ATTACHMENT A _ PERFORMANCE WORK STATEMENT _ OCAMS SUPPORT.pdf

PERFORMANCE WORK STATEMENT FOR DEPARTMENT OF VETERANS AFFAIRS, OFFICE OF ASSET ENTERPRISE

MANAGEMENT PROGRAMMATIC MANAGEMENT SUPPORT SERVICES FOR CAPITAL ASSET MANAGEMENT

A. GENERAL INFORMATION

1. Title of Project: Veterans Health Administration (VHA) Capital Project Activation Costs

2. Background: The Strategic Capital Investment Planning (SCIP) process is the basis for the Department of Veterans Affairs’ (VA) current and out-year capital budget requests. The SCIP process includes development of 10-Year action plans and budget year business cases to close performance gaps (space, utilization, facility condition, access, etc.) and enhance healthcare and delivery of services and benefits to the nation’s Veterans.

To better estimate all-in project costs (e.g., furniture, equipment, information technology, staffing. etc.) and to provide documentation for budgetary requests required for project “activation” funding, a model for calculating these costs in advance of and during construction is necessary to plan and redistribute funding as project schedules change.

The model will be based on the Space and Equipment Planning Software (SEPS). Each Construction project and Major Lease are required to submit a SEPS plan during the SCIP submission. That SEPS plan will become the baseline for Furniture, Fixtures, and Equipment (FF&E) funding.

3. Scope of Work: The contractor shall provide all resources necessary to accomplish the deliverables described in this Performance Work Statement (PWS). The contractor shall be responsible for the following:

Contractor shall provide an initial update to the previous estimates, historical activation funding executed per project, and provide to VHA. Additionally, the contractor shall provide a mid-year update to assist VHA in providing the most accurate data to VHA finance for funding requests; validation that the initial update is still accurate based on the midyear project changes. Initial and mid-year update estimates will include recurring and non-recurring for all types and sizes of VHA capital projects, and all inputs, and outputs previously included in the estimates, and as needed, changes the contractor may recommend improving the accuracy of the estimates. The estimates should provide all required documentation to respond to the Office of Management and Budget (OMB) and Congressional requests for information regarding activation costs.

Contractor shall provide ongoing support to develop reports, update project changes to the estimate, and/or presentations as needed by project, VISN or VHA for the term of this contract. The contractor shall also provide on-going support to Office of Capital Asset Management (OCAMS) and VISNs in maintaining and updating the database data/information to support an effective activation funding process, which will help ensure the tool is being evaluated with current data and information.

4. Performance Period: The period of performance is for twelve (12) months from date of award and includes a twelve (12) month option period. Work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO).

5. Type of Contract: Firm Fixed Price

6. Place of Performance: Contractor’s facility - The Government does not anticipate travel under this effort, however if travel is required, a request will be submitted to the CO for prior approval.

7.0. Non-Personal Services: In accordance with FAR 37.104 and 5 U.S.C. 3109, this requirement has been determined to be a non-personal services contract. A non-personal services contract is a contract under which the contractor personnel providing the services are not subject to continuous Government supervision and or control, either by the contract's terms or by the manner of its administration.

B. CONTRACT AWARD MEETING

The contractor shall not commence performance on the tasks in this PWS until the CO has conducted a Post-Award Conference (PAC) or has advised the contractor that a PAC is waived.

C. SPECIFIC MANDATORY TASKS AND ASSOCIATED DELIVERABLES

1. Description of Tasks and Associated Deliverables: The contractor shall provide the specific deliverables described below within the performance period stated in Section A.4 of this PWS.

a. Task One: Project Management Plan (PMP) and Briefing

The contractor shall provide a PMP and briefing for the project team, which presents the contractor's plan for completing the contract deliverables and on-going support. The contractor's plan shall be responsive to this PWS and describe, in further detail, the approach to be used for each aspect of the contract as defined in the technical proposal.

The contractor shall keep the PMP up-to-date throughout the period of performance.

Deliverable 1: PMP and briefing is due 15 days after contract award

b. Task Two: OCAMES- Activation Project Status Meetings/Monthly Meetings and Ongoing Support

For the entirety of the POP, the contractor shall coordinate and participate in monthly status meetings with the VHA Activation Program Manager (APM), develop meeting agendas, document and submit meeting minutes within 2-business days for approval to the APM. Contractor will maintain tracking list that includes follow-up items, issues, tasks, and resolutions, and identifying them as open and closed items.

Monthly Meeting Agenda, at a minimum the agendas will contain ongoing topics of:

a. Contract Deliverables – Status/Update

b. VISN Activation Projects - Open items and/or issues, etc.

c. Tracking List of open and closed issues/tasks/and resolutions

d. Reports Requested: Who, What, When, Why, and format expected

Contractor shall provide ongoing support to analyze VHA portfolio of projects to determine if changes are needed to VHA activation funding estimates, OMB request, allocation, redistribution, and possible effects of short and long-term funding need. This on-going support includes the validation of activation funding for VHA portfolio of projects, development of reports and presentations, updating project changes to the activations estimates for each Major Construction Project/Major Lease.

Deliverable 2: Meeting Minutes and tracking list (Ongoing deliverable throughout PoP)

c. Task Three: Update the previous Activation Estimates

a. Initial Activation Funding Estimate: Contractor shall coordinate with VA/VHA stakeholders to gather required data, project information, historical funding execution, and project documents (i.e., spend plan, staffing plan, etc.)

to update the previous activation estimates; determine accurate and if submission is reasonable bases on the scope and/or complexity of the project. The new estimate will outline the expected total cost of each project by project, VISN and VHA, which will include estimated activation dates. The new estimate will also include actual activation spend (outlays)/historical funding executed by project, three-year period expected allocation by appropriation category, and out-year bucket to illustrate the remaining funding requirement by project (i.e., Total Cost Project, Historical Expenditures, FY22, FY23, FY24, Out-years) by project and VISN. Contractor will update assumptions and factors, inputs and outputs for the cost estimating, and cost/square foot factors, as required.

This initial estimate will be accomplished utilizing the SEPS plan submitted with the SCIP submission for each Major Construction Project and Major Lease” to gather the required data, information and/or documents to estimate VHA’s activations funding

The contractor shall coordinate data collection effort with VISNs to calculate activation estimates to include the following:

i) Request levels of workload, square footage information, and any additional input data associated with task from field staff.

ii) Conduct detailed review and validation of VISN responses to ensure square footages are consistent with current CFM data and that workload is consistent with documented project intent and scope.

iii) Prepare activation estimates for all in process, previously approved projects

iv) Create centralized database of all in process, previously approved projects

v) Document the total VHA Non-recurring, Recurring, and requirements, by VISN and by project

vi) Document estimating tool generated activation funding estimates

vii) Compare and validate final run estimates with latest VISN estimates prepared by field staff, based on their current view of projects. Review and document any differences in estimates.

viii) Prepare options for senior VA leadership for final adjustments to Re-run estimates in advance of authorization request.

Deliverable 3: Initial update (Due date: 60 days from contract award)

• Excel Workbook Report (Initial Est and Midyear Est update)

• PowerPoint presentation outlining estimate, process utilized, category definition, funding detail, etc.

• Administrative and Technical Manual Update

• VHA Op Plan / Spend Plan

• Project Staffing Plan rolled up into report

• Updated Activations Estimate

b. Midyear Activation Funding Estimate: Contractor shall provide a mid-year validation of the “Initial Activation Cost Estimate” to ensure the estimate is still accurate based on project or funding allocation changes. Contractor will submit changes to the COR for approval of changes to the initial estimate.

Examples:

1. Non-recurring Activation Costs

2. Recurring Activation Costs

3. Notational New FTEE

4. Workload

5. VAMC Support Needed

Deliverable 4: Mid-year Update (Due December 31, 2020)

• Excel Workbook Report (Initial Est and Midyear Est update)

• PowerPoint presentation outlining estimate, process utilized, category definition, funding detail, etc.

• Administrative and Technical Manual Update

• VHA Op Plan / Spend Plan

• Project Staffing Plan rolled up into report

• Updated Activations Estimates

c. 4th Quarter Update - Activation Funding Estimate: Contractor shall provide an end of year update and report including Initial Estimate, Midyear Estimate Update, and Q4 Update of the “Initial Activation Cost Estimate” to ensure the estimates are still accurate based on project or funding allocation changes. Contractor will submit changes to the COR for approval of changes to the initial estimate.

Deliverable 5: 4th Quarter Update (Due June 30, 2021)

• Excel Workbook Report (Initial Est, Midyear Est update , Q4 Update)

• PowerPoint presentation outlining estimate, process utilized, category definition, funding detail, etc.

• Administrative and Technical Manual Update

• VHA Op Plan / Spend Plan

• Project Staffing Plan rolled up into report

• Updated Activations Estimates

Performance Standards and Methods as specified in each task. Past performance will be documented in accordance with VHA Procurement Policy Memorandum dated August 12, 2013 and as required by Federal Acquisition Regulation (FAR) subpart 42.15.

Performance Objective Performance Standard Acceptable Levels of Performance

A. Technical / Quality of Product or Service

1. Shows understanding of requirements

2. Efficient and effective in meeting requirements

3. Meets technical needs and mission requirements

4. Provides quality services/products

Satisfactory or higher

B. Project Milestones and Schedule

1. Quick response capability

2. Products completed, reviewed, delivered in accordance with the established schedule

3. Notifies customer in advance of potential problems

Satisfactory or higher

C. Cost & Staffing 1. Currency of expertise and staffing levels appropriate

2. Personnel possess necessary knowledge, skills and abilities to perform tasks

Satisfactory or higher

D. Management 1. Integration and coordination of all activities to execute effort

Satisfactory or higher

The COR will utilize a Quality Assurance Surveillance Plan (QASP) throughout the life of the Contract to ensure that the Contractor is performing the services required by this PWS in an acceptable level of performance. The Government reserves the right to alter or change the QASP at its own discretion. A Performance Based Service Assessment will be used by the COR in accordance with the QASP to assess Contractor performance.

D. GENERAL REQUIREMENTS

The following general requirements to this contract:

1. All written deliverables shall be phrased in layperson language. Statistical and other technical terminology shall not be used without providing a glossary of terms.

2. Unless otherwise specified, the following schedule requirements apply: Where a written milestone deliverable is required in draft form, the VA will complete its review of the draft deliverable within 12 calendar days from date of receipt. The contractor shall have 12 calendar days to deliver the final deliverable from date of receipt of the Government’s comments.

4. The contractor shall provide, via email, minutes of all Government-contractor meetings. The contractor shall provide these minutes within one calendar day after completion of the meeting.

5. Except for proprietary information in company quotes identified and marked in accordance with FAR 52.215-1(e), the contractor shall not deliver to the Office of Asset Enterprise Management (OAEM) any proprietary products or information of any type in completing the requirements of the PWS. The contractor’s internal development tools (that is, those development tools not developed for OAEM work and not required by OAEM to install, use, or revise the deliverables) are exempted from this requirement. If the contractor believes an exception to this requirement is necessary for the effective or efficient execution of the contract, the contractor shall request a specific exception, in writing, to the CO, and shall not use the proprietary tools or information in OAEM work until approval is received from the CO.

6. The contractor shall ensure contract employees maintain an open and professional communication with the staff at the

VA facilities. For transparency purposes, email to the CO shall not be blind carbon copied (BCC) to other Government personnel.

7. Complaints or violation validated by the COR or VA staff will be reported in writing to the CO, Office of the Inspector

General (OIG), or Head of the Contracting Activity (HCA) for action. If the contractor fails to correct validated complaints raised by the COR and or CO, it will be considered a failure in performance.

8. The CO may require the contractor to meet with the CO, contract administrator, and other Government personnel at least quarterly, and as often as deemed necessary. The contractor may request a meeting with the CO when deemed necessary.

E. SPECIAL REQUIREMENTS

This section describes the special requirements for this effort. The following sub-sections provide details of various considerations on this effort.

1. Security and Safety

This section describes the security and safety for this effort. The following sub-sections provide details of various considerations on this effort.

1.1. Position/Task Risk Designation Level(s)

The following position sensitivity classifications and background investigation requirements are in accordance with the VA 0710 Handbook "Personnel Security Suitability Program" 6500 Appendix A:

• Position Sensitivity Low Tier 1: National Agency Check with Written Inquiries (NACI) A NACI is conducted by OPM and covers a five-year period. It consists of a review of records contained in the OPM Security Investigations Index (SII) and the DOD Defense Central Investigations Index (DCII), FBI name check, FBI fingerprint check, and written inquiries to previous employers and references listed on the application for employment. In VA, it is used for Non-sensitive or Low-Risk positions.

• Position Sensitivity Moderate Tier 2: Moderate Background Investigation (MBI) An MBI is conducted by OPM and covers a five-year period. It consists of National Agency Check (NAC) records [OPM SII, DCII, FBI name check, and an FBI fingerprint check], a credit report covering a period of five years, written inquiries to previous employers and references listed on the application for employment, an interview with the subject, law enforcement check, and a verification of the educational degree.

• Position Sensitivity Moderate/Secret Tier 3: Background Investigation (ANACI) An ANACI is not applicable to VHA contractors in most cases.

• Position Sensitivity High Tier 4: Background Investigation (BI) A BI is conducted by OPM and covers a 10-year period. It consists of a review of NAC records [OPM SII, DCII, FBI name check, and an FBI fingerprint check report], a credit report covering a period of 10 years, written inquiries to previous employers and references listed on the application for employment; an interview with the subject, spouse neighbors, supervisor, and co-workers; court records, law enforcement check, and a verification of the educational degree.

• Position Sensitivity High/Top Secret Tier 5: Background Investigation (SSBI) A SSBI is not applicable to VHA contractors in most cases.

The Government is required to identify the appropriate background investigation level (NACI, MBI, or BI) by PWS task using the Position Designation Automated Tool (PDAT) at the US Office of Personnel Management Website at:

https://www.opm.gov/investigations/suitability-executive-agent/position-designation-tool/#url=Automated-Tool.

The position sensitivity and the level of background investigation commensurate with the required level of access for the following tasks within the PWS are listed in PDAT Matrix (see Attachment J to the contract).

The tasks identified in Attachment J of the contract and the resulting Position Sensitivity and Background Investigation requirements identify, in effect, the Background Investigation requirements for contractor individual, based upon the tasks the contractor individual will be working.

The submitted contractor Staff Roster (see Attachment H to the contract) must indicate the required Background Investigation Level for each contractor individual based upon the task the contractor individual will be working, in accordance with their submitted proposal.

1.2. contractor Personnel Security Requirement Responsibilities

(1) The contractor shall prescreen all personnel requiring access to the computer systems to ensure they maintain the appropriate Background Investigation, and are able to read, write, speak, and understand the English language.

(2) The contractor shall bear the expense of obtaining background investigations.

(3) Within 5 business days after award, the contractor shall provide a completed Form 1A (see Attachment I to the contract) for each employee and a roster of contractor and Subcontractor employees to the COR to begin their background investigations. The staff roster shall contain each contractor and Subcontractor employee's full name and individual background investigation level requirement.

(4) The contractor should coordinate the location of the nearest VA fingerprinting office through the COR. Only electronic fingerprints are authorized.

(5) For a Low Risk designation, the following forms are required to be completed: OF-306 and DVA Memorandum - Electronic Fingerprints. For Moderate or High-Risk designations, the following forms are required to be completed: VA Form 0710 and DVA Memorandum - Electronic Fingerprints. These should be submitted to the COR within 5 business days after contract award.

(6) The contractor employee will receive an email notification from the Security and Investigation Center (SIC) through the Electronics Questionnaire for Investigations Processing (e-QIP) identifying the website link that includes detailed instructions regarding completion of the investigation documents (SF85, SF85P, or SF86). The contractor employee shall submit all required information related to their background investigations utilizing e-QIP.

(7) The contractor employee is to certify and release the e-QIP document, print and sign the signature pages, and send them to the COR for electronic submission to the SIC. These should be submitted to the COR within 3 business days of receipt of the e-QIP notification email.

(8) The contractor shall be responsible for the actions of all personnel provided to work for VA under this contract. In the event that damages arise from work performed by contractor personnel, under the auspices of this contract, the contractor shall be responsible for all resources necessary to remedy the incident.

(9) A contractor employee may be granted unescorted access to VA facilities and/or access to VA Information Technology resources (network and/or protected data) with a favorably adjudicated Special Agreement Check (SAC) or "Closed, No Issues" (SAC) finger print results, completion of training delineated in VA Handbook 6500.6 (Appendix C, Section 9), and the signed "contractor Rules of Behavior." However, the contractor will be responsible for the actions of the contractor personnel they provide to perform work for the VA. The investigative history for contractor personnel working under this contract must be maintained in the database of the Office of Personnel Management.

(10) The contractor, when notified of an unfavorably adjudicated background investigation on a contractor employee as determined by the Government, shall withdraw the employee from consideration in working under the contract.

(11) Failure to comply with the contractor personnel security investigative requirements may result in termination of the contract for default.

ADDENDUM A – ADDITIONAL VA REQUIREMENTS, CONSOLIDATED

A1.0 Cyber and Information Security Requirements for VA IT Services

The contractor shall ensure adequate LAN/Internet, data, information, and system security in accordance with VA standard operating procedures and standard PWS language, conditions, laws, and regulations. The contractor’s firewall and web server shall meet or exceed VA minimum requirements for security. All VA data shall be protected behind an approved firewall. Any security violations or attempted violations shall be reported to the project’s VA Program Manager and VA Information Security Officer as soon as possible. The contractor shall follow all applicable VA policies and procedures governing information security, especially those that pertain to assessment and authorization (A&A).

VA Handbook 6500.3 defines the procedures for Assessment, Authorization and Continuous Monitoring of VA Information Systems. A&A is the process used to ensure information systems have effective security safeguards which have been implemented, planned for, and documented in a security plan. The A&A process is the mechanism by which management provides formal authority for a system to operate and process information. A&A is based on the approval of the AO who is the senior most VA official assigned responsibility for IT systems. A&A is required by information security legislation and Federal regulation and provides a framework for auditing the efficiency and effectiveness of security controls. Since this acquisition will not require services that involve connection of one or more contractor-owned IT devices (such as a laptop computer or remote connection from a contractor system) to a VA internal trusted (i.e. non-public) network, A&A requirements do not apply, and a Security Accreditation Package will not be required. Additionally, VA Sensitive information will remain protected as it will reside behind the VA firewall at all times.

contractor supplied equipment, PCs of all types, equipment with hard drives, etc. for contract services must meet all security requirements that apply to Government Furnished Equipment (GFE) and Government Owned Equipment (GOE). Security Requirements include: a) VA Approved Encryption Software must be installed on all laptops or mobile devices before placed into operation, b) Bluetooth equipped devices are prohibited within VA; Bluetooth must be permanently disabled or removed from the device, c) VA approved anti-virus and firewall software, d) Equipment must meet all VA sanitization requirements and procedures before disposal. The COR, CO, the Project Manager, and the Information Security Officer (ISO) must be notified and verify all security requirements have been adhered to.

Each documented initiative under this contract incorporates the VA Handbook 6500.6, “Contract Security,” March 12, 2010 by reference as though fully set forth therein. The VA Handbook 6500.6, “Contract Security” shall also be included in every related agreement, contract or order. The VA Handbook 6500.6, Appendix C, is included in this document as Addendum B.

Training requirements: The contractor shall create TMS accounts and complete all mandatory training courses identified on the current external VA training site, VALU VA Learning University. The VALU VA Learning University may be accessed at https://www.tms.va.gov/learning/user/SelfRegistrationUserSelection.do. If local Program Office desires, the contractor shall use the VALU VA Learning Website to complete their mandatory training, accessed at https://www.tms.va.gov/learning/user/SelfRegistrationUserSelection.do.

Once contractor TMS accounts are created and mandatory training completed, contractor TMS accounts may be move to VA domains where VA computer access for contractors are created to monitor training.

contractor employees shall complete a VA Systems Access Agreement and submit an appropriate background investigation before permitted access privileges to VA computer systems.

A2.0 VA Enterprise Architecture Compliance The applications, supplies, and services furnished under this contract must comply with One-VA Enterprise Architecture (EA), available at http://www.ea.oit.va.gov/index.asp in force at the time of issuance of this contract, including the Program Management Plan and VA's rules, standards, and guidelines in the Technical Reference Model/Standards Profile. The VA reserves the right to assess contract deliverables for EA compliance prior to acceptance.

A2.1 VA Internet and Intranet Standards:

The contractor shall adhere to and comply with VA Directive 6102 and VA Handbook 6102, Internet/Intranet Services, including applicable amendments and changes, if the contractor’s work includes managing, maintaining, establishing and presenting information on VA’s Internet/Intranet Service Sites. This pertains, but is not limited to: creating announcements;

collecting information; databases to be accessed, graphics and links to external sites.

Internet/Intranet Services Directive 6102 is posted at (copy and paste the following URL to browser):

http://www1.va.gov/vapubs/viewPublication.asp?Pub_ID=409&FType=2

Internet/Intranet Services Handbook 6102 is posted at (copy and paste following URL to browser):

http://www1.va.gov/vapubs/viewPublication.asp?Pub_ID=410&FType=2

A3.0 Notice of the Federal Accessibility Law Affecting All Electronic and Information Technology (EIT) Procurements (Section 508)

On August 7, 1998, Section 508 of the Rehabilitation Act of 1973 was amended to require that when Federal departments or agencies create, procure, maintain, or use EIT, that they shall ensure it allows Federal employees with disabilities to have access to and use of information and data that is comparable to the access to and use of information and data by other Federal employees. Section 508 required the Architectural and Transportation Barriers Compliance Board (Access Board) to publish standards setting forth a definition of EIT and the technical and functional criteria for such technology to comply with Section 508. These standards have been created and are published with an effective date of December 21, 2000.

Federal departments and agencies shall create all EIT requirements to comply with the standards found in 36 CFR 1194.

Section 508 – EIT Standards:

The Section 508 standards established by the Architectural and Transportation Barriers Compliance Board (Access Board) are incorporated into, and made part of all VA orders, solicitations and purchase orders created to procure EIT. These standards are found in their entirety at: http://www.section508.gov and https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-section-508-standards/section-508-standards. A printed copy of the standards will be supplied upon request. The contractor shall comply with the technical standards as marked:

_x_§ 1194.21 Software applications and operating systems

_x_§ 1194.22 Web-based intranet and internet information and applications

_x_§ 1194.23 Telecommunications products

_x_§ 1194.24 Video and multimedia products

_x_§ 1194.25 Self-contained, closed products

_x_§ 1194.26 Desktop and portable computers

_x_§ 1194.31 Functional Performance Criteria

_x_§ 1194.41 Information, Documentation, and Support

The standards do not require the installation of specific accessibility-related software or the attachment of an assistive technology device, but merely require that the EIT be compatible with such software and devices so that it can be made accessible if so required by the agency in the future.

A4.0 Physical Security & Safety Requirements:

The contractor and their personnel shall follow all VA policies, standard operating procedures, applicable laws and regulations while on VA property. Violations of VA regulations and policies may result in citation and disciplinary measures for persons violating the law.

(1) The contractor and their personnel shall wear visible identification at all times while they are on the premises.

(2) The VA does not provide parking spaces at the work site; the contractor must obtain parking at the work site if needed. It is the responsibility of the contractor to park in the appropriate specified parking areas. The VA will not invalidate or make reimbursement for parking violations of the contractor under any conditions.

(3) Smoking is prohibited inside/outside any building other than the specified smoking areas.

(4) Possession of weapons is prohibited.

(5) The contractor shall obtain all necessary licenses and/or permits required to perform the work, except for software licenses that need to be procured from a contractor or vendor in accordance with the requirements document. The contractor shall take all reasonable precautions necessary to protect persons and property from injury or damage during the performance of this contract.

A5.0 Confidentiality and Non-Disclosure

The contractor shall follow all VA rules and regulations regarding information security to prevent disclosure of sensitive information to unauthorized individuals or organizations.

The contractor may have access to Protected Health Information (PHI) and Electronic Protected Health Information (EPHI) that is subject to protection under the regulations issued by the Department of Health and Human Services, as mandated by the Health Insurance Portability and Accountability Act of 1996 (HIPAA); 45 CFR Parts 160 and 164, Subparts A and E, the Standards for Privacy of Individually Identifiable Health Information (“Privacy Rule”); and 45 CFR Parts 160 and 164, Subparts A and C, the Security Standard (“Security Rule”). Pursuant to the Privacy and Security Rules, the contractor must agree in writing to certain mandatory provisions regarding the use and disclosure of PHI and EPHI.

1. The contractor will have access to some privileged and confidential materials of VA. These printed and electronic documents are for internal use only, are not to be copied or released without permission, and remain the sole property of VA. Some of these materials are protected by the Privacy Act of 1974 (revised by PL 93-5791) and Title

38. Unauthorized disclosure of Privacy Act or Title 38 covered materials is a criminal offense.

2. The VA CO will be the sole authorized official to release in writing, any data, draft deliverables, final deliverables, or any other written or printed materials pertaining to this contract. The contractor shall release no information. Any request for information relating to this contract presented to the contractor shall be submitted to the VA CO for response.

3. contractor personnel recognize that in the performance of this effort, contractor personnel may receive or have access to sensitive information, including information provided on a proprietary basis by carriers, equipment manufacturers and other private or public entities. contractor personnel agree to safeguard such information and use the information exclusively in the performance of this contract. contractor shall follow all VA rules and regulations regarding information security to prevent disclosure of sensitive information to unauthorized individuals or organizations as enumerated in this section and elsewhere in this Contract and its subparts and appendices.

4. contractor shall limit access to the minimum number of personnel necessary for contract performance for all information considered sensitive or proprietary in nature. If the contractor is uncertain of the sensitivity of any information obtained during the performance this contract, the contractor has a responsibility to ask the VA CO.

5. contractor shall train all their employees involved in the performance of this contract on their roles and responsibilities for proper handling and nondisclosure of sensitive VA or proprietary information. contractor personnel shall not engage in any other action, venture or employment wherein sensitive information shall be used for the profit of any party other than those furnishing the information. The sensitive information transferred, generated, transmitted, or stored herein is for VA benefit and ownership alone.

6. contractor shall maintain physical security at all facilities housing the activities performed under this contract, including any contractor facilities according to VA-approved guidelines and directives. The contractor shall ensure that security procedures are defined and enforced to ensure all personnel who are provided access to patient data must comply with published procedures to protect the privacy and confidentiality of such information as required by VA.

7. Contractor must adhere to the following:

a. The use of “thumb drives” or any other medium for transport of information is expressly prohibited.

b. Controlled access to system and security software and documentation.

c. Recording, monitoring, and control of passwords and privileges.

d. All terminated personnel are denied physical and electronic access to all data, program listings, data processing equipment and systems.

e. VA, as well as any contractor (or Subcontractor) systems used to support development, provide the capability to cancel immediately all access privileges and authorizations upon employee termination.

f. contractor PM and VA PM are informed within twenty-four (24) hours of any employee termination.

g. Acquisition sensitive information shall be marked "Acquisition Sensitive" and shall be handled as "For

Official Use Only (FOUO)".

h. contractor does not require access to classified data.

8. Regulatory standard of conduct governs all personnel directly and indirectly involved in procurements. All personnel engaged in procurement and related activities shall conduct business in a manner above reproach and, except as authorized by statute or regulation, with complete impartiality and with preferential treatment for none. The general rule is to strictly avoid any conflict of interest or even the appearance of a conflict of interest in VA/contractor relationships.

ADDENDUM B - VA INFORMATION AND INFORMATION SYSTEMS SECURITY/PRIVACY LANGUAGE VA HANDBOOK 6500.6, APPENDIX C, MARCH 12, 2010

B.1 GENERAL

contractors, contractor personnel, Subcontractors, and Subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security.

B.2 ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS

1. A contractor/subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, Subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order.

2. All contractors, subcontractors, and third-party servicers and associates working with VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures.

3. Contract personnel who require access to national security programs must have a valid security clearance. National Industrial Security Program was established by Executive Order 12829 to ensure that cleared U.S. defense industry contract personnel safeguard the classified information in their possession while performing work on contracts, programs, bids, or research and development efforts. The VA does not have a Memorandum of Agreement with Defense Security Service. Verification of a Security Clearance must be processed through the Special Security Officer located in the Planning and National Security Service within the Office of Operations, Security, and Preparedness.

4. Custom software development and outsourced operations must be located in the U.S. to the maximum extent practical. If such services are proposed to be performed abroad and are not disallowed by other VA policy or mandates, the contractor/subcontractor must state where all non-U.S. services are provided and detail a security plan, deemed to be acceptable by VA, specifically to address mitigation of the resulting problems of communication, control, data protection, and so forth. Location within the U.S. may be an evaluation factor.

5. The contractor or subcontractor must notify the CO immediately when an employee working on a VA system or with access to VA information is reassigned or leaves the contractor or subcontractor’s employ. The CO must also be notified immediately by the contractor or subcontractor prior to an unfriendly termination.

B.3 VA INFORMATION CUSTODIAL LANGUAGE

1. Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed created by the contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of VA. This clause expressly limits the contractor/subcontractor's rights to use data as described in Rights in Data - General, FAR 52.227-14(d) (1).

2. VA information should not be co-mingled, if possible, with any other data on the contractors/subcontractor’s information systems or media storage systems in order to ensure VA requirements related to data protection and media sanitization can be met. If co-mingling must be allowed to meet the requirements of the business need, the contractor must ensure that VA’s information is returned to the VA or destroyed in accordance with VA’s sanitization requirements. VA reserves the right to conduct on-site inspections of contractor and Subcontractor IT resources to ensure data security controls, separation of data and job duties, and destruction/media sanitization procedures are in compliance with VA directive requirements.

3. Prior to termination or completion of this contract, contractor/subcontractor must not destroy information received from VA, or gathered/created by the contractor in the course of performing this contract without prior written approval by VA. Any data destruction done on behalf of VA by a contractor/subcontractor must be done in accordance with National Archives and Records Administration requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self-certification by the contractor that the data destruction requirements above have been met must be sent to the VA CO within 30 days of termination of the contract.

4. The contractor/subcontractor must receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with the terms of the contract and applicable Federal and VA information confidentiality and security laws, regulations and policies. If Federal or VA information confidentiality and security laws, regulations and policies become applicable to the VA information or information systems after execution of the contract, or if NIST issues or updates applicable FIPS or Special Publications after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations and policies in this contract.

5. The contractor/subcontractor shall not make copies of VA information except as authorized and necessary to perform the terms of the agreement or to preserve electronic information stored on contractor/subcontractor electronic storage media for restoration in case any electronic equipment or data used by the contractor/subcontractor needs to be restored to an operating state. If copies are made for restoration purposes, after the restoration is complete, the copies must be appropriately destroyed.

6. If VA determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the contractor or third party or terminate the contract for default or terminate for cause under FAR Part 12.

7. If a VHA contract is terminated for cause, the associated Business Associate Agreement must also be terminated and appropriate actions taken in accordance with VHA Handbook 1600.01, Business Associate Agreements. Absent an agreement to use or disclose protected health information, there is no business associate relationship.

8. The contractor/subcontractor must store, transport, or transmit VA sensitive information in an encrypted form, using VA-approved encryption tools that are, at a minimum, FIPS 140-2 validated.

9. The contractor/subcontractor’s firewall and Web services security controls, if applicable, shall meet or exceed VA’s minimum requirements. VA Configuration Guidelines are available upon request.

10. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor/subcontractor may use and disclose VA information only in two other situations: (i) in response to a qualifying order of a court of competent jurisdiction, or (ii) with VA’s prior written approval. The contractor/Subcontractor must refer all requests for, demands for production of, or inquiries about, VA information and information systems to the VA CO for response.

11. Notwithstanding the provision above, the contractor/Subcontractor shall not release VA records protected by Title 38 U.S.C. 5705, confidentiality of medical quality assurance records and/or Title 38 U.S.C. 7332, confidentiality of certain health records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse, or infection with human immunodeficiency virus. If the contractor/Subcontractor is in receipt of a court order or other requests for the above-mentioned information, that contractor/Subcontractor shall immediately refer such court orders or other requests to the VA CO for response.

12. For service that involves the storage, generating, transmitting, or exchanging of VA sensitive information but does not require Certification and Accreditation (Authorization) (C&A) or a Memorandum of Understanding- Interconnection Service Agreement (MOU-ISA) for system interconnection, the contractor/Subcontractor must complete a contractor Security Control Assessment on a yearly basis and provide it to the COR.

B.4 INFORMATION SYSTEM DESIGN AND DEVELOPMENT

1. Information systems that are designed or developed for or on behalf of VA at non-VA facilities shall comply with all VA directives developed in accordance with FISMA, HIPAA, NIST, and related VA security and privacy control requirements for Federal information systems. This includes standards for the protection of electronic PHI, outlined in 45 C.F.R. Part 164, Subpart C, information and system security categorization level designations in accordance with FIPS 199 and FIPS 200 with implementation of all baseline security controls commensurate with the FIPS 199 system security categorization (reference Appendix D of VA Handbook 6500, VA Information Security Program).

During the development cycle a Privacy Impact Assessment (PIA) must be completed, provided to the COR, and approved by the VA Privacy Service in accordance with Directive 6508, VA Privacy Impact Assessment.

2. The contractor/Subcontractor shall certify to the COR that applications are fully functional and operate correctly as intended on systems using the VA Federal Desktop Core Configuration (FDCC), and the common security configuration guidelines provided by NIST or VA. This includes Internet Explorer 7 configured to operate on Windows XP and Vista (in Protected Mode on Vista) and future versions, as required.

3. The standard installation, operation, maintenance, updating, and patching of software shall not alter the configuration settings from the VA approved and FDCC configuration. Information technology staff must also use the Windows Installer Service for installation to the default “program files” directory and silently install and uninstall.

4. Applications designed for normal end users shall run in the standard user context without elevated system administration privileges.

5. The security controls must be designed, developed, approved by VA, and implemented in accordance with the provisions of VA security system development life cycle as outlined in NIST Special Publication 800-37, Guide for Applying the Risk Management Framework to Federal Information Systems, VA Handbook 6500, Information Security Program and VA Handbook 6500.5, Incorporating Security and Privacy in System Development Lifecycle.

6. The contractor/Subcontractor is required to design, develop, or operate a System of Records Notice (SOR) on individuals to accomplish an agency function subject to the Privacy Act of 1974, (as amended), Public Law 93-579, December 31, 1974 (5 U.S.C. 552a) and applicable agency regulations. Violation of the Privacy Act may involve the imposition of criminal and civil penalties.

7. The contractor/Subcontractor agrees to:

a. Comply with the Privacy Act of 1974 (the Act) and the agency rules and regulations issued under the Act in the design, development, or operation of any system of records on individuals to accomplish an agency function when the contract specifically identifies:

i. The Systems of Records (SOR); and

ii. The design, development, or operation work that the contractor/Subcontractor is to perform;

b. Include the Privacy Act notification contained in this contract in every solicitation and resulting subcontract and in every subcontract awarded without a solicitation, when the work statement in the proposed subcontract requires the redesign, development, or operation of a SOR on individuals that is subject to the Privacy Act; and

c. Include this Privacy Act clause, including this subparagraph (3), in all subcontracts awarded under this contract which requires the design, development, or operation of such a SOR.

8. In the event of violations of the Act, a civil action may be brought against the agency involved when the violation concerns the design, development, or operation of a SOR on individuals to accomplish an agency function, and criminal penalties may be imposed upon the officers or employees of the agency when the violation concerns the operation of a SOR on individuals to accomplish an agency function. For purposes of the Act, when the contract is for the operation of a SOR on individuals to accomplish an agency function, the contractor/Subcontractor is considered to be an employee of the agency.

a. “Operation of a System of Records” means performance of any of the activities associated with maintaining the SOR, including the collection, use, maintenance, and dissemination of records.

b. “Record” means any item, collection, or grouping of information about an individual that is maintained by an agency, including, but not limited to, education, financial transactions, medical history, and criminal or employment history and contains the person’s name, or identifying number, symbol, or any other identifying particular assigned to the individual, such as a fingerprint or voiceprint, or a photograph.

c. “System of Records” means a group of any records under the control of any agency from which information is retrieved by the name of the individual or by some identifying number, symbol, or other identifying particular assigned to the individual.

9. The vendor shall ensure the security of all procured or developed systems and technologies, including their subcomponents (hereinafter referred to as “Systems”), throughout the life of this contract and any extension, warranty, or maintenance periods. This includes, but is not limited to workarounds, patches, hot fixes, upgrades, and any physical components (hereafter referred to as Security Fixes) which may be necessary to fix all security vulnerabilities published or known to the vendor anywhere in the Systems, including Operating Systems and firmware. The vendor shall ensure that Security Fixes shall not negatively impact the Systems.

10. The vendor shall notify VA within 24 hours of the discovery or disclosure of successful exploits of the vulnerability which can compromise the security of the Systems (including the confidentiality or integrity of its data and operations, or the availability of the system). Such issues shall be remediated as quickly as is practical, based upon the severity of the incident.

11. When…