DRAFT PERFORMANCE WORK STATEMENT.pdf

PERFORMANCE WORK STATEMENT

Title: OAWP Investigative Interview Transcription Services

1. BACKGROUND

The Department of Veterans Affairs (VA), Office of Accountability and Whistleblower Protection (OAWP), promotes and improves accountability through unbiased investigations of allegations involving senior-leader retaliation, misconduct, poor performance, and whistleblower retaliation by VA supervisors. To support these investigations, OAWP requires professional transcription of approximately 1,400 recorded interviews each year.

2. SCOPE OF WORK

The Contractor shall provide all personnel, equipment, systems, and other resources needed to transcribe OAWP-furnished audio and/or video recordings of testimony and investigative interviews. Services shall be virtual using a mutually agreed, VA-approved platform. The Contractor shall provide timely, accurate, secure, professionally formatted transcripts suitable for official Government case files. The Contractor shall access only specifically assigned recordings, not other records within an investigative case folder.

The anticipated workload is approximately 1,400 interviews annually. Unless otherwise directed by the designated Ordering Representative or Contracting Officer’s Representative

(COR), a completed transcript package shall be delivered within one business day after assignment. The deliverable and quality criteria are specified in Sections 7, 8, and 12.

3. CONTRACT TYPE

Firm Fixed Price

4. PERIOD OF PERFORMANCE

The period of performance is as follows:

Base Period: November 23, 2026 – November 22, 2027 Option Period 1: November 23, 2027 – November 22, 2028

5. PLACE OF PERFORMANCE

Work shall be performed virtually at Contractor-controlled locations using only a mutually agreed, VA-approved platform and secure transmission method. No onsite transcription services or Government-provided workspace are anticipated.

6. TRAVEL

Travel is not authorized for this requirement.

7. TASK STATEMENT

Tasks performed shall be of a non-personal nature. VA organizations will not provide supervision of contractor personnel. Contractor personnel shall at no time allow an employer-employee relationship to develop with VA organizations or their staff. VA organizations will refrain from any activities that create the appearance of such a relationship.

Contractors shall not perform inherently governmental functions including: decision-making, supervision of Government employees, supervision of other contractors on other contracts, and activities that create the appearance of performing such functions.

7.1 Kick Off Meeting

The Contractor shall conduct a kick off meeting 10 calendar days after contract award. The Contractor shall include the COR, Government Program Manager, and CO on the contract kick off invite. The Contractor shall generate the kick off agenda and meeting slides.

Deliverable:

Contract Kickoff Meeting

7.2 ASSIGNMENT COORDINATION AND NOTIFICATION

The Contractor shall provide an accurately transcribed electronic PDF package for each assigned recording. Assignment status, late deliveries, deficiencies, and corrective actions shall be reported to the COR/Ordering Representative as directed. A separate monthly progress report is not required unless expressly added to the awarded contract.

The COR/Ordering Representative will use the submission timestamps and quality-review results to monitor the timeliness and accuracy standards in this section 7 and section 12.

The Contractor shall promptly identify inability to meet an assignment’s required due date so that the Government can determine any authorized course of action.

Deliverable:

- An individual PDF transcript package for each assigned recording and any Government-directed status or corrective-action information.

7.3 TRANSCRIPTION SERVICES

The Contractor shall convert OAWP-furnished recorded speech into written text suitable for printing and use as an official record, investigative document, case file, or report. Each transcript shall accurately reflect the source recording, be professionally formatted, and include the elements below:

• Filler words such as “um,” “uh,” and other spoken utterances, when present in the source recording.

• Stuttering and repeated words, accurately captured.

• Portions that are inaudible or cannot reasonably be understood, clearly identified.

• Profane language used by interview participants, accurately transcribed.

• Language sufficient to document that the witness oath was administered and accepted; the entire oath need not be transcribed.

Deliverable: complete transcript and associated documents, in accordance with Sections

7.4 and 8.

7.4 TRANSCRIPT FORMAT AND DELIVERY

Each completed transcript shall use the OAWP-prescribed page format and include:

• Numbered text lines, no more than 25 lines per page.

• The full assigned case number in each page header (e.g., OAWP Case 26-

WashingtonDC-12345).

• Page numbers at the bottom right of each page.

• An errata sheet.

• An Acknowledgement of Testimony.

• Certification sheets.

• One electronic transcript and full package in PDF format, delivered to the Ordering

Representative/COR by an OAWP-designated secure mechanism, such as a VA-approved Box.com environment.

• All documents and applicable deliverables shall meet Section 508 requirements.

7.5 INFORMATION HANDLING AND DISPOSITION

The Contractor shall work only with assigned recordings and shall not access unrelated case-file materials. The Contractor shall maintain records and transcript deliverables on a secure system in accordance with Section 13 and any VA-approved security plan.

The Contractor shall securely retain the records for 30 days after delivery to OAWP. The

Contractor shall destroy the records after that period only after obtaining the required prior written VA authorization and complying with applicable VA records schedules, Directive

6300, and Section 13.3.3(c).

7.6 ORDERING AND CANCELLATIONS

Assignments may be issued by the COR or an Ordering Representative designated by the

Contracting Officer. A cancellation notice made within eight hours after placement of an order will not be subject to a cancellation fee.

7.7 TURNAROUND AND ACCURACY

The Contractor shall deliver 100 percent of assigned transcripts within one business day of assignment, unless otherwise directed by the COR/Ordering Representative. Transcripts shall accurately represent the recording and shall not require substantial correction.

Each Government-reviewed transcript shall achieve at least 97 percent accuracy. Accuracy

= [(total words reviewed − transcription errors) ÷ total words reviewed] × 100. An error includes a word omitted, inserted without being spoken, substituted, or materially mistranscribed. Required filler words, repetitions, and stuttering are part of the accuracy calculation. Words unintelligible because of recording quality may be excluded when agreed to by the COR. The Government will evaluate an entire transcript or a representative sample.

If a transcript is not delivered accurately within the required deadline, payment for that request shall be reduced by three percent for each business day beyond the one-business-day deadline. If another contractor must perform the unsatisfactory transcription request, the original contractor shall have no claim for payment for that request.

8. DELIVERY SCHEDULE

Task Deliverable Quantity Delivery Date

Kick Off Meeting

Kickoff meeting inclusive of agenda and presentations.

5 days after contract award for agenda and presentations and 10 days after contract award for kickoff meeting.

Electronic submission to: COR, CO

Transcription

PDF transcript and full package for each assigned recording

1 package per assignment;

approx. 1,400 interviews/year

Within one business day after

COR/Ordering

Representative assignment, unless otherwise directed

Quality Accuracy of reviewed transcript

At least 97% of words reviewed

With each transcript / as evaluated by

Government

Transcript format

Case number, numbered lines, pages, errata, acknowledgement, certification

Included with each applicable transcript package

At delivery

Secure delivery

PDF via approved secure channel

Each completed package

At delivery

Task Deliverable Quantity Delivery Date

Kick Off Meeting

Kickoff meeting inclusive of agenda and presentations.

5 days after contract award for agenda and presentations and 10 days after contract award for kickoff meeting.

Electronic submission to: COR, CO

Record disposition

Certificate of destruction

(subject to VA approval and records schedule)

For applicable data/record batch

Source proposes 30 days after delivery;

CO/Records review required

9. KEY PERSONNEL

N/A

10. OTHER DIRECT COSTS

No separately reimbursable other direct costs are proposed.

11. GOVERNMENT- FURNISHED EQUIPMENT/ MATERIALS/ FACILITIES/

INFORMATION

The Government will furnish the assigned audio and/or video recordings and relevant case identification information needed to produce each transcript. The Government will designate the authorized ordering official, transcript format, approved secure platform, and delivery mechanism. VA-provided workspace, laptops, telephones, and contractor network accounts are not anticipated.

Any Government-furnished equipment or VA network access required in performance shall be authorized separately and governed by applicable VA security, property-accountability, and access requirements. No access to unrelated investigative case folders is authorized.

The Contractor shall complete all applicable, VA-required information security and privacy training before access to VA systems or information is granted, as directed by the CO/COR and the approved security review.

Any Government-furnished property, if later authorized, shall be inventoried, protected, and returned at the conclusion of the contract in accordance with applicable VA property requirements.

12. QUALITY ASSURANCE SURVEILLANCE PLAN

The Government will assess contractor compliance with the measurable standards in this PWS through delivery-log review, transcript quality reviews, and documented customer complaints. The COR will record surveillance results and inform the CO of unacceptable performance. The controlling performance standards for this requirement are the one-business-day turnaround and at least 97-percent accuracy specified in Sections 7 and 12.

12.1 METHODS OF SURVEILLANCE

The COR may use the following surveillance methods to evaluate performance against the established standards:

1. 100% timeliness review. Check assignment and delivery timestamps for every transcript submitted during the period.

2. Accuracy review. Examine the entire transcript or a representative sample and apply the 97-percent word-accuracy formula in Section 7.6.

3. Complaint/exception review. Examine transcripts associated with validated deficiencies, late submissions, security concerns, or corrective actions.

12.2 FREQUENCY OF MEASUREMENT

The COR shall monitor delivery timeliness as transcripts are received and review accuracy on each transcript selected for inspection. Consolidated surveillance documentation will be retained by the COR.

12.3 ACCEPTABLE PERFORMANCE LEVELS (APLS)

Requirement Performance

Standard Surveillance

Method Outcome

TIMELY

DELIVERY

100% of assigned transcripts delivered within one business day unless otherwise directed

100% review of assignment and delivery timestamps

Late deliveries documented and elevated for CO review

TRANSCRIPTION

ACCURACY

At least 97% word accuracy for each

Government-reviewed transcript, calculated per

Section 7.6

Full or representative-sample transcript review

Transcript meets or does not meet accuracy threshold;

deficiencies documented

TRANSCRIPT

CONTENT

Filler words, stutter/repeats, inaudibles, profanity, and oath confirmation included as prescribed

Transcript review against source recording

Content requirements met; substantive omissions documented

Requirement Performance

Standard Surveillance

Method Outcome

FORMAT /

PACKAGE

Case number, numbered lines, 25 lines maximum/page, errata, acknowledgement, certification, page numbers

Document inspection

Complete PDF package ready for case use

SECURE

HANDLING

Delivery only over

Government-approved channel and no access to unrelated case material

Delivery/access records and security incident review

Any exception referred to COR/CO and security officials

DATA

DISPOSITION

Retention/destruction per approved VA instructions, records schedules and

Section 13.3.3

Review of

Government authorization and certificate of destruction

Documents disposed of only when approved;

certificate submitted

12.4 DOCUMENTING PERFORMANCE

Acceptable Performance The Government will document acceptable performance in accordance with the chart above. Any report may become a part of the supporting documentation for any contractual action.

Unacceptable Performance When unacceptable performance occurs, the COR shall inform the CO. This will always be in writing although when circumstances necessitate immediate verbal communication, that communication will be followed in writing. The COR shall document the discussion and place it in the COR file.

When the CO determines formal written communication is required, the COR shall prepare a Contract Discrepancy Report (CDR), and present it to the contractor's program manager.

The contractor shall acknowledge receipt of the CDR in writing to the CO. The CDR will state how long after receipt the contractor has to take corrective action. The CDR will also specify if the contractor is required to prepare a corrective action plan to document how the contractor shall correct the unacceptable performance and avoid a recurrence. The CO shall review the contractor's corrective action plan to determine acceptability.

Any CDRs may become a part of the supporting documentation for any contractual action deemed necessary by the CO.

13. SECURITY AND PRIVACY REQUIREMENTS

13.1 POSITION/TASK RISK DESIGNATION LEVEL(S)

Position Sensitivity

Background Investigation (in accordance with Department of Veterans Affairs 0710 Handbook, “Personnel Suitability and Security Program,” Appendix A)

Low / Tier 1 Tier 1 / National Agency Check with Written Inquiries (NACI) A Tier 1/NACI is conducted by OPM and covers a 5-year period. It consists of a review of records contained in the OPM Security Investigations Index (SII) and the DOD Defense Central Investigations Index (DCII), Federal Bureau of Investigation (FBI) name check, FBI fingerprint check, and written inquiries to previous employers and references listed on the application for employment. In VA it is used for Non-sensitive or Low Risk positions.

Moderate / Tier 2

Tier 2 / Moderate Background Investigation (MBI) A Tier 2/MBI is conducted by OPM and covers a 5-year period. It consists of a review of National Agency Check (NAC) records [OPM Security Investigations Index (SII), DOD Defense Central Investigations Index (DCII), FBI name check, and a FBI fingerprint check], a credit report covering a period of 5 years, written inquiries to previous employers and references listed on the application for employment; an interview with the subject, law enforcement check; and a verification of the educational degree.

High / Tier 4 Tier 4 / Background Investigation (BI) A Tier 4/BI is conducted by OPM and covers a 10-year period. It consists of a review of National Agency Check (NAC) records [OPM Security Investigations Index (SII), DOD Defense Central Investigations Index (DCII), FBI name check, and a FBI fingerprint check report], a credit report covering a period of 10 years, written inquiries to previous employers and references listed on the application for employment; an interview with the subject, spouse, neighbors, supervisor, co-workers; court records, law enforcement check, and a verification of the educational degree.

The position sensitivity and the level of background investigation commensurate with the required level of access for the following tasks within the Performance Work Statement are:

Position Sensitivity and Background Investigation Requirements by Task

Task Number Tier1 / Low / NACI Tier 2 / Moderate /

MBI

Tier 4 / High / BI

7.2–7.6:

transcription and secure handling of VA investigative recordings

[VA SECURITY TO

DETERMINE]

[VA SECURITY TO

DETERMINE]

[VA SECURITY TO

DETERMINE]

The Tasks identified above and the resulting Position Sensitivity and Background Investigation requirements identify, in effect, the Background Investigation requirements for Contractor individuals, based upon the tasks the particular Contractor individual will be working. The submitted Contractor Staff Roster must indicate the required Background Investigation Level for each Contractor individual based upon the tasks the Contractor individual will be working, in accordance with their submitted proposal.

13.2 CONTRACTOR PERSONNEL SECURITY REQUIREMENTS

13.2.1 Contractor Responsibilities:

A. The Contractor shall prescreen all personnel requiring access to the computer systems to ensure they maintain the appropriate Background Investigation, and are able to read, write, speak and understand the English language.

B. The Contractor shall bear the expense of obtaining background investigations. Within 3 business days after award, the Contractor shall provide a roster of Contractor and Subcontractor employees to the COR to begin their background investigations in accordance with the ProPath template. The Contractor Staff Roster shall contain the Contractor’s Full Name, Date of Birth, Place of Birth, individual background investigation level requirement (based upon Section 7.0 Tasks), etc. The Contractor shall submit full Social Security Numbers either within the Contractor Staff Roster or under separate cover to the COR. The Contractor Staff Roster shall be updated and provided to VA within 1 day of any changes in employee status, training certification completion status, Background Investigation level status, additions/removal of employees, etc. throughout the Period of Performance. The Contractor Staff Roster shall remain a historical document indicating all past information and the Contractor shall indicate in the Comment field, employees no longer supporting this contract. The preferred method to send the Contractor Staff Roster or Social Security Number is by encrypted e-mail. If unable to send encrypted e-mail, other methods which comply with FIPS 140-2 are to encrypt the file, use a secure fax, or use a traceable mail service.

C. The Contractor shall coordinate the location of the nearest VA fingerprinting office through the COR. Only electronic fingerprints are authorized.

D. The Contractor shall ensure the following required forms are submitted to the COR within 5 days after contract award:

1) For a Tier 1/Low Risk designation:

a) OF-306

b) DVA Memorandum – Electronic Fingerprints

2) For Tier 2/Moderate or Tier 4/High Risk designation:

a) OF-306

b) VA Form 0710

c) DVA Memorandum – Electronic Fingerprints

The Contractor personnel shall submit all required information related to their background investigations (completion of the investigation documents (SF85, SF85P, or SF 86) utilizing the Office of Personnel Management’s (OPM) Electronic Questionnaire for Investigations Processing (e-QIP) after receiving an email notification from the Security and Investigation Center (SIC).

The Contractor employee shall certify and release the e-QIP document, print and sign the signature pages, and send them encrypted to the COR for electronic submission to the SIC. These documents shall be submitted to the COR within 3 business days of receipt of the e-QIP notification email. (Note: OPM is moving towards a “click to sign” process. If click to sign is used, the Contractor employee should notify the COR within 3 business days that documents were signed via eQIP).

E. The Contractor shall be responsible for the actions of all personnel provided to work for VA under this contract. In the event that damages arise from work performed by Contractor provided personnel, under the auspices of this contract, the Contractor shall be responsible for all resources necessary to remedy the incident.

F. A Contractor may be granted unescorted access to VA facilities and/or access to VA Information Technology resources (network and/or protected data) with a favorably adjudicated Special Agreement Check (SAC) or “Closed, No Issues” (SAC) finger print results, training delineated in VA Handbook 6500.6 (Appendix C, Section 9), and, the signed “Contractor Rules of Behavior.” However, the Contractor will be responsible for the actions of the Contractor personnel they provide to perform work for VA. The investigative history for Contractor personnel working under this contract must be maintained in the database of the Office of Personnel Management (OPM).

G. The Contractor, when notified of an unfavorably adjudicated background investigation on a Contractor employee as determined by the Government, shall withdraw the employee from consideration in working under the contract.

Failure to comply with the Contractor personnel security investigative requirements may result in loss of physical and/or logical access to VA facilities and systems by Contractor and Subcontractor employees and/or termination of the contract for default.

Identity Credential Holders must follow all HSPD-12 policies and procedures as well as use and protect their assigned identity credentials in accordance with VA policies and procedures, displaying their badges at all times, and returning the identity credentials upon termination of their relationship with VA.

Contractor employees shall complete a VA Systems Access Agreement if they are provided access privileges as an authorized user of the computer system of VA.

13.2.3 Physical Security and Safety Requirements

The Contractor and their personnel shall follow all VA policies, standard operating procedures, applicable laws and regulations while on VA property. Violations of VA regulations and policies may result in citation and disciplinary measures for persons violating the law.

a. The Contractor and their personnel shall wear visible identification at all times while they are on the premises.

b. VA does not provide parking spaces at the work site; the Contractor shall obtain parking at the work site if needed. It is the responsibility of the Contractor to park in the appropriate designated parking areas. VA will not invalidate or make reimbursement for parking violations of the Contractor under any conditions.

c. Smoking is prohibited inside/outside any building other than the designated smoking areas.

d. Possession of weapons is prohibited.

e. The Contractor shall obtain all necessary licenses and/or permits required to perform the work, with the exception of software licenses that need to be procured from a Contractor or vendor in accordance with the requirements document. The Contractor shall take all reasonable precautions necessary to protect persons and property from injury or damage during the performance of this contract.

13.2.4 Confidentiality and Non-Disclosure

a. The Contractor shall follow all VA rules and regulations regarding information security to prevent disclosure of sensitive information to unauthorized individuals or organizations.

b. The VA CO will be the sole authorized official to release in writing, any data, draft deliverables, final deliverables, or any other written or printed materials pertaining to this contract. The Contractor shall release no information. Any request for information relating to this contract presented to the Contractor shall be submitted to the VA CO for response.

c. Contractor personnel recognize that in the performance of this effort, Contractor personnel may receive or have access to sensitive information, including information provided on a proprietary basis by carriers, equipment manufacturers and other private or public entities. Contractor personnel agree to safeguard such information and use the information exclusively in the performance of this contract. Contractor shall follow all VA rules and regulations regarding information security to prevent disclosure of sensitive information to unauthorized individuals or organizations as enumerated in this section and elsewhere in this Contract and its subparts and appendices.

d. Contractor shall limit access to the minimum number of personnel necessary for contract performance for all information considered sensitive or proprietary in nature. If the Contractor is uncertain of the sensitivity of any information obtained during the performance this contract, the Contractor has a responsibility to ask the VA CO.

e. Contractor shall train all of their employees involved in the performance of this contract on their roles and responsibilities for proper handling and nondisclosure of sensitive VA or proprietary information. Contractor personnel shall not engage in any other action, venture or employment wherein sensitive information shall be used for the profit of any party other than those furnishing the information. The sensitive information transferred, generated, transmitted, or stored herein is for VA benefit and ownership alone.

f. The Contractor shall maintain appropriate physical and technical safeguards at any location where OAWP investigative audio, video, or transcript information is received, processed, or stored. Personnel shall follow all VA-approved procedures applicable to the confidentiality of OAWP records and any protected information appearing in those records.

g. Contractor must adhere to the following:

1) The use of “thumb drives” or any other medium for transport of information is expressly prohibited.

2) Controlled access to system and security software and documentation.

3) Recording, monitoring, and control of passwords and privileges.

4) All terminated personnel are denied physical and electronic access to all data, program listings, data processing equipment and systems.

5) VA, as well as any Contractor (or Subcontractor) systems used to support development, provide the capability to cancel immediately all access privileges and authorizations upon employee termination.

6) Contractor PM and VA PM are informed within twenty-four (24) hours of any employee termination.

7) Acquisition sensitive information shall be marked "Acquisition Sensitive" and shall be handled as "For Official Use Only (FOUO)".

8) Classified information access is not contemplated.

h. Regulatory standard of conduct governs all personnel directly and indirectly involved in procurements. All personnel engaged in procurement and related activities shall conduct business in a manner above reproach and, except as authorized by statute or regulation, with complete impartiality and with preferential treatment for none. The general rule is to strictly avoid any conflict of interest or even the appearance of a conflict of interest in VA/Contractor relationships.

i. Any VA-required confidentiality/non-disclosure agreement shall be executed by Contractor personnel with access to covered VA information, as directed by the CO/COR and the applicable security requirements.

13.3 VA CYBERSECURITY AND PRIVACY LANGUAGE FOR INCLUSION IN

ACQUISITIONS.

a. GENERAL

(1) Contractors, Contractor personnel, Sub-Contractor and Sub-Contractor personnel (hereinafter referred to as “Contractor”) will be subject to the same Federal laws, regulations, standards, VA directives and handbooks as VA personnel regarding information and information system security and privacy.

(2) VA Cybersecurity and Privacy language included in the solicitation or contract applies to the Contractor and all Contractor affiliates and agents.

(3) All information systems, applications, and services operating on behalf of or within VA must meet or exceed all applicable federal cybersecurity and risk management minimum standards. At a minimum, systems shall implement and maintain compliance with the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-37, Risk Management Framework for Information Systems and Organization: A System Life Cycle Approach for Security and Privacy, Federal Information Security Modernization Act of 2014 (FISMA) requirements, and all applicable federal laws, and Office of Management and Budget (OMB) mandates. Contractual terms, implementation approaches, or operational constraints shall not supersede or circumvent these federal minimum security and compliance requirements. Authority established under this handbook is limited to technical, and enterprise architecture matters;

interpretation or adjudication of non-technical policy or programmatic content remains the responsibility of the appropriate business or governing policy offices.

b. VA INFORMATION CUSTODIAL

(1) The Contractor must provide unlimited rights to data / intellectual property first produced and delivered in the performance of this contract or order (hereinafter “contract”) unless expressly stated otherwise in this contract.

This includes all rights to source code and all documentation created in support thereof. The primary clause used to define Government and Contractor data rights is Federal Acquisition Regulation (FAR) 52.227-14, Rights in Data – General.

(a) The Contractor must provide all custom-developed code and technical components developed in the performance of this contract (e.g., documentation; data models; schemas; metadata; architecture designs; configuration scripts; and artifacts required to develop, build, test, and deploy the code for or on behalf of VA) for storage in a VA-designated repository for custom-developed code in a format that allows VA to access, use, modify, distribute, and reuse it in accordance with the Source Code Harmonization and Reuse in Information Technology Act of 2024 (SHARE IT Act).

(b) The Contractor must provide any support and assistance deemed necessary for VA to comply with the SHARE IT Act (e.g., furnishing data for reporting and following federal and VA standards for custom code development).

https://csrc.nist.gov/pubs/sp/800/37/r2/final https://csrc.nist.gov/pubs/sp/800/37/r2/final https://csrc.nist.gov/pubs/sp/800/37/r2/final https://csrc.nist.gov/pubs/sp/800/37/r2/final https://www.congress.gov/113/plaws/publ283/PLAW-113publ283.pdf https://www.congress.gov/113/plaws/publ283/PLAW-113publ283.pdf https://www.acquisition.gov/far/52.227-14 https://www.acquisition.gov/far/52.227-14 https://www.congress.gov/118/plaws/publ187/PLAW-118publ187.pdf https://www.congress.gov/118/plaws/publ187/PLAW-118publ187.pdf

(2) Information made available to the Contractor by VA for the performance or administration of this contract will be used only for the purposes specified in the contract, service agreement, SOW, PWS, and / or PD. The Contractor shall not use VA information in any other manner without prior written approval from a VA CO. The Contractor shall disclose to the CO all Data to be collected, stored, and accessed and will only collect, store, and access the minimum Data necessary to perform its services. The Contractor may only use VA information within the terms of the contract and applicable Federal law, regulations, and VA policies. If new Federal laws, regulations, or VA policies become applicable after execution of the contract, the parties agree to negotiate contract modification and adjustment necessary to implement the new laws, regulations, and / or policies. The primary clause used to define Government and Contractor data rights is FAR 52.227-14.

(3) The Contractor shall not make copies of VA information unless necessary to perform the requirements of the contract. If copies are made for restoration purposes, after the restoration is complete, the copies shall be destroyed in accordance with VA Directive 6500, VA Cybersecurity Program, and VA Office of Information Security (OIS) Knowledge Service.

(4) VA information will not be co-mingled with any other data on the

Contractor’s information systems or media storage systems. The Contractor shall ensure compliance with Federal and VA requirements related to data protection, data encryption, physical data segregation, logical data segregation, classification requirements and media sanitization. Exceptions to this paragraph will be granted only with the approval of the VA Program Office communicated to the Contractor by the

VA CO.

(5) Except for uses and disclosures of VA information specifically authorized by this contract, the Contractor may use and disclose VA information only in two situations: (i) in response to a qualifying order of a court of competent jurisdiction after notification to VA CO (ii) with written approval from the VA CO. The Contractor shall refer all requests for, or inquiries about, VA information and information systems to the VA CO.

(6) Notwithstanding the provision above, the Contractor shall not release VA records protected by Title 38 United States Code (U.S.C.) § 5705, Confidentiality of medical quality- assurance records, and / or Title 38 U.S.C. § 7332, Confidentiality of certain medical records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse or infection with Human Immunodeficiency Virus (HIV). If the Contractor is in receipt of a court order or other form of request for the above-mentioned information, the Contractor shall immediately refer that court order or request to the VA

CO.

(7) If a VHA contract is terminated for default or cause with a business associate, the related local Business Associate Agreement (BAA) shall also be terminated and actions taken in accordance with Veterans Health Administration (VHA) Directive 1605.05, Business Associate Agreements.

If there is an executed national BAA associated with the contract, VA will determine what actions are appropriate and notify the contractor.

(8) Information made available to the Contractor by VA for the performance or administration of this contract, or information developed by the Contractor in performance or administration of the contract, will be protected and secured in accordance with VA Directive 6500, VA Directive 6510, VA Identity, Credential, and Access Management, and VA Handbook 6510, VA Identity, Credential and Access Management.

(9) The Contractor shall store VA sensitive information in an encrypted form, using VA-approved encryption tools which are Federal Information Processing Standards (FIPS)-validated in accordance with requirements on the OIS Knowledge Service. The Contractor shall verify the integrity of transmitted security and privacy attributes. The Contractor shall provide the capability to check the integrity of VA information while it resides in the external system.

https://uscode.house.gov/view.xhtml?req=granuleid%3AUSC-prelim-title38-section5705&num=0&edition=prelim https://uscode.house.gov/view.xhtml?req=granuleid%3AUSC-prelim-title38-section5705&num=0&edition=prelim https://www.law.cornell.edu/uscode/text/38/7332 https://www.law.cornell.edu/uscode/text/38/7332 https://www.bing.com/ck/a?!&&p=ddc1a2baa4d8effd8b3d69d386e1c139e3b4f93cb8e4ca7179827ab00481e3a4JmltdHM9MTc1Nzg5NDQwMA&ptn=3&ver=2&hsh=4&fclid=06e87191-2473-6a6c-1edc-67bd25bc6bd0&psq=vha%2Bdirective%2B1605.05&u=a1aHR0cHM6Ly93d3cudmEuZ292L3ZoYXB1YmxpY2F0aW9ucy9WaWV3UHVibGljYXRpb24uYXNwP3B1Yl9JRD05MTc4 https://www.bing.com/ck/a?!&&p=ddc1a2baa4d8effd8b3d69d386e1c139e3b4f93cb8e4ca7179827ab00481e3a4JmltdHM9MTc1Nzg5NDQwMA&ptn=3&ver=2&hsh=4&fclid=06e87191-2473-6a6c-1edc-67bd25bc6bd0&psq=vha%2Bdirective%2B1605.05&u=a1aHR0cHM6Ly93d3cudmEuZ292L3ZoYXB1YmxpY2F0aW9ucy9WaWV3UHVibGljYXRpb24uYXNwP3B1Yl9JRD05MTc4 https://vaww.my.sites.va.gov/policy/viewer/paKMOE0000000IlU4AU https://vaww.my.sites.va.gov/policy/viewer/paKMOE0000000IlU4AU https://vaww.my.sites.va.gov/policy?p=paKMOE0000000KL44AM https://vaww.my.sites.va.gov/policy?p=paKMOE0000000KL44AM

(10) The Contractor shall transmit VA sensitive information using VA approved

Transport Layer Security (TLS) configured with FIPS based cipher suites in conformance with NIST SP 800-52, Guidelines for the Selection, Configuration and Use of Transport Layer Security (TLS) Implementations.

The cryptographic module used must be FIPS-validated in accordance with requirements on the OIS Knowledge Service.

(11) The Contractor’s firewall security shall meet or exceed VA’s minimum requirements.

(12) The Contractor shall retain all data storage media which have been used to create, collect, process, store, or disseminate any VA data, information, or agency record in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management, VA Handbook 6300.1, Records Management Procedures, and applicable VA Records Control Schedules.

(13) The Contractor shall not store or maintain VA sensitive information, including on any form of removable or transportable media, without CO’s prior written approval.

(14) The Contractor, in accordance with Federal and VA policy, shall maintain backup of Data containing VA sensitive information, image repositories, and provisioned environments. The backup storage infrastructure shall be located in physically protected, limited-access facilities within the United States and governed by the cybersecurity Controls set forth herein.

(15) The Contractor shall provide its plan for the disposition of all VA data in its possession, including destruction and return, in accordance with VA Directive 6500 and requirements specified on the VA OIS Knowledge Service, prior to termination or completion of this contract.

(16) The Contractor shall return to VA all data storage media which have been used to create, collect, process, store, or disseminate any VA data, information, or agency record which cannot be sanitized or destroyed as required by Section b(15) of this contract. Such media include, but are not limited to, printed or handwritten hardcopies (containing text or images), magnetic tapes, magnetic discs, optical discs, solid state devices, or any other removable digital or analog data storage media.

(17) Media shall be returned using VA-approved methods for secure data transfer. If the media contain VA sensitive information, that information must be encrypted by a VA-approved FIPS-validated encryption tool in accordance with requirements on the OIS Knowledge Service. If the Contractor chooses to ship the media, and the media contain no VA sensitive information, such shipment shall be performed in accordance with VA Directive 6340, Enterprise Mail Management. If any of the media to be https://csrc.nist.gov/pubs/sp/800/52/r2/final https://csrc.nist.gov/pubs/sp/800/52/r2/final https://vaww.my.sites.va.gov/policy?p=paKMOE00000008ln4AA https://vaww.my.sites.va.gov/policy?p=paKMOE00000008ln4AA https://vaww.my.sites.va.gov/policy/viewer/paKMOE00000009Cf4AI https://vaww.my.sites.va.gov/policy/viewer/paKMOE00000009Cf4AI https://vaww.my.sites.va.gov/policy/viewer/paKMOE00000009Bf4AI shipped contain VA Sensitive Information, the shipment shall be performed in accordance with VA Directive 6609, Mailing of Sensitive Personal Information.

(18) The Contractor shall self-certify that the data disposition requirements in Section b(12)-(15) of this contract have been satisfied, and shall send this self-certification to the VA Program Office and the VA CO within 30 business days of the completion or termination of this contract.

(19) At the end of any contracted lease, loan, or trade-in of equipment, VA shall not return any electronic storage media included in or with equipment if that media has been used to create, collect, process, store, or disseminate VA data, information, or agency record. Any exception to this stipulation will be granted only with the written approval of the VA CO.

(20) VA reserves the right to conduct scheduled or unscheduled audits, assessments, or investigations of Contractor Information Technology (IT) resources to ensure information security is compliant with Federal and VA requirements in accordance with Title 38 U.S.C. § 5722(b)(1). This includes, but is not limited to, periodic assessments of the risk and magnitude of harm that could result from the unauthorized access, use, disclosure, disruption, modification, or destruction of information and information systems that support the operations and assets of VA. The Contractor shall provide all necessary access to records (including electronic and documentary materials related to the contracts and subcontracts) and support (including access to Contractors associated with the contract) to VA, VA's Office Inspector General (OIG), and / or the Government Accountability Office (GAO) staff during periodic control assessments, audits, or investigations.

c. ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS

(1) All Contractors shall comply with conditions specified in the Veterans Affairs Acquisition Regulation (VAAR) 852.204-71(d), and Contractor operations are required to be in U.S. All Contractors working with VA information must be permanently located within a jurisdiction subject to the law of the U.S. to the maximum extent practicable. The Contractor shall also ensure to restrict the geographic location of information processing and data storage to facilities located within the legal jurisdictional boundary of the U.S. If services are proposed to be performed abroad, the Contractor must state where all non-U.S. services are provided and obtain the CO’s prior written approval where required by law.

(2) The Contractor shall deliver to VA a detailed risk mitigation plan specifically addressing communications, personnel control, data protection and potential legal issues. The plan shall be approved by the Contracting Officer (CO) in writing prior to access being granted.

https://vaww.my.sites.va.gov/policy/viewer/paKMOE000000090d4AA https://vaww.my.sites.va.gov/policy/viewer/paKMOE000000090d4AA https://uscode.house.gov/view.xhtml?req=granuleid%3AUSC-prelim-title38-section5722&num=0&edition=prelim https://www.acquisition.gov/vaar/852.204-71-information-and-information-systems-security https://www.acquisition.gov/vaar/852.204-71-information-and-information-systems-security

(3) The Contractor shall ensure that all Contractors assigned to work on the contract undergo the same security investigations and obtain the same levels of clearance as VA employees who have been granted access to VA information at the same level of sensitivity. The level and process of background security investigations for Contractors shall be in accordance with VA Directive 0710, Personnel Vetting Program, and VA Handbook 0710, Personnel Vetting Program.

(4) The Contractor shall request logical (electronic) or physical access to VA information and VA information systems only to the extent that the requested information is needed to perform the services specified in the solicitation or contract. Contractors who require privileged access to any VA Information System (or component) shall complete the VA elevated privilege access request processes before privileged access is granted.

(5) Before being granted access to VA information or VA information systems, Contractors shall:

(a) Successfully complete VA Privacy and Information Security Awareness and Rules of Behavior (RoB) course [Talent Management System (TMS) #10176] upon contract initiation and annually thereafter;

(b) Sign and acknowledge (electronically through TMS #10176) understanding of and responsibilities for compliance with the VA RoB for Organizational Users; and

(c) Successfully complete all additional cybersecurity or privacy training required for personnel granted equivalent information system or information access.

(6) The Contractor shall provide to the VA Program Office a copy of each applicable employee’s training certificates and certificate of signature of the VA RoB for Organizational Users within five (5) business days of contract initiation and annually thereafter. Failure by the Contractor to complete the mandatory annual training is grounds for suspension or termination of all privileges to access VA information physically or electronically and removal from work on the contract until such time as the required training has been successfully completed.

(a) The Contractor shall notify the VA Program Office and the VA CO in writing immediately (within 24 hours) after any of the following events:

i The Contractor no longer needs access to VA information or VA information systems.

ii The Contractor is terminated, suspended, or otherwise has their work on a VA project discontinued for any reason.

https://www.my.sites.va.gov/policy/viewer/paKMfE0000001I4XWAU https://www.my.sites.va.gov/policy/viewer/paKMfE0000001HZtWAM https://www.my.sites.va.gov/policy/viewer/paKMfE0000001HZtWAM iii The Contractor believes that a member of their own personnel may pose a threat to the Contractor’s working environment or to any Contractor-owned assets (e.g., property, buildings, confidential data, COs, employees, networks, systems, trade secrets and / or VA data entrusted to the Contractor).

iv Discovery or revelation of previously undisclosed changes to a Contractor’s background history, background investigation, or employee record.

v The Contractor has their authorization to work in the U.S.

revoked.

vi The contract by which Contractors provides products and services to VA has either been fulfilled or terminated, such that VA can cut off electronic and / or physical access for the Contractor.

(7) The Contractor is not permitted to access the VA network or internal resources from any foreign country. When travel outside the United States is required for official VA business or an international work location is explicitly specified in the contract, the Contractor must submit a request for accessing the VA internal network and resources internationally subject to the written approval by the Contracting Officer’s Representative (COR) and all required VA approvers. If approved, the Contractor must adhere to all approval conditions for accessing VA networks or internal resources via VA-issued Government Furnished Equipment (GFE), contractor supplied devices, personal devices with appropriate remote desktop features, or personal devices enrolled in VA’s Bring Your Own Device (BYOD) program.

(8) The Contractor is not permitted to travel outside the U.S. with any VA-issued GFE. If international travel is required for official VA business or an international work location is explicitly specified in the contract, an exception may be requested and is subject to written approval by the COR and all required VA approvers.

(9) In such cases of contract fulfillment, termination, or other causes, the Contractor shall take the necessary measures to immediately revoke access to VA network, property, information, and information systems (logical and physical) by the Contractor. These measures include (but are not limited to): removing and then securing Personal Identification Verification (PIV) badges and PIV–Interoperable (PIV-I) access badges, VA-issued photo badges, credentials for VA facilities and devices, VA-issued laptops, and authentication tokens. Contractors shall notify the VA Program Office immediately to initiate access removal.

(10) Contractors who no longer require VA access will return VA-issued assets to VA (e.g., documents, electronic equipment, keys, and parking passes).

PIV and PIV-I access badges shall be returned to the nearest VA PIV Badge Issuance Office. Once they have had access to VA information, information systems, networks and VA property in their possessions removed, Contractors shall notify the VA Program Office.

d. SECURITY INCIDENT INVESTIGATION

(1) The Contractor shall immediately (within one hour) report suspected security / privacy incidents (including intrusions) to the CO and VA Office of Information and Technology’s (OIT) Enterprise Service Desk (ESD) by calling (855) 673-4357 [Text Telephones (TTY)-based Telecommunications Relay Service: 711].

(2) The Contractor's immediate notice to VA about the incident shall include the following information about the incident, to the extent that this information is known:

(a) Date and time (known or approximated) the security incident occurred.

(b) Names of individuals involved (when applicable).

(c) Location (physical and / or logical, as applicable) of the incident.

(d) Event logs related to the incident in a format agreed upon by the Contractor and VA.

(e) Actual or potential security issues associated with any Contractor-designed Product Known Exploited Vulnerabilities (KEVs).

i The Contractor shall create, implement, and maintain a process to record, track, and report all KEVs.

(f) Amount (in number of files or records) of data belonging to VA believed to have been compromised; and

(g) Immediate remediation and mitigation measures the Contractor is taking to minimize exposure to the vulnerability and impact of future incidents of a similar nature including timeframes.

(3) After providing the initial incident summary to VA, the Contractor shall continue to provide written updates on any new relevant information about the incident and provide updates at the request of VA officials. The Contractor shall fully cooperate with VA or third-party entity performing an independent risk analysis. Failure to cooperate may be deemed a material breach and grounds for contract termination.

(4) If the incident involves theft or break-in or other criminal activity, the

Contractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including to the VA OIG and to the VA Office of Security and Law Enforcement. The Contractor shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The Contractor shall cooperate with VA in any civil litigation to recover VA information, obtain monetary or other compensation from a third party for damages arising from any incident, or obtain injunctive relief against any third party arising from, or related to, the incident.

(5) The Contractor shall comply with VA Handbook 6500.2, Management of Breaches Involving Sensitive Personal Information, which establishes the…