36C77619Q0037-001.docx

PERFORMANCE WORK STATEMENT

FOR

SIMLEARN AUDIT

1. BACKGROUND

SimLEARN has become aware of irregularities in its method of assessing the need for purchases, the accountability of purchases and the assessment of funding. Preliminary results of inventories reveal a high level of waste. EES is required by the Office of Management and Budget (OMB) to perform assessments over its manager’s internal control environment. It contributes to EES’s Statement of Assurance (SOA), as prescribed by OMB Circular A-123, “Manager’s Internal Control Program (MICP).” The circular cites it is the responsibility of management to establish and maintain adequacy and operating effectiveness of internal financial control, evaluate internal financial control and risk management systems.

SimLEARN plans to enhance its comprehensive business environment and subsequent processes and increase compliance with Federal and Department of Veteran Affairs standards and directives. However, SimLEARN does not have the internal capability to review over 2,800 invoices and the budget system that supported the funding for those purchases. This request is to provide support to the Simulation Learning Education and Research Networks’ (SimLEARN) to have the ability to assess whether SimLEARN has functioned in accordance with the Federal Acquisition Regulation and the Office of Management and Budget (OMB) Circular A-123 (updated July 15, 2016).

This requirement for managerial evaluation of Internal Financial Controls allows for seeking support and advice for external auditors and finance professionals. This audit and its resultant recommendations will support the development of program management services to ensure alignment with financial management, contract, and technical requirements objectives and processes as required.

2. SCOPE

The objective of this PWS is to obtain Financial Management support in the form of Internal Financial Process Audit which will review SimLEARNs Budget, Execution, and Accounting Operations, this will include the processes of Employee Education System (EES) Budget operations that facilitated the oversight of SimLEARN budgetary and acquisition functions.

Internal Financial Process Audit support service includes a review of approximately 6,500 purchasing support documents, approximately 325 awards and the financial system used to facilitate the actions by providing the following capabilities:

Substantiation/Matching: Corroborating or confirming financial information contained in the reporting systems of EES budget, acquisition records that relate to SimLEARN with reporting systems or source document (e.g. invoice) to ensure that the information is accurate and complete.

Review and Verification: Examining financial information related to requirement validation and funding, bonafide need and final disposition (to include invoice review, tracking of deliverables, correlation of award to program requirement for accuracy and reasonableness. Information determined to appear inaccurate or unreasonable will be annotated in monthly reports.

Reconciliation: Comparing information that exists between the EES tracking systems and the approximately 6,500 documents that reflect the expenditures for all EES purchases with PEO STRI. The Contractor is to analyze the differences and report necessary corrections so that the information is accurate, complete and consistent in both systems or locations.

Internal control: Assessment of SimLLEARN cannot be separate from the office responsible for its functional oversight. Conduct an overarching review of EES budget to assess the internal controls of budgetary distribution, accountability and compliance with VHA and OMB guidance.

3. WORKLOAD DATA

3.1. Key Personnel and Non-Key Personnel Support Services: The following personnel is listed to identify the support services required in the different support categories and considered Key Personnel by the Government.

3.1.1. Project Manager (PM):

· The Contractor shall provide a PM who shall be responsible for the performance of the work. The name of this person and an alternate who shall act for the Contractor when the PM is absent shall be designated in writing to the CO. The alternate PM shall not be a sub-contractor. The PM or alternate shall be the single point of contact for the Government and have full authority for all matters concerning progress, problems, problem resolution, performance schedule, cost resources and all other contract matters relating to daily operation of this contract to include initiation, planning, execution, monitoring, and closeout. The PM shall be available during normal working hours.

· Shall have a minimum of 10 years PM experience managing projects and programs similar in magnitude and complexity as the work described in the PWS.

· Shall have a minimum of 10 years DoD financial management experience managing projects and programs similar in magnitude and complexity as the work described in the PWS.

· Significant experience briefing upper management and must possess an in-depth understanding and knowledge of, resource management, and accountability

· Excellent written and oral communication skills

· Must have the following certification: Certified Public Accountant (CPA)

3.1.2. Auditor – Internal Control over Financial Reporting:

· A Bachelor’s of Science degree in Accounting, or Master’s Degree with Business Concentration

· Shall have a minimum of 3-5 years experience in Actual Yellow Book audits

· Shall have a minimum of 5-8 years Financial Processes or Audit experience

· Must have the following certifications: CPA

3.1.3. Audit Readiness / MICP – Internal Control over Financial Systems:

· A Bachelor’s of Science degree in Management Information Systems

· Shall have a minimum of 3-5 years experience of Actual Yellow Book

· Shall have a minimum of 5-8 years DoD systems AuR experience

· Experience with the DAI accounting system or Oracle-based accounting system

· Must have one of the following certifications: Certified Information Systems Auditor (CISA) (Preferred), Certified Information Systems Manager (CISM), or Certified Information Systems Security Professional (CISSP)

3.1.4. Accounting Support:

· Experience with the Federal accounting systems

· Ability to produce, analyze and interpret accounting reports including but not limited to financial statements, related footnotes, SF133s, 1002 Accounts Receivable (AR) reports etc.

· Must have expert level experience with Federal Contracting, and working with Excel and Access databases

· Must have either of the following certifications: CPA (Preferred) or Certified Government Financial Manager (CGFM) / Certified Defense Financial Manager (CDFM)

· Must have 5-8 years of experience resolving/analyzing accounting reports and data anomalies related to Unmatched disbursements (UMDs), Unliquidated obligations (ULOs), Negative Unliquidated balance

· Experience with the DAI accounting system

· Shall have a minimum of total 3-5 years of Federal Budget and accounting experience

· Must have expert level experience working with Excel and Access databases

· Must have either of the following certifications: CPA (Preferred) or CGFM / CDFM

· Must have 3-5 years experience resolving/analyzing accounting reports and data anomalies related to UMDs, ULOs, NULOs, and TAR.

3.2. APPLICABLE PUBLICATIONS

3.2.1. The Contractor must abide by the following applicable regulations, publications, manuals, and local policies and procedures as well as regulations, publications, manuals, and local policies and procedures identified in each individual task within the PWS.

3.2.2. The Contractor shall comply with all appropriate Department of Veteran Affairs security policies.

3.2.3. All processes shall be performed and maintained at a quality assurance level based upon ISO 9001:2008. The Contractor must perform its task and maintain the environment in accordance with these standards and operational procedures.

3.2.4. The following criteria are applicable to this requirement. The Contractor shall refer to following documents for guidance to complete this requirement: OMB Circular A-123 guidance (2004), Generally Accepted Accounting Principles (GAAP) and any and all applicable Government pronouncements including the General Accounting Office/Presidents Council on Integrity and Efficiency (GAO/PCI-E) financial and audit methods as set forth in the GAO/PCIE Financial Audit Manual (FAM) (2008) and the GAO Federal Information System Controls Audit Manual (FISCAM). OMB Circular A-123 implements and incorporates the CFO Act, Federal Managers Financial Integrity Act of 1982 (FMFIA), Government Performance and Results Act (GPRA), Inspector General Act of 1978 (IG Act), Federal Financial Management Improvement Act of 1996 (FFMIA), Improper Payment Information Act of 2002 (IPIA), and Clinger-Cohen Act of 1996 (CCA). These Government criteria and other criteria listed below are all available online.

· Federal Managers’ Financial Integrity Act of 1982 (FMFIA)

· Federal Financial Management Improvement Act of 1996 (FFMIA)

· Statements of Federal Financial Accounting Standards (SFFAS)

· Generally Accepted Accounting Principles (GAAP)

· Generally Accepted Auditing Standards (GAAS)

· Generally Accepted Government Audit Standards (GAGAS)

· Audit guidance issued by the Office of Management and Budget (OMB)

· Joint Financial Management Improvement Program (JFMIP) Core and Subsidiary Core Requirements

· General Accounting Office/President’s Council on Integrity and Efficiency (GAO/PCIE) “Financial Audit Manual” (FAM)

· GAO “Federal Information System Control Audit Manual” (FISCAM)

· Standards established by the American Institute of Certified Public Accountants (AICPA), the Federal Accounting Standards Advisory Board (FASAB) and the Public Company Accounting Oversight Board (PCAOB)

· COSO Internal Control – Integrated Framework (1992)

4. REQUIREMENT

4.1. Specific Tasks:

4.1.1. Basic Services: The Contractor shall provide services for an in-depth Internal Financial Process Audit and Analysis; to include documentation analysis, program process analysis (in respect to cost-effectiveness and efficiencies) and audit readiness planning.

4.1.2. Review of Financial Processes, Budget Execution, and Progress Process analysis.

4.1.3. Program Management Analysis

4.1.3.1. The Contractor shall ensure alignment with financial management, contract, technical requirements objectives, and processes. These include, but are not limited to preparation, review, and assessment of program management documentation addressing scope, cost, schedule and technical performance, across all phases of the financial management lifecycle from requirement initiation through close out.

4.1.3.2. The Program Management analysis shall review different work streams across the operation, data analytics and reporting, compliance and audit infrastructure. The Contractor shall conduct a comparative analysis of SimLEARN financial program planning to those of like entities ensure reasonable responsiveness to mission objectives and reflecting sound program planning and tenants. The contractor will assess the processes of project development and implementation from a financial perspective reviewing program management procedures and processes to achieve efficiency and cost savings for managing current and future requirements.

4.1.4. Auditing of Budgeting and Execution process: The contractor will review existing records, create a clear record of expenditures and identify deficiencies in both processes or actual actions. This review applies to all budget-related events for all expenditure actions in support of SimLEARN between FY 2011 through FY 2017. To be completed by extracting data from program, budget and acquisition databases. Support SimLEARN in developing a defend executable budgets clearly linked to VHA and VA business transformation and strategic goals.

4.1.4.1. Planning: The Contractor shall provide plans include: providing recommendations and initiatives for organizations improvements to developing and reviewing future year financial program plans; conducting financial and risk analysis identifying and evaluating financial risks and recommending mitigation strategies to reduce risk exposure; providing analytical assessments, recommendations to improve cost estimates (for life-cycle costs or other activities).

4.1.4.2. Programming: The Contractor shall provide programming services to include: reviewing and preparing draft Program Objective Memorandum (POM) guidance documentation; developing impact statements; developing financial aspects of Plan of Actions & Milestones (POA&Ms); providing program analysis and evaluation reports in support of the DoD programming process; and collecting, analyzing, and evaluating requirements.

4.1.5. Execution Support Services: Services shall review spending plans and funding documents to align allocation to programs in alignment with metrics and projections. provide for funding from other entities. The workstream shall focus heavily on analyzing data in SimLEARN to develop metrics and dashboard type display which supports measurement and assesses overall financial performance. This shall result in the identification of specific metrics and trends (i.e. contract lead times, obligation rates, etc.) to improve visibility and accountability during execution and for use in subsequent planning activities.

4.1.5.1. Financial Reporting: The Contractor shall assist with documented adherence to accounting standards, processes, and requirements, and shall support the implementation and proper maintenance of the organizations accounting system. In addition, the Contractor shall provide support for the examination, analysis, and interpretation of accounting data, records, and reports to ensure transactions have posted accurately, timely, and completely to any system SimLEARN designates as their repository. Examples include reconciliation of PEO STRI invoice portal to detailed transactions with the purpose of identifying errors and anomalies that requires subsequent research, analysis and correction, review, and analysis. The Contractor shall perform financial reconciliations statements to develop and deliver financial reports and documentation that provide information for planning, formulating policy, determining root cause and corrective actions and evaluating financial performance.

4.1.5.2. The Contractor shall support SimLEARN by reviewing financial management information systems; collecting, monitoring and analyzing obligation/expenditure information from the source (contractor or government activity) and official and/or unofficial accounting records or systems; resolving problem disbursements; providing reconciliation for the UMDs open document listings, TAR, contract closeout and NULO’s; providing analysis of contract execution status.

4.1.5.3. The contractor shall ensure data completeness, data cleansing, data anomaly root cause analysis and prevention with the end goal of valid data used in support of management decision making in accordance with applicable laws and regulations.

4.1.5.4. The Contractor shall provide financial analysis, trends, and forecast support for major programs (i.e. PSI-I, civilian pay, FTE, and manpower). Assessment and development of an annual execution strategy to improve agency compliance w/ OUSD Comptroller benchmarks. The Contractor shall develop and prepare special reports, financial analyses, and briefings to respond to the financial data needs of the DSS Comptroller. To accomplish this task the Contractor will receive and analyze DSS financial reports and other pertinent information with the goal of providing performance and decision support information to the Comptroller. Government shall provide the Contractor DSS financial reports and other pertinent information for analysis. Government shall provide initial requirements for special reports and financial analyses no later than the fifth workday after contract award with subsequent requirements identified during the period of performance.

4.1.5.5. The Contractor shall review: Unpaid Invoice Report, Invoice Register, Invoice Aging Report, WAWF Interface Report, Aging Reports and any other databases deem relevant.

4.1.5.6. Administrative and Documentation Support: The Contractor shall provide administrative support for all documentation in support of the Internal Financial Process Audit. All documents should be reviewed and recorded as required. This will include, but not be limited to, all SimLEARN business processes related to budget formulation and execution, The Contractor shall maintain documentation of data requirements, system test, and implementation plans.

4.1.6. Audit Readiness and Sustainment Support

4.1.6.1. Financial Improvement and Audit Readiness (FIAR) Plan: Deliver a report that identifies and maps the steps to implement the recommendations for SimLEARN to continue to be Audit ready. To ensure SimLEARN financial actions and resultant financial data meet the requirements of VHA, VA, and other referenced guidance. FIAR efforts shall include but are not limited to the following:

· Planning and Prioritization

· Bilateral Agreement monitoring

· Documentation repository management

· Corrective Action Plan (CAP) monitoring and remediation

· Workflow management

Policy and Procedures and Standard Operating Procedures (SOP). The Contractor shall review, edit, or develop Policies and Procedures that meet the objectives of the overall business processes defined in the audit ready environment either currently in existence or recommended as part of the Corrective Action Phase. Additionally, gap analysis efforts shall be conducted to address any undocumented processes.

4.2. The Contractor shall ensure a stable workforce during the performance of this contract. Key personnel shall not be replaced without prior notification and approval by the CO or COR on the contract. The Government recognizes that the Contractor cannot compel any individual to remain under its employ. Due to the short period of performance, the contractor is advised that consistency in staffing is a critical component to the success of this requirement. The Contractor shall notify the CO or COR, in writing of a proposed substitution at least fourteen (14) calendar days in advance of the key personnel change. Include the proposed replacement’s résumé in the notification. The Government will review the résumé(s) to ensure compliance with this clause and other requirements contained in this PWS. All proposed substitutes shall have qualifications equal to or greater than the person to be replaced. The Government will evaluate such requests and promptly notify the Contractor, in writing, of his/her approval or disapproval thereof.

4.3. Identification of Contractor Employees: All contract personnel attending meetings, answering Government telephones, and working in other situations where their Contractor status is not obvious to third parties are required to identify themselves as such to avoid creating an impression in the minds of members of the public that they are Government officials. They must also ensure that all documents or reports produced by contractors are suitably marked as contractor products or that contractor participation is appropriately disclosed.

4.4. Contractor Travel: Travel outside of the local commuting area of some contractor employees may be required under this contract. The contract will include a Contract Line Item Number (CLIN) for travel that will be provided for the period of performance with a Not-to-Exceed value.

The Government anticipates that travel to one Government site for a face to face report of findings may be required. The exact location is not known at this time. Travel reimbursement shall be made on a cost reimbursable method; the Government will reimburse the contractor for actuals costs associated with approved travel. All request for contractor travel must be approved by the COR or CO prior to commencing. The contractor shall submit a Cost Estimate that includes the following:

a. Reason for Traveling

b. Temporary Duty Location

c. Number of Individuals Traveling

d. Estimates for Hotel, Air Fare, Parking, Mileage, Rental Car, and Per Diem

All contractor travel shall use the most effective and efficient means to travel. Requests for approval of costs in excess of maximum per diem rates in accordance with the procedures contained in FAR 31.205-46(a)(3) must be submitted to the CO for final approval prior to the commencement of travel.

Local travel, including to and from Department of Veteran Affairs headquarters and in the surrounding metropolitan DC area, performed during the course of performance is considered the cost of doing business and will not be reimbursed. Consequently, all travel within 100 miles of the National Capital Region is included in the price of this contract. When the movement of contractor personnel is required locally (e.g., Metro) costs will be borne by the Contractor. The Government will reimburse the Contractor for all other travel outside the 100-mile limitation that was authorized in advance by the COR or CO, for reasonable travel-related expenses.

The contractor shall be reimbursed for actual allowable, allocable, and reasonable travel costs incurred during performance of this effort in accordance with the FAR 31.205-46 "Travel Costs" and the limitation of funds specified in this contract. This includes, but is not limited to, reimbursement of transportation, lodging, meals and incidental expenses. When the contractor invoices for the completed travel, the contractor shall submit copies of all receipts (regardless of dollar value) with a copy of the COR/CO’s approval to travel with the invoice that requests reimbursement for travel under the Travel CLIN.

4.5. Organizational Conflict of Interest: Contractor and subcontractor personnel performing work under this contract may receive, have access to or participate in the development of proprietary or source selection information (e.g., cost or pricing information, budget information or analyses, specifications or work statements, etc.) or perform evaluation services which may create a current or subsequent Organizational Conflict of Interests (OCI) as defined in FAR Subpart 9.5. The Contractor shall notify the CO immediately whenever it becomes aware that such access or participation may result in any actual or potential OCI and shall promptly submit a plan to the CO to avoid or mitigate any such OCI. The Contractor’s mitigation plan will be determined to be accepted solely at the discretion of the CO and in the event the CO unilaterally determines that any such OCI cannot be satisfactorily avoided or mitigated, the CO may affect other remedies as he or she deems necessary, including prohibiting the Contractor from participation in subsequently contracted requirements which may be affected by the OCI.

5. DELIVERABLES AND PERFORMANCE MEASURES

Quality Assurance: The government shall evaluate the contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Plan. This plan is primarily focused on what the Government must do to ensure that the contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s).

Performance Requirements Summary

Performance Measures

The contractor service requirements are summarized into performance objectives that relate directly to mission essential items. The performance threshold briefly describes the minimum acceptable levels of service required for each requirement. These thresholds are critical to mission success.

PRS # 1.

The Contractor shall be effective in ensuring quality, accuracy and clear reporting in support of this project

95% of the time

Random monitoring, 100% inspection of all deliverables by the assigned COR

PRS # 2

The Contractor shall provide assistance to the government FM managers in direction of selected files and data required for initiating, planning, and execute this requirement.

PRS # 3

The Contractor shall provide professional business services that include project leadership and communications with stakeholders; project planning and management; performance monitoring and measurement; reporting and documentation.

PRS # 4

The Contractor will participate in programmatic meetings, reviews, and briefings associated with this contract and will advise COR and CO of document/ timely access concerns.

99% of the time Random monitoring, 100% inspection of all deliverables by the assigned COR

Deliverables Schedule

Status Report (see note)

Microsoft Office products only.

Government PM and COR

Microsoft Office products only.

Government PM and COR

Program Development Analysis Report: including process flow charts, narratives, risk and control assessments, and remediation plans

OPTIONAL

Audit Readiness and Sustainment Report

products only.

Government PM and COR

6. GENERAL INFORMATION

6.1. Site Conditions, Holidays and other Closures:

The Government expects the Contractor will establish normal core operating hours under this contract between 8:00 a.m. to 4:30 p.m. Eastern Standard Time (EST) Monday through Friday. The Contractor’s PM and the Government’s COR shall consult and coordinate on any proposed alternate work schedules that may be arranged depending on the operational tempo/needs of the mission.

Government personnel observes the following days as holidays and the Government facilities will be closed and unavailable to contractor personnel on the following days:

*If the date falls on a Saturday, the Government holiday is the preceding Friday. If the date falls on a Sunday, the Government holiday is the following Monday.

6.2. Hours of Operation: The contractor is responsible for conducting business, between the hours of 6:00 a.m. to 6:00 p.m. EST Monday thru Friday except for Federal holidays or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings. The Contractor must at all times maintain an adequate workforce for the uninterrupted performance of all tasks defined within this PWS. When hiring personnel, the Contractor shall keep in mind that the stability and continuity of the workforce are essential.

6.3. Place of Performance: The work to be performed under this contract will be performed off-site at the contractor work location.

6.4. Post Award Conference/Periodic Progress Meetings: The Contractor agrees to attend any post-award conference convened by the contracting activity or contract administration office in accordance with Federal Acquisition Regulation Subpart 42.5. The CO, COR, and other Government personnel, as appropriate, may meet periodically with the contractor to review the contractor's performance. At these meetings, the CO will apprise the contractor of how the government views the contractor's performance and the contractor will apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the government.

6.5. Contracting Officer Representative (COR): The COR will be identified by a separate letter. The COR monitors all technical aspects of the contract and assists in contract administration. The COR is authorized to perform the following functions: assure that the Contractor performs the technical requirements of the contract; perform inspections necessary in connection with contract performance; maintain written and oral communications with the Contractor concerning technical aspects of the contract; issue written interpretations of technical requirements, including Government drawings, designs, and specifications; monitor the Contractor's performance and notifies both the CO and Contractor of any deficiencies; coordinate availability of government furnished property, and provide site entry of Contractor personnel. A letter of designation issued to the COR, a copy of which is sent to the Contractor, states the responsibilities and limitations of the COR, especially with regard to changes in cost or price, estimates or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the resulting order.

6.6. GOVERNMENT FURNISHED ITEMS AND SERVICES:

6.6.1. Facilities: The Government will provide the necessary workspace for the Contractor staff to provide the support outlined in the PWS to include desk space, telephones, computers, and other items necessary to maintain an office environment.

6.6.2. Equipment: DSS will provide all necessary equipment to perform this requirement. Contractor personnel will take and appropriately document any necessary training related to the use of DSS equipment. The Government will provide computing devices for use by the Contractor on the DSS Network, in the performance of this contract. In addition, the Contractor will be provided Government-Furnished Information (GFI) and Government-Furnished Material (GFM) as applicable.

6.6.3. Databases and Financial Systems: The Government shall provide access to various DSS databases and financial systems including DAI, the Defense Department Reporting System (DDRS), and the Manpower database.

6.7. CONTRACTOR FURNISHED ITEMS AND RESPONSIBILITIES:

6.7.1. General: The Contractor shall furnish all supplies, equipment, facilities, and services required to perform work under this contract that is not listed under Section 3 of this PWS.

6.7.2. Materials and Equipment: For any tasks performed off-site or at a Contractor facility the contractor shall furnish materials, supplies, and equipment necessary to accomplish the requirement.

VA Information and Information System Security/Privacy Language for Contracted Personnel from VA Handbook 6500.6, Contract Security, Appendix C:

1. GENERAL

Contractors, contractor personnel, subcontractors, and subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security.

2. ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS

a. A contractor/subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order.

b. All contractors, subcontractors, and third-party servicers and associates working with VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures.

c. Contract personnel who require access to national security programs must have a valid security clearance. National Industrial Security Program (NISP) was established by Executive Order 12829 to ensure that cleared U.S. defense industry contract personnel safeguard the classified information in their possession while performing work on contracts, programs, bids, or research and development efforts. The Department of Veterans Affairs does not have a Memorandum of Agreement with Defense Security Service (DSS). Verification of a Security Clearance must be processed through the Special Security Officer located in the Planning and National Security Service within the Office of Operations, Security, and Preparedness.

d. Custom software development and outsourced operations must be located in the U.S. to the maximum extent practical. If such services are proposed to be performed abroad and are not disallowed by other VA policy or mandates, the contractor/subcontractor must state where all non-U.S. services are provided and detail a security plan, deemed to be acceptable by VA, specifically to address mitigation of the resulting problems of communication, control, data protection, and so forth. Location within the U.S. may be an evaluation factor.

e. The contractor or subcontractor must notify the Contracting Officer immediately when an employee working on a VA system or with access to VA information is reassigned or leaves the contractor or subcontractor’s employ. The Contracting Officer must also be notified immediately by the contractor or subcontractor prior to an unfriendly termination.

3. VA INFORMATION CUSTODIAL LANGUAGE

a. Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the contractor/subcontractor's rights to use data as described in Rights in Data - General, FAR 52.227-14(d) (1).

b. VA information should not be co-mingled, if possible, with any other data on the contractors/subcontractor’s information systems or media storage systems in order to ensure VA requirements related to data protection and media sanitization can be met. If co-mingling must be allowed to meet the requirements of the business need, the contractor must ensure that VA’s information is returned to the VA or destroyed in accordance with VA’s sanitization requirements. VA reserves the right to conduct on site inspections of contractor and subcontractor IT resources to ensure data security controls, separation of data and job duties, and destruction/media sanitization procedures are in compliance with VA directive requirements.

c. Prior to termination or completion of this contract, contractor/subcontractor must not destroy information received from VA, or gathered/created by the contractor in the course of performing this contract without prior written approval by the VA. Any data destruction done on behalf of VA by a contractor/subcontractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self-certification by the contractor that the data destruction requirements above have been met must be sent to the VA Contracting Officer within 30 days of termination of the contract.

d. The contractor/subcontractor must receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with the terms of the contract and applicable Federal and VA information confidentiality and security laws, regulations and policies. If Federal or VA information confidentiality and security laws, regulations and policies become applicable to the VA information or information systems after execution of the contract, or if NIST issues or updates applicable FIPS or Special Publications (SP) after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations and policies in this contract.

e. The contractor/subcontractor shall not make copies of VA information except as authorized and necessary to perform the terms of the agreement or to preserve electronic information stored on contractor/subcontractor electronic storage media for restoration in case any electronic equipment or data used by the contractor/subcontractor needs to be restored to an operating state. If copies are made for restoration purposes, after the restoration is complete, the copies must be appropriately destroyed.

f. If VA determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12.

g. If a VHA contract is terminated for cause, the associated BAA must also be terminated and appropriate actions taken in accordance with VHA Handbook 1600.01, Business Associate Agreements. Absent an agreement to use or disclose protected health information, there is no business associate relationship.

h. The contractor/subcontractor must store, transport, or transmit VA sensitive information in an encrypted form, using VA-approved encryption tools that are, at a minimum, FIPS 140-2 validated.

i. The contractor/subcontractor’s firewall and Web services security controls, if applicable, shall meet or exceed VA’s minimum requirements. VA Configuration Guidelines are available upon request.

j. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor/subcontractor may use and disclose VA information only in two other situations: (i) in response to a qualifying order of a court of competent jurisdiction, or (ii) with VA’s prior written approval. The contractor/subcontractor must refer all requests for, demands for production of, or inquiries about, VA information and information systems to the VA contracting officer for response.

k. Notwithstanding the provision above, the contractor/subcontractor shall not release VA records protected by Title 38 U.S.C. 5705, confidentiality of medical quality assurance records and/or Title 38 U.S.C. 7332, confidentiality of certain health records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse, or infection with human immunodeficiency virus. If the contractor/subcontractor is in receipt of a court order or other requests for the above mentioned information, that contractor/subcontractor shall immediately refer such court orders or other requests to the VA contracting officer for response.

l. For service that involves the storage, generating, transmitting, or exchanging of VA sensitive information but does not require C&A or an MOU-ISA for system interconnection, the contractor/subcontractor must complete a Contractor Security Control Assessment (CSCA) on a yearly basis and provide it to the COR.

4. SECURITY INCIDENT INVESTIGATION

a. The term “security incident” means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. The contractor/subcontractor shall immediately notify the COR and simultaneously, the designated ISO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/subcontractor has access.

b. To the extent known by the contractor/subcontractor, the contractor/subcontractor’s notice to VA shall identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the VA information or assets were placed at risk or compromised), and any other information that the contractor/subcontractor considers relevant.

c. With respect to unsecured protected health information, the business associate is deemed to have discovered a data breach when the business associate knew or should have known of a breach of such information. Upon discovery, the business associate must notify the covered entity of the breach. Notifications need to be made in accordance with the executed business associate agreement.

d. In instances of theft or break-in or other criminal activity, the contractor/subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG and Security and Law Enforcement. The contractor, its employees, and its subcontractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The contractor/subcontractor shall cooperate with VA in any civil litigation to recover VA information, obtain monetary or other compensation from a third party for damages arising from any incident, or obtain injunctive relief against any third party arising from, or related to, the incident.

5. LIQUIDATED DAMAGES FOR DATA BREACH

a. Consistent with the requirements of 38 U.S.C. §5725, a contract may require access to sensitive personal information. If so, the contractor is liable to VA for liquidated damages in the event of a data breach or privacy incident involving any SPI the contractor/subcontractor processes or maintains under this contract. However, it is the policy of VA to forgo collection of liquidated damages in the event the contractor provides payment of actual damages in an amount determined to be adequate by the agency.

b. The contractor/subcontractor shall provide notice to VA of a “security incident” as set forth in the Security Incident Investigation section above. Upon such notification, VA must secure from a non-Department entity or the VA Office of Inspector General an independent risk analysis of the data breach to determine the level of risk associated with the data breach for the potential misuse of any sensitive personal information involved in the data breach. The term 'data breach' means the loss, theft, or other unauthorized access, or any access other than that incidental to the scope of employment, to data containing sensitive personal information, in electronic or printed form, that results in the potential compromise of the confidentiality or integrity of the data. Contractor shall fully cooperate with the entity performing the risk analysis. Failure to cooperate may be deemed a material breach and grounds for contract termination.

c. Each risk analysis shall address all relevant information concerning the data breach, including the following:

(1) Nature of the event (loss, theft, unauthorized access);

(2) Description of the event, including:

(a) date of occurrence;

(b) data elements involved, including any PII, such as full name, social security number, date of birth, home address, account number, disability code;

(3) Number of individuals affected or potentially affected;

(4) Names of individuals or groups affected or potentially affected;

(5) Ease of logical data access to the lost, stolen or improperly accessed data in light of the degree of protection for the data, e.g., unencrypted, plain text;

(6) Amount of time the data has been out of VA control;

(7) The likelihood that the sensitive personal information will or has been compromised (made accessible to and usable by unauthorized persons);

(8) Known misuses of data containing sensitive personal information, if any;

(9) Assessment of the potential harm to the affected individuals;

(10) Data breach analysis as outlined in 6500.2 Handbook, Management of Security and Privacy Incidents, as appropriate; and

(11) Whether credit protection services may assist record subjects in avoiding or mitigating the results of identity theft based on the sensitive personal information that may have been compromised.

d. Based on the determinations of the independent risk analysis, the contractor shall be responsible for paying to the VA liquidated damages in the amount of $37.50 per affected individual to cover the cost of providing credit protection services to affected individuals consisting of the following:

(1) Notification;

(2) One year of credit monitoring services consisting of automatic daily monitoring of at least 3 relevant credit bureau reports;

(3) Data breach analysis;

(4) Fraud resolution services, including writing dispute letters, initiating fraud alerts and credit freezes, to assist affected individuals to bring matters to resolution;

(5) One year of identity theft insurance with $20,000.00 coverage at $0 deductible; and

(6) Necessary legal expenses the subjects may incur to repair falsified or damaged credit records, histories, or financial affairs.

6. TRAINING

a. All contractor employees and subcontractor employees requiring access to VA information and VA information systems shall complete the following before being granted access to VA information and its systems:

(1) Sign and acknowledge (either manually or electronically) understanding of and responsibilities for compliance with the Contractor Rules of Behavior relating to access to VA information and information systems;

(2) Successfully complete the VA Privacy and Information Security Awareness and Rules of Behavior training and annually complete required security/privacy training; and

(3) Successfully complete any additional cyber security or privacy training, as required for VA personnel with equivalent information system access [to be defined by the VA program official and provided to the contracting officer for inclusion in the solicitation document – e.g., any role-based information security training required in accordance with NIST Special Publication 800-16, Information Technology Security Training Requirements.]

b. The contractor shall provide to the contracting officer and/or the COR a copy of the training certificate and certification of signing the Contractor Rules of Behavior for each applicable employee within 1 week of the initiation of the contract and annually thereafter, as required.

c. Failure to complete the mandatory annual training and sign the Contractor Rules of Behavior annually, within the timeframe required, is grounds for suspension or termination of all physical or electronic access privileges and removal from work on the contract until such time as the training and documents are complete.

CONTRACTOR PERSONNEL SECURITY

a. Background Investigations and Special Agreement Checks (SAC)

(1) All contractor employees are subject to the same level of investigation as VA employees who have access to VA Sensitive Information and VA information systems. The position sensitivity for this effort has been designated as <Low> and the level of background investigation is <NACI>. This requirement is applicable to all subcontractor personnel requiring the same access.

(2) The contractor employee is required to submit all requested paperwork to appropriate VA staff for the background investigation within requested timeframe.

b. Contractor Responsibilities

(1) Background investigations from investigating agencies other than OPM are permitted if the agencies possess an OPM and Defense Security Service certification. Security and Investigations Center staff will verify the information and advise the contracting officer whether access to the computer systems can be authorized.

(2) The contractor shall prescreen all personnel requiring access to the computer systems to ensure they maintain a U.S. citizenship and are able to read, write, speak and understand the English language without the use of an interpreter.

(3) The contractor, when notified of an unfavorable determination by the Government, shall withdraw the employee from consideration from working under the contract.

(4) Failure to comply with the contractor personnel security requirements may result in termination of the contract for default.

(5) The contractor will be responsible for the actions of all individuals provided to work for the VA under this contract. In the event that damages arise from work performed by contractor provided personnel, under the auspices of this contract, the contractor will be responsible for all resources necessary to remedy the incident.

c. Government Responsibilities

(1) The VA Security and Investigations Center (07C) will provide the necessary forms to the contractor or to the contractor's employees after receiving a list of names and addresses.

(2) Upon receipt, the VA Security and Investigations Center (07C) will review the completed forms for accuracy and forward the forms to OPM to conduct the background investigation.

(3) The VA facility will pay for investigations conducted by the OPM.

(4) The VA Security and Investigations Center (07C) will notify the contracting officer and contractor after adjudicating the results of the background investigations received from OPM.

INTERNET/INTRANET

a. The contractor shall comply with Department of Veterans Affairs (VA) Directive 6102 and VA Handbook 6102 (Internet/Intranet Services).

b. VA Directive 6102 sets forth policies and responsibilities for the planning, design, maintenance support, and any other functions related to the administration of a VA Internet/Intranet Service Site or related service (hereinafter referred to as Internet). This directive applies to all organizational elements in the Department.