ICC AV System PD 7-1-2026.docx

PRODUCT DESCRIPTION (PD)

DEPARTMENT OF VETERANS AFFAIRS

Communications & Customer Experience Technology Office

Brand Name or Equal Haivision Incident Command & Control Video Wall System

Date: 9 June 2026

VA-26-00072345

PD Version Number: 1.0

Table of Contents

1.0 PRODUCT SOLUTION REQUIREMENTS

The Department of Veterans Affairs (VA) Technology Office, North Las Vegas Medical Center (NLVMC) requires an a Video Wall Display Modernization Solution (referred to as the “solution”). This solution shall be Technical Reference Model (TRM) approved. This solution must allow users to stream Command & Control content displayed on the video wall between geographic locations at such locations as VA’s Hines, IL, Tampa VA Medical Center and Martinsburg, WV Cybersecurity Operations Center (CSOC) on an ad-hoc basis locations with easy reading/viewing from anywhere in the NLVMC Incident Command Center Room 3H313.

This solution will require encoder and decoder hardware to communicate with Cinelink and Command 360 Software/hardware at these other locations. This effort also includes installation, testing, training, and a 1-year warranty and maintenance. This solution must also allow integration with the current Brightsign-based Facility Emergency Notification System infrastructure located throughout the NLVMC and 4 remote clinical locations.

The period of performance shall be delivery of a Video Wall Display Modernization Solution within 180 calendar days from date of award; and 12 months of warranty and maintenance support, upon successful conclusion of the installation, test, and burn-in at the NLVMC.

1.1 SALIENT CHARACTERISTICS

Video Command Software

HDMI & Audio Command Video Wall

Display 2EA 3103035 4K HDMI 2.0 TPX Rx with RS-232, IR, Ethernet, bi-dir rem pwr 2EA 3103034 4K HDMI 2.0 TPX Tx with RS-232, IR, Ethernet, bi-dir Rem pwr Audio System

Outputs, 2 Channels 1EA 4103010 4 Channel, 250W Per Channel, 70v or 8 Ohm Audio Power Amplifier

VTC System

HDMI-UCX-TPX-RX107

2EA 4003002 30x Zoom HD VTC Camera with Pan, Tilt & Zoom Controls TAA Compliant Touch Control System

Site to Site 1EA S-KR-PREMIUM-KLV Kraken Prem 8 Chnl H.264/HEVC HD Transcoding Sys KLV TAA Cert

1.2 GENERAL EQUIPMENT CHARACTERISTICS REQUIREMENTS

The Contractor’s Solution shall adhere to the general required functionality/performance specified below for each identified Command A/V category The following requirements are for the NLVMC Incident Command Center (ICC) Solution.

1.3 LOCATIONS

Tasks under this PD shall be performed at the following VA Site:

2.0 VIDEO WALL COMMAND SOFTWARE SOLUTION REQUIREMENTS

All Software and Visualizing Hardware must be currently represented on The Veterans Administration TRM (Technical Reference Model) to be considered.

Shall support integration into Active Directory authentication or authentication services such as TACACS+.

Must support two-factor authentication via Personal Identity Verification (PIV), Single Sign-on (SSO) is preferred.

The solution shall support role-based permissions for administrators and users including unlimited licensing for users.

Use Transport Layer Security (TLS) version 1.2 or higher public key certificate to encrypt communication on all web interfaces.

Shall support dual stack Internet Protocol version (IPv4/IPv6) environments.

Must meet Section 508 of the Rehabilitation Act information and communications technology accessibility standards.

The software solution shall provide native time clock applications to the displays for easy display of a minimum of four time zones

The solution will provide audit and event logs.

Support the ability to move windows or applications anywhere on the ICC displays dynamically.

Have the capability to dynamically scale an image to any size without limitations, aside from possible distortion of displayed content due to resolution.

The solution shall support a drag-and-drop and pinch-to-zoom management interface. The video wall management software solution interface shall be webserver based and accessed on a 24” Touch Panel. Solutions that require any proprietary software to be loaded and maintained on a “source” VA workstation or “source” laptop to operate are not considered.

Must use a “completely “Web Based browser interface capability.

Shall support user-defined preset content mapping to include incorporating shortcuts for quick recall.

Shall provide appliance(s) to allow for IP capture of a webpage and/or streaming media. This is intended to eliminate the need for a desktop except as required for the delivery of content as detailed below:

a. The facility shall provide a desktop for each installation with 2 HDMI outputs for content provisioning.

b. The solution shall utilize the desktop content for streaming web broadcasts composed of audio and video as well as other Windows-based applications.

Display real-time content including audio and video for HD cable TV.

Display multiple sources within a single section of the display (layering of content).

The solution shall support automated display content scheduling and automated content or layout rotation.

The software solution shall include a software update process that enables an administrator to perform multi-site, room, video wall, and device management tasks from a single administrative menu.

The solution provided appliance shall stream website content using a modern browser initially capable of displaying 16 distinct content sources with the capability to scale to 24 distinct content sources.

The solution shall provide a hot stand-by operating mode to allow for additional content sources to be streamed simultaneously through managed appliances. The streams in stand-by mode shall not consume hardware resources and shall be available for recall to the video wall using the management environment. All solutions provided streaming appliances must be managed via solution provided software presenting the streaming appliances as a single resource.

The solution shall require authenticated access for viewing content and using keyboard and mouse control. Authentication shall support integration with Active Directory and two-factor authentication via PIV, SSO is preferred.

Provide a minimum frame rate of 30 frames per second (FPS) at 1920 x 1080 or higher resolution per web application.

Provide two sub 300 millisecond latency streams, between encode and decode. One stream shall provide a feed to the video wall processor while the second stream is viewable within a modern browser to include but not limited to Chrome v83.

The solution shall provide management of streams using a modern browser without requiring the use of virtual machine environment to include, but not limited to, Remote Desktop Protocol, Virtual Network Computing (VNC), or products that utilize a VNC protocol.

The solution shall provide an appliance external to the video wall processor to render web content. Rendering web content shall not utilize video wall processor system resources.

Provide content viewing for an unlimited number of concurrent users from distinct instances of a modern browser from their local workstation.

Capable of providing audio from each of the input sources, to include but not limited to HD cable TV, HD satellite TV, and broadcasts via web browser.

The solution shall have processing encoders that are Approval to Operate (ATO) approved for secure interoperability communications by the VA OIT service for operation on the VA internal network.

TRM approval shall require the contractor to provide security configuration documentation for the software.

The solution must provide four virtual dashboard interfaces through a virtual content server to

3.0 COMMAND VIDEO WALL AND DISPLAYS SOLUTION REQUIREMENTS

The vendor’s solution shall provide installation of all system components to include but not limited to video display panels, video controllers, mounts, audio controllers, and associated network and video/audio cabling. Network and video cabling (fiber) is to be run and terminated in the closest IDF (closet 3H304)

The video wall solution must be Micro-LED Technology specifications to allow for proper integration with command software, display sizing, and pixilation of multiple video displays when conferencing with other VA Command centers.

The offeror shall clearly state power requirements and plug type within their response.

The installed display depth shall be compliant with the Americans with Disabilities Act.

The video controller and display shall support at least 24 source inputs.

Have the ability for local facilities personnel to remove/replace display modules.

Provide installation of all system components to include but not limited to video display panels, video controllers, mounts, audio controllers, and associated network and video/audio cabling. Network and video cabling (fiber) is to be run and terminated in the closest IDF (closet 3H304)

The video connectors required at the time of installation will be three HDMI connectors in support of two content sources provided via facility provided workstation and the other for HD satellite/cable TV at each installation. This is in addition to the connectors required for the IP capture appliance.

The display shall have locking internal cable connections.

The video wall system shall have a built-in option for control and health monitoring of the display including current status and email alerting over a LAN connection.

The video wall solution shall be field upgradable to allow for the inclusion of additional video inputs/outputs.

The video wall processor shall be field serviceable, and a spare parts kit shall be provided. This kit to include, (but not limited to), any HDDs, fans, and PSUs. HDDs, fans, and PSUs shall be hot-swappable and provide redundancy.

The video wall control terminal shall include be browser based controls for displays, input sources, video wall content layouts, audio, VTC codec, third-party TV (remote), and TV tuner and shall perform device control tasks such as audio source control, general room volume control, HD cable TV controls (if applicable), HD satellite TV controls, third party TV (remote) controls, and system on/off. The touch panel control system shall also perform automated device behaviors configured by an administrator as detailed below:

4.0 COMMAND AUDIO SOLUTION REQUIREMENTS

The solution shall include a new audio capture and delivery system, including two multi-lobe ceiling array microphones, Video Bridge, DSP and amplification. The ceiling speaker solution shall be comprised of 8 inch 70.7volt/100volt speakers. Pre-existing speakers may be utilized. The offeror shall provide and install the necessary wiring to connect the speakers to the data center mounted audio controller.

5.0 COMMAND VTC SOLUTION REQUIREMENTS

Allow for a user role to manipulate content but not administrative settings.

Allow administrators to restrict a user’s ability to control content to a specific area of the video wall.

Allow users and administrators to view content as it would be displayed on the video wall within the management interface.

Allow users and administrators to control all aspects of the video wall, within their role, from a single intuitive browser-based user interface.

6.0 COMMAND TOUCH CONTROL SOLUTION REQUIREMENTS

The solution shall provide one (1) 24” touch-screen control terminal, for visualization operation management. The control terminal shall be within the ICC (3H313) and with direct view of the video wall. System must have a browser based-direct touch-panel back up for all operations by users and administrators.

7.0 COMMAND SITE TO SITE SOLUTION REQUIREMENTS

The solution shall allow users to stream content displayed on the video wall between other VA geographic locations such as Orlando VA Medical Center (OVAMC), Austin, TX (AITC), Hines, IL (HITC), Tampa VA Medical Center, and Martinsburg, WV, CSOC, on an ad-hoc basis. This solution will require encoder and decoder hardware to communicate with Cinelink hardware at these other locations. Solution must use encoder technology that has ATO to operate on VA Network and is on the VATRM.

8.0 COMMAND VIDEO WALL DISPLAY MODERNIZATION SOLUTION SITE SPECIFIC REQUIREMENTS

8.1 INFRASTRUCTURE CONSIDERATIONS

The solution’s video processor shall be rack installed. Rack specifications are consistent with APC NetShelter with mounting rails 19 inches wide x 29 inches deep; 42RU rack enclosure cabinet.

The contractor shall supply all necessary electrical circuit wiring.

The Facility will provide appropriate power supply plugs within the mounting rack.

The contractor shall supply all necessary data wiring.

All cables ran farther than 6ft from the infrastructure cable trays will be either incased in conduit or plenum rated.

Offeror shall provide evidence that they have the capability to integrate the Command-and-Control A/V system supplied in this solution into the Brightsign-based Facility Emergency Notification system currently in place at the NLVMC.

The contractor’s solution shall provide installation of all system components to include but not limited to video display panels, video controllers, audio controllers, and associated network and video/audio cabling. Network and video cabling (fiber) is to be run and terminated in the closest IDF (closet 3H304)

The offeror shall clearly state power requirements and plug type within their response.

The solution’s video processor shall be supported by a facility-provided UPS and generator redundant power.

Offeror shall be familiar with the currently Brightsign-based Facility Emergency Notification System and the required process to integrate this new Command A/V system into the existing infrastructures.

8.2 VIDEO WALL INSTALLATION

The Contractor shall install all systems, software, and equipment procured under this contract in accordance with the accepted Master Installation Plan and Schedule.

The Contractor shall provide all necessary parts, racks, mounts, brackets, installation kits, connections/connectors, ancillary equipment, and cables necessary to install the required hardware and systems to an operational state. Any incidental hardware shall be identified in the Contractor’s quote or proposal.

If required by the Original Equipment Manufacturers (OEM), all equipment and systems shall be installed by OEM certified technicians and installers.

Contractor shall be responsible for any damage to furniture, or the building caused by the Contractor or their agents at the site listed above. It is incumbent upon the Contractor to identify to the COR any existing damage to the relevant areas of the building/furniture. All corrections and repairs to any building/furniture damage caused by the Contractor are at Contractor's expense.

8.3 VIDEO WALL TEST AND BURN-IN

The Contractor shall provide, at minimum, the results of the manufacturer’s recommended systems acceptance test within two weeks of test completion.

The Contractor shall also execute a VA authored acceptance test plan with members of the VA operations staff. This test plan to be provided prior to installation of the solution.

The Contractor shall provide an equipment burn-in period of 30 days immediately following the systems acceptance test, prior to commencement of the warranty period. The contractor shall be responsible for any hardware or software failures during this same 30-day burn-in period.

All issues and failures identified during the testing and burn-in period shall be addressed by the Contractor at no additional cost to the government.

Upon successful conclusion of the installation, test, and burn-in at the facility, the Contractor shall submit a certification of operational readiness to the VA within seven business days.

Deliverable:

A. Test Plan B. Certification of Operational Readiness

9.0 SUPPLEMENTAL REQUIREMENTS

9.1 PROJECT KICK-OFF MEETING / WEEKLY REPORT

The Contractor shall hold a kickoff meeting no later than 20 days after award or a mutually agreed upon date. Project kickoff meeting shall be held on-site at the facility. The purpose of the kick-off meeting is to review project scope; system requirements; verify site conditions; and to ensure there is an understanding between VA and the Contractor of the approach, major actions, the schedule for key milestones, and what is needed from NLVMC and the Contractor to ensure project success. The Contractor shall deliver a Master Installation Plan and Schedule encompassing the site 20 business days after project kick-off meeting. The Plan shall include:

a. Installation schedule with associated tasks and any foreseen risks or constraints.

b. Equipment to be installed.

c. Connectivity diagram showing specific connection at each physical port.

d. Government Furnished Equipment requirements to include connections and type.

e. Locations of all required electrical power outlets and circuit requirements; data connection points and all other type connections not installed by the Contractor as a part of this requirement.

f. All other types of connections/connector requirements.

g. Other required items necessary for successful equipment installation.

The Contractor shall deliver a weekly Progress Report every Monday beginning one week after conclusion of the Kickoff Meeting and updated thereafter throughout the period of performance until all site installations and testing are complete. The weekly report shall include:

a. Installation Schedule & Associated Tasks to include scheduled start and end dates and status (ongoing/complete/delayed)

Deliverable:

A. Master Installation Plan and Schedule B. Weekly Progress Report

9.2 WARRANTY AND MAINTENANCE SERVICES

The Contractor shall provide 12 months of maintenance and warranty services and software licensing for the hardware and software included in this PD. The Contractor shall provide, maintain, and administer warranty support agreements for use on all the systems and components and related hardware and software procured under this contract. The maintenance period shall not commence until the equipment has been successfully delivered and final acceptance has been granted by the VA.

The Contractor shall pass through the applicable OEM warranties to the Government, at no additional cost to the Government. The Warranty and the Warranty Support shall run concurrently with any applicable pass-through OEM warranty provided.

The Contractor shall be the primary/initial interface between the VA and the OEMs regarding all technical support issues as well as the primary interface for all warranty information. The Contractor shall serve as a single point of interface for all Support and Technical Issues.

The Contractor shall provide remote and on-site hardware maintenance and remote software maintenance support for the Video Wall Modernization Solution including but not limited to component parts, labor, shipping, and travel to ensure the Video Wall Modernization Solution is functioning properly. The contractor shall identify a POC and phone number to be the single point of contact for hardware/software maintenance. This number shall be available during regular (local) business hours.

Specific hardware and software support shall include the following:

a. Hardware Warranty and Maintenance – The hardware warranty and maintenance support shall cover all hardware included in the Video Wall Modernization Solution provided by the Contractor. In the event of component failure, the Contractor shall determine the cause of the failure and execute repairs. For serviceable components, the Contractor shall correct the failure and return the system to operation within no less than 24 hours, unserviceable components shall be replaced and operational within 3 business days of incident notification.

b. Software Maintenance - The OEM shall provide current versions of all software included in this PD. The software maintenance support shall include, at a minimum, support for installation of manufacturer software releases as well as all software upgrades, updates, and manufacturer released security patches and maintenance of licensing integrity. Security patches shall be received by VA within 5 business days of vendor issuance. All Patches, releases and updates shall be provided to the VA for installation.

9.3 PERFORMANCE PERIOD

All required equipment shall be delivered, installed, and tested NLT 180 calendar days after contract award.

9.4 SYSTEM DOCUMENTATION

Upon successful completion of the installation, the Contractor shall deliver a Site Documentation Package within 30 calendar days. The Site Documentation Package shall include, at a minimum:

Deliverable:

A. Site Documentation Package

9.5 TRAINING SERVICES

The Contractor shall provide in-depth, onsite technical training sessions. The frequency is anticipated to be a total of 2 classes per topic during the base period.

The topics of the training classes include:

1. Video Wall User Training

1. Video Wall Administrator Training

The training schedule shall be organized in conjunction with the local personnel (preferred times will be early in the morning and late in the evening), with at least 2 offerings of each training course for each shift to allow staff from all 3 shifts of the Event Management staff. Class duration will be to be determined (TBD) days for each class and classes shall consist of a minimum of 5 attendees per class.

The Contractor shall conduct the training on-site at ICC room 3h313 during the Test and 30-day burn-in periods.

For each training course, all training materials must be made available prior to the training.

Deliverable:

1. Training materials, to include User Guide, Training syllabus and documentation.

10.0 NOTICE OF THE FEDERAL ACCESSIBILITY LAW AFFECTING ALL INFORMATION AND COMMUNICATION TECHNOLOGY (ICT) PROCUREMENTS (SECTION 508)

On January 18, 2017, the Architectural and Transportation Barriers Compliance Board (Access Board) revised and updated, in a single rulemaking, standards for electronic and information technology developed, procured, maintained, or used by Federal agencies covered by Section 508 of the Rehabilitation Act of 1973, as well as our guidelines for telecommunications equipment and customer premises equipment covered by Section 255 of the Communications Act of 1934. The revisions and updates to the Section 508-based standards and Section 255-based guidelines are intended to ensure that information and communication technology (ICT) covered by the respective statutes is accessible to and usable by individuals with disabilities.

10.1 SECTION 508 – INFORMATION AND COMMUNICATION TECHNOLOGY (ICT) STANDARDS

The Section 508 standards established by the Access Board are incorporated into, and made part of all VA orders, solicitations and purchase orders developed to procure ICT. These standards are found in their entirety at: https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines. A printed copy of the standards will be supplied upon request.

Federal agencies must comply with the updated Section 508 Standards beginning on January 18, 2018. The Final Rule as published in the Federal Register is available from the Access Board: https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule.

The Contractor shall comply with “508 Chapter 2: Scoping Requirements” for all electronic ICT and content delivered under this contract. Specifically, as appropriate for the technology and its functionality, the Contractor shall comply with the technical standards marked here:

10.2 COMPATABILITY WITH ASSISTIVE TECHNOLOGY

The standards do not require installation of specific accessibility-related software or attachment of an assistive technology device. Section 508 requires that ICT be compatible with such software and devices so that ICT can be accessible to and usable by individuals using assistive technology, including but not limited to screen readers, screen magnifiers, and speech recognition software.

10.3 ACCEPTANCE AND ACCEPTANCE TESTING

Deliverables resulting from this solicitation will be accepted based in part on satisfaction of the Section 508 Chapter 2: Scoping Requirements standards identified above.

The Government reserves the right to test for Section 508 Compliance before delivery. The Contractor shall be able to demonstrate Section 508 Compliance upon Deliverables resulting from this solicitation will be accepted based in part on satisfaction of the Section 508 Chapter 2: Scoping Requirements standards identified above.

The Government reserves the right to test for Section 508 Compliance before delivery. The Contractor shall be able to demonstrate Section 508 Compliance upon delivery.

10.4 INFORMATION TECHNOLOGY USING ENERGY-EFFICIENT PRODUCTS

The Contractor shall comply with Sections 524 and Sections 525 of the Energy Independence and Security Act of 2007; Section 104 of the Energy Policy Act of 2005; Executive Order 13834, “Efficient Federal Operations”, dated May 17, 2018; Executive Order 13221, “Energy-Efficient Standby Power Devices,” dated August 2, 2001; and the Federal Acquisition Regulation (FAR) to provide ENERGY STAR®, Federal Energy Management Program (FEMP) designated, low standby power, and Electronic Product Environmental Assessment Tool (EPEAT) registered products in providing information technology products and/or services.

10.5 EPEAT

EPEAT product compliance is not required in this acquisition.

10.6 ENERGY STAR

As required in clause 52.223-15 Energy Efficiency in Energy-Consuming Products, the Contractor shall provide products that earn the ENERGY STAR label and meet ENERGY STAR specifications for energy efficiency. For information about ENERGY STAR, see http://www.energystar.gov for complete product specifications and updated lists of qualifying products.

10.7 FEMP

As required in clause 52.223-15 Energy Efficiency in Energy-Consuming Products, the contractor shall only provide products that meet Federal Energy Management Program (FEMP) and/or FEMP Low Standby Power purchasing specifications for energy efficiency under this contract, as applicable. Covered product categories and the applicable energy efficiency requirements can be found at http://energy.gov/eere/femp/covered-product-categories and low standby power product list can be found at https://www.energy.gov/eere/femp/low-standby-power-product-list.

10.8 SHIPMENT OF HARDWARE OR EQUIPMENT

Inspection: Destination Acceptance: Destination Free on Board (FOB): Destination

Ship To and Mark For:

Primary:

Alternate:

Name:

Name:

Address:

Address:

Voice:

Voice:

Email:

Email:

10.9 SPECIAL SHIPPING INSTRUCTIONS

Prior to shipping, the Contractor shall notify Site POCs, by phone followed by email, of all incoming deliveries including line-by-line details for review of requirements the PM, Steven Smith/Steven Telles should be cc’d on this correspondence to the POC’s. The Contractor cannot make any changes to the delivery schedule at the request of Site POCs.

Contractors must coordinate deliveries with Site POCs before shipping of wall display monitors and the associated equipment to ensure sites have adequate storage space.

All shipments, either single or multiple container deliveries, shall bear the VA Purchase Order number and site locations on external shipping labels and associated manifests or packing lists. In the case of multiple container deliveries, a statement readable near the VA PO number will indicate total number of containers for the complete shipment (ex. “Package 1 of 2”), clearly readable on manifests and external shipping labels.

Packing Slips/Labels and Lists shall include the following:

IFCAP PO # ___TBD_________ (e.g., 166-E11234. The IFCAP PO number is located in block #20 of the SF 1449.)

Project Description:

Total number of Containers: Package ___ of ___. (e.g., Package 1 of 3)

10.10 VA TECHNICAL REFERENCE MODEL

The Contractor shall support the VA enterprise management framework. In association with the framework, the Contractor shall comply with OIT Technical Reference Model (VA TRM). The VA TRM is one component within the overall Enterprise Architecture (EA) that establishes a common vocabulary and structure for describing the information technology used to develop, operate, and maintain enterprise applications. Moreover, the VA TRM, which includes the Standards Profile and Product List, serves as a technology roadmap and tool for supporting OIT. Architecture & Engineering Services (AES) has overall responsibility for the VA TRM.

NOTE FROM TRM:

All software components of the solution shall pass analysis and be incorporated into the contract award. TRM approval shall require the contractor to provide security configuration documentation for the software.

10.11 SOCIAL SECURITY NUMBER (SSN) REDUCTION

The Contractor solution shall support the Social Security Number (SSN) Fraud Prevention Act (FPA) of 2017 which prohibits the inclusion of SSNs on any document sent by mail. The Contractor support shall also be performed in accordance with Section 240 of the Consolidated Appropriations Act (CAA) 2018, enacted March 23, 2018, which mandates VA to discontinue using SSNs to identify individuals in all VA information systems as the Primary Identifier. The Contractor shall ensure that any new IT solution discontinues the use of SSN as the Primary Identifier to replace the SSN with the Integrated Control Number (ICN) in all VA information systems for all individuals. The Contractor shall ensure that all Contractor delivered applications and systems integrate with the VA Master Person Index (MPI) for identity traits to include the use of the ICN as the Primary Identifier. The Contractor solution may only use a Social Security Number to identify an individual in an information system if and only if the use of such number is required to obtain information VA requires from an information system that is not under the jurisdiction of VA.

10.12 INTERNET PROTOCOL VERSION 6 (IPV6)

The Contractor solution shall support Internet Protocol Version 6 (IPv6) based upon the memo issued by the Office of Management and Budget (OMB) on November 19, 2020 (https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-07.pdf). IPv6 technology, in accordance with the USGv6 Program (https://www.nist.gov/programs- projects/usgv6-program/usgv6-revision-1), NIST Special Publication (SP) 500-267B Revision 1 “USGv6 Profile” (https://doi.org/10.6028/NIST.SP.500-267Br1), and NIST SP 800-119 “Guidelines for the Secure Deployment of IPv6” (https://doi.org/10.6028/NIST.SP.800-119), compliance shall be included in all IT infrastructures, application designs, application development, operational systems and sub-systems, and their integration. In addition to the above requirements, all devices shall support native IPv6 and dual stack (IPv6 / IPv4) connectivity without additional memory or other resources being provided by the Government, so that they can function in a mixed environment. All public/external facing servers and services (e.g. web, email, DNS, ISP services, etc.) shall support native IPv6 and dual stack (IPv6 / IPv4) users and all internal infrastructure and applications shall communicate using native IPv6 and dual stack (IPv6 / IPv4) operations.

ADDENDUM B – VA INFORMATION AND INFORMATION SYSTEM SECURITY/PRIVACY LANGUAGE

APPLICABLE PARAGRAPHS TAILORED FROM: THE VA INFORMATION AND INFORMATION SYSTEM SECURITY/PRIVACY LANGUAGE, VA HANDBOOK 6500.6, APPENDIX C, AP RIL 22, 2024

B1. GENERAL

Contractors, Contractor personnel, Subcontractors, and Subcontractor personnel will be subject to the same Federal laws, regulations, standards, VA Directives and Handbooks as VA and VA personnel regarding information and information system security and privacy.

B2. VA INFORMATION CUSTODIAL LANGUAGE. This entire section applies to all acquisitions requiring any Information Security and Privacy language.

a. The Government shall receive unlimited rights to data/intellectual property first produced and delivered in the performance of this contract or order (hereinafter “contract”) unless expressly stated otherwise in this contract. This includes all rights to source code and all documentation created in support thereof. The primary clause used to define Government and Contractor data rights is FAR 52.227-14 Rights in Data – General. The primary clause used to define computer software license (not data/intellectual property first produced under this contractor or order) is FAR 52.227-19, Commercial Computer Software License.

b. Information made available to the contractor by VA for the performance or administration of this contract will be used only for the purposes specified in the service agreement, SOW, PWS, PD, and/or contract. The contractor shall not use VA information in any other manner without prior written approval from a VA Contracting Officer (CO). The primary clause used to define Government and Contractor data rights is FAR 52.227-14 Rights in Data – General.

c. VA information will not be co-mingled with any other data on the contractor’s information systems or media storage systems. The contractor shall ensure compliance with Federal and VA requirements related to data protection, data encryption, physical data segregation, logical data segregation, classification requirements and media sanitization.

d. VA reserves the right to conduct scheduled or unscheduled audits, assessments, or investigations of contractor Information Technology (IT) resources to ensure information security is compliant with Federal and VA requirements. The contractor shall provide all necessary access to records (including electronic and documentary materials related to the contracts and subcontracts) and support (including access to contractor and subcontractor staff associated with the contract) to VA, VA's Office Inspector General (OIG), and/or Government Accountability Office (GAO) staff during periodic control assessments, audits, or investigations.

e. The contractor may only use VA information within the terms of the contract and applicable Federal law, regulations, and VA policies. If new Federal information security laws, regulations or VA policies become applicable after execution of the contract, the parties agree to negotiate contract modification and adjustment necessary to implement the new laws, regulations, and/or policies.

f. The contractor shall not make copies of VA information except as specifically authorized and necessary to perform the terms of the contract. If copies are made for restoration purposes, after the restoration is complete, the copies shall be destroyed in accordance with VA Directive 6500, VA Cybersecurity Program and VA Information Security Knowledge Service.

g. If a Veterans Health Administration (VHA) contract is terminated for default or cause with a business associate, the related local Business Associate Agreement (BAA) shall also be terminated and actions taken in accordance with VHA Directive 1605.05, Business Associate Agreements. If there is an executed national BAA associated with the contract, VA will determine what actions are appropriate and notify the contactor.

h. The contractor shall store and transmit VA sensitive information in an encrypted form, using VA-approved encryption tools which are, at a minimum, Federal Information Processing Standards (FIPS) 140-2, Security Requirements for Cryptographic Modules (or its successor) validated and in conformance with VA Information Security Knowledge Service requirements. The contractor shall transmit VA sensitive information using VA approved Transport Layer Security (TLS) configured with FIPS based cipher suites in conformance with National Institute of Standards and Technology (NIST) 800-52, Guidelines for the Selection, Configuration and Use of Transport Layer Security (TLS) Implementations.

i. The contractor’s firewall and web services security controls, as applicable, shall meet or exceed VA’s minimum requirements.

j. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor may use and disclose VA information only in two situations: (i) in response to a qualifying order of a court of competent jurisdiction after notification to VA CO (ii) with written approval from the VA CO. The contractor shall refer all requests for, demands for production of or inquiries about, VA information and information systems to the VA CO for response.

k. Notwithstanding the provision above, the contractor shall not release VA records protected by Title 38 U.S.C. § 5705, Confidentiality of medical quality- assurance records and/or Title 38 U.S.C. § 7332, Confidentiality of certain medical records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse or infection with Human Immunodeficiency Virus (HIV). If the contractor is in receipt of a court order or other requests for the above- mentioned information, the contractor shall immediately refer such court order or other requests to the VA CO for response.

l. Information made available to the contractor by VA for the performance or administration of this contract or information developed by the contractor in performance or administration of the contract will be protected and secured in accordance with VA Directive 6500 and Identity and Access Management (IAM) Security processes specified in the VA Information Security Knowledge Service.

m. Any data destruction done on behalf of VA by a contractor shall be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management, VA Handbook 6300.1, Records Management Procedures, and applicable VA Records Control Schedules.

n. The contractor shall provide its plan for destruction of all VA data in its possession according to VA Directive 6500 and NIST 800-88, Guidelines for Media Sanitization prior to termination or completion of this contract. If directed by the COR/CO, the contractor shall return all Federal Records to VA for disposition.

o. Any media, such as paper, magnetic tape, magnetic disks, solid state devices or optical discs that are used to store, process, or access VA information that cannot be destroyed shall be returned to VA. The contractor shall hold the appropriate material until otherwise directed by the Contracting Officer’s Representative (COR) or CO. Items shall be returned securely via VA-approved methods. VA sensitive information must be transmitted utilizing VA-approved encryption tools which are validated under FIPS 140-2 (or its successor) and NIST 800-52. If mailed, the contractor shall send via a trackable method (USPS, UPS, FedEx, etc.) and immediately provide the COR/CO with the tracking information. Self-certification by the contractor that the data destruction requirements above have been met shall be sent to the COR/CO within 30 business days of termination of the contract.

p. All electronic storage media (hard drives, optical disks, CDs, back-up tapes, etc.) used to store, process or access VA information will not be returned to the contractor at the end of lease, loan, or trade-in. Exceptions to this paragraph will only be granted with the written approval of the VA CO.

B3. SECURITY INCIDENT INVESTIGATION. This entire section applies to all acquisitions requiring any Information Security and Privacy language.

a. The contractor, subcontractor, their employees, or business associates shall immediately (within one hour) report suspected security / privacy incidents to the VA OIT’s Enterprise Service Desk (ESD) by calling (855) 673-4357 (TTY: 711). The ESD is OIT’s 24/7/365 single point of contact for IT-related issues. After reporting to the ESD, the contractor, subcontractor, their employees, or business associates shall, within one hour, provide the COR/CO the incident number received from the ESD.

b. To the extent known by the contractor/subcontractor, the contractor/ subcontractor's notice to VA shall identify the information involved and the circumstances surrounding the incident, including the following:

(1) The date and time (or approximation of) the Security Incident occurred.

(2) The names of individuals involved (when applicable).

(3) The physical and logical (if applicable) location of the incident.

(4) Why the Security Incident took place (i.e., catalyst for the failure).

(5) The amount of data belonging to VA believed to have been compromised.

(6) The remediation measures the contractor is taking to ensure no future incidents of a similar nature.

c. After the contractor has provided the initial detailed incident summary to VA, they will continue to provide written updates on any new and relevant circumstances or facts they discover. The contractor, subcontractor, and their employes shall fully cooperate with VA or third-party entity performing an independent risk analysis on behalf of VA. Failure to cooperate may be deemed a material breach and grounds for contract termination.

d. VA IT contractors shall follow VA Handbook 6500, Risk Management Framework for VA Information Systems VA Information Security Program, and VA Information Security Knowledge Service guidance for implementing an Incident Response Plan or integrating with an existing VA implementation.

e. In instances of theft or break-in or other criminal activity, the contractor/subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG, and the VA Office of Security and Law Enforcement. The contractor, its employees, and its subcontractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The contractor/subcontractor shall cooperate with VA in any civil litigation to recover VA information, obtain monetary or other compensation from a third party for damages arising from any incident, or obtain injunctive relief against any third party arising from, or related to, the incident.

f. The contractor shall comply with VA Handbook 6500.2, Management of Breaches Involving Sensitive Personal Information, which establishes the breach management policies and assigns responsibilities for the oversight, management and reporting procedures associated with managing of breaches.

g. With respect to unsecured Protected Health Information (PHI), the contractor is deemed to have discovered a data breach when the contractor knew or should have known of breach of such information. When a business associate is part of VHA contract, notification to the covered entity (VHA) shall be made in accordance with the executed BAA.

h. If the contractor or any of its agents fails to protect VA sensitive personal information or otherwise engages in conduct which results in a data breach involving any VA sensitive personal information the contractor/subcontractor processes or maintains under the contract; the contractor shall pay liquidated damages to the VA as set forth in clause 852.211-76, Liquidated Damages— Reimbursement for Data Breach Costs.

B4. INFORMATION SYSTEM HOSTING, OPERATION, MAINTENANCE OR USE.

This entire section applies to information systems, systems, major applications, minor applications, enclaves, and platform information technologies (cloud and non- cloud) hosted, operated, maintained, or used on behalf of VA at non-VA facilities.

a. The contractor shall comply with all Federal laws, regulations, and VA policies for Information systems (cloud and non-cloud) that are hosted, operated, maintained, or used on behalf of VA at non-VA facilities. Security controls for collecting, processing, transmitting, and storing of VA sensitive information, must be in place. The controls will be tested by VA or a VA sanctioned 3PAO and approved by VA prior to hosting, operation, maintenance or use of the information system or systems by or on behalf of VA. This includes conducting compliance risk assessments, security architecture analysis, routine vulnerability scanning, system patching, change management procedures and the completion of an acceptable contingency plan for each system. The contractor’s security control procedures shall be the same as procedures used to secure VA-operated information systems.

b. Outsourcing (contractor facility, equipment, or staff) of systems or network operations, telecommunications services or other managed services require Assessment and Authorization (A&A) of the contractor’s systems in accordance with VA Handbook 6500 as specified in VA Information Security Knowledge Service. Major changes to the A&A package may require reviewing and updating all the documentation associated with the change. The contractor’s cloud computing systems shall comply with FedRAMP and VA Directive 6517 requirements.

c. The contractor shall return all electronic storage media (hard drives, optical disks, CDs, back-up tapes, etc.) on non-VA leased or non-VA owned IT equipment used to store, process or access VA information to VA in accordance with A&A package requirements. This applies when the contract is terminated or completed and prior to disposal of media. The contractor shall provide its plan for destruction of all VA data in its possession according to VA Information Security Knowledge Service requirements and NIST 800-88. The contractor shall send a self-certification that the data destruction requirements above have been met to the COR/CO within 30 business days of termination of the contract.

d. All external internet connections to VA network involving VA information must be in…