36C25924Q0807.docx

36C25924R0140

GENERAL INFORMATION

Network Contracting Office

NCO 19

6162 South Willow Drive, Suite 300 Greenwood Village CO 80111

POINT OF CONTACT*

Contract Specialist Christine Jarvis christine.jarvis@va.gov 303-712-5784

PLACE OF PERFORMANCE

ADDITIONAL INFORMATION

DESCRIPTION

Personal Digital Assistant (PDA) Scanner Bundle

Combined Synopsis/Solicitation Notice Combined Synopsis/Solicitation Notice

Combined Synopsis/Solicitation Notice

Personal Digital Assistant (PDA) Scanner Bundle

I. This is a combined synopsis/solicitation for commercial items prepared in accordance with the format in Federal Acquisition Regulation (FAR) subpart 12.6, “Streamlined Procedures for Evaluation and Solicitation for Commercial Products or Commercial Services,” as supplemented with additional information included in this notice. This announcement constitutes the only solicitation; quotes are being requested, and a written solicitation document will not be issued.

II. This is a Request for Quote (RFQ) Solicitation number 36C25924Q0807. The government anticipates awarding a firm-fixed price contract resulting from this solicitation.

III. The solicitation document and incorporated provisions and clauses are those in effect through Federal Acquisition Circular 2022-08.

IV. This acquisition is not set-aside and is being solicited as full and open competition. The North American Industry Classification System (NAICS) code is 334118 Computer Terminal and other computer peripheral equipment manufacturing . The PSC is 7E21 -IT and Telecom—Mobile Device Products (Hardware and Perpetual License Software).

V. Department of Veterans Affairs, Network Contracting Office 19 Located at 6162 S. Willow Drive, Suite 300, Greenwood Village, Colorado 80111, in support of the Veteran Integrated Service Network (VISN) 19 is seeking to procure supplies and services in accordance with the Statement of Work and price schedule. The Contractor shall provide pricing for brand name or equivalent medical grade Zebra TC52ax-HC scanners, technical support for the scanner and interface to CensiTrac® system and a one-year commercial warranty for the scanners as detailed in the Statement of Work.

VI. All interested parties shall provide quotations for the following services in accordance with the Statement of Work (SOW):

Handheld PDA Scanners and 1-Year Scanner support and warranty for CensiTrac® ITS –(623) Muskogee Contract Period: Base POP Begin: 09-30-2024 POP End: 09-29-2025 PRINCIPAL NAICS CODE: 334118 - Computer Terminal and Other Computer Peripheral Equipment Manufacturing PRODUCT/SERVICE CODE: 7E21 - IT and Telecom - Mobile Device Products (Hardware and Perpetual License Software)

Handheld PDA Scanners and 1-Year Scanner support and warranty for CensiTrac® ITS - (635) OKC

POP Begin: 09-30-2024 POP End: 09-29-2025 PRINCIPAL NAICS CODE: 334118 - Computer Terminal and Other Computer Peripheral Equipment Manufacturing PRODUCT/SERVICE CODE: 7E21 - IT and Telecom - Mobile Device Products (Hardware and Perpetual License Software)

Handheld PDA Scanners and 1-Year Scanner support and warranty for CensiTrac® ITS - (442) Cheyenne

POP Begin: 09-30-2024 POP End: 09-29-2025 PRINCIPAL NAICS CODE: 334118 - Computer Terminal and Other Computer Peripheral Equipment Manufacturing PRODUCT/SERVICE CODE: 7E21 - IT and Telecom - Mobile Device Products (Hardware and Perpetual License Software)

Handheld PDA Scanners and 1-Year Scanner support and warranty for CensiTrac® ITS - (554) Denver

POP Begin: 09-30-2024 POP End: 09-29-2025 PRINCIPAL NAICS CODE: 334118 - Computer Terminal and Other Computer Peripheral Equipment Manufacturing PRODUCT/SERVICE CODE: 7E21 - IT and Telecom - Mobile Device Products (Hardware and Perpetual License Software)

Handheld PDA Scanners and 1-Year Scanner support and warranty for CensiTrac® ITS - GRJ (575)

POP Begin: 09-30-2024 POP End: 09-29-2025 PRINCIPAL NAICS CODE: 334118 - Computer Terminal and Other Computer Peripheral Equipment Manufacturing PRODUCT/SERVICE CODE: 7E21 - IT and Telecom - Mobile Device Products (Hardware and Perpetual License Software)

Handheld PDA Scanners and 1-Year Scanner support and warranty for CensiTrac® ITS -(660) SLC

POP Begin: 09-30-2024 POP End: 09-29-2025 PRINCIPAL NAICS CODE: 334118 - Computer Terminal and Other Computer Peripheral Equipment Manufacturing PRODUCT/SERVICE CODE: 7E21 - IT and Telecom - Mobile Device Products (Hardware and Perpetual License Software)

Handheld PDA Scanners and 1-Year Scanner support and warranty for CensiTrac® ITS -Sheridan (666) VA HCS Period of Performance: 9/30/2024 - 2/28/2025 Contract Period: Base POP Begin: 09-30-2024 POP End: 09-29-2025 PRINCIPAL NAICS CODE: 334118 - Computer Terminal and Other Computer Peripheral Equipment Manufacturing PRODUCT/SERVICE CODE: 7E21 - IT and Telecom - Mobile Device Products (Hardware and Perpetual License Software)

Note: Statement of Work– SOW

VII. Place of performance is for this project is VISN 19 locations as indicated in the Pricing Schedule.

VIII. Period of performance has a one-year base period of 9/30/2024 to 09/29/2025.

IX. The provision at 52.212-1, Instructions to Offerors-Commercial Product and Commercial Services, applies to this acquisition.

ADDENDUM to FAR 52.212-1 INSTRUCTIONS TO OFFERORS—COMMERCIAL ITEMS Provisions that are incorporated by reference (by Citation Number, Title, and Date), have the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. The version of FAR 52.212-1 in the addendum is tailored for Simplified Acquisition Procedures and supersedes the current version of FAR 52.212-1 contained in the FAR.

OFFER SUBMITTAL INSTRUCTIONS:

1. Offeror shall submit offers by Due Date/Time specified in section XV. Late quotes shall not be considered.

1. Offeror shall acknowledge all amendment acknowledgements as part of their quote.

1. Offeror shall submit the completed Price Schedule Table from Section VI.

1. Offeror shall submit Technical Capability Documents as described in X.1.(a)-(d).

1. The quote shall include three (3) relevant past performances evaluations with a rating along with their quote.

Offers received that do not comply with the terms and conditions of the solicitation and/or have missing documentation may be considered con-compliant and eliminated from evaluation.

(End of Provision)

52.212-1 SUPPLEMENTAL INSTRUCTIONS TO OFFERORS

1. Offerors shall provide an authorization letter or other means of verification from the Original Equipment Manufacturer (OEM) confirming it is an authorized dealer, authorized distributor, or authorized reseller for the proposed equipment/system in accordance with VA Acquisition Regulation (VAAR) 852.212-72 and 852.212-73.

2. The Offeror’s quote/proposal shall explicitly self-certify that it will not provide Gray Market Goods and/or Counterfeit Items, as defined by VA Acquisition Regulation (VAAR) 852.212-72 and 852.212-73, and that it has the level of certification/specialization, as required by the OEM(s). Failure to include the requisite OEM letter(s)/documentation and Offeror self-certification may render the Offeror’s quote Unacceptable and thus, ineligible for award.

3. Offerors shall provide with its quote/proposal evidence of product registration/qualification/designation for EPEAT, Energy Star, and FEMP respectively for any and all proposed products certifying that the proposed product(s) as of the date of the submission of the quote/proposal are registered/qualified/designated as required in the form of screenshots from the associated website.

4. The Offeror shall include in the screenshots submitted, the EPEAT-registered product(s) by manufacturer, model name, and model number to be supplied under this contract, and shall specify the EPEAT level rating (bronze, silver, or gold) for each product.

5. The Offeror shall include in the screenshots submitted, the Energy Star qualified product(s) by manufacturer, model name, and model number to be supplied under this contract, and shall provide evidence of Energy Star qualification for each product.

6. Offerors shall include in the screenshots submitted the FEMP-designated product(s) by brand, model name, and model number to be supplied under this contract.

7. The Offeror’s quote/proposal shall explicitly self-certify that that the products proposed meet the required EPEAT level rating, Energy Star, or FEMP registration/qualification/designation respectively. Failure to include the requisite evidence and Offeror self-certification may render the Offeror’s quote Unacceptable and thus, ineligible for award.

8. The Offerors shall provide an authorization letter from Censis Technology, LLC confirming the authority to configure and update the scanners to latest versions/patches of the CensiTrac® and the authority to provide access and support from scanning through upload of data to CensiTrac®.

X. The provision at 52.212-2 Evaluation – Commercial Items applies to this acquisition.

Addendum to 52.212-2 EVALUATION—SIMPLIFIED ACQUISITION PROCEDURES

(a) Basis of Award: The Government will award a contract resulting from this solicitation to the responsible offeror whose offer conforming to the solicitation will be most advantageous to the Government, price and other factors considered. The Government will evaluate offers based on price and other factors. Evaluation of quotes will be conducted utilizing Simplified Acquisition Procedures in accordance with FAR 13.106-2(b)(3), Evaluation of Quotations or Offers, using comparative evaluation. Comparative evaluation is the side by side pairwise comparison of quotes based on factors resulting in a Contracting Officer decision for the quote most beneficial to the Government. The Government reserves the right to consider a quotation other than the lowest price. Quotations may exceed minimum requirements of the solicitation. The Government reserves the right to select a quotation that provides a benefit to the Government that exceeds the minimum requirements of the solicitation but is not required to do so. Technical and past performance, when combined, are significantly more important than cost or price. Each offer must meet the requirements of the solicitation to be considered for evaluation.

Please read each section below carefully for the submittals and information required as part of the evaluation. Offers missing the requested information below, as well as the items listed in the Addendum to FAR 52.212-1, Instructions to Offerors, shall be considered non-compliant and may be removed from the evaluation process.

1) Technical Capability - Technical Capability Offerors shall submit documentation illustrating:

a) A clear description of the management methodology that will be used for executing the effort described in the Statement of Work (SOW).

i) This description shall include:

(1) staffing approach,

(2) training, licensing and certification considerations,

(3) meeting deliverable deadlines,

(4) identification of all planned facilities to be used in support of the effort, and

(5) details of how the proposed effort will be assigned within the corporate entity and among any proposed subcontractors.

b) Authorization, verification, certification, and evidence as required in 52.212-1 Supplemental Instructions to Offerors; Items 1-8.

c) Documentation of TAA compliance of the Brand Name or equal PDA Scanner Device

d) Authorization, verification, certification that the Brand Name or equal PDA Scanner Device will connect to and interoperate with the Cenis CensiTrac® RTLS Solution.

2) Price – The Government will evaluate the price schedule submitted by each offeror. Contractors shall submit pricing on Section VI; firm fixed unit pricing shall include all labor, overhead, profit, materials, and associated costs of the like to provide services. Pricing shall not be handwritten on Section VI to ensure they are legible. The offeror agrees to hold the prices in its offer firm for 90 calendar days from the date specified for receipt of offers.

3) Past Performance - The quote shall include three (3) relevant past performances evaluations with their quote. The Government reserves the right to obtain past performance information from any available source and may contact customers other than those identified by the Offeror when evaluating past performance. If an offeror has no record of relevant past performance record or if information is not available, they will not be rated favorably or unfavorably.

(b) Options - The Government will evaluate offers for award purposes by adding the total price for all options to the total price for the basic requirement. The Government may determine that an offer is unacceptable if the option prices are significantly unbalanced. Evaluation of options shall not obligate the Government to exercise the option(s). For the purposes of the award of this Contract, the Government intends to evaluate the option to extend services under FAR 52.217-8 as follows: The evaluation will consider the possibility that the option can be exercised at any time and can be exercised in increments of one to six months, but not for more than a total of six months during the life of the contract. The evaluation will assume that the prices for any option exercised under FAR 52.217-8 will be at the same rates as those in effect under the contract at the time the option is exercised. The evaluation will therefore assume that the addition of the price or prices of any possible extension or extensions under FAR 52.217-8 to the total price for the basic requirement and the total price for the priced options has the same effect on the total price of all proposals relative to each other and will not affect the ranking of proposals based on price, unless, after reviewing the proposals, the Government determines that there is a basis for finding otherwise. This evaluation will not obligate the Government to exercise any option under FAR 52.217-8.

(c) Acceptance of Offer. A written notice of award or acceptance of an offer, mailed or otherwise furnished to the successful offeror within the time for acceptance specified in the offer, shall result in a binding contract without further action by either party. Before the offer’s specified expiration time, the Government may accept an offer (or part of an offer), whether or not there are negotiations after its receipt, unless a written notice of withdrawal is received before award.

XI. FAR 52.212-3 – OFFERORS REPRESENTATION AND CERTIFICATIONS – COMMERCIAL ITEMS

Offerors must complete annual representations and certifications electronically via the System for Award Management (SAM) website located at https://www.sam.gov/portal in accordance with FAR 52.212-3, “Offerors Representations and Certifications–Commercial Items.” If paragraph (j) of the provision is applicable, a written submission is required.

XII. FAR 52.212-4 – CONTRACT TERMS AND CONDITIONS – COMMERIAL ITEMS (November 2021), applies to this requirement.

Addendum to XI. FAR 52.212-4 – CONTRACT TERMS AND CONDITIONS – COMMERIAL ITEMS (November 2021)

Clauses that are incorporated by reference (by Citation Number, Title, and Date), have the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available.

The following clauses are incorporated into 52.212-4 as an addendum to this contract:

52.252-2 Clauses Incorporated by Reference (FEB 1998) http://www.acquisition.gov/far/index.html (FAR) and http://www.va.gov/oal/library/vaar/index.asp (VAAR)

IT CONTRACT SECURITY

XIII. FAR 52.212-5 – CONTRACT TERMS AND CONDITIONS REQUIRED TO IMPLEMENT STATUTES OR EXECUTIVE ORDERS – COMMERCIAL ITEMS (October 2022), applies to this requirement. The additional clauses below are incorporated by reference.

The Contractor agrees to comply with any provision or clause that is incorporated herein by reference to implement agency policy applicable to acquisition of commercial items or components.

XIV. VAAR 852.212-70 PROVISIONS AND CLAUSES APPLICABLE TO VA ACQUISITION OF COMMERCIAL ITEMS (APR 2020) The Contractor agrees to comply with any provision or clause that is incorporated herein by reference to implement agency policy applicable to acquisition of commercial items or components. The following provisions and clauses that have been checked by the Contracting Officer are incorporated by reference.

XV. This is not a Defense Priorities and Allocations System (DPAS) rated requirement.

XVI. Offers are due 09-18-2024 @ 2:00pm MST. All questions/inquiries must be submitted to the contract specialist via electronic mail (e-mail) not later than 09-16-2024 @ 10:00am MST. Inquiries submitted via telephone calls will be re-directed to an e-mail submission.

XVII. Submit offers or any questions to the attention of Christine Jarvis via email to: christine.jarvis@va.gov.

STATEMENT OF WORK

Personal Digital Assistant (PDA) Scanners, Support and Warranty

PRODUCT REQUIREMENTS

1.1 Background

VISN 19 Healthcare Technology Management Real Time Location Systems (RTLS) assists facilities deployment, and management of RTLS technologies. In 2018, VISN 19 Real Time Location Services (RTLS) deployed Censis CensiTrac® (AKA instrument tracking system or ITS) to its medical centers to track sterile processing workflow. The Censis CensiTrac® solution utilizes 3D barcodes etched into reusable medical equipment or printed on hung tags to track surgical and dental equipment through its normal cycle of cleaning, sterilization, tray building, and clinical use. At each step in the process, the barcode is scanned to document the equipment’s status. In order to facilitate barcode scanning Cybermed handheld tablets with Censis CensiTrac® software are currently deployed in the sterile processing department. The information scanned into the Censitrac software on the handheld is propagated through the system via an upload to the system’s server. The Cybermed tablets originally deployed as part of the ITS have reached their end of life and end of support and need to be replaced.

1.2 Statement of Work

VISN 19 has a requirement to procure 76 brand name or equivalent medical grade Zebra TC52ax-HC scanners, technical support for the scanner and interface to CensiTrac® system and a one-year commercial warranty for the scanners. The brand name or equivalent handheld scanners shall meet or exceed the salient characteristics detailed in Section 1.2.1, Table 1. Handheld scanners must be compatible with VA Gold Image baseline Operating Systems. Technical support for the devices shall include configuration, support, and maintenance as detailed in section 1.2.2. These Medical Grade Scanners shall be delivered to the noted VA facilities (See Attachment A - Master Delivery Schedule) within 90 days after contract award.

1.2.1 Handheld Scanners

The medical grade scanner shall meet or exceed the following salient characteristics:

Environmental

IP65

Bluetooth

Class 2, Bluetooth: v5.0, Bluetooth Low Energy

Touch Screen

Yes

Keyboard

On Screen

Speakers

Integrated audio

Scan range – Code 39 barcode

TAA Compliant

Yes

Connect to and be interoperate with the Censis CensiTrac® RTLS solution

Yes

Table 1: Salient Characteristics of Government Required Handheld Scanners

1.2.2 Technical Support Services

As part of the support services, a one-time access fee shall provide the devices the capability to connect and receive maintenance and technical support.

Technical and maintenance support services will ensure that the scanners are properly configured and updated to latest versions/patches of the CensiTrac® software. The Contractor shall provide a dedicated helpdesk telephone line for VA Staff to call and troubleshoot and submit helpdesk tickets. The helpdesk and call desk shall be available 24 hours per day, 7 days per week, 365 days per year. The Contractor shall maintain a log of helpdesk incidents, resolutions, and repair times. The contractor shall provide authorization by Censis Technologies, Inc. granting the authority to access and provide support for the Censis CensiTrac® application.

The Contractor shall provide a one-year standard commercial warranty for the scanners. This warranty shall begin the day of certified receipt by the government. In the event that issues cannot be first remedied through maintenance support service process, or it is determined by the facility to be a work stoppage/patient safety issue, the Contractor shall ship a replacement unit within 2 business days and delivered no later than 5 business days. The Contractor shall follow the same shipping instructions included in this contract.

2.0 NOTICE OF THE FEDERAL ACCESSIBILITY LAW AFFECTING ALL INFORMATION AND COMMUNICATION TECHNOLOGY (ICT) PROCUREMENTS (SECTION 508) On January 18, 2017, the Architectural and Transportation Barriers Compliance Board (Access Board) revised and updated, in a single rulemaking, standards for electronic and information technology developed, procured, maintained, or used by Federal agencies covered by Section 508 of the Rehabilitation Act of 1973, as well as our guidelines for telecommunications equipment and customer premises equipment covered by Section 255 of the Communications Act of 1934. The revisions and updates to the Section 508-based standards and Section 255-based guidelines are intended to ensure that information and communication technology (ICT) covered by the respective statutes is accessible to and usable by individuals with disabilities.

2.1 SECTION 508 – INFORMATION AND COMMUNICATION TECHNOLOGY (ICT) STANDARDS

The Section 508 standards established by the Access Board are incorporated into, and made part of all VA orders, solicitations and purchase orders developed to procure ICT. These standards are found in their entirety at: https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines. A printed copy of the standards will be supplied upon request.

Federal agencies must comply with the updated Section 508 Standards beginning on January 18, 2018. The Final Rule as published in the Federal Register is available from the Access Board: https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule.

The Contractor shall comply with “508 Chapter 2: Scoping Requirements” for all electronic ICT and content delivered under this contract. Specifically, as appropriate for the technology and its functionality, the Contractor shall comply with the technical standards marked here:

2.2 COMPATABILITY WITH ASSISTIVE TECHNOLOGY

The standards do not require installation of specific accessibility-related software or attachment of an assistive technology device. Section 508 requires that ICT be compatible with such software and devices so that ICT can be accessible to and usable by individuals using assistive technology, including but not limited to screen readers, screen magnifiers, and speech recognition software.

2.3 ACCEPTANCE AND ACCEPTANCE TESTING

Deliverables resulting from this solicitation will be accepted based in part on satisfaction of the Section 508 Chapter 2: Scoping Requirements standards identified above.

The Government reserves the right to test for Section 508 Compliance before delivery. The Contractor shall be able to demonstrate Section 508 Compliance upon delivery.

3.0 INFORMATION TECHNOLOGY USING ENERGY-EFFICIENT PRODUCTS

The Contractor shall comply with Sections 524 and Sections 525 of the Energy Independence and Security Act of 2007; Section 104 of the Energy Policy Act of 2005; Executive Order 13834, “Efficient Federal Operations”, dated May 17, 2018; Executive Order 13221, “Energy-Efficient Standby Power Devices,” dated August 2, 2001; and the Federal Acquisition Regulation (FAR) to provide ENERGY STAR®, Federal Energy Management Program (FEMP) designated, low standby power, and Electronic Product Environmental Assessment Tool (EPEAT) registered products in providing information technology products and/or services.

3.1 EPEAT

The Contractor shall provide EPEAT-registered products under this contract, as applicable to clause(s) 52.223-16 and 52.223-14.

3.2 ENERGY STAR

As required in clause 52.223-15 Energy Efficiency in Energy-Consuming Products, the Contractor shall provide products that earn the ENERGY STAR label and meet ENERGY STAR specifications for energy efficiency. For information about ENERGY STAR, see http://www.energystar.gov for complete product specifications and updated lists of qualifying products.

3.3 FEMP

As required in clause 52.223-15 Energy Efficiency in Energy-Consuming Products, the contractor shall only provide products that meet Federal Energy Management Program (FEMP) and/or FEMP Low Standby Power purchasing specifications for energy efficiency under this contract, as applicable. Covered product categories and the applicable energy efficiency requirements can be found at http://energy.gov/eere/femp/covered-product-categories and low standby power product list can be found at https://www.energy.gov/eere/femp/low-standby-power-product-list.

4.0 SHIPMENT OF HARDWARE OR EQUIPMENT

Inspection: Destination Acceptance: Destination Free on Board (FOB): Destination

Ship To and Mark For:

Primary

Alternate

Address:

Address:

Voice:

Voice:

Email:

Email:

4.1 SPECIAL SHIPPING INSTRUCTIONS

Prior to shipping, Contractor shall notify Site Point-of-Contact (POC)s, by phone followed by email, of all incoming deliveries including line-by-line details for review of requirements. The Contractor shall not make any changes to the delivery schedule at the request of Site POC. The Contractor shall furnish a copy of the receipt/acceptance to the VA Contracting Officer Representative (COR) and ensure that the Master Delivery Schedule is updated with each delivery.

Contractors shall coordinate deliveries with Site POCs before shipment of hardware to ensure sites have adequate storage space. A listing of Site POCs will be provided upon contract award.

All shipments, either single or multiple container deliveries, shall bear the VA IFCAP Purchase Order number on external shipping labels and associated manifests or packing lists. In the case of multiple container deliveries, a statement readable near the VA IFCAP PO number shall indicate total number of containers for the complete shipment (e.g. “Package 1 of 2”), clearly readable on manifests and external shipping labels.

Packing Slips/Labels and Lists shall also include the following:

IFCAP PO #: ____________ (e.g., 166-E11234 (the IFCAP PO number is located in block #20 of the SF 1449)) Project Description: (e.g. Tier I Lifecycle Refresh)

Total number of Containers: Package ___ of ___. (e.g., Package 1 of 3)

5.0 GENERAL REQUIREMENTS

5.1 VA TECHNICAL REFERENCE MODEL

The Contractor shall support the VA enterprise management framework. In association with the framework, the Contractor shall comply with Office of Information Technology (OIT) Technical Reference Model (VA TRM). The VA TRM is one component within the overall Enterprise Architecture (EA) that establishes a common vocabulary and structure for describing the information technology used to develop, operate, and maintain enterprise applications. Moreover, the VA TRM, which includes the Standards Profile and Product List, serves as a technology roadmap and tool for supporting OIT. Architecture & Engineering Services (AES) has overall responsibility for the VA TRM.

5.2 INTERNET PROTOCOL VERSION 6 (IPV6)

The Contractor solution shall support Internet Protocol Version 6 (IPv6) based upon the memo issued by the Office of Management and Budget (OMB) on November 19, 2020 (https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-07.pdf). IPv6 technology, in accordance with the USGv6 Program (https://www.nist.gov/programs-projects/usgv6-program/usgv6-revision-1), NIST Special Publication (SP) 500-267B Revision 1 “USGv6 Profile” (https://doi.org/10.6028/NIST.SP.500-267Br1), and NIST SP 800-119 “Guidelines for the Secure Deployment of IPv6” (https://doi.org/10.6028/NIST.SP.800-119), compliance shall be included in all IT infrastructures, application designs, application development, operational systems and sub-systems, and their integration. In addition to the above requirements, all devices shall support native IPv6 and dual stack (IPv6 / IPv4) connectivity without additional memory or other resources being provided by the Government, so that they can function in a mixed environment. All public/external facing servers and services (e.g. web, email, DNS, ISP services, etc.) shall support native IPv6 and dual stack (IPv6 / IPv4) users and all internal infrastructure and applications shall communicate using native IPv6 and dual stack (IPv6 / IPv4) operations.

5.3 INFORMATION SECURITY CONSIDERATIONS:

The Assessment and Authorization (A&A) requirements do not apply and a Security Accreditation Package is not required All VA sensitive information shall be protected at all times in accordance with local security field office System Security Plans (SSP’s) and Authority to Operate (ATO)’s for all systems/LAN’s accessed while performing the tasks detailed in this Product Description.

a. A prohibition on unauthorized disclosure: “Information made available to the Contractor or Subcontractor by VA for the performance or administration of this contract or information developed by the Contractor/Subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA.” This clause expressly limits the Contractor/Subcontractor’s rights to use data as described in Rights in Data – General, FAR 52.227-14(d).(1).

b. A requirement for data breach notification: Upon discovery of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the Contractor/Subcontractor has access, the Contractor/Subcontractor shall immediately notify the COR and simultaneously, the designated ISO, and Privacy Officer for the contract. The term “security incident” means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. See VA Handbook 6500.6, Appendix C, paragraph 6.a.

c. A requirement to pay liquidated damages in the event of a data breach: “In the event of a data breach or privacy incident involving SPI the contractor processes or maintains under this contract, the contractor shall be liable to VA for liquidated damages for a specified amount per affected individual to cover the cost of providing credit protection services to those individuals.” However, it is the policy of VA to forgo collection of liquidated damages in the event the Contractor provides payment of actual damages in an amount determined to be adequate by the agency.

Based on the determinations of the independent risk analysis, the Contractor shall be responsible for paying to VA liquidated damages in the amount of $37.50 per affected individual to cover the cost of providing credit protection services to affected individuals consisting of the following:

1) Notification;

2) One year of credit monitoring services consisting of automatic daily monitoring of at least 3 relevant credit bureau reports;

3) Data breach analysis;

4) Fraud resolution services, including writing dispute letters, initiating fraud alerts and credit freezes, to assist affected individuals to bring matters to resolution;

5) One year of identity theft insurance with $20,000.00 coverage at $0 deductible; and

6) Necessary legal expenses the subjects may incur to repair falsified or damaged credit records, histories, or financial affairs

d. A requirement for annual security/privacy awareness training: “Before being granted access to VA information or information systems, all Contractor employees and Subcontractor employees requiring such access shall complete on an annual basis either: (i) the VA security/privacy awareness training (contains VA security/privacy requirements) within 1 week of the initiation of the contract, or (ii) security awareness training provided or arranged by the contractor that conforms to VA’s security/privacy requirements as delineated in the hard copy of the VA security awareness training provided to the Contractor. If the Contractor provides their own training that conforms to VA’s requirements, they will provide the COR or CO, a yearly report (due annually on the date of the contract initiation) stating that all applicable employees involved in VA’s contract have received their annual security/privacy training that meets VA’s requirements and the total number of employees trained. See VA Handbook 6500.6, Appendix C, paragraph 9.

e. A requirement to sign VA’s Rules of Behavior: “Before being granted access to VA information or information systems, all Contractor employees and Subcontractor employees requiring such access shall sign on annual basis an acknowledgement that they have read, understand, and agree to abide by VA’s Contractor Rules of Behavior which is attached to this contract.” See VA Handbook 6500.6, Appendix C, paragraph 9, and Appendix D. Note: If a medical device vendor anticipates that the services under the contract will be performed by 10 or more individuals, the Contractor Rules of Behavior may be signed by the vendor’s designated representative. The contract must reflect by signing the Rules of Behavior on behalf of the vendor that the designated representative agrees to ensure that all such individuals review and understand the Contractor Rules of Behavior when accessing VA’s information and information systems.

See attached document: Attachment 1 - Appendix C 6500.06.

See attached document: Attachment 2 - 52.204-24 Telecom.

Page 1 of Page 1 of