Law Enforcement. The contractor, its employees, and its Subcontractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The Contractor/Subcontractor shall cooperate with VA in any civil litigation to recover VA information, obtain monetary or other compensation from a third party for damages arising from any incident, or obtain injunctive relief against any third party arising from, or related to, the incident.

24. LIQUIDATED DAMAGES FOR DATA BREACH

a) Consistent with the requirements of 38 U.S.C. §5725, a contract may require access to sensitive personal information. If so, the Contractor is liable to VA for liquidated damages in the event of a data breach or privacy incident involving any SPI the Contractor/Subcontractor processes or maintains under this contract.

b) The Contractor/Subcontractor shall provide notice to VA of a “security incident” as set forth in the Security Incident Investigation section above. Upon such notification, VA must secure from a non-Department entity or the VA Office of Inspector General an independent risk analysis of the data breach to determine the level of risk associated with the data breach for the potential misuse of any sensitive personal information involved in the data breach. The term 'data breach' means the loss, theft, or other unauthorized access, or any access other than that incidental to the scope of employment, to data containing sensitive personal information, in electronic or printed form, that results in the potential compromise of the confidentiality or integrity of the data. Contractor shall fully cooperate with the entity performing the risk analysis. Failure to cooperate may be deemed a material breach and grounds for contract termination.

Each risk analysis shall address all relevant information concerning the data breach, including the following:

i. Nature of the event (loss, theft, unauthorized access);

ii. Description of the event, including:

iii. date of occurrence;

iv. data elements involved, including any PII, such as full name, social security number, date of birth, home address, account number, disability code;

v. Number of individuals affected or potentially affected;

vi. Names of individuals or groups affected or potentially affected;

vii. Ease of logical data access to the lost, stolen or improperly accessed data in light of the degree of protection for the data, e.g., unencrypted, plain text;

viii. Amount of time the data has been out of VA control;

ix. The likelihood that the sensitive personal information will or has been compromised (made accessible to and usable by unauthorized persons);

x. Known misuses of data containing sensitive personal information, if any;

xi. Assessment of the potential harm to the affected individuals;

xii. Data breach analysis as outlined in 6500.2 Handbook, Management of Security and Privacy Incidents, as appropriate; and

xiii. Whether credit protection services may assist record subjects in avoiding or mitigating the results of identity theft based on the sensitive personal information that may have been compromised.

Based on the determinations of the independent risk analysis, the Contractor shall be responsible for paying to the VA liquidated damages in the amount of $37.50 per affected individual to cover the cost of providing credit protection services to affected individuals consisting of the following:

i. Notification;

ii. One year of credit monitoring services consisting of automatic daily monitoring of at least 3 relevant credit bureau reports;

iii. Data breach analysis;

iv. Fraud resolution services, including writing dispute letters, initiating fraud alerts and credit freezes, to assist affected individuals to bring matters to resolution;

v. One year of identity theft insurance with $20,000.00 coverage at $0 deductible; and

vi. Necessary legal expenses the subjects may incur to repair falsified or damaged credit records, histories, or financial affairs.

25. TRAINING

a) All Contractor employees and Subcontractor employees requiring access to VA information and VA information systems shall complete the following before being granted access to VA information and its systems:

i. Sign and acknowledge (either manually or electronically) understanding of and responsibilities for compliance with the Contractor Rules of Behavior, Appendix D relating to access to VA information and information systems;

ii. Successfully complete the VA Cyber Security Awareness and Rules of Behavior training and annually complete required security training;

iii. Successfully complete the appropriate VA privacy training and annually complete required privacy training; and

iv. Successfully complete any additional cyber security or privacy training, as required for VA personnel with equivalent information system access

b) The Contractor shall provide to the contracting officer and/or the COTR a copy of the training certificates and certification of signing the Contractor Rules of Behavior for each applicable employee within 1 week of the initiation of the contract and annually thereafter, as required.

c) Failure to complete the mandatory annual training and sign the Rules of Behavior annually, within the timeframe required, is grounds for suspension or termination of all physical or electronic access privileges and removal from work on the contract until such time as the training and documents are complete.