DRAFT PWS - FFM Certification Program 26 May.pdf

Performance Work Statement Office of Information & Technology (OIT) Office of IT Budget & Finance (ITBF)

Federal Financial Management Certification

1. BACKGROUND

The Department of Veterans Affairs (VA) relies on strong financial management to support more than 18.5 million Veterans. The Office of IT Budget & Finance (ITBF) enables this mission by funding and sustaining the technology that powers VA’s enterprise systems, benefits platforms, and health care solutions.

ITBF directs VA’s IT spending and ensures alignment with operational and technology priorities across over 1,300 health care facilities and key platforms such as VA.gov.

Strategic resource allocation strengthens OIT’s ability to deliver secure, innovative, cost-effective, and Veteran-focused digital services.

ITBF provides the Chief Information Officer (CIO) and Department leadership with rigorous financial analysis and recommendations to ensure IT investments, policies, and operations are properly resourced. The office delivers accurate financial data, manages OIT’s resources, and advocates for mission-critical funding.

ITBF oversees all budget and finance functions within OIT, including multi-year planning, budget formulation and execution, financial accounting, audit readiness, IT capital planning, and investment control. Through disciplined financial governance, ITBF ensures a systematic approach to selecting, managing, and optimizing VA’s IT investments

2. SCOPE

The Contractor shall provide Commercial Off-the-Shelf (COTS) Professional Federal Financial Management (FFM) Training Certification courses with full before (pre), during (delivery), and post course facilitation and management to enhance the knowledge base of the VA workforce. The Contractor shall assist in the evaluation of the course offerings to provide return on investment data to VA leaders based on the industry standard Kirkpatrick's levels of valuation and additional learning measures and metrics used by

VA.

3. SPECIFIC TASKS

3.1. CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor's approach, timeline and tools to be used in execution of this requirement. The CPMP shall take the form of both a narrative that displays the schedule, milestones, risks and resource support. The CPMP shall also include how the Contractor will coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the Performance Work Statement (PWS). The initial baseline CPMP shall be concurred upon 10 business days post-award and updated each option year and shall be concurred upon 15 business days after option exercised.

The Contractor shall update the CPMP within 5 business days of a material change and maintain the VA Program Manager (PM) approved CPMP throughout the Period of Performance (POP).

Deliverable:

A. Contractor Project Management Plan (CPMP)

3.2. TECHNICAL KICKOFF MEETING

A technical kickoff meeting shall be held within 10 business days after award. The Contractor shall coordinate the date, time, and location (shall be virtual) with the Contracting Officer (CO), as the Post-Award Conference Chairperson, the VA Project Manager (PM), as the Co-Chairperson, the Contract Specialist (CS), and the Contracting Officer Representative (COR). The Contractor shall provide a draft agenda to the CO and VA PM at least five (5) business days prior to the meeting. Upon Government approval of the final agenda, the Contractor shall distribute to all meeting attendees. During the kickoff meeting, the Contractor shall present, for review and approval by the Government, the details of the intended approach, work plan, and project schedule for each effort via a Microsoft Office PowerPoint presentation. At the conclusion of the meeting, the Contractor shall update the presentation with a final slide entitled "Summary Report" which shall include notes on any major issues, agreements, or disagreements discussed during the kickoff meeting and the following statement "As the Post-Award Conference Chairperson, I have reviewed the entirety of this presentation and assert that it is an accurate representation and summary of the discussions held during the Technical Kickoff Meeting for the, "Federal Financial Management Certifications."

The Contractor shall submit the final updated presentation to the COR and PM for review within three (3) business days after the meeting.

Deliverables:

A. Technical Kickoff Meeting Agenda B. Technical Kickoff Meeting Presentation

3.3. FEDERAL FINANCIAL MANAGEMENT CERTIFICATION PROGRAM

The Contractor shall support and administer the Federal Financial Management (FFM) Certification Program. The Contractor shall provide:

• Provider Accreditation: Accredited by a US Department of Education recognized organization.

• Delivery Format: Virtual Instructor-Led Training from federal financial management expert instructors with a class size of no more than 20 Government employees per course.

• Materials & Mentoring: Includes instructor developed materials and practical exercises.

• 508 Accessibility: All electronic content/platforms/documents used for training shall comply with Section 508 Chapter 2 Scoping (E205 Electronic Content, E204 Functional Performance Criteria, E208 Support Documentation & Services).

The Contractor shall:

A. Produce a Monthly Status Report (MSR) that shall be delivered no more than five (5) business days following the close of the prior month and participate in MSR Review meetings with VA COR and PM. The report shall include:

• Metrics regarding FFM Certification-related courses conducted in the prior reporting month: the number of students trained, the number of students that took a certification exam, the number of students that passed the exam, and the completed Student Evaluation Forms, for each course.

• Course Schedule Monthly Updates

• Monthly Exam Voucher Status Updates detailing the results of voucher usage to identify the number of issued vouchers versus number of vouchers used by students to take certification exams.

Include pass/fail status of students who took certification tests.

B. Produce a draft Course Schedule including course name, detailed synopsis and date/time within 20 business days of award. The Contractor shall participate in development and finalization of the course schedule with the VA COR, and VA PM. The final course schedule shall be delivered within 3 business days post final government comments. The basis for the initial submission shall contain the list of industry-recognized professional Federal Financial Management certification-related courses equivalent to the samples provided in the PWS.

• The Contractor shall ensure that every training course delivered under this contract includes clearly documented Continuing Professional Education (CPEs)/Continuing Education Units (CEUs), and no course shall be scheduled or delivered without an assigned CPE/CEU value. The Contractor shall analyze all information input sources and update the Course Schedule monthly, with COR approval. The Contractor shall identify any outdated or irrelevant courses and submit recommended removals to the COR for approval. For each course deemed outdated or irrelevant, the Contractor shall also recommend replacement courses, which must be approved by the PM and the COR. Replacement courses shall be offered at no additional cost to the Government.

C. Develop a one-page Course Description Factsheet for each course offering that includes the course name, description of training, dates/times. Initial baseline Course Description Factsheets shall be delivered no later than 10 business days post-award. The Contractor shall update the Factsheet as needed if changes are required.

D. Provide a Functional Area Mapping for each course offering, showing how each certification-related course maps to the existing IT functional areas provided by the government no later than 20 business days post-award. The mapping report shall include a complete list of functions and proficiency levels the certification course can be mapped to for all applicable government functions. Mappings are based on the course content and the specific skills an employee can gain proficiency in, upon completion of the course.

E. The Contractor shall provide registration tracking, reporting, and customer service support to students and supervisors for an average of eight (8) hours per week—aligned to a mutually agreed-upon schedule between the Government and Contractor excluding Federal holidays—to ensure all participants are informed of course attendance requirements, receive timely responses to inquiries, and obtain all necessary course information. Engagement activities shall be on-going before, during, and after courses are conducted including ensuing training materials are delivered, confirmation with each attendee is obtained via email at least one week prior to the course start date, resolving student issues during courses, follow-ups with students upon course completion, and ensuring completions are reported to the

COR.

F. Administer Kirkpatrick’s Standard Evaluations of each course by:

a) producing a standard student evaluation form

b) distributing standard student evaluation forms to all participants in each course completed,

c) collecting the completed student evaluation forms, and

d) evaluating the effectiveness of attended training based on Kirkpatrick's standards of evaluation.

Deliver Kirkpatrick's Standards Evaluation Levels one and two for each course in Quarterly Kirkpatrick Reports that shall be delivered no later than five (5) business days post-quarter close. Kirkpatrick’s Standard Evaluations are required for each course in the Base period, option periods and for all exercised Optional Tasks.

Deliverables:

A. Monthly Status Report (MSR) B. Course Schedule C. Course Descriptions Factsheet (for each course) D. Functional Area Mapping E. Registration Tracking F. Quarterly Kirkpatrick's Standards Evaluations (for each course)

3.4. LEVEL I (BASE YEAR) FOUNDATIONAL FFM CERTIFICATION

TRAINING

A. Scope: The Contractor shall deliver Level I FFM training to budget and finance personnel during the Base Year. There shall be no prerequisites for the Level I FFM certification.

• Duration: Provide five (5) FFM training courses that are equivalent to the sample courses provided below. Each course shall be offered six (6) times during the base period of performance (PoP). The duration of each course shall be no more than five (5) business days, conducted between the hours of 9:00 am- 4:00 pm Eastern Standard Time (EST).

• Class size: No more than 20 participants per course

B. Credit: The Contractor shall provide an exam voucher for each participant for every course. All exams shall be administered on a Pass/Fail basis. Participants who fail or do not complete the exam shall be given one additional opportunity to retake the exam within two business days following the final day of the course offering.

C. Successful completion of Level I requires passing all 5 courses. Each participant who successfully completes Level I shall receive one verified certificate and the applicable CPE/CEU credits, issued no later than 10 business days after completion. The CPE/CEU shall be stated on the certificate issued.

D. Expected Outcomes: Learners demonstrate baseline competency in budget lifecycle awareness, accounting concepts, internal control principles, and legal compliance context.

The Contractor shall provide introduction instruction aligned to Level 1 topics including:

• Federal Financial Management Principles

• Federal Budget Process Overview

• Introduction to Federal Budget Formulation and Execution

• Introduction to Federal Accounting

• Appropriations Law- Basics

Deliverables:

A. FFM Certification Course Offerings B. Certification Exam Vouchers C. Completion Certificate

3.5. LEVEL II – INTERMEDIATE FFM CERTIFICATION TRAINING

A. Scope: The Contractor shall deliver Level II FFM training to budget and finance personnel throughout the PoP of Option Period 1. Participants must complete Level I FFM certification to be eligible for Level II. There shall be no external prerequisites to the Level II certification.

• Duration: Provide five (5) FFM training courses that are equivalent to the sample courses provided below. Each course shall be offered six (6) times per year. The duration of each course offering shall be no more than five (5) business days, conducted between the hours of 9:00 am- 4:00 pm Eastern Standard Time (EST).

Pass/Fail basis. Participants who fail or do not complete the exam shall business days following the final day of the course offering.

C. Successful completion of Level II requires passing all 5 courses. Each participant who successfully completes the Level shall receive one verified certificate and the applicable CPE/CEU credits, issued no later than 10 business days after completion. The CPE/CEU shall be stated on the certificate issued.

D. Expected Outcomes: Learners produce performance-based budgets, interpret execution data, and articulate congressional impacts on agency resources.

The Contractor shall provide intermediate instruction aligned to Level II topics including:

• Budget Justification and Congressional Submission

• Planning, Programming, Budgeting, and Execution (PPBE)

• Legislative Budget Process

• Federal Financial Reporting and Statement Analysis

• Cost Estimation and Capital Planning (CPIC) Essentials.

Deliverables:

A. FFM Certification Course Offerings

3.6. LEVEL III – ADVANCED FFM CERTIFICATION TRAINING

A. Scope: The Contractor shall deliver Level III FFM training budget and finance personnel throughout Option Period 2. Participants must complete Level II FFM certification to be eligible for Level III. There shall be no external prerequisites to the Level III certification.

• Duration: Provide five (5) courses that are equivalent to the sample courses provided below. Each course shall be offered six

(6) times per year. The duration of each course shall be no more than five (5) business days, conducted between the hours of 9:00 am- 4:00 pm Eastern Standard Time (EST).

participant for every course. All exams shall be administered on a Pass/Fail basis. Participants who fail or do not complete the exam shall be given one additional opportunity to retake the exam within two business days following the final day of the course. The CPE/CEU shall be stated on the certificate issued.

C. Successful completion of Level III requires passing all 5 courses. Each verified certificate and the applicable CPE/CEU credits, issued no later than 10 business days after completion.

D. Expected Outcomes: Learners justify budgets with data backed narratives, analyze statements, apply risk-based resource management, and execute analytical methods using standard tools.

The Contractor shall provide introduction instruction aligned to Level III topics including:

• Financial Analysis and Decision Support

• Advanced Appropriations Law

• Budget Justification and Executive Presentation

• Enterprise Risk Management (ERM) for Financial Managers

• Audit Readiness and Remediation Strategies

Deliverables:

A. FFM Certification Course Offerings

3.7. LEVEL IV– EXPERT FFM CERTIFICATION TRAINING

A. Scope: The Contractor shall deliver Level IV training to budget and finance personnel throughout Option Period 3. Participants must complete Level III FFM certification to be eligible for Level IV. There shall be no external prerequisites to the Level IV certification.

• Duration: Provide five (5) courses that are equivalent to the sample courses provided below. Each course shall be offered six

(6) times per year. The duration of each course offering shall be no more than five (5) business days, conducted between the hours of 9:00 am- 4:00pm Eastern Standard Time (EST).

Pass/Fail basis. Participants who fail or do not complete the exam shall business days following the final day of the course.

C. Successful completion of Level IV requires passing 5 courses. Each verified certificate and the applicable CPE/CEU credits, issued no later than 10 business days after completion. The CPE/CEU shall be stated on the certificate issued.

Expected Outcomes: Learners led multidisciplinary FM teams, apply structured decision frameworks to complex resource challenges, and communicate persuasively with stakeholders.

The Contractor shall provide introduction instruction aligned to Level IV topics including:

• Organizational Leadership

• Stakeholder Engagement and Communication

• Executive Decision-Making

• Strategic Planning, Problem-Solving, and Performance

Integration

• Advanced Fiscal Law and Appropriations

Deliverables:

A. FFM Certification Course Offerings

3.8. OPTIONAL TASKS

Requirements for all optional tasks are as follows:

If an Optional Task is exercised by VA, the Contractor shall provide:

Scope: The Level specified FFM Certification Program which consists of five (5) courses offered per Optional Task Exercise. The classes provided in the Optional Tasks shall be the same or updated versions of the classes in Levels I-IV above (PWS §3.4- §3.7)

Duration: The duration of each course offering shall be no more than five

(5) business days, conducted between the hours of 9:00am- 4:00pm Eastern Standard Time (EST).

Class size: No more than 20 participants per course

Credit: The Contractor shall provide an exam voucher for each participant for every course. All exams shall be administered on a Pass/Fail basis.

Participants who fail or do not complete the exam shall be given one additional opportunity to retake the exam within two business days following the final day of the course offering. Successful completion of the Level requires passing all 5 courses.

Each participant who successfully completes the Level shall receive one verified certificate with the applicable CPE/CEU credits denoted, issued no later than 10 business days after completion.

The Contractor shall provide Level I through IV course offerings that are equivalent to the example courses provided in Section 3.4 through 3.7 above.

• There shall be no internal or external required prerequisites for Level I.

• Successful completion of the previous level is required to be eligible for next Level (Level II through IV).

• The class shall not require renewal of certification once earned.

• The Contractor shall update the Monthly Course Schedule to include the courses included in the Optional Task when exercise.

Deliverables:

A. FFM Certification Course Offerings

3.8.1 LEVEL ONE OPTIONAL TASK

This task may be exercised up to three times in the base PoP and each option period.

3.8.2 LEVEL TWO OPTIONAL TASK

This task may be exercised up to three times in Option Periods 1, 2, and 3.

3.8.3 LEVEL THREE OPTIONAL TASK

This task may be exercised up to three times in Option Periods 2 and 3

3.8.4 LEVEL FOUR OPTIONAL TASK

This task may be exercised up to three times in Option Period 3.

3.9. DELIVERY SCHEDULE

All deliverables shall be electronically submitted to the VA PM, and COR.

TASK ID DELIVERABLE QTY DELIVERY INSTRUCTIONS & DATE

3.1 A Contractor Project Management Plan 1 The initial baseline CPMP shall be concurred upon 10 business days post-award and updated each option year.

The Contractor shall update the CPMP within 5 business days of a material change and maintain the VA PM approved CPMP throughout the POP.

3.2 A Technical Kickoff Meeting Agenda 1 The Contractor shall provide a draft agenda to the CO and VA PM at least five (5) business days prior to the meeting. Upon Government approval of the final agenda, the Contractor shall distribute to all meeting attendees.

3.2 B Technical Kickoff Meeting

Presentation

1 A technical kickoff meeting shall be held within 10 business days after award. The Contractor shall submit the final updated presentation to the CO for review within three (3) business days after the meeting.

3.3. A Monthly Status Report (MSR) 12 Produce a Monthly Status Report (MSR) that shall be delivered no more than five (5) business days following the close of the prior month

3.3. B Course Schedule 1 Produce a draft Course Schedule including course name, detailed synopsis, and date/time within 20 business days of award.

3.3. C Course Descriptions Factsheet (for

each course)

20 Initial baseline Course Description Factsheets shall be delivered no later than 10 business days post-award. The Contractor shall update the Factsheet as needed if changes are required.

3.3. D Functional Area Mapping (for each

course)

20 Provide a Functional Area Mapping for each course offering, showing how each certification-related course maps to the existing IT functional areas provided by the government no later than 20 business days post-award.

3.3 E Registration Tracking and Customer

Service Support

1 The Contractor shall provide registration tracking, reporting, and customer service support to students and supervisors for an average of eight (8) hours per week—aligned to a mutually agreed-upon schedule between the Government and Contractor and excluding Federal holidays. Engagement activities shall be on-going before, during, and after courses are conducted

3.3 F Quarterly Kirkpatrick's Standards

Evaluations (for each course)

20 Deliver Kirkpatrick's Standards Evaluation Levels one and two for each course in Quarterly Kirkpatrick Reports that shall be delivered no later than five (5) business days post-quarter close.

3.4 A Delivery of FFM Certification Course

Offerings

30 Provide five (5) Level I FFM training courses that are equivalent to the sample courses provided in PWS §3.4. Each course shall be offered six (6) times per year.

3.4 B Certification Exam Vouchers 550 The Contractor shall provide an exam voucher for each 110 participants for each of the 5 courses in Level I.

3.4 C Completion Certificate 110 Each participant who successfully completes Level I shall receive one verified certificate and the applicable CPE/CEU credits, issued no later than 10 business days after completion.

3.5 A Delivery of FFM Certification Course

Offerings

30 Provide five (5) Level II FFM training courses that are equivalent to the sample courses provided in PWS §3.5. Each course shall be offered six (6) times per year.

3.5 B Certification Exam Vouchers 550 The Contractor shall provide an exam voucher for each 110 participants for each of the 5 courses in Level II.

3.5 C Completion Certificate 110 Each participant who successfully completes Level II shall receive one verified certificate and the applicable CPE/CEU credits, issued no later than 10 business days after completion.

3.6 A Delivery of FFM Certification Course 30 Provide five (5) Level III FFM training courses

4. PERIOD OF PERFORMANCE

The Period of Performance (POP) for this effort shall be one 12-month base period with three (3) 12-month Option Periods.

5. ANTICIPATED CONTRACT TYPE

This will be Firm Fixed Price (FFP).

6. FEDERAL HOLIDAYS

Any work required by the Government shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO).

Offerings that are equivalent to the sample courses provided in PWS §3.6. Each course shall be offered six (6) times per year.

3.6 B Certification Exam Vouchers 550 The Contractor shall provide an exam voucher for each 110 participants for each of the 5 courses in Level III.

3.6 C Completion Certificate 110 Each participant who successfully completes Level III shall receive one verified certificate and the applicable CPE/CEU credits, issued no later than 10 business days after completion.

3.7 A Delivery of FFM Certification Course

Offerings

30 Provide five (5) Level IV FFM training courses that are equivalent to the sample courses provided in PWS §3.7. Each course shall be offered six (6) times per year.

3.7 B Certification Exam Vouchers 550 The Contractor shall provide an exam voucher for each 110 participants for each of the 5 courses in Level IV.

3.7 C Completion Certificate 110 Each participant who successfully completes Level IV shall receive one verified certificate and the applicable CPE/CEU credits, issued no later than 10 business days after completion.

3.8.1- 3.8.4

A Delivery of FFM Certification Course Offerings

5 Each Level I- IV Optional Task shall consist of five (5) courses offered once per Optional Task Exercise.

3.8.1- 3.8.4

B Certification Exam Vouchers 20 The Contractor shall provide an exam voucher for each participant for every course.

Participants who fail or do not complete the exam shall be given one additional opportunity to retake the exam within two business days following the final day of the course offering.

3.8.1- 3.8.4

C Completion Certificate 20 Each participant who successfully completes the Level shall receive one verified certificate with the applicable CPE/CEU credits denoted, issued no later than 10 business days after completion.

There are eleven (11) Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, five are set by date:

New Year's Day January 1 Juneteenth June 19 Independence Day July 4 Veterans Day November 11 Christmas Day December 25

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

Martin Luther King's Birthday Third Monday in January Washington's Birthday Third Monday in February Memorial Day Last Monday in May Labor Day First Monday in September Columbus Day Second Monday in October Thanksgiving Fourth Thursday in November

7. PLACE OF PERFORMANCE

All work shall be completed remotely.

8. TRAVEL

Travel is not anticipated or authorized.

The Government requires maximum utilization of teleconferencing and video conferencing for training and administrative meetings. Local travel within a 50-mile radius from the Contractor's normal duty location is considered the cost of doing business and will not be reimbursed. This includes travel, subsistence, and associated labor charges for travel time. Travel performed for personal convenience and daily travel to and from work at the Contractor's facility will not be reimbursed.

9. MATERIAL OTHER DIRECT COSTS

Material other direct costs will not be required.

10. GOVERNMENT-FURNISHED INFORMATION, EQUIPMENT, AND FACILITIES

The government will not provide any GFP to Contractors. Contractors are required to utilize their own devices to conduct training and project management activities.

11. CHANGES TO THE PWS

Any changes to this PWS shall be authorized and approved only through written correspondence from the Contracting Officer (CO) and modification to the Contract if applicable. A copy of each change will be kept in a contract folder, along with all other products of the contract. The COR has no authority to bind the Government or authority to make material changes to the contract.

12. KEY PERSONNEL

The Contractor will designate the minimum personnel that will be considered key personnel and be assigned to this contract. The Contractor shall propose appropriate labor categories for these positions. Key personnel must be assigned for the duration of the period of performance. The customer encourages and will evaluate additional key personnel as proposed by the Contractor.

The Contractor shall identify all key personnel, if applicable, in the price proposal.

The Contractor shall assign key personnel whose names were identified in the quote and who are integral to the performance of the contract requirements. It is the responsibility of the Contractor to provide Contractor support personnel and subcontractors who have the required educational background, experience, security clearance, and access authorization or combination thereof to meet the labor category descriptions under this task order for the required PWS tasks. The Contractor shall represent/acknowledge that all personnel assigned to the contract are capable of working independently and with demonstrated knowledge, skills and expertise in their respective functional areas, which are necessary to perform all assigned duties. If the Contractor personnel do not possess the expertise necessary to perform the tasks required under this contract, then the contractor shall be responsible for the appropriate training and/or replacing the personnel. The customer will require replacement of key personnel if staff are not meeting expectations.

The Contractor shall not substitute key personnel during the contract performance period unless the substitutions are unavoidable because of the incumbent’s sudden illness, death or termination of employment or the customer requires replacement of the key personnel. The Contractor shall promptly notify the COR if this is the case. The contractor must provide substitute key personnel if key personnel are on leave. Minimum staffing must be maintained through any replacement and all leave requests. All requests for approval of substitutions hereunder must be in writing and provide a detailed explanation of the circumstances necessitating the proposed substitution. Requests must contain a complete resume for the proposed substitute who shall have at least equal ability and qualifications and receive approval from the customer.

The labor categories below are identified as Key Personnel. Key Personnel must meet the corresponding requirements identified in the general requirements list and the Labor Description column below (the Government will permit mapping of skillsets to the Key Personnel role for designating and proposing best suited LCATs for that role):

Labor Category

Labor Description

Project Manager

The contractor shall designate a Project Manager who is the single contractor point of contact with/for ITBF requests and any matter related to the contractor performance. The Project Manager is defined as a person with a BA/BS degree and experience relevant to successfully managing a large- scale training program. Such experience shall include planning, managing, executing and closing out the Federal Financial Management Certification Level I-IV training programs in support of an agency’s mission.

13. PERFORMANCE STANDARDS SUMMARY

The COR will utilize a Quality Assurance Surveillance Plan (QASP) throughout the life of the contract to ensure that the Contractor is performing the services required by this PWS in an acceptable level of performance. The Government reserves the right to alter or change the surveillance methods in the QASP at its own discretion.

PWS Ref. Performance

Objective Performance

Standard / AQL Surveillance

Methods Incentives / Remedies

3.1 Contractor

Project Management Plan (CPMP)

• Initial CPMP delivered ≤ 10 business days (100%).

• Updates ≤ 5 business days (95%).

• Adherence 98%.

Deliverable reviews;

timeline audits

Positive

CPARS;

Corrective Action Request (CAR) for <95%

3.2 Technical

Kickoff Completion

• Agenda submitted ≥5 business days prior (98%).

• Meeting within 10 days (100%).

• Final deck ≤3 days (100%).

Timestamp checks

CAR for <95%

3.3 A Program

Reporting & Evidence

• Monthly and quarterly reports/updates

• Document review

• Survey Logs

Delay notice;

CAR if <95% submitted on time, complete, and accurate (98%).

• Exam Voucher Logs

3.3 B Course

Schedule

• Draft ≤20 days post-award (100%).

• Final ≤3 days post government final comment (98%)

Timestamp verification

CAR; hold deliverable payment

3.3 C Course

Description Factsheets

• All factsheets ≤10 days (100%).

• Updates ≤5 days (95%).

Deliverable review

Clarification request; CAR for non-submission

3.3 D Functional

Area Mapping

• Delivered ≤20 days 100%.

• Accuracy ≥95%.

COR review Clarification request; CAR for non-submission

3.3 E Registration &

Customer Service

• Support ≥8 hrs/wk (95%).

• Confirmations received ≥98%.

Deliverable review

CAR if <95%

3.4 A, 3.5 A, 3.6 A,

3.7 A

Course Delivery Quality

• 30 offerings/year.

• 98% delivered.

• 95% on-time.

Schedule audits

CAR for noncompliance

3.4 B, 3.5 B,

3.6 B, 3.7 B

Exam Voucher Delivery Quality

• 100% Vouchers Received by government

• Retake ≤2 days (98%)

Voucher logs CAR if <98%

3.4 C, 3.5 C,

3.6 C, 3.7 C

Certificate Delivery

• Issued ≤10 days (98%)

• CPE/CEU

documented on certificate (100%)

Certificate logs

Withhold payment if not received within 30 days.

3.8 Optional Task

Delivery Quality

• 5 courses/run

• 100% delivered

• Certificates ≤10 days (98%).

Schedule & logs

CAR for noncompliance

14. SECURITY REQUIREMENTS

14.1. VA 6500.6 Checklist, Appendix A must be completed and signed by COR and ISSO.

The Federal Government shall be the sole owner and have all rights to use, copy, and distribute all deliverables, and the research and data behind the deliverables developed under this effort, except for Commercial-Off-the-Shelf (COTS) materials. The Contractor has no rights in these deliverables, data and research, and may not disseminate them to any party other than the VA.

In accordance with VA policy, contractors’ storage, generation, transmission or exchanging of VA sensitive information requires appropriate security controls to be in place. The VA Information Security Program policy – VA Directive and Handbook 6500 and additional 6500 series directives and handbooks - provide the framework for security within VA.

14.2. Position Sensitivity and Background Investigation Requirements by Task

The position sensitivity and the level of Background Investigation (BI) commensurate with the required level of access for the following tasks within the Performance Work Statement (PWS) are:

Position Sensitivity and Background Investigation Requirements

Task Number Low/NACI Moderate/MBI High/BI 3.1-3.8 ☒ ☐ ☐

14.3. APPENDIX C — VA INFORMATION AND INFORMATION SYSTEM

SECURITY AND PRIVACY LANGUAGE

1. GENERAL. This entire section applies to all acquisitions requiring any Information Security and Privacy language. Contractors, contractor personnel, subcontractors and subcontractor personnel will be subject to the same federal laws, regulations, standards, VA directives and handbooks, as VA personnel regarding information and information system security and privacy.

2. VA INFORMATION CUSTODIAL LANGUAGE.

a. The Government shall receive unlimited rights to data/intellectual property first produced and delivered in the performance of this contract or order (hereinafter “contract”) unless expressly stated otherwise in this contract.

This includes all rights to source code and all documentation created in support thereof. The primary clause used to define Government and Contractor data rights is FAR 52.227-14 Rights in Data – General. The primary clause used to define computer software license (not data/intellectual property first produced under this contractor or order) is FAR 52.227-19, Commercial Computer Software License.

b. Information made available to the contractor by VA for the performance or administration of this contract will be used only for the purposes specified in the service agreement, SOW, PWS, PD, and/or contract. The contractor shall not use VA information in any other manner without prior written approval from a VA Contracting Officer (CO). The primary clause used to define Government and Contractor data rights is FAR 52.227-14 Rights in Data – General.

c. VA information will not be co-mingled with any other data on the contractor’s information systems or media storage systems. The contractor shall ensure compliance with Federal and VA requirements related to data protection, data encryption, physical data segregation, logical data segregation, classification requirements and media sanitization.

d. VA reserves the right to conduct scheduled or unscheduled audits, assessments, or investigations of contractor Information Technology (IT) resources to ensure information security is compliant with Federal and VA requirements. The contractor shall provide all necessary access to records (including electronic and documentary materials related to the contracts and subcontracts) and support (including access to contractor and subcontractor staff associated with the contract) to VA, VA's Office Inspector General (OIG), and/or Government Accountability Office (GAO) staff during periodic control assessments, audits, or investigations.

e. The contractor may only use VA information within the terms of the contract and applicable Federal law, regulations, and VA policies. If new Federal information security laws, regulations or VA policies become applicable after execution of the contract, the parties agree to negotiate contract modification and adjustment necessary to implement the new laws, regulations, and/or policies.

f. The contractor shall not make copies of VA information except as specifically authorized and necessary to perform the terms of the contract.

If copies are made for restoration purposes, after the restoration is complete, the copies shall be destroyed in accordance with VA Directive 6500, VA Cybersecurity Program and VA Information Security Knowledge Service.

g. If a Veterans Health Administration (VHA) contract is terminated for default or cause with a business associate, the related local Business Associate Agreement (BAA) shall also be terminated and actions taken in accordance with VHA Directive 1605.05, Business Associate Agreements.

If there is an executed national BAA associated with the contract, VA will determine what actions are appropriate and notify the contactor.

h. The contractor shall store and transmit VA sensitive information in an encrypted form, using VA-approved encryption tools which are, at a minimum, Federal Information Processing Standards (FIPS) 140-2, Security Requirements for Cryptographic Modules (or its successor) validated and in conformance with VA Information Security Knowledge Service requirements.

The contractor shall transmit VA sensitive information using VA approved Transport Layer Security (TLS) configured with FIPS based cipher suites in conformance with National Institute of Standards and Technology (NIST) 800-52, Guidelines for the Selection, Configuration and Use of Transport Layer Security (TLS) Implementations.

i. The contractor’s firewall and web services security controls, as applicable, shall meet or exceed VA’s minimum requirements.

j. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor may use and disclose VA information only in two situations: (i) in response to a qualifying order of a court of competent jurisdiction after notification to VA CO (ii) with written approval from the VA CO. The contractor shall refer all requests for, demands for production of or inquiries about, VA information and information systems to the VA CO for response.

k. Notwithstanding the provision above, the contractor shall not release VA records protected by Title 38 U.S.C. § 5705, Confidentiality of medical quality- assurance records and/or Title 38 U.S.C. § 7332, Confidentiality of certain medical records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse or infection with Human Immunodeficiency Virus (HIV). If the contractor is in receipt of a court order or other requests for the above- mentioned information, the contractor shall immediately refer such court order or other requests to the VA CO for response.

l. Information made available to the contractor by VA for the performance or administration of this contract or information developed by the contractor in performance or administration of the contract will be protected and secured in accordance with VA Directive 6500 and Identity and Access Management (IAM) Security processes specified in the VA Information Security Knowledge Service.

m. Any data destruction done on behalf of VA by a contractor shall be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management, VA Handbook 6300.1, Records Management Procedures, and applicable VA Records Control Schedules.

n. The contractor shall provide its plan for destruction of all VA data in its possession according to VA Directive 6500 and NIST 800-88, Guidelines for Media Sanitization prior to termination or completion of this contract. If directed by the COR/CO, the contractor shall return all Federal Records to VA for disposition.

o. Any media, such as paper, magnetic tape, magnetic disks, solid state devices or optical discs that is used to store, process, or access VA information that cannot be destroyed shall be returned to VA.The contractor shall hold the appropriate material until otherwise directed by the Contracting Officer’s Representative (COR) or CO. Items shall be returned securely via VA-approved methods. VA sensitive information must be transmitted utilizing VA-approved encryption tools which are validated under FIPS 140-2 (or its successor) and NIST 800-52. If mailed, the contractor shall send via a trackable method (USPS, UPS, FedEx, etc.) and immediately provide the COR/CO with the tracking information. Self-certification by the contractor that the data destruction requirements above have been met shall be sent to the COR/CO within 30 business days of termination of the contract.

p. All electronic storage media (hard drives, optical disks, CDs, back-up tapes, etc.) used to store, process or access VA information will not be returned to the contractor at the end of lease, loan, or trade-in. Exceptions to this paragraph will only be granted with the written approval of the VA CO.

3. ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS.

a. A contractor/subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees and subcontractors only to the extent necessary to perform the services specified in the solicitation or contract. This includes indirect entities, both affiliate of contractor/subcontractor and agent of contractor/subcontractor.

b. Contractors and subcontractors shall sign the VA Information Security Rule of Behavior (ROB) before access is provided to VA information and information systems (see Section 4, Training, below). The ROB contains the minimum user compliance requirements and does not supersede any policies of VA facilities or other agency components which provide higher levels of protection to VA’s information or information systems. Users who require privileged access shall complete the VA elevated privilege access request processes before privileged access is granted.

c. All contractors and subcontractors working with VA information are subject to the same security investigative and clearance requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors shall be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office of Human Resources and Administration/Operations, Security and Preparedness (HRA/OSP) is responsible for these policies and procedures. Contract personnel who require access to classified information or information systems shall have an appropriate security clearance. Verification of a Security Clearance shall be processed through the Special Security Officer located in HRA/OSP. Contractors shall conform to all requirements stated in the National Industrial Security Program Operating Manual (NISPOM).

d. All contractors and subcontractors shall comply with conditions specified in VAAR 852.204-71(d); Contractor operations required to be in United States.

All contractors and subcontractors working with VA information must be permanently located within a jurisdiction subject to the law of the United States or its Territories to the maximum extent feasible. If services are proposed to be performed abroad the contractor must state where all non- U.S. services are provided. The contractor shall deliver to VA a detailed plan specifically addressing communications, personnel control, data protection and potential legal issues. The plan shall be approved by the COR/CO in writing prior to access being granted.

e. The contractor shall notify the COR/CO in writing immediately (no later than 24 hours) after personnel separation or occurrence of other causes. Causes may include the following:

(1) Contractor/subcontractor personnel no longer has a need for access to VA information or VA information systems.

(2) Contractor/subcontractor personnel are terminated, suspended, or otherwise has their work on a VA project discontinued for any reason.

(3) Contractors believe their own personnel or subcontractor personnel may pose a threat to their company’s working environment or to any company- owned property. This includes contractor-owned assets, buildings, confidential data, customers, employees, networks, systems, trade secrets and/or VA data.

(4) Any previously undisclosed changes to contractor/subcontractor background history are brought to light, including but not limited to changes to background investigation or employee record.

(5) Contractor/subcontractor personnel have their authorization to work in the United States revoked.

(6) Agreement by which contractor provides products and services to VA has either been fulfilled or terminated, such that VA can cut off electronic and/or physical access for contractor personnel.

f. In such cases of contract fulfillment, termination, or other causes; the contractor shall take the necessary measures to immediately revoke access to VA network, property, information, and information systems (logical and physical) by contractor/subcontractor personnel. These measures include (but are not limited to): removing and then securing Personal Identity Verification (PIV) badges and PIV – Interoperable (PIV-I) access badges, VA-issued photo badges, credentials for VA facilities and devices, VA-issued laptops, and authentication tokens. Contractors shall notify the appropriate VA COR/CO immediately to initiate access removal.

g. Contractors/subcontractors who no longer require VA accesses will return VA- issued property to VA. This property includes (but is not limited to):

documents, electronic equipment, keys, and parking passes. PIV and PIV-I access badges shall be returned to the nearest VA PIV Badge Issuance Office. Once they have had access to VA information, information systems, networks and VA property in their possessions removed, contractors shall notify the appropriate VA COR/CO.

4. TRAINING.

a. All contractors and subcontractors requiring access to VA information and VA information systems shall successfully complete the following before being granted access to VA information and its systems:

(1) VA Privacy and Information Security Awareness and Rules of Behavior course (Talent Management System (TMS) #10176) initially and annually thereafter.

(2) Sign and acknowledge (electronically through TMS #10176) understanding of and responsibilities for compliance with the Organizational Rules of Behavior, relating to access to VA information and information systems initially and annually thereafter; and

(3) Successfully complete any additional cyber security or privacy training, as required for VA personnel with equivalent information system or information access [to be defined by the VA program official and provided to the VA CO for inclusion in the solicitation document – i.e., any role- based information security training].

b. The contractor shall provide the COR/CO a copy of the training certificates and certification of signing the Organizational Rules of Behavior for each applicable employee within five days of the initiation of the contract and annually thereafter, as required.

c. Failure to complete the mandatory annual training is grounds for suspension or termination of all physical or electronic access privileges and removal from work on the contract until such time as the required training is complete.

5. SECURITY INCIDENT INVESTIGATION.

a. The contractor, subcontractor, their employees, or business associates shall immediately (within one hour) report suspected security / privacy incidents to the VA OIT’s Enterprise Service Desk (ESD) by calling (855) 673-4357 (TTY: 711). The ESD is OIT’s 24/7/365 single point of contact for IT-related issues. After reporting to the ESD, the contractor, subcontractor, their employees, or business associates shall, within one hour, provide the COR/CO the incident number received from the ESD.

b. To the extent known by the contractor/subcontractor, the contractor/ subcontractor's notice to VA shall identify the information involved and the circumstances surrounding the incident, including the following:

(1) The date and time (or approximation of) the Security Incident occurred.

(2) The names of individuals involved (when applicable).

(3) The physical and logical (if applicable) location of the incident.

(4) Why the Security Incident took place (i.e., catalyst for the failure).

(5) The amount of data belonging to VA believed to have been compromised.

(6) The remediation measures the contractor is taking to ensure no future incidents of a similar nature.

c. After the contractor has provided the initial detailed incident summary to VA, they will continue to provide written updates on any new and relevant circumstances or facts they discover. The contractor, subcontractor, and their employes shall fully cooperate with VA or third-party entity performing an independent risk analysis on behalf of VA. Failure to cooperate may be deemed a material breach and grounds for contract termination.

d. VA IT contractors shall follow VA Handbook 6500, Risk Management Framework for VA Information Systems VA Information Security Program, and VA Information Security Knowledge Service guidance for implementing an Incident Response Plan or integrating with an existing VA implementation.

e. In instances of theft or break-in or other criminal activity, the contractor/subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG, and the VA Office of Security and Law Enforcement.