P09 PWS VHA Resuscitation Education Products and Services FINAL.pdf

Veterans Health Administration (VHA) Resuscitation Education Products and Services

B.3 PERFORMANCE WORK STATEMENT

1. Title of Project: Veterans Affairs (VA) Veterans Health Administration (VHA) Resuscitation Education Products and Services

2. Background: The Resuscitation Education and Innovation (REdI) program, housed within the VHA Simulation Learning, Evaluation, Assessment, and Research Network (SimLEARN) under the Office of Healthcare Innovation and Learning (OHIL), serves as the national program responsible for delivering mandatory resuscitation education and training across the Veterans Health Administration (VHA). This includes both clinical and non-clinical employees across the enterprise.

VHA is federally mandated to ensure staff competency in resuscitation techniques in accordance with healthcare regulations and internal directives. To meet these requirements, REdI provides comprehensive national support services, including training materials, standardized equipment, oversight, and validation of local VA medical facility resuscitation education programs.

As the national subject matter expert in resuscitation education, REdI is responsible for the full spectrum of resuscitation training across VHA. This includes the identification, development, administration, and maintenance of all required courseware, as well as oversight of mock code programs, training materials, and standardized equipment. REdI serves as the operational lead for the implementation and compliance of VHA Directive 1177, Cardiopulmonary Resuscitation, ensuring that all designated clinical and non-clinical personnel are equipped to obtain and maintain the certifications necessary for emergency response readiness. Through this comprehensive oversight, REdI ensures consistency, quality, and preparedness across the enterprise. Certification requirements are further defined in VHA Directive 1101.14, Emergency Medicine, which outlines the clinical and non-clinical roles required to maintain appropriate levels of training. These directives ensure that all designated staff are prepared to respond effectively to clinical deterioration or medical emergencies involving patients, visitors, or employees within VA medical facilities and their surrounding campuses.

Over the past nine years, REdI has led a transformative shift from traditional, instructor-led classroom training to an innovative, self-directed digital platform. This evolution embraces a Low Dose, High Frequency (LDHF) model that emphasizes deliberate practice and objective feedback, enabling clinicians to build and sustain critical skills through brief, focused sessions. This modern approach aligns with the latest education science and responds to healthcare market demands by significantly reducing time away from direct Veteran care, preserving clinical capacity and ensuring continuity of services.

Today, nearly 275,000 VHA clinical and non-clinical employees across 172 VA medical centers and over 1,200 Community-Based Outpatient Clinics engage with REdI’s digital learning ecosystem. The platform delivers scenario-based eLearning modules that promote interactive learning, assess knowledge and confidence, and adapt to learner needs. These are followed by psychomotor skill assessments conducted on Mobile

Cardiopulmonary Resuscitation (CPR) Testing Stations equipped with adult and infant manikins.

This self-directed model provides real-time, objective feedback and validates competency in compressions and ventilations, enabling certification in Responder (Lay Rescuer), Basic Life Support (BLS), Advanced Cardiovascular Life Support (ACLS), and Pediatric Advanced Life Support (PALS) without instructor facilitation. Learners can complete training through a traditional biennial format or a standardized LDHF pathway.

The LDHF model is grounded in evidence-based education science, helping prevent skill decay in life-saving interventions and ensuring compliance with federal healthcare accreditation standards.

The current Government training environment features an enterprise-wide infrastructure that supports standardized resuscitation education across the VHA. This includes approximately 2,050 Mobile CPR Testing Stations, each equipped with Laerdal QCPR® adult and infant manikins. These stations deliver Lay Rescuer, BLS, ACLS, and PALS courseware through the RQI 1Stop digital platform.

In addition to digital delivery, the Government maintains a comprehensive library of current-edition digital and print educational materials to support a wide range of certifications, including HeartSaver (HS), BLS, ACLS, Advanced Stroke Life Support (ASLS), Pediatric Emergency Assessment, Recognition, and Stabilization (PEARS), and PALS. These materials are utilized by a network of approximately 2,500 trained and approved VHA instructors who facilitate instructor-led classroom sessions and mock code training, as appropriate. This learning environment ensures that VHA personnel, both clinical and non-clinical, have access to the appropriate level of training based on their roles, while maintaining flexibility, standardization, and compliance with national resuscitation education requirements.

The International Liaison Committee on Resuscitation (ILCOR) serves as the global coordinating body for resuscitation science. It provides a consensus-based framework for evaluating and updating evidence-based guidelines related to CPR and Emergency Cardiovascular Care (ECC). ILCOR publishes updated treatment and training recommendations on a five-year cycle, with the most recent guidelines covering the period of 2025-2030. These updates inform the continuous improvement of VHA resuscitation training programs, ensuring alignment with the latest global standards and best practices.

3. Scope of Work: The Scope of Work will consist of three primary categories of tasks.

a. Program Management and Maintenance of Support Services. These services are essential to ensure uninterrupted access to resuscitation training, maintain equipment functionality, and support enterprise-wide compliance with certification requirements.

1) The contractor shall provide support services, on a continuous basis, including daily program support, program coordination support and warranty support for Mobile CPR testing stations.

2) The contractor shall provide technical support services to VHA end users and program staff, including email-based support, customer service telephone support, technical troubleshooting related to RQI platform and associated equipment, replacement of defective equipment, generation and delivery of required reports, and support for course and data integration between VHA Talent Management System (TMS) and the RQI course content.

3) The contractor shall provide access to national databases that allow VHA facilities to benchmark performance metrics related to overall resuscitation outcomes.

a. The contractor shall maintain all required security and authorization statuses for the digital solution, including continuous compliance with Federal Risk and Authorization Management Program (FedRAMP) requirements and maintenance of a valid VA Authority to Operate (ATO), in accordance with VA Directive 6500, VA Handbook 6500, and other applicable VA cybersecurity, privacy, and cloud security policies. The contractor shall promptly notify the Government of any change in FedRAMP authorization or ATO status that may affect the availability, security, or compliance of the solution.

b. Electronic Courseware. The contractor shall provide secure, interactive electronic courseware that supports adaptive, scenario-based resuscitation training and certification. The courseware must integrate with existing VA infrastructure, support multiple certification levels, and align with current resuscitation education guidelines. The digital solution shall be Personal Identity Verification (PIV)-enabled to allow authorized access through VA-issued credentials and must comply with all applicable VA security, privacy, and data protection requirements, including adherence to Federal Information Security Modernization Act (FISMA), VA Handbook 6500, and related VA cybersecurity policies. The contractor shall ensure the courseware is accessible via VA networked systems and PIV-compatible devices (e.g., VA-issued laptops) without compromising system security or user privacy.

c. Resuscitation Education Materials

1) The contractor shall furnish all labor, supervision, materials, and logistical support necessary to deliver resuscitation education and training materials, both instructor-led and self-directed learning environments, as applicable, to each designated VHA facility specified in an allocation document provided by the Government.

2) The contractor shall provide digital and/or print resuscitation education materials to support the full spectrum of training programs required by the Government to include Lay Rescuer, BLS, ACLS, PALS, PEARS and ASLS.

3) All educational content, whether digital and/or print, must align with the most current evidence-based resuscitation guidelines issued by the International Liaison Committee on Resuscitation (ILCOR). Materials must reflect the latest clinical science and instructional design standards to ensure consistency, accuracy, and regulatory compliance across the VHA enterprise.

4. Current Environment. The Veterans Health Administration (VHA) Resuscitation Education and Innovation (REdI) program currently operates within a comprehensive, enterprise-wide resuscitation training environment that integrates both instructor-led and self-directed learning modalities.

a. The Government environment includes the latest editions of digital and print education materials to support a wide range of resuscitation training programs, including HS, BLS, ACLS, ASLS, PEARS, and PALS. These materials are delivered by a network of approximately 2,500 trained and approved VHA instructors who facilitate instructor led activities such as classroom-based and mock code training sessions.

b. In parallel, the Government environment supports a digital resuscitation education platform that includes electronic courseware for Lay Rescuer, BLS, ACLS, and PALS.

This platform is supported by the necessary equipment, peripheral devices, and vendor-provided services, including technical support, platform maintenance, and an equipment warranty program. These components enable the successful deployment and sustainment of resuscitation training across the VHA enterprise.

c. The current environment includes the following key components:

1) HeartCode® Complete

2) Resuscitation Quality Improvement (RQI)® Platform

3) Mobile CPR Testing Stations

4) Laerdal QCPR® Adult and Infant Manikins

5) Resuscitation course content that supports both traditional biennial certification and LDHF models. This includes self-directed certification in Lay Rescuer, BLS, ACLS, and PALS using Mobile CPR Testing Stations without instructor facilitation.

6) VA-issued laptops tethered via USB to Mobile CPR Testing Stations for skills validation, with secure data transmission to credentialing systems.

5. Contract Type: The Government anticipates award of a Firm Fixed Price (FFP) Indefinite Quantity, Indefinite Delivery (IDIQ) contract.

6. Period of Performance. The period of performance shall consist of one (1) twelve-month base period and four (4) twelve-month option periods. An additional six (6) month extension may be exercised in accordance with FAR Clause 52.217-8, Option to Extend

Services. The total period of performance shall not exceed sixty (60) months and six (6) months if the extension is exercised.

a. Period of Performance Schedule:

1) Base Period: May 26, 2026 – May 25, 2027

2) Option Period 1: May 26, 2027 – May 25, 2028

3) Option Period 2: May 26, 2028 – May 25, 2029

4) Option Period 3: May 26, 2029 – May 25, 2030

5) Option Period 4: May 26, 2030 – May 25, 2031

6) Optional Six-Month Extension: May 26, 2031 – November 25, 2032

Any work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO). If required, the CO may designate the Contractor to work during holidays and weekends.

There are eleven (11) Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

1) Under current definitions, five are set by date:

New Year's Day January 1

Juneteenth June 19

Independence Day July 4

Veterans Day November 11

Christmas Day December 25

2) If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

3) The other six are set by a day of the week and month:

a) Martin Luther King's Birthday Third Monday in January

b) Washington's Birthday Third Monday in February

c) Memorial Day Last Monday in May

d) Labor Day First Monday in September

e) Columbus Day Second Monday in October

f) Thanksgiving Fourth Thursday in November

7. Place of Employment: The place of performance shall include the contractor’s facilities, as well as VHA medical centers and associated locations across the United States and U.S. Territories.

8. Travel: The Government does not anticipate travel under this effort. However, if travel becomes necessary in support of the contract, all associated costs shall be the responsibility of the contractor and will not be reimbursed by the Government.

9. Mandatory Task and Deliverables Statement: The Contractor shall perform all mandatory tasks and provide the specific deliverables outlined in this Performance Work Statement (PWS) within the designated period of performance.

a. If, for any reason, a deliverable cannot be submitted by its scheduled due date, the Contractor shall notify the Program Manager (PM) and Contracting Officer’s Representative (COR) in writing no later than three (3) business days prior to the due date. This written notification must include:

1) A detailed explanation for the delay

2) The anticipated completion date

3) An assessment of the impact on the overall project timeline

b. All tasks performed under this contract shall be of a non-personal services nature. Contractor personnel shall not be supervised by Government employees, nor shall they perform duties that create the appearance of an employer-employee relationship with any VA organization or staff.

c. Contractor personnel shall not engage in inherently governmental functions, including but not limited to:

1) Direct supervision of Government employees

2) Oversight of other contractors on separate contracts

3) Decision-making or policy-setting on behalf of the Government

4) Any activity that may be perceived as performing inherently governmental responsibilities

9.1 Task and Deliverable Requirements:

9.1.1 Program Management and Maintenance of Support Services

9.1.1.1 Program Coordination and Equipment Warranty of Mobile CPR testing stations.

a. Contractor shall work with internal VHA REdI Program Manager or designee to facilitate the day-to-day program support of resuscitation education and training programs. The Resuscitation Training Program includes HeartCode®, RQI®, CPR Mobile Testing Stations, Laerdal QCPR® Adult and QCPR® Infant manikins, resuscitation course content and skill testing in Responder, BLS, ACLS and PALS courses.

b. Works with internal colleagues, National VHA TMS, National OI&T, and VHA REdI Program Staff (Project Manager and Health Education Specialists) to facilitate the day-to-day progress of the program, control, budget, scope management, procurement, risk and issue management, contingency planning, project visibility.

c. Provides guidance working with VHA REdI Program and project team in terms of communication, accountability and issue escalation from the field.

d. Works effectively with technical team members and cross functional teams to ensure the project is on time and within contract requirements.

e. Project planning, scope management, procurement assistance, risk and issue management, contingency planning, project visibility, status reporting, and escalation.

f. Serve as liaison for the internal team to ensure the successful delivery of all required components.

g. Contractor shall support the local VHA medical facility Program Directors to ensure optimal working order of the existing Government equipment to support the Resuscitation Training Programs to include Mobile CPR Testing Stations, (Laerdal QCPR® Adult and QCPR® Infant manikins.

h. Initiates a replacement manikin or part to be shipped to the local VHA facility.

i. Coordinates the return of non-functioning manikin or part.

9.1.1.2 Technical Support Services.

a. Contractor shall provide direct technical and administrative support to VHA medical facility Program Directors to ensure successful implementation and sustainment of existing HeartCode® and RQI® training programs.

b. Contractor shall collaborate with VA facility REdI Program Directors and internal stakeholders to align support services with national program goals and local facility needs.

c. Contractor shall manage user accounts and student records within the proprietary RQI® Administrative environment, including account activations and data imports when appropriate.

d. Contractor shall deliver virtual administrative training (e.g., webinars) to VHA facility staff as needed to ensure consistent understanding of system use and program updates.

e. Contractor shall monitor and report emerging trends that may impact training accessibility, learner engagement, or program effectiveness, and escalate concerns to REdI leadership.

f. Contractor shall provide quarterly reports on facility-level performance, including enrollment growth, compliance rates, and user satisfaction metrics.

g. Contractor shall coordinate and test updates to HeartCode® and RQI® courseware, administrative processes, and training equipment prior to deployment across VHA facilities.

h. Contractor shall provide access and orientation to national benchmarking databases that allow VHA facilities to evaluate performance and outcomes against peer institutions.

Deliverables:

a. Monthly written status report, submitted no later than the 10th calendar day of the following month, outlining the contractor’s support of VHA medical facility Program Directors, including coordination with REdI leadership, account management, and administrative support for HeartCode® and RQI® programs.

Provide centralized log documenting all technical support interactions, system updates, software/hardware changes, and associated testing outcomes, including communication of updates to REdI staff and facility stakeholders.

(student enrollment and discipline)

b. Quarterly report, submitted no later than the 10th calendar day of the first month of each fiscal year quarter, detailing facility-level training compliance, enrollment trends, user satisfaction, and equipment status (including warranty claims, replacements, and maintenance activities).

c. Participation in bi-weekly collaboration meetings with the National VHA REdI Team.

9.1.2 Electronic Courseware

9.1.2.1 The electronic courseware shall have the following salient characteristics:

a. Courseware shall be hosted on a secure, online platform that includes interactive learning components, scenario-based patient cases, and assessments that evaluate both knowledge and learner confidence.

b. Modules shall simulate clinical decision-making through realistic, scenario-based patient cases that reinforce didactic content.

c. Courseware shall incorporate intelligent, competency-based adaptive learning that adjusts to the learner’s knowledge, confidence, and performance.

d. The platform shall support both traditional biennial training and an LDHF model to promote continuous skill retention.

e. Courseware shall integrate with mobile CPR testing stations to enable self-directed psychomotor skills practice.

f. The system shall provide real-time, objective feedback on CPR performance (compressions and ventilations) and issue electronic certification (e-Card or eCredential) upon successful completion, without instructor facilitation.

g. Courseware shall support training and certification for Lay Rescuer, BLS, ACLS, and PALS.

h. The solution shall be fully compatible with existing Government infrastructure, including the RQI 1Stop platform and Laerdal QCPR® manikins.

i. Courseware shall align with the most current resuscitation education guidelines issued by the ILCOR.

j. Courseware shall be accessible through the VA’s Talent Management System (TMS), ensuring accurate tracking of learner progress, completion, and compliance.

k. The solution shall operate as a Software-as-a-Service (SaaS) product, accessible via Government-issued devices and secure networks, and comply with FedRAMP and FISMA standards.

Deliverables:

A. Monthly status reports submitted via email no later than the 10th calendar day of the following month, to the REdI Project Manager/COR, this report shall include the number and discipline of students enrolled, system usage metrics, and any notable issues or updates.

B. Quarterly technical report, submitted no later than the 10th calendar day of the first month of each fiscal year quarter, detailing the number and nature of trouble calls, triage actions, trends of reported issues, and resolutions implemented.

C. Bi-Weekly coordination meetings with the national VHA REdI team to provide operational updates, discuss ongoing issues, and coordinate upcoming changes or implementations.

D. Quarterly organizational analytic report, submitted no later than the 10th calendar day of the first month of each fiscal year quarter, providing a high-level summary of student performance data across VHA, including visualizations and insights into national trends to inform program improvement.

9.1.3 Software-as-a-Service (SaaS) FEDRAMP Assessment and Authorization and Continuous Monitoring Requirements.

9.1.3.1 The information system solution selected by the Contractor shall comply with the FISMA and have a current VA authorization.

9.1.3.2 The Contractor shall remain in compliance with FedRAMP requirements as mandated by Federal laws and policies, including making available any documentation, physical access, and logical access needed to support this requirement.

9.1.3.3 The FedRAMP Authorization level and existing VA ATO should be no less than the level required for this use case which has been defined as Low Impact Level.

9.1.3.4 The Contractor shall, where applicable, assist with the VA ATO Sustainment Process to help maintain health and quality of agency authorization of the cloud service or migrated application.

9.1.3.5 The Contractor shall exclusively provide subscription licenses to FedRAMP authorized and VA authorized environments.

9.1.3.6 If new or unanticipated vulnerabilities are discovered by either VA or the Contractor, or if existing safeguards have ceased to function, the discoverer shall bring the situation to the attention of the other party within one hour in accordance with Addendum B, VA Information and Information System Security/Privacy Language. VA Privacy and Security deliverables as directed by the VA System owner.

9.1.3.7 The Contractor shall comply with FedRAMP data management requirements.

9.1.3.8 Successful issuance of a VA ATO will be required before live VA data can be used in the system.

9.1.3.9 The Contractor shall participate in FedRAMP Continuous Monitoring activities as outlined by FedRAMP’s Continuous Monitoring Strategy Guide found on the FedRAMP Website.

9.1.3.10 The Contractor shall provide continuous monitoring activities including, but not limited to, scans, security artifacts, and provide Continuous Monitoring Monthly Scans and monthly Plan of Action and Milestones (POAM) reports as outlined by FedRAMP requirements.

9.1.3.11 The Contractor shall participate in monthly Agency and FedRAMP Sustainment meetings following the granting of a VA ATO.

9.1.3.12 The Contractor shall provide a Monthly VA License report of VA sites currently utilizing the cloud product post ATO award. The license report shall include the number of subscription licenses being utilized and the specific VA site where they’re in use.

Deliverables:

A. Continuous Monitoring Monthly Scans

B. Plan of Action and Milestones Reports.

C. Monthly VA License Report

• The SaaS offering must be hosted within the United States and data stored/processed/transmitted within the offering must remain within the United States.

CSPs should be aware of FedRAMP and ready to partner with VA through the SaaS FedRAMP Authorization process.

9.1.4 Print and Digital Materials

9.1.4.1 The contractor shall provide all labor, supervision, and other resources required to deliver to each individual VHA facility (noted in the allocation document).

9.1.4.2 The contractor shall provide resuscitation education training course materials that is are brand name American Heart Association (AHA) curriculum. These materials must meet the following salient characteristics, which are essential to ensure alignment with the Department of Veterans Affairs’ enterprise-wide resuscitation training and certification standards:

a. Materials must reflect the most current resuscitation science and guidelines as issued by the International Liaison Committee on Resuscitation (ILCOR) and adopted by the American Heart Association.

b. Materials must be approved for use in training programs that result in nationally recognized certification for BLS, ACLS, PALS, PEARS, and HeartSaver courses.

c. Courseware must be compatible with the VA’s existing training platforms, including the RQI 1Stop system and Talent Management System (TMS), and support integration with CPR Mobile Testing Stations and Laerdal QCPR® manikins.

d. Materials must include instructor manuals, provider manuals, digital videos, crash cart cards, posters, and eCards necessary to deliver and document instructor-led and blended learning courses.

e. Materials must be available in both digital and print formats to support flexible delivery across VHA medical centers and Community-Based Outpatient Clinics (CBOCs).

f. eCards must be issued through a credentialing system recognized by national accrediting bodies and accepted by healthcare institutions for compliance purposes.

Deliverables:

A. Tracking information shall be provided to the VA medical facility POC and to the REdI Project Manager.

B. Delivery will be within 30 calendar days of contract task award.

10. OTHER DIRECT COSTS

No other direct costs are anticipated under this IDIQ contract.

11. GOVERNMENT- FURNISHED EQUIPMENT, MATERIALS, FACILITIES AND

INFORMATION

a. The current training environment includes Government-owned equipment that has already been procured and deployed across VHA medical facilities. This includes Mobile CPR Testing Stations equipped with Laerdal QCPR® Adult and Infant manikins, which operate the Responder, BLS, ACLS, and PALS courseware via the RQI 1Stop Digital Platform. Due to the significant investment in this infrastructure, a complete replacement or retooling of the existing environment is not feasible and would be cost-prohibitive to the Government.

b. The Government will provide the following support to facilitate contractor performance:

1) During onsite training events, the Government will furnish access to relevant personnel and existing training equipment at VHA medical facilities.

2) The Government will provide appropriate training or conference space for Government-related training activities, including standard presentation aids (e.g., whiteboards, monitors, and display systems).

3) VHA National REdI program staff will supply a list of designated points of contact for each VHA medical facility to support coordination of onsite training.

12. Quality Assurance Surveillance Plan

Table 1. Performance Requirement Summary

Performance Indicator

Performance Standard

Minimum Acceptabl e Standard

Method of Surveillanc e

Frequency

Program Management Support

PWS

paragraph …

Contractor provides comprehensive program and project management support, including coordination, reporting, and warranty services.

95% accuracy and completene ss, allowing only minor issues such as typographic al errors that do not affect meaning or decision-making; 0% significant errors or omissions, defined as incorrect, missing, or misleading information that could impact program decisions, performanc e assessment s, or contractual compliance.

Review of reports, meeting minutes, and issue logs

Monthly

Electronic Courseware Delivery

PWS

paragraph …

Courseware is delivered, integrated with TMS, and accessible to learners with real-time feedback and certification issuance.

100% availability;

95% learner access success rate; 0% critical system failures

System access testing, user feedback, and LMS reports

Quarterly

FedRAMP and

ATO

Compliance

PWS

paragraph …

All systems must maintain valid FedRAMP Moderate or High certification and VA ATO throughout the contract period.

95% complianc e; zero lapses in FedRAMP or ATO status

Review of FedRAMP documentati on, ATO status reports, and

VA OIT

security reviews

Due 30 days post award and monthly reports thereafter

Instructor-Led Materials Distribution

PWS

paragraph…

Digital and print materials are delivered in accordance with the allocation schedule and meet content standards.

100% on-time delivery;

95% accuracy in order fulfillment

Review of shipping logs, inventory, and user feedback

Quarterly

Contract Deliverables and Reporting

PWS

paragraph…

All reports and deliverables are submitted on time and include required content.

95% error-free for minor issues; 0% significant omissions

Review of submitted reports and deliverables

Monthly

12.1 METHODS OF SURVEILLANCE

a. The Contracting Officer’s Representative (COR) may use one or more of the following surveillance methods to monitor contractor performance under this QASP. All findings shall be documented and maintained in the COR’s Quality Assurance (QA) file.

1) The COR shall conduct a full review of all contractor deliverables and performance documentation on a monthly basis. All findings will be recorded and retained in the QA file.

2) The COR may review a statistically valid random sample of contractor deliverables or performance outputs. Results of the sample review will be documented and maintained in the QA file.

3) The COR shall investigate and document any validated customer complaints or confirmed deficiencies in contractor performance, particularly those falling below the Acceptable Level of Performance (ALP). These findings will be used to assess compliance and may trigger corrective action.

4) The COR shall conduct formal performance review meetings with the contractor on a recurring basis (e.g., monthly or quarterly) to assess overall contract performance, discuss trends, address issues, and review deliverables. Meeting minutes and action items will be documented and retained in the QA file.

5) Verification of electronic licenses. The PM/COR will conduct periodic functional inspections of the services provided under the contract, including verification that electronic courseware licenses are active, accessible, and functioning as intended for end users. Although a centralized license inventory may not be visible, the PM/COR will validate license availability through user access testing, system reporting, and confirmation of learner enrollment and course completion data.

6) The PM/COR will certify receipt of services and/or goods and recommend acceptance of the deliverables. This certification process will be used to authorize payment of contractor invoices and will serve as the official record that contractor performance has met the requirements for the period covered by the invoice.

12.2 FREQUENCY OF MEASUREMENT

The COR shall periodically assess whether the established frequency of surveillance remains appropriate based on the nature and performance of the work. At a minimum, performance surveillance shall occur no less than twice per year during the period of performance for each task order.

12.3 ACCEPTABLE PERFORMANCE LEVELS (APLS)

Requirement Performance Standard

Surveillance Method Outcome

Project Management, Milestones, and Schedule

Contractor notifies the Government of potential issues at least 90% of the time.

100% inspection of milestone tracking and communications

Notification occurs within two business days of a known issue, or within 24 hours for urgent issues.

Contractor submits deliverables in accordance with the approved schedule, with no more than five incidents of slippage per performance period.

100% inspection of deliverables and schedule adherence

No more than five late submissions (within ±5 business days) per performance period.

Written Communication

Written materials are grammatically correct, well-organized, and appropriate for the intended audience at least 95% of the time.

Random sampling of written deliverables and correspondence

Written communication is clear, concise, and free of significant errors; message is easily understood.

Customer Support

Contractor maintains courteous and professional interactions, with no more than five validated complaints per performance period.

Customer feedback and complaint tracking

Customer issues are resolved within one business day; no more than five validated complaints requiring Government intervention.

12.4 DOCUMENTING PERFORMANCE

a. Acceptable Performance. The Government shall document acceptable performance in accordance with the Acceptable Performance Levels (APLs) outlined in Section 12.3. Documentation may include inspection results, meeting notes, reports, and correspondence. All records of acceptable performance may be used as supporting documentation for future contractual actions, including performance evaluations and option period decisions.

b. Unacceptable Performance. When unacceptable performance is identified, the COR shall notify the Contracting Officer (CO) in writing. If immediate action is required, verbal notification may be made first but must be followed by written documentation. The COR shall record the issue and any related discussions in the COR’s Quality Assurance file.

1) If the CO determines that formal action is warranted, the COR shall prepare a

Contract Discrepancy Report (CDR) and present it to the contractor’s Program Manager. The contractor shall acknowledge receipt of the CDR in writing to the CO.’

2) The CDR shall include:

a) A description of the performance deficiency

b) The required timeframe for corrective action

c) Whether a Corrective Action Plan (CAP) is required

d) If a CAP is required, the contractor shall submit a written plan detailing how the deficiency will be corrected and how recurrence will be prevented.

The CO will review the CAP for adequacy and determine whether further action is necessary.

e) All CDRs and related documentation may be used to support contractual decisions, including withholding of payment, termination for cause, or negative performance evaluations.

13. SECURITY AND PRIVACY REQUIREMENTS

VA Information and Information System Security/Privacy Language for Contracted Personnel from VA Handbook 6500.6, Contract Security, Appendix C:

13.1 Physical Security and Safety Requirements

The Contractor and their personnel shall follow all VA policies, standard operating procedures, applicable laws and regulations while on VA property. Violations of VA regulations and policies may result in citation and disciplinary measures for persons violating the law.

a. The Contractor and their personnel shall wear visible identification at all times while they are on the premises.

b. VA does not provide parking spaces at the work site; the Contractor must obtain parking at the work site if needed. It is the responsibility of the Contractor to park in the appropriate designated parking areas. VA will not invalidate or make reimbursement for parking violations of the Contractor under any conditions.

c. Smoking is prohibited inside/outside any building other than the designated smoking areas.

d. Possession of weapons is prohibited.

e. The Contractor shall obtain all necessary licenses and/or permits required to perform the work, with the exception of software licenses that need to be procured from a Contractor or vendor in accordance with the requirements document. The Contractor shall take all reasonable precautions necessary to protect persons and property from injury or damage during the performance of this contract.

13.2 Confidentiality and Non-Disclosure

. The Contractor shall follow all VA rules and regulations regarding information security to prevent disclosure of sensitive information to unauthorized individuals or organizations.

. The VA CO will be the sole authorized official to release in writing, any data, draft deliverables, final deliverables, or any other written or printed materials pertaining to this contract. The Contractor shall release no information. Any request for information relating to this contract presented to the Contractor shall be submitted to the VA CO for response.

. Contractor personnel recognize that in the performance of this effort, Contractor personnel may receive or have access to sensitive information, including information provided on a proprietary basis by carriers, equipment manufacturers and other private or public entities. Contractor personnel agree to safeguard such information and use the information exclusively in the performance of this contract. Contractor shall follow all VA rules and regulations regarding information security to prevent disclosure of sensitive information to unauthorized individuals or organizations as enumerated in this section and elsewhere in this Contract and its subparts and appendices.

. Contractor shall limit access to the minimum number of personnel necessary for contract performance for all information considered sensitive or proprietary in nature.

If the Contractor is uncertain of the sensitivity of any information obtained during the performance this contract, the Contractor has a responsibility to ask the VA CO.

. Contractor shall train all of their employees involved in the performance of this contract on their roles and responsibilities for proper handling and nondisclosure of sensitive VA or proprietary information. Contractor personnel shall not engage in any other action, venture or employment wherein sensitive information shall be used for the profit of any party other than those furnishing the information. The sensitive information transferred, generated, transmitted, or stored herein is for VA benefit and ownership alone.

. Contractor shall maintain physical security at all facilities housing the activities performed under this contract, including any Contractor facilities according to VA-approved guidelines and directives. The Contractor shall ensure that security procedures are defined and enforced to ensure all personnel who are provided access to patient data must comply with published procedures to protect the privacy and confidentiality of such information as required by VA.

. Contractor must adhere to the following:

1) The use of “thumb drives” or any other medium for transport of information is expressly prohibited.

2) Controlled access to system and security software and documentation.

3) Recording, monitoring, and control of passwords and privileges.

4) All terminated personnel are denied physical and electronic access to all data, program listings, data processing equipment and systems.

5) VA, as well as any Contractor (or Subcontractor) systems used to support development, provide the capability to cancel immediately all access privileges and authorizations upon employee termination.

6) Contractor PM and VA PM are informed within twenty-four (24) hours of any employee termination.

7) Acquisition sensitive information shall be marked "Acquisition Sensitive" and shall be handled as "For Official Use Only (FOUO)".

8) Contractor does not require access to classified data.

. Regulatory standard of conduct governs all personnel directly and indirectly involved in procurements. All personnel engaged in procurement and related activities shall conduct business in a manner above reproach and, except as authorized by statute or regulation, with complete impartiality and with preferential treatment for none.

The general rule is to strictly avoid any conflict of interest or even the appearance of a conflict of interest in VA/Contractor relationships.

. VA Form 0752, Confidentiality of Sensitive Information Non-Disclosure Agreement, shall be completed by all Contractor employees that receive Government furnished laptops, and shall be provided to the CO before any work is performed. In the case that Contractor personnel are replaced in the future, their replacements shall complete VA Form 0752 prior to beginning work.

13.3 VA Data Assessment, Authorization, and Continuous Monitoring

a. The information system solution selected by the Contractor shall comply with the

Federal Information Security Management Act (FISMA)

b. The Contractor shall comply with FedRAMP requirements as mandated by Federal laws and policies, including making available any documentation, physical access, and logical access needed to support this requirement

c. The Contractor shall, where applicable, assist with the VA ATO Process to help achieve agency authorization of the cloud service or migrated application.

https://www.fedramp.gov/agency-authorization/

d. The Contractor shall provide VA specific implementation diagram withing 14 days of award

e. The Contractor shall provide IRP scenario within 14 calendar days and complete

Table-Top exercise within 28 calendar days of award unless current, approved VA IRP can be provided

f. The Contractor shall provide a System Boundary Diagram that demonstrates implementation and any proposed VA interconnections including required ports and protocols at the time award.

g. The Contractor shall provide a FedRAMP System Security Plan (SSP) and supporting documentation at the time of award

h. The Contractor shall provide a 3PAO Security Assessment Report (SAR) at the time of award

i. The Contractor shall comply with VA specific controls that are required for Agency

Authorization

j. The Contractor shall keep FedRAMP baseline System Security Plan (SSP) and all attachments up to date in the OMB Max repository (If Data Security Categorization is High, Contractor to provide access to alternate document repository)

k. The Contractor shall afford VA access to the Contractor’s and Cloud Service Provider’s (CSP) facilities, installations, technical capabilities, operations, documentation, records, and databases

l. If new or unanticipated threats or hazards are discovered by either VA or the

Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party in accordance with the security addendum B

m. The Contractor shall not release any data without the consent of VA in writing. All requests for release must be submitted in writing to the Contracting Officer’s Representative (COR)/Contracting Officer (CO)

n. In order for live VA data to be used in this system, a FedRAMP Authorization and Agency ATO will be required.

Deliverables:

a. System Boundary Diagram

b. VA Implementation Diagram

c. FedRAMP System Security Plan (SSP) and supporting documentation 3PAO Security Assessment Report (SAR)

13.4 APPLICABLE VA INFORMATION AND INFORMATION SYSTEM

SECURITY/PRIVACY LANGUAGE (per VA HANDBOOK 6500.6, APPENDIX C, APRIL 22, 2024)

1. GENERAL. This entire section applies to all acquisitions requiring any Information Security and Privacy language. Contractors, contractor personnel, subcontractors and subcontractor personnel will be subject to the same federal laws, regulations, standards, VA directives and handbooks, as VA personnel regarding information and information system security and privacy.

2. VA INFORMATION CUSTODIAL LANGUAGE. This entire section applies to all acquisitions requiring any Information Security and Privacy language.

�. The Government shall receive unlimited rights to data/intellectual property first produced and delivered in the performance of this contract or order (hereinafter “contract”) unless expressly stated otherwise in this contract. This includes all rights to source code and all documentation created in support thereof. The primary clause used to define Government and Contractor data rights is FAR 52.227-14 Rights in Data – General. The primary clause used to define computer software license (not data/intellectual property first produced under this contractor or order) is FAR 52.227-19, Commercial Computer Software License.

�. Information made available to the contractor by VA for the performance or administration of this contract will be used only for the purposes specified in the service agreement, SOW, PWS, PD, and/or contract. The contractor shall not use VA information in any other manner without prior written approval from a VA Contracting Officer (CO). The primary clause used to define Government and Contractor data rights is FAR 52.227-14 Rights in Data – General.

�. VA information will not be co-mingled with any other data on the contractor’s information systems or media storage systems. The contractor shall ensure compliance with Federal and VA requirements related to data protection, data encryption, physical data segregation, logical data segregation, classification requirements and media sanitization.

�. VA reserves the right to conduct scheduled or unscheduled audits, assessments, or investigations of contractor Information Technology (IT) resources to ensure information security is compliant with Federal and VA requirements. The contractor shall provide all necessary access to records (including electronic and documentary materials related to the contracts and subcontracts) and support (including access to contractor and subcontractor staff associated with the contract) to VA, VA's Office Inspector General (OIG), and/or Government Accountability Office (GAO) staff during periodic control assessments, audits, or investigations.

e. The contractor may only use VA information within the terms of the contract and applicable Federal law, regulations, and VA policies. If new Federal information security laws, regulations or VA policies become applicable after execution of the contract, the parties agree to negotiate contract modification and adjustment necessary to implement the new laws, regulations, and/or policies.

f. The contractor shall not make copies of VA information except as specifically authorized and necessary to perform the terms of the contract.

If copies are made for restoration purposes, after the restoration is complete, the copies shall be destroyed in accordance with VA Directive 6500, VA Cybersecurity Program and VA Information Security Knowledge Service.

g. If a Veterans Health Administration (VHA) contract is terminated for default or cause with a business associate, the related local Business Associate Agreement (BAA) shall also be terminated and actions taken in accordance with VHA Directive 1605.05, Business Associate Agreements.

If there is an executed national BAA associated with the contract, VA will determine what actions are appropriate and notify the contactor.

h. The contractor shall store and transmit VA sensitive information in an encrypted form, using VA-approved encryption tools which are, at a minimum, Federal Information Processing Standards (FIPS) 140-2, Security Requirements for Cryptographic Modules (or its successor) validated and in conformance with VA Information Security Knowledge Service requirements.

The contractor shall transmit VA sensitive information using VA approved Transport Layer Security (TLS) configured with FIPS based cipher suites in conformance with National Institute of Standards and Technology (NIST) 800-52, Guidelines for the Selection, Configuration and Use of Transport Layer Security (TLS) Implementations.

i. The contractor’s firewall and web services security controls, as applicable, shall meet or exceed VA’s minimum requirements.

j. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor may use and disclose VA information only in two situations: (i) in response to a qualifying order of a court of competent jurisdiction after notification to VA CO (ii) with written approval from the VA CO. The contractor shall refer all requests for, demands for production of or inquiries about, VA information and information systems to the VA CO for response.

k. Notwithstanding the provision above, the contractor shall not release VA records protected by Title 38 U.S.C. § 5705, Confidentiality of medical quality- assurance records and/or Title 38 U.S.C. § 7332, Confidentiality of certain medical records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse or infection with Human Immunodeficiency Virus (HIV). If the contractor is in receipt of a court order or other requests for the above- mentioned information, the contractor shall immediately refer such court order or other requests to the VA CO for response.

l. Information made available to the contractor by VA for the performance or administration of this contract or information developed by the contractor in performance or administration of the contract will be protected and secured in accordance with VA Directive 6500 and Identity and Access Management (IAM) Security processes specified in the VA Information Security Knowledge Service.

m. Any data destruction done on behalf of VA by a contractor shall be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management, VA Handbook 6300.1, Records Management Procedures, and applicable VA Records Control Schedules.

n. The contractor shall provide its plan for destruction of all VA data in its possession according to VA Directive 6500 and NIST 800-88, Guidelines for Media Sanitization prior to termination or completion of this contract. If directed by the COR/CO, the contractor shall return all Federal Records to VA for disposition.

o. Any media, such as…