Draft PD Cority GX2 BNE SaaS Subscription_23 June 2026.docx

Cority GX2 Brand Name or Equivalent SaaS Subscription TAC Number: VA-26-00049891

PRODUCT DESCRIPTION (PD)

DEPARTMENT OF VETERANS AFFAIRS

Center of Enterprise Human Resource Information Services (CEHRIS)

Enterprise Occupational Safety and Health (EOSH) Cority GX2 Brand Name or Equivalent Software as a Service (SaaS) Subscription

Date: June 23, 2026

VA-26-00049891

PD Version Number: 1.0

Contents

PRODUCT REQUIREMENTS

Several challenges exist in Enterprise, Occupational Safety, and Health (EOSH) program performance and effectiveness across United States (U.S.) Department of Veterans Affairs (VA). Facilities continue to struggle to fully integrate comprehensive Safety Management Systems (SMS) into the structure of healthcare and VA support operations beyond the local Safety Office, preventing those facilities from progressing from merely closing safety findings to proactively managing safety programs based on risk, which leads to more consistent EOSH risk reduction. Additionally, while EOSH best practices abound across the VA, there are limited standard approaches or centralized data sets/platforms that enable facilities to rapidly identify, adapt, and apply best practices to meet unique requirements and reduce program risk. The lack of an Enterprise Data platform supporting Enterprise VA-standardized management EOSH requirements, prevents facilities, Veterans Integrated Service Networks (VISNs) and Staff Offices from leveraging the data across the enterprise both to identify trends and areas of greater risks more rapidly and to gain economies in time spent developing local database systems to manage data and predictive analysis to reduce program and operational risks.

The VA Center for Enterprise Human Resource Information Services (CEHRIS) has a requirement for Brand Name Cority GX2 or Equivalent Software as a Service (SaaS) application to meet the VA enterprise’s EOSH data requirements. The solution should provide an integrated SaaS platform capable of supporting safety, industrial hygiene (IH), ergonomics, workflow automation, reporting, and advanced data analytics within an integrated system. This solution should allow facilities to identify, adapt, and implement best practices to meet specific needs and mitigate risks across the VA enterprise. Additionally, the solution will adhere to VA directives 7700, 7701, 7702, and 7703, which define responsibilities for Occupational Safety and Health Administration (OSHA) programs, latex allergy prevention, Industrial Hygiene, and Safety and Health Management Systems.

The VA CEHRIS Team successfully completed a Proof-of-Concept for Cority GX2, which confirmed that the platform met VA’s needs for managing EOSH requirements. The proof of concept included: Capability Discovery, Identification, initial business requirements documentation and configuration of a Minimum Viable Product (MVP) for Incident Reporting. Cority GX2 has received VA Authority to Operate (ATO) approval. Any offered Brand Name Cority GX2 or Equivalent SaaS solution should provide the same or greater capabilities necessary to support enterprise deployment, module configuration, integrations, and year-over-year subscription adjustments based on VA Enterprise requirements. The period of performance for this requirement shall be one 12-month base period, four 12-month option periods, and one optional task.

Because the required solution is a SaaS application that will process, store, transmit, and access VA data, the Contractor should comply with all applicable VA information, security, privacy, data handling, Federal Risk and Authorization Management Program (FedRAMP), and ATO requirements. The requirements below apply to any offered Brand Name Cority GX2 or Equivalent solution and are intended to ensure the solution can securely support VA enterprise EOSH operations prior to full production use.

DATA HANDLING FOR USING DEVICES:

· User Consent: Users who use the product shall consent to share their data, which may include Personally Identifiable Information (PII) and Protected Health Information (PHI), directly with the SaaS provider.

· Published Terms: The SaaS provider shall have published terms and conditions for user consent.

· Data Ownership: All data processed by the SaaS provider shall be owned by the Veterans Affairs.

· Revocation: Users shall have the ability to revoke data sharing with the SaaS provider at any point.

· Data Backup & Recovery The solution must include automated, encrypted backups with defined recovery time objectives (RTO) and recovery point objectives (RPO). The vendor must document their disaster recovery procedures and test recovery processes regularly.

· Prohibited Data Practices The vendor shall not share, analyze, mine, or repurpose VA data for commercial purposes, including analytics, AI model training, or third-party integrations, without express written consent from the VA.

· Access from End-User Devices The solution must be compatible with VA-authorized endpoints and accessible via web-based interfaces secured through encrypted channels. The vendor must not store data on local devices, cache sensitive data, or allow offline access to SPI, PII, or PHI.

· Section 508 Accessibility Compliance The platform’s user interface and documentation must be fully compliant with Section 508 of the Rehabilitation Act, ensuring accessibility for users with disabilities.

· Incident Response & Breach Notification The vendor must adhere to VA Handbook 6500.2 regarding incident response. Any suspected or confirmed breach must be reported to the VA ISO within one hour and followed by a root cause analysis and remediation report.

· User Authentication The system shall integrate with VA Single Sign-On (SSO) and enforce multi-factor authentication (MFA) using PIV credentials or Derived PIV as required by VA Handbook 6510 and HSPD-12.

· Access Control The system must support role-based access controls (RBAC) with least privilege enforcement. Administrative access shall be auditable, and access provisioning must align with VA-defined user roles and permissions.

FEDRAMP and ATO:

1. The information system solution selected by the Contractor shall comply with the Federal Information Security Management Act (FISMA) and have a current VA authorization.

2. The Contractor shall remain in compliance with FedRAMP requirements as mandated by Federal laws and policies, including making available any documentation, physical access, and logical access needed to support this requirement.

3. The FedRAMP Authorization level and existing VA ATO should be no less than the level required for this use case which has been defined as Moderate .

4. The Contractor shall, where applicable, assist with the VA ATO Sustainment Process to help maintain health and quality of agency authorization of the cloud service or migrated application.

5. The Contractor shall exclusively provide subscription licenses to FedRAMP authorized and VA authorized environments.

6. If new or unanticipated vulnerabilities are discovered by either VA or the Contractor, or if existing safeguards have ceased to function, the discoverer shall bring the situation to the attention of the other party within one hour in accordance with Addendum B, VA Information and Information System Security/Privacy Language. VA Privacy and Security deliverables as directed by the VA System owner.

7. The Contractor shall comply with FedRAMP data management requirements.

8. Successful issuance of a VA ATO will be required before live VA data can be used in the system.

9. The Contractor shall participate in FedRAMP Continuous Monitoring activities as outlined by FedRAMP’s Continuous Monitoring Strategy Guide found on the FedRAMP Website.

10. The Contractor shall upload continuous monitoring artifacts to the FedRAMP Document Repository (“App Central”) on a monthly basis, no later than 30 days following the previous submission, including:

a. Credentialed vulnerability scan reports (including OS/infrastructure, web applications, databases, and containers).

b. Updated Plan of Action & Milestones (POA&M) entries.

VA staff and Authorizing Officials will access these deliverables directly via the FedRAMP portal; no separate delivery of these monthly artifacts to VA is required..

11. The Contractor shall participate in monthly Agency and FedRAMP Sustainment meetings following the granting of a VA ATO.

12. The Contractor shall provide the VA a monthly license utilization report detailing active number of and type of VA subscriptions in use no later than 10 days after the first day of the month.

Deliverables:

A. Monthly VA License Report

REQUIRED PRODUCT CONFIGURATION AND ESTIMATED QUANTITIES

The VA requires a Brand Name Cority GX3 or Equivalent SaaS solution that provides the following software technical/functional capabilities:

· Full suite of Industrial Hygiene system capabilities

· Full suite of Safety system capabilities

· Administrative support capabilities

· Portal access to review and submit data

The functionalities must be provided on a single, consolidated platform.

Table 1: Brand Name Cority GX2 or Equivalent Deliverables

The VA requires the following software program/operational capabilities:

· VA requires SaaS offering that is FedRamp Certified – Moderate or higher. Provide full data input, reporting, and other system functional capabilities for VA EOSH professional staff, and functional access for all VA staff (e.g., up to current staff of over +470,000 personnel) for emergency and safety incident reporting. These functional capabilities must be user accessible and hardware agnostic (e.g., PC, Tablet, Cellular Phone).

· Enable data sharing across all functional EOSH capabilities and all VA organizational levels in each of the five (5) VA Administrations at the VA facility, regional (i.e., VISN and Central Office level).

· Provide detailed analytical capabilities, to include predictive analysis, that provides advanced computational capabilities and Bayesian support analysis in the IH application and data reporting, trending, and visualization (e.g., summary dashboards) across all functional EOSH capabilities.

· Support connectivity to numerous EOSH assessment tools, equipment, and other resources (e.g., respiratory protection fit testing and analytical laboratories) and to established VA data system platforms through either Application Programming Interfaces (APIs) or backend data intake.

a. Maximize the best technical capability across the EOSH functional capabilities with predictive analysis to drive an enterprise-level EOSH data information system across the VA.

b. Provide needed capability in a single platform, allowing for improved data sharing, dashboarding and reporting while minimizing customizations due OOTB capabilities allowing for robust configuration.

OPTIONAL TASK, OPTION PERIODS 1 – 4 - ADDITIONAL SOFTWARE LICENSES AND RELATED SERVICES The following table identifies the representative Brand Name and Equivalent Cority GX2 product configurations and estimated not-to-exceed ceiling quantities that support the technical/functional capabilities required by this PD. Offerors proposing an equal product shall clearly demonstrate that the proposed solution provides the same or greater capabilities and meets all requirements identified in this PD.

Table 2: Brand Name Cority GX2 or Equivalent Deliverables – Optional Task

SALIENT CHARACTERISTICS

The salient characteristics below are the critical features that satisfy the VA's comprehensive requirements, guaranteeing a robust, scalable, and user-focused solution for effective data management and process automation.

These salient characteristics and the corresponding requirements they fulfill are detailed as follows:

CONFIGURABLE

a) The system shall provide configurable incident reporting workflows based on VA operational models, achieved through configuration rather than customization.

b) The system shall include configurable equipment and asset management module to support instrumentation tracking, inventory scheduling, and operational compliance.

c) The system shall allow creation and control of differentiated user groups (e.g., Safe Patient Handling Coordinators versus OSHA Recordkeepers) with role-based access segmentation.

d) The system shall support configuration of exposure assessment, hazard logging, and job hazard analysis workflows in alignment with site-specific safety operations.

e) The system shall enable configuration of pop-up alerts for OSHA-reportable events, guiding users to meet regulatory reporting timelines.

f) The system shall integrate with VA Approved Data Sources (ADS) and systems of records through API integrations

SAAS PLATFORM

a) The system shall support multi-tenant architecture with VA-specific data isolation and administrative governance.

b) It shall integrate securely with enterprise VA systems via RESTful APIs and enable Single Sign-On (SSO) using PIV or Derived PIV credentials in alignment with Zero Trust security principles.

c) The SaaS platform shall provide VA administrators with tools to manage access control, configure workflows, audit system use, and monitor data quality through an intuitive console.

d) The solution shall support data export in open and structured formats and meet all VA Directive 6500, FISMA, and NIST-based IT compliance standards.

CONSOLIDATED PLATFORM

a) The platform shall include configurable, role-based dashboards that provide integrated business intelligence aligned with facility, VISN, and national needs.

b) The system shall serve as a centralized location for reviewing inspection records, safety trends, and performance metrics from Safety and AWE inspections.

c) Corrective action tracking must be embedded across all modules to support traceable updates and ensure enterprise-wide accountability for safety interventions.

NOTIFICATION OF PROCESSES

a) The system shall generate alerts and notifications based on thresholds, user role, incident severity, or overdue actions.

b) It shall include scheduling and communication functionality for safety review boards and executive oversight groups to receive regular case updates.

c) The platform shall support configurable high-profile event alerts for scenarios such as fatalities, outbreaks, or large-scale environmental incidents

ANALYTICS

a) The system shall provide root cause analytics with “What If” simulation capabilities to guide cost reduction and injury prevention strategies.

b) The platform shall include a configurable CDSO dashboard summarizing training status, injury origin, and involvement of occupational health resources.

c) The system shall include a Data Quality Score metric for measuring data accuracy, completeness, and consistency, with benchmarking support.

d) The platform shall support OSHA- and ACGIH-compliant visualization of qualitative and quantitative exposure data for analysis and reporting.

MOBILE ACCESS

a) The system shall allow users to assign, complete, and document inspections, audits, and safety tasks from mobile devices at the facility level.

b) The solution shall support integration with third-party hardware (e.g., noise dosimeters, gas detectors, tablets) for rapid data entry during field assessments.

c) The platform shall allow secure data transmission and device interoperability with minimal configuration to support efficient and compliant workflows.

NOTICE OF THE FEDERAL ACCESSIBILITY LAW AFFECTING ALL INFORMATION AND COMMUNICATION TECHNOLOGY (ICT) PROCUREMENTS (SECTION 508) On January 18, 2017, the Access Board issued a final rule that updated accessibility requirements covered by Section 508 and refreshed guidelines for telecommunications equipment subject to Section 255 of the Communications Act. The final rule went into effect on January 18, 2018. The revisions and updates to the Section 508-based standards and Section 255-based guidelines are intended to ensure that information and communication technology (ICT) covered by the respective statutes is accessible to and usable by individuals with disabilities.

SECTION 508 – INFORMATION AND COMMUNICATION TECHNOLOGY (ICT) STANDARDS

The Section 508 standards established by the Access Board are incorporated into, and made part of all VA orders, solicitations and purchase orders developed to procure ICT. These standards are found in their entirety at: Revised 508 Standards and 255 Guidelines (access-board.gov). A single PDF file version of the Revised Section 508 Standards and 255 Guidelines will be supplied upon request, or can be obtained from the Access Board website. Federal agencies must comply with the Rehabilitation Act of 1973, as amended.

The Contractor shall comply with “508 Chapter 2: Scoping Requirements” for all electronic ICT and content delivered under this contract. Specifically, as appropriate for the technology and its functionality, the Contractor shall comply with the technical standards marked here:

COMPATABILITY WITH ASSISTIVE TECHNOLOGY

The standards do not require installation of specific accessibility-related software or attachment of an assistive technology device. Section 508 requires that ICT be compatible with such software and devices so that ICT can be accessible to and usable by individuals using assistive technology, including but not limited to screen readers, screen magnifiers, and speech recognition software.

ACCEPTANCE AND ACCEPTANCE TESTING

Deliverables resulting from this solicitation will be accepted based in part on satisfaction of the Section 508 Chapter 2: Scoping Requirements standards identified above.

The Government reserves the right to test for Section 508 Compliance before delivery. The Contractor shall be able to demonstrate Section 508 Compliance upon delivery.

GENERAL REQUIREMENTS

VA TECHNICAL REFERENCE MODEL

The Contractor shall comply with the VA OIT Technical Reference Model (VA TRM). Compliance with the VA TRM is achieved by using only technologies and standards that are listed as approved for use in the VA TRM. The Contractor shall provide all necessary information requested by VA to ensure TRM approval is obtained prior to use on VA’s network.

ZERO TRUST – VA CRITICAL SECURITY CONTROLS

VA has established minimum mandatory security requirements and requires that any network connected software system or service must meet the VA Critical Security Controls as outlined in the VA Memorandum, “VA Security Controls”, https://www.voa.va.gov/DocumentView.aspx?DocumentID=5010. VA Critical Security Controls identify the minimum mandatory requirements that must be implemented across all VA enterprise infrastructure, cloud computing environments, information systems, networks, and specialized devices (medical devices/systems, special-purpose systems, and research scientific computing devices) that process, store, and/or transmit VA data. Effective July 1, 2025, the Contractor shall implement these VA Critical Security Controls, within any network connected software system or service prior to being authorized for use in the VA. This functional requirement is not negotiable, and Plan of Action & Milestones (POAM) will not be accepted in the event these controls cannot be implemented for new systems. Critical Security Controls are intended to increase VA’s security posture and provide security and privacy risk visibility into the VA network and is not a new requirement. The Contractor’s failure to maintain these VA Critical Controls after implementation will result in VA discontinuing the use of the system.

SOCIAL SECURITY NUMBER (SSN) REDUCTION

The Contractor solution shall support the Social Security Number (SSN) Fraud Prevention Act (FPA) of 2017 which prohibits the inclusion of SSNs on any document sent by mail. The Contractor support shall also be performed in accordance with Section 240 of the Consolidated Appropriations Act (CAA) 2018, enacted March 23, 2018, which mandates VA to discontinue using SSNs to identify individuals in all VA information systems as the Primary Identifier. The Contractor shall ensure that any new IT solution discontinues the use of SSN as the Primary Identifier to replace the SSN with the Integrated Control Number (ICN) in all VA information systems for all individuals. The Contractor shall ensure that all Contractor delivered applications and systems integrate with the VA Master Person Index (MPI) for identity traits to include the use of the ICN as the Primary Identifier. The Contractor solution may only use a Social Security Number to identify an individual in an information system if and only if the use of such number is required to obtain information VA requires from an information system that is not under the jurisdiction of VA.

INTERNET PROTOCOL VERSION 6 (IPV6)

The Contractor solution shall support IPv6-Only based upon the memo issued by the Office of Management and Budget (OMB) on November 19, 2020 (https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-07.pdf). Which defines IPv6-only as the state of an operational system or service when IPv4 protocol functions (addressing, packet forwarding) are not in use. The NIST USGv6 profile defines technical requirements for a product to be capable of operating in IPv6-Only environments. IPv6-Only technology, in accordance with the USGv6 Program (https://www.nist.gov/programs-projects/usgv6-program/usgv6-revision-1), NIST Special Publication (SP) 500-267B Revision 1 “USGv6 Profile” (https://doi.org/10.6028/NIST.SP.500-267Br1), and NIST SP 800-119 “Guidelines for the Secure Deployment of IPv6” (https://doi.org/10.6028/NIST.SP.800-119), compliance shall be included in all IT infrastructures, application designs, application development, operational systems and sub-systems, and their integration. In addition to the above requirements, all devices, applications, and systems shall support all applicable functionality on native IPv6-Only as well as dual stack (IPv6 / IPv4) connectivity without additional memory or other resources being provided by the Government, so that they can function in a mixed environment. All public/external facing servers and services (e.g., web, email, DNS, ISP services, etc.) shall support native IPv6-Only and dual stack (IPv6 / IPv4) users and all internal infrastructure and applications shall support using native IPv6-Only and dual stack (IPv6 / IPv4) for all functionality and operations.

TRUSTED INTERNET CONNECTION (TIC)

The Contractor solution shall meet the requirements outlined in Office of Management and Budget Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative“ (https://www.whitehouse.gov/wp-content/uploads/2019/09/M-19-26.pdf), VA Directive 6513 “Secure External Connections”, and shall comply with the TIC 3.0 Core Guidance Documents, including all Volumes and TIC Use Cases, found at the Cybersecurity & Infrastructure Security Agency (CISA) (https://www.cisa.gov/publication/tic-30-core-guidance-documents.)

GENERATIVE ARTIFICIAL INTELLIGENCE REQUIREMENTS

If Artificial Intelligence (AI) is part of the Contractor system/solution, the Contractor shall be in compliance with E.O. 13960 and 14319, OMB Memorandums M-25-21, M-25-22, and M-26-04, and VA Directive and Handbook 6500 to support VA in trustworthy, secure, responsible, accountable, Truth Seeking, and Ideologically Neutral AI innovation.

No web-based, publicly available generative AI service has been approved for use with VA-sensitive data including, but not limited to OpenAI’s ChatGPT, Microsoft’s Copilot, Google’s Gemini, and Anthropic’s Claude. No PII, protected health information (PHI), or VA-sensitive data should be entered into these unapproved services. The entire definition of VA Sensitive Data can be found at 38 U.S.C. § 5727 (23). The Contractor shall protect VA Sensitive data from unauthorized disclosure or use, and from being used to train or improve the functionality of the vendor's commercial offerings without express permission from VA. Only VA-hosted instances of generative AI services may be approved for use with VA-sensitive data.

The Contractor shall deliver the services, technical data, configurations, models, weights, documentation or other information, including source code, developed during contract performance. The Contractor, in collaboration with VA, must evaluate the output of any AI tool for accuracy prior to using the output in VA efforts. All data, including models, weights, algorithms, and outputs generated using either Government-furnished data or data first developed under this contract shall be the property of the Government with unlimited rights as defined by FAR 52.227-14. The Contractor shall also deliver any custom-developed code developed with AI methodologies in accordance with the SHARE IT Act, if applicable. VA shall also retain unlimited rights to any improvements to that data, including the continued design, development, testing, and operation of AI systems and/or systems utilizing AI.

The Contractor shall ensure that all AI Systems, including Large Language Models (LLM), whether standalone LLMs or integrated into broader software platforms, procured under this effort and/or used in performance of this contract complies with the Unbiased AI Principles as defined in Executive Order 14319 and OMB Memorandum M-26-04, e.g. Truth Seeking and Ideologically Neutral, as applicable to the intended use of the system.

The Contractor shall ensure that AI System/LLM generated outputs are truthful in responding to user prompts seeking factual information or analysis, prioritize historical accuracy, scientific inquiry, and objectivity, as well as acknowledge uncertainty where reliable information is incomplete or contradictory and do not fabricate, hallucinate, or present unverifiable information as fact.

The Contractor shall ensure that LLMs and AI outputs are neutral, nonpartisan tools that do not manipulate responses in favor of ideological dogmas such as Diversity, Equity, and Inclusion (DEI). The Contractor shall ensure that the LLMs, including the AI System, are not intentionally encoded with partisan or ideological judgments within an AI System’s/LLM’s outputs unless those judgments are prompted by or otherwise readily accessible to the end user.

Compliance with the AI requirements of this contract, including adherence to the Unbiased AI Principles, Truth-Seeking and Ideological Neutrality requirements, disclosure obligations, monitoring and reporting requirements, and corrective action responsibilities, is a material condition of eligibility for payment and continued performance. In accordance with OMB Memorandum M-26-04, failure to comply with these requirements, or refusal to take timely and appropriate corrective action to remedy identified noncompliance, may constitute a material breach of contract and may result in remedies consistent with the terms of the contract and applicable law including but not limited to withholding of payment, termination for cause/default, or other appropriate contractual remedies, as determined by the Contracting Officer.

All AI for delivery and/or use in performance of the contract shall adhere to the VA Trustworthy AI Framework, available at https://department.va.gov/ai/trustworthy/. Once the Contractor has obtained CO authorization to use specific AI in contract performance, the Contractor shall provide the COR a signed Statement of Attestation prior to AI implementation as identified in the Artificial Intelligence in VA Contracts clause, to include its associated list of AI being used in contract performance.

Deliverable:

1. Statement of Attestation

AI SYSTEM/LLM DEVELOPMENT AND OPERATION DOCUMENTATION REQUIREMENTS

To enable Government continued assessment of compliance with Trustworthy AI requirements and both Unbiased AI Principles, Truth-seeking and Ideological Neutrality, in accordance with OMB M-26-04, the Contractor shall provide AI System/LLM Development and Operation Documentation Package to include, at a minimum:

1. Acceptable Use Policy The Contractor shall provide an Acceptable Use Policy document governing its AI operation that characterizes and differentiates appropriate and inappropriate use of their product offering

1. Model Cards, System Cards and/or Data Cards The Contractor shall provide documentation describing essential information about the model, system, and or data as it relates to the AI/LLM product offering. The documentation shall address summaries of training process, identified risks and mitigations, and model evaluation scores on LLM benchmarks at a minimum, where appropriate

1. End User Resources The Contractor shall provide documentation to include product tutorials, developer guides, and/or other tools to assist VA in ensuring proper use of the AI/LLM to maximize utility

1. Mechanism for End User Feedback The Contractor shall provide documentation describing the mechanism employed to provide feedback to the Offeror on outputs identified that violate the Unbiased AI Principles. This may be satisfied by a general inbox, specific Point of Contact, or similar feedback mechanism.

Deliverable:

A. AI System/LLM Development and Operation Documentation Package

MONITORING, REPORTING, AND CORRECTIVE ACTION

The Contractor shall develop and implement a Compliance Monitoring and Reporting Plan supporting ongoing monitoring processes to evaluate AI outputs for compliance with Trustworthy AI and Unbiased AI principles. This plan shall include the mechanism for authorized users to provide end user feedback to report suspected violations of Truth-Seeking or Ideological Neutrality requirements.

The Contractor shall notify the COR within 10 business days of identifying any material deviation from these principles and shall submit a written Corrective Action Plan describing mitigation steps, responsible parties, and timelines. Any material deviation, corrective action taken, and results shall be detailed in a Monthly Progress Reports.

Deliverable:

1. Compliance Monitoring and Reporting Plan

1. Corrective Action Plan

1. Monthly Progress Reports

AI MODEL UPDATES AND CHANGE DISCLOSURES

The Contractor, in an AI Model/LLM Change Disclosure, shall notify the Government throughout the PoP in advance of any material changes to AI models, including new AI enhancements, features and/or components, controls, retraining, classifiers, system prompts, fine-tuning, content moderation, filters, version replacement, or architectural changes, that could reasonably affect compliance with Trustworthy AI or Unbiased AI principles. Updated documentation shall be provided to VA for VA approval prior to implementation of such changes.

Deliverable:

1. AI Model/LLM Change Disclosure

POINTS OF CONTACT

Contracting Officer:

Contract Specialist:

Name: Erin Butler

ADDENDUM B – VA INFORMATION AND INFORMATION SYSTEM SECURITY/ PRIVACY LANGUAGE

NOTE: In the event of a conflict, VA Acquisition Regulation (VAAR) Security Clauses take precedence over the language in this Addendum B.

APPLICABLE SECTIONS TAILORED FROM: VA NOTICE 24-12, APRIL 22, 2024, UPDATE TO VA HANDBOOK 6500.6, CONTRACT SECURITY, APPENDIX C VA INFORMATION AND INFORMATION SYSTEM SECURITY/PRIVACY LANGUAGE, FOR INCLUSION INTO CONTRACTS, AS APPROPRIATE

GENERAL

This entire section applies to all acquisitions requiring any Information Security and Privacy language. Contractors, contractor personnel, Subcontractors and subcontractor personnel will be subject to the same federal laws, regulations, standards, VA directives and handbooks, as VA personnel regarding information and information system security and privacy.

VA INFORMATION CUSTODIAL LANGUAGE

a. The Government shall receive unlimited rights to data/intellectual property first produced and delivered in the performance of this contract or order (hereinafter “contract”) unless expressly stated otherwise in this contract. This includes all rights to source code and all documentation created in support thereof. The primary clause used to define Government and Contractor data rights is FAR 52.227-14 Rights in Data – General.

b. Information made available to the Contractor by VA for the performance or administration of this contract will be used only for the purposes specified in the service agreement, SOW, PWS, PD, and/or contract. The Contractor shall not use VA information in any other manner without prior written approval from a VA Contracting Officer (CO). The primary clause used to define Government and Contractor data rights is FAR 52.227-14 Rights in Data – General.

c. VA information will not be co-mingled with any other data on the Contractor’s information systems or media storage systems. The Contractor shall ensure compliance with Federal and VA requirements related to data protection, data encryption, physical data segregation, logical data segregation, classification requirements and media sanitization.

d. VA reserves the right to conduct scheduled or unscheduled audits, assessments, or investigations of Contractor Information Technology (IT) resources to ensure information security is compliant with Federal and VA requirements. The Contractor shall provide all necessary access to records (including electronic and documentary materials related to the contracts and subcontracts) and support (including access to Contractor and Subcontractor staff associated with the contract) to VA, VA's Office Inspector General (OIG), and/or Government Accountability Office (GAO) staff during periodic control assessments, audits, or investigations.

e. The Contractor may only use VA information within the terms of the contract and applicable Federal law, regulations, and VA policies. If new Federal information security laws, regulations or VA policies become applicable after execution of the contract, the parties agree to negotiate contract modification and adjustment necessary to implement the new laws, regulations, and/or policies.

f. The Contractor shall not make copies of VA information except as specifically authorized and necessary to perform the terms of the contract. If copies are made for restoration purposes, after the restoration is complete, the copies shall be destroyed in accordance with VA Directive 6500, VA Cybersecurity Program and VA Information Security Knowledge Service.

g. If a Veterans Health Administration (VHA) contract is terminated for default or cause with a business associate, the related local Business Associate Agreement (BAA) shall also be terminated and actions taken in accordance with VHA Directive 1605.05, Business Associate Agreements. If there is an executed national BAA associated with the contract, VA will determine what actions are appropriate and notify the contractor.

h. The Contractor shall store and transmit VA sensitive information in an encrypted form, using VA-approved encryption tools which are, at a minimum, Federal Information Processing Standards (FIPS) 140-2, Security Requirements for Cryptographic Modules (or its successor) validated and in conformance with VA Information Security Knowledge Service requirements. The Contractor shall transmit VA sensitive information using VA approved Transport Layer Security (TLS) configured with FIPS based cipher suites in conformance with National Institute of Standards and Technology (NIST) 800-52, Guidelines for the Selection, Configuration and Use of Transport Layer Security (TLS) Implementations.

i. The Contractor’s firewall and web services security controls, as applicable, shall meet or exceed VA’s minimum requirements.

j. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the Contractor may use and disclose VA information only in two situations: (i) in response to a qualifying order of a court of competent jurisdiction after notification to VA CO (ii) with written approval from the VA CO. The Contractor shall refer all requests for, demands for production of or inquiries about, VA information and information systems to the VA CO for response.

k. Notwithstanding the provision above, the Contractor shall not release VA records protected by Title 38 U.S.C. § 5705, Confidentiality of medical quality-assurance records and/or Title 38 U.S.C. § 7332, Confidentiality of certain medical records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse or infection with Human Immunodeficiency Virus (HIV). If the Contractor is in receipt of a court order or other requests for the above-mentioned information, the Contractor shall immediately refer such court order or other requests to the VA CO for response.

l. Information made available to the Contractor by VA for the performance or administration of this contract or information developed by the Contractor in performance or administration of the contract will be protected and secured in accordance with VA Directive 6500 and Identity and Access Management (IAM) Security processes specified in the VA Information Security Knowledge Service.

m. Any data destruction done on behalf of VA by a Contractor shall be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management, VA Handbook 6300.1, Records Management Procedures, and applicable VA Records Control Schedules.

n. The Contractor shall provide its plan for destruction of all VA data in its possession according to VA Directive 6500 and NIST 800-88, Guidelines for Media Sanitization prior to termination or completion of this contract. If directed by the COR/CO, the Contractor shall return all Federal Records to VA for disposition.

o. Any media, such as paper, magnetic tape, magnetic disks, solid state devices or optical discs that is used to store, process, or access VA information that cannot be destroyed shall be returned to VA. The Contractor shall hold the appropriate material until otherwise directed by the Contracting Officer’s Representative (COR) or CO. Items shall be returned securely via VA-approved methods. VA sensitive information must be transmitted utilizing VA-approved encryption tools which are validated under FIPS 140-2 (or its successor) and NIST 800-52. If mailed, the Contractor shall send via a trackable method (USPS, UPS, FedEx, etc.) and immediately provide the COR/CO with the tracking information. Self-certification by the Contractor that the data destruction requirements above have been met shall be sent to the COR/CO within 30 business days of termination of the contract.

p. All electronic storage media (hard drives, optical disks, CDs, back-up tapes, etc.) used to store, process or access VA information will not be returned to the Contractor at the end of lease, loan, or trade-in. Exceptions to this paragraph will only be granted with the written approval of the VA CO.

ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS

a. A Contractor/Subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees and subcontractors only to the extent necessary to perform the services specified in the solicitation or contract. This includes indirect entities, both affiliate of Contractor/Subcontractor and agent of Contractor/Subcontractor.

b. Contractors and subcontractors shall sign the VA Information Security Rule of Behavior (ROB) before access is provided to VA information and information systems (see Section 4, Training, below). The ROB contains the minimum user compliance requirements and does not supersede any policies of VA facilities or other agency components which provide higher levels of protection to VA’s information or information systems. Users who require privileged access shall complete the VA elevated privilege access request processes before privileged access is granted.

c. All Contractors and Subcontractors working with VA information are subject to the same security investigative and clearance requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors shall be in accordance with VA Directive and Handbook 0710, Personnel Vetting Program. The Office of Human Resources and Administration/Operations, Security and Preparedness (HRA/OSP) is responsible for these policies and procedures. Contract personnel who require access to classified information or information systems shall have an appropriate security clearance. Verification of a Security Clearance shall be processed through the Special Security Officer located in HRA/OSP. Contractors shall conform to all requirements stated in the National Industrial Security Program Operating Manual (NISPOM).

d. All Contractors and subcontractors shall comply with conditions specified in VAAR 852.204-71(d); Contractor operations required to be in United States. All Contractors and Subcontractors working with VA information must be permanently located within a jurisdiction subject to the law of the United States or its Territories to the maximum extent feasible. If services are proposed to be performed abroad the Contractor must state where all non-U.S. services are provided. The Contractor shall deliver to VA a detailed plan specifically addressing communications, personnel control, data protection and potential legal issues. The plan shall be approved by the COR/CO in writing prior to access being granted.

e. The Contractor shall notify the COR/CO in writing immediately (no later than 24 hours) after personnel separation or occurrence of other causes. Causes may include the following:

(1) Contractor/Subcontractor personnel no longer has a need for access to VA information or VA information systems.

(2) Contractor/Subcontractor personnel are terminated, suspended, or otherwise has their work on a VA project discontinued for any reason.

(3) Contractor believes their own personnel or Subcontractor personnel may pose a threat to their company’s working environment or to any company-owned property. This includes Contractor-owned assets, buildings, confidential data, customers, employees, networks, systems, trade secrets and/or VA data.

(4) Any previously undisclosed changes to Contractor/Subcontractor background history are brought to light, including but not limited to changes to background investigation or employee record.

(5) Contractor/Subcontractor personnel have their authorization to work in the United States revoked.

(6) Agreement by which Contractor provides products and services to VA has either been fulfilled or terminated, such that VA can cut off electronic and/or physical access for Contractor personnel.

f. In such cases of contract fulfillment, termination, or other causes; the Contractor shall take the necessary measures to immediately revoke access to VA network, property, information, and information systems (logical and physical) by Contractor/Subcontractor personnel. These measures include (but are not limited to): removing and then securing Personal Identity Verification (PIV) badges and PIV – Interoperable (PIV-I) access badges, VA-issued photo badges, credentials for VA facilities and devices, VA-issued laptops, and authentication tokens. Contractors shall notify the appropriate VA COR/CO immediately to initiate access removal.

g. Contractors/Subcontractors who no longer require VA accesses will return VA-issued property to VA. This property includes (but is not limited to): documents, electronic equipment, keys, and parking passes. PIV and PIV-I access badges shall be returned to the nearest VA PIV Badge Issuance Office. Once they have had access to VA information, information systems, networks and VA property in their possessions removed, Contractors shall notify the appropriate VA COR/CO.

TRAINING

a. All contractors and subcontractors requiring access to VA information and VA information systems shall successfully complete the following before being granted access to VA information and its systems:

(1) VA Privacy and Information Security Awareness and Rules of Behavior course (Talent Management System (TMS) #10176) initially and annually thereafter.

(2) Sign and acknowledge (electronically through TMS #10176) understanding of and responsibilities for compliance with the Organizational Rules of Behavior, relating to access to VA information and information systems initially and annually thereafter; and

(3) Successfully complete any additional cyber security or privacy training, as required for VA personnel with equivalent information system or information access [to be defined by the VA program official and provided to the VA CO for inclusion in the solicitation document – i.e., any role-based information security training].

b. The Contractor shall provide to the COR/CO a copy of the training certificates and certification of signing the Organizational Rules of Behavior for each applicable employee within five days of the initiation of the contract and annually thereafter, as required.

c. Failure to complete the mandatory annual training is grounds for suspension or termination of all physical or electronic access privileges and removal from work on the contract until such time as the required training is complete.

SECURITY INCIDENT INVESTIGATION

a. The Contractor, Subcontractor, their employees, or business associates shall immediately (within one hour) report suspected security / privacy incidents to the VA OIT’s Enterprise Service Desk (ESD) by calling (855) 673-4357 (TTY: 711). The ESD is OIT’s 24/7/365 single point of contact for IT-related issues. After reporting to the ESD, the Contractor, Subcontractor, their employees, or business associates shall, within one hour, provide the COR/CO the incident number received from the ESD.

b. To the extent known by the Contractor/Subcontractor, the Contractor/Subcontractor's notice to VA shall identify the information involved and the circumstances surrounding the incident, including the following:

(1) The date and time (or approximation of) the Security Incident occurred.

(2) The names of individuals involved (when applicable).

(3) The physical and logical (if applicable) location of the incident.

(4) Why the Security Incident took place (i.e., catalyst for the failure).

(5) The amount of data belonging to VA believed to have been compromised.

(6) The remediation measures the Contractor is taking to ensure no future incidents of a similar nature.

c. After the Contractor has provided the initial detailed incident summary to VA, they will continue to provide written updates on any new and relevant circumstances or facts they discover. The Contractor, Subcontractor, and their employes shall fully cooperate with VA or third-party entity performing an independent risk analysis on behalf of VA. Failure to cooperate may be deemed a material breach and grounds for contract termination.

d. VA IT Contractors shall follow VA Handbook 6500, Risk Management Framework for VA Information Systems VA Information Security Program, and VA Information Security Knowledge Service guidance for implementing an Incident Response Plan or integrating with an existing VA implementation.

e. In instances of theft or break-in or other criminal activity, the Contractor/Subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG, and the VA Office of Security and Law Enforcement. The Contractor, its employees, and its Subcontractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The Contractor/Subcontractor shall cooperate with VA in any civil litigation to recover VA information, obtain monetary or other compensation from a third party for damages arising from any incident, or obtain injunctive relief against any third party arising from, or related to, the incident.

f. The Contractor shall comply with VA Handbook 6500.2, Management of Breaches Involving Sensitive Personal Information, which establishes the breach management policies and assigns responsibilities for the oversight, management and reporting procedures associated with managing of breaches.

g. With respect to unsecured Protected Health Information (PHI), the Contractor is deemed…