Performance Work Statement_GenISIS Sustainment Services v1.4.docx

Data and Scientific Computing Service for Sustainment of GenISIS

VA-22-00025235

TRANSFORMATION TWENTY-ONE TOTAL TECHNOLOGY NEXT GENERATION (T4NG)

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Office of Information & Technology Product Development Veterans Health Administration (VHA)

Data and Scientific Computing Service for Sustainment of GenISIS

Date: May 4, 2022

VA-22-00025235

Task Order PWS Version Number: 1.4

Contents

BACKGROUND

Veteran Affairs (VA) continues to establish its leadership in genomic medicine through The Million Veterans Program (MVP), Cooperative Studies Program (CSP) and other national initiatives. MVP is a national initiative of VA to collect, store and manage biosamples from a minimum of one million Veterans that will be made available for conducting genomic research. To date more than 850,000 biosamples have been collected and processed at the National VA Biorepositories.

Genomic Information System for Integrative Sciences (GenISIS) is the data and informatics platform for collecting, storing, integrating, and retrieving integrated data on a secure computing environment for research purposes. Thus, GenISIS spans multiple data domains, data centers, functionalities and technology stacks.

The GenISIS infrastructure includes a 17 Petabytes (PB) high-performance networked storage, and a HPC environment with 4660 cores and 85 TB RAM located at multiple VA data centers. Currently, GenISIS hosts and manages multi-omic data including whole genome and whole exome sequence and Single Nucleotide Polymorphisms (SNP) genotyping data, methylation, metabolomic, proteomic, clinical and self-reported data. GenISIS continues to receive all the above data types as more participants are recruited to the national programs.

The current need for the Government is fulfilling tasks associated with multi-dimensional data acquisition, management and scientific computing services.

APPLICABLE DOCUMENTS

The documents in Paragraph 2.0 in the T4NG Basic PWS apply to the performance of this effort, there are no additional referenced documents.

SCOPE OF WORK

The Contractor shall provide Multi-omics Data Analysis, Biomedical informatics analysis, Informatics, Information Assurance and systems administrator support services to enable multiple data operations and scientific computing tasks for GenISIS Sustainment.

APPLICABILITY

This Task Order (TO) effort PWS is within the scope of paragraphs 4.2.11 Informatics Services, 4.2.13 Current System and Data Migration, 4.8.1 Systems Administration and 4.9.1 Information Assurance of the T4NG Basic PWS.

ORDER TYPE

The effort shall be proposed on a Firm Fixed Price (FFP) basis.

PERFORMANCE DETAILS

PERFORMANCE PERIOD

The PoP shall be a twelve (12) month base period, with 4 option period of 12 months each.

PLACE OF PERFORMANCE

Efforts under this Task Order (TO) shall be performed in the VA data center located at:

Department of Veterans Affairs VA Boston Healthcare System 150 South Huntington Ave Boston, MA 02130

Or on-prem at other VA data centers as approved by the VA PM.

Work may be performed at remote locations with prior approval of the Contracting Officer’s Representative (COR).

TRAVEL OR SPECIAL REQUIREMENTS

The Government anticipates travel under this effort to attend program-related meetings or conferences throughout the period of performance. Include all estimated travel costs in your firm-fixed price line items. These costs will not be directly reimbursed by the Government.

Table 1 below outlines the anticipated travel to attend program-related meetings.

Table 1: Anticipated Travel

Technical Kick-off Meeting (Base Period Only)

Program-related meetings or conferences (Base and Option Periods)

CONTRACT MANAGEMENT

All requirements of Sections 7.0 and 8.0 of the T4NG Basic PWS apply to this effort. This TO shall be addressed in the Contractor’s Progress, Status and Management Report as set forth in the T4NG Basic contract.

GOVERNMENT FURNISHED PROPERTY

The Government will provide office space, computers, telephone services and system access via terminals/workstations for authorized Contract-staff to accomplish the tasks associated with this PWS. All procedural guides, reference materials, and program documentation for the project and other Government applications will also be provided on an as-needed basis.

The Government has multiple remote access solutions available to include Citrix Access Gateway (CAG), Site-to-Site Virtual Private Network (VPN), and RESCUE VPN.

The Government’s issuance of Government Furnished Equipment (GFE) is limited to Contractor personnel requiring direct access to the network to: development environments; install, configure and run Technical Reference Model (TRM) approved software and tools (e.g., Oracle, Fortify, Eclipse, SoapUI, WebLogic, LoadRunner); upload/download/ manipulate code, run scripts, and apply patches; configure and change system settings; check logs, troubleshoot/debug, and test/QA.

When necessary, the Government will furnish desktops or laptops, for use by the Contractor to access VA networks, systems, or applications to meet the requirements of this PWS. The overarching goal is to determine the most cost-effective approach to providing needed access to the VA environment coupled with the need to ensure proper Change Management principles are followed. Contractor personnel shall adhere to all VA system access requirements for on-site and remote users in accordance with VA standards, local security regulations, policies and rules of behavior. GFE shall be approved by the COR and Program Manager on a case-by-case basis prior to issuance.

Based upon the Government assessment of remote access solutions and requirements of this TO, the Government estimates that the following GFE will be required by this TO:

1. 12 each laptops

The Government will not provide IT accessories including but not limited to Mobile Wi-Fi hotspots/wireless access points, additional or specialized keyboards or mice, laptop bags, extra charging cables, extra Personal Identity Verification card readers, peripheral devices, or additional Random Access Memory (RAM). The Contractor is responsible for providing these types of IT accessories in support of the TO as necessary and any VA installation required for these IT accessories shall be coordinated with the COR.

The Status of Government Furnished Equipment Report under the T4NG Basic Contract requirements is applicable to this TO and shall be delivered to the COR/VA PM as required.

SECURITY AND PRIVACY

All requirements in Section 6.0 of the T4NG Basic PWS apply. Addendum B requirements have been tailored to reflect the security and privacy requirements of this specific TO.

All VA sensitive information shall be protected at all times in accordance with local security field office System Security Plans (SSPs) and Authority to Operate documents (ATO)s for all systems and networks accessed while performing the tasks detailed in this PWS

POSITION/TASK RISK DESIGNATION LEVEL(S)

In accordance with VA Handbook 0710, Personnel Security and Suitability Program, the position sensitivity and the level of background investigation commensurate with the required level of access for the following tasks within the PWS are:

Position Sensitivity and Background Investigation Requirements by Task

The Tasks identified above and the resulting Position Sensitivity and Background Investigation requirements identify, in effect, the Background Investigation requirements for Contractor individuals, based upon the tasks the particular Contractor individual will be working. The submitted Contractor Staff Roster must indicate the required Background Investigation Level for each Contractor individual based upon the tasks the Contractor individual will be working, in accordance with their submitted proposal.

SPECIFIC TASKS AND DELIVERABLES

The Contractor shall perform the following:

PROJECT MANAGEMENT

CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, timeline and tools to be used in execution of this Tasks outlined for this effort. The CPMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks and resource support. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPMP shall be concurred upon and updated as required. The Contractor shall update and maintain the VA Program Manager (PM) approved CPMP throughout the PoP.

Deliverable:

A. Contractor Project Management Plan

BI-WEEKLY REPORTING REQUIREMENTS

The Contractor shall deliver Bi-Weekly (every two weeks) Status Reports. The Bi-Weekly Status Report shall include the following information:

a. Project Name and TO Number

b. Overall high level assessment of progress

c. All work in-progress and completed during the reporting period

d. Identification of any TO related issues uncovered during the reporting period and especially highlight those areas with a high probability of impacting schedule, or performance goals and their likely impact on schedule, or performance goals

e. Explanations for any unresolved issues, including possible solutions and any actions required of the Government and/or Contractor to resolve or mitigate any identified issue, including a plan and timeframe for resolution

f. Status on previously identified issues, actions taken to mitigate the situation and/or progress made in rectifying the situation.

g. Work planned for the subsequent three (3) reporting periods, when applicable

These reports shall not be the only means of communication between the Contractor, COR and the Program/Project Manager to advise of performance/schedule issues and to develop strategies for addressing the issues. The Contractor shall continuously monitor performance and report any deviation from the CPMP or previous Bi-Weekly Status Report to the COR and Program/Project Manager during routine, regular communications.

Deliverable:

A. Bi-Weekly Status Report

PRIVACY TRAINING

The Contractor shall submit status of VA Privacy and Information Security Awareness training for all individuals engaged on the task. The status reporting shall identify; a single Contractor Security Point of Contact (POC), the names of all personnel engaged on the task, their initial training date for VA Privacy and Information Security training, and their next required training date. This information shall be submitted as part of the monthly Status Report as well as ad hoc report when changes happen.

The Contractor shall submit VA Privacy and Information Security and Privacy HIPAA training certificates, to include Signed Contractor Rules of Behavior, in accordance with Section 9, Training, from Appendix C of the VA Handbook 6500.6, “Contract Security”.

Deliverables:

A. VA Privacy and Information Security Training Certificates B. Privacy and HIPAA Training Certificates C. Signed Contractor Rules of Behavior

TECHNICAL KICKOFF MEETING

A technical kickoff meeting shall be held within 10 days after TO award, virtually over Microsoft Teams or at the VA Boston Health System office at Jamaica Plain in Boston, MA. The Contractor shall coordinate the date, time, and location (can be virtual as stated previously) with the Contracting Officer (CO), as the Post-Award Conference Chairperson, the VA PM, as the Co-Chairperson, the Contract Specialist (CS), and the COR. The Contractor shall provide a draft agenda to the CO and VA PM at least five (5) calendar days prior to the meeting. Upon Government approval of a final agenda, the Contractor shall distribute to all meeting attendees. During the kickoff-meeting, the Contractor shall present, for review and approval by the Government, the details of the intended approach, work plan, and project schedule for each effort via a Microsoft Office PowerPoint presentation. At the conclusion of the meeting, the Contractor shall update the presentation with a final slide entitled “Summary Report” which shall include notes on any major issues, agreements, or disagreements discussed during the kickoff meeting and the following statement “As the Post-Award Conference Chairperson, I have reviewed the entirety of this presentation and assert that it is an accurate representation and summary of the discussions held during the Technical Kickoff Meeting for the Data and Scientific Computing Service for Sustainment of GenISIS.” The Contractor shall submit the final updated presentation to the CO for review and signature within three (3) calendar days after the meeting. The Contractor shall also work with the CS, the Government’s designated note taker, to prepare and distribute the meeting minutes of the kickoff meeting to the CO, COR and all attendees within three (3) calendar days after the meeting. The Contractor shall obtain concurrence from the CS on the content of the meeting minutes prior to distribution of the document.

RECEIVING, CATALOGING AND UPLOADING BIOMEDICAL DATA

The Contractor shall receive, track, and catalog encrypted external disk drives containing genomic data including SNP, whole genome, whole exome, methylation, metabolomics, and proteomics data as these data are shipped from the vendors generating the data. The Contractor shall receive, track, and catalog additional data from online sources where hard drives are not involved. Currently, the size of the environment consists of SNP data from about 878,000 samples, Whole Genome Sequence (WGS) data from 175,000 samples, Methylation data from 100,000 samples, Metabolomics data from 50,000 samples, and proteomics from 100,000 samples.. Over the life of the program, it is expected that the entire environment will increase approximately 10-20% per year.

The Contractor shall catalog and upload all data files described above that meet all internal standards for Quality Assurance/Quality Control QA/QC.

The Contractor shall:

1. Follow the current processes for uploading, organizing and managing the GenISIS data stores for multi-omics data. Maintain, enhance and deliver an updated version of the current External Drive Management Standard Operating Procedures (SOP) for receiving, tracking, signing off disk receipt, cataloging, and secure storage of external hard disks, as well as for uploading genomic data from the hard disks onto GenISIS storage systems per business requirements, which includes decryption, disk integrity checks, data validation and other common industry best practices. The Contractor shall maintain and follow all the current data flow procedures on the receipt of external encrypted disk drives with genomic data shipped from third party molecular analysis laboratories.

2. Perform Data QA/QC of genotype, Next Generation Sequencing (NGS) data that has been developed internally by the VA research team, and upload all of the QC metrics, data provenance & pipeline process metadata to the current Catalog system. The current Meta tagging will be required to be maintained for searching and retrieving of specific data from the hard drives once they are stored.

3. Perform enhancements to the current GenISIS Drive Catalogue System. The Contractor shall provide configuration enhancements to the data catalog for new data types and data quality efforts on an as needed basis based upon data changes and in consultation with VA. The Catalogue System shall be updated once a year, but no more than every quarter, based upon functional requirements. VA retains proprietorship and copyright of the Catalog System and all configuration enhancements developed under this TO. The Contractor shall maintain, administer, and operate the GenISIS Drive Catalog System and provide reporting on the resulting activities in GenISIS Drive Catalogue System Activity Reports on a monthly basis.

4. Follow the Data Retrieval SOP for the currently established encryption and decryption process to maintain data security and privacy. All data received are encrypted and secured and privacy preserved.

5. Follow the current Data Retrieval SOP to ensure external disk drives are stored in a secure lockable storage cabinet provided by VA within the Boston VA facility. Occasionally some drives will need to be shipped to external locations when specified by VA Program manager. VA will provide all packing materials as well as the shipping account and instructions.

6. Maintain, and keep up-to-date the existing Data Retrieval SOP for retrieving data from previously stored external disk drives. The Data Retrieval SOP shall include procedures for the case where the hard disk in question is local in the Boston data center, and the case where the hard disk is stored at a location external to the Boston data center. In the latter case, the Contractor shall initiate a request to the external location to forward the external disk drive to Boston, and upon receipt the Contractor then follows the SOP for data retrieval instructions with external disk drive in hand.

7. Maintain and enhance an updated External Data Management Standard Operating Procedures (SOP)for receiving, tracking, cataloging, and monitoring external data brought into GenISIS storage systems per business requirements which includes encryption/decryption, file integrity checks, data validation and other common industry best practices. This SOP shall enumerate in detail all the steps and procedures the Contractor shall follow to receive data, evaluate its quality, and any necessary cleaning and storage of data.

8. Perform standard Data QA/QC of genotype and NGS data and other omics data. The Contractor shall upload all the QC metrics, data provenance & pipeline process metadata for all imported external data to appropriate internal repositories.

Deliverables:

A. Updated External Drive Management SOP B. Updated GenISIS Drive Catalogue System Activity Report C. Updated Data Retrieval SOP D. Updated External Data Management SOP

GenISIS NETWORK STORAGE AND HPC PERFORMANCE MONITORING AND TUNING The MVP now banks over 900,000 blood samples from which genomic (SNP, whole exome, whole genome and other omics) information continues to be generated by third party vendors and shipped to VA either via encrypted external hard disks or Wide Area Network (WAN). The VA computing infrastructure available for hosting and analysis of this genomic data currently includes approximately 17 Petabytes (PB) high-performance networked storage, and a HPC environment with 4660 cores and 85 TB RAM.

The Contractor shall maintain the GenISIS computing and data environment for performing multi-omics analysis by the VA researchers.

The Contractor shall upload the standard set of genomic data including SNP calls and variant files detailed in Section 5.2 onto the GenISIS system to be made available on the HPC for analysis. The standard sequence files that shall generally be uploaded include the Variant Call Format (VCF), annotation and Quality Control (QC) files, while the raw files including the FASTQ format and BAM (Binary version of Sequence Alignment / Map (SAM)) files shall be uploaded only as needed based on the results of a GenISIS Project data quality determination assessment by the VA PM.

The Contractor shall monitor the performance of GenISIS scientific compute and storage systems and HPC cluster. These systems utilize both Red Hat Linux and Microsoft Windows operating systems. The Contractor shall apply industry-standard performance specifications as applied to scientific HPC systems similar in size and function to GenISIS systems to compare with baseline industry genomic computing systems standards. The Contractor shall deliver a quarterly GenISIS System Performance Report that provides assessment of current GenISIS performance, contrasts current performance with recommended baselines, and lists steps to be taken by the Contractor to align current performance with recommended performance.

The Contractor shall provide Recommendations for improving the Baseline GenISIS Performance Metrics that shall include the implementation of the recommendations approved by VA for fine tuning the HPC cluster and GenISIS networked storage: storage partitioning and alignment, compute node configuration, and HPC cluster analysis for optimal performance of job queuing for genomic analysis. The Contractor shall summarize all tuning activities in the Bi-Weekly Status Report. The Contractor shall provide Daily Usage Reports of the HPC cluster to the VA. The Contractor shall also provide constant performance monitoring, account management, and system security functions of the HPC cluster.

The Contractor shall apply configuration changes approved by the VA to improve operational performance of GenISIS computational elements. GenISIS currently operates an enhanced Affymetrix data QA/QC pipeline as well as GATK (is the industry standard for identifying Single Nucleotide Polymorphisms (SNP {snips}) and indels in germline DNA and RNAseq data) based NGS QA/QC pipeline. The Contractor shall execute and enhance current genomic data curation workflows/pipelines and have knowledge and skills to enhance these pipelines as needed or demanded by changes in the genomics data analytics field. The Contractor shall evaluate and improve current processes for GenISIS end user support systems including issue tracking for system access, data provisioning, data analysis pipelines/workflows and other end user requests.

Deliverables:

A. GenISIS System Performance Report B. Baseline GenISIS Performance Metrics Improvement Recommendations

QA/QC PIPELINES MAINTENANCE

The Contractor shall maintain the existing approximately 40 operational clinical, survey and genomic data QA/QC pipelines to ensure the continuity and successful operation of the data QA/QC pipelines and scripts and shall confirm the functionality of the pipelines. The Contractor shall ensure these pipelines/scripts perform scientific data operations and management tasks including Data de-identifications, data fetching, data transformations, honest broker operations, data integration and data subsetting on demand, etc. These pipelines consist of a growing list of over 100 different tools. The Contractor shall provide a summary of the pipeline components and usage, to include maintenance and QA/QC of all pipelines, and shall include the summary in the Bi-Weekly Status Report.

MAINTAIN DATA MANAGEMENT STANDARD OPERATING PROCEDURES (SOP)

The Contractor shall maintain the current catalog of data sources, detailed in Section 5.2, and version the data from each source. The data catalog shall include data metadata and quality metrics of the data that are currently being collected.

BUILDING NEW GENOTYPE, NGS, OTHER OMICS AND CLINICAL DATA QA/QC PIPELINES

GenISIS currently maintains and operates over 40 data operation pipelines. As the science of genomic medicine incorporates fast paced changes, there will be other data pipelines that may be required to be built. The Contractor shall assist in building any such required QA/QC pipelines for genotype, NGS, as well as phenomic or other types of data. Historically there were 6-8 QA/QC pipelines built per year. These pipelines include adaptation of pipelines already built elsewhere or available in the academic community. The Contractor shall deliver Genotype, NGS, other omics and clinical data QA/QC Pipelines with associated Operation Manuals for each pipeline built.

Deliverable:

A. Genotype, NGS, other omics and Clinical Data QA/QC Pipeline Documentation ADMINISTER, CONFIGURE AND MAINTAIN VARIOUS SCIENTIFIC COMPUTING AND ANALYTICAL SOFTWARE FOR USE BY RESEARCHERS As part of maintaining the current builds of the HPC environment and all the software in the GenISIS software ecosystem, the Contractor shall maintain and:

1. Administer scientific software applications for over 110 applications. This includes installing newer versions, configuring, upgrading, and monitoring bioinformatics software tools and pipelines. Configuration changes shall be version controlled. The technology stack in GenISIS includes, but is not limited to: .NET, Java, Spring Framework, Hibernate, JavaServer Faces (JSF), Python, Pylon, Dojo Toolkit, Resource Description Framework (RDF), SQL Alchemy, SQL, Postgres, MySQL, and SPARQL Protocol and RDF Query Language (SPARQL), Scala, R, S, APT, Bowtie, GATK, PLINK, and StarLIMS.

2. Administer software tools to process data generated by Next Generation Sequencing (NGS) platforms and other omics pipelines

3. Administer software tools to process data generated by the multi-mics platforms.

4. Administer software analysis tools used to perform Genome-wide Association Studies (GWAS) and other downstream analysis like polygenic risk score (PRS), heritability calculations etc.

5. Configure software tools to run efficiently (comparable or better than the standard large academic computing systems) in the GenISIS HPC environment.

6. Provide a Quarterly Software Maintenance Report that shall detail all of the work completed in support of this task.

Deliverable:

A. Quarterly Software Maintenance Report

GENERAL REQUIREMENTS

PERFORMANCE METRICS

The table below defines the Performance Standards and Acceptable Levels of Performance associated with this effort.

2. Efficient and effective in meeting requirements

3. Meets technical needs and mission requirements

4. Provides quality services/products

5. Incorporates “ease of use” Human Centered Design principles in any software developed.

Satisfactory or higher

2. Products completed, reviewed, delivered in accordance with the established schedule

3. Notifies customer in advance of potential problems Satisfactory or higher

2. Personnel possess necessary knowledge, skills and abilities to perform tasks Satisfactory or higher

The COR will utilize a Quality Assurance Surveillance Plan (QASP) throughout the life of the TO to ensure that the Contractor is performing the services required by this PWS in an acceptable level of performance. The Government reserves the right to alter or change the QASP at its own discretion. A Performance Based Service Assessment will be used by the COR in accordance with the QASP to assess Contractor performance.

SECTION 508 – INFORMATION AND COMMUNICATION TECHNOLOGY (ICT) STANDARDS

On January 18, 2017, the Architectural and Transportation Barriers Compliance Board (Access Board) revised and updated, in a single rulemaking, standards for electronic and information technology developed, procured, maintained, or used by Federal agencies covered by Section 508 of the Rehabilitation Act of 1973, as well as our guidelines for telecommunications equipment and customer premises equipment covered by Section 255 of the Communications Act of 1934. The revisions and updates to the Section 508-based standards and Section 255-based guidelines are intended to ensure that information and communication technology (ICT) covered by the respective statutes is accessible to and usable by individuals with disabilities.

The following Section 508 Requirements supersede Addendum A, Section A3 from the T4NG Basic PWS.

The Section 508 standards established by the Access Board are incorporated into, and made part of all VA orders, solicitations and purchase orders developed to procure ICT. These standards are found in their entirety at: https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines. A printed copy of the standards will be supplied upon request.

Federal agencies must comply with the updated Section 508 Standards beginning on January 18, 2018. The Final Rule as published in the Federal Register is available from the Access Board: https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule.

The Contractor shall comply with “508 Chapter 2: Scoping Requirements” for all electronic ICT and content delivered under this contract. Specifically, as appropriate for the technology and its functionality, the Contractor shall comply with the technical standards marked here:

COMPATIBILITY WITH ASSISTIVE TECHNOLOGY

The standards do not require installation of specific accessibility-related software or attachment of an assistive technology device. Section 508 requires that ICT be compatible with such software and devices so that ICT can be accessible to and usable by individuals using assistive technology, including but not limited to screen readers, screen magnifiers, and speech recognition software.

ACCEPTANCE AND ACCEPTANCE TESTING

Deliverables resulting from this solicitation will be accepted based in part on satisfaction of the Section 508 Chapter 2: Scoping Requirements standards identified above.

The Government reserves the right to test for Section 508 Compliance before delivery. The Contractor shall be able to demonstrate Section 508 Compliance upon delivery.

INFORMATION TECHNOLOGY USING ENERGY-EFFICIENT PRODUCTS

Not Applicable (N/A)

ADDENDUM B- VA INFORMATION AND INFORMATION SYSTEM SECURITY / PRIVACY LANGUAGE

APPLICABLE PARAGRAPHS TAILORED FROM: VA INFORMATION AND INFORMATION SYSTEM SECURITY/PRIVACY LANGUAGE, VA HANDBOOK 6500.6, APPENDIX C, MARCH 12, 2010

B.1 GENERAL

Contractors, Contractor personnel, Subcontractors, and Subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security.

B.2 ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS

a. A Contractor/Subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, Subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order.

b. All Contractors, Subcontractors, and third-party servicers and associates working with VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for Contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures.

c. Contract personnel who require access to national security programs must have a valid security clearance. National Industrial Security Program (NISP) was established by Executive Order 12829 to ensure that cleared U.S. defense industry contract personnel safeguard the classified information in their possession while performing work on contracts, programs, bids, or research and development efforts. The Department of Veterans Affairs does not have a Memorandum of Agreement with Defense Security Service (DSS). Verification of a Security Clearance must be processed through the Special Security Officer located in the Planning and National Security Service within the Office of Operations, Security, and Preparedness.

d. Custom software development and outsourced operations must be located in the U.S. to the maximum extent practical. If such services are proposed to be performed abroad and are not disallowed by other VA policy or mandates (e.g. Business Associate Agreement, Section 3G), the Contractor/Subcontractor must state where all non-U.S. services are provided and detail a security plan, deemed to be acceptable by VA, specifically to address mitigation of the resulting problems of communication, control, data protection, and so forth. Location within the U.S. may be an evaluation factor.

e. The Contractor or Subcontractor must notify the Contracting Officer immediately when an employee working on a VA system or with access to VA information is reassigned or leaves the Contractor or Subcontractor’s employ. The Contracting Officer must also be notified immediately by the Contractor or Subcontractor prior to an unfriendly termination.

B.3 VA INFORMATION CUSTODIAL LANGUAGE

a. Information made available to the Contractor or Subcontractor by VA for the performance or administration of this contract or information developed by the Contractor/Subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of VA. This clause expressly limits the Contractor/Subcontractor's rights to use data as described in Rights in Data - General, FAR 52.227-14(d) (1).

b. VA information should not be co-mingled, if possible, with any other data on the Contractors/Subcontractor’s information systems or media storage systems in order to ensure VA requirements related to data protection and media sanitization can be met. If co-mingling must be allowed to meet the requirements of the business need, the Contractor must ensure that VA’s information is returned to VA or destroyed in accordance with VA’s sanitization requirements. VA reserves the right to conduct on site inspections of Contractor and Subcontractor IT resources to ensure data security controls, separation of data and job duties, and destruction/media sanitization procedures are in compliance with VA directive requirements.

c. Prior to termination or completion of this contract, Contractor/Subcontractor must not destroy information received from VA, or gathered/created by the Contractor in the course of performing this contract without prior written approval by VA. Any data destruction done on behalf of VA by a Contractor/Subcontractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self-certification by the Contractor that the data destruction requirements above have been met must be sent to the VA Contracting Officer within 30 days of termination of the contract.

d. The Contractor/Subcontractor must receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with the terms of the contract and applicable Federal and VA information confidentiality and security laws, regulations and policies. If Federal or VA information confidentiality and security laws, regulations and policies become applicable to the VA information or information systems after execution of the contract, or if NIST issues or updates applicable FIPS or Special Publications (SP) after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations and policies in this contract.

e. The Contractor/Subcontractor shall not make copies of VA information except as authorized and necessary to perform the terms of the agreement or to preserve electronic information stored on Contractor/Subcontractor electronic storage media for restoration in case any electronic equipment or data used by the Contractor/Subcontractor needs to be restored to an operating state. If copies are made for restoration purposes, after the restoration is complete, the copies must be appropriately destroyed.

f. If VA determines that the Contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the Contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12.

g. If a VHA contract is terminated for cause, the associated Business Associate Agreement (BAA) must also be terminated and appropriate actions taken in accordance with VHA Directive 1605.05, Business Associate Agreements. Absent an agreement to use or disclose protected health information, there is no business associate relationship.

h. The Contractor/Subcontractor must store, transport, or transmit VA sensitive information in an encrypted form, using VA-approved encryption tools that are, at a minimum, FIPS 140-2 validated.

i. The Contractor/Subcontractor’s firewall and Web services security controls, if applicable, shall meet or exceed VA’s minimum requirements. VA Configuration Guidelines are available upon request.

j. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the Contractor/Subcontractor may use and disclose VA information only in two other situations: (i) in response to a qualifying order of a court of competent jurisdiction, or (ii) with VA’s prior written approval. The Contractor/Subcontractor must refer all requests for, demands for production of, or inquiries about, VA information and information systems to the VA contracting officer for response.

k. Notwithstanding the provision above, the Contractor/Subcontractor shall not release VA records protected by Title 38 U.S.C. 5705, confidentiality of medical quality assurance records and/or Title 38 U.S.C. 7332, confidentiality of certain health records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse, or infection with human immunodeficiency virus. If the Contractor/Subcontractor is in receipt of a court order or other requests for the above mentioned information, that Contractor/Subcontractor shall immediately refer such court orders or other requests to the VA contracting officer for response.

l. For service that involves the storage, generating, transmitting, or exchanging of VA sensitive information but does not require Assessment and Authorization (A&A) or a Memorandum of Understanding-Interconnection Security Agreement (MOU-ISA) for system interconnection, the Contractor/Subcontractor must complete a Contractor Security Control Assessment (CSCA) on a yearly basis and provide it to the COR.

B.4 INFORMATION SYSTEM DESIGN AND DEVELOPMENT

N/A

B.5 INFORMATION SYSTEM HOSTING, OPERATION, MAINTENANCE, OR USE

N/A

B.6 SECURITY INCIDENT INVESTIGATION

a. The term “security incident” means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. The Contractor/Subcontractor shall immediately notify the COR and simultaneously, the designated ISO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the Contractor/Subcontractor has access.

b. To the extent known by the Contractor/Subcontractor, the Contractor/Subcontractor’s notice to VA shall identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the VA information or assets were placed at risk or compromised), and any other information that the Contractor/Subcontractor considers relevant.

c. With respect to unsecured protected health information, the business associate is deemed to have discovered a data breach when the business associate knew or should have known of a breach of such information. Upon discovery, the business associate must notify the covered entity of the breach. Notifications need to be made in accordance with the executed business associate agreement.

d. In instances of theft or break-in or other criminal activity, the Contractor/Subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG and Security and Law Enforcement. The Contractor, its employees, and its Subcontractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The Contractor/Subcontractor shall cooperate with VA in any civil litigation to recover VA information, obtain monetary or other compensation from a third party for damages arising from any incident, or obtain injunctive relief against any third party arising from, or related to, the incident.

B.7 LIQUIDATED DAMAGES FOR DATA BREACH

a. Consistent with the requirements of 38 U.S.C. §5725, a contract may require access to sensitive personal information. If so, the Contractor is liable to VA for liquidated damages in the event of a data breach or privacy incident involving any SPI the Contractor/Subcontractor processes or maintains under this contract. However, it is the policy of VA to forgo collection of liquidated damages in the event the Contractor provides payment of actual damages in an amount determined to be adequate by the agency.

b. The Contractor/Subcontractor shall provide notice to VA of a “security incident” as set forth in the Security Incident Investigation section above. Upon such notification, VA must secure from a non-Department entity or the VA Office of Inspector General an independent risk analysis of the data breach to determine the level of risk associated with the data breach for the potential misuse of any sensitive personal information involved in the data breach. The term 'data breach' means the loss, theft, or other unauthorized access, or any access other than that incidental to the scope of employment, to data containing sensitive personal information, in electronic or printed form, that results in the potential compromise of the confidentiality or integrity of the data. Contractor shall fully cooperate with the entity performing the risk analysis. Failure to cooperate may be deemed a material breach and grounds for contract termination.

c. Each risk analysis shall address all relevant information concerning the data breach, including the following:

1) Nature of the event (loss, theft, unauthorized access);

2) Description of the event, including:

(a) date of occurrence;

(b) data elements involved, including any PII, such as full name, social security number, date of birth, home address, account number, disability code;

3) Number of individuals affected or potentially affected;

4) Names of individuals or groups affected or potentially affected;

5) Ease of logical data access to the lost, stolen or improperly accessed data in light of the degree of protection for the data, e.g., unencrypted, plain text;

6) Amount of time the data has been out of VA control;

7) The likelihood that the sensitive personal information will or has been compromised (made accessible to and usable by unauthorized persons);

8) Known misuses of data containing sensitive personal information, if any;

9) Assessment of the potential harm to the affected individuals;

10) Data breach analysis as outlined in 6500.2 Handbook, Management of Breaches Involving Sensitive Personal Information, as appropriate; and

11) Whether credit protection services may assist record subjects in avoiding or mitigating the results of identity theft based on the sensitive personal information that may have been compromised.

d. Based on the determinations of the independent risk analysis, the Contractor shall be responsible for paying to VA liquidated damages in the amount of $37.50 per affected individual to cover the cost of providing credit protection services to affected individuals consisting of the following:

1) Notification;

2) One year of credit monitoring services consisting of automatic daily monitoring of at least 3 relevant credit bureau reports;

3) Data breach analysis;

4) Fraud resolution services, including writing dispute letters, initiating fraud alerts and credit freezes, to assist affected individuals to bring matters to resolution;

5) One year of identity theft insurance with $20,000.00 coverage at $0 deductible; and

6) Necessary legal expenses the subjects may incur to repair falsified or damaged credit records, histories, or financial affairs.

B.8 SECURITY CONTROLS COMPLIANCE TESTING

N/A

B.9 TRAINING

a. All Contractor employees and Subcontractor employees requiring access to VA information and VA information systems shall complete the following before being granted access to VA information and its systems:

1) Sign and acknowledge (either manually or electronically) understanding of and responsibilities for compliance with the VA Information Security Rules of Behavior, relating to access to VA information and information systems;

2) Successfully complete the VA Privacy and Information Security Awareness and Rules of Behavior course (TMS #10176) and complete this required privacy and information security training annually;

3) Successfully complete any additional cyber security or privacy training, as required for VA personnel with equivalent information system access [to be defined by the VA program official and provided to the CO for inclusion in the solicitation document – e.g., any role-based information security training required in accordance with NIST Special Publication 800-16, Information Technology Security Training Requirements.]

b. The Contractor shall provide to the contracting officer and/or the COR a copy of the training certificates and certification of signing the Contractor Rules of Behavior for each applicable employee within 2 days of the initiation of the contract and annually thereafter, as required.

c. Failure to complete the mandatory annual training and electronically sign the Rules of Behavior annually, within the timeframe required, is grounds for suspension or termination of all physical or electronic access privileges and removal from work on the contract until such time as the training and documents are complete.

image1.jpeg