IN 4028 Postage Machines Lease PWS_Use.docx

PERFORMANCE WORK STATEMENT

Title: IN 4028 Postage Machines Lease

1.0 Background

The Department of Veterans Affairs (VA) consists of the Veterans Health Administration (VHA), which operates over 170 Medical Centers and 1,063 medical clinics; the Veterans Benefits Administration (VBA), which operates 56 regional benefit offices; the National Cemetery Administration (NCA), which operates over 136 national cemeteries; and numerous staff offices such as the VA Central Office (VACO). VACO operates multiple facilities in Washington, DC.

VACO is establishing and streamlining a lease-based contract vehicle to procure mail systems, standardizing and integrating mailroom operations for the VA administration and staff offices.

VACO has established strategic objectives related to mailroom operations:

· Modernize and standardize mail systems.

· Establish, enhance, and advance mail management reporting through web accessible, cloud-based data hosting services to optimize mail operations and funding efficiencies.

· Establish and advance centralized management and oversight of agency mail managers, mail operations, and accomplishment of emerging strategic objectives.

The federal chief information officer (CIO) has confirmed that for Software-as-a-Service (SaaS), agencies have the option of: (1) leveraging a provisional authority to operate (P-ATO) completed by the Joint Authorization Board (JAB); (2) leveraging an ATO completed by another agency; or (3) conducting their own ATO. However, if either the JAB or another agency has already gone through the risk management framework (RMF) process with the cloud service provider, then we encourage the agency to leverage the work already done. This is less burdensome for both the agencies and the service providers.

VACO requires equipment and services for its mailrooms to standardize mail services, technology, processes, and accountability. In addition, the equipment and services meter mail, provide the best cost shipping options, allow for accurate reporting, accountability of volume and expenditures, and traceability of mail and parcels. All applicable hardware, software, and support services must adhere to the United States Postal Service (USPS) Domestic Mail Manual (DMM), located at www.usps.gov, and shipping partners' rules and regulations, such as those of the United Parcel Service (UPS), Federal Express (FedEx), DHL, etc.

2.0 Scope

Pursuant to 44 U.S.C. § 2904, General Services Administration (GSA) has issued regulations requiring all executive agencies to adopt commercial payment processing to pay postage costs and to ensure that mail costs are identified at the agency program level (see 41 C.F.R. § 102-192-50 et seq.).

To meet this requirement, the VA intends to lease a comprehensive mail/shipping solution, “mail system.” For the purpose of this PWS, a mail system is defined as any mail processing equipment, web-based software solutions, scalable cloud data storage/hosting, and support services to maintain all systems fully operational. The scope of this PWS is to provide mail system solutions for VACO.

3.0 Period of Performance (POP)

The Period of Performance (PoP) of this Firm Fixed Price contract shall be for one twelve (12)-month base period with four (4) 12-month option periods as follows:

Base Year: August 1, 2025, to July 31, 2026 Option Year 1: August 1, 2026–July 31, 2027 Option Year 2: August 1, 2027–July 31, 2028 Option Year 3; August 1, 2028–July 31, 2029 Option Year 4: August 1, 2029–July 31, 2030

3.1. Contract Type

This contract shall be awarded as a firm-fixed-price contract.

3.2. Place of Performance

Performance shall occur within the Washington D.C. Area at the following locations:

· 810 Vermont Ave, NW, Washington, DC, 20420

· 425 I Street NW, Washington, DC, 20420

3.3. Hours of Operation

The contractor shall assume the core work hours/schedule that the Government utilizes unless otherwise directed in the terms and conditions of the contract. The contractor shall also be prepared to provide maintenance support services to meet requirements and to support the peak mailroom processing needs.

3.4. Recognized Holidays

The contractor shall provide services during the facility hours of operation, except for the following federal holidays set by law (5 U.S.C. §6103), or as approved by the ordering contracting officer. The following are recognized United States (US) federal holidays:

· New Year’s Day (January 1)

· Martin Luther King, Jr.’s Birthday

· President’s Day

· Memorial Day

· Juneteenth Day (June 19)

· Independence Day (July 4)

· Labor Day

· Columbus Day

· Veteran’s Day (November 11)

· Thanksgiving Day

· Christmas Day (December 25)

3.5. Travel

The contact shall include all travel to and from the VA facilities for equipment delivery, implementation, training, maintenance support, services, and transition activities.

Travel required outside of the approved the contract by contractor personnel in the performance of this contract must be pre-approved by the ordering contracting office and the contracting officer’s representative (COR) five business days in advance. Travel shall be reimbursed in accordance with Federal Acquisition Regulations 31.205-46 as well as federal travel regulations. Each contractor invoice shall include copies of all receipts which support the travel costs claimed in the invoice. Trip reports shall be submitted to the COR within five business days after trip completion. General and administrative (G&A) expenses are prohibited and will not be reimbursed.

Contractor travel within the local commuting area will not be reimbursed. Local travel within a fifty (50)-mile radius from the contractor's facility or assigned Government-provided facility is considered the cost of doing business and will not be reimbursed. This includes travel, subsistence, and associated labor charges for travel time. Travel performed for personal convenience and daily travel to and from work at the contractor's facility or Government-assigned facility will not be reimbursed.

4.0 Applicable Documents

The following documents shall be used in the performance of the tasks in this performance work statement:

Mail Legislation, Directives, and Handbooks 39 U.S.C. § 601 - Letters carried out of the mail 40 U.S.C. 121 - Administrative (Title 39 Postal Service) 39 CFR Part 310 - ENFORCEMENT OF THE PRIVATE EXPRESS STATUTES 39 CFR Part 320 - SUSPENSION OF THE PRIVATE EXPRESS STATUTES Domestic Mail Manual - Mailing Standards of the USPS Official Mail Accounting System (OMAS) GSA Federal Management Regulation: Subchapter G - Administrative Programs Part 102-192 - Mail Management VA 6340 Directive/Handbook - Mail Management Procedures/Notices VA 6609 Directive - Mailing Sensitive Personal Information

Records Management Legislation, Directives, and Handbooks 44 U.S.C Chapter 29 - Records Management by the Archivist of the United States Public Law 94-575 FRM - H.R.13828 - An Act to amend title 44 U.S.C.

36 CFR Chapter XII, Subchapter B - RECORDS MANAGEMENT VA Directive 6300, Records and Information Management, February 26, 2009 VA Handbook 6300.1 Records Management Procedures, applicable VA Records Control Schedules VA Handbook 6500.1, Electronic Media Sanitization VA Directive 7179, Mandatory Use of The Federal Strategic Sourcing Initiative for Domestic Delivery Services for Express and Ground Small Package Shipments and Express Heavyweight Shipments

Security, Privacy, Fraud Legislation, Directives, and Handbooks 38 U.S. Code § 5725 - Contracts for data processing or maintenance 44 U.S.C. § 3541, “Federal Information Security Management Act (FISMA) of 2002”;

Homeland Security Presidential Directive 7: Critical Infrastructure Identification, Prioritization, and Protection 45 CFR Parts 160 and 164, Subparts A and C, the Security Standard (“Security Rule”) VA Directive and Handbook 0710, Personnel Suitability and Security Program

Reference Documents Trusted Internet Connections (TIC) Reference Architecture Document, Version 2.0, Federal Interagency Technical Reference Architectures, October 1, 2013 Federal Information Processing Standard (FIPS) Publication 140-2, (FIPS PUB 140-2) Use of Software-as-a-Service (SaaS), Managed Services, and Cloud-Based Native Technologies and Approaches Use of VA Enterprise Cloud (VAEC) to Host Applications Use of VA Enterprise Cloud (VAEC) for New Development US Federal Risk and Authorization Management Program (FedRAMP)

5.0 Mail System Requirements

This contract provides maximum flexibility for VA mailroom facilities to meet their local geographic and operational needs. The below chart depicts the mailroom facility by size (small, medium, and large) based on average mailroom processing volumes. The model provides the Government with the ability to estimate requirements and mail system proposed configurations.

(approx.)

Equipment/Software

· 10-100 parcels/day Mail Metering Machine (5.1, 5.2) Scalable Cloud-Based Data Hosting (5.1) Mail Metering Software (5.3) Web-Based Mail Machine Software (5.3) Scanner Tracking Software (5.3.4) Mail Opener (5.4.1) Letter Folder (5.4.2) Letter Inserter (5.4.2) Sorter (5.4.3) Mail Stacker (5.4.4) Digital Scale (5.4.5) Laser Printer (5.4.6) Thermal Printer (5.4.6) Hand-Held Scanner (5.4.7)

· 100-200 parcels/day

· 200+ parcels/day

5.1. Mail System Global Requirements

Global requirements shall be applied across all mail system components and services. Leased services shall include all mail processing equipment, web-based browser software, a scalable cloud-based software solution for data hosting (with web-portal access), mailroom processing accessories, and handheld scanners, all supported by maintenance and support services to keep all systems fully operational. Lease services additionally include delivery, set-up, configuration, user training, complete functionality testing, thirty (30) days of operating supplies, and removal of old equipment. If required by the ordering activity, third-party contractor or Government-owned equipment can only be processed with the authority and approval of the COR in writing.

5.1.1. VACO will lease only new, unused, non-refurbished, non-remanufactured mail system equipment. This applies to all components of the equipment, replacement parts, associated accessories, and supplies.

5.1.2. VACO locations shall lease hardware, software, or both when necessary to meet the mail system solution requirements. Only new equipment procurement is authorized to procure additional maintenance beyond the initial warranty period; legacy equipment is only authorized to procure software to update that respective equipment. The utilization of existing compatible components is a requirement to conserve VA fiscal resources.

5.1.3. The Mail system shall include password-protected security features to prevent unauthorized use. The software application connecting all the mailing systems for reporting purposes must be FIPS-compliant and support active directory sign-on authentication.

5.1.4. The contractor will offer to upgrade machine technologies as they become available, and, if required, replace machines as the technology demands. Existing equipment shall be forward- and backward-compatible with new equipment introduced into the mail center.

5.1.5. Postage meters must have the ability to stamp and postmark mailings, charging postage costs to the meter balance. Meters should be able to provide exact shipping costs, deducted from the meter, and have the ability to utilize postage discount rates assigned by the USPS.

5.1.6. Postage meters shall be compatible with all major shippers and have the ability to work with and process mail formats associated with USPS DMM products, services, and shipping partner rules and regulations.

5.1.7. Software shall have the ability to electronically capture, store, and make accessible mail management data for VA use. Data captured and stored shall be identifiable and referenced by the serial number of each individual piece of equipment generating such data. Data shall include United States and international volumes (number of pieces) and expenditures for USPS letters/flats/packages in all mail classes, and commercially provided expedited services in all shipping classes. (Reference Appendix A – VA Agency Mail Data Requirements.)

5.1.8. An equipment-naming convention shall identify each mail machine by serial number, agency, administration, region, station identification number, account owner, facility, and physical location. The following format shall be used in all service and financial documentation. (Reference: VA Directive 7179 and Station Identification Number Reference: https://www.va.gov/directory/guide/rpt_fac_list.cfm.)

Example:

ID

Account Owner

Baltimore Regional Office 31 Hopkins Plaza Baltimore, MD 21201

5.1.9. Contractor shall be responsible for the removal of machines, mail meters, and accessories confirmed and approved with the COR not later than (NLT) 10 business days of the expiration or cancellation.

5.1.10. The contractor shall ensure all unused mail meter postage funds are returned to the VA, in a method reported, confirmed, and approved with the COR NLT four to six weeks of expiration or cancellation of the contract.

5.1.11. Media (i.e., hard drives, flash drives, memory devices, etc.) must be removed from the equipment and secured and managed with a return authorization approved by the COR NLT five business days within the expiration or cancellation of the contract.

5.2. Postage Meter and System Requirements

VACO requires a cost-effective leased, metered mail system, associated USPS-certified postal funds meter capability for all VACO-operated mailroom facilities. The postage metering capability shall meet the performance and volume/throughput demands of the individual facility or facilities as defined in the contract requirements. Equipment is to be of the latest technologies associated with mail processing.

5.2.1. Mail Systems must support the requirements as defined in the Government Publishing Office (GPO) Code of Federal Regulations 41 CFR 102 – 192 – Mail Management. All physical and virtual postage meters must meet the Department of the Treasury’s requirement for using depositaries to hold public money, Chapter 4100 Section 4130.

5.2.2. The mail systems shall accurately scan, weigh, rate, meter, and account for all outbound mail and parcels. All equipment supplied shall have postage meters with remote capability that permit postage replenishment, usage, and balance reporting.

5.2.3. The mail systems shall accommodate network connectivity for downloading postage, software upgrades, updating rate changes, data collection, reporting, and maintenance. It is the contractor’s responsibility to meet VA security requirements for all contractor-supplied equipment and software.

5.2.4. The mail systems shall provide rate shopping and produce UPS-, FedEx-, and USPS-compliant bar codes through standard thermal label printer(s). No specialized label stock will be acceptable and must meet USPS regulations.

5.2.5. Mail systems shall support VA carrier-negotiated rates for USPS, UPS, and FedEx. This includes, but is not limited to, discounted rates these carriers have on the GSA Schedule 48 as well as any VA carrier-negotiated rate for the term of the lease agreement. The contractor shall sign nondisclosure agreements to ensure confidentiality of VA-negotiated rates and services.

5.3. Mailing and Shipping Software Requirements

5.3.1. Mail system shall support seamless processing of all carriers through automatic rate shopping. Software shall automatically determine the most economical delivery method for letters, flats, and parcels by examining criteria such as applied business rules, delivery time, priority, and transportation method, and then produce the carrier-compliant label.

5.3.2. Software shall be delivered and maintained at the contractor's most current version. The contractor shall deliver software that is operational/functional at the level specific to each new or legacy piece of equipment and scalable across the VACO to facilitate maximum web-based access.

5.3.3. The software utilities shall provide access and identity controls to prevent unauthorized access or use.

5.3.4. Software shall provide a web-based/online end-to-end tracking of letters/flats/packages throughout the delivery process. The software shall also be capable of resource visibility, management reporting, throughput efficiencies, and workload or resource distribution. This software shall be available across VACO for new equipment under this contract vehicle.

5.3.5. Software shall be web-based, allowing remote access to mail machines. Mail machines shall have locally stored data, which includes United States and international volumes (number of pieces) and expenditures for USPS letters/flats/packages in all mail classes, and commercially provided expedited services in all shipping classes.

5.3.6. The contractor shall provide a cloud solution for VACO. The cloud solution shall allow compatible VACO mailroom equipment to automatically transmit data to the cloud. Based on equipment compatibility, data shall be transmitted to the cloud hosting service on a transactional basis within twenty-four (24) hours of transaction completion or manually, based on equipment compatibility. Cloud-stored data will be consistent with the format as described in Section 5.1.9.

5.3.7. The cloud solution shall provide a web-based portal for accessing the cloud-stored data. Cloud-stored data shall be accessible and downloadable to VACO systems for data analysis and reporting.

5.3.8. Software shall have the ability to capture and download postage, track and determine how much postage has been downloaded; determine postage remaining on the meter, and report daily/monthly/yearly spending from the meter

5.3.9. Data shall be accessible to VACO for the term of the contract and, at no additional cost, delivered to VACO at the expiration of the contract. The comprehensive consolidated data file shall be delivered NLT 30 days before the end of the contract POP. Both the 30-day cycle data and the comprehensive consolidated file shall be in a government-designated medium, format, and configuration for delivery.

5.3.10. No software is to be loaded onto a VACO computer unless otherwise approved at the order level.

5.4. Mail System Accessory Requirements

5.4.1. Mail openers/extractors shall cut, open, and extract mail letters or overnight packs of different dimensions and thickness. Openers shall have adjustable cutters and options for single or multiple envelope cuts. Mailroom requirements range from processing a few letters per minute/hour to several thousand letters per hour. Mailrooms will define their individual overall requirements.

5.4.2. Folders/inserters shall provide low- to high-volume document and envelope feeders with multisheet collation and fold modes to meet mailroom specification requirements. Mailroom requirements range from processing a few letters per minute/hour to several thousand letters per hour. Mailrooms will define their individual overall requirements.

5.4.3. Sorters shall count the number of pieces in a postal tray and have the ability to sort several hundred to thousands of pieces per day. Sorters shall leverage postal discounts and report mailing cost statistics. Mailrooms will define their individual overall requirements.

5.4.4. Stackers shall provide low- to high-volume envelope handlers that clear stamped mail from the mail machine. Based on mailroom requirements, stackers may range from minimum volume holding trays to stackers that are power-driven to move stamped mail from the mail machine area. Mailroom requirements range from processing a few letters per minute/hour to several thousand letters per hour. Mailrooms will define their individual overall requirements.

5.4.5. Digital scales shall provide the ability to electronically weigh postal and parcel items for shipping. Scales shall be USB-capable for downloading weight data to a computer or other connected devices. Typical mailroom processing requires scales able to handle weight ranges from 0-70 lbs. Mailrooms will define their individual overall requirements.

5.4.6 Printers shall provide options for various mailroom requirements to meet mail addressing, barcoding, and postage printing. Each mailroom will specify their pages/minute, size, thickness, resolution, and type of media, such as extra-thick card stock, polyester, magnetic media, and transparency films. Pages should conform to industry standards.

5.4.7 Handheld scanners shall be able to be used to receive and process all types of mail with barcoded technology that allows traceability of items that are sent and received at mailroom facilities. Scanners shall be downloadable to a receipt/delivery program that can be a standalone or integrated technology that allows storage of information, printability, and allows for ease of data downloads and research. The receiving program should have editable fields that can be created for ease of sorting by the following methods: tracking number, facility/VA purchase order number, item number, address (sender/receiver), date, or other identifying methods as required by the facility.

5.5. Maintenance Support Requirements

All technology, hardware, software, and associated components of contractor-provided solutions shall include maintenance and support services.

5.5.1. Contractor maintenance shall include preventative maintenance at manufacturer-recommended intervals. The contractor shall submit a planned/projected maintenance schedule to be complied with and monitored by the COR.

5.5.2. The contractor shall follow standard commercial practices to furnish manual(s), handbook(s), or brochure(s) containing operation, installation, and maintenance instructions, including pictures or illustrations, schematics, and complete repair/test guides, as necessary, for technical equipment and devices and/or other technical and mechanical equipment. The manuals, handbooks, or brochures shall be provided in hard copy, soft copy, or with electronic access instructions, consistent with standard industry practices for the equipment or device. Where applicable, the manuals, handbooks, or brochures will include electrical data and connection diagrams for all utilities. The documentation shall also contain a complete list of all replaceable parts showing part number, name, and quantity required.

5.5.3. The contractor shall provide complete remedial and preventive maintenance for the components of the installed solution.

5.5.4. The contractor shall provide all replacement component parts as required to meet original equipment performance at no additional cost to VACO.

5.5.5. The contractor shall provide an affixed label to equipment that identifies equipment make, model, device serial number, mail meter serial number, and equipment service support and contact information.

5.5.6. The contractor shall employ field service engineers (FSE) who are fully trained, qualified, and certified to provide maintenance services and shall maintain personnel in sufficient numbers to provide service and maintenance support in accordance with the submitted maintenance schedule.

5.5.7. The contactor shall be available to handle general questions regarding machine operation, maintenance, warranty, service, and related issues. VACO personnel shall be able to access contractor service technicians via a toll-free number, Monday through Friday business days between the hours of 8:00 AM and 8:00 PM, Eastern Standard Time. Specific service-level agreement (SLA) requirements will be defined with individual TO awards.

5.5.8. The contractor shall maintain a record of all service calls, including the following minimum level of information: date and time the service call is received/resolved, location of equipment, name and phone number of the person reporting the problem, meter serial number, equipment serial number, description of the problem reported, response time, meter balance, final diagnosis of the problem and date and time of the final corrective action.

5.5.9. When a pattern of excessive repairs or other frequent operational problems/malfunctions occurs, the contractor shall replace the malfunctioning equipment, accessory, or software component. The term “excessive repairs” means two or more service calls in a single month, not including preventative maintenance calls.

5.6. Delivery, Installation, Operational Readiness, and Transition Requirements

The contractor shall install and make fully operational the mailing solution, including all accessories as ordered. The contractor shall be responsible for all costs associated with relocating or re-shipping any misdelivered solution components. At the expiration or termination of the lease, the contractor shall, at no cost to the Government, remove and pick up equipment from the Government facility. Media (i.e., hard drives, flash drives, memory devices, etc.) must be removed from the equipment, secured and managed with return authorization approved by the COR NLT five business days within expiration or cancellation of the contract.

5.6.1. The contractor shall complete delivery, installation, configuration, testing, and operational readiness not to exceed (NTE) 30 calendar days after contract award or as defined at the contract level. (The government COR or local government mailroom manager shall provide the contact’s name(s), address(s), telephone number(s), and prioritized delivery locations at the time of contract award.)

5.6.2. The contractor shall, at the time of operational readiness, ensure the implementation of the equipment naming convention as defined in Section 5.1.10 of this PWS.

5.6.3. The contractor shall contact the receiving site mail manager or COR to schedule delivery and installation as defined at the order level.

5.6.4. The contractor shall install and make fully operational the mailing solution(s), including all accessories as ordered.

5.6.5. The contractor shall establish internet connectivity to the postage meter for replenishment, rate change updates, etc. If applicable, the contractor is to fully test remote diagnostics and troubleshooting as part of the mail system operational readiness.

5.6.6. The contractor shall provide one hard copy and an electronic version of the operator’s manual and job aid(s).

5.6.7. The contractor shall remove trade-in components, old or discarded equipment from the installation site immediately after the new solution is installed and fully operational. This is done at no cost to VACO. Any equipment to be removed from a VACO facility will be identified at the contract level.

5.6.8. Transition activities and equipment shall have associated authorities and signed receipts that can be reconciled, noted, and administered to protect all parties. Media (i.e., hard drives, flash drives, memory devices, etc.) must be removed from the equipment, secured and managed with return authorization approved by the COR NLT five business days within expiration or cancellation of the contract.

5.7. Material and Supply Requirements

5.7.1. The contractor shall provide, at the time of delivery, an initial 30-business-day stock of supplies sufficient for the installed mailing system. The 30-day stock of supplies shall include ink, meter tape, sealing solution, and any other system-specific supplies sufficient for 30 business days of average use for the mailing system installed.

5.7.2. The contractor shall have access to an inventory of parts and consumable supplies in quantities sufficient to perform under the resulting order. The contractor must have an inventory system and delivery system for the parts and consumable supplies.

5.8. Training Requirements

5.8.1. The contractor shall provide training at the user site(s) to at least one key operator and one alternate for each solution installed.

5.8.2. The contractor shall provide and complete key operator training within two business days of the solution’s installation.

5.8.3. The contractor shall schedule training in coordination with the local mail manager or COR. Training shall include ad-hoc and web-based opportunities.

5.8.4. Training shall cover, at a minimum, the following operations: proper operation of the solution component(s), replacement and ordering of supplies, performance of routine tasks such as daily maintenance, adding postage to the meter, reporting of mail volumes and costs, locating a component’s model and serial numbers, meter serial number, and placing a service call.

5.9. Enterprise Cloud Authority to Operate

To establish, enhance, and advance enterprise mail management capabilities, cloud-based data storage and application hosting service requirements can be described as follows:

Non-Software-as-a-Service (SaaS) solutions utilizing the VA Enterprise Cloud (VAEC) cloud service providers (CSP) where VA-generated data and application services do not extend beyond VA’s architectural environment will not require FedRAMP authorization. The contractor shall, however, provide all assessment and authorization (A&A) support and documentation required to achieve and maintain full A&A certification for a data and application-level authority to operate (ATO) using the process specified in the VA’s A&A Standard Operating Procedure (SOP).

5.9.1. This section applies only for SaaS with VA data.

5.9.1.1. The information system solution selected by the contractor shall comply with the Federal Information Security Management Act (FISMA).

5.9.1.2. The contractor shall comply with FedRAMP requirements as mandated by Federal laws and policies, including making available any documentation, physical access, and logical access needed to support this requirement.

5.9.1.3. Following guidance from the federal CIO, the VA will utilize existing JAB ATO or agency ATO issued by another agency as a starting point for FedRAMP requirements. If neither of those exists, the VA will sponsor FedRAMP ATO. VA will be using the FedRAMP baselines as a starting point, since they are specifically tailored for cloud services.

5.9.1.4. The contractor shall, where applicable, assist with the VA authority to operate (ATO) process to help achieve agency authorization of the cloud service or migrated application.

5.9.1.5. The contractor shall afford VA access to the contractor’s and cloud service provider’s facilities, installations, technical capabilities, operations, documentation, records, and databases.

5.9.1.6. If new or unanticipated threats or hazards are discovered by either VA or the contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party.

5.9.1.7. The contractor shall not release any data without the consent of VA in writing. All requests for release must be submitted in writing to the COR/CO.

5.9.2. This section only applies to SaaS with no VA data. The SaaS product has no direct connections or interfaces to VA systems or networks. Users consent to share their data (which may include PII and PHI) directly with the SaaS provider. A SaaS provider must have published terms and conditions for user consent. VA providers access data in a view-only mode or with limited functionality per the user’s consent. All data processed by an SaaS provider shall be owned by the SaaS provider/user.

5.9.3. The contractor shall be fully responsible and accountable for ensuring compliance with all HIPAA, Privacy Act, FISMA, National Institute of Standards and Technology (NIST), FIPS, and VA security and privacy directives. This includes conducting compliant risk assessments, routine vulnerability scanning, system patching and change management procedures, and the completion of an acceptable contingency plan for each system. The contractor’s security control procedures must be equivalent to those procedures used to secure VA systems.

5.9.4. The contractor shall ensure adequate security controls for collecting, processing, transmitting, and storage and removal of personally identifiable information (PII) and personal health information (PHI), as determined by the VA Privacy Service, must be in place, tested, and approved by VA prior to hosting, operation, maintenance, or use of the information system, or systems by or on behalf of VA.

5.9.5. The contractor shall ensure these security controls are to be assessed and stated within the PIA, and if these controls are determined not to be in place or inadequate, a plan of action and milestones (POA&M) shall be submitted and approved prior to the collection of PII and PHI.

5.9.6. The contractor shall perform monthly reviews of the contractor-developed POAM with the VA PM/COR to ensure backlog is scheduled and prioritized for remediation, and to verify that defined milestones will be achieved.

5.9.7. The contractor shall perform monthly reviews of risk-based decisions with the VA PM/COR to ensure remediation of outstanding risks or a path forward is identified and achievable.

5.9.8. The contractor shall support documentation of a data use and reciprocal support agreement (DURSA)/memorandum of understanding ([MOU]/IS) between the solution environment and VA.

5.10. Postaward Meeting

Within five business days after contract award, the COR shall schedule a post-award “kick-off” meeting to be held with the Government and contractor representatives. The intent of the meeting is to initiate the communication process between the Government and contractor to ensure an open line of communication is established between key personnel (i.e., contractor contract representative, contractor technical staff, contract mailroom lead, and government COR).

5.11. Deliverables

Deliverables associated with this PWS are the following:

A. Contract activities: The prime contractor shall report new contract awards, cancellations, or any modification to the contract status, due NLT five business days from the first of each month.

B. The contractor shall repair the mail system within 24 hours after the request for the service call during the hours of 8:00 AM to 4:00 PM, Monday through Friday (excluding federal holidays).

C. Monthly service and maintenance calls roll-up report (identified by device serial number) for the preceding month, due NLT five business days from the first of each month.

D. Risk and issue report of overall contractor-provided equipment (identified by device serial number), services, and support, due NLT five business days from the first of each month.

E. Overall invoice detail and roll-up of all costs associated with overall contractor-provided equipment, services, and support, due NLT five business days from the first of each month.

F. Fielding schedule. The contractor shall develop, establish, provide for government approval, and implement/execute (upon CO approval) a new equipment fielding schedule, only to be modified by the receiving local mail center. The fielding schedule shall include the following data elements: mail center provided new equipment/software, mail center point of contact, date of actual delivery, date initially scheduled for delivery, number of pieces of new equipment, each new piece of equipment’s serial number, and contract line number associated with the new equipment delivery.

G. The contractor shall provide to the Government 100% of Government-owned data at the end of each 30-day billing cycle and a comprehensive consolidated file with 100% of all government data acquired throughout the life of the contract. The comprehensive consolidated data file shall be delivered NLT 30 days prior to the end of the contract’s POP. Both the 30-day cycle data and the comprehensive consolidated file shall be in a Government-designated medium, format, and configuration for delivery.

H. 1.) Enterprise Cloud Authority to Operate Plan of Action and Milestones.

2.) Enterprise Cloud Authority to Operate Assessment and Authorization and Authority to Operate Package.

I. Contractor shall provide prescribed services and requirements as defined in sections

5.0 – 5.10. of this PWS.

The contractor shall provide all deliverables identified in the PWS using Microsoft Office formats. All deliverables shall be compliant with Section 508, 1998 Amendment to the Rehabilitation Act of 1973 according to the requirements for each such deliverable.

The contractor shall regularly and systematically examine, clean, lubricate, test, adjust the equipment, and as conditions warrant, repair or replace equipment included under the contract. The contractor shall ensure that the mail system operates as originally designed and installed throughout the entire awarded contract period.

6.0 Contractor Performance

The contract performance will be monitored by the COR, who ensures all contractual obligations are being met. Any issues or contractual disputes will be forwarded to the CO via the COR.

The contractor’s performance on this PWS will be reported to the Contractor Performance Assessment Reporting System (CPARS) on an annual basis.

The CO and COR will make use of information from performance evaluations, as well as any additional knowledge and information available to them with respect to the contractor’s performance, to complete the CPARS. Contractors shall familiarize themselves with the CPARS process and be prepared to respond to reports entered by the CO and COR.

7.0 Government-Furnished Equipment (GFE)/Government-Furnished Information (GFI)

GFI/GFE, if required, may be facilitated at the order level.

B.3 APPENDIX A – VA AGENCY MAIL DATA REQUIREMENTS

United States Postal Service - Letters/Flats

Undeliverable as Addressed

United States Postal Service - Packages

Expedited Services - FedEx

Expedited Services - UPS

Other Services