S02 - ATTACHMENT 1 - PWS - Application Management System - V2.2 9.26.24 UPDATED.docx

APPLICATION MANAGER

DEPARTMENT OF VETERANS AFFAIRS

Veterans Health Administration (VHA) Workforce Management and Consulting (WMC) Scholarships & Clinical Education (S&CE)

Health Professional Scholarship Program (HPSP) Application Management System (AMS) Project Management, Subscriptions, Configuration, Training and Support Services Performance Work Statement (PWS) September 26, 2024 Version 2.2

Contents

1.0 BACKGROUND

Department of Veterans Affairs (VA), Workforce Management and Consulting (WMC) and Scholarship & Clinical Education (S&CE) Program requires an Application Management System (AMS) that leverages technology to improve transparency, accountability, and agency reporting capabilities while streamlining operations for the program and program waivers. Additional benefits of automation include timeliness throughout the entire application cycle, ease of use for the customer, centralized library content for standardization and consistency, and transparent record repository to ensure record retention guidelines and audit compliance requirements are met.

The S&CE office is requesting a contractor-hosted Software as a Service (SaaS) AMS with a dedicated database for the VA to manage the Health Professionals Scholarship Program (HPSP), Visual Impairment and Orientation and Mobility Professional Scholarship Program (VIOMPSP), Specialty Education Loan Repayment Program (SELRP), Readjustment Counseling Service Scholarship Program (RCSSP), and VA- Student Trainee Experience Program (VASTEP) application process for approximately 8,000 scholarship applicants, and 300 waiver applicants annually throughout the application lifecycle. The requested web-based cloud solution must have the ability to automate the complete workflow, upload completed applications for review and manage the entire application lifecycle. S&CE is requesting AMS subscriptions, project management, configuration of VA scholarships and waivers processes, operations and maintenance, data migration, training and help desk support services.

The Department of Veterans Affairs (VA) currently manages HPSP, VIOMPSP, SELRP, RCSSP, and VASTEP applications and waivers using a contractor-developed Application Management System (AMS) along with some features currently worked outside of AMS. Programs are governed by VA Directive 1426.01 (2), Employee Incentive Scholarship Program (EISP), established by Title VIII of Public Law 105-368, Department of Veterans Affairs Health Care Personnel Incentive Act of 1998, and codified at § 7671-7675 of title 38, United States Code (U.S.C). Congress established HPSP on August 26, 1980, under Public Law (P. L.) 46-330. The original authority for HPSP expired on December 31, 1998. HPSP was re-authorized through December 31, 2014, by Section 603 of P.L. 111-163, The Caregivers and Veterans Omnibus Health Service Act of 2010, and extended through December 31, 2019, by Section 302 of P.L. 113-146, Veterans Access, Choice, and Accountability Act of 2014. HPSP was extended through December 31, 2033, by Section 301 of P.L. 115-182, The VA Mission Act of 2018. It is codified in 38 U.S.C. 7601 through 7619, 7633, 7634, and 7636. The Consolidated Appropriations Act (Strong Act) expanded the number of scholarships available to those who are pursuing degrees or training in mental health disciplines. Readjustment Counseling Service Scholarship Program (RCSSP) in 38 CFR 17.545 through 17.553 pursuant to section 502 of Public Law 116–171, the Commander John Scott Hannon Veterans Mental Health Care Improvement Act of 2019, enacted on October 17, 2020.

2.0 APPLICABLE Documents

In the performance of the tasks associated with this Performance Work Statement, the Contractor must comply with the following:

1. 44 U.S.C. § 3541, “Federal Information Security Management Act (FISMA) of 2002”

2. Federal Information Processing Standards (FIPS) Publication 140-2, “Security Requirements For Cryptographic Modules”

3. FIPS Pub 201, “Personal Identity Verification of Federal Employees and Contractors,” March 2006

4. 10 U.S.C. § 2224, "Defense Information Assurance Program"

5. Software Engineering Institute, Software Acquisition Capability Maturity Modeling (SA CMM) Level 2 procedures and processes

6. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

7. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”

8. Department of Veterans Affairs (VA) Directive 0710, “Personnel Suitability and Security Program,” May 18, 2007

9. VA Directive 6102, “Internet/Intranet Services,” July 15, 2008

10. 36 C.F.R. Part 1194 “Electronic and Information Technology Accessibility Standards,” July 1, 2003

11. OMB Circular A-130, “Management of Federal Information Resources,” November 28, 2000

12. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed Services (CHAMPUS)”

13. An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule, October 2008

14. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended by the Workforce Investment Act of 1998 (P.L. 105-220), August 7, 1998

15. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

16. VA Directive 6500, “Managing Information Security Risk: VA Information Security Program,” September 20, 2012

17. VA Handbook 6500, “Risk Management Framework for VA Information Systems – Tier 3: VA Information Security Program,” September 20, 2012

18. VA Handbook 6500.1, “Electronic Media Sanitization,” March 22, 2010

19. VA Handbook 6500.2, “Management of Data Breaches Involving Sensitive Personal Information (SPI)”, January 6, 2012

20. VA Handbook 6500.3, “Certification and Accreditation of VA Information Systems,” November 24, 2008

21. VA Handbook, 6500.5, “Incorporating Security and Privacy in System Development Lifecycle” March 22, 2010

22. VA Handbook 6500.6, “Contract Security,” March 12, 2010

23. Project Management Accountability System (PMAS) portal (reference PWS References -Technical Library at https://www.voa.va.gov/)

24. OIT ProPath Process Methodology (reference PWS References -Technical Library and ProPath Library links at https://www.voa.va.gov/) NOTE: In the event of a conflict, OIT ProPath takes precedence over other processes or methodologies.

25. Technical Reference Model (TRM) (reference at https://www.voa.va.gov/)

26. National Institute Standards and Technology (NIST) Special Publications

3.0 SCOPE

The Contractor must support The Department of Veterans Affairs (VA), Workforce Management and Consulting (WMC), Scholarships and Clinical Education (S&CE) Program Office by providing a FedRAMP-approved application/waiver management system (AMS) that has already been developed and is configurable to meet the functional requirements, the personnel and management necessary to deploy and annually maintain the AMS SaaS solution as described throughout the PWS. This includes creating templates for scholarship and waiver application requirements, tracking of scholarship recipients and waiver applicants throughout the lifecycle, customized training for all VA application managers and waiver managers, and access to an applicant base that includes all VA employees and US Citizens. The contractor must provide subscriptions and support for the AMS solution for up to 15 Global Users, 200 Manager Users, 8,000 Scholarship Applicants, and 300 Waiver Applicants annually. Software must not be downloaded onto VA computers to access the application/waiver manager solution. Also, the solution must not require any servers hosted within the VA. User specific application configuration settings are allowed in the contractor hosted solution.

The requested web-based, vendor hosted, AMS SaaS solution must automate the entire scholarship and waiver application lifecycle in compliance with HPSP, EISP, SELRP, and RCSSP Guidance Title 38 United States Code (U.S.C.) Chapter 76 - Health Professionals Educational Assistance Program and VIOMPSP Guidance Title 38 USC Chapter 75 - Visual Impairment and Orientation and Mobility Professional Educational Assistance Program. The requested application/waiver management system must demonstrate performance management efficiencies and cost savings through the automation of existing manual application/waiver acceptance/tracking processes. SC&E requests an application/waiver management system that has already been developed and is configurable to meet the following functional requirements:

3.1 The AMS SaaS solution must be FedRAMP certified to meet VA security requirements. VA Authority to Operate (ATO) and VA SSO (Single Sign On) (or ID.me) must be in progress by the start of the contract.

3.2 Project Management (PR, Document Reviews and Release) and Meeting: Contractor provides timeline of Project Management requirements after contract approval. Implementation should not exceed 30 days from the time contract is approved.

3.3 Access Configuration: The system must allow for secure communication with participants throughout the application and waiver process. Participants include all US Citizens and VA Employees.

3.3.1 System must provide for participant login through ID.me for non-VA users and Login.gov for VA users.

3.3.2 The system must be configurable to provide different levels of access:

3.3.2.1 Global Administrator(s): Overall site development and template management.

3.3.2.2 Manager User(s): Ability to manage system access based on restrictive levels of original access (i.e., facility assignment).

3.3.2.3 Participant Account(s): Participate accounts will upload, download, and review documents.

3.3.2.4 Facility Coordinator User(s): Each facility in the VA will have access to manage VASTEP application/waiver lifecycle and be limited to facility specific tasks

3.3.2.5 Program Specialist Account(s): Specific accounts to manage different aspects of the application/waiver lifecycle. These accounts include but are not limited to Financial, Program Support, Waiver, Application Reviewer, Program Manager/Director, Selection Committee Chairmen etc.

3.3.2.6 Selection Committee User(s): Users that will review, rate and rank applicants.

3.3.2.7 External Data Provider(s): Third-Party users input of application data as requested by the applicant. This includes but is not limited to Academic Verification, References, Change approvers, etc.

3.3.3 The system must provide a landing page that allows the submission of multiple scholarship types and waiver documents by applicants and participants.

3.3.4 The system must provide access to Web Services/Application Program Interfaces necessary for integration with other systems.

3.4 Application, Reports and Site Edits: The contractor is required to have flexibility in all aspects of application design, report outputs and general site look and feel.

3.4.1 Contractor must configure extensive mapping service to allow for easy navigation of services.

3.4.2 Reporting system must be User interactive and have the flexibility to adjust output in an online screen of field entries to produce a variety of outputs.

3.4.3 Instructions must be provided so users know how to complete the applications/waivers and what documents are required to be uploaded.

3.5 Master Template and Application Configuration:

3.5.1 Scholarship Applications: The contractor must configure templates for the various scholarship types and provide an online builder for S&CE to create their own templates. The system must allow for the running of multiple scholarship programs simultaneously.

3.5.2 Automated Notification: The system must provide an automated notification of submitted applications and waivers. This includes but is not limited to notice(s) to applicant(s) showing missing information, late monthly reporting, application/waiver lifecycle completion tasks, etc.

3.5.3 Post Acceptance Sections: The system must provide a tracking mechanism to follow scholarship recipients through the conclusion of the scholarship period. This includes follow up emails and additional document requirements through Residency, Placement, and during Service Obligation Period.

3.5.4 Waiver Sections: The system must provide templates for tracking waivers from consideration to decision. These templates must be creatable using an online waiver template builder.

3.5.5 The system must provide S&CE the ability to email links to access documents in accounts.

3.5.6 Search Filters: The system must provide for multi search parameters that can look at all aspects of scholarship/waiver applications that have been submitted.

3.5.7 VASTEP/HPSP Cross Promotion and Data Sharing: System must fully integrate data sharing between VASTEP and HPSP Programs to allow for a concurrent application development.

3.6 Evaluation Task Requirements:

3.6.1 Review Committees: The system must provide a mechanism to support the evaluation of applicants in multiple pools of applicants and multiple review committees.

3.6.2 Unique Scoring Rubric: The system must allow for the manipulation of scoring values for all criteria and the creation of unique rubrics.

3.6.3 Automated Scoring: The system must provide an automated application evaluation criterion that eliminates applicants based upon pre-determined criteria specific to database information.

3.7 Awards Management and Final Decisions:

3.7.1 Selection Approvals: The system must provide a mechanism to support the evaluation of applicants in multiple pools of applicants to determine and make final selection (s) from the evaluation screen showing fields that include but are not limited to Score, Annual Cost, Overall Cost, School, Available Budget, etc.

3.7.2 Electronic Signatures: The system must provide electronic signature capability on all documents.

3.8 Selection & Award Process Workflow:

3.8.1 System must provide workflow to open multiple tasks concurrently and adjust the transition to enrolled status to immediately after program director signs the formal agreement.

3.8.2 Submitted applications and waivers must go through a workflow approval process that allows the submission to be approved, denied, placed in suspension, or returned for additional information.

3.8.3 The system must provide the ability for S&CE to email links to participants, facilities, groups of individuals, and other staffing agencies to access documents created/submitted by applicants.

3.8.4 The system must provide a status "Dashboard" for applicants and recipients. Active updating status bar outlining application, selection, on-boarding, waiver, and service obligation progress. And all steps identified by the Program Manager.

3.8.5 The system will include a conclusion of the workflow process by providing communication/notification capability to the appropriate parties/end users.

3.9 Application Lifecycle:

3.9.1 The system must cover the entire scholarship Application Lifecyle. The Application lifecycle is defined as Applying, Scoring, Selecting, On-boarding, Residency, Placement, and Service Obligation Management.

3.9.2 The system must provide a function for all users to process changes using a notice of change (NOC) at various stages of the application and waiver lifecycle.

3.9.3 The system must route the NOCs for approval or denial to various levels depending on the change requested.

3.9.4 The system must provide a function to update applicable information linked or tied to other areas within the system (i.e., grad dates, school name change, Leave of Absence (LOA), Advisor changes) upon approval of the NOC.

3.9.5 System must create Placement Letter tasks after LOA is approved. Generate a letter to be reviewed and accepted by the recipient for them to acknowledge any updates to their service obligation.

3.9.6 The system must provide the ability to update the school/program if it changes during the award process and prior to enrollment in the scholarship program. Create a step in the on-boarding process that requires students to validate their school, the next semester start date, grad date, and their academic advisor and have those inputs updated to the master record.

3.9.7 The system must provide a Breach and Waiver Process to update application status, capture facts leading to a breach of contract, upload documents and a routing workflow for approvals and denials.

3.10 Information and Forms Repository:

3.10.1 The system must maintain a repository of all signed documents and forms to meet record retention and audit readiness requirements. This includes all documents from the application submission through the Service Obligation period and the breach and waiver submission process.

3.10.2 The system must provide a school list repository with editable fields to maintain school name, address, UEI, Vendor Code. Etc. To automatically populate the names, addresses, vendor ID, etc. Enter the name of a school not on the list by student or school while doing academic verification. Track attributes associated with Schools and their programs that are currently being stored outside of VA AMS for reporting and/or business logic.

3.10.3 The system must configure a comments log to capture details of interactions between the applicants/recipients and program office staff. Comments log must be accessible from all screens (applicants, applicant packets, and recipients) with a running notes tab to provide entire history of each applicant.

3.10.4 Dynamic Reporting System: The system must provide a dynamic reporting system allowing end user to choose from all application, selection, onboarding, and placement fields and across all years of data.

3.10.5 Access to an ad hoc dashboard builder and report generator to provide end users with the ability to create dashboards and reports. System data readily available to other dashboards offered by the federal government.

3.11 Financial Requirements

3.11.1 Funds/Funding Pools: The system must capture starting funding pools broken out across multiple scholarship offerings and funding sources.

3.11.2 Criteria Based Funds: The system must provide a mechanism to split and track funding across specific criteria. Example: Monthly Stipends, Tuition Semester and Courses, Fees, etc.

3.11.3 Provide workflow from vendorization of students and schools, payments of stipends and tuition from Award through completion of Service Obligation

3.11.4 Provide workflow for the SF 1034 form (Public Voucher for Purchases And Services Other Than Personal) and stage the SF 1034 in a secured folder for retrieval by VA staff outside of the program office (VA-FSC)

3.11.5 Payment Tracking: The system must provide a means of tracking stipends, fees, and tuition payments for processing into other systems, audit requests, and various reports.

3.12 Data Migration: The contractor must migrate all existing VA data from an export received from the previous contractor into the Application Management System.

3.13 The Contractor must provide Tier I, Tier II, and Tier III help desk support services. Standard help desk availability will be from 8:00am – 5:00pm ET, Monday-Friday, excluding federal holidays.

3.14 Required Training Hours: The contractor must provide up to 60 hours of virtual training in the areas of Forms, Funds, Email Templates, Reports, Review Process, Award Process and Cycle End Rollover.

3.15 At the conclusion of the contract, the Contractor must provide VA a complete export of all VA data in the AMS.

4.0 PERFROMANCE DETAILS

4.1 PERFORMANCE PERIOD

Base: One (1) year from the date of contract award.

Option 1: One (1) year from the end of base year.

Option 2: One (1) year from the end of Option 1.

Option 3: One (1) year from the end of Option 2.

Option 4: One (1) year from the end of Option 3.

Any work at the Government site must not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO).

There are eleven (11) Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, five are set by date:

If any of the holidays mentioned above falls on a Saturday, then Friday must be observed as a holiday. Similarly, if one falls on a Sunday, then Monday must be observed as a holiday.

The other six (6) are set by a day of the week and month:

4.2 PLACE OF PERFORMANCE

Tasks under this contract must be performed at the contractor’s site.

Hours of service – Contractor shall provide service during normal business hours from 8:00 a.m. to 5:00 p.m., Eastern Local Time, Monday through Friday.

4.3 TRAVEL

The Government does not anticipate any travel under this effort to perform the tasks.

5.0 SPECIFIC TASKS AND DELIVERABLES

The Contractor must perform the tasks and complete the associated deliverables as follows by the scheduled dates within the overall period of performance and in accordance with the PWS.

TASK 5.1 – SaaS SUBSCRIPTIONS (Licenses) The Contractor must provide AMS subscriptions for 15 Global Users, 200 Manager Users, 8,000 Scholarship Applicants, and 300 Waiver Applicants annually. The Contractor must provide subscriptions in the base year and for each exercised option year period. Included in the subscription includes hosting, maintenance, helpdesk, security FedRAMP and VA ATO (Authority to Operate) maintenance, system training, and Tier I, II, and III support services during core business hours.

task 5.2 – FEDRAMP, ATO (Authority to Operate) MAINTENANCE (Assessment, Authorization and Continuous Monitoring) This software must be cloud-based with a FedRAMP (SaaS FedRAMP, not just a PaaS (Platform as a Service) FedRAMP). VA ATO and VA SSO (Single Sign On) (or ID.me) must be in progress by the start of the contract. The Contractor must comply with FedRAMP requirements as mandated by Federal laws and policies, including making available any documentation and logical access needed to support this requirement. The Contractor must provide and update all artifacts necessary to obtain and maintain the ATO.

TASK 5.3 – CONFIGURATION SUPPORT

Contractor must provide ongoing configuration, testing, validation, and deployment of change requests to meet business requirements.

TASK 5.4 – TRANSITION PLAN AND SUPPORT (OPTIONAL TASK 1)

5.4.1 Transition-In Plan and Support: The contractor must develop and execute a plan for transitioning from the current AMS cloud-based software system to the contractor’s cloud-based system. The transition will include creating a branded theme, standard application templates, standard reports, and transferring all active applicants and data from the current system to the vendor’s system. The contractor must execute the plan to include initial configuration, data migration, and testing procedures necessary for deployment.

5.4.2 Transition-Out Plan and Support: The contractor shall provide transition of all knowledge and service products produced during the duration of the contract. The contractor shall provide a plan for up to 90 days of outgoing transition support for transitioning work from the current contract to a follow-on contract or other entity. This transition may be to a government entity or to another contractor or to the incumbent contractor under a new contract. In accordance with the Government-approved plan, the contractor shall assist the Government in implementing a complete transition from this contract to a new support provider. This shall include formal coordination with Government staff and successor staff and management. It shall also include delivery of copies of all artifacts delivered under this contract including all VA data, as well as existing policies and procedures, and delivery of baseline metrics and statistics.

The Contractor must provide transition support for migrating all existing VA data to the new Application Management System (AMS). The Contractor will be responsible for costs and workload of transitioning all existing VA AMS data to the awarded solution. The one-time migration of data from the legacy AMS systems must be completed within 3 months of award and before the new system deploys. In accordance with the Government-approved plan, the Contractor must assist the Government in implementing a complete AMS transition from this contract to a new support provider. This must include formal coordination with Government staff.

5.4.1 The Transition Plans shall include:

1. Coordination with Government representatives.

2. Review, evaluation, and transition of current support services.

3. Transition of historic data to a new contractor system.

4. Transfer of all necessary business and/or technical documentation.

Deliverables:

5.4A Transition Plan 5.4B Transition Support

TASK 5.5 – ADDITIONAL SUBSCRIPTIONS (OPTIONAL TASK 2)

The VA may exercise this optional task for additional subscriptions dependent on workload requirements. The specific workload requirements will be determined by the VA PM, Supervisor, COR, and business owners based on current business priorities. This optional task may be exercised as many times as needed by the VA in the base period and each option period. All deliverables in this document shall be required for the optional tasks if exercised.

Deliverables Base Year:

Option Year 1:

Option Year 2:

Option Year 3:

Option Year 4:

6.0 PERFORMANCE METRICS

The table below defines the Performance Standards and Acceptable Performance Levels for Objectives associated with all tasks outlined in this PWS.

Standard

Negative)

· Efficient and effective in meeting requirements

· Meets technical needs and mission requirements

· Offers quality services/ products

(See Note 2)

· Products completed, reviewed, delivered in timely manner

· Notifies customer in advance of potential problems, recommends solutions

(See Note 2)

· Personnel possess necessary knowledge, skills, and abilities to perform tasks

(See Note 2)

· Services/ products delivered were of desired quality

· Proactively meets government’s needs, including responding to changing requirements, systems, etc.

(See Note 2)

The Government intends to utilize a QASP consistent with the table above throughout the life of the contract to ensure that the contractor is performing the services required by this PWS in an acceptable manner. The Government reserves the right to alter or change the surveillance methods in the QASP at its own discretion. The contractor will be promptly notified when changes occur.

The Contractor must perform the tasks and complete the associated deliverables under this contract by the scheduled due dates within the overall period of performance. If the Contractor cannot deliver those deliverables specified by this contract by the required due date, then the Contractor must provide a written explanation to the Contracting Officer (CO) within one (1) business day of the deliverable due date. This written transmittal must include the reasons for the delay; when the Contractor knew or should have known a delay would incur; due diligence taken to mitigate the problems, the impact on the overall project; and a firm commitment of when the work is to be completed.

The Government will have ten (10) business days to review each deliverable and provide feedback/comments. The contractor must have five (5) business days to incorporate feedback/comments and make appropriate revisions. The contractor must provide the revised version of each deliverable to the Contracting Officer Representative (COR) and VA Program Manager (VA PM). The COR will review and determine final acceptance by the Government. The COR will notify the contractor of final acceptance within five (5) business days.

The contractor must be responsible for adhering to all pertinent VA standards including but not limited to ensuring that all documentation and deliverables are stored on appropriate VA servers within one week of their completion. The contractor must use the VA Nationwide Teleconferencing System (VANTS) for all pertinent conference calls, and the VA Exchange server for all pertinent email. Upon assignment of VA email accounts, use of external email accounts for the purpose of VA communications and business will be prohibited. The contractor must be responsible for adhering to all pertinent VA information technology policies and procedures, which will be made available at the contractor’s request on award.

Late Deliverables and/or Significant Errors or Omissions must be handled in the following manner:

Late deliverables:

a. Deliverables must be provided on the dates specified. Any changes to the delivery date must have prior approval (in writing) by the PM/CO or designate at least five business days prior to the deliverable due date

b. If the deliverable cannot be provided within the scheduled time frame, the Vendor is required to contact the Project Manager/Contract Manager in writing with a reason for the delay and the proposed revised schedule. The request for a revised schedule must include the impact on related tasks and the overall project

c. A request for a revised schedule must be reviewed and approved by the PM/CO before placed in effect. Contract Terms and Conditions may dictate penalties, costs, and other actions based on the facts related to the request for a revised schedule Note 1: Significant errors or omissions are defined as deliverables not meeting the intent of the task and the work considered to be within scope of this order.

Note 2: Continued repetitive errors may result in an unacceptable rating on performance report to be used as part of the evaluation criteria on future order competition.

Types of Surveillance:

· Random sampling: Appropriate for frequently recurring tasks. Evaluate randomly selected samples of the lot to determine the acceptability of the entire lot (random inspection guide, method of surveillance, lot size, sample size, performance requirement, sampling procedure, and inspection procedure).

· One hundred percent inspection: Appropriate for tasks that occur infrequently. Inspect and evaluate performance each time task is performed.

· Periodic surveillance: Evaluation of samples selected on other than a 100 percent or statistically random basis (such as monthly, quarterly, or semi-annually).

7.0 GENERAL REQUIREMENTS

7.1 METHOD AND DISTRIBUTION OF DELIVERABLES

The Contractor must deliver documentation in electronic format, unless otherwise directed in Section B of the solicitation/contract. Acceptable electronic media include: Microsoft Word, Microsoft Excel, Microsoft PowerPoint, Microsoft Project, Microsoft Visio and Adobe Postscript Data Format (PDF).

7.2 SECURITY AND PRIVACY REQUIREMENTS

7.2.1 POSITION/TASK RISK DESIGNATION LEVEL(S)

The position sensitivity and the level of background investigation commensurate with the required level of access for the following tasks within the Performance Work Statement are:

Position Sensitivity and Background Investigation Requirements

The Tasks identified above, and the resulting Position Sensitivity and Background Investigation requirements identify, in effect, the Background Investigation requirements for Contractor individuals, based upon the tasks the particular Contractor individual will be working. The submitted Contractor Staff Roster must indicate the required Background Investigation Level for each Contractor individual based upon the tasks the Contractor individual will be working, in accordance with their submitted proposal.

8.0 ADDENDUM A

Cyber and Information Security Requirements for VA IT Services The Contractor must ensure adequate LAN/Internet, data, information, and system security in accordance with VA standard operating procedures and standard PWS language, conditions, laws, and regulations. The Contractor’s firewall and web server must meet or exceed VA minimum requirements for security. All VA data must be protected behind an approved firewall. Any security violations or attempted violations must be reported to the VA Program Manager and VA Information Security Officer as soon as possible. The Contractor must follow all applicable VA policies and procedures governing information security, especially those that pertain to certification and accreditation.

Contractor supplied equipment, PCs of all types, equipment with hard drives, etc. for contract services must meet all security requirements that apply to Government Furnished Equipment (GFE) and Government Owned Equipment (GOE). Security Requirements include: a) VA Approved Encryption Software must be installed on all laptops or mobile devices before placed into operation, b) Bluetooth equipped devices are prohibited within VA; Bluetooth must be permanently disabled or removed from the device, c) VA approved anti-virus and firewall software, d) Equipment must meet all VA sanitization requirements and procedures before disposal. The COR, CO, the Project Manager, and the Information Security Officer (ISO) must be notified and verify all security requirements have been adhered to.

Each documented initiative under this contract incorporates VA Handbook 6500.6, “Contract Security,” March 12, 2010 by reference as though fully set forth therein. The VA Handbook 6500.6, “Contract Security” must also be included in every related agreement, contract or order. The VA Handbook 6500.6, Appendix C, is included in this document as Addendum B.

Training requirements: The Contractor must complete all mandatory training courses on the current VA training site, the VA Talent Management System (TMS), and will be tracked therein. The TMS may be accessed at https://www.tms.va.gov. If you do not have a TMS profile, go to https://www.tms.va.gov and click on the “Create New User” link on the TMS to gain access.

Contractor employees must complete a VA Systems Access Agreement if they are provided access privileges as an authorized user of the computer system of VA.

VA Enterprise Architecture Compliance The applications, supplies, and services furnished under this contract must comply with One-VA Enterprise Architecture (EA), available at http://www.ea.oit.va.gov/index.asp in force at the time of issuance of this contract, including the Program Management Plan and VA's rules, standards, and guidelines in the Technical Reference Model/Standards Profile (TRMSP). VA reserves the right to assess contract deliverables for EA compliance prior to acceptance.

VA Internet and Intranet Standards The Contractor must adhere to and comply with VA Directive 6102 and VA Handbook 6102, Internet/Intranet Services, including applicable amendments and changes, if the Contractor’s work includes managing, maintaining, establishing and presenting information on VA’s Internet/Intranet Service Sites. This pertains, but is not limited to: creating announcements; collecting information; databases to be accessed, graphics and links to external sites.

Internet/Intranet Services Directive 6102 is posted at (copy and paste the following URL to browser): http://www1.va.gov/vapubs/viewPublication.asp?Pub_ID=409&FType=2 Internet/Intranet Services Handbook 6102 is posted at (copy and paste following URL to browser): http://www1.va.gov/vapubs/viewPublication.asp?Pub_ID=410&FType=2 Section 508 – Information and Communication Technology (ICT) Accessibility Standards:

The Contractor shall comply with “508 Chapter 2: Scoping Requirements” for all electronic ICT and content delivered under this contract. Specifically, as appropriate for the technology and its functionality, the Contractor shall comply with the technical standards marked here:

· E204 Functional Performance Criteria

· E205 Electronic Content – (Accessibility Standard - WCAG 2.0 Guidelines)

· E206 Hardware Requirements

· E207 Software Requirements

· E208 Support Services and Documentation Requirements Physical Security & Safety Requirements:

The Contractor and their personnel must follow all VA policies, standard operating procedures, applicable laws and regulations while on VA property. Violations of VA regulations and policies may result in citation and disciplinary measures for persons violating the law.

1. The Contractor and their personnel must wear visible identification at all times while they are on the premises.

2. VA does not provide parking spaces at the work site; the Contractor must obtain parking at the work site if needed. It is the responsibility of the Contractor to park in the appropriate designated parking areas. VA will not invalidate or make reimbursement for parking violations of the Contractor under any conditions.

3. Smoking is prohibited inside/outside any building other than the designated smoking areas.

4. Possession of weapons is prohibited.

5. The Contractor must obtain all necessary licenses and/or permits required to perform the work, with the exception of software licenses that need to be procured from a Contractor or vendor in accordance with the requirements document. The Contractor must take all reasonable precautions necessary to protect persons and property from injury or damage during the performance of this contract.

Confidentiality and Non-Disclosure The Contractor must follow all VA rules and regulations regarding information security to prevent disclosure of sensitive information to unauthorized individuals or organizations.

The Contractor may have access to Protected Health Information (PHI) and Electronic Protected Health Information (EPHI) that is subject to protection under the regulations issued by the Department of Health and Human Services, as mandated by the Health Insurance Portability and Accountability Act of 1996 (HIPAA); 45 CFR Parts 160 and 164, Subcontracts A and E, the Standards for Privacy of Individually Identifiable Health Information (“Privacy Rule”); and 45 CFR Parts 160 and 164, Subcontracts A and C, the Security Standard (“Security Rule”). Pursuant to the Privacy and Security Rules, the Contractor must agree in writing to certain mandatory provisions regarding the use and disclosure of PHI and EPHI.

1. The Contractor will have access to some privileged and confidential materials of VA. These printed and electronic documents are for internal use only, are not to be copied or released without permission, and remain the sole property of VA. Some of these materials are protected by the Privacy Act of 1974 (revised by PL 93-5791) and Title 38. Unauthorized disclosure of Privacy Act or Title 38 covered materials is a criminal offense.

2. The VA Contracting Officer will be the sole authorized official to release in writing, any data, draft deliverables, final deliverables, or any other written or printed materials pertaining to this contract. The Contractor must release no information. Any request for information relating to this contract presented to the Contractor must be submitted to the VA Contracting Officer for response.

3. Contractor personnel recognize that in the performance of this effort, Contractor personnel may receive or have access to sensitive information, including information provided on a proprietary basis by carriers, equipment manufacturers and other private or public entities. Contractor personnel agree to safeguard such information and use the information exclusively in the performance of this contract. Contractor must follow all VA rules and regulations regarding information security to prevent disclosure of sensitive information to unauthorized individuals or organizations as enumerated in this section and elsewhere in this Contract and its subcontracts and appendices.

4. Contractor must limit access to the minimum number of personnel necessary for contract performance for all information considered sensitive or proprietary in nature. If the Contractor is uncertain of the sensitivity of any information obtained during the performance this contract, the Contractor has a responsibility to ask the VA Contracting Officer.

5. Contractor must train all of their employees involved in the performance of this contract on their roles and responsibilities for proper handling and nondisclosure of sensitive VA or proprietary information. Contractor personnel must not engage in any other action, venture or employment wherein sensitive information must be used for the profit of any party other than those furnishing the information. The sensitive information transferred, generated, transmitted, or stored herein is for VA benefit and ownership alone.

6. Contractor must maintain physical security at all facilities housing the activities performed under this contract, including any Contractor facilities according to VA-approved guidelines and directives. The Contractor must ensure that security procedures are defined and enforced to ensure all personnel who are provided access to patient data must comply with published procedures to protect the privacy and confidentiality of such information as required by VA.

7. Contractor must adhere to the following:

a. The use of “thumb drives” or any other medium for transport of information is expressly prohibited.

b. Controlled access to system and security software and documentation.

c. Recording, monitoring, and control of passwords and privileges.

d. All terminated personnel are denied physical and electronic access to all data, program listings, data processing equipment and systems.

e. VA, as well as any Contractor (or Subcontractor) systems used to support development, provide the capability to cancel immediately all access privileges and authorizations upon employee termination.

f. Contractor PM and VA PM are informed within twenty-four (24) hours of any employee termination.

g. Acquisition sensitive information must be marked "Acquisition Sensitive" and must be handled as "For Official Use Only (FOUO)".

h. Contractor does not require access to classified data.

8. Regulatory standard of conduct governs all personnel directly and indirectly involved in procurements. All personnel engaged in procurement and related activities must conduct business in a manner above reproach and, except as authorized by statute or regulation, with complete impartiality and with preferential treatment for none. The general rule is to strictly avoid any conflict of interest or even the appearance of a conflict of interest in VA/Contractor relationships.

9. VA Form 0752 must be completed by all Contractor employees working on…