P02 Draft PWS External Paging Services.pdf

DRAFT

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Office of Information & Technology

End User Services

External Paging Services

Date: 1/15/2026

VA-26-00037210

PWS Version Number: 1

Draft PWS External Paging Services Page 2 of 30

TABLE OF CONTENTS

1.0 BACKGROUND

2.0 APPLICABLE DOCUMENTS

3.0 SCOPE OF WORK

3.1 PERFORMANCE DETAILS

3.1.1 PERFORMANCE PERIOD

3.1.2 PLACE OF PERFORMANCE

3.2 CONTRACT TYPE

4.0 SPECIFIC TASKS AND DELIVERABLES

4.1 PROJECT MANAGEMENT

4.1.1 REPORTING REQUIREMENTS

4.2 FUNCTIONALITY AND FEATURES

4.3 BEEPER MAINTENANCE AND SERVICE LEVEL AGREEMENTS (SLA)

4.3.1 MEAN TIME TO REPAIR (MTTR)

4.3.2 PRIORITY 1- SERVICE OUTAGE

4.3.3 PRIORITY 2- SERVICE DEGRADED

4.3.4 EXCLUSIONS

4.3.5 MAINTENANCE PERFORMANCE

4.4 BEEPER MANAGEMENT SERVICES

4.4.1 BEEPER REPLACEMENT

4.4.2 RETURNS SHIPPING SUPPORT

4.4.3 URGENT DELIVERIES

4.4.4 WEB-BASED PORTAL

4.5 PERFORMANCE METRICS

4.6 FACILITY/RESOURCE PROVISIONS

4.7 GOVERNMENT FURNISHED PROPERTY

4.8 SHIPMENT OF HARDWARE OR EQUIPMENT

5.0 ADDENDUM A – ADDITIONAL VA REQUIREMENTS, CONSOLIDATED

6.0 ADDENDUM B – VA INFORMATION AND INFORMATION SYSTEM

SECURITY/ PRIVACY LANGUAGE

7.0 ADDENDUM C - SERVICE DELIVERY POINTS

8.0 POINTS OF CONTACT

Draft PWS External Paging Services Page 3 of 30

1.0 BACKGROUND

The Department of Veterans Affairs (VA), Office of Information & Technology (OIT), End User Operations (EUO), strives to provide high quality, effective, and efficient Information Technology (IT) services to those responsible for providing care to the Veterans at the point-of-care as well as throughout all the points of the Veterans’ health care in an effective, timely and compassionate manner. VA depends on Information Management/Information Technology (IM/IT) systems to meet mission goals.

EUO has a requirement to continue the current wireless messaging pager/beeper services and functionality for 81 Veterans Affairs Medical Centers (VAMC) in the states of Alabama, Arizona, California, Colorado, Florida, Georgia, Hawaii, Illinois, Indiana, Kentucky, Massachusetts, Maryland, Michigan, Missouri, Mississippi, North Carolina, New Hampshire, New Jersey, New Mexico, Nevada, New York, Ohio, Oregon, Pennsylvania, Rhode Island, South Carolina, Tennessee, Texas, Utah, Virginia, District of Columbia (Washington DC), Washington, and Wisconsin.

The contractor shall ensure that the proposed wireless messaging pager/beeper services includes lease of one-way, two-way messaging, and wireless information services, maintenance and replacement beepers for lost devices. Additionally, the contractor shall provide access to a web-based portal for moves, adds, deletions, and changes. Furthermore, the contractor shall provide shipping and return support of deployed devices. The period of performance for this effort shall be a 12-month base period with two 12-month option periods (if exercised).

2.0 APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. “Federal Information Security Modernization Act of 2014”

2. Federal Information Processing Standards (FIPS) Publication 140-3, “Security

Requirements for Cryptographic Modules”, March 22, 2019

3. FIPS Pub 199. “Standards for Security Categorization of Federal Information and

Information Systems,” February 2004

4. FIPS Pub 200, “Minimum Security Requirements for Federal Information and

Information Systems,” March 2006

5. FIPS Pub 201-3, “Personal Identity Verification of Federal Employees and

Contractors,” January 2022

6. 10 U.S.C. § 2224, "Defense Information Assurance Program", as amended

7. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

8. Public Law 109-461 (P.L. 109-461), Veterans Benefits, Health Care, and Information

Technology Act of 2006, as amended, Title IX, Information Security Matters

9. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”, as amended

10. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, https://www.va.gov/vapubs/index.cfm

Draft PWS External Paging Services Page 4 of 30

11. VA Handbook 0710, “Personnel Security and Suitability Program,” May 2, 2016,

12. VA Directive 6102, “Internet/Intranet Services,” August 5, 2019

13. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and

Guidelines,” as amended

14. Office of Management and Budget (OMB) Circular A-130, “Managing Federal

Information as a Strategic Resource,” July 28, 2016

15. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed Services

(CHAMPUS)”, as amended

16. NIST SP 800-66 Rev. 2, “Implementing the Health Insurance Portability and

Accountability Act (HIPAA) Security Rule: A Cybersecurity Resource Guide,” February 2024

17. 45 C.F.R Parts 160 and 164, Subparts A and E, the Standards for Privacy of Individually Identifiable Health Information (“Privacy Rule”); and 45 C.F.R. Parts 160 and 164, Subparts A and C, the Security Standard (“Security Rule”); as amended

18. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended

19. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

20. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021 (see VA

NOTICE 24-18, dated September 27, 2024, “Update to VA Directive 6500 Cybersecurity Program”, and VA Notice 25-07, dated 3/18/25, “Amending VA Directive 6500 to incorporate M-24-15”)

21. VA Handbook 6500, “Risk Management Framework for VA Information Systems VA Information Security Program,” February 24, 2021 (see VA Notice 25-01, dated October 15, 2024, “Update to VA Handbook 6500 Risk Management Framework for VA Information Systems VA Information Security Program”, and VA Notice 25-06, dated 3/18/25, “Amending VA Directive 6500 to incorporate M-24-15”)

22. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI),” June 30, 2023

23. VA Handbook 6500.6, “Contract Security,” March 12, 2010 (see VA Notice 24-12, dated April 22, 2024, “Update to VA Handbook 6500.6, Contract Security, Appendix C VA Information and Information System Security/Privacy Language For Inclusion Into Contracts, As Appropriate”)

24. VA Handbook 6500.8, “Information System Contingency Planning,” March 25, 2025

25. VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018

26. VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017

27. OIT Process Asset Library (PAL), OIT Process Asset Library.

28. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

29. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy

Impact Assessment,” October 15, 2014

30. VA Directive 6510, “VA Identity, Credential and Access Management,” September 3,

31. VA Handbook 6510, “VA Identity, Credential and Access Management,” September

27, 2024

32. VA Directive and Handbook 6513, “Secure External Connections,” October 12, 2017

33. VA Directive 6300, “Records and Information Management,” September 21, 2018 https://www.va.gov/vapubs/index.cfm http://www.va.gov/vapubs http://www.va.gov/vapubs https://digital.va.gov/process-asset-library/ https://www.va.gov/trm/TRMHomePage.aspx

Draft PWS External Paging Services Page 5 of 30

34. VA Handbook, 6300.1, “Records Management Procedures,“ March 24, 2010

35. NIST SP 800-37 Rev 2, “Risk Management Framework for Information Systems and

Organizations: A System Life Cycle Approach for Security and Privacy,” December

36. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020)

37. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015

38. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” March 24, 2014

39. OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005

40. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019

41. OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008

42. Federal Identity, Credential, and Access Management (FICAM) Architecture, June 30, 2023 (FICAM Architecture (idmanagement.gov))

43. NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access,“ June 2018

44. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, “Digital Identity Guidelines,” updated March 02, 2020

45. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014

46. VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland

Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

47. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

48. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

49. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

50. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019

51. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008

52. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (P.L.

110–140), December 19, 2007

53. Section 104 of the Energy Policy Act of 2005, (P.L. 109–58), August 8, 2005

54. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 2, 2001

55. VA Directive 0057, “VA Environmental Management Program,” October 25, 2022 https://www.idmanagement.gov/arch/#:~:text=FICAM%20is%20the%20federal%20government%E2%80%99s%20enterprise%20approach%20to,identity%20processes%2C%20practices%2C%20policies%2C%20and%20information%20security%20disciplines.

https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514 https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896 https://www.cisa.gov/publication/tic-30-core-guidance-documents

Draft PWS External Paging Services Page 6 of 30

56. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

57. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

58. “Veteran Focused Integration Process (VIP) Guide 4.0,” March 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

59. VA Memorandum “Proper Use of Email and Other Messaging Services,” January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

60. “Product Line Management Transformation Playbook” version 3.1, August 2023, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

61. NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020

62. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol Version

6 (IPv6),” November 19, 2020

63. Social Security Number (SSN) Fraud Prevention Act of 2017

64. Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23, 2018

65. C.F.R Title 15 Part 7, “Securing the Information and Communications Technology and Services (ICTS) Supply Chain”, as amended

66. Executive Order 14028, “Executive Order on Improving the Nation's Cybersecurity,”

May 12, 2021, https://bidenwhitehouse.archives.gov/briefing-room/presidential-actions/2025/01/16/executive-order-on-strengthening-and-promoting-innovation-in-the-nations-cybersecurity/

67. OMB Memorandum M-22-09, “Moving the U.S. Government Toward Zero Trust Cybersecurity Principles”, January 26, 2022, https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf.

68. NIST SP 800-52 Revision 2, “Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations

69. OMB M-22-18, “Enhancing the Security of the Software Supply Chain through Secure Software Development Practices,” September 14, 2022

70. OMB M-23-16, “Update to Memorandum M-22-18,” June 9, 2023

71. OMB M-21-31, “Improving the Federal Government’s Investigative and Remediation

Capabilities Related to Cybersecurity Incidents,” August 27, 2021

72. NIST SP 800-88 Revision 1 “Guidelines for Media Sanitization,” December 2014

73. CISA Binding Operational Directive (BOD) 19-02: “Vulnerability Remediation

Requirements of Internet-Accessible Systems,” April 29, 2019, BOD 19-02:

Vulnerability Remediation Requirements for Internet-Accessible Systems | CISA

74. CISA BOD 22-01: “Reducing the Significant Risk of Known Exploited Vulnerabilities,” November 3, 2021, BOD 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities | CISA

75. CISA BOD 23-01: Improving Asset Visibility and Vulnerability Detection on Federal Networks.” Cybersecurity & Infrastructure Security Agency (CISA), BOD 23-01:

Improving Asset Visibility and Vulnerability Detection on Federal Networks | CISA

76. VA Directive 6550, Pre-Procurement Assessment and Implementation of Medical Devices/Systems, June 03, 2019

77. VA Memorandum, “VA Security Controls,” January 17, 2025, https://www.voa.va.gov/DocumentView.aspx?DocumentID=5010 https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371 https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946 https://bidenwhitehouse.archives.gov/briefing-room/presidential-actions/2025/01/16/executive-order-on-strengthening-and-promoting-innovation-in-the-nations-cybersecurity/ https://bidenwhitehouse.archives.gov/briefing-room/presidential-actions/2025/01/16/executive-order-on-strengthening-and-promoting-innovation-in-the-nations-cybersecurity/ https://bidenwhitehouse.archives.gov/briefing-room/presidential-actions/2025/01/16/executive-order-on-strengthening-and-promoting-innovation-in-the-nations-cybersecurity/ https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf https://www.cisa.gov/news-events/directives/bod-19-02-vulnerability-remediation-requirements-internet-accessible-systems https://www.cisa.gov/news-events/directives/bod-19-02-vulnerability-remediation-requirements-internet-accessible-systems https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities https://www.cisa.gov/news-events/directives/bod-23-01-improving-asset-visibility-and-vulnerability-detection-federal-networks https://www.cisa.gov/news-events/directives/bod-23-01-improving-asset-visibility-and-vulnerability-detection-federal-networks https://www.voa.va.gov/DocumentView.aspx?DocumentID=5010

Draft PWS External Paging Services Page 7 of 30

3.0 SCOPE OF WORK

The Contractor shall continue to provide the necessary infrastructure, hardware, software, and program support for wireless messaging pager/beeper services. This shall include leased beepers of various device types, features, and plans to meet the needs described herein. The Contractor shall provide VA personnel with access to a web-based portal for management of moves, adds, and changes. The Contractor shall provide end users with how to use instructions, maintenance, and/or removal of two-way local beeper consoles, transmitters, and related equipment. Site Specific alternative configurations, add-ons or service integrations which exceed the current existing wireless messaging pager/beeper coverages and services provided by the contractor are not permissible.

The Contractor shall ensure the paging service meets VA current needs and consist of the following Salient Characteristics:

1. Consists of network telephony, base station transmitters, and radio towers that simulcast a beeper message from each base station to the intended receiver/beeper device.

2. A message is sent to a paging subscriber via a telephone keypad using a paging system access number.

3. Paging system transmits a page throughout the service area using base stations which simulcast the message on a radio carrier network.

4. Transmitters in the paging network broadcast signals over reserved radio high frequency bands allocated to wide area beeper systems.

5. Satellite, cellular, or other radio services are not an acceptable solution.

The Contractor shall provide standard paging services and features to include:

A. Numeric Paging (Unlimited Calls): Users transmit and receive numeric messages or codes

B. Alphanumeric Paging: Users transmit and receive either alphabetical and numeric messages or codes.

1. Unlimited Calls

2. Unlimited Characters

Beeper Features Description of Features

Simultaneous Message Delivery

Ability to notify unlimited recipients simultaneously in seconds, ensuring that each recipient will receive a message at the same time

Message Carbon Copy • Message carbon copy

• Copy incoming pages to an unlimited number of beeper addresses

Alias Email Send messages to alphanumeric or two-way beeper using an easy-to-remember alias address

Draft PWS External Paging Services Page 8 of 30

Beeper Features Description of Features

Additional Number Simultaneous transmission of a page to the assigned beeper and additional numbers, such as a cell, smart phone whether a single device or group

Toll Free Number Toll-free beeper numbers so anyone can send a page from anywhere in the country, without having to pay charges

Secondary Toll-Free Number Secondary number assignment for devices including local and toll-free service

Group Call Lead/Follow Group Paging Setup

• Multi-Messenger Groups

• Text or numeric message distributed to a pre-established group of beepers

Short Message Service

(SMS)

Two-way device can communicate directly with any SMS-equipped phone

Two-Way Group Call Feature Two-Way Group Call Feature

Operator Dispatch 24/7 live operator answered dispatch service that will send alphanumeric messages to the beeper owner

Custom Greeting Personal Greeting

Page Forwarding Forward your page/message to another beeper

Numeric Retrieval • Message delivery services to ensure pages are not missed if the beeper is left at home, leaves the coverage area, or if the battery runs down.

• Allow end-users to call their own beeper numbers to retrieve pages

Private Voice Mailbox Various Voicemail (VM) packages

• VM Option 1; 10 Msg, 12 hrs., 30 sec

• VM Option 2; 10 Msg, 24 hrs., 45 sec

• VM Option 3; 15 Msg, 72 hrs., 60 sec

Occasionally, the Government may require specific feature-sets and functionality based on the VA’s needs. Historically, additional features/services included numeric retrieval, call forwarding, voicemail, group call/follow, alias, etc. The listing below identifies the VA’s current potential feature-set requirements, which may be updated from time-to-time based upon the government’s need.

The table below further details VA’s existing footprint of leased SPOK beepers and features, as known today. The quantities listed are required for the base period and subsequent option periods (if exercised):

Description Qty Unit

Alphanumeric - Statewide Coverage 6654 each

Alphanumeric - 2 State Coverage 713 each

Alphanumeric - 3 State Coverage 9 each

Alphanumeric - 4 State Coverage 3 each

Alphanumeric - Regional Coverage 80 each

Alphanumeric - Nationwide Coverage 8 each

Draft PWS External Paging Services Page 9 of 30

Description Qty Unit

Coaster - Statewide Coverage 183 each

Coaster Charger 18 each

Multi-messenger Group Leader 161 each

Numeric - Statewide Coverage 3568 each

Numeric - 2 State Coverage 586 each

Numeric - 3 State Coverage 29 each

Numeric - 4 State Coverage 49 each

Numeric - Regional Coverage 113 each

Numeric - Nationwide Coverage 5 each

2way - Nationwide 566 each

Additional Local Number 19 each

Admin Fee 1 each

Alias* (Not Separately Priced) 525 each

Encryption* 2316 each

Forwarding* (Not Separately Priced) 23 each

Message Carbon Copy* (Not Separately Priced)

674 each

Numeric Retrieval* (Not Separately Priced) 388 each

Over the Air Programming* 63 each

Short Messaging* (Not Separately Priced) 2 each

Toll Free Number 23 each

Voicemail - 72-hour hold, 60 seconds 21 each

Voicemail - 24-hour hold, 45 seconds 6 each

Voicemail - 12-hour hold, 30 seconds 152 each

Voice Prompt /Generic* (Not Separately Priced) 2686 each

Voice Prompt /Custom* (Not Separately Priced) 1132 each

VA is not responsible for purchasing any new equipment to accommodate Contractor services due to any Contractor inability to provide coverage. Beeper coverage capabilities shall continue under the same incumbent level as currently being provided at the covered VA Service Delivery Points (SDP) as indicated in Section 7, Addendum C.

For this requirement, the incumbent Contractor coverage capabilities, existing infrastructure, and resources that are independent of site-specific add-ons or service integrations are permissible. Therefore, new beeper infrastructure software/hardware installations at an SDP are not permitted for this requirement. Similarly, only original equipment manufacturer (OEM) routine software/hardware update support will be required during the contract life cycle. Likewise, regular maintenance of existing infrastructure is permitted.

Draft PWS External Paging Services Page 10 of 30

The Contractor shall furnish all necessary resources and services to provide reporting, project management, beeper leasing, accessories and associated service plans, as well as management support, including a web-based portal. Furthermore, the VA reserves the right to require e-bonding integration with the agency’s management and provisioning systems.

3.1 PERFORMANCE DETAILS

3.1.1 PERFORMANCE PERIOD

The Period of Performance (PoP) shall be a 12-month base and (2) two 12-month option periods (if exercised).

Any work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO).

There are 11 Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, five are set by date:

New Year's Day January 1 Juneteenth June 19 Independence Day July 4 Veterans Day November 11 Christmas Day December 25

If any of the above falls on a Saturday, then Friday shall be observed as a holiday.

Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

Martin Luther King's Birthday Third Monday in January Washington's Birthday Third Monday in February Memorial Day Last Monday in May Labor Day First Monday in September Columbus Day Second Monday in October Thanksgiving Fourth Thursday in November

3.1.2 PLACE OF PERFORMANCE

This effort will support VA medical and attached facilities as indicated in Addendum C.

VA reserves the right to update Addendum C to add or remove locations, required to define future requirements. All changes in location will be within the vendors service area.

Draft PWS External Paging Services Page 11 of 30

3.2 CONTRACT TYPE

This is a Firm-Fixed Price (FFP) Contract

4.0 SPECIFIC TASKS AND DELIVERABLES

4.1 PROJECT MANAGEMENT

4.1.1 REPORTING REQUIREMENTS

The Contractor shall hold a kickoff meeting within five (5) days after the award or unless otherwise specified. At a minimum, the Contractor shall present, for review and approval by the Government, the details of the intended approach, work plan, and project schedule for each effort. Dates, locations (can be virtual), and agenda shall be specified at least five (5) calendar days prior to the meeting. The Contracting Officer (CO), Contracting Officer’s Representative (COR), and VA Program Manager shall be invited, at a minimum. The Contractor shall produce and distribute the kickoff meeting minutes identifying the key discussion points and action items. The Contractor shall deliver the kickoff meeting minutes to the COR within five (5) days after kickoff meeting.

4.2 FUNCTIONALITY AND FEATURES

The Contractor shall provide wireless messaging pager/beeper services functionality and features described herein for varying locations. The Contractor shall provide leased one-way and two-way alpha and numeric beeper messaging, and wireless information services. The incumbent Contractor shall offer service area coverage capabilities within the same geographical areas currently being provided. These services are offered on a local, statewide, regional, or national basis using digital beeper networks. Such services provide the requirements for exclusively provisioned and dedicated critical wireless messaging pager/beeper services.

The Contractor’s standard commercial warranty shall apply to furnished or installed equipment. All wireless messaging pager/beepers shall include standard beeper service.

The Contractor shall provide Wide-Area leased wireless messaging pager/beeper services and features. The required wireless messaging pager/beeper service shall be a wireless telecommunications device that receives and displays messages and operate as part of the Contractor’s existing wireless messaging pager/beeper system which includes the current infrastructure. Based on the Contractor’s current configuration of the wireless messaging pager/beeper services. The Contractor’s current existing wireless messaging pager/beeper services must continue to offer standard industry features such as custom greeting, private mailbox, and message retrieval.

The following outlines the characteristics of the existing wireless messaging pager/beeper service currently utilized by VA and required for continued operation:

Draft PWS External Paging Services Page 12 of 30

1. A network telephony function, base station transmitters, and radio towers that simulcast a beeper message from each base station to the intended wireless messaging pager/beeper device.

2. An access number to send a message to a user via a telephone keypad.

3. Can transmit a message throughout the service area using base stations which simulcast the message on a radio carrier network.

4. Has transmitters to broadcast signals over reserved radio high frequency bands allocated to wide area wireless messaging pager/beeper systems. The coverage shall provide the same existing levels of the current VA locations noted in Attachment A.

5. None of the following are permissible:

• satellite,

• cellular, or

• other non-wireless messaging pager/beeper radio services.

4.3 BEEPER MAINTENANCE AND SERVICE LEVEL AGREEMENTS (SLA)

4.3.1 MEAN TIME TO REPAIR (MTTR)

MTTR is the average time for the Contractor to restore the service during a service outage in a billing month. The SLA for MTTR shall be four hours for outage and 72 hours for service degraded. The Contractor shall provide technical support/resolution during established business hours to remediate service issues pertaining to the Support Services in Section 4.4. MTTR times begin when the Contractor receives a support request from VA. The Contractor shall respond to VA’s support requests according to the following fault classifications.

4.3.2 PRIORITY 1- SERVICE OUTAGE

A service outage is defined as an unscheduled period in which the service is interrupted and unavailable for use by Customer for 60 or more Unavailable Seconds within a 15-minute period. This includes a business impacting function or service is not available such as inability to receive an electronic message due to service outages. This shall include total loss of service, or the service is degraded to the extent where the Government is unable to use it. This shall include the inability to receive or transmit data or access critical messaging systems due to network impairment. The Contractor shall restore to all service outages within four hours. Notifications shall be provided to VA local POC as identified by call order, every business day via telephone until restored.

The fault shall not return for seven calendar days, or it shall be considered a continuation of the original service impact.

4.3.3 PRIORITY 2- SERVICE DEGRADED

Service Degraded means VA’s workflow is not seriously affected or limited. The Contractor repair technician shall respond to all Service Degraded reports within four hours. Status notifications shall be provided to VA local POC as identified by call order, Draft PWS External Paging Services Page 13 of 30 every business day until restored. The fault shall not return for 30 calendar days, or it shall be considered a continuation of the original fault.

4.3.4 EXCLUSIONS

During scheduled maintenance of the Beeper Service, the Contractor shall notify VA COR/PM within three business days of the maintenance window and describe in detail how long and to what level degraded service is to be expected. The Contractor shall obtain approval in advance from the appropriate VA POC as identified by call order before scheduled maintenance occurs. The beeper service shall not be unavailable for any outrage that results from any maintenance performed by the Contractor as defined by the following three exceptions:

1. VA is notified at least three business days in advance of outage or service degradation.

2. During the installation period; or

3. Trouble beyond the demarcation point or Network Interface (NI) is not caused by the Contractor.

4.3.5 MAINTENANCE PERFORMANCE

The Contractor shall obtain the approval of the COR prior to starting any work that cause a service outage. The Contractor shall notify the COR and Program Manager (PM), if work needs to be performed outside of normal business hours, a minimum of three business days before the work is to begin (except in the case of Trouble Ticket repair). The Contractor shall receive approval from the VA Facility Area Manager prior to commencement of either intrusive testing or contractor actions which may affect service quality.

4.4 BEEPER MANAGEMENT SERVICES

The Contractor shall coordinate initial deliveries with site POC before shipment of hardware to ensure sites have adequate storage space. All shipments, either single or multiple container deliveries, shall bear the VA Purchase Order number on external shipping labels and associated manifests or packing lists. In the case of multiple container deliveries, concise summary near the VA PO number will indicate total number of containers for the complete shipment (e.g., 1 of 2), clearly readable on manifests and external shipping labels.

4.4.1 BEEPER REPLACEMENT

The Contractor shall replace any beeper types, including the associated features and plans specified in this requirements document, that are defective or configured with the wrong beeper services or features. Any beepers that have a quality defect shall be covered by the manufacturer’s warranty. If a beeper has a quality defect, then the Contractor shall replace the beeper. Any non-quality user caused damage

Draft PWS External Paging Services Page 14 of 30 malfunctioning beeper shall be replaced by the Contractor and the cost associated with the replacement be invoiced to the VA.

4.4.1.1 Loss Devices (Optional Quantity)

VA may require lost device replacement during the performance period. The Contractor shall provide replacement pagers or beepers for lost devices only upon issuance of a formal contract modification that exercised this option. Replacement pagers must not exceed a quantity of 1,800 each.

4.4.2 RETURNS SHIPPING SUPPORT

The Contractor shall supply VA with postage paid Return Shipping Labels for inventory management logistics (e.g., quantity reductions, management services). The VA threshold for spare beeper device inventory target is 3%. The Contractor shall provide inventory reduction credits for all returned beeper quantities. The Government will not separately reimburse any return shipping support logistics cost.

Prior to shipping the Contractor shall notify site POC, by phone, followed by an email, of all incoming deliveries including line-by-line details for review of requirements. The Contractor shall not make any changes to the delivery schedule at the request of the site POC. Any changes to the delivery schedule need to be authorized by the COR.

4.4.3 URGENT DELIVERIES

VA shall contact the Contractor for the purpose of obtaining accelerated delivery for beepers and/or transmitters (e.g., replace a transmitter or antenna in the event of a natural disaster). The Contractor shall reply to the VA inquiry within 24 hours after receipt and provide confirmation in writing that the Contractor can provide the requested beeper service. If the Contractor offers an accelerated delivery time acceptable to the VA, any order(s) placed pursuant to the agreed upon accelerated delivery time frame shall be delivered within the quickest accelerated interval and in accordance with all other terms and conditions of the contract.

4.4.4 WEB-BASED PORTAL

The Contractor shall provide a secure platform with an access point for account information management purposes. The Web-Based Portal shall provide users event driven capability to assign, activate, swap, or disconnect devices. The VA COR will provide the Contractor with a list of individuals who will need access to the web-based portal and the account numbers. The Contractor shall provide VA with the capability of running reports through the web-based portal. The Contractor shall grant web-based portal access only from the COR provided user list. The web-based portal shall provide the capability for twill run the reports at call order level. At a minimum the Government shall be able to run reports specific to the facility for the following information:

Draft PWS External Paging Services Page 15 of 30

a. Units in service by type, billed customer, department

b. Beeper messages by billed customer, beeper number, department

c. New Sales, charges, or disconnects

d. Account Summary by sub-accounts

e. Zero-use devices

f. Beeper returns

4.5 PERFORMANCE METRICS

The table below defines the Performance Standards and Acceptable Levels of Performance associated with this effort.

Performance Objective

Performance Standard Acceptable Levels of Performance

A. Technical / Quality of Product or Service

1. Demonstrates understanding of requirements

2. Efficient and effective in meeting requirements

3. Meets technical needs and mission requirements

4. Provides quality services/products

5. Incorporates “ease of use” Human Centered Design principles in any software developed.

Satisfactory or higher

B. Project Milestones and Schedule

1. Established milestones and project dates are met

2. Products completed, reviewed, delivered in accordance with the established schedule

3. Notifies customers in advance of potential problems

Satisfactory or higher

C. Cost & Staffing 1. Currency of expertise and staffing levels appropriate to perform tasks required

2. Personnel possess necessary knowledge, skills, and abilities to perform tasks

Satisfactory or higher

D. Management 1. Integration and coordination of all activities to execute effort

Satisfactory or higher

Draft PWS External Paging Services Page 16 of 30

4.6 FACILITY/RESOURCE PROVISIONS

Not Applicable.

4.7 GOVERNMENT FURNISHED PROPERTY

Not Applicable.

4.8 SHIPMENT OF HARDWARE OR EQUIPMENT

Shipment of hardware shall be defined and identified in the Contract. Locations are identified in Addendum C.

Inspection: Destination Acceptance: Destination Free on Board (FOB): Destination

Draft PWS External Paging Services Page 17 of 30

5.0 ADDENDUM A – ADDITIONAL VA REQUIREMENTS, CONSOLIDATED

A1.0 Cyber and Information Security Requirements for VA IT Services

The Contractor shall ensure adequate LAN/Internet, data, information, and system security in accordance with VA standard operating procedures and standard PWS language, conditions, laws, and regulations. The Contractor’s firewall and web server shall meet or exceed VA minimum requirements for security. All VA data shall be protected behind an approved firewall. Any security violations or attempted violations shall be reported to the VA Program Manager and VA Information Security Officer as soon as possible. The Contractor shall follow all applicable VA policies and procedures governing information security, especially those that pertain to assessment and authorization and continuous monitoring.

Contractor supplied equipment, PCs of all types, equipment with hard drives, etc. for contract services must meet all security requirements that apply to Government Furnished Equipment (GFE) and Government Owned Equipment (GOE). Security Requirements include: a) VA Approved Encryption Software must be installed on all laptops or mobile devices before being placed into operation, b) Bluetooth equipped devices are prohibited within VA; Bluetooth must be permanently disabled or removed from the device, unless the connection uses FIPS 140-2 (or its successor) validated encryption, c) VA approved anti-virus and firewall software, d) Equipment must meet all VA sanitization requirements and procedures before disposal. The Contractor shall notify the COR/CO within one hour of disclosure or successful exploits of any vulnerability which can compromise the confidentiality, integrity, or availability of the information systems.

Each documented initiative under this contract incorporates VA Handbook 6500.6, “Contract Security,” March 12, 2010 (Appendix C updated April 22, 2024) by reference as though fully set forth therein. The VA Handbook 6500.6, “Contract Security” shall also be included in every related agreement, contract, or order. The VA Handbook 6500.6, Appendix C, is included in this document as Addendum B.

Training requirements: The Contractor shall complete all mandatory training courses on the current VA training site, the VA Talent Management System (TMS) 2.0, and will be tracked therein. The TMS 2.0 may be accessed at https://www.tms.va.gov/SecureAuth35/. If you do not have a TMS 2.0 profile, go to https://www.tms.va.gov/SecureAuth35/ and click on the “Create New User” link on the TMS 2.0 to gain access.

Contractor employees shall complete a VA Systems Access Agreement if they are provided access privileges as an authorized user of the computer system of VA.

A2.0 VA Enterprise Architecture Compliance The applications, supplies, and services furnished under this contract must comply with VA Enterprise Architecture (EA), available at http://www.ea.oit.va.gov/index.asp in force at the time of issuance of this contract, including the Program Management Plan and https://www.tms.va.gov/SecureAuth35/ https://www.tms.va.gov/SecureAuth35/ http://www.ea.oit.va.gov/index.asp

Draft PWS External Paging Services Page 18 of 30

VA's rules, standards, and guidelines in the Technical Reference Model/Standards Profile (TRMSP). VA reserves the right to assess contract deliverables for EA compliance prior to acceptance.

A2.1. VA Internet and Intranet Standards

The Contractor shall adhere to and comply with VA Directive 6102 and VA’s Web Governance if the Contractor’s work includes building and maintaining VA’s digital presence. This pertains, but is not limited to: websites, social media, creating announcements; collecting information; databases to be accessed, graphics and links to external sites.

Internet/Intranet Services Directive 6102 is posted at (copy and paste the following URL to browser): https://www.va.gov/vapubs/viewPublication.asp?Pub_ID=1056&FType=2

VA Web Governance website can be found at Home - VA Web Governance.

A3.0 Notice of the Federal Accessibility Law Affecting All Information and Communication Technology (ICT) Procurements (Section 508)

On January 18, 2017, the Access Board issued a final rule that updated accessibility requirements covered by Section 508 and refreshed guidelines for telecommunications equipment subject to Section 255 of the Communications Act. The final rule went into effect on January 18, 2018. The revisions and updates to the Section 508-based standards and Section 255-based guidelines are intended to ensure that information and communication technology (ICT) covered by the respective statutes is accessible to and usable by individuals with disabilities.

A3.1. Section 508 – Information and Communication Technology (ICT) Standards

The Section 508 standards established by the Access Board are incorporated into, and made part of all VA orders, solicitations and purchase orders developed to procure ICT.

These standards are found in their entirety at: Revised 508 Standards and 255 Guidelines (access-board.gov). A single PDF file version of the Revised Section 508 Standards and 255 Guidelines will be supplied upon request or can be obtained from the Access Board website. Federal agencies must comply with the Rehabilitation Act of 1973, as amended.

The Contractor shall comply with “508 Chapter 2: Scoping Requirements” for all electronic ICT and content delivered under this contract. Specifically, as appropriate for the technology and its functionality, the Contractor shall comply with the technical standards marked here:

☒ E205 Electronic Content – (Accessibility Standard -WCAG 2.0 Level A and AA

Guidelines)

☒ E204 Functional Performance Criteria https://www.va.gov/vapubs/viewPublication.asp?Pub_ID=1056&FType=2 https://digital.va.gov/web-governance/ https://www.access-board.gov/ict/ https://www.access-board.gov/ict/

Draft PWS External Paging Services Page 19 of 30

☒ E206 Hardware Requirements

☐ E207 Software Requirements

☒ E208 Support Documentation and Services Requirements

A3.2. Compatibility with Assistive Technology

The standards do not require installation of specific accessibility-related software or attachment of an assistive technology device. Section 508 requires that ICT be compatible with such software and devices so that ICT can be accessible to and usable by individuals using assistive technology, including but not limited to screen readers, screen magnifiers, and speech recognition software.

A3.3. Acceptance and Acceptance Testing

Deliverables resulting from this solicitation will be accepted based in part on satisfaction of the Section 508 Chapter 2: Scoping Requirements standards identified above.

The Government reserves the right to test for Section 508 Compliance before delivery.

The Contractor shall be able to demonstrate Section 508 Compliance upon delivery.

A4.0 Physical Security & Safety Requirements:

The Contractor and their personnel shall follow all VA policies, standard operating procedures, applicable laws and regulations while on VA property. Violations of VA regulations and policies may result in citation and disciplinary measures for persons violating the law.

1. The Contractor and their personnel shall wear visible identification at all times while they are on the premises.

2. VA does not provide parking spaces at the work site; the Contractor must obtain parking at the work site if needed. It is the responsibility of the Contractor to park in the appropriate designated parking areas. VA will not invalidate or make reimbursement for parking violations of the Contractor under any conditions.

3. Smoking is prohibited inside/outside any building other than the designated smoking areas.

4. Possession of weapons is prohibited.

5. The Contractor shall obtain all necessary licenses and/or permits required to perform the work, with the exception of software licenses that need to be procured from a Contractor or vendor in accordance with the requirements document. The Contractor shall take all reasonable precautions necessary to protect persons and property from injury or damage during the performance of this contract.

A5.0 Confidentiality and Non-Disclosure

The Contractor shall follow all VA rules and regulations regarding information security to prevent disclosure of sensitive information to unauthorized individuals or organizations.

Draft PWS External Paging Services Page 20 of 30

The Contractor may have access to Protected Health Information (PHI) and Electronic Protected Health Information (ePHI) that is subject to protection under the regulations issued by the Department of Health and Human Services, as mandated by the Health Insurance Portability and Accountability Act of 1996 (HIPAA); 45 CFR Parts 160 and 164, Subparts A and E, the Standards for Privacy of Individually Identifiable Health Information (“Privacy Rule”); and 45 CFR Parts 160 and 164, Subparts A and C, the Security Standard (“Security Rule”). Pursuant to the Privacy and Security Rules, the Contractor must agree in writing to certain mandatory provisions regarding the use and disclosure of PHI and ePHI.

1. The Contractor will have access to some privileged and confidential materials of

VA. These printed and electronic documents are for internal use only, are not to be copied or released without permission, and remain the sole property of VA. Some of these materials are protected by the Privacy Act of 1974 (revised by PL 93-5791) and Title 38. Unauthorized disclosure of Privacy Act or Title 38 covered materials is a criminal offense.

2. The VA CO will be the sole authorized official to release in writing, any data, draft deliverables, final deliverables, or any other written or printed materials pertaining to this contract. The Contractor shall release no information. Any request for information relating to this contract presented to the Contractor shall be submitted to the VA CO for response.

3. Contractor personnel recognize that in the performance of this effort, Contractor personnel may receive or have access to sensitive information, including information provided on a proprietary basis by carriers, equipment manufacturers and other private or public entities. Contractor personnel agree to safeguard such information and use the information exclusively in the performance of this contract. Contractor shall follow all VA rules and regulations regarding information security to prevent disclosure of sensitive information to unauthorized individuals or organizations as enumerated in this section and elsewhere in this Contract and its subparts and appendices.

4. Contractor shall limit access to the minimum number of personnel necessary for contract performance for all information considered sensitive or proprietary in nature. If the Contractor is uncertain of the sensitivity of any information obtained during the performance this contract, the Contractor has a responsibility to ask the

VA CO.

5. Contractor shall train all their employees involved in the performance of this contract on their roles and responsibilities for proper handling and nondisclosure of sensitive VA or proprietary information. Contractor personnel shall not engage in any other action, venture or employment wherein sensitive information shall be used for the profit of any party other than those furnishing the information. The sensitive information transferred, generated, transmitted, or stored herein is for VA benefit and ownership alone.

6. Contractor shall maintain physical security at all facilities housing the activities performed under this contract, including any Contractor facilities according to VA-approved guidelines and directives. The Contractor shall ensure that security procedures are defined and enforced to ensure all personnel who are provided

Draft PWS External Paging Services Page 21 of 30 access to patient data must comply with published procedures to protect the privacy and confidentiality of such information as required by VA.

7. Contractor must adhere to the following:

a. The use of “thumb drives” or any other medium for transport of information is expressly prohibited.

b. Controlled access to system and security software and documentation.

c. Recording, monitoring, and control of passwords and privileges.

d. All terminated personnel are denied physical and electronic access to all data, program listings, data processing equipment and systems.

e. VA, as well as any Contractor (or Subcontractor) systems used to support development, provide the capability to cancel immediately all access privileges and authorizations upon employee termination.

f. Contractor PM and VA PM are informed within twenty-four (24) hours of any employee termination.

g. Acquisition sensitive information shall be marked "Acquisition Sensitive" and shall be handled as "For Official Use Only (FOUO)".

h. Contractor does not require access to classified data.

8. Regulatory standard of conduct governs all personnel directly and indirectly involved in procurements. All personnel engaged in procurement and related activities shall conduct business in a manner above reproach and, except as authorized by statute or regulation, with complete impartiality and with preferential treatment for none. The general rule is to strictly avoid any conflict of interest or even the appearance of a conflict of interest in VA/Contractor relationships.

9. VA Form 0752 shall be completed by all Contractor employees working on this contract and shall be provided to the CO before any work is performed. In the case that Contractor personnel are replaced in the future, their replacements shall complete VA Form 0752 prior to beginning work.

A6.0 Information Technology Using Sustainable Products and Services

The Contractor shall comply with Sections 524 and Sections 525 of the Energy Independence and Security Act of 2007; Section 104 of the Energy Policy Act of 2005;

Executive Order 13221, “Energy-Efficient Standby Power Devices,” dated August 2, 2001; and the Federal Acquisition Regulation (FAR) to provide ENERGY STAR®, Federal Energy Management Program (FEMP) designated, and products and services that meet EPA Recommendations of Specifications, Standards, and Ecolabels in effect as of October 2023 (e.g. Electronic Product Environmental Assessment Tool (EPEAT) registered products) in providing information technology products and/or services. The Green Procurement Compilation (GPC) website available at Green Procurement Compilation - GSA Sustainable Facilities Tool (sftool.gov) provides a comprehensive list of sustainable products and services and sustainable acquisition guidance.

The Contractor shall…