PD- DRAFT 9MAY2025.docx

Email Marketing Delivery Serviceand Software Maintenance TAC Number: VA-25-00019994

PRODUCT DESCRIPTION (PD)

DEPARTMENT OF VETERANS AFFAIRS

Office of Information & Technology Office of Public Affairs

Email Marketing Delivery Service and Software Maintenance

Date: May 8, 2025

:VA-25-00019994

PD Version Number: 1.4

Contents

1.0 PRODUCT REQUIREMENTS

The Department of Veterans Affairs (VA) currently operates at scale, with 54 active accounts managing over 3,000 topics and sending more than 2.5 billion emails in Fiscal Year 2024 to a unique subscriber base exceeding 28 million individuals. While this extensive reach has enabled broad dissemination of information, the VA now seeks to evolve its communications strategy to emphasize quality over quantity. Moving forward, the VA intends to adopt a more streamlined, efficient, and targeted email delivery approach via a Commercial-Off-the Shelf (COTS) platform . The goal is to prioritize outcome-based messaging through intelligent delivery strategies that minimize overall message volume while maximizing relevance and engagement. This shift is designed to reduce message fatigue, enhance communication trust, and allow VA teams to achieve greater impact with fewer resources. Embracing the principle that 'less is more effective,' the VA’s future state will also focus on reducing its digital and operational footprint by consolidating redundant or underutilized accounts, eliminating inactive or overlapping topics, and simplifying message governance structures. Through better data alignment, cross-functional collaboration, and centralized oversight, the VA will ensure that only high-value, strategically necessary communications are delivered—making its outreach efforts not only more effective, but more sustainable and easier to manage over time.

VA Office of Public Affairs, requires an enterprise-level cloud-based digital communications COTS platform. The selected Software-as-a-Service (SaaS) platform shall include licensing, cloud hosting, software maintenance, and professional support services. The platform shall be hosted in a FedRAMP Moderate environment at a minimum and provide secure, authenticated communication capabilities with the public—particularly Veterans—without backend system integration.

The system shall support customized communication campaigns, subscriber management, multi-channel messaging (email, SMS), and detailed analytics. The platform must also integrate with VA internal data systems, including contact relationship management (CRM) platforms, to support unified data access, enhance campaign targeting, and enable seamless workflow across VA business lines. Users shall be able to create profiles and subscribe to topics across VA websites using customizable sign-up tools. The platform shall integrate with third-party services for authentication and data analytics.

The period of performance for this effort shall be a 12-month base period plus four 12-month option periods and optional tasks (See Section 2.0 and underlying Sub-Sections). The entire effort shall not exceed 60 months.

The Contractor shall provide the requirements set forth under Sub-Sections 1.1-1.3 for the base period and option periods, if exercised.

1.1 EMAIL DELIVERY CLOUD SERVICE SAAS:

The COTS platform shall be hosted in an environment that shall have at a minimum, Federal Risk and Authorization Management Program (FedRAMP) compliance at the Moderate Level. The contractor shall provide FedRAMP security features, such as two-factor authentication, VA’s Identity Management System (IAM) integration, Internet Protocol (IP) restrictions, password complexity/ age/re-use configuration, and a FedRAMP flag upon login.

The COTS platform shall provide the following functionality:

VA’s intended use of these services will enable VA to educate Veterans, family members, caregivers and the public about VA benefits, programs, and services. It will also enable VA to humanize the agency through use of direct, personal, and warm interaction with as many Veterans and stakeholders as possible. In order to provide for increased communication trust, the Contractor shall provide digital tools that include full customization of sign up and e-mail templates and allow posting content to social media web sites. As public-facing internet web sites, it is critical that the services be ‘user-friendly’ in a way that enables web site visitors a simple method to subscribe to updates as they occur. This process will be achieved through an easy to implement code snippet that requires VA staff to add to a webpage or in social media without having to interface with any VA backend databases. In order to better serve the VA’s external audience with the most accurate information possible, this service will utilize the most modern Application Programming Interface (APIS) in order to integrate with various external systems like Microsoft’s active directory, to perform data analysis and customer experience journey mapping.

The COTS platform shall provide enterprise reporting capability for agency users regardless of access level as well as reporting for each communication sent on behalf of the agency. This ability will allow VA administrators to better analyze the activity to better identify trends, opportunities, and make data-driven decisions with confidence. Communication reporting will provide statistics that reflect at a minimum, engagement rates, subscriber access, and bounce rates. Enterprise reporting will provide administrator usage statistic.

Core Requirements of the COTS Platform:

· FedRAMP Moderate-compliant environment at a minimum with advanced security features including two-factor authentication, IP restrictions, password policies, and integration with VA Identity Management systems.

· User-friendly, responsive web interfaces supporting mobile access.

· API integration with third-party systems (e.g., directory services, analytics platforms ).

· Full email and SMS campaign functionality with tracking and performance metrics (e.g., engagement, bounce rates) capabilities and reporting.

· Administrative reporting tools accessible by users at various access levels.

· No direct connections to VA networks; data sharing requires user consent.

· Data processed by the platform shall be owned by VA or users, based on consent agreements.

· The platform shall include email deliverability monitoring, including blacklisting detection and resolution. The Contractor shall proactively monitor major blocklists and coordinate with Internet Service Providers (ISPs) to resolve any blacklisting incidents impacting message delivery.

· Capability for custom aliasing, including the ability to send messages from “VA.gov” email addresses to ensure domain consistency and message authenticity.

· Ability to segment messages based on user data.

1.2 AUTHORITY TO OPERATE AND FEDRAMP REQUIREMENTS

The platform shall meet the below FedRAMP requirements:

1. The information system platform selected by the Contractor shall at a minimum comply with the Federal Information Security Management Act (FISMA) Moderate.

2. The Contractor shall at a minimum comply with FedRAMP Moderate requirements as mandated by Federal laws and policies, including making available any documentation, physical access, and logical access needed to support this requirement.

3. Following guidance from the Federal CIO, VA will utilize existing Joint Authorization Board (JAB) Authority to Operate (ATO) or agency ATO issued by another agency as a starting point for FedRAMP requirements. If neither of those exist, VA will sponsor FedRAMP ATO. VA will be using the FedRAMP baselines as a starting point, since they are specifically tailored for cloud services.

4. The Contractor shall, where applicable, assist with the VA ATO Process to help achieve agency authorization of the cloud service or migrated application.

5. The Contractor shall complete/maintain a FedRAMP System Security Plan (SSP) and supporting documentation within 30 days after contract award.

6. The Contractor shall complete/maintain a Third-Party Assessment Organization (3PAO) Security Assessment Plan (SAP) within 30 days after contract award.

7. The Contractor shall complete/maintain a 3PAO Security Assessment Report (SAR) within 30 days after contract award.

8. The Contractor shall afford VA access to the Contractor’s and Cloud Service Provider’s (CSP) facilities, installations, technical capabilities, operations, documentation, records, and/or databases.

9. If new or unanticipated threats or hazards are discovered by either VA or the Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party in accordance with the security addendum B.

10. The Contractor shall not release any data without the consent of VA in writing. All requests for release must be submitted in writing to the Contracting Officer’s Representative (COR)/Contracting Officer (CO).

11. In order for live VA data to be used in this system, a FedRAMP Authorization and Agency ATO will be required.

The SaaS product shall have not any direct connections or interfaces to VA systems or network. Users may consent to share their data (which may include PII and PHI) directly with the SaaS provider. However, the SaaS provider must have published terms and conditions for user consent. VA providers access data in a view-only mode, or with limited functionality per the user’s consent. All data processed by SaaS provider shall be owned by SaaS provider/user (VA).

1.3 FEDERAL IDENTITY, CREDENTIAL, AND ACCESS MANAGEMENT (FICAM)

The Contractor shall ensure Commercial Off-The-Shelf (COTS) product(s), software configuration and customization, and/or new software are Personal Identity Verification (PIV) card-enabled by accepting HSPD-12 PIV credentials using VA Enterprise Technical Architecture (ETA), https://www.ea.oit.va.gov/EAOIT/VA_EA/Enterprise_Technical_Architecture.asp, and VA Identity and Access Management (IAM) approved enterprise design and integration patterns, https://www.oit.va.gov/library/recurring/edp/index.cfm. The Contractor shall ensure all Contractor delivered applications and systems comply with the VA Identity, Credential, and Access Management policies and guidelines set forth in VA Handbook 6510 VA Identity and Access Management, VA Handbook 0735 Homeland Security Presidential Directive 12 (HSPD-12) Program, and align with the Federal Identity, Credential, and Access Management Roadmap and Implementation Guidance v2.0.

The Contractor shall ensure all Contractor delivered applications and systems provide user authentication services compliant with the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-63-3, VA Handbook 6500 Appendix F, “VA System Security Controls”, and VA IAM enterprise requirements for direct, assertion based authentication, and/or trust based authentication, as determined by the design and integration patterns. Direct authentication at a minimum must include Public Key Infrastructure (PKI) based authentication supportive of PIV card and/or Common Access Card (CAC), as determined by the business need.

The Contractor shall ensure all Contractor delivered applications and systems conform to the specific Identity and Access Management PIV requirements set forth in the Office of Management and Budget (OMB) Memoranda M-05-24, M-19-17, and NIST Federal Information Processing Standard (FIPS) 201-2. OMB Memoranda M-05-24 and M-19-17 can be found at: https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2005/m05-24.pdf, and https://www.whitehouse.gov/wp-content/uploads/2019/05/M-19-17.pdf respectively. Contractor delivered applications and systems shall be on the FIPS 201-2 Approved Product List (APL). If the Contractor delivered application and system is not on the APL, the Contractor shall be responsible for taking the application and system through the FIPS 201 Evaluation Program.

The Contractor shall ensure all Contractor delivered applications and systems support:

The required Assurance Levels for this specific effort are Identity Assurance Level 3, Authenticator Assurance Level 3, and Federation Assurance Level 3 Deliverables:

A. FedRAMP System Security Plan (SSP) and supporting documentation B. 3PAO Security Assessment Plan (SAP) C. 3PAO Security Assessment Report (SAR)

1.4 SERVICE LEVEL AGREEMENTS

The platform shall meet the below Service Level Agreements

1. Service Availability: All deployed services shall be available and functional to serve user requests at no less than 99.9% availability. Any maintenance window outages due to upstream or downstream maintenance shall include a record of the notification that was distributed to Veterans Affairs Stakeholders, and the time which the record was distributed. All messages shall be delivered to the Internet Service Provider within 60 minutes of agency issuance.

2. Service Reachability: Services on this platform shall be reachable by internal and external entities no less than 99.9% of the time. All required routing and proxying services are correctly functioning and forwarding traffic. Services that are unavailable due to upstream maintenance must have an outage notification to all Veterans Affairs stakeholders prior to the maintenance window for attribution to the upstream team. The Contractor shall have access to the Government’s published maintenance windows times and dates upon award. The Contractor shall provide a Service Level Agreement Monitoring Plan detailing its approach to ensuring Service Availability and Reachability is met, to included but not limited to automated testing scripts, monitoring processes, and cadency of reviews. An automated test, in accordance with the approved Service Level Agreement Monitoring Plan, and the logged reports of execution, including timing details, of that test shall be provided in the Service Level Agreement Report.

Deliverables:

A. Service Level Agreement Monitoring Plan B. Service Level Agreement Report

1.5 MAINTENANCE SUPPORT SERVICES:

The Contractor shall provide maintenance and support services as follows:

1. The Contractor shall provide maintenance and support to include: 24x7 Support (This shall include full time access to support during regular business hours via telephone and e-mail options as well as 4-hour response time for after business hours).

2. Setup/Customization Support – Ongoing support for onboarding and complete product feature training for new VA account users throughout the period of performance.

1.6 SUPPORT SERVICES

The Contractor shall provide technical support services to allow users to create customizable profiles and subscribe to information from across VA web sites via a configurable signup form.

The Contractor shall perform IP monitoring to ensure optimum deliverability of emails.

2.0 OPTIONAL TASKS

If exercised, the Contractor shall provide support for below efforts.

2.1 OPTIONAL TASK ONE: SHORT MESSAGE SERVICE (SMS) FUNCTIONALITY

The Contractor shall provide Short Message Service (SMS) Text Messaging to additional SMS/text messages per year for use with Communications Cloud Service and Software. This optional task will provide VA offices the flexibility to pick from packages of SMS messages. Communications Cloud Service and Software provides access to either 1 million, 2.5 million, or 4 increments of 10 million SMS/text messages per year from a shared short code within the United States. Specific quantities will be noted in a modification if exercised. VA can deliver messages directly to the public and other stakeholders to provide an enhanced direct communications channel for priority alerts via these additional SMS/text messages. This Optional Task may be exercised for either/both of the quantities noted above per performance period.

Additional SMS/Text Messaging includes:

· Access to the selected volume of additional SMS/text messages per year from a shared short code within the United States

· Use of responsively designed sign-up pages that allow the public to subscribe to communication updates from various devices

2.2 OPTIONAL TASK TWO: INDIVIDUAL MESSAGING CAPABILITY

The Contractor shall implement Individual Messaging Capability and shall deliver and track emails and SMS messages for Web applications via secure API’s. This service will provide an automated platform that makes critical, large-scale email and SMS/text message communication between VA and the public more personal, effective, and reliable. This service will deliver and track emails and SMS messages for Web applications via secure APIs. This will allow VA staff to focus on core business logic and operational needs, such as enrollment, licensing, or renewals. The Government may exercise this optional task in quantities of four hundred thousand, 4 million messages or 2 increments 10 million . In the event the Government elects for 4 million message, a subscription fee may be required. This Optional Task may be exercised once for each of the range quantities noted (400,000; 4,000,000) per Delivery Order performance period. The optional requirement for the subscription fee may only be exercised once during the base period.

This service shall include:

· Access to the selected volume of Individual Messages per year

· Text or Hypertext Markup Language formatting capabilities

· Robust, secure, and scalable infrastructure

· Certified delivery of email and SMS/text message confirmations and reminders

· Real-time resolution services (blocked emails).

OPTIONAL TASK Three: Enhanced Reporting API Capability Provide the capability to allow account administrators the ability to combine and visualize the engagement, subscriber and activity data across platforms and media channels in ways that may not be available within standard SaaS products reporting. This service shall connect with third party data visualization tools of their choice for example; Tableau, Klipfolio, Datarama or Excel. This ability will allow VA administrators to better analyze the activity to better spot trends, identify opportunities and make data-driven decisions with confidence. This optional task CLIN can be exercised once during each period of performance.

This service shall include:

Enhanced Reporting API Capability- Setup and Configuration

Covers the consultative PM/Implementation time required to get a client fully up and running on a new instance of a Product.

Additional inclusions:

• Online project kickoff

• A dedicated implementation resource for up to 90 days from project kickoff to provide assistance, guidance, and best practices

• Client must have access to development resources for API integration

• Access to online resources and reference documentation

• For up to 10 users

Enhanced Reporting API Capability - Online Training

Provides a balance of Product knowledge and industry best practices to a specific audience. Sessions are delivered by product experts via videoconferencing technology.

Deliverables:

A. Enhanced Reporting API Capability Online Training

3.0 NOTICE OF THE FEDERAL ACCESSIBILITY LAW AFFECTING ALL INFORMATION AND COMMUNICATION TECHNOLOGY (ICT) PROCUREMENTS (SECTION 508)

On January 18, 2017, the Architectural and Transportation Barriers Compliance Board (Access Board) revised and updated, in a single rulemaking, standards for electronic and information technology developed, procured, maintained, or used by Federal agencies covered by Section 508 of the Rehabilitation Act of 1973, as well as our guidelines for telecommunications equipment and customer premises equipment covered by Section 255 of the Communications Act of 1934. The revisions and updates to the Section 508-based standards and Section 255-based guidelines are intended to ensure that information and communication technology (ICT) covered by the respective statutes is accessible to and usable by individuals with disabilities.

3.1 SECTION 508 – INFORMATION AND COMMUNICATION TECHNOLOGY (ICT) STANDARDS

The Section 508 standards established by the Access Board are incorporated into, and made part of all VA orders, solicitations and purchase orders developed to procure ICT. These standards are found in their entirety at: https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines. A printed copy of the standards will be supplied upon request.

Federal agencies must comply with the updated Section 508 Standards beginning on January 18, 2018. The Final Rule as published in the Federal Register is available from the Access Board: https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule.

The Contractor shall comply with “508 Chapter 2: Scoping Requirements” for all electronic ICT and content delivered under this contract. Specifically, as appropriate for the technology and its functionality, the Contractor shall comply with the technical standards marked here:

3.2 COMPATABILITY WITH ASSISTIVE TECHNOLOGY

The standards do not require installation of specific accessibility-related software or attachment of an assistive technology device. Section 508 requires that ICT be compatible with such software and devices so that ICT can be accessible to and usable by individuals using assistive technology, including but not limited to screen readers, screen magnifiers, and speech recognition software.

3.3 ACCEPTANCE AND ACCEPTANCE TESTING

Deliverables resulting from this solicitation will be accepted based in part on satisfaction of the Section 508 Chapter 2: Scoping Requirements standards identified above.

The Government reserves the right to test for Section 508 Compliance before delivery. The Contractor shall be able to demonstrate Section 508 Compliance upon delivery.

4.0 INFORMATION TECHNOLOGY USING ENERGY-EFFICIENT PRODUCTS- IS NOT APPLICABLE TO THIS ACQUISITION

4.1 EPEAT – EPEAT PRODUCT COMPLIANCE IS NOT APPLICABLE TO THIS ACQUISITION

4.2 ENERGY STAR - ENERGY STAR COMPLIANCE IS NOT APPLICABLE TO THIS ACQUISITION

4.3 FEMP - FEMP OR FEMP LOW STANDBY POWER PRODUCT COMPLIANCE IS NOT APPLICABLE TO THIS ACQUISITION

5.0 SYSTEM ACCEPTANCE (PRE-PRODUCTION) TESTING - SHIPMENT OF HARDWARE OR EQUIPMENT- IS NOT APPLICABLE TO THIS ACQUISITION

5.1 SPECIAL SHIPPING INSTRUCTIONS – IS NOT APPLICABLE TO THIS ACQUISITION

5.2 NATIONAL ACQUISITIONS - IS NOT APPLICABLE TO THIS ACQUISITION

6.0 GENERAL REQUIREMENTS

6.1 VA TECHNICAL REFERENCE MODEL

The Contractor shall support the VA enterprise management framework. In association with the framework, the Contractor shall comply with OIT Technical Reference Model (VA TRM). The VA TRM is one component within the overall Enterprise Architecture (EA) that establishes a common vocabulary and structure for describing the information technology used to develop, operate, and maintain enterprise applications. Moreover, the VA TRM, which includes the Standards Profile and Product List, serves as a technology roadmap and tool for supporting OIT. Architecture & Engineering Services (AES) has overall responsibility for the VA TRM.

6.2 SOCIAL SECURITY NUMBER (SSN) REDUCTION

The Contractor platform shall support the Social Security Number (SSN) Fraud Prevention Act (FPA) of 2017 which prohibits the inclusion of SSNs on any document sent by mail. The Contractor support shall also be performed in accordance with Section 240 of the Consolidated Appropriations Act (CAA) 2018, enacted March 23, 2018, which mandates VA to discontinue using SSNs to identify individuals in all VA information systems as the Primary Identifier. The Contractor shall ensure that any new IT platform discontinues the use of SSN as the Primary Identifier to replace the SSN with the Integrated Control Number (ICN) in all VA information systems for all individuals. The Contractor shall ensure that all Contractor delivered applications and systems integrate with the VA Master Person Index (MPI) for identity traits to include the use of the ICN as the Primary Identifier. The Contractor platform may only use a Social Security Number to identify an individual in an information system if and only if the use of such number is required to obtain information VA requires from an information system that is not under the jurisdiction of VA.

6.3 INTERNET PROTOCOL VERSION 6 (IPV6)

The Contractor platform shall support Internet Protocol Version 6 (IPv6) based upon the memo issued by the Office of Management and Budget (OMB) on November 19, 2020 (https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-07.pdf). IPv6 technology, in accordance with the USGv6 Program (https://www.nist.gov/programs-projects/usgv6-program/usgv6-revision-1), NIST Special Publication (SP) 500-267B Revision 1 “USGv6 Profile” (https://doi.org/10.6028/NIST.SP.500-267Br1), and NIST SP 800-119 “Guidelines for the Secure Deployment of IPv6” (https://doi.org/10.6028/NIST.SP.800-119), compliance shall be included in all IT infrastructures, application designs, application development, operational systems and sub-systems, and their integration. In addition to the above requirements, all devices shall support native IPv6 and dual stack (IPv6 / IPv4) connectivity without additional memory or other resources being provided by the Government, so that they can function in a mixed environment. All public/external facing servers and services (e.g. web, email, DNS, ISP services, etc.) shall support native IPv6 and dual stack (IPv6 / IPv4) users and all internal infrastructure and applications shall communicate using native IPv6 and dual stack (IPv6 / IPv4) operations.

6.4 POSITION/TASK RISK DESIGNATION LEVEL(S) - NOT APPLICABLE

In accordance with VA Handbook 0710, Personnel Security and Suitability Program, the position sensitivity was reviewed and does not require background investigations.

INFORMATION SECURITY CONSIDERATIONS:

The assessment and authorization (A&A) requirements do not apply and a Security Accreditation Package is not required.

All VA sensitive information shall be protected at all times in accordance with local security field office System Security Plans (SSP’s) and Authority to Operate (ATO)’s for all systems/LAN’s accessed while performing the tasks detailed in this Product Description.

a. A prohibition on unauthorized disclosure: “Information made available to the Contractor or Subcontractor by VA for the performance or administration of this contract or information developed by the Contractor/Subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA.” This clause expressly limits the Contractor/Subcontractor’s rights to use data as described in Rights in Data – General, FAR 52.227-14(d).(1).

b. A requirement for data breach notification: Upon discovery of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the Contractor/Subcontractor has access, the Contractor/Subcontractor shall immediately notify the COR and simultaneously, the designated ISO, and Privacy Officer for the contract. The term “security incident” means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. See VA Handbook 6500.6, Appendix C, paragraph 6.a.

c. A requirement to pay liquidated damages in the event of a data breach: “In the event of a data breach or privacy incident involving SPI the contractor processes or maintains under this contract, the contractor shall be liable to VA for liquidated damages for a specified amount per affected individual to cover the cost of providing credit protection services to those individuals.” However, it is the policy of VA to forgo collection of liquidated damages in the event the Contractor provides payment of actual damages in an amount determined to be adequate by the agency.

Based on the determinations of the independent risk analysis, the Contractor shall be responsible for paying to VA liquidated damages in the amount of $37.50 per affected individual to cover the cost of providing credit protection services to affected individuals consisting of the following:

1) Notification;

2) One year of credit monitoring services consisting of automatic daily monitoring of at least 3 relevant credit bureau reports;

3) Data breach analysis;

4) Fraud resolution services, including writing dispute letters, initiating fraud alerts and credit freezes, to assist affected individuals to bring matters to resolution;

5) One year of identity theft insurance with $20,000.00 coverage at $0 deductible; and

6) Necessary legal expenses the subjects may incur to repair falsified or damaged credit records, histories, or financial affairs

d. A requirement for annual security/privacy awareness training: “Before being granted access to VA information or information systems, all Contractor employees and Subcontractor employees requiring such access shall complete on an annual basis either: (i) the VA security/privacy awareness training (contains VA security/privacy requirements) within 1 week of the initiation of the contract, or (ii) security awareness training provided or arranged by the contractor that conforms to VA’s security/privacy requirements as delineated in the hard copy of the VA security awareness training provided to the Contractor. If the Contractor provides their own training that conforms to VA’s requirements, they will provide the COR or CO, a yearly report (due annually on the date of the contract initiation) stating that all applicable employees involved in VA’s contract have received their annual security/privacy training that meets VA’s requirements and the total number of employees trained. See VA Handbook 6500.6, Appendix C, paragraph 9.

e. A requirement to sign VA’s Rules of Behavior: “Before being granted access to VA information or information systems, all Contractor employees and Subcontractor employees requiring such access shall sign on annual basis an acknowledgement that they have read, understand, and agree to abide by VA’s Contractor Rules of Behavior which is attached to this contract.” See VA Handbook 6500.6, Appendix C, paragraph 9, and Appendix D. Note: If a medical device vendor anticipates that the services under the contract will be performed by 10 or more individuals, the Contractor Rules of Behavior may be signed by the vendor’s designated representative. The contract must reflect by signing the Rules of Behavior on behalf of the vendor that the designated representative agrees to ensure that all such individuals review and understand the Contractor Rules of Behavior when accessing VA’s information and information systems.

POINTS OF CONTACT

VA Program Manager/Contracting Officers Representative:

Name:

Address:

Voice:

Email:

Contracting Officer:

Name: Michael Weckesser Address: 23 Christopher Way Eatontown, NJ 07724 Voice: 848-377-5032 Email: Michael.Weckesser@va.gov

Contract Specialist:

Name: Dennis Simms Address: 23 Christopher Way Eatontown, NJ 07724 Voice: 848-377-5132 Email: Dennis.Simms@va.gov image1.jpeg