PD_eQMS_DRAFTRFISAM.pdf

PRODUCT DESCRIPTION (PD)

DEPARTMENT OF VETERANS AFFAIRS

Office of Information & Technology Cooperative Studies Program (CSP)

Clinical Research Pharmacy Coordinating Center (CRPCC)

Brand Name or Equal to ComplianceQuest Electronic Quality Management System Software License and Support

Date: July 23, 2025

VA-25-00085171

PD Version Number: 1.0

Brand Name or Equal to ComplianceQuest eQMS

1.0 PRODUCT REQUIREMENTS

The Department of Veteran’s Affairs (VA) Cooperative Studies Program (CSP) Clinical Research Pharmacy Coordinating Center (CRPCC) in Albuquerque, NM requires brand name ComplianceQuest via the SalesforceGovCloud+ platform or equivalent FedRAMP compliant Solution, and support to serve as its primary electronic Quality Management Software (eQMS). The Contractor shall propose a versatile, cloud based commercial off-the shelf Solution requiring minimal configuration as specified in section 1.1 below.

This software is required to manage multiple functions relating to document version control including; upload, storage, and archival of Microsoft Office file types, the Portable Document Format (PDF) file type, and other file types as technology evolves.

The system must allow VA Personal Identity Verification (PIV) authentication of users with role-based permissions for system access and restrictions.

The period of performance (POP) shall be for one 12-month base period, inclusive of four 12-month option periods and one optional task.

Base and Option Periods 1 - 4

Description Quantity Unit

Salesforce GovCloud+ access or equivalent.

1 LT

Salesforce Shield or equivalent. 1 LT

ComplianceQuest Base Software or equivalent.

1 LT

Administrator licenses 1 LT

Full User licenses 1 LT

Technical Support and Training 1 LT

Optional Task

CQ AI platform 1 LT

Any product and/or service being provided as an equivalent alternative to the brand name products/services list above, must meet all of the salient characteristics below, and all responses must be provided evidence of such conformance in accordance with FAR 52.211-6 and 52.214-21 both included in Section E of this RFQ.

1.1 SALIENT CHARACTERISTICS

The following requirements encompass standard baseline functionality for an alternative electronic Quality Management Software (eQMS) to the brand name listed above. The eQMS must function as a stand-alone, commercial off-the-shelf, system that is compliant with current Food and Drug Administration (FDA) regulations (21 CFR Part 11, etc.), VA Office of Information Security (OIS) requirements, and ISO 9001guidelines.

The eQMS shall be a versatile commercial system which requires minimal configuration to meet CRPCC business needs. Configuration should be done using established functions that don’t require code changes to the system’s codebase. For controlled or formal content management, a secure and controlled environment is provided by:

• Controlling and restricting access to the system and its content

• Managing documents and content through their lifecycle, including creation, reviews, approvals, distribution, and obsolescence.

• Recording details of all actions performed on records and documents in an audit log, i.e., who performed the action, what the action was, why the action was performed, and when the action was performed.

The system will be used to facilitate execution of the CRPCC Quality Management System which include the following key processes:

• Quality document control (i.e. Standard Operating Procedures (SOP), Work Instructions (AMP), Policies (PL), Forms (FM), and any other defined documents)

• Internal and external audits of center operations

• Management reviews

• Quality issue and continuous improvement tracking

• Equipment management

1.2 SERVICE REQUIREMENTS

In addition to the requirements outlined below, the proposed eQMS must adhere to all VA requirements for electronic systems. The eQMS must be able to satisfy requirements to obtain a VA issued authority to operate (ATO) and function on the VA’s production network. Specific additional characteristics follow:

1.2.1 CONFIGURATION, AND VALIDATION SERVICES

ID Requirement Priority

ICV1 The Contractor shall provide access to the eQMS system and all required components and complete all required activities and documentation associated with installation qualification of the system.

Required

ICV2 The Contractor shall meet with key CRPCC stakeholders to perform strategic review to devise a configuration strategy based on CRPCC business needs and practices

Required

ICV3 The Contractor shall provide configuration services to configure system according to the configuration strategy.

Required

ICV4 The Contractor shall migrate data from existing CRPCC eQMS (Proquis) to the new eQMS platform and perform all necessary checks to ensure the data integrity remains intact.

Required

ICV5 The Contractor shall work with CRPCC key stakeholders to devise a validation strategy to include, at a minimum: System Risk Assessment, System Configuration Specifications, User Requirements and Specifications, Installation Qualification Specifications, Operational Qualification Specifications, Performance Qualification Specification, Test Plan, Final Validation Summary Report.

Required

ICV6 The Contractor shall provide documentation to indicate how system satisfies 21 CFR Part 11 regulatory requirements.

1.2.2 TRAINING AND SUPPORT SERVICES

TR1 The Contractor shall provide virtual training for up to 130 CRPCC employees. The training should cover all system modules and be pertinent to the user role.

Required

TR2 The Contractor shall provide continued online, phone, and virtual technical support of system

Required

TR3 The Contractor shall provide maintenance and updates to ensure system properly functions throughout period-of-performance.

1.3 FUNCTIONAL REQUIREMENTS

1.3.1 GENERAL EQMS REQUIREMENTS

1.3.1.1 TRAINING AND SUPPORT FUNCTIONALITY

ID Requirement Priority

TR4 The system shall enable users to access training on how to use the vendor-provided aspects of the system.

Required

TR5 The system shall enable users to access training on how to perform quality management activities as enabled by the system.

Required

TR6 The system shall have the capability to identify, assign, and provide appropriate quality management training materials to all users based on job codes or roles.

Desired

TR7 The system shall provide the integrated capabilities for training according to the Document Control and Record Control requirements.

Desired

TR8 The system shall provide online help that can be updated and maintained such that content is not lost upon system upgrade.

1.3.1.2 AUDIT TRAIL

AT1 The system shall retain an audit trail for actions performed on records and documents (i.e. creation, modification, deletion)

Required

AT2 Each audit trail record shall contain, at a minimum: details of the event, the initiator of the event, and a computer generated datetime stamp.

Required

AT3 The system shall ensure that record changes do not obscure the values in the original audit record.

Required

AT4 The system shall prohibit modification of audit trail records. Required

AT5 The audit trail shall be presented in a readable format to authorized users and will be readily available for retrieval.

Required

AT6 The system shall allow an authorized user to view and print the audit trail.

1.3.1.3 ACCESS CONTROL

AC1 The system must provide a unique and distinguishable user account for each user.

Required

AC2 The system should allow management of user details, i.e., name, position title, hire date, supervisor, position within organizational chart, etc.

Required

AC3 User authentication should integrate with VHA Active Directory and allow a user to authenticate using their VHA provided PIV card and pin.

Desired

AC4 Access to the system should be restricted to authenticated users who have an active account which has been granted access to the system by a system administrator.

Required

AC5 The system should allow user permissions (read, write, modify, delete) be controlled at the individual account level and also using Role-Based Access Controls.

Required

AC6 The system should enforce a principle of least privilege model, i.e., in situations where an account has multiple permission levels associated with a particular action, the permission level that is most restrictive will be applied.

AC7 The system should allow specified users to be identified as system administrators. System administrator accounts should have the ability to manage users, roles, permission, and system access.

1.3.2 INTERNAL/EXTERNAL AUDITS

The eQMS is required to include a module that allows scheduling, creation, and management of internally/externally conducted audits. The audit module should include functionality and behavior outlined in the requirements below.

AUD1 The system shall enable an audit to be scheduled and processed as specified in a standard operating procedure

(SOP.)

Required

AUD2 The system shall enable a user to initialize audit fields such as audit type and audit entities, including but not limited to location, process, system, site, supplier, department, and studies, risk, frequency, linked risks, linked documents, next audit date, last audit date, audit history, address, contact, phone, fax, email address, creation date, custom fields, and applicable standards.

Required

AUD3 The system shall have the capability for authorized users to be able to make configuration changes with a reasonable amount of training or use of the online help.

Required

AUD4 The system shall provide an interface to define and manage the compliance criteria to which an audit is performed against.

Required

AUD5 The audit interface shall be able to access, search, import and reference defined standard metadata within the system as it applies to an audit.

Required

AUD6 The system shall support the audit planning workflow with all the requirements specified in the cross-module functional requirements.

For example, workflows and checklists to support audit planning functions can be imported, updated, and managed.

Required

AUD7 The application shall provide an interface that allows authorized users to import audit entities from a delimited file.

Desired

AUD8 The system shall provide a flexible scheduling capability to enable managers to create and manage a schedule to accomplish audit objectives.

AUD9 The system shall support the audit execution workflow with all the requirements specified in the cross-module functional requirements.

For example, workflows and checklists to support audit scheduling functions can be imported, updated and managed.

Desired

AUD10 The system shall provide a scheduling interface within the system that has the ability to interface with MS Outlook.

Desired

AUD11 The system shall provide scheduling capability that can integrate with CRPCC systems that track each user’s qualifications such that the manager can select appropriate people for the given audit objectives.

Desired

AUD12 The system shall provide a flexible, yet easy to use, scheduling view that provides a Gantt-like perspective on the audit tasks.

Desired

AUD13 The system shall enable managers to easily modify which people or resources are allocated to a given task.

Desired

AUD14 The system shall provide role-based access to the schedule so managers can create and change it, and others can view it.

Desired

AUD15 The system shall provide a scheduling capability that enables managers to view current users scheduled tasks related to the assigned audit.

Required

AUD16 The system shall provide scheduling capability that enables managers to schedule users and have the commitment show up in the user's task list and MS Outlook calendar or MS Teams.

Desired

AUD17 The system shall support the workflow execution actions to progress the audit such as updating and linking evidence.

Required

AUD18 The system shall enable managers and users to clearly understand and track the dialog of a collaboration, including responses to audit observations.

Required

AUD19 The system shall provide an interface for mobile devices so users can manage and participate in an audit.

Desired

AUD20 The system shall enable managers to update the schedule at any point during the execution of the audit.

Required

AUD21 The system shall support audit execution workflow actions regarding the collection of metrics and building reports in order to monitor the progress of the audit.

Required

AUD22 The system shall enable authorized users per role-based access to monitor the progress of the audit, adjustment checklists or schedules, collaborate with users, and initiate Corrective Action Requests (CAR).

Required

AUD23 The system shall enable defining and generating default reports on audit data such as Link to the Audit Entity, Audit Type, Scheduled Start and End Dates, Performed Start and End Dates, Lead Auditors and Auditors, Audit Summary, Scope and Conclusion.

AUD24 The application shall provide interface for reporting and trending, including the following defined reports: Audit Entity, Audits, Audit Observations, Observations by Finding Trend, Observations by Rating, Observations by Criteria, Responses and Cycle time.

Required

AUD25 The system shall enable authorized users to set the final status for an audit and generate a final report.

Required

AUD26 The system shall enable authorized users to approve or reject the Audit Report.

NOTE: Rejection shall be to the most recent data entry workspace or collaboration step.

Required

AUD27 The system shall ensure completed audits are accessible according to role-based access and maintained as read only.

1.3.3 QUALITY ISSUE, CORRECTIVE/PREVENTIVE ACTION, AND

CONTINUOUS IMPROVEMENT TRACKING

The eQMS is required to include a module which allows creation, management, and tracking of quality issues, corrective/preventive actions (CAPA), and continuous improvement activities. This module should include functionality and behavior outlined in the requirements below.

QI1 The system shall allow users to document, manage, and track quality issues.

Required

QI2 The system shall allow a user to record the source which initially identified a quality issue, i.e., customer complaint, customer survey, audit, observed within organization, etc..

Required

QI3 The system shall allow a user to specify the severity of a quality issue, i.e., major non-conformance, minor non-conformance, discrepancy, etc..

Required

QI4 The system shall allow users to document, manage, and track continuous improvement initiatives (CI).

Required

QI5 The system shall allow the CRPCC to specify the required and optional data elements associated with a quality issue and CI.

QI6 The system shall allow the CRPCC to define the quality issue and CI lifecycle workflow. The workflow will enforce rules that govern, at a minimum:

• Configuration of statuses, e.g., Open, In-progress, Closed

• Configuration of milestones

• Documentation requirement, review/approval criteria, and target completion dates for each milestone

• Notification configuration NOTE: Workflow modifications must not require software code changes.

Required

QI7 The system shall allow one or more actions each with its own workflow be associated with a quality issue and CI.

Required

QI8 The system shall allow a user to specify a classification for each action, i.e., corrective, preventive, or improving.

Required

QI9 The system shall incorporate configurable email notifications which are triggered when certain criteria are met regarding quality issues, actions, and CI.

Required

QI10 The system shall allow a root cause analysis and supporting documentation be associated with a quality issue.

Required

QI11 The system shall allow users to link one or more electronic files to a quality issue, action, and CI as evidence.

Required

QI12 The system shall allow users to update the data elements, specified plan, time frame(s), evidence documents, and resources to support change control for quality issues, actions, and CI.

Required

QI13 The system shall allow users to configure custom reports regarding quality issues, actions, and CI. At a minimum, reports should allow filtering of items on source, severity, status, and/or lifecycle stage.

Required

QI14 The system shall allow custom reports be exported as an Excel document or delimited (.csv) file

Required

QI15 The system should allow configuration of key metrics and dashboards regarding quality issues, actions, and CI

Desired

QI16 The system shall allow CRPCC to configure permissions to control access to the quality issue, actions, and CI module and individual quality issues, actions, and CI.

Required

QI17 The system shall enable authorized user to rescind a quality issue, action, or CI.

Required

QI18 The system shall log all actions (creation, modification, deletion) performed on quality issues, actions, and CIs in the system’s audit trail.

QI19 The system shall allow for effectiveness checks Required

QI20 The system shall require a risk assessment for all issues entered and require a root cause analysis for all items identified as high risk

Desired

1.3.4 MANAGEMENT REVIEW

The eQMS is required to include a module that allows creation and management of quality issues requiring Management Review. The management review module should include functionality and behavior outlined in the requirements below.

MR1 The system shall allow users to document, manage, and track management review items (MR).

Required

MR2 The system shall allow the CRPCC to specify the required and optional data elements associated with a MR.

Required

MR3 The system shall allow the CRPCC to define the MR lifecycle workflow. The workflow will enforce rules that govern, at a minimum:

• Configuration of statuses, e.g., Open, In-progress, Closed

• Configuration of milestones

• Documentation requirement, review/approval criteria, and target completion dates for each milestone

• Notification configuration NOTE: Workflow modifications must not require software code changes.

Required

MR4 The system shall incorporate configurable email notifications which are triggered when certain criteria are met regarding a

MR.

Required

MR5 The system shall allow a user to link a MR item with a corresponding quality Issue or CI.

Desired

MR6 The system shall allow users to link one or more electronic files to a MR as evidence.

Required

MR7 The system shall allow users to configure custom reports regarding MR items. At a minimum, reports should allow filtering of items on status, and/or lifecycle stage.

Required

MR8 The system shall log all actions (creation, modification, deletion) performed on MRs in the system’s audit trail.

1.3.5 DOCUMENT MANAGEMENT

The eQMS is required to include a module that allows creation and management of quality documents such as SOPs, AMPs, PLs, FMs, etc. The document management module should include functionality and behavior outlined in the requirements below.

DM1 The system shall allow documents to be added, uploaded, or imported and managed.

Required

DM2 The system shall allow a library of document templates be created and managed. A user should be able to add a new document to the system using one of the prebuilt document templates or importing a new document.

Required

DM3 The system shall allow the CRPCC to configure the required and optional metadata to be collected when a document is added to the system, e.g., user adding the document, document title, document description.

System shall allow configuration to be defined, at a minimum:

• Globally – Configuration applies to all document

• Document type – Configuration applies to all documents of the specified type, e.g., SOP

• Individual Document – Configuration applies to the identified document

Required

DM4 The system shall provide each version of each document a unique id.

Required

DM5 The system shall allow CRPCC to configure permissions to the document module and individual documents at the individual user level and using role-based access controls.

Required

DM6 The system shall allow CRPCC to configure use of electronic signatures in the review/approval process for documents.

Required

DM7 The system shall allow users to export documents and save documents outside of the system in the document’s native application format, i.e., MS Word, MS Excel, Adobe PDF, MS Visio, etc.

Required

DM8 The system shall allow users to export documents using a drag-and-drop feature.

Desired

DM9 The system shall allow a user to print the current, approved version of a document.

Required

DM10 The system shall allow the CRPCC to configure which metadata elements are printed when a current, approved document is printed.

Required

DM11 The system shall allow an authorized user to print a draft copy of a document. The printed document should be watermarked to indicate it is in draft.

Required

DM12 The system shall allow an authorized user to print a previous version of a document. The printed document should be watermarked to indicate it is a previous, not current version.

Desired

DM13 The system shall provide user-friendly capabilities for users to manage the document change process including workflow planning, scheduling, collaboration, review/approval, release, and reporting.

Required

DM14 The system shall provide user-friendly capabilities for users to manage the document review process, i.e., planning, scheduling, notifications, collaboration, review/approval, and reporting.

Required

DM15 The system shall have the capability for the reviewer to apply standardized and agreed upon statuses for document review.

Required

DM16 The system shall allow document reviewers to see the changes made to the document (similar to the track changes feature in MS Word).

Desired

DM17 The system shall enforce version control throughout the life of the document from initial draft to obsolescence.

Required

DM18 The system shall ensure that each document version retain its own content and metadata.

Required

DM19 The system shall ensure that each document version retains its own metadata (properties).

Required

DM20 The system shall support the restoration of a previous version to the current version.

Required

DM21 The system shall allow CRPCC to configure distribution groups to receive notification when a document change is approved.

Required

DM22 The system shall allow CRPCC to configure which employees are required to confirm they have received and reviewed a document after a change has been approved.

Required

DM23 The system shall allow CRPCC to configure training criteria to ensure that identified users have completed the required training when a document change has been approved.

Desired

DM24 The system shall allow users to submit document change requests (DCR) for documents. Regarding document change requests, the system shall have the capability to:

• Create a document change request

• Optionally link supporting evidence to the request

• Preserve the link during the change process and thereafter

• Collect metrics such as timestamping when a document is added

• Assign a unique id to each document

Required

DM25 The system shall allow CRPCC to configure the DCR workflow for DCRs.

DM26 The system shall have the capability for the Quality Manager to:

• Define the review chain and change the author assignment

• Route assignment to the author.

Required

DM27 The system shall have the capability to allow a DCR evaluator to:

• View requests and linked evidence

• Approve or modify the requested document change

• Indicate that the evaluation is complete.

Required

DM28 The system shall notify an approver when a DCR evaluation is complete.

Required

DM29 The system shall allow an authorized user to rescind a document.

Required

DM30 All actions performed on documents, document reviews, and document change requests will be captured in the system’s audit trail.

1.3.6 EQUIPMENT MANAGEMENT

The eQMS is required to include a module that allows management of equipment and equipment lifecycle activities, e.g., preventive maintenance schedules, calibration schedules and certifications. The equipment module should include functionality and behavior outlined in the requirements below.

EQ1 The system shall allow users to add new equipment items for management.

Required

EQ2 The system shall allow the CRPCC to configure the required and optional data elements to be collected when a new equipment item is added to the system, i.e., manufacturer, model number, serial number, purchase date, expected life length, etc.

Required

EQ3 The system shall allow authorized users to add, modify, and delete data elements associated with an equipment item.

Required

EQ4 The system shall allow a user to request a repair against a piece of equipment.

Desired

EQ5 The system shall allow an authorized user to define a preventive maintenance schedule for an equipment item.

Required

EQ6 The system shall allow a user to document unplanned repairs and routine checks. Unplanned repairs and routine checks will not interfere with preventive maintenance schedule.

EQ7 The system shall allow the CRPCC to configure the required and optional data elements that must be documented for a preventive maintenance timepoint.

Required

EQ8 The system shall allow an authorized user to define a calibration schedule.

Required

EQ9 The system shall allow the CRPCC to configure the required and optional data elements that must be documented for a calibration timepoint.

Required

EQ10 The system shall allow an authorized user to attach a calibration certificate document to a calibration timepoint.

Required

EQ11 The system shall allow the CRPCC to configure email notifications regarding:

• New equipment items

• Modified equipment items

• Decommissioning of equipment items

• Preventive maintenance schedule timepoints

• Calibration timepoints

Required

EQ12 The system shall allow an authorized user to decommission an equipment item and/or suspend any schedules associated with the equipment.

Required

EQ13 The system shall allow CRPCC to configure customized reports for equipment items and/or associated schedules.

Required

EQ14 All actions performed on equipment items and/or associated schedules will be captured in the system’s audit trail.

Required

EQ15 The system shall display a calendar view of all upcoming calibration timepoints and preventive maintenance timepoints.

Desired

EQ16 The system shall allow for validation and/or qualification documents, electronic manuals and other documents to be uploaded to the specificfic piece of equipment.

Required

1.4 REPORTING REQUIREMENTS

The Contractor shall provide the COR with weekly Progress Reports in electronic form in Microsoft Word and Project formats. The report shall include detailed instructions/explanations for each required data element, to ensure that data is accurate and consistent. These reports shall reflect data as of the last day of the preceding week.

The weekly Progress Reports shall cover all work completed during the reporting period and work planned for the subsequent reporting period. The report shall also identify any problems that arose and a description of how the problems were resolved. If problems have not been completely resolved, the Contractor shall provide an explanation including their plan and timeframe for resolving the issue. The report shall also include an itemized list of all Information and Communication Technology (ICT) deliverables and their current Section 508 conformance status. It is expected that the Contractor will keep in communication with VA accordingly so that issues that arise are transparent to both parties to prevent escalation of outstanding issues.

Deliverable:

A. Weekly Progress Report

2.0 NOTICE OF THE FEDERAL ACCESSIBILITY LAW AFFECTING ALL

INFORMATION AND COMMUNICATION TECHNOLOGY (ICT)

PROCUREMENTS (SECTION 508)

On January 18, 2017, the Access Board issued a final rule that updated accessibility requirements covered by Section 508 and refreshed guidelines for telecommunications equipment subject to Section 255 of the Communications Act. The final rule went into effect on January 18, 2018. The revisions and updates to the Section 508-based standards and Section 255-based guidelines are intended to ensure that information and communication technology (ICT) covered by the respective statutes is accessible to and usable by individuals with disabilities.

2.1 SECTION 508 – INFORMATION AND COMMUNICATION TECHNOLOGY (ICT)

STANDARDS

The Section 508 standards established by the Access Board are incorporated into, and made part of all VA orders, solicitations and purchase orders developed to procure ICT.

These standards are found in their entirety at: Revised 508 Standards and 255 Guidelines (access-board.gov). A single PDF file version of the Revised Section 508 Standards and 255 Guidelines will be supplied upon request, or can be obtained from the Access Board website. Federal agencies must comply with the Rehabilitation Act of 1973, as amended.

The Contractor shall comply with “508 Chapter 2: Scoping Requirements” for all electronic ICT and content delivered under this contract. Specifically, as appropriate for the technology and its functionality, the Contractor shall comply with the technical standards marked here:

☒ E205 Electronic Content – (Accessibility Standard -WCAG 2.0 Level A and AA Guidelines)

☒ E204 Functional Performance Criteria

☐ E206 Hardware Requirements

☒ E207 Software Requirements

☒ E208 Support Documentation and Services Requirements

2.2 COMPATABILITY WITH ASSISTIVE TECHNOLOGY

The standards do not require installation of specific accessibility-related software or attachment of an assistive technology device. Section 508 requires that ICT be compatible with such software and devices so that ICT can be accessible to and usable https://www.access-board.gov/ict/ https://www.access-board.gov/ict/ by individuals using assistive technology, including but not limited to screen readers, screen magnifiers, and speech recognition software.

2.3 ACCEPTANCE AND ACCEPTANCE TESTING

Deliverables resulting from this solicitation will be accepted based in part on satisfaction of the Section 508 Chapter 2: Scoping Requirements standards identified above.

The Government reserves the right to test for Section 508 Compliance before delivery.

The Contractor shall be able to demonstrate Section 508 Compliance upon delivery.

3.0 DELIVERY OF FULL USER LICENSES

Licenses shall be delivered electronically to the point of contact below.

Inspection: Destination Acceptance: Destination Free on Board (FOB): Destination

Ship To and Mark For:

Primary Alternate Name: Name:

Address: Address:

Voice: Voice:

Email: Email:

4.0 GENERAL REQUIREMENTS

4.1 VA TECHNICAL REFERENCE MODEL

The Contractor shall comply with the VA OIT Technical Reference Model (VA TRM).

Compliance with the VA TRM is achieved by using only technologies and standards that are listed as approved for use in the VA TRM. The Contractor shall provide all necessary information requested by VA to ensure TRM approval is obtained prior to use on VA’s network.

4.2 ZERO TRUST – VA CRITICAL SECURITY CONTROLS

VA has established minimum mandatory security requirements and requires that any network connected software system or service must meet the VA Critical Security Controls as outlined in the VA Memorandum, “VA Security Controls”, https://www.voa.va.gov/DocumentView.aspx?DocumentID=5010. VA Critical Security Controls identify the minimum mandatory requirements that must be implemented across all VA enterprise infrastructure, cloud computing environments, information systems, networks, and specialized devices (medical devices/systems, special-purpose systems, and research scientific computing devices) that process, store, and/or transmit VA data. Effective July 1, 2025, the Contractor shall implement these VA Critical https://www.voa.va.gov/DocumentView.aspx?DocumentID=5010

Security Controls, within any network connected software system or service prior to being authorized for use in the VA. This functional requirement is not negotiable, and Plan of Action & Milestones (POAM) will not be accepted in the event these controls cannot be implemented for new systems. Critical Security Controls are intended to increase VA’s security posture and provide security and privacy risk visibility into the VA network and is not a new requirement. The Contractor’s failure to maintain these VA Critical Controls after implementation will result in VA discontinuing the use of the system.

4.3 SOCIAL SECURITY NUMBER (SSN) REDUCTION

The Contractor solution shall support the Social Security Number (SSN) Fraud Prevention Act (FPA) of 2017 which prohibits the inclusion of SSNs on any document sent by mail. The Contractor support shall also be performed in accordance with Section 240 of the Consolidated Appropriations Act (CAA) 2018, enacted March 23, 2018, which mandates VA to discontinue using SSNs to identify individuals in all VA information systems as the Primary Identifier. The Contractor shall ensure that any new IT solution discontinues the use of SSN as the Primary Identifier to replace the SSN with the Integrated Control Number (ICN) in all VA information systems for all individuals. The Contractor shall ensure that all Contractor delivered applications and systems integrate with the VA Master Person Index (MPI) for identity traits to include the use of the ICN as the Primary Identifier. The Contractor solution may only use a Social Security Number to identify an individual in an information system if and only if the use of such number is required to obtain information VA requires from an information system that is not under the jurisdiction of VA.

4.4 INTERNET PROTOCOL VERSION 6 (IPV6)

The Contractor solution shall support IPv6-Only based upon the memo issued by the Office of Management and Budget (OMB) on November 19, 2020 (https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-07.pdf). Which defines IPv6-only as the state of an operational system or service when IPv4 protocol functions (addressing, packet forwarding) are not in use. The NIST USGv6 profile defines technical requirements for a product to be capable of operating in IPv6-Only environments. IPv6-Only technology, in accordance with the USGv6 Program (https://www.nist.gov/programs-projects/usgv6-program/usgv6-revision-1), NIST Special Publication (SP) 500-267B Revision 1 “USGv6 Profile” (https://doi.org/10.6028/NIST.SP.500-267Br1), and NIST SP 800-119 “Guidelines for the Secure Deployment of IPv6” (https://doi.org/10.6028/NIST.SP.800-119), compliance shall be included in all IT infrastructures, application designs, application development, operational systems and sub-systems, and their integration. In addition to the above requirements, all devices, applications, and systems shall support all applicable functionality on native IPv6-Only as well as dual stack (IPv6 / IPv4) connectivity without additional memory or other resources being provided by the Government, so that they can function in a mixed environment. All public/external facing servers and services (e.g., web, email, DNS, ISP services, etc.) shall support native IPv6-Only and dual stack (IPv6 / IPv4) users and all internal infrastructure and applications shall support using native IPv6-Only and dual stack (IPv6 / IPv4) for all functionality and operations.

https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-07.pdf https://www.nist.gov/programs-projects/usgv6-program/usgv6-revision-1 https://doi.org/10.6028/NIST.SP.500-267Br1 https://doi.org/10.6028/NIST.SP.800-119

4.5 TRUSTED INTERNET CONNECTION (TIC)

The Contractor solution shall meet the requirements outlined in Office of Management and Budget Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative“ (https://www.whitehouse.gov/wp-content/uploads/2019/09/M-19-26.pdf), VA Directive 6513 “Secure External Connections”, and shall comply with the TIC 3.0 Core Guidance Documents, including all Volumes and TIC Use Cases, found at the Cybersecurity & Infrastructure Security Agency (CISA) (https://www.cisa.gov/publication/tic-30-core-guidance-documents.)

4.6 POSITION/TASK RISK DESIGNATION LEVEL(S)

In accordance with VA Handbook 0710, Personnel Security and Suitability Program, the position sensitivity and the level of background investigation commensurate with the required level of access for the following tasks within the PD are:

Position Sensitivity and Background Investigation Requirements by Service Task/Item Number

Service Task / Item Number

Tier1 / Low Risk Tier 2 / Moderate Risk

Tier 4 / High Risk

1.0 ☒ ☐ ☐

The Tasks identified above and the resulting Position Sensitivity and Background Investigation requirements identify, in effect, the Background Investigation requirements for Contractor individuals, based upon the tasks the particular Contractor individual will be working. The submitted Contractor Staff Roster must indicate the required Background Investigation Level for each Contractor individual based upon the tasks the Contractor individual will be working, in accordance with their submitted proposal.

5.0 POINTS OF CONTACT

VA Program Manager:

Name: Alexandra Scrymgeour Voice: 505-248-3200 Email: Alexandra.scrymgeour@va.gov

Contracting Officer’s Representative:

Name: Jose Rodriguez Voice: (202) 632-9521 Email: Jose.Rodriguez11@va.gov

Contracting Officer:

Name: Joseph Jones Voice: 848-377-5109 Email: Joseph.Jones6@va.gov

Contract Specialist:

https://www.whitehouse.gov/wp-content/uploads/2019/09/M-19-26.pdf https://www.cisa.gov/publication/tic-30-core-guidance-documents

Name: Luis Lozada-Santiago Voice: 848-377-5245 Email: luis.lozada-santiago@va.gov

6.0 INFORMATION SECURITY CONSIDERATIONS:

The assessment and authorization (A&A) requirements do not apply and a security accreditation package is not required.

All VA sensitive information shall be protected at all times in accordance with local security field office system security plans (SSP) and authority to operate (ATO) for all systems/LAN’s accessed while performing the tasks detailed in this product description.

a. A prohibition on unauthorized disclosure: “information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA.” This clause expressly limits the contractor/subcontractor’s rights to use data as described in rights in data – general, far 52.227-14(d).(1).

b. A requirement for data breach notification: upon discovery of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/subcontractor has access, the contractor/subcontractor shall immediately notify the COR and simultaneously, the designated iso, and privacy officer for the contract. The term “security incident” means an event that has, or could have, resulted in unauthorized access to, loss or damage to

VA assets, or sensitive information, or an action that breaches VA security procedures.

See VA handbook 6500.6, appendix c, paragraph 6.a.

c. A requirement to pay liquidated damages in the event of a data breach: “in the event of a data breach or privacy incident involving SPI the contractor processes or maintains under this contract, the contractor shall be liable to VA for liquidated damages for a specified amount per affected individual to cover the cost of providing credit protection services to those individuals.” However, it is the policy of VA to forgo collection of liquidated damages in the event the contractor provides payment of actual damages in an amount determined to be adequate by the agency.

Based on the determinations of the independent risk analysis, the contractor shall be responsible for paying to VA liquidated damages in the amount of $37.50 per affected individual to cover the cost of providing credit protection services to affected individuals consisting of the following:

1) notification;

2) one year of credit monitoring services consisting of automatic daily monitoring of at least 3 relevant credit bureau reports;

3) data breach analysis;

4) fraud resolution services, including writing dispute letters, initiating fraud alerts and credit freezes, to assist affected individuals to bring matters to resolution;

5) one year of identity theft insurance with $20,000.00 coverage at $0 deductible; and

6) necessary legal expenses the subjects may incur to repair falsified or damaged credit records, histories, or financial affairs

d. A requirement for annual security/privacy awareness training: “before being granted access to VA information or information systems, all contractor employees and subcontractor employees requiring such access shall complete on an annual basis either:

(i) the va security/privacy awareness training (contains VA security/privacy requirements) within 1 week of the initiation of the contract, or (ii) security awareness training provided or arranged by the contractor that conforms to VA’s security/privacy requirements as delineated in the hard copy of the VA security awareness training provided to the contractor. If the contractor provides their own training that conforms to

VA’s requirements, they will provide the COR or CO, a yearly report (due annually on the date of the contract initiation) stating that all applicable employees involved in VA’s contract have received their annual security/privacy training that meets VA’s requirements and the total number of employees trained. See va handbook 6500.6, appendix c, paragraph 9.

e. A requirement to sign VA’s rules of behavior: “before being granted access to va information or information systems, all contractor employees and subcontractor employees requiring such access shall sign on annual basis an acknowledgement that they have read, understand, and agree to abide by VA’s contractor rules of behavior which is attached to this contract.” See VA handbook 6500.6, appendix c, paragraph 9, and appendix d. Note: if a medical device vendor anticipates that the services under the contract will be performed by 10 or more individuals, the contractor rules of behavior may be signed by the vendor’s designated representative. The contract must reflect by signing the rules of behavior on behalf of the vendor that the designated representative agrees to ensure that all such individuals review and understand the contractor rules of behavior when accessing VA’s information and information systems.