Attachment 1 - Draft SOW Dated 03-20-2026 - OICM Services.pdf

STATEMENT OF WORK (SOW)

Office of Investigations Case Management (OICM) Services

Department of Veterans Affairs Office of Inspector General (VA OIG) Office of Investigations

Dated: March 20, 2026

Title and Scope The Department of Veterans Affairs (VA) Office of the Inspector General (OIG) Office of Investigations (OI) requires a commercial off-the-shelf (COTS) solution to provide OICMS Services and services related to its installation. The new COTS system will be OI system of record and will technically modernize and replace parts of the VA OIG Enterprise Management System (EMS) and transition OI from paper case files to electronic case files.

The COTS solution shall allow OI employees to create, maintain, retrieve, and manage all data related to investigations; generate investigative and statistical reports based on that data; the Contractor shall provide services that allow for configuration and customization to OI’s business processes, and user roles.

Background The mission of the VA OIG Office of Investigations (OI) is to investigate potential crimes and civil violations of law involving VA programs and operations committed by VA employees, Contractors, beneficiaries, and other individuals. These investigations focus on a wide range of matters including healthcare, procurement, benefits, construction, and other fraud; cybercrime and identity theft; bribery and embezzlement; drug offenses; and violent crimes.

OI is staffed by special agents with full law enforcement authority, forensic auditors, and other professionals. OI staff use data analytics, cyber-tools, covert operations, and other strategies to detect and address conduct that poses a threat to or has harmed veterans or other beneficiaries and VA personnel, programs, operations, and property. Through criminal prosecutions and civil monetary recoveries, OI’s investigations promote integrity, patient safety, efficiency, and accountability within VA.

OI is also responsible for conducting personnel security and suitability background investigations.

The OIG has an existing case management system called the Enterprise Management System (EMS), which is a .NET application using Structured Query Language (SQL). EMS consists of customized applications to maintain information pertaining to investigations, hotline allegations, and congressional and public affairs inquiries. However, EMS is not adequate for the future. For example, the user interface and system integration are not optimized for streamlined investigative case management.

Objectives

1. The Contractor shall provide a commercial off-the-shelf (COTS) investigative case management system to technically modernize OI’s current investigative case management system. The Contractor shall:

a. Deliver software licensing containing the features needed to meet the requirements outlined in the Performance Work Statement (SOW).

b. Deliver a COTS investigative case management system no later than (NLT) 12 months from the date of contract award that includes all identified existing case data successfully migrated from the existing case management system.

2. The Contractor shall provide services for the COTS investigative case management system to meet OI requirements. The Contractor shall:

a. Provide documentation, installation, configuration, deployment, maintenance support, and training to successfully implement a new case management system.

b. Deliver services to successfully migrate data from OI’s existing case management system into the COTS solution in accordance with the Technical Requirements outlined in the SOW.

c. Provide technical and customer support to OI as required in the SOW.

Technical Requirements

1. COTS Investigative Case Management System

a. The Contractor shall provide a commercial off-the-shelf (COTS) investigative case management system to replace and technically modernize OI’s current investigative case management system. This includes providing software licensing necessary for OI to fully utilize the new case management system.

i. This system shall have a highly configurable interface that allows users to customize design elements (e.g., labels, drop menus, dashboards, etc.).

ii. This system shall have the ability for system administrators to set the global policy for user interface configuration and allow individual users to configure their own personal settings.

iii. The case management system shall be a single inclusive, scalable case management system to record, track, and display accurate and current information on OI investigations (e.g., the system should display up-to-date information on investigative activities, evidence, judicial results, and case information for the OI).

iv. The case management system shall provide capabilities for document management, workflow and reporting, contact/referral intake, evidence management, and case tracking to include a capability to track and document personnel time spent on these activities.

b. The Contractor shall deliver a case management system that contains the following core capabilities (at a minimum):

i. Logical access controls and management with advanced role-based internal controls to protect sensitive data including, but not limited to, internal affairs investigations, undercover and confidential sources, grand jury material, etc.

ii. Investigation case management that is customizable and configurable, including the ability to open investigations, make referrals, conduct case reviews, close, and track results with current or future machine learning features.

iii. Configurable bi-directional workflows and approval levels (one-to-one and one-to-many).

iv. Visible audit trails to record system activity at the individual user level with date and time stamps. Activities include, but are not limited to searches, case access, and changes made to contacts, cases, and system.

v. Capability to generate templated and/or customizable letters/emails containing auto-filled information from any data field in the system; capability to sign and print the letters, save as PDF, and directly send with email.

vi. Employee roles/actions, associated with contacts and cases, will be retained as part of the record regardless of an employee’s change in status (transferred, retired, etc.).

vii. Customizable, ad-hoc, and pre-built reports that include but are not limited to investigative statistics and data points specific to OIG’s oversight work. Recurring reports, for instance, are required by the Inspector General Act, the Attorney General Guidelines, and the Council of the Inspectors General on Integrity and Efficiency (CIGIE). Customizable reports, for instance, include number of cases opened, number of hours spent on investigations, counts of types of cases, counts of prosecutions, counts of operations, slicing of this data per organizational unit or division).

viii. Ability to create sub-modules or sub-case environments for specialized elements or support groups to receive, display, and distribute information, track incoming requests, and organize the compartmentalized information. These sub-modules shall have the ability to connect cases or information to the main case management system.

ix. Advanced search of new and legacy files (including text, documents, files, and data fields) with drill-down capability, Soundex-like capability, and typo tolerance.

x. Internal (within OIG) support services request feature with the ability to generate and request support tickets including, but not limited to, analytical, technical operations, subpoenas, and desk office support.

xi. Report automation allowing for auto-filled information from any data field in the system (case activity notes, synopsis, etc.), attachment of documents, and other exhibits related to the case. Also allow for attachments or other records in the case to be linked to a generated report for simple reference and review.

xii. Investigation activity and technique management to include IG subpoena generator, overt and covert law enforcement operations planning, consensual/electronic monitoring requests and result reporting, and other law enforcement specific investigative activities and techniques.

xiii. Undercover and confidential source documentation capability, to include contact information separate from general system contacts/entities.

xiv. IG subpoena generator and management that builds, prints to PDF, links to specific case file, and tracks IG subpoenas. This includes a database of frequent or previously entities who were issued IG subpoenas with the ability to update address/contact information.

xv. The system should be URL addressable and allow for keys to be passed into the web application such that a specific record, profile, or case can be rendered.

The URL strings shall not include PII. URL addressing shall not allow for bypass or override of access controls including but not limited to search.

xvi. Tracking time associated with investigations and investigative activity, law enforcement availability pay (LEAP) hours, training hours, physical fitness hours, and other direct and indirect time.

xvii. Record input, retention, queries and report generation for employee certifications, training records, assigned law enforcement equipment, etc.

xviii. Tracking and reporting for government vehicles, including vehicle inventory, including those assigned by region and agent; vehicle mileage (with capability to specify usage amount and purpose, including home-to-work); vehicle maintenance, accident, and safety information.

xix. Evidence management within the investigative case file with barcoding and multi-site capabilities. Web or app-based access for evidence collection and logging using barcodes generated by the system, to identify individual items of evidence.

Ability to use VA OIG issued smartphones to scan barcodes for inventory purposes. Barcodes will be formatted to use existing government hardware with the ability to print on commercially available labels.

xx. Data migration, integration, and interoperability with existing OIG, VA, and external applications via application programming interface (API) and other means.

xxi. Print, export, and download capability for all cases for legal discovery and archiving. This capability should include selecting documents or the entire file in a consumable format.

xxii. Ability to upload document and media files that exists in electronic digital images, audio, and video formats. Within attachments, the ability to tag images, audio files, and video files with associated cases and keywords, and the creation of hash values associated with all electronic files. The system shall support file uploads up to 10GB per file to ensure adequate data transmission and storage capacity.

xxiii. Ability to scan and load documents into the system with optical character recognition (OCR).

xxiv. Mobile-friendly interfaces via mobile application that allows users to access work, search within the case management system, and upload files to specific cases or folders.

xxv. Automatic name check deconfliction to ensure no duplication of entities both upon search and entry.

xxvi. Provide an optimized database that fully supports advanced visualization of dashboards, reporting, and data analysis.

1. Provide users with link analysis functionality that can be automatically and manually created.

2. Includes geospatial analysis and map tools that can be searched, filtered, and marked up.

3. Provide the ability to send/transmit email, mobile application, or web application alerts. Alert settings should be customizable by the individual user and include but not limited to case statuses, due dates, new assignments, document corrections, and approval notices.

4. Provides the ability to create timelines from various data points or information sets within the case management system.

5. Customizable dashboards that provide the ability for all users to display information captured and related to their investigations.

xxvii. Ability to track eDiscovery, digital forensics, and technical operation media volume and statistics in support of investigations (e.g., a primary case owner’s request for assistance requires response from support personnel; the system should be able to track this support activity, which could include, for instance, forensic analysis of 1000 bank records, forensic examination of data, or forensic computer analysis).

xxviii. Ability to enter and maintain investigative notes.

xxix. Ability to integrate internal VA and VA OIG records and data, including, but not limited to, employee master file, to automatically populate specified fields.

xxx. Ability to provide licenses to users outside of the organization for case information, documents, or data reviewing within the case management system.

xxxi. Ability to scale to and/or incorporate artificial intelligence (AI) capabilities throughout the case management system.

c. The new COTS investigative case management system shall offer comprehensive API endpoints that deliver data in standard formats like JavaScript Object Notation (JSON) to facilitate direct backend database access to optimize performance and flexibility.

d. The Contractor shall provide data storage capabilities with at least 10 TB of storage capacity. This includes, but is not limited to, the ability to scale dynamically to accommodate increases in data volume, ensuring continuous availability and optimal performance without interruptions due to storage constraints.

e. The Contractor shall provide a system that allows web form integration/functionality, dashboard and notifications, task assignment, contact data recording, workflow and routing, referrals and tracking, and reporting, to include, but not limited to, the detailed list of requirements shown SOW section 1.b.

i. For example, the system should have the ability to automatically generate documents using defined templates and populate with selected information from the database; generate alerts related to events or any user definition and accommodate many searchable data fields.

2. COTS Investigative Case Management Services

a. The Contractor shall provide services for the successful implementation, configuration, and data migration of the new COTS investigative case management system to meet OI requirements.

i. Implementation and Configuration

1. The Contractor shall configure the system for maximum interoperability across VA OIG offices to ensure flexibility in exchanging information/integration with OIG’s existing applications and reporting tools (e.g., eCase, Genesys, Teammate, FOIA Xpress, and the Microsoft 365 suite, etc.) and third-party tools including at a minimum Microsoft Power BI and Dynamics, and Tableau. This interoperability shall incorporate the use of an open systems standards-based solution which addresses net-centric objectives (including continuity of operations, back-up, and recovery).

2. The Contractor shall provide a configuration plan that outlines the steps that will be taken to configure the software to OIG’s specifications including (but not limited to):

a. setting up rules and policies

b. customizing access and user or group security roles and associated rights

c. developing and implementing any specific global/universal terminology

d. developing and implementing project templates

e. setting up groups for access to project data and information

f. generating customized dashboard views for project and overall

OIG

g. performance tracking and configuring all custom fields available within the software

h. The Contractor shall provide a configuration control document capturing all baseline system configurations as well as configuration change logs

i. The Contractor shall provide a Configuration Management tool to track changes and software release deployment.

3. The Contractor shall provide staging environments for the COTS case management system, to include but is not limited to Development, Pre- Production, and Quality Assurance. The Contractor shall provide VA OIG access to these environments as part of this effort. Validation and verification actions will occur in one or a combination of these environments before VA OIG approves the solution to be deployed to the Production environment. VA OIG’s validation and verification does not relieve the Contractor of its responsibility to comply will all requirements under the Contract.

4. The Contractor shall provide an implementation plan that outlines the business cases, steps, and timeframes that will be followed for all phases of software implementation and data migration. The implementation plan will include (but is not limited to) implementation of working discussions, installing software and maintenance updates, user access, system security, and delivery of software.

5. The Contractor shall provide integrated control documentation that includes, but is not limited to, up-to-date details on data mapping and procedures for real- or near-real-time data exchange between the product and the existing OIG case management system. The integrated control documentation shall also include, but is not limited to:

a. The Contractor shall provide an automated notification process regarding changes to any data elements.

b. The Contractor shall establish a baseline integrated control document (ICD) to include all required data elements to other OIG systems.

ii. System Access

1. The Contractor shall configure and implement user rights, permissions, and access to system records. These activities include ensuring the case management system has the following capabilities:

a. Capability to manage access controls, including read-only viewing, for each directorate by either group or individual. For example, the OI directorate must have the ability to grant an OIG employee outside of the OI read-only access to a case file after executive leader approval.

b. Ability for investigative staff to have remote or mobile utilization to the solution via a Government furnished smart phone or other device.

2. The Contractor shall provide uninterrupted and unrestricted access to the data 24 hours a day, seven (7) days a week. The access shall be free from artificial constraints such as rate limits, throttling, or other access restrictions that could impede data use.

iii. Data Migration

1. The Contractor shall deliver services to successfully migrate data from

OI’s existing case management system into the COTS solution. This includes all existing data in OI’s current investigative case management system that shall be successfully imported, validated, and certified into the new system format.

2. The Contractor shall successfully migrate identified existing case data from the existing casement system into the COTS solution before the COTS solution is live in the Production environment.

3. The Contractor shall provide OIG with a data migration plan with strategy for conducting and analyzing the existing data, workflows, permissions, and other aspects within the legacy EMS system. The plan and analysis provided to OIG shall include, but is not limited to ICD, data dictionary for the COTS case management system, schema, source-to-target mapping, and similar artifacts that show the planned migration between systems along with identifying any data fields, storage objects, etc. that may be at risk. The migration plan shall include a crosswalk from OI’s current investigative case management system to the new case management system to ensure data is migrated to the appropriate location within the new system. The migrated data shall adhere to the advanced search requirements documented in the Technical Requirements section (above).

4. The Contractor shall provide up-to-date detailed information describing the contents, format, and structure of the case management database and the relationship between its elements of the product throughout the life cycle of the product. This information shall be documented in a Data Dictionary.

b. The Contractor shall assist the OI in implementing business rules, data mapping, and processes to support information workflows and business process efficiencies based upon the new COTS investigative case management system. This ties to training OI in new business processes based on how the system works.

Non-Technical Requirements

1. 508 Compliance

a. The Industry Partner shall support the Government in its compliance with Section 508 throughout the development and implementation of the work to be performed. Section 508 of the Rehabilitation Act of 1973, as amended (29 U.S.C. § 794d) requires that when Federal agencies develop, procure, maintain, or use electronic information technology, Federal employees with disabilities have access to and use of information and data that is comparable to the access and use by Federal employees who do not have disabilities, unless an undue burden would be imposed on the agency. Section 508 also requires that individuals with disabilities, who are members of the public seeking information or services from a Federal agency, have access to and use of information and data that is comparable to that provided to the public who are not individuals with disabilities, unless an undue burden would be imposed on the agency. Applicable standards are 36 C.F.R §§1194.21-1194-26.

b. The Contractor should review the following websites for additional 508 information:

i. http://www.section508.gov/index.cfm?FuseAction=Content&ID=12

ii. http://www.access-board.gov/508.htm http://www.w3.org/WAI/Resources

c. The Contractor must indicate in its proposal where full details of compliance to the identified standards can be found, such as Contractor’s website, etc.

2. Security Compliance

a. The Contractor shall provide a system that is compliant with all applicable Federal security, privacy, technical, and functional directives.

b. The Contractor shall provide a solution that is capable of being deployed in at least one

(1) of the following methods in accordance with the requirements of OMB Memorandum 24-15:

i. FedRAMP Authorized Solution - The Contractor's solution is fully FedRAMP authorized as evidenced by an active FedRAMP Authority to Operate (ATO). The Contractor’s solution must be able to be implemented at a FedRAMP Impact Level of Moderate or higher with the capability of adding security control overlays as defined by NIST, if needed, and maintain compliance with FedRAMP requirements throughout the period of performance, or;

ii. Deployment on Single Agency Private Cloud - The Contractor is fully capable of deploying the solution on a customer-provided, single-agency private cloud.

The solution must comply with all applicable security and performance standards, including those outlined in the agency's security policies, FISMA Law, NIST guidance and standards, and OMB mandates.

c. The solution shall support data-at-rest (DAR) and data-in-transit (DIT) encryption using FIPS 140-2 or 140-3 certified cryptomodules as certified by https://csrc.nist.gov/projects/cryptographic- module-validation-program/validated-modules. This encryption requirement also applies to mobile applications. Additionally, some mobile applications require registration through the VA Mobile Device Management (MDM), which any application must satisfy, as required by Executive Order

(EO) 14028.

d. The solution shall adhere to Homeland Security Presidential Directive 12: Policy for a Common Identification Standard for Federal Employees and Contractors (HSPD-12) compliance.

e. The Contractor shall ensure that the solution provides the capability for OI to specify particular records retention periods in a no-code environment. This functionality shall exist in a case, issue, or document basis, which may be time-based or permanent.

Records retention capability is needed for statutory and regulatory records requirements (e.g., from the National Archives and Records Administration, Department of Homeland Security, and Cybersecurity and Infrastructure Security Agency), along with litigation holds and Freedom of Information Act requests.

f. Logging shall meet or exceed OMB M-21-31 Event Logging 3 requirements including “cloud storage” requirements. OIG may determine whether to allow lower compliance, but the solution must meet at least Event Logging 2 requirements. OIG may specify other logging requirements including but not limited to Certified Information Systems Auditor (CISA) Emergency Directive or OIG incident response requirements. Contractor must presume that all logging requirements for the solution must be fulfilled by the cloud solution.

3. General Requirements

a. The Contractor shall provide a solution that supports modern browser standards for

Microsoft Edge, Google Chrome, and Safari.

b. If using a web browser, the solution shall use Hypertext Transfer Protocol Secure

(HTTPS) on port 443 for all information transmission. The solution shall comply with Federal TLS requirements and any other technical requirements specified by OIG.

c. The solution shall be certified as compatible with the latest applicable Microsoft Operating System (OS).

d. The Contractor shall support the solution being added to the VA OIG inventory system.

e. The solution shall be capable of single sign-on (SSO) using VA-issued PIV cards and credentials generated by the VA Entra ID (Active Directory) identity and access management tenant as required by HSPD-12 (Homeland Security Presidential Directive 12: Policy for a Common Identification Standard for Federal Employees and Contractors).

f. The Contractor shall ensure the solution meets the following metrics:

i. Supports initial userbase of 325 concurrent users across Investigations and other

OIG offices with the ability to be scalable to meet an increased user base.

ii. Database must be compatible with Microsoft Windows Server 2019 or higher and Microsoft SQL Server 2019 or higher.

iii. COTS product (when operational) is available to users with 99.9% uptime.

iv. Once an employee (account) is associated with an action in a contact/case, that user association must remain indefinitely even if the employee departs OIG, and the associated Active Directory account is deleted/disabled.

v. The solution shall have the capability to run reports on user account activity including, but not limited to, logon to the solution and access to individual case files.

4. Testing

a. The Contractor shall provide a detailed test management plan (TMP) that describes the objectives, resources, and processes for successfully testing the COTS solution. The TMP shall also include (but is not limited to) entrance and exit criteria, a Requirements Traceability Matrix, Test Case/Procedure, Test Scripts, Test Schedule, and Test Reports.

Other Requirements

1. Onboarding Support

a. Onboarding support shall have a period of performance (PoP) of three (3) months from the date of contract award. At the conclusion of the PoP, all Contractor staff shall be successfully onboarded to support this effort. The Contractor shall manage the onboarding process for VA OIG access and individual system/environment access for all Contractor staff support this effort. The Contractor shall collect signed rules of behavior documents, signed non-disclosure documents, training certificates, and other onboarding related information. The Contractor shall provide the files and information outlined in the Security Annex for this effort. The Contractor shall monitor the submission of the artifacts and follow up with Contractors to ensure that all artifacts submitted are complete and correct. The Contractor shall also track VA OIG system access requests, for assigned projects, to completion. The Contractor shall document all findings in the Daily Onboarding Status Report.

2. Contract Kickoff

a. A contract kickoff meeting shall be held within 5 business days after award. The

Contractor shall coordinate the date, time, and location (can be virtual) with the Contracting Officer (CO), the VA OIG PM, and the COR. The Contractor shall provide a draft agenda to the CO and VA PM at least two (2) business days prior to the meeting.

Upon Government approval of the final agenda, the Contractor shall distribute to all meeting attendees.

b. During the contract kickoff meeting, the Contractor shall present an overview of the intended approach, work plan, project team, and applicable contact information for each effort via a Microsoft Office PowerPoint presentation.

3. Technical Kickoff

a. A technical kickoff meeting shall be held within 5 business days after award. The

Contractor shall coordinate the date, time, and location (can be virtual) with the CO, the VA OIG PM, and the COR. The Contractor shall provide a draft agenda to the CO and VA PM at least three (3) business days prior to the meeting. Upon Government approval of the final agenda, the Contractor shall distribute to all meeting attendees.

b. During the technical kickoff-meeting, the Contractor shall present, for review and approval by the Government, the details of the intended approach, work plan, and project schedule for each effort via a Microsoft Office PowerPoint presentation. At the conclusion of the meeting, the Contractor shall update the presentation with a final slide entitled “Summary Report” which shall include notes on any major issues, agreements, or disagreements discussed during the kickoff meeting. The Contractor shall submit the final updated presentation to the COR for review and approval within three (3) business days after the meeting. The Contractor shall obtain concurrence from the COR on the content of the meeting minutes prior to distribution of the document.

4. Project/Schedule Management

a. The Contractor shall provide a weekly status report detailing the current activities of the project. At a minimum, the weekly status report shall include weekly activity status, risks, issues/concerns, and a high-level milestone schedule of upcoming key events.

b. The Contractor shall develop and maintain schedule(s) detailing critical activities, tasks, and milestones. At a minimum, the schedule(s) shall detail the schedule baseline, interdependencies amongst tasks, key project milestones, estimated time to completion, critical path tasks, resource accountability and resource schedules.

c. The Contractor shall provide a project management plan with detailed analysis and milestones for testing, risk management, training, licensing, and deploying the system to support structured change process for future updates to the system.

5. Technical and Customer Support

a. The Contractor shall, upon OIG acceptance of the final configured software, provide software maintenance and customer support services. Any applicable customer support access code or number will be provided to allow access to submit support requests. It is expected that a transition to support meeting should take place to ensure OIG designated representatives have knowledge of the support process. The customer Support Agreement (SA) shall include, but not be limited to, the following support requirements:

i. Technical and customer support from the Contractor at a minimum during core business hours between 8am to 6pm Eastern Time, Monday through Friday.

ii. The Contractor shall support emergency technical and customer support requests outside normal business hours.

iii. If Contractor is directly supporting the operation and maintenance of the solution, then the Contractor shall offer at least one tier of service that meets or exceeds 95% availability during Contractor-specified normal business hours of support.

iv. The Contractor shall offer a support service tier that includes a dedicated account manager.

v. The solution shall provide the capability to capture and raise application events and security access attempts and send electronic notifications for identifying, submitting, and tracking incidents.

vi. The solution shall have a documented Contractor commitment to be at least five years away from end of life and shall have at least five years of customer support available.

vii. The Contractor shall provide, at no additional cost, and in within one business day of completing the software release schedule, a scheduled software release cycle for software updates to provide major releases, service pack releases, and vulnerability remediation patches / hotfixes.

viii. Contractor’s technical and customer support websites/portals will be hosted in the United States of America.

ix. The Contractor shall provide live Help Desk support during the work hours of 8:00am to 6:00pm Eastern Standard Time (EST) Monday through Friday.

x. The Contractor shall provide a self-service customer portal for identifying, submitting, and tracking issues.

6. Knowledge Transfer and Training

a. The Contractor shall provide guidance, comprehensive knowledge transfer, and personnel training on the new COTS investigative case management system.

i. Knowledge Articles - The Contractor shall develop a knowledge based (or more specific role focused) articles containing details agreed upon during the technical kickoff meeting.

b. Training Materials

i. The Contractor shall provide all materials to include, but not limited, recordings, slides and handouts that will be used during training sessions for review by the OIG prior to the first training session.

c. Training Sessions

i. The Contractor shall provide (virtual/in-person/hybrid) user training on the new

COTS investigative case management system. The specific training session content and types of training sessions will be agreed upon as part of the technical kickoff meeting.

Contract Type The Government anticipates issuing a Firm-Fixed Price (FFP) type contract.

Administration All communication related to any contract issues or changes should be communicated to the designated OIG COR for the contract.

Place of Performance Most work will be performed at the Government’s location. Additional work will be performed at Contractor sites. Remote Contractor work may be allowed by the COR. All remote Contractor work will be approved in writing by the COR prior to that work being performed.

The Contractor may be required by VA OIG to travel to one or more of VA OIG field offices. The Contractor will submit travel requests no less than 10 calendar days prior to expected travel to VA OIG COR, who will review. Upon written approval, the Contractor may be reimbursed. (Note: All travel is reimbursed in accordance with Federal Travel Regulations.) Travel vouchers will be submitted by the Contractor no later than three business days after the travel by the contracted personnel has returned from travel.

Period of Performance The Government anticipates that the period of performance will be for one (1) twelve (12) month Base Period, and four (4) twelve (12) month Option Periods.

Quality Assurance The Government shall evaluate the Contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Plan (QASP). This plan is primarily focused on what the Government must do to ensure that the Contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s). The QASP shall be shared with the Contractor after award. VA OIG’s evaluation of the Contractor’s performance does not relieve the Contractor of its responsibility to comply will all requirements under the Contract.

Deliverables / Delivery Schedule No. DELIVERABLE TITLE Format of

Deliverable Timeline/Deadline Acceptance

Criteria

VA OIG POC

1 COTS Investigative Case Management System

Product Due no later than (NLT) 12 months from the date of contract award

Not accepted unless written approval is received from the

COR

Contracting Officer Representative (COR), Contracting Officer (CO)

2 Implementation and Configuration

Services Due as agreed upon at the Technical Kickoff meeting.

Not accepted unless written approval is received from the

COR

Contracting Officer Representative (COR), Contracting Officer (CO)

3 Configuration Plan Document Due as agreed upon at the Technical Kickoff meeting.

Not accepted unless written approval is received from the

COR

Contracting Officer Representative

(COR)

4 Configuration Control Document (CCD)

Document Due as agreed upon at the Technical Kickoff meeting.

Not accepted unless written approval is received from the

COR

Contracting Officer Representative

(COR)

5 Configuration Management Tool

Product Due as agreed upon at the Technical Kickoff meeting.

Not accepted unless written approval is received from the

COR

Contracting Officer Representative

(COR)

6 Implementation Plan Document Due as agreed upon at the Technical Kickoff meeting.

Not accepted unless written approval is received from the

COR

Contracting Officer Representative

(COR)

7 Integrated Control Documentation

Document(s) Due as agreed upon at the

Not accepted unless written approval is

Contracting Officer Representative

(COR)

Technical Kickoff meeting.

received from the

COR

8 Data Migration Services Due as agreed upon at the Technical Kickoff meeting.

Not accepted unless written approval is received from the

COR

Contracting Officer Representative

(COR)

9 Data Migration Plan Document(s) Due as agreed upon at the Technical Kickoff meeting.

Not accepted unless written approval is received from the

COR

Contracting Officer Representative

(COR)

10 Business Rules and Data Mapping

Services Due as agreed upon at the Technical Kickoff meeting.

Not accepted unless written approval is received from the

COR

Contracting Officer Representative

(COR)

11 Test Management Plan

(TMP)

Document Due as agreed upon at the Technical Kickoff meeting.

Not accepted unless written approval is received from the

COR

Contracting Officer Representative

(COR)

12 Daily Onboarding Status Report

Document Daily (COB every weekday)

Not accepted unless written approval is received from the

COR

Contracting Officer Representative

(COR)

13 Contract Kickoff Meeting Meeting/Document Due 5 business days from contract award.

Not accepted unless written approval is received from the

COR

Contracting Officer Representative

Technical Kickoff Meeting Meeting/Document Due 5 business days from contract award.

Not accepted unless written approval is received from the

COR

Contracting Officer

15 Weekly Status Report Document (MS Word document)

Weekly (COB every Friday)

Not accepted unless written approval is received from the

COR

Contracting Officer Representative

(COR)

16 Project Schedule MS Project or other similar Project Management tool detailing the schedule, milestones, dependencies, critical path, etc.

Due 5 business days from contract award.

Not accepted unless written approval is received from the

COR

Contracting Officer Representative

(COR)

17 Project Management Plan

(PMP)

Document Due as agreed upon at the Technical Kickoff meeting.

Not accepted unless written approval is received from the

COR

Contracting Officer Representative

(COR)

18 Support Agreement Document Due as agreed upon at the Technical Kickoff meeting.

Not accepted unless written approval is received from the

COR

Contracting Officer Representative

(COR)

19 Knowledge Articles Document (as agreed upon at the Technical Kickoff meeting).

Due as agreed upon at the Technical Kickoff meeting.

Not accepted unless written approval is received from the

COR

Contracting Officer Representative

(COR)

20 Training Materials Document and other media (as agreed upon at the Technical Kickoff meeting).

Due as agreed upon at the Technical Kickoff meeting.

Not accepted unless written approval is received from the

COR

Contracting Officer Representative

(COR)

21 Training Sessions Service (as agreed upon at the Technical Kickoff meeting).

Due as agreed upon at the Technical Kickoff meeting.

Not accepted unless written approval is

Contracting Officer received from the

COR

22 A&A Documentation Document Due as agreed upon at the Technical Kickoff meeting.

Not accepted unless written approval is received from the

COR

Contracting Officer

Security Annex

1. Definitions and Confidentiality / Nondisclosure

A. Key Definitions

1. Information means: “any communication or representation of knowledge such as facts, data, or opinions in any medium or form, including textual, numerical, graphic, cartographic, narrative, electronic, or audiovisual forms.” [Office of Management and Budget (OMB) Circular A-130 § 10]

2. VA information means: information provided by VA OIG or other VA organizations.

3. Sensitive information means: “any VA information that would not be released to the public by VA OIG under the Freedom of Information Act.” [OIG GM Directive 335, Revision 2, Appendix A § 1a]

4. Personally identifiable information (PII) means: “information that can be used to distinguish or trace an individual’s identity, either alone or when combined with other information that is linked or linkable to a specific individual. Because there are many different types of information that can be used to distinguish or trace an individual’s identity, the term PII is necessarily broad. To determine whether information is PII, the agency shall perform an assessment of the specific risk that an individual can be identified using the information with other information that is linked or linkable to the individual. In performing this assessment, it is important to recognize that information that is not PII can become PII whenever additional information becomes available – in any medium and from any source – that would make it possible to identify an individual.” [OMB M-17-12 § III-B]

5. Record means: “all recorded information, regardless of form or characteristics, made or received by a Federal agency under Federal law or in connection with the transaction of public business and preserved or appropriate for preservation by that agency or its legitimate successor as evidence of the organization, functions, policies, decisions, procedures, operations, or other activities of the United States Government or because of the informational value of data in them” [44 U.S.C. § 3301]

6. System of records means: “a group of any records under the control of any agency from which information is retrieved by the name of the individual or by some identifying number, symbol, or other identifying particular assigned to the individual” [5 U.S.C. § 552a]

7. Information system means: “a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information” [44 U.S.C. § 3502]

8. Information resources means: “information and related resources such as personnel, equipment, funds, and information technology” [44 U.S.C. § 3502]

9. VA system means: any automated data processing component serviced or maintained by VA, either connected or stand-alone.

10. Breach means: “the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where (a) a person other than an authorized user accesses or potentially accesses personally identifiable information or (b) an authorized user accesses or potentially accesses personally identifiable information for an other-than-authorized purpose” [OMB M-17-12 § III-C]

B. Confidentiality and Nondisclosure

Contractor acknowledges, understands, and accepts the following:

1. Presumption of sensitivity: Contractor shall presume that all VA information and information systems accessed while performing work under this contract are sensitive and must be protected as outlined in this Security Annex.

2. VA OIG property: Any VA information, software, applications, information systems and hardware accessed by Contractor in the performance of work under the contract remain the sole property of OIG.

3. Copyrights: To the extent that any software or applications on the VA information systems are protected by copyright, Contractor will not copy or disclose them without first obtaining OIG’s prior written authorization, which will be provided only where authorized under applicable copyright law.

4. Need to know basis: Contractor will access, or be provided access to, the VA information, software, applications, information systems and hardware only to the extent necessary, and only for performing the work required under the contract. Contractor will take reasonable steps to ensure that it will allow only those Contractor personnel who need to see the VA materials to perform their work requirements have access. This paragraph also applies to any other VA information systems or information to which Contractor may have access to or which may be disclosed to Contractor.

5. Restricted access: Contractor shall not authorize anyone other than those Contractor personnel who require the information to perform work under the contract to access, disclose, modify, or destroy the information, software or applications on the VA information systems provided or accessed under the contract without OIG’s prior written authorization.

To the extent permitted by law, Contractor will refer all requests or demands for production of or access to VA information and information systems, including court orders, to the OIG COR for response.

6. Restrictions on copies: Except as authorized under the contract, Contractor shall not make any copies of any VA information provided to Contractor by OIG, including software or applications that are not copyrighted. Any authorized copies made by Contractor shall be identified as OIG information and protected as outlined in this Security Annex.

7. Recording, sensitivity, and disclosure of VA information: Except to the extent necessary to perform the work under the contract, any information that Contractor learns from and about VA and OIG information and information systems shall not be recorded and such information, whether recorded or not, shall be protected as outlined in this Security Annex.

Contractor may not use or disclose this information except as Contractor is permitted to use or disclose under the User Agreement/Rules of Behavior and the Nondisclosure Agreement executed in accordance with this contract.

8. OIG Access to Information: Contractor will provide access to all information obtained or generated under the contract to OIG employees as designated by the OIG COR.

9. Retention and return of information, software and equipment: Upon completion or termination of the contract for any reason, Contractor shall as soon as practicable, deliver all non-public (that is, not open to, shared with or otherwise made available to the public) VA information, copies made of VA information, software and equipment, in its possession, to OIG. Contractor shall not retain any copies of any VA sensitive/non-public information, software, or equipment unless authorized by the OIG COR or by the OIG Information Security Division (ISD-53I).

10. Restricted disclosure: Disclosure of VA information to persons other than in the performance of the contract is authorized in only two situations: (a) pursuant to an order of a court of competent jurisdiction; or (b) with OIG’s prior written authorization. Prior to any disclosure pursuant to a court order, Contractor shall promptly notify OIG and provide OIG with a copy by fax or email, whichever is faster, and notify by telephone the OIG COR in advance that it will be receiving such notices. The notice under this provision will include the following information to the extent that Contractor knows it, if it does not show on the face of the court order: the records to be disclosed pursuant to the order, to whom, where and when, for what purpose, and any other information that Contractor reasonably believes is relevant to the disclosure. To clarify this requirement, Contractor shall not disclose any VA information without prior consent from OIG.

11. Notifications of unauthorized actions: Contractor shall promptly, within one hour of confirmation of an unauthorized action by Contractor or Contractor personnel, notify the OIG COR and OIG ISD (53I) of any access, disclosure, disposition, or destruction of VA information and information systems not authorized under the contract. To the extent known, Contractor will notify the OIG COR and OIG ISD (53I) of the information improperly disclosed, to whom, how, when, the reason for the access, disclosure, disposition or destruction, and any other relevant information or information requested by the OIG.

12. Law enforcement and legal proceedings: Contractor will cooperate with OIG and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any unauthorized access, disclosure, disposition or destruction of VA information or property. Contractor will also cooperate with VA in any civil litigation to recover VA information or property, to obtain monetary or other compensation for a third party, or to obtain injunctive relief against any third party who accessed, modified, disclosed or destroyed VA information and information systems except as explicitly authorized under the contract.

2. Personnel Security

A. Mandatory VA OIG User Agreement/Rules of Behavior and Nondisclosure Agreement

1. General rule: Every individual Contractor personnel who will access VA information or VA information systems under the contract shall complete a VA OIG User Agreement/Rules of Behavior (UA/RoB) and Nondisclosure Agreement (NDA). The OIG ISD (53I) must accept the submitted UA/RoB and NDA before any Contractor personnel may obtain access or start work. The OIG Information Security Division (53I) determines the acceptability of submitted UA/RoBs and NDAs.

2. Provide Email Contact: Contractor shall provide the email addresses for each individual Contractor personnel that must complete this requirement. The email address may be a work or a personal email address for this specific requirement. If a Contractor official is coordinating the return of UAs/RoBs and NDAs, that official must first receive approval and instructions from the OIG ISD (53I) before proceeding.

3. Sign UA/RoB: Each individual Contractor personnel who will access VA information or VA information systems under the contract shall complete the following tasks prior to OIG authorizing such access:

a. Read the current VA OIG UA/RoB provided by the OIG ISD (53I),

b. Complete…