36C77618Q9237-001.docx

1.0 GENERAL

The Department of Veterans Affairs (VA), Workforce Management and Consulting Office Human Resources Development (HRD) Group supports the learning and professional development needs of approximately 5,000 HR professionals across the agency. A component of the HR Development Group, HR Academy provides training services to support closing current and previously identified competency gaps among the HR Workforce.

Annually, HR Development administers an individual competency gap assessment to identify workforce skill gaps. HR Development also develops and delivers training to address identified skill gaps. Stakeholders include VA HR Professionals and HR Leadership across the Administrations: Veterans Health Administration (VHA), Veterans Benefits Administration (VBA), National Cemetery Administration (NCA), and Staff Offices.

1.1 BACKGROUND

HR Academy, began delivering critical needs training during the fourth quarter of fiscal year (FY) 2010 and formally launched the training program during the first quarter of FY 2011. HR Development supports VA’s mission and guiding principles by developing a qualified and effective community of HR professionals to support the agency’s workforce needs; close competency gaps; and improve HR professional’s proficiency to provide better service to veterans and their families.

The HR Academy team provides a virtual training program that is may be parallel to, or complements, the other virtual or in-person offerings by the HRD Group. Participants access tools and learning opportunities via VA’s Talent Management System (TMS), Blackboard Collaborate and Learn, contact with instructors, HR Academy has delivered training using multiple training modalities

HR Academy joined the HR Development Group in 2017, in the Workforce Management and Consulting Office of the Veterans Health Administration (VHA). HR Academy and other areas of HR Development offer virtual instructor led training using Blackboard Collaborate and Learn, live training through Skype and face-to-face classroom instruction through a variety of sources. HR Academy conducts an annual cost benefit analysis, and has measured success using Kirkpatrick’s Training Evaluation Model levels one through four which validates the HR Academy learning approach used to address competency gaps.

HR Academy uses a multi-pronged, integrated approach for evaluating the training program: 1) programmatic assessment, and 2) learning evaluation. The learning evaluation presents a framework to evaluate program learning at four levels using the Kirkpatrick® Model. Levels 1 and 2 assess the participant’s satisfaction and learning relative to the training attended, while Level 3 assesses the participant’s ability to implement on-the-job new skills or abilities learned in training. Level 4 assesses the impact of HR training on the VA HR community using the programmatic assessment progress metrics.

1.2 APPLICABLE DOCUMENTS

Documents referenced or germane to this Performance Work Statement (PWS) are listed below. In the performance of the tasks associated with this PWS, the contractor shall comply with the following:

1. 44 U.S.C. § 3541, “Federal Information Security Management Act (FISMA) of 2002”

2. Federal Information Processing Standards (FIPS) Publication 140-2, “Security Requirements For Cryptographic Modules”

3. FIPS Pub 201, “Personal Identity Verification of Federal Employees and Contractors,” March 2006

4. 10 U.S.C. § 2224, "Defense Information Assurance Program"

5. Software Engineering Institute, Software Acquisition Capability Maturity Modeling (SA CMM) Level 2 procedures and processes

6. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

7. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”

8. Department of Veterans Affairs (VA) Directive 0710, “Personnel Suitability and Security Program,” May 18, 2007

9. VA Directive 6102, “Internet/Intranet Services,” July 15, 2008

10. 36 C.F.R. Part 1194 “Electronic and Information Technology Accessibility Standards,” July 1, 2003

11. OMB Circular A-130, “Management of Federal Information Resources,” November 28,

12. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed Services

(CHAMPUS)”

13. An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule, October 2008

14. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended by the Workforce Investment Act of 1998 (P.L. 105-220), August 7, 1998

15. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

16. VA Directive 6500, “Information Security Program,” August 4, 2006

17. VA Handbook 6500, “Information Security Program,” September 18, 2007

18. VA Handbook 6500.1, “Electronic Media Sanitization,” March 22, 2010

19. VA Handbook 6500.2, “Management of Security and Privacy Incidents,” June 17, 2008.

20. VA Handbook 6500.3, “Certification and Accreditation of VA Information Systems,” November 24, 2008.

21. VA Handbook, 6500.5, Incorporating Security and Privacy in System Development Lifecycle.

22. VA Handbook 6500.6, “Contract Security,” March 12, 2010

23. Project Management Accountability System (PMAS) portal (reference PWS References - Technical Library at https://www.voa.va.gov/)

24. OIT ProPath Process Methodology (reference PWS References -Technical Library and ProPath Library links at https://www.voa.va.gov/) NOTE: In the event of a conflict, OIT ProPath takes precedence over other processes or methodologies.

25. Technical Reference Model (TRM) (reference at http://www.ea.oit.va.gov/Technology.asp)

26. National Institute Standards and Technology (NIST) Special Publications

27. VA Directive 6508, VA Privacy Impact Assessment, October 3, 2008

28. VA Directive 6300, Records and Information Management, February 26, 2009

29. VA Handbook, 6300.1, Records Management Procedures, March 24, 2010

30. Kirkpatrick® Model, used for learning evaluation, was created by Dr. Donald L.

Kirkpatrick. Visit kirkpatrickpartners.com for more information.

2.0 SCOPE OF WORK

2.1 Program Evaluation and Improvement

The purpose of this requirement is to maintain and enhance a well-defined, customized evaluation process to evaluate the efficiency and effectiveness of the Human Resources Development program over the longer term to promote enduring successful results. This requires implementation of a learning measurement system, data collection, and analysis and reporting. The system and methodology shall be designed and managed to enable and show continual improvement of Human Resources Development ‘s programs over the period of performance.

2.2 Automated Web-Based Dashboard:

The contractor shall design and develop an internally VA, hosted web-based automated dashboard that shall depict a holistic summary of Human Resources Development Group’s training/courses by function, delivery type, for each VA administration. The dashboard shall include a training snapshot, which shall detail training events (course titles, course competency mapping data, start dates, end dates, number of completions, and number of unique learners) per month, real-time analytics that include a holistic summary of training/courses by function, delivery type, course, for each VA administration as applicable, display corresponding evaluation data for each course, under each pillar of HR Development, and course completion rates. The dashboard shall have drill down capabilities for detailed data on summary data.

2.3 Communications Strategy and Online Presence

[See language under 7.11] The Contractor shall develop and implement strategies to strengthen HR Academy’s SharePoint The dashboard shall be accessible via the HR Academy SharePoint site The contractor shall enhance, manage, and maintain the HR Academy’s SharePoint to ensure ease of use for online audiences. The SharePoint shall be well organized, current and designed to direct the user quickly to materials, reports, schedules or other tools. The SharePoint shall house standard and on-demand/ad hoc reports and shall only be accessible by the HR Academy director, Human Resources Development program and project managers, Contracting Officer (CO), Contract Specialist (CS) and Contracting Officer Representative (COR).

The Contractor shall provide consultative guidance and proactive support for specified projects to the HR Development team by creating and implementing communications strategies in support of HR Development goals to build/leverage partnerships, raise awareness, increase enrollment and support sub-Initiative(s).

HR Academy Communications Goals:

1. Position HR Development as the leader in training HR Professionals in the Agency.

2. Help HR Development build partnerships with internal and external partners, raise awareness of services and increase sustainability.

3. Increase the number of HR Professionals who take HR Development course offerings by building personal urgency around the importance of career planning and how it supports professional development and builds internal capacity.

4. Build end user comfort level with virtual learning; just in time training and self-paced learning.

This contract includes firm fixed price line items.

All training and materials developed under this contract shall become property of VA .

3.0 PERFORMANCE PERIOD

The period of performance shall be one (1) 12-month base period, and four (4) 12-month option periods. Option years will not be exercised until need is determined and subject to availability of appropriated funds. Exercising the option is at the discretion of the VA.

Any work performed at the Government site shall not take place on Federal holidays or weekends, unless directed by the CO.

The VA observes ten Federal holidays as set by law (5 U.S.C. § 6103).

Under current definitions, four are set by date:

If any of the above holidays fall on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

4.0 PLACE OF PERFORMANCE

All work performed under this contract shall be performed at contractor facilities. However, the contractor may be asked to attend meetings, briefings, and interviews, with Government clients at VA Central Office, 810 Vermont Avenue, NW, Washington, DC 20420 or the Contracting Officer’s Representative (COR) at a designated Government facility within the Washington, DC metro area.

5.0 TRAVEL

Local travel within a 50-mile radius from the Contractor’s facility is considered the local cost of doing business and will not be reimbursed. This includes travel, subsistence, and associated labor charges for travel time. Travel performed for personal convenience and daily travel to and from work at the Contractor’s facility will not be reimbursed. Travel, subsistence, and associated labor charges for travel time for travel beyond a 50-mile radius of the Contractor’s facility are authorized for reimbursement on a case-by-case basis and must be pre-approved by the COR and the CO (See attached Travel Request Form). Authorized travel will be reimbursed at cost. Travel shall be in accordance with the Federal Travel Regulations (FTR) and requires advanced concurrence/approval by the COR.

6.0 PERSONNEL

6.1 GENERAL EXPERIENCE REQUIREMENTS

Contractor personnel shall be fully qualified and have the level of experience necessary to accomplish the requirements of this PWS. In addition, contractor personnel shall be acceptable to the Government in terms of personal and professional conduct, and in technical knowledge. Furthermore, contractor personnel are expected to be proficient with office automation equipment, Microsoft Office 2016 (Word, Excel, Outlook, Access), MS Project 2016 or later, Software/Systems Development Lifecycle, data analytics software, and have sufficient written and verbal communication skills to support VA. Should any contractor personnel be determined to be unacceptable in terms of technical competency or unacceptable personal conduct while working on contract activities, the contractor shall immediately remove and replace the unacceptable personnel at no additional cost to the Government. Contractor personnel are to serve in a support role; final decisions regarding VA business shall always be made by Government personnel.

6.2 Key Personnel

Certain skilled, experienced professional and/or technical personnel are essential for accomplishing the work to be performed. These individuals are defined as “Key Personnel” and are those persons whose résumé is submitted and marked by the vendor as “Key Personnel” under the Technical Approach. Substitutions shall only be accepted if in compliance with the “Substitution of Key Personnel” provision below.

Substitution of Key Personnel: All contractor requests for approval of substitutions hereunder shall be submitted in writing to the CO at least 15 calendar days in advance of the effective date, whenever possible, and shall provide a detailed explanation of the circumstances necessitating the proposed substitution, a complete résumé for the proposed substitute, and any other information requested by the CO necessary to approve or disapprove the proposed substitution. New personnel shall not commence work until all necessary security requirements have been fulfilled and résumé provided and accepted. The CO will evaluate such requests and promptly notify the contractor of approval or disapproval in writing. Any substituted personnel shall have the equivalent or better education, experience, and credentials than the personnel submitted with the proposal, subject to VA review and approval.

Project Manager: The contractor shall assign a Project Manager (PM) who has at least five years’ experience successfully managing large-scale Training and Development and/or Information Technology projects, with a total lifecycle cost greater than or equal to $3 million. The PM shall also have a Project Management Professional (PMP) certification or equivalent, such as program and project management certification through the Federal Acquisition Institute or Defense Acquisition Workforce Improvement Act. An additional two years of experience (seven total years’ experience) may be substituted in lieu of a PMP certification. Previous experience shall demonstrate the ability to lead and direct cross-functional teams to deliver projects within the constraints of schedule, budget, and scope. The PM shall also have documented expertise in providing strategic consultative services and program evaluation and management support. The duties of the Project Manager shall include the following:

· Provide overall project direction

· Develop and implement project management plans

· Be the primary contractor point of contact with the VA

· Coordinate project activities and resources

· Obtain government acceptance of all deliverables

Required Skills for the PM: Proficient in Microsoft Office 2016 or later (Word, Excel, Outlook, Access), MS Project 2016 or later, and Software/Systems Development Lifecycle. Proficient with Lean Six Sigma, Rational Team Concert and demonstrated experience with the following development methodologies: Waterfall, Agile, or Scrum.

Support Personnel Qualifications: The contractor shall employ a number of personnel to complete the requirements of the contract. The contracted support personnel shall be fully qualified and competent to perform the required work. The personnel employed by the contractor shall be proficient in Microsoft Office 2016 or later (Word, Excel, Outlook, Access), MS Project 2016 or later, and Software/Systems Development Lifecycle. Support Personnel shall have proven proficiency and experience in data analytics. The support personnel shall also have documented experience in strategic communications, program evaluation and support.

7.0 SPECIFIC TASKS AND DELIVERABLES

The Contractor shall perform the following tasks and provide all associated deliverables for all contracted years unless otherwise noted in the Tasks or Deliverables table. A complete list of all deliverables, required formatting, and due dates are listed in the Contract Line Items Numbers (CLIN) schedule. Should the Government elect to award any of the option periods then the Contractor shall perform all tasks as noted in Section 7.0 and provide all associated deliverables in the CLIN schedule.

Acceptance/ Rejection of Deliverables The Government will have ten (10) business days to review each deliverable and provide feedback/comments. The contractor shall have five (5) business days to incorporate feedback/comments and make appropriate revisions. The contractor shall provide the revised version of each deliverable to the Contracting Officer Representative (COR) and VA Program Manager (VA PM). The COR will review and determine final acceptance by the Government. The COR will notify the contractor and Contracting Officer of final acceptance within five (5) business days of receiving the revised deliverable. See Quality Assurance Surveillance Plan attachment for additional information on deliverable rejection.

The contractor shall be responsible for adhering to all pertinent VA standards including but not limited to ensuring that all documentation, deliverables and meets or exceeds VA information technology policies and procedures, which will be made available at the contractor’s request on award.

7.1 Task 1 - PROJECT MANAGEMENT

The Contractor shall conduct a contract kickoff meeting within 10 business days after award of contract or the exercise of an option period. The Contractor shall present a draft Contractor Project Management Plan (CPMP) and a draft Quality Control Plan (QCP) at the Kickoff Meeting for review and approval by the Government PM team.

7.1.2 CONTRACTOR PROJECT MANAGEMENT PLAN (CPMP)

The Contractor shall develop a project management plan which shall describe the Contractor’s overall project structure, the methods used to plan, monitor, control, and improve the project efforts that optimally support the requirements identified in the PWS. The CPMP shall be developed in accordance with the Project Management Body of Knowledge Guide, Sixth Edition (or later) and shall include all subsidiary plans described therein. The CPMP shall include a Work Breakdown Structure (WBS) that accurately displays the Contractor’s anticipated schedule, deliverables, milestones, risks, and resources. The WBS shall be completed in Microsoft (MS) Project and submitted as both a picture/image within the CPMP and in a separate WBS MS Project electronic file.

The CPMP shall be consistent with the requirements of the PWS and shall not contradict or indicate supplemental requirements to those stated in the PWS. The CPMP does not supersede the task order or govern the requirements. Any changes to the requirements in the task order must be approved in advance in writing by the Contracting Officer or are performed at the sole risk of the contractor.

The Contractor shall present a draft Contractor Management Plan (CPMP) at the Contract Kick-Off meeting for review and approval by the Government PM team and within 10 business days after receipt of award or exercise of option.

Deliverable: 0001 – Contractor Project Management Plan

7.1.3 MONTHLY PROGRESS REPORTS

The Contractor shall deliver Monthly Progress Reports (MPR). The MPR shall detail training activities executed during the preceding month. The monthly report shall include a section called training snapshot, which shall detail training events (course titles, start dates, end dates, number of completions, and number of participants per course, number of unique learners) per month. The report shall identify any problems that arose and a description of how the problems were resolved. If problems have not been completely resolved, the Contractor shall provide an explanation including their plan and timeframe for resolving the issue(s). The Contractor shall monitor performance against the CPMP and report any deviations/issues to the COR within two business days of identifying said deviation/issue.

The MPR shall include a data analytics section. This section shall include the Contractor’s narrative on analysis of trends discovered during the previous month and an assessment of the impact of trends on the programs and curriculum. The Contractor shall provide proposals for improvement of negative trends, and shall provide recommendations to optimize positive trends.

The MPR is due on the fifth calendar day of each month. If this day falls on a Saturday, Sunday, or Government holiday, the MPR is due the next business day. The report shall contain work planned for the subsequent reporting period. The Contractor is expected to keep in communication with the COR to mitigate escalation of outstanding issues.

Deliverable: 0002 – Monthly Progress Report

7.1.4 QUARTERLY IN PROGRESS REVIEWS

The Contractor shall present quarterly programmatic updates on schedule, performance, and analytics during the HR Development’s In Progress Reviews (IPR) meetings using the Government-approved template for PowerPoint slides. The Contractor shall provide the COR with a copy of the IPR slide deck no later than two business day prior to the IPR. The IPR is due within the last five business days of each quarter after the initial kick-off meeting. IPR slide decks are due no later than two business days prior to IPR and shall be posted on the HR Academy SharePoint site.

Deliverable: 0003 – Quarterly Update In Progress Report

7.1.5 QUALITY CONTROL PLAN

The Contractor shall develop a Quality Control Plan (QCP) for the purpose of establishing and monitoring quality controls to ensure the Contractor meets all performance metrics identified in the PWS. The draft QCP shall be presented at the Contract Kickoff Meeting. The QCP will be reviewed annually at exercise of option. Required updates may be identified by either the Contractor or Government personnel. All updates must be pre-approved by the COR before inclusion in the QCP. The contractor shall present findings of results from implementation of the QCP during the IPR meetings. The Contractor shall present a draft Quality Control Plan at the Contract Kick-Off meeting for review and approval by the Government PM team.

Deliverable: 0004 – Quality Control Plan

7.2.1 COMPETENCY GAP ASSESSMENT AND REPORT

7.2. TASK 2 – Implement, and Manage a Performance Measurement System The contractor shall develop and implement a performance measurement system which uses the Kirkpatrick® Model as a framework to measure the effectiveness, efficiency, and impact of HR Development courses, content, and instructors along with individual HR Professionals’ performance and ability to meet strategic HR Goals. The preferred performance measurement is Knowledge Advisors Metrics that Matter® (MTM) and shall integrate with the VA Learning Management System. The system shall provide systematic and automatic collection of data from participants; observational detail from supervisors, peers, subordinates and customers; and system generated information to provide HR Development Leadership with a comprehensive assessment of environment. The system shall provide advanced measurement capabilities to enable long-term tracking and reporting of job performance change at an individual level and the contribution of individual performance to mission readiness/mission execution. The system shall include a mobile capability via an iOS and Android application, and of the following Knowledge Advisor Metrics that Matter modules:

HR Development Program Evaluation and Management PWS

· Performance Improvement

· Employee Surveys

· Big Data

· Executive Reporting

· Social and Informal Learning

· Project Assessment

· 360˚/Multi-rater Assessment

· Conference Evaluation

· Dashboards

The contractor shall purchase licenses on behalf of the Government to support (7) seven administrators and up to 5,000 users. VA will own the licenses and all customization to the performance measurement system.

The contractor shall provide initial implementation of the performance measurement system. During initial implementation the contractor shall upload courses and data, establish reporting features, and provide training and job aids for HR Development designated staff (administrative users) on how to use the system and reports.

After the initial implementation, the contractor shall provide monthly support. This support shall include: administering user access to the system including creation of accounts and addressing technical issues experienced with logging in system or accessing course evaluations; attaching surveys to HR Development courses in all modalities; running and customizing performance measurement system generated reports; notifying users to take course evaluations; and working with the Performance Measurement System help desk team to resolve any system issues that may arise. Should there be any updates to the performance measurement system, the contractor shall provide support to ensure consistent access and make necessary updates as required. The monthly support shall not begin or be billed prior to the completion of the initial implementation of the system.

Deliverable 0005 – Performance Measurement System Licenses (to be billed as Other Direct Costs) Deliverable 0006 –Initial Implementation of Performance Management System

Deliverable 0007– Monthly Support of Performance Measurement System

7.3 Task 3 – Data Collection, Analysis, and Reporting

The contractor shall develop and implement a data collection and analysis plan. The plan shall be used to build quarterly and annual Programmatic and Learning Evaluation (PLE) reports. The reports shall include evaluation of HR Development’s effectiveness and efficiency as compared with its goals and metrics. This will be defined by section: HR Academy, HR Development Consultant and New Talent Development courses, and aggregate (summary data). The reports shall also provide analysis on Levels 1-4 of the Kirkpatrick® Model for HR Development’s student cohorts. Both the quarterly and annual reports shall include comparative analysis of data and findings from the previous quarter and year(s), respectively.

Please see Attachment A for an example of the evaluation report. The contractor shall include cost benefit analysis, and Return on Investment (ROI) in both the quarterly and annual reports. Each report shall incorporate the contractor’s summary of forecasted analysis and recommendations for HR Academy’s continual improvement. Semi-Annual reports shall be no more than 15 pages long, excluding appendices. Annual reports shall be no more than 30 pages long, excluding appendices. The semi-annual and annual PLE reports shall include an executive summary. PLE reports shall be posted to the SharePoint site on the first Tuesday of October for reporting on the prior quarter; and on the first Tuesday of October for the prior year’s reporting for each annual report. Each report shall include, but not limited to, data points below:

· Data outliers and leverage points.

· Discussion of feasibility of a course(s) and/or projects towards HR Development’s overall goals

· Comparison of HR Development courses and projects, including comparing the total expected cost of each option against the total expected benefits, to see whether the benefits outweigh the costs, and by how much.

· Rates of return on funds invested in HR Development, including an indicator to compare different projects within HR Academy’s project portfolio

Deliverable 0008 – Data Collection Plan Workshop Deliverable 0009- Data Collection and Analysis Plan Deliverable Deliverable 0010 – Programmatic Learning Evaluation Semi-Annual Report Deliverable 0011 – Programmatic Learning Evaluation Annual Report

7.4 TASK 4 HR Academy SharePoint Enhancements, Management, and Maintenance

The Contractor shall manage HR Academy’s efforts to strengthen its online presence on sites such as the HR Academy SharePoint site. Existing internal and external VA HR Academy components of HR Development will be simplified and will direct users appropriately to Workforce Management. The contractor shall deliver enhancement recommendations for HR Academy’s SharePoint to drive user adoption, stakeholder engagement and one-stop shopping, The HR Academy SharePoint Enhancement plan is due within 45 business days after award. The HR Academy SharePoint site and subsites shall be updated quarterly. The contractor shall recommend any additional features and enhancements for inclusion to the site, for approval by the Government. If approved, the contractor shall implement the new features and capabilities. The contractor shall also develop pages within the SharePoint to store requirements detailed in sections 7.1.2, 7.1.3; 7.1.4, 7.2.1, 7.2.3, 7.8, 7.9 and 7.10 of this PWS. The Contractor shall establish appropriate access permissions for HR Development staff and students for the SharePoint and its subsites.

Deliverable 0012 HR Academy SharePoint Enhancement Plan Deliverable 0013 – Maintenance to HR Academy SharePoint site

8.0 GENERAL REQUIREMENTS

8.1 POSITION/TASK RISK DESIGNATION LEVEL(S) AND CONTRACTOR PERSONNEL SECURITY REQUIREMENTS

8.1.1 11.1.1 POSITION/TASK RISK DESIGNATION LEVEL(S)

The Contractor shall submit a Staff Roster that must indicate the required Background Investigation Level for each Contractor individual based upon the tasks the Contractor individual will be working, in accordance with table below.

Position Sensitivity Background Investigation (in accordance with Department of Veterans Affairs 0710 Handbook, “Personnel Security Suitability Program,” Appendix A)

Low National Agency Check with Written Inquiries (NACI) A NACI is conducted by OPM and covers a 5-year period. It consists of a review of records contained in the OPM Security Investigations Index (SII) and the DOD Defense Central Investigations Index (DCII), FBI name check, FBI fingerprint check, and written inquiries to previous employers and references listed on the application for employment. In VA it is used for Non-sensitive or Low Risk positions.

Moderate Moderate Background Investigation (MBI) A MBI is conducted by OPM and covers a 5-year period. It consists of a review of National Agency Check (NAC) records [OPM Security Investigations Index (SII), DOD Defense Central Investigations Index (DCII), FBI name check, and a FBI fingerprint check], a credit report covering a period of 5 years, written inquiries to previous employers and references listed on the application for employment; an interview with the subject, law enforcement check; and a verification of the educational degree.

High Background Investigation (BI) A BI is conducted by OPM and covers a 10-year period. It consists of a review of National Agency Check (NAC) records [OPM Security Investigations Index (SII), DOD Defense Central Investigations Index (DCII), FBI name check, and a FBI fingerprint check report], a credit report covering a period of 10 years, written inquiries to previous employers and references listed on the application for employment; an interview with the subject, spouse, neighbors, supervisor, co-workers; court records, law enforcement check, and a verification of the educational degree.

The position sensitivity and the level of background investigation commensurate with the required level of access for the following tasks within the Performance Work Statement are:

Position Sensitivity and Background Investigation Requirements

The Tasks identified above and the resulting Position Sensitivity and Background Investigation requirements identify, in effect, the Background Investigation requirements for Contractor individuals, based upon the tasks the Contractor individual will be working.

8.1.2 CONTRACTOR PERSONNEL SECURITY REQUIREMENTS

RESCUE GFE requires two factor authentication, so contractor personnel performing SharePoint administrative-types of tasks will need electronic fingerprints, an eQIP background check to the Public Trust High level, VA PIV badges, and VA network/email logins in order to have RESCUE GFE access. Contractor personnel who do not required VPN access for the VA network to perform work under this task order will not need electronic fingerprints, eQIP background checks, VA PIV badges, or VA network/email logins. If contractor personnel will be issued VA PIV badges, but will not be doing system/SharePoint administration-types of tasks, then electronic fingerprints and an eQIP background check to at least the Public Trust Low level will be required.

Contractor Responsibilities:

a. The Contractor shall prescreen all personnel requiring access to the computer systems to ensure they maintain the appropriate Background Investigation, and can read, write, speak and understand the English language.

b. The Contractor shall bear the expense of obtaining background investigations. The background level for this requirement shall be NACI.

c. Within three business days after award, the Contractor shall provide a roster of Contractor and Subcontractor employees to the COR to begin their background investigations. The roster shall contain the Contractor’s Full Name, Full Social Security Number, Date of Birth, Place of Birth, and individual background investigation level requirement (based upon Section 6.0 Tasks).

d. The Contractor should coordinate the location of the nearest VA fingerprinting office through the COR. Only electronic fingerprints are authorized.

e. For a Low Risk designation the following forms are required to be completed: 1.OF-306 and 2.

DVA Memorandum – Electronic Fingerprints. For Moderate or High Risk the following forms are required to be completed: 1. VA Form 0710 and 2. DVA Memorandum – Electronic Fingerprints. These should be submitted to the COR within 5 business days after award.

f. The Contractor personnel will receive an email notification from the Security and Investigation Center (SIC); through the Electronics Questionnaire for Investigations Processes (e-QIP) identifying the website link that includes detailed instructions regarding completion of the investigation documents (SF85, SF85P, or SF 86). The Contractor personnel shall submit all required information related to their background investigations utilizing the Office of Personnel Management’s (OPM) Electronic Questionnaire for Investigations Processing (e-QIP).

g. The Contractor is to certify and release the e-QIP document, print and sign the signature pages, and send them to the COR for electronic submission to the SIC. These should be submitted to the COR within 3 business days of receipt of the e-QIP notification email.

h. The Contractor shall be responsible for the actions of all personnel provided to work for VA under this contract. In the event that damages arise from work performed by Contractor provided personnel, under the auspices of this contract, the Contractor shall be responsible for all resources necessary to remedy the incident.

i. A Contractor may be granted unescorted access to VA facilities and/or access to VA Information Technology resources (network and/or protected data) with a favorably adjudicated Special Agreement Check (SAC) or “Closed, No Issues” (SAC) finger print results, training delineated in VA Handbook 6500.6 (Appendix C, Section 9), and, the signed “Contractor Rules of Behavior.” However, the Contractor will be responsible for the actions of the Contractor personnel they provide to perform work for VA. The investigative history for Contractor personnel working under this contract must be maintained in the database of the Office of Personnel Management (OPM).

j. The Contractor, when notified of an unfavorably adjudicated background investigation on a Contractor employee as determined by the Government, shall withdraw the employee from consideration in working under the contract.

k. Failure to comply with the Contractor personnel security investigative requirements may result in termination of the contract for default.

8.2 METHOD AND DISTRIBUTION OF DELIVERABLES

The Contractor shall deliver documentation in electronic format, unless otherwise directed in Section B of the solicitation/contract. Acceptable electronic media include: MS Office Suite 2016 or higher, and Adobe Postscript Data Format (PDF).

8.3 PERFORMANCE METRICS

The Government shall evaluate the Contractor’s performance under this contract in accordance with the below Quality Assurance Surveillance Plan (QASP). This plan is primarily focused on what the Government must do to ensure the Contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s).

8.4 FACILITY/RESOURCE PROVISIONS

The Government will provide all procedural guides, reference materials, and program documentation for the project. Other Government applications will also be provided on an as-needed basis to accomplish the Tasks associated with this PWS.

The Contractor shall request other Government documentation deemed pertinent to the work accomplishment directly from the COR. The Contractor shall consider the COR as the final source for needed Government documentation when the Contractor fails to secure the documents by other means. The Contractor is expected to use common knowledge and resourcefulness in securing all other reference materials, standard industry publications, and related materials that are relevant to the work.

8.5 GOVERNMENT FURNISHED PROPERTY

Not applicable

9.0 INFORMATION SECURITY

VA INFORMATION AND INFORMATION SYSTEM SECURITY/PRIVACY

1. GENERAL

Contractors, contractor personnel, subcontractors, and subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security.

2. ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS

a. A contractor/subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order.

b. All contractors, subcontractors, and third-party servicers and associates working with VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures.

c. Contract personnel who require access to national security programs must have a valid security clearance. National Industrial Security Program (NISP) was established by Executive Order 12829 to ensure that cleared U.S. defense industry contract personnel safeguard the classified information in their possession while performing work on contracts, programs, bids, or research and development efforts. The Department of Veterans Affairs does not have a Memorandum of Agreement with Defense Security Service (DSS). Verification of a Security Clearance must be processed through the Special Security Officer located in the Planning and National Security Service within the Office of Operations, Security, and Preparedness.

d. Custom software development and outsourced operations must be located in the U.S. to the maximum extent practical. If such services are proposed to be performed abroad and are not disallowed by other VA policy or mandates, the contractor/subcontractor must state where all non-U.S. services are provided and detail a security plan, deemed to be acceptable by VA, specifically to address mitigation of the resulting problems of communication, control, data protection, and so forth. Location within the U.S. may be an evaluation factor.

e. The contractor or subcontractor must notify the Contracting Officer immediately when an employee working on a VA system or with access to VA information is reassigned or leaves the contractor or subcontractor's employ. The Contracting Officer must also be notified immediately by the contractor or subcontractor prior to an unfriendly termination.

3. VA INFORMATION CUSTODIAL LANGUAGE

a. Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the contractor/subcontractor's rights to use data as described in Rights in Data - General, FAR 52.227-14(d) (1).

b. VA information should not be co-mingled, if possible, with any other data on the contractors/subcontractor's information systems or media storage systems in order to ensure VA requirements related to data protection and media sanitization can be met. If co-mingling must be allowed to meet the requirements of the business need, the contractor must ensure that VA's information is returned to the VA or destroyed in accordance with VA's sanitization requirements. VA reserves the right to conduct on site inspections of contractor and subcontractor IT resources to ensure data security controls, separation of data and job duties, and destruction/media sanitization procedures are in compliance with VA directive requirements.

c. Prior to termination or completion of this contract, contractor/ subcontractor must not destroy information received from VA, or gathered/ created by the contractor in the course of performing this contract without prior written approval by the VA. Any data destruction done on behalf of VA by a contractor/subcontractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self-certification by the contractor that the data destruction requirements above have been met must be sent to the VA Contracting Officer within 30 days of termination of the contract.

d. The contractor/subcontractor must receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with the terms of the contract and applicable Federal and VA information confidentiality and security laws, regulations and policies. If Federal or VA information confidentiality and security laws, regulations and policies become applicable to the VA information or information systems after execution of the contract, or if NIST issues or updates applicable FIPS or Special Publications (SP) after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations and policies in this contract.

e. The contractor/subcontractor shall not make copies of VA information except as authorized and necessary to perform the terms of the agreement or to preserve electronic information stored on contractor/subcontractor electronic storage media for restoration in case any electronic equipment or data used by the contractor/subcontractor needs to be restored to an operating state. If copies are made for restoration purposes, after the restoration is complete, the copies must be appropriately destroyed.

f. If VA determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12.

g. If a VHA contract is terminated for cause, the associated BAA must also be terminated and appropriate actions taken in accordance with VHA Handbook 1600.01, Business Associate Agreements. Absent an agreement to use or disclose protected health information, there is no business associate relationship.

h. The contractor/subcontractor must store, transport, or transmit VA sensitive information in an encrypted form, using VA-approved encryption tools that are, at a minimum, FIPS 140-2 validated.

i. The contractor/subcontractor's firewall and Web services security controls, if applicable, shall meet or exceed VA's minimum requirements. VA Configuration Guidelines are available upon request.

j. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor/subcontractor may use and disclose VA information only in two other situations: (i) in response to a qualifying order of a court of competent jurisdiction, or (ii) with VA's prior written approval. The contractor/subcontractor must refer all requests for, demands for production of, or inquiries about, VA information and information systems to the VA contracting officer for response.

k. Notwithstanding the provision above, the contractor/subcontractor shall not release VA records protected by Title 38 U.S.C. 5705, confidentiality of medical quality assurance records and/or Title 38 U.S.C. 7332, confidentiality of certain health records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse, or infection with human immunodeficiency virus. If the contractor/subcontractor is in receipt of a court order or other requests for the above mentioned information, that contractor/subcontractor shall immediately refer such court orders or other requests to the VA contracting officer for response.

l. For service that involves the storage, generating, transmitting, or exchanging of VA sensitive information but does not require C&A or an MOU-ISA for system interconnection, the contractor/subcontractor must complete a Contractor Security Control Assessment (CSCA) on a yearly basis and provide it to the COR.

4. INFORMATION SYSTEM DESIGN AND DEVELOPMENT

a. Information systems that are designed or developed for or on behalf of VA at non-VA facilities shall comply with all VA directives developed in accordance with FISMA, HIPAA, NIST, and related VA security and privacy control requirements for Federal information systems. This includes standards for the protection of electronic PHI, outlined in 45 C.F.R. Part 164, Subpart C, information and system security categorization level designations in accordance with FIPS 199 and FIPS 200 with implementation of all baseline security controls commensurate with the FIPS 199 system security categorization (reference Appendix D of VA Handbook 6500, VA Information Security Program). During the development cycle a Privacy Impact Assessment (PIA) must be completed, provided to the COR, and approved by the VA Privacy Service in accordance with Directive 6507, VA Privacy Impact Assessment.

b. The contractor/subcontractor shall certify to the COR that applications are fully functional and operate correctly as intended on systems using the VA Federal Desktop Core Configuration (FDCC), and the common security configuration guidelines provided by NIST or the VA. This includes Internet Explorer 7 configured to operate on Windows XP and Vista (in Protected Mode on Vista) and future versions, as required.

c. The standard installation, operation, maintenance, updating, and patching of software shall not alter the configuration settings from the VA approved and FDCC configuration. Information technology staff must also use the Windows Installer Service for installation to the default "program files" directory and silently install and uninstall.

d. Applications designed for normal end users shall run in the standard user context without elevated system administration privileges.

e. The security controls must be designed, developed, approved by VA, and implemented in accordance with the provisions of VA security system development life cycle as outlined in NIST Special Publication 800-37, Guide for Applying the Risk Management Framework to Federal Information Systems, VA Handbook 6500, Information Security Program and VA Handbook 6500.5, Incorporating Security and Privacy in System Development Lifecycle.

f. The contractor/subcontractor is required to design, develop, or operate a System of Records Notice (SOR) on individuals to accomplish an agency function subject to the Privacy Act of 1974, (as amended), Public Law 93-579, December 31, 1974 (5 U.S.C. 552a) and applicable agency regulations. Violation of the Privacy Act may involve the imposition of criminal and civil penalties.

g. The contractor/subcontractor agrees to:

(1) Comply with the Privacy Act of 1974 (the Act) and the agency rules and regulations issued under the Act in the design, development, or operation of any system of records on individuals to accomplish an agency function when the contract specifically identifies:

(a) The Systems of Records (SOR); and

(b) The design, development, or operation work that the contractor/ subcontractor is to perform;

(1) Include the Privacy Act notification contained in this contract in every solicitation and resulting subcontract and in every subcontract awarded without a solicitation, when the work…