S06 - 36C24826Q1057 0002_Extend RFQ Close Date and Update PWS Section 6.8.pdf

5. PROJECT NUMBER (if applicable)

CODE 7. ADMINISTERED BY

2. AMENDMENT/MODIFICATION NUMBER

CODE

6. ISSUED BY

8. NAME AND ADDRESS OF CONTRACTOR

4. REQUISITION/PURCHASE REQ. NUMBER 3. EFFECTIVE DATE

9A. AMENDMENT OF SOLICITATION NUMBER

9B. DATED

PAGE OF PAGES

10A. MODIFICATION OF CONTRACT/ORDER NUMBER

10B. DATED

BPA NO. 1. CONTRACT ID CODE

FACILITY CODE CODE

Offers must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended, by one of the following methods:

The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offers

E. IMPORTANT:

is extended,

(a) By completing Items 8 and 15, and returning __________ copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted; or (c) By separate letter or electronic communication which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGMENT TO BE RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY is not extended.

12. ACCOUNTING AND APPROPRIATION DATA

(REV. 11/2016)

is required to sign this document and return ___________ copies to the issuing office. is not, A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE CONTRACT ORDER NO. IN ITEM 10A.

15C. DATE SIGNED

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(b).

RESULT IN REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by letter or electronic communication, provided each letter or electronic communication makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER

Contractor

16C. DATE SIGNED

14. DESCRIPTION OF AMENDMENT/MODIFICATION

16B. UNITED STATES OF AMERICA

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15A. NAME AND TITLE OF SIGNER 16A. NAME AND TITLE OF CONTRACTING OFFICER

15B. CONTRACTOR/OFFEROR

STANDARD FORM 30 PREVIOUS EDITION NOT USABLE

Prescribed by GSA - FAR (48 CFR) 53.243

(Type or print) (Type or print)

(Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

(Number, street, county, State and ZIP Code)

(If other than Item 6)

(Specify type of modification and authority)

(such as changes in paying office, appropriation date, etc.)

(If required)

(SEE ITEM 11)

(SEE ITEM 13)

(X)

CHECK

ONE

13. THIS ITEM APPLIES ONLY TO MODIFICATIONS OF CONTRACTS/ORDERS,

IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

(Signature of person authorized to sign) (Signature of Contracting Officer)

1 26

0002 10-26-2026

None

36C248

Department of Veterans Affairs Network Contracting Office 8 (NCO 8)

8875 Hidden River Pkwy Suite 525 Tampa FL 33637

36C248

Department of Veterans Affairs Network Contracting Office 8 (NCO 8)

8875 Hidden River Pkwy Tampa FL 33637

To all Offerors/Bidders

36C24826Q1057

09-15-2026

X

X X

** HOUR & DATE for Receipt of Offers is EXTENDED to: 11-09-2026 4:30pm EDT

X one (1)

The purpose of this amendment is to extend the due date and time for the receipt of quotations for the above referenced Request for Quotations (RFQ), block 9a, from Wednesday, October 28, 2026, to Monday, November 9, 2026, and to update Performance Work Statement (PWS) section 6.8. Contractor Security Requirements (VA Handbook 6500.6) See attached for the required change.

An amendment addressing vendor questions will be forthcoming. No additional questions will be addressed.

Jayne Messer Contracting Officer

VA-VHARPOE-2023-0120

CONTINUATION SHEET

Section 6.8. Contractor Security Requirements (VA Handbook 6500.6) of the Performance Work Statement, pages 27 through 47 of the Request for Quotations (RFQ), is hereby removed and replaced with the following:

6.8. Contractor Security Requirements (VA Handbook 6500.6)

VA CYBERSECURITY AND PRIVACY

The Department of Veterans Affairs (VA) Cybersecurity and Privacy language from Sections a-m are the minimum VA requirements, and each section shall be included in full, without alterations, in the Statement of Work (SOW), Performance Work Statement (PWS), Product Description (PD) or contract.

NOTE: Medical devices / systems as defined by VA Directive 6550, Pre-Procurement Assessment and Implementation of Medical Devices / Systems may be exempted from specific cybersecurity requirements below where implementation is not technically feasible, would invalidate manufacturer support, conflict with FDA-cleared configurations, or adversely impact patient safety or clinical operations. Any proposed exemptions must be documented, including risk justification and compensating controls, and be approved by the requesting office, Information System Security Officer (ISSO), and Contracting Officer (CO) prior to contract award/implementation. VA minimum privacy and security requirements address:

a. GENERAL

(1) Contractors, Contractor personnel, Sub-Contractor and Sub-Contractor personnel (hereinafter referred to as “Contractor”) will be subject to the same Federal laws, regulations, standards, VA directives and handbooks as VA personnel regarding information and information system security and privacy.

(2) VA Cybersecurity and Privacy language included in the solicitation or contract applies to the Contractor and all Contractor affiliates and agents.

(3) All information systems, applications, and services operating on behalf of or within VA must meet or exceed all applicable federal cybersecurity and risk management minimum standards. At a minimum, systems shall implement and maintain compliance with the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-37, Risk Management Framework for Information Systems and Organization: A System Life Cycle Approach for Security and Privacy, Federal Information Security Modernization Act of 2014 (FISMA) requirements, and all applicable federal laws, and Office of Management and Budget (OMB) mandates. Contractual terms, implementation approaches, or operational constraints shall not supersede or circumvent these federal minimum security and compliance requirements. Authority established under this handbook is limited to technical, and enterprise architecture matters; interpretation or adjudication of non-technical policy or programmatic content remains the responsibility of the appropriate business or governing policy offices.

https://csrc.nist.gov/pubs/sp/800/37/r2/final https://csrc.nist.gov/pubs/sp/800/37/r2/final https://csrc.nist.gov/pubs/sp/800/37/r2/final https://csrc.nist.gov/pubs/sp/800/37/r2/final https://csrc.nist.gov/pubs/sp/800/37/r2/final https://csrc.nist.gov/pubs/sp/800/37/r2/final https://csrc.nist.gov/pubs/sp/800/37/r2/final https://www.congress.gov/113/plaws/publ283/PLAW-113publ283.pdf https://www.congress.gov/113/plaws/publ283/PLAW-113publ283.pdf https://www.congress.gov/113/plaws/publ283/PLAW-113publ283.pdf

b. VA INFORMATION CUSTODIAL

(1) The Contractor must provide unlimited rights to data / intellectual property first produced and delivered in the performance of this contract or order (hereinafter “contract”) unless expressly stated otherwise in this contract.

This includes all rights to source code and all documentation created in support thereof. The primary clause used to define Government and Contractor data rights is Federal Acquisition Regulation (FAR) 52.227-14, Rights in Data – General.

(a) The Contractor must provide all custom-developed code and technical components developed in the performance of this contract (e.g., documentation; data models; schemas; metadata; architecture designs;

configuration scripts; and artifacts required to develop, build, test, and deploy the code for or on behalf of VA) for storage in a VA-designated repository for custom-developed code in a format that allows VA to access, use, modify, distribute, and reuse it in accordance with the Source Code Harmonization and Reuse in Information Technology Act of 2024 (SHARE IT Act).

(b) The Contractor must provide any support and assistance deemed necessary for VA to comply with the SHARE IT Act (e.g., furnishing data for reporting and following federal and VA standards for custom code development).

(2) Information made available to the Contractor by VA for the performance or administration of this contract will be used only for the purposes specified in the contract, service agreement, SOW, PWS, and / or PD. The Contractor shall not use VA information in any other manner without prior written approval from a VA CO. The Contractor shall disclose to the CO all Data to be collected, stored, and accessed and will only collect, store, and access the minimum Data necessary to perform its services. The Contractor may only use VA information within the terms of the contract and applicable Federal law, regulations, and VA policies. If new Federal laws, regulations, or VA policies become applicable after execution of the contract, the parties agree to negotiate contract modification and adjustment necessary to implement the new laws, regulations, and / or policies. The primary clause used to define Government and Contractor data rights is FAR 52.227-14.

(3) The Contractor shall not make copies of VA information unless necessary to perform the requirements of the contract. If copies are made for restoration purposes, after the restoration is complete, the copies shall be destroyed in accordance with VA Directive 6500, VA Cybersecurity Program, and VA Office of Information Security (OIS) Knowledge Service.

https://www.acquisition.gov/far/52.227-14 https://www.acquisition.gov/far/52.227-14 https://www.congress.gov/118/plaws/publ187/PLAW-118publ187.pdf https://www.congress.gov/118/plaws/publ187/PLAW-118publ187.pdf https://www.congress.gov/118/plaws/publ187/PLAW-118publ187.pdf

(4) VA information will not be co-mingled with any other data on the Contractor’s information systems or media storage systems. The Contractor shall ensure compliance with Federal and VA requirements related to data protection, data encryption, physical data segregation, logical data segregation, classification requirements and media sanitization. Exceptions to this paragraph will be granted only with the approval of the VA Program Office communicated to the Contractor by the VA CO.

(5) Except for uses and disclosures of VA information specifically authorized by this contract, the Contractor may use and disclose VA information only in two situations: (i) in response to a qualifying order of a court of competent jurisdiction after notification to VA CO (ii) with written approval from the VA CO. The Contractor shall refer all requests for, or inquiries about, VA information and information systems to the VA CO.

(6) Notwithstanding the provision above, the Contractor shall not release VA records protected by Title 38 United States Code (U.S.C.) § 5705, Confidentiality of medical quality- assurance records, and / or Title 38 U.S.C. § 7332, Confidentiality of certain medical records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse or infection with Human Immunodeficiency Virus (HIV). If the Contractor is in receipt of a court order or other form of request for the above-mentioned information, the Contractor shall immediately refer that court order or request to the VA CO.

(7) If a VHA contract is terminated for default or cause with a business associate, the related local Business Associate Agreement (BAA) shall also be terminated and actions taken in accordance with Veterans Health Administration (VHA) Directive 1605.05, Business Associate Agreements. If there is an executed national BAA associated with the contract, VA will determine what actions are appropriate and notify the contractor.

(8) Information made available to the Contractor by VA for the performance or administration of this contract, or information developed by the Contractor in performance or administration of the contract, will be protected and secured in accordance with VA Directive 6500, VA Directive 6510, VA Identity, Credential, and Access Management, and VA Handbook 6510, VA Identity, Credential and Access Management.

(9) The Contractor shall store VA sensitive information in an encrypted form, using VA-approved encryption tools which are Federal Information Processing Standards (FIPS)-validated in accordance with requirements on the OIS Knowledge Service. The Contractor shall verify the integrity of transmitted security and privacy attributes. The Contractor shall provide the capability to check the integrity of VA information while it resides in the external system.

https://uscode.house.gov/view.xhtml?req=granuleid%3AUSC-prelim-title38-section5705&num=0&edition=prelim https://uscode.house.gov/view.xhtml?req=granuleid%3AUSC-prelim-title38-section5705&num=0&edition=prelim https://www.law.cornell.edu/uscode/text/38/7332 https://www.law.cornell.edu/uscode/text/38/7332 https://www.bing.com/ck/a?!&&p=ddc1a2baa4d8effd8b3d69d386e1c139e3b4f93cb8e4ca7179827ab00481e3a4JmltdHM9MTc1Nzg5NDQwMA&ptn=3&ver=2&hsh=4&fclid=06e87191-2473-6a6c-1edc-67bd25bc6bd0&psq=vha%2Bdirective%2B1605.05&u=a1aHR0cHM6Ly93d3cudmEuZ292L3ZoYXB1YmxpY2F0aW9ucy9WaWV3UHVibGljYXRpb24uYXNwP3B1Yl9JRD05MTc4 https://www.bing.com/ck/a?!&&p=ddc1a2baa4d8effd8b3d69d386e1c139e3b4f93cb8e4ca7179827ab00481e3a4JmltdHM9MTc1Nzg5NDQwMA&ptn=3&ver=2&hsh=4&fclid=06e87191-2473-6a6c-1edc-67bd25bc6bd0&psq=vha%2Bdirective%2B1605.05&u=a1aHR0cHM6Ly93d3cudmEuZ292L3ZoYXB1YmxpY2F0aW9ucy9WaWV3UHVibGljYXRpb24uYXNwP3B1Yl9JRD05MTc4 https://vaww.my.sites.va.gov/policy/viewer/paKMOE0000000IlU4AU https://vaww.my.sites.va.gov/policy/viewer/paKMOE0000000IlU4AU https://vaww.my.sites.va.gov/policy/viewer/paKMOE0000000IlU4AU https://vaww.my.sites.va.gov/policy?p=paKMOE0000000KL44AM https://vaww.my.sites.va.gov/policy?p=paKMOE0000000KL44AM https://vaww.my.sites.va.gov/policy?p=paKMOE0000000KL44AM

(10) The Contractor shall transmit VA sensitive information using VA approved Transport Layer Security (TLS) configured with FIPS based cipher suites in conformance with NIST SP 800-52, Guidelines for the Selection, Configuration and Use of Transport Layer Security (TLS) Implementations.

The cryptographic module used must be FIPS-validated in accordance with requirements on the OIS Knowledge Service.

(11) The Contractor’s firewall security shall meet or exceed VA’s minimum requirements.

(12) The Contractor shall retain all data storage media which have been used to create, collect, process, store, or disseminate any VA data, information, or agency record in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management, VA Handbook 6300.1, Records Management Procedures, and applicable VA Records Control Schedules.

(13) The Contractor shall not store or maintain VA sensitive information, including on any form of removable or transportable media, without CO’s prior written approval.

(14) The Contractor, in accordance with Federal and VA policy, shall maintain backup of Data containing VA sensitive information, image repositories, and provisioned environments. The backup storage infrastructure shall be located in physically protected, limited-access facilities within the United States and governed by the cybersecurity Controls set forth herein.

(15) The Contractor shall provide its plan for the disposition of all VA data in its possession, including destruction and return, in accordance with VA Directive 6500 and requirements specified on the VA OIS Knowledge Service, prior to termination or completion of this contract.

(16) The Contractor shall return to VA all data storage media which have been used to create, collect, process, store, or disseminate any VA data, information, or agency record which cannot be sanitized or destroyed as required by Section b(15) of this contract. Such media include, but are not limited to, printed or handwritten hardcopies (containing text or images), magnetic tapes, magnetic discs, optical discs, solid state devices, or any other removable digital or analog data storage media.

(17) Media shall be returned using VA-approved methods for secure data transfer. If the media contain VA sensitive information, that information must be encrypted by a VA-approved FIPS-validated encryption tool in accordance with requirements on the OIS Knowledge Service. If the Contractor chooses to ship the media, and the media contain no VA sensitive information, such shipment shall be performed in accordance with VA Directive 6340, Enterprise Mail Management. If any of the media to be https://csrc.nist.gov/pubs/sp/800/52/r2/final https://csrc.nist.gov/pubs/sp/800/52/r2/final https://vaww.my.sites.va.gov/policy?p=paKMOE00000008ln4AA https://vaww.my.sites.va.gov/policy?p=paKMOE00000008ln4AA https://vaww.my.sites.va.gov/policy/viewer/paKMOE00000009Cf4AI https://vaww.my.sites.va.gov/policy/viewer/paKMOE00000009Cf4AI https://vaww.my.sites.va.gov/policy/viewer/paKMOE00000009Bf4AI shipped contain VA Sensitive Information, the shipment shall be performed in accordance with VA Directive 6609, Mailing of Sensitive Personal Information.

(18) The Contractor shall self-certify that the data disposition requirements in Section b(12)-(15) of this contract have been satisfied, and shall send this self-certification to the VA Program Office and the VA CO within 30 business days of the completion or termination of this contract.

(19) At the end of any contracted lease, loan, or trade-in of equipment, VA shall not return any electronic storage media included in or with equipment if that media has been used to create, collect, process, store, or disseminate VA data, information, or agency record. Any exception to this stipulation will be granted only with the written approval of the VA CO.

(20) VA reserves the right to conduct scheduled or unscheduled audits, assessments, or investigations of Contractor Information Technology (IT) resources to ensure information security is compliant with Federal and VA requirements in accordance with Title 38 U.S.C. § 5722(b)(1). This includes, but is not limited to, periodic assessments of the risk and magnitude of harm that could result from the unauthorized access, use, disclosure, disruption, modification, or destruction of information and information systems that support the operations and assets of VA. The Contractor shall provide all necessary access to records (including electronic and documentary materials related to the contracts and subcontracts) and support (including access to Contractors associated with the contract) to VA, VA's Office Inspector General (OIG), and / or the Government Accountability Office (GAO) staff during periodic control assessments, audits, or investigations.

c. ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS

(1) All Contractors shall comply with conditions specified in the Veterans Affairs Acquisition Regulation (VAAR) 852.204-71(d), and Contractor operations are required to be in U.S. All Contractors working with VA information must be permanently located within a jurisdiction subject to the law of the U.S. to the maximum extent practicable. The Contractor shall also ensure to restrict the geographic location of information processing and data storage to facilities located within the legal jurisdictional boundary of the U.S. If services are proposed to be performed abroad, the Contractor must state where all non- U.S. services are provided and obtain the CO’s prior written approval where required by law.

(2) The Contractor shall deliver to VA a detailed risk mitigation plan specifically addressing communications, personnel control, data protection and potential legal issues. The plan shall be approved by the Contracting Officer (CO) in writing prior to access being granted.

https://vaww.my.sites.va.gov/policy/viewer/paKMOE000000090d4AA https://vaww.my.sites.va.gov/policy/viewer/paKMOE000000090d4AA https://uscode.house.gov/view.xhtml?req=granuleid%3AUSC-prelim-title38-section5722&num=0&edition=prelim https://www.acquisition.gov/vaar/852.204-71-information-and-information-systems-security https://www.acquisition.gov/vaar/852.204-71-information-and-information-systems-security https://www.acquisition.gov/vaar/852.204-71-information-and-information-systems-security

(3) The Contractor shall ensure that all Contractors assigned to work on the contract undergo the same security investigations and obtain the same levels of clearance as VA employees who have been granted access to VA information at the same level of sensitivity. The level and process of background security investigations for Contractors shall be in accordance with VA Directive 0710, Personnel Vetting Program, and VA Handbook 0710, Personnel Vetting Program.

(4) The Contractor shall request logical (electronic) or physical access to VA information and VA information systems only to the extent that the requested information is needed to perform the services specified in the solicitation or contract. Contractors who require privileged access to any VA Information System (or component) shall complete the VA elevated privilege access request processes before privileged access is granted.

(5) Before being granted access to VA information or VA information systems, Contractors shall:

(a) Successfully complete VA Privacy and Information Security Awareness and Rules of Behavior (RoB) course [Talent Management System (TMS) #10176] upon contract initiation and annually thereafter;

(b) Sign and acknowledge (electronically through TMS #10176) understanding of and responsibilities for compliance with the VA RoB for Organizational Users; and

(c) Successfully complete all additional cybersecurity or privacy training required for personnel granted equivalent information system or information access.

(6) The Contractor shall provide to the VA Program Office a copy of each applicable employee’s training certificates and certificate of signature of the VA RoB for Organizational Users within five (5) business days of contract initiation and annually thereafter. Failure by the Contractor to complete the mandatory annual training is grounds for suspension or termination of all privileges to access VA information physically or electronically and removal from work on the contract until such time as the required training has been successfully completed.

(a) The Contractor shall notify the VA Program Office and the VA CO in writing immediately (within 24 hours) after any of the following events:

i The Contractor no longer needs access to VA information or VA information systems.

ii The Contractor is terminated, suspended, or otherwise has their work on a VA project discontinued for any reason.

https://www.my.sites.va.gov/policy/viewer/paKMfE0000001I4XWAU https://www.my.sites.va.gov/policy/viewer/paKMfE0000001HZtWAM https://www.my.sites.va.gov/policy/viewer/paKMfE0000001HZtWAM https://www.my.sites.va.gov/policy/viewer/paKMfE0000001HZtWAM iii The Contractor believes that a member of their own personnel may pose a threat to the Contractor’s working environment or to any Contractor-owned assets (e.g., property, buildings, confidential data, COs, employees, networks, systems, trade secrets and / or VA data entrusted to the Contractor).

iv Discovery or revelation of previously undisclosed changes to a Contractor’s background history, background investigation, or employee record.

v The Contractor has their authorization to work in the U.S.

revoked.

vi The contract by which Contractors provides products and services to VA has either been fulfilled or terminated, such that VA can cut off electronic and / or physical access for the Contractor.

(7) The Contractor is not permitted to access the VA network or internal resources from any foreign country. When travel outside the United States is required for official VA business or an international work location is explicitly specified in the contract, the Contractor must submit a request for accessing the VA internal network and resources internationally subject to the written approval by the Contracting Officer’s Representative (COR) and all required VA approvers. If approved, the Contractor must adhere to all approval conditions for accessing VA networks or internal resources via VA-issued Government Furnished Equipment (GFE), contractor supplied devices, personal devices with appropriate remote desktop features, or personal devices enrolled in VA’s Bring Your Own Device (BYOD) program.

(8) The Contractor is not permitted to travel outside the U.S. with any VA-issued GFE. If international travel is required for official VA business or an international work location is explicitly specified in the contract, an exception may be requested and is subject to written approval by the COR and all required VA approvers.

(9) In such cases of contract fulfillment, termination, or other causes, the Contractor shall take the necessary measures to immediately revoke access to VA network, property, information, and information systems (logical and physical) by the Contractor. These measures include (but are not limited to):

removing and then securing Personal Identification Verification (PIV) badges and PIV–Interoperable (PIV-I) access badges, VA-issued photo badges, credentials for VA facilities and devices, VA-issued laptops, and authentication tokens. Contractors shall notify the VA Program Office immediately to initiate access removal.

(10) Contractors who no longer require VA access will return VA-issued assets to VA (e.g., documents, electronic equipment, keys, and parking passes). PIV and PIV-I access badges shall be returned to the nearest VA PIV Badge Issuance Office. Once they have had access to VA information, information systems, networks and VA property in their possessions removed, Contractors shall notify the VA Program Office.

d. SECURITY INCIDENT INVESTIGATION

(1) The Contractor shall immediately (within one hour) report suspected security / privacy incidents (including intrusions) to the CO and VA Office of Information and Technology’s (OIT) Enterprise Service Desk (ESD) by calling (855) 673- 4357 [Text Telephones (TTY)-based Telecommunications Relay Service:

711].

(2) The Contractor's immediate notice to VA about the incident shall include the following information about the incident, to the extent that this information is known:

(a) Date and time (known or approximated) the security incident occurred.

(b) Names of individuals involved (when applicable).

(c) Location (physical and / or logical, as applicable) of the incident.

(d) Event logs related to the incident in a format agreed upon by the Contractor and VA.

(e) Actual or potential security issues associated with any Contractor-designed Product Known Exploited Vulnerabilities (KEVs).

i The Contractor shall create, implement, and maintain a process to record, track, and report all KEVs.

(f) Amount (in number of files or records) of data belonging to VA believed to have been compromised; and

(g) Immediate remediation and mitigation measures the Contractor is taking to minimize exposure to the vulnerability and impact of future incidents of a similar nature including timeframes.

(3) After providing the initial incident summary to VA, the Contractor shall continue to provide written updates on any new relevant information about the incident and provide updates at the request of VA officials. The Contractor shall fully cooperate with VA or third-party entity performing an independent risk analysis. Failure to cooperate may be deemed a material breach and grounds for contract termination.

(4) If the incident involves theft or break-in or other criminal activity, the Contractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including to the VA OIG and to the VA Office of Security and Law Enforcement. The Contractor shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The Contractor shall cooperate with VA in any civil litigation to recover VA information, obtain monetary or other compensation from a third party for damages arising from any incident, or obtain injunctive relief against any third party arising from, or related to, the incident.

(5) The Contractor shall comply with VA Handbook 6500.2, Management of Breaches Involving Sensitive Personal Information, which establishes the breach management policies and assigns responsibilities for the oversight, management and reporting procedures associated with managing of breaches.

(6) The Contractor shall follow VA Directive 6500 and VA OIS Knowledge Service guidance for implementing an Incident Response Plan or integrating with an existing VA implementation.

(7) With respect to unsecured Protected Health Information (PHI), the Contractor is deemed to have discovered a data breach when the Contractor knew or should have known of breach of such information. When a business associate is subject to the requirements of a VHA-issued contract, notification to the covered entity (VHA) shall be made in accordance with the executed

BAA.

(8) If the Contractor or any of its agents fails to protect VA Sensitive Personal Information (SPI) or otherwise engages in conduct which results in a data breach involving any VA SPI, the Contractor processes or maintains under the contract; the Contractor shall pay liquidated damages to VA as set forth in VAAR clause 852.211-76, Liquidated Damages—Reimbursement for Data Breach Costs.

e. INFORMATION SYSTEM DESIGN AND DEVELOPMENT

(1) The Contractor shall design and develop information systems in compliance with all VA Directives and Handbooks. This includes standards for the protection of electronic PHI, outlined in 45 Code of Federal Regulations (CFR)Part 164, Subpart C and information and system security categorization level designations in accordance with FIPS 199, Standards for Security Categorization of Federal Information and Information Systems and FIPS 200, Minimum Security Requirements for Federal Information Systems. Baseline security controls shall be implemented commensurate with the FIPS 199 system security categorization [reference VA Handbook https://www.va.gov/vapubs/viewPublication.asp?Pub_ID=1449 https://www.va.gov/vapubs/viewPublication.asp?Pub_ID=1449 https://www.va.gov/oal/library/vaar/vaar852.asp#85221176 https://www.va.gov/oal/library/vaar/vaar852.asp#85221176 https://www.va.gov/oal/library/vaar/vaar852.asp#85221176 https://www.va.gov/oal/library/vaar/vaar852.asp#85221176 https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C https://csrc.nist.gov/pubs/fips/199/final https://csrc.nist.gov/pubs/fips/199/final https://csrc.nist.gov/pubs/fips/199/final https://csrc.nist.gov/pubs/fips/200/final https://csrc.nist.gov/pubs/fips/200/final https://csrc.nist.gov/pubs/fips/200/final https://vaww.my.sites.va.gov/policy?p=paKMOE00000009Bi4AI

6500, Risk Management Framework for VA Information Systems - VA Information Security Program, and VA Trusted Internet Connections (TIC) Architecture].

(2) Contracted new developments require creation, testing, evaluation, and authorization in compliance with VA Assessment and Authorization (A&A) processes in VA Handbook 6500 and VA OIS Knowledge Service to obtain an Authorization to Operate (ATO). Full compliance with defined VA Critical Security Controls shall be mandatory.

(3) The Contractor shall comply with the OMB Memorandum M-24-15, Modernizing the Federal Risk and Authorization Management Program (FedRAMP), when using any cloud computing products. The information system is classified as a cloud system if it meets the criteria as outlined in NIST SP 800-145, The NIST Definition of Cloud Computing. For any cloud systems, the Contractor shall leverage the FedRAMP authorization process to achieve an authorization to operate in a VA environment. This consists of either leveraging an existing FedRAMP authorization for the information system or achieving FedRAMP authorization, if the system does not have an existing FedRAMP authorization at the appropriate FIPS 199 impact level.

(4) VA IT Contractors shall address and / or integrate applicable VA Handbook 6500 and OIS Knowledge Service specifications in delivered IT systems / solutions, products and / or services. Contractors shall comply with FAR 39.1, General, specifically the prohibitions referenced. If information system solutions, products and / or services do not directly match VA security requirements, the Contractor shall work with the VA Program Office for governance or resolution and inform VA CO of any unresolved compliance issues.

(5) The Contractor shall ensure that all delivered applications and information systems enforce multi-factor authentication (MFA) for privileged accounts and non-privileged accounts in compliance with Homeland Security Presidential Directive (HSPD) 12 and VA Identity, Credential and Access Management (ICAM) enterprise identity management requirements as set forth in OMB Memo M-19-17, Enabling Mission Delivery through Improved Identity, Credential, and Access Management; OMB M-05-24, Implementation of HSPD 12 – Policy for a Common Identification Standard for Federal Employees and Contractors; FIPS 201-3, Personal Identity Verification (PIV) of Federal Employees and Contractors (or its successor); and supporting NIST guidance. This applies to Commercial Off-The-Shelf (COTS) product(s) that the Contractor did not develop, all software configurations and all customizations.

https://vaww.my.sites.va.gov/policy?p=paKMOE00000009Bi4AI https://vaww.my.sites.va.gov/policy?p=paKMOE00000009Bi4AI https://vaww.my.sites.va.gov/policy?p=paKMOE00000009Bi4AI https://www.whitehouse.gov/wp-content/uploads/2024/07/M-24-15-Modernizing-the-Federal-Risk-and-Authorization-Management-Program.pdf https://www.whitehouse.gov/wp-content/uploads/2024/07/M-24-15-Modernizing-the-Federal-Risk-and-Authorization-Management-Program.pdf https://www.whitehouse.gov/wp-content/uploads/2024/07/M-24-15-Modernizing-the-Federal-Risk-and-Authorization-Management-Program.pdf https://csrc.nist.gov/pubs/sp/800/145/final https://www.acquisition.gov/far/subpart-39.1 https://www.acquisition.gov/far/subpart-39.1 https://www.acquisition.gov/far/subpart-39.1 https://www.whitehouse.gov/wp-content/uploads/2019/05/M-19-17.pdf https://www.whitehouse.gov/wp-content/uploads/2019/05/M-19-17.pdf https://www.whitehouse.gov/wp-content/uploads/2019/05/M-19-17.pdf https://www.whitehouse.gov/wp-content/uploads/2019/05/M-19-17.pdf https://georgewbush-whitehouse.archives.gov/omb/memoranda/fy2005/m05-24.pdf https://georgewbush-whitehouse.archives.gov/omb/memoranda/fy2005/m05-24.pdf https://georgewbush-whitehouse.archives.gov/omb/memoranda/fy2005/m05-24.pdf https://georgewbush-whitehouse.archives.gov/omb/memoranda/fy2005/m05-24.pdf https://georgewbush-whitehouse.archives.gov/omb/memoranda/fy2005/m05-24.pdf https://csrc.nist.gov/pubs/fips/201-3/final https://csrc.nist.gov/pubs/fips/201-3/final https://csrc.nist.gov/pubs/fips/201-3/final

(6) The Contractor shall ensure all Contractor-delivered applications and information systems explicitly authenticate, authorize, and disable all subjects, assets, and workflows across systems.

(7) All Contractor Product cybersecurity features shall either be enabled by default or be clearly identified as requiring initial configuration. Product documentation shall specify how to enable, configure, and use all Product cybersecurity features.

(8) The Contractor shall eliminate default or hardcoded passwords from the organization’s software products.

(9) The Contractor shall provide user authentication services compliant with VA Directive 6500, VA Handbook 6500, VA Directive 6510, VA Handbook 6510, and NIST SP 800-63, Digital Identity Guidelines, for direct, assertion-based authentication and / or trust-based authentication, as determined by the application’s / system’s design and integration patterns. Direct authentication at a minimum must include Public Key Infrastructure (PKI) based authentication supportive of PIV and / or Common Access Card (CAC), as determined by the business need and compliance with VA OIS Knowledge Service specifications.

(10) Prior to acceptance or connection into an authorized VA computing environment, the Contractor shall use VA-authorized technical security baseline configurations and shall certify that applications are fully functional and operate correctly as intended on information systems in compliance with VA baselines. If the Defense Information Systems Agency (DISA) has created a Security Technical Implementation Guide (STIG) for the technology, the Contractor may use that STIG to specify the configuration settings. If VA determines that a new or updated VA configuration baseline needs to be created, the Contractor shall provide required technical support to specify the configuration settings for that baseline.

(11) The standard installation, operation, maintenance, updating and patching of software shall not alter the configuration settings from VA-approved baseline configuration. Software developed for VA must be compatible with VA enterprise installer services and install to the default “program files” directory using a silent install / uninstall mechanism. The Contractor shall perform testing of all updates and patching prior to implementation on VA systems.

(12) Applications designed for normal end users will run in the standard user context without elevated system administration privileges.

(13) The Contractor-delivered solutions shall reside on VA-approved operating systems.

https://csrc.nist.gov/pubs/sp/800/63/4/final

(14) The Contractor shall design, develop, and implement security and privacy controls, including any applicable physical security controls, in accordance with the provisions of the VA security system development life cycle outlined in NIST SP 800-37, VA Directive 6500, and VA Handbook 6500.

(15) The Contractor shall comply with the Privacy Act of 1974 (the Privacy Act), FAR 52.224-2, Privacy Act, and VA rules and regulations issued under the Privacy Act in the design, development, or operation of any system of records (SOR) on individuals to accomplish a VA function.

(16) Any use of Personally Identifiable Information (PII) and live data during the design, development, and testing of systems and system components must be approved by VA.

(17) The Contractor shall ensure the security of all procured or developed information systems, major applications, minor applications, devices, enclaves and platform information technologies, including all their hardware, firmware, and software subcomponents (hereinafter referred to as “information systems”) throughout the life of this contract and any extension, warranty, or maintenance periods. This includes applying security configurations, workarounds, patches, hotfixes, upgrades, replacements and adding or upgrading any physical components as necessary to remediate all security vulnerabilities published or known to the Contractor anywhere in the information systems. The Contractor shall ensure that security fixes do not negatively impact the information systems being designed and / or developed by the Contractor. Additionally, the Contractor shall take proactive measures to address entire classes of vulnerabilities such as implementing secure software design practices, using the Cybersecurity and Infrastructure Security Agency (CISA) KEV Catalog to prioritize patching efforts for internet facing resources, and adopting a Zero Trust model to ensure continuous authentication and authorization of users and devices, both inside and outside the network.

(18) When the Contractor is responsible for operations or maintenance of the information systems, the Contractor shall apply the security fixes within the timeframe specified by the associated controls on the VA OIS Security Knowledge Service. When security fixes involve installing third-party patches (such as patches issued by Microsoft or Adobe), the Contractor shall provide written notice to the VA Program Office that the patch has been validated to not negatively impact the information system(s) to which it was applied.

f. INFORMATION SYSTEM HOSTING, OPERATION, MAINTENANCE OR USE

(1) The Contractor shall comply with all Federal laws, regulations, and VA policies for cloud-based and non-cloud-based information systems hosted, operated, maintained, or used on behalf of VA. VA OIS Knowledge Service https://uscode.house.gov/statutes/pl/93/579.pdf https://www.acquisition.gov/far/52.224-2

Security controls for collecting, processing, transmitting, and storing of VA sensitive information, must be in place. Prior to hosting, operation, maintenance or use of the information system by or on behalf of VA, the security controls will be tested by VA or a VA-approved sanctioned third party assessment organization (3PAO) then approved by VA. This testing includes conducting compliance risk assessments, security architecture analyses, vulnerability scanning, system patching, change management procedures and the completion of acceptable contingency and incident response plans for each information system. The Contractor’s security control procedures shall be the equal to or greater than procedures used by VA to operate and maintain information systems.

(2) When the Contractor operates, as an IT managed service, a VA information system, data network, telecommunications system or network, each of the Contractor system(s) to be used in delivery of the managed services to VA will be part of the VA A&A processes in accordance with VA Handbook 6500 and specifications in the VA OIS Knowledge Service (in accordance with OMB M-24-15). Full compliance with defined VA Critical Security Controls shall be mandatory. After completion of its VA A&A, any major change to that A&A package will require a review of all the package documentation and artifacts for potential impact of the change and may require an update to reflect that change.

(3) Contractor systems, services, and devices must maintain an event logging capability compliant with OMB Memorandum M-26-14, Ensuring Effective and Efficient Agency Logging and Network Visibility to Defend Against Cyber Threats, and VA requirements. The Contractor must provide any support and assistance (including data) deemed necessary for VA to comply with OMB M- 26-14.

(4) The Contractor shall identify the Operating System (OS) and all software in its Devices. Devices must not be running any OS software within two (2) years of End of Support by an OS third-party supplier at the time of Contractor’s committed delivery to the service location and / or expected use. If any device is running an OS within two (2) years of obsolescence, the Contractor shall upgrade the Device to a non-obsolete OS, at the Contractor’s expense.

(a) The Contractor may offer an extended support agreement to defer OS replacement under conditions mutually agreed upon by the Contractor and the CO.

(b) For all Devices currently at any Service Location, the Contractor shall verify whether the installed OS is within one (1) year of obsolescence and shall notify the CO of an upgrade option for such Devices to a supported OS.

https://www.whitehouse.gov/wp-content/uploads/2026/05/M-26-14-Ensuring-Effective-and-Efficient-Agency-Logging-and-Network-Visibility-to-Defend-Against-Evolving-Cyber-Threats.pdf https://www.whitehouse.gov/wp-content/uploads/2026/05/M-26-14-Ensuring-Effective-and-Efficient-Agency-Logging-and-Network-Visibility-to-Defend-Against-Evolving-Cyber-Threats.pdf https://www.whitehouse.gov/wp-content/uploads/2026/05/M-26-14-Ensuring-Effective-and-Efficient-Agency-Logging-and-Network-Visibility-to-Defend-Against-Evolving-Cyber-Threats.pdf https://www.whitehouse.gov/wp-content/uploads/2026/05/M-26-14-Ensuring-Effective-and-Efficient-Agency-Logging-and-Network-Visibility-to-Defend-Against-Evolving-Cyber-Threats.pdf i Where this requirement is not currently feasible, the Contractor shall provide documentation of their roadmap to achieve these requirements within two (2) years.

(5) The Contractor shall return to VA all data storage media (hard drives, optical disks, CDs, back-up tapes, etc.) used with non-VA leased or non-VA owned IT equipment when that equipment has been used to create, collect, process, store, transmit, disseminate, or dispose VA information in accordance with A&A package requirements. This applies when the contract is terminated or completed and prior to disposal of media. The Contractor shall provide its plan for destruction of all VA data in its possession in accordance with VA Directive 6500 and requirements specified on the VA OIS Knowledge Service, prior to termination or completion of this contract. Within thirty (30) business days of contract termination, the Contractor shall send to the VA Program Office and the VA CO a self-certification that the data disposition requirements above have been satisfied.

(6) All external Internet connections to VA network which will be used to transmit or receive VA information must be implemented in accordance with the VA TIC Reference Architecture, VA Directive 6513, Secure External Connections;

Handbook 6513, Secure External Connections; and the Memorandum of Understanding (MOU) and Interconnection Security Agreement (ISA) processes specified in the VA OIS Knowledge Service. The security terms and conditions under which that connection will be permitted to operate and carry VA data shall be reviewed and approved by VA prior to implementation.

(7) Contractor procedures associated with information system security and privacy shall be subject to periodic, announced, or unannounced assessments by VA officials. The physical security aspects associated with Contractor activities are also subject to such assessments. The Contractor shall report, in writing, any deficiencies noted during the above assessment to the VA COR / CO. The Contractor shall use VA’s defined processes to document planned remedial actions that address identified deficiencies in the Contractor’s information security policies, procedures, and practices. The Contractor shall correct security deficiencies within the timeframes specified in the VA OIS Knowledge Service.

(8) All major information system changes which occur in the production environment shall be reviewed by VA to determine the impact on privacy and security of the system. Based on the review results, updates to the ATO documentation and parameters may be required to remain in compliance with VA Handbook 6500 and VA OIS Knowledge Service requirements.

https://vaww.my.sites.va.gov/policy?p=paKMOE00000009GD4AY https://vaww.my.sites.va.gov/policy?p=paKMOE00000009GD4AY https://vaww.my.sites.va.gov/policy?p=paKMOE000000091M4AQ

(9) The Contractor shall conduct a privacy and security self-assessment on all information systems and outsourced services as required by the contract. A report containing the self-assessment results shall be provided to the VA Program Office. The Contractor shall correct or mitigate any weaknesses discovered during the assessment. VA reserves the right to conduct assessment at its discretion, using Government personnel or a third party if deemed necessary.

(10) The Contractor shall not install or use personally owned or Contractor-owned equipment or software on any VA network or information systems. If non-VA owned equipment must be used to fulfill the requirements of a contract, it must be documented in the contract. All VA-approved Contractor Other Equipment (OE) will be subject to technical inspection by VA at any time. On all VA-approved OE, the Contractor shall:

(a) Implement the same VA OIS Knowledge Service Security Controls required for equivalent GFE.

(b) Fund any configuration changes required to the OE.

(c) Provide, install, operate, and maintain antivirus software and a personal host-based or enclave-based firewall configured with a VA-approved configuration for all OE with a network connection; and

(d) Apply all critical updates and patches to the software and firmware of the OE.

(11) Upon discovery of an incident, the Contractor shall conduct an impact analysis jointly with VA, and, if deemed necessary, isolate all affected components from the connected network(s).

(12) The Contractor shall develop policies and procedures for disclosing to VA any discovery by the Contractor of a material defect or vulnerability in a product or service the Contractor provides to VA and shall implement said policies and procedures upon contract initiation. These policies and procedures shall require the Contractor to provide a summary document, within thirty (30) business days of discovery, about every material defect(s) or vulnerability(ies) discovered. This document shall include a root cause analysis and description of the potential impact of each defect / vulnerability, a list of compensating security controls and other mitigations to be undertaken, a list of recommended corrective actions and / or workarounds (e.g., monitoring).

(13) When any backdoor (i.e., a method for bypassing user authentication) is known or discovered by the Contractor in a product / service provided by the Contractor to VA, the Contractor shall permanently remediate the backdoor and provide to the VA Program Office and the VA CO a written attestation that the backdoor has been permanently remediated. The

Contractor shall remediate all other vulnerabilities based on risk, including those…