Product Description Momentum Enterprise Suite_RFI.docx

PRODUCT DESCRIPTION (PD)

DEPARTMENT OF VETERANS AFFAIRS

Office of Information & Technology Financial Management Business Transformation

Momentum® Enterprise Suite

Date: November 27, 2024

VA-25-00026319

PD Version Number: 1.0

Contents

PRODUCT REQUIREMENTS

The Department of Veterans Affairs (VA) has implemented the Momentum® Enterprise Suite including Momentum Financials and Momentum Acquisitions, known as iFAMS. iFAMS is the core solution for the VA’s Financial Management and Business Transformation program. The solution is deployed in the VA Enterprise Cloud in Microsoft Azure.

Momentum® Enterprise Suite of Products Description

The Momentum Enterprise Suite provides solutions for effective management of federal organizations, ranging from programmatic offices to large agencies. The suite includes solutions for financial management, acquisitions management, asset management, and travel management capabilities. While severable, these solutions are fully integrated with each other and fully support integration into the agency’s enterprise.

Momentum Financials

The Momentum Financials products provide comprehensive federal financial management capabilities, including support for the core federal financial requirements as defined by the General Service Administration’s Federal Integrated Business Framework (FIBF) and the Office of Management and Budget (OMB). The following modules are included in Momentum Financials:

Momentum Reports Portal. Provides a single report distribution and management portal to streamline reporting for Momentum users while enforcing stringent security permissions based on report content. Reports can be automatically published and displayed in an easy-to-use tree structure. Users can subscribe to reports of interest and can be notified via email when reports are available.

The following additional modules are available and provide related, supplemental financial and/or administrative functions required by some agencies. Licensed users of these additional modules must also have a license for Momentum Financials. Additionally, a license for these additional modules is required for any use of the module including but not limited to actions such as view, create, modify, process, add, change, and delete.

Momentum Contract Management

The Momentum Contract Management module provides the ability to effectively manage the Federal procurement cycle, especially large contract buys. This module’s solicitation facilities provide procurement professionals with the ability to create announcements (e.g., pre-solicitation notices), post notices to beta.sam.gov, generate vendor lists, create and amend solicitation documents (including standard federal forms, attachments and knowledge-based incorporation of FAR or agency-specific clauses/provisions). This module’s offer evaluation capabilities include features to compare vendor pricing offers, define best-value evaluation criteria with weighting and scoring, distribute evaluations to technical evaluation team members, receive input from evaluators on technical criteria, evaluate cost and technical factors, and make an award decision. It also includes access to Momentum’s Comment Attachment Review Tool (CART) to distribute selected documents to Momentum and non-Momentum users for their review and comment. The issuance of contract orders and awards is facilitated by the modules capabilities to create and modify order and award documents (including standard federal forms, attachments and knowledge-based incorporation of FAR or agency-specific clauses/provisions), verify buyer authority, process Federal Procurement Data System – Next Generation (FPDS-NG) reports, create announcements (e.g., award notices), and post award notices to beta.sam.gov. In addition, the module allows procurement officials to perform vendor performance evaluations through features to define performance evaluation criteria with weighting and scoring, distribute evaluations to evaluation team members, and capture performance appraisals from evaluators. This module is fully integrated with the requisition, invoicing, and payment capabilities included in the Purchasing and Accounts Payable modules.

Momentum Fixed Assets

The Momentum Fixed Assets module provides the ability to account for fixed assets and other controlled property. This Fixed Assets module includes the ability to record the acquisition, betterment, sale/disposition, transfer, and depreciation of fixed assets. This module also tracks the custodian(s) of each fixed asset or controlled property item.

Momentum Project Cost Accounting

The Momentum Project Cost Accounting module accumulates the costs and revenue associated with projects. A project may be an internal project (for management information only) or it may be funded by an external agreement with the public or with another federal agency. This module accounts for advances received, for costs and overhead applied, and for revenue recognition and billing on a number of bases (cost basis, fixed price basis, etc.).

Momentum Travel Accounting

The Momentum Travel Accounting module supports the tracking of and accounting for travel orders, advances, and vouchers related to local travel, TDY assignments, and permanent change of station. In addition, this module provides for travel-related payments to vendors and credit card companies as well as expense reimbursements for travelers.

Momentum Budget Execution

The Momentum Budget Execution and Momentum Budget Execution Plus products monitor and control all accounting related to the execution of an agency’s budget. This module includes the ability to establish spending limits and exercise funds control as appropriate; post to the general ledger to reflect budgetary events; and account for revenue and reimbursements. Momentum Budget Execution supports up to eight hierarchical levels of spending control, plus additional detailed spending control specifications called “limitations.” The module also provides the ability to reprogram budget authority, identify recoveries and adjustments, and withdraw funding at yearend.

The following module provides agencies with enterprise application integration capabilities to tie Momentum into an agency’s applications and operate an effective e-Government enterprise:

Momentum Enterprise Integration Frameworks. This item consists of software that effectively integrates Momentum into the enterprise and creates an effective e-Government solution. The Enterprise Integration Frameworks provide an agency with the tools required to 1) integrate Momentum with the agency’s existing applications and 2) implement an effective B2B solution. The enterprise application integration components provide an out of the box solution for integrating Momentum with administrative applications offered by other vendors and tools for integrating with the agency’s custom applications. In addition, the B2B integration components provide an agency with the ability to utilize EDI, XML, and other avenues to carryout business with external organizations. The Momentum Enterprise Integration Framework provides a robust mechanism for integrating the Momentum suite with other applications – including legacy systems, programmatic systems, and modules from other COTS vendors. The framework provides adapters to the Momentum modules as well as most relational databases, flat files, and other COTS products. The Momentum Enterprise Integrations Frameworks license provides for integrations within Momentum systems and with Momentum systems and other applications only. Integrations between systems that are not part of Momentum are not allowed. A number of integrations are provided within the base Momentum suite solutions. These include integrations within the Momentum solutions as well as with critical Federal applications. For these integrations, a separate license for Momentum Enterprise Integration Frameworks is not needed. For a complete list of the Integrations supported within the base Momentum Financials or Acquisitions licenses, please see the current release documentation. Upon purchase of CGI Federal’s Momentum Enterprise Integration Framework software license, the client will have access to third party products embedded and/or included in the software. The list of third-party products embedded and/or included in the software can be found in the applicable Momentum end user license agreement.

Momentum Contracting Apps

Momentum Contracting Apps is a suite of federal acquisition focused applications that can be used in conjunction with your existing contract writing system to extend and bolster your agencies procurement functions. Built specifically for the federal contracting environment Momentum Contracting Apps is uniquely positioned to meet your agency’s needs.

Momentum Acquisitions

Momentum Acquisitions is a web-based, multi-user application that support the procurement professional through all phases of the acquisition process, from planning through requisition, solicitation, award, contract management, and close-out. The following acquisition management system capabilities are included in Momentum Acquisitions Plus:

Momentum Contract Management. This module provides the ability to effectively manage the Federal procurement cycle, especially large contract buys. This module’s solicitation facilities provide procurement professionals with the ability to create announcements (e.g., pre-solicitation notices), post notices to beta.sam.gov, generate vendor lists, create and amend solicitation documents (including standard federal forms, attachments and knowledge-based incorporation of FAR or agency-specific clauses/provisions). This module’s offer evaluation capabilities include features to compare vendor pricing offers, define best-value evaluation criteria with weighting and scoring, distribute evaluations to technical evaluation team members, receive input from evaluators on technical criteria, evaluate cost and technical factors, and make an award decision. It also includes access to Momentum’s Comment Attachment Review Tool (CART) to distribute selected documents to Momentum and non-Momentum users for their review and comment. The issuance of contract orders and awards is facilitated by the modules capabilities to create and modify order and award documents (including standard federal forms, attachments and knowledge-based incorporation of FAR or agency-specific clauses/provisions), verify buyer authority, process Federal Procurement Data System – Next Generation (FPDS-NG) reports, create announcements (e.g., award notices), and post award notices to beta.sam.gov. In addition, the module allows procurement officials to perform vendor performance evaluations through features to define performance evaluation criteria with weighting and scoring, distribute evaluations to evaluation team members, and capture performance appraisals from evaluators. This module is fully integrated with the requisition, invoicing, and payment capabilities included in the Purchasing and Accounts Payable modules.

Momentum Planning. This module supports flexible, multi-level user-defined operating plans with plan versus actual tracking by month, quarter and year. Separate from the Budget Execution module, Planning provides an independent funds control capability that enables agencies to control spending against plans that are independent of the formal budget.

Momentum Purchasing. This module supports the full chain of spending transactions from pre-commitment through receipt. The ability to “back-reference” preceding transactions facilitates the carry-forward of accounting detail and enforces the liquidation of prior account balances as appropriate. This module includes extended descriptive information about each item and associates the related accounting information to the itemized goods or services.

Momentum Accounts Payable. This module records payable amounts resulting from liquidated obligations, scheduling payments according to the Prompt Pay Act. In addition, this subsystem provides all other payment-related transactions such as advances issued and liquidated, contract holdbacks (resulting in an expense but no disbursement), vendor credits and discounts applied, and recording of Prompt Pay Act interest paid and penalties applied.

Momentum Workflow. This module provides workflow capabilities including comprehensive rules-based routing, approvals, and event handling. The advanced workflow capabilities allow any activity to be tracked and pro-actively managed throughout the Momentum application suite. In addition to standard transaction routing, events can be triggered based on delays in transaction processing, rejection of approvals, and periods of inactivity against open items such as unpaid invoices or uncollected receivables.

Note on Licensing for Clients with Momentum Financials:

VA requires a license for Momentum Acquisitions or Momentum Acquisitions Plus.

Momentum Reports Portal. Provides a single report distribution and management portal to streamline reporting for Momentum users while enforcing stringent security permissions based on report content. Reports can be automatically published and displayed in an easy-to-use tree structure. Users can subscribe to reports of interest and can be notified via email when reports are available.

Momentum Business Insights

Momentum Business Insights provides comprehensive business intelligence and enterprise performance management capabilities across the agencies entire data set. The set of solutions utilizes Big Data platforms to provide engaging visualizations and discovery tools built for real time and predictive analytics using multiple data sets; or the solutions may be scaled to work on a single system. These solutions are configured for use with Momentum Financials, Momentum Acquisitions, and Momentum Performance Budgeting products to provide true out of the box, integrated capabilities. Upon purchase of CGI Federal’s Momentum Business Insights software license, the client will have access to third party products embedded and/or included in the software. The list of third-party products embedded and/or included in the software can be found in the applicable Momentum end user license agreement.

Momentum Performance Budgeting

Momentum Performance Budgeting operates in web-based environments and perform the functions that support the budget preparation and management for the agency. The Performance Budgeting module provides the building blocks for agency preparation of all phases of the budget. Actual results from current and prior years can be used as the basis for out-year estimates, and final budgets can be used to establish initial values for the Budget Execution module of Momentum Financials. The following budget preparation and management capabilities are included in Momentum Performance:

· Enables annual operating, working-capital, and multi-year capital budget preparation

· Provides salary and benefits forecasting

· Supports multiple budget roll-up perspectives and levels (i.e., by program, organization, etc.)

· Allows users to track historical budget information

· Includes user-defined flexible on-line budget forms

· Includes user-defined chart of account elements

· Supports “what if” analysis

· Includes standard reports

· Supports agency-defined performance-based budgeting consistent with GPRA

The following additional modules are available and provide related, supplemental performance management and/or budgeting functions required by some agencies:

Momentum Performance Budgeting—Budget Book Publishing Option. Budget Book Publishing is an add-on component to Momentum Performance Budgeting to allow automated budget publication. The specific capabilities include the following:

· Rapid in-house budget document and exhibits publication

· One set of information sources to multiple outputs including print, web, CD

· Flexible formatting capability for tables, images, multi-column text, and pages

· Connects to various data sources and databases Upon purchase of CGI Federal’s Momentum Performance Budgeting – Budget Book Publishing Option software license, the client will have access to third party products embedded and/or included in the software. The list of third-party products embedded and/or included in the software can be found in the applicable Momentum end user license agreement.

Momentum SAM Connector

The Momentum System for Award Management (SAM) Connector is a web-based, multi-user application that enables the customer to select appropriate SAM vendors and automatically integrate the vendors into designated agency application(s). The Momentum SAM Connector solution includes:

· A staging database for the bulk transfer of the initial vendor data (and any periodic vendor additions, removal/deletions or updates) from the SAM database into the customer’s environment.

· A web-based interface that will enable users to select vendors, which are appropriate for the customer, in order to automatically transfer, via a seamless integration process, the relevant data elements in parallel and populate the designated target agency applications.

The following system capabilities are included in Momentum SAM Connector:

· Momentum SAM Staging Database—allows agencies to store and manage SAM records before they are uploaded into the specific agency applications.

· Momentum SAM Transformation Agent—enables agencies to load vendor data from SAM and specify which SAM vendors are to be transferred from the Momentum SAM Staging Database to the agency target applications.

· Momentum SAM Publishing Agent—enables agencies to transform a file containing SAM records that have been selected for use from the Momentum SAM Staging Database for publication to agency target applications.

· Momentum SAM Subscribing Agent—enables agencies to automatically update target agency applications with published SAM records. CGI Federal provides Subscribing Agents for each of the CGI Federal Product Suites (Momentum Financials, and Momentum Acquisitions).

· Momentum System Administration—provides supporting tools for the Momentum SAM Connector process (e.g., configuration of information security controls).

Momentum SAM Connector is licensed in increments of two (2) CPUs for production usage. The minimum purchase level is two (2) CPUs. A predefined number of CPUs will be included for development, test, and continuity of operations environments.

Momentum Vendor Self Service

Momentum Vendor Self Service is a web-based, multi-user application that supports online interaction and business information exchange between a buying organization and the vendor community via a web site. This includes such functions as solicitation posting, vendor solicitation responses, award and order posting, invoice submission, payment status posting, and vendor performance evaluation information exchange. Momentum Vendor Self Service can be implemented as a seamless component of CGI Federal’s product suite. Alternatively, with the purchase of Momentum Enterprise Integration Frameworks, Momentum Vendor Self Service can be implemented as a web platform for vendor interaction that can interact directly with non-CGI Federal external systems to exchange business data and process interdependent transactions. The following system capabilities are included in Momentum Vendor Self Service:

· Solicitation Posting—posts solicitations and solicitation amendments for vendor access.

· Vendor Solicitation Responses—enables vendors to enter responses to a solicitation (e.g., price and proposal information) and submit their responses to the buying organization.

· Award and Order Posting—posts award and order information, including modifications, to winning vendors.

· Invoice Submission—enables vendors to submit invoices to the buying organization.

· Payment Status Posting—presents payment status information to vendors.

· Vendor Performance Evaluation—enables the buying organization to post performance evaluation information for review by the vendor being evaluated. This capability also enables the vendor to submit self-evaluations of their performance to the buying organization.

· System Administration—provides supporting tools for the vendor self-service process (e.g., configuration of information security controls).

Momentum Vendor Self Service is licensed in increments of two (2) CPUs for production usage. The minimum purchase level is two (2) CPUs. A predefined number of CPUs will be included for development, test, and continuity of operations environments.

Momentum Integration Adaptor

This module contains the logic for the integration between Momentum Financials/Acquisitions and other COTS vendor applications.

PRODUCT IDENTIFICATION

The Contractor shall provide the following:

Performance Budgeting - Budget Book Publishing / Maintenance

Momentum Integration Adapter: (800-1000 Users) / Subscription

NOTICE OF THE FEDERAL ACCESSIBILITY LAW AFFECTING ALL INFORMATION AND COMMUNICATION TECHNOLOGY (ICT) PROCUREMENTS (SECTION 508)

On January 18, 2017, the Architectural and Transportation Barriers Compliance Board (Access Board) revised and updated, in a single rulemaking, standards for electronic and information technology developed, procured, maintained, or used by Federal agencies covered by Section 508 of the Rehabilitation Act of 1973, as well as our guidelines for telecommunications equipment and customer premises equipment covered by Section 255 of the Communications Act of 1934. The revisions and updates to the Section 508-based standards and Section 255-based guidelines are intended to ensure that information and communication technology (ICT) covered by the respective statutes is accessible to and usable by individuals with disabilities.

SECTION 508 – INFORMATION AND COMMUNICATION TECHNOLOGY (ICT) STANDARDS

The Section 508 standards established by the Access Board are incorporated into, and made part of all VA orders, solicitations and purchase orders developed to procure ICT. These standards are found in their entirety at: https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines. A printed copy of the standards will be supplied upon request.

Federal agencies must comply with the updated Section 508 Standards beginning on January 18, 2018. The Final Rule as published in the Federal Register is available from the Access Board: https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule.

The Contractor shall comply with “508 Chapter 2: Scoping Requirements” for all electronic ICT and content delivered under this contract. Specifically, as appropriate for the technology and its functionality, the Contractor shall comply with the technical standards marked here:

1.5 COMPATABILITY WITH ASSISTIVE TECHNOLOGY

The standards do not require installation of specific accessibility-related software or attachment of an assistive technology device. Section 508 requires that ICT be compatible with such software and devices so that ICT can be accessible to and usable by individuals using assistive technology, including but not limited to screen readers, screen magnifiers, and speech recognition software.

ACCEPTANCE AND ACCEPTANCE TESTING

Deliverables resulting from this solicitation will be accepted based in part on satisfaction of the Section 508 Chapter 2: Scoping Requirements standards identified above.

The Government reserves the right to test for Section 508 Compliance before delivery. The Contractor shall be able to demonstrate Section 508 Compliance upon delivery.

INFORMATION TECHNOLOGY USING ENERGY-EFFICIENT PRODUCTS

The Contractor shall comply with Sections 524 and Sections 525 of the Energy Independence and Security Act of 2007; Section 104 of the Energy Policy Act of 2005; Executive Order 13834, “Efficient Federal Operations”, dated May 17, 2018; Executive Order 13221, “Energy-Efficient Standby Power Devices,” dated August 2, 2001; and the Federal Acquisition Regulation (FAR) to provide ENERGY STAR®, Federal Energy Management Program (FEMP) designated, low standby power, and Electronic Product Environmental Assessment Tool (EPEAT) registered products in providing information technology products and/or services.

EPEAT

EPEAT product compliance is not required in this acquisition.

ENERGY STAR

Energy Star compliance is not required in this acquisition.

FEMP

FEMP or FEMP low standby power product compliance is not required in this acquisition.

Electronic Shipment of Software

Inspection: Destination Acceptance: Destination Free on Board (FOB): Destination

Ship To and Mark For:

Primary

Alternate

Address:

Address:

Voice:

Voice:

Email:

Email:

GENERAL REQUIREMENTS

VA TECHNICAL REFERENCE MODEL

The Contractor shall support the VA enterprise management framework. In association with the framework, the Contractor shall comply with OIT Technical Reference Model (VA TRM). The VA TRM is one component within the overall Enterprise Architecture (EA) that establishes a common vocabulary and structure for describing the information technology used to develop, operate, and maintain enterprise applications. Moreover, the VA TRM, which includes the Standards Profile and Product List, serves as a technology roadmap and tool for supporting OIT. Architecture & Engineering Services (AES) has overall responsibility for the VA TRM.

SOCIAL SECURITY NUMBER (SSN) REDUCTION

The Contractor solution shall support the Social Security Number (SSN) Fraud Prevention Act (FPA) of 2017 which prohibits the inclusion of SSNs on any document sent by mail. The Contractor support shall also be performed in accordance with Section 240 of the Consolidated Appropriations Act (CAA) 2018, enacted March 23, 2018, which mandates VA to discontinue using SSNs to identify individuals in all VA information systems as the Primary Identifier. The Contractor shall ensure that any new IT solution discontinues the use of SSN as the Primary Identifier to replace the SSN with the Integrated Control Number (ICN) in all VA information systems for all individuals. The Contractor shall ensure that all Contractor delivered applications and systems integrate with the VA Master Person Index (MPI) for identity traits to include the use of the ICN as the Primary Identifier. The Contractor solution may only use a Social Security Number to identify an individual in an information system if and only if the use of such number is required to obtain information VA requires from an information system that is not under the jurisdiction of VA.

INTERNET PROTOCOL VERSION 6 (IPV6)

The Contractor solution shall support Internet Protocol Version 6 (IPv6) based upon the memo issued by the Office of Management and Budget (OMB) on November 19, 2020 (https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-07.pdf). IPv6 technology, in accordance with the USGv6 Program (https://www.nist.gov/programs-projects/usgv6-program/usgv6-revision-1), NIST Special Publication (SP) 500-267B Revision 1 “USGv6 Profile” (https://doi.org/10.6028/NIST.SP.500-267Br1), and NIST SP 800-119 “Guidelines for the Secure Deployment of IPv6” (https://doi.org/10.6028/NIST.SP.800-119), compliance shall be included in all IT infrastructures, application designs, application development, operational systems and sub-systems, and their integration. In addition to the above requirements, all devices shall support native IPv6 and dual stack (IPv6 / IPv4) connectivity without additional memory or other resources being provided by the Government, so that they can function in a mixed environment. All public/external facing servers and services (e.g. web, email, DNS, ISP services, etc.) shall support native IPv6 and dual stack (IPv6 / IPv4) users and all internal infrastructure and applications shall communicate using native IPv6 and dual stack (IPv6 / IPv4) operations.

SOFTWARE AND LICENSING REQUIREMENTS

The Contractor shall be responsible for the provision of all software licenses and any associated licensing maintenance required for any development, delivery, integration, operation, and/or maintenance associated with its proposed application(s), software products, software solution, and/or system including, but not limited to, any and all application(s), software and/or software products that comprise, are a part of, or integrate with the Contractor’s proposed application(s), software products, software solution, and/or system for the life of any resulting contract.

POINTS OF CONTACT

VA Program Manager:

Name: TBD Address:

Voice:

Email:

Contracting Officer’s Representative:

Name: TBD Address:

Voice:

Email:

Contracting Officer:

Name: kendra Casebolt Address:

Contract Specialist:

Name: Angel Santos Address:

Momentum® Enterprise Suite TAC Number: VA-25-00026319

ADDENDUM B – VA INFORMATION AND INFORMATION SYSTEM SECURITY/PRIVACY LANGUAGE

APPLICABLE PARAGRAPHS TAILORED FROM: THE VA INFORMATION AND INFORMATION SYSTEM SECURITY/PRIVACY LANGUAGE, VA HANDBOOK 6500.6, APPENDIX C, MARCH 12, 2010

GENERAL

Contractors, Contractor personnel, Subcontractors, and Subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security.

ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS

a. A Contractor/Subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, Subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order.

b. All Contractors, Subcontractors, and third-party servicers and associates working with VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for Contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures.

c. Contract personnel who require access to national security programs must have a valid security clearance. National Industrial Security Program (NISP) was established by Executive Order 12829 to ensure that cleared U.S. defense industry contract personnel safeguard the classified information in their possession while performing work on contracts, programs, bids, or research and development efforts. The Department of Veterans Affairs does not have a Memorandum of Agreement with Defense Security Service (DSS). Verification of a Security Clearance must be processed through the Special Security Officer located in the Planning and National Security Service within the Office of Operations, Security, and Preparedness.

d. Custom software development and outsourced operations must be located in the U.S. to the maximum extent practical. If such services are proposed to be performed abroad and are not disallowed by other VA policy or mandates (e.g. Business Associate Agreement, Section 3G), the Contractor/Subcontractor must state where all non-U.S. services are provided and detail a security plan, deemed to be acceptable by VA, specifically to address mitigation of the resulting problems of communication, control, data protection, and so forth. Location within the U.S. may be an evaluation factor.

e. The Contractor or Subcontractor must notify the CO immediately when an employee working on a VA system or with access to VA information is reassigned or leaves the Contractor or Subcontractor’s employ. The CO must also be notified immediately by the Contractor or Subcontractor prior to an unfriendly termination.

VA INFORMATION CUSTODIAL LANGUAGE

1. Information made available to the Contractor or Subcontractor by VA for the performance or administration of this contract or information developed by the Contractor/Subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of VA. This clause expressly limits the Contractor/Subcontractor's rights to use data as described in Rights in Data - General, FAR 52.227-14(d) (1).

2. VA information should not be co-mingled, if possible, with any other data on the Contractors/Subcontractor’s information systems or media storage systems in order to ensure VA requirements related to data protection and media sanitization can be met. If co-mingling must be allowed to meet the requirements of the business need, the Contractor must ensure that VA information is returned to VA or destroyed in accordance with VA’s sanitization requirements. VA reserves the right to conduct on site inspections of Contractor and Subcontractor IT resources to ensure data security controls, separation of data and job duties, and destruction/media sanitization procedures are in compliance with VA directive requirements.

3. Prior to termination or completion of this contract, Contractor/Subcontractor must not destroy information received from VA, or gathered/created by the Contractor in the course of performing this contract without prior written approval by VA. Any data destruction done on behalf of VA by a Contractor/Subcontractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self-certification by the Contractor that the data destruction requirements above have been met must be sent to the VA CO within 30 days of termination of the contract.

4. The Contractor/Subcontractor must receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with the terms of the contract and applicable Federal and VA information confidentiality and security laws, regulations and policies. If Federal or VA information confidentiality and security laws, regulations and policies become applicable to VA information or information systems after execution of the contract, or if NIST issues or updates applicable FIPS or Special Publications (SP) after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations and policies in this contract.

5. The Contractor/Subcontractor shall not make copies of VA information except as authorized and necessary to perform the terms of the agreement or to preserve electronic information stored on Contractor/Subcontractor electronic storage media for restoration in case any electronic equipment or data used by the Contractor/Subcontractor needs to be restored to an operating state. If copies are made for restoration purposes, after the restoration is complete, the copies must be appropriately destroyed.

6. If VA determines that the Contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the Contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12.

7. If a VHA contract is terminated for cause, the associated Business Associate Agreement (BAA) must also be terminated and appropriate actions taken in accordance with VHA Directive 1605.05, Business Associate Agreements. Absent an agreement to use or disclose protected health information, there is no business associate relationship.

8. The Contractor/Subcontractor must store, transport, or transmit VA sensitive information in an encrypted form, using VA-approved encryption tools that are, at a minimum, FIPS 140-2 validated.

9. The Contractor/Subcontractor’s firewall and Web services security controls, if applicable, shall meet or exceed VA minimum requirements. VA Configuration Guidelines are available upon request.

10. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the Contractor/Subcontractor may use and disclose VA information only in two other situations: (i) in response to a qualifying order of a court of competent jurisdiction, or (ii) with VA prior written approval. The Contractor/Subcontractor must refer all requests for, demands for production of, or inquiries about, VA information and information systems to the VA CO for response.

11. Notwithstanding the provision above, the Contractor/Subcontractor shall not release VA records protected by Title 38 U.S.C. 5705, confidentiality of medical quality assurance records and/or Title 38 U.S.C. 7332, confidentiality of certain health records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse, or infection with human immunodeficiency virus. If the Contractor/Subcontractor is in receipt of a court order or other requests for the above mentioned information, that Contractor/Subcontractor shall immediately refer such court orders or other requests to the VA CO for response.

12. For service that involves the storage, generating, transmitting, or exchanging of VA sensitive information but does not require Assessment and Authorization (A&A) or a Memorandum of Understanding-Interconnection Security Agreement (MOU-ISA) for system interconnection, the Contractor/Subcontractor must complete a Contractor Security Control Assessment (CSCA) on a yearly basis and provide it to the COR.

INFORMATION SYSTEM DESIGN AND DEVELOPMENT

1. Information systems that are designed or developed for or on behalf of VA at non-VA facilities shall comply with all VA directives developed in accordance with FISMA, HIPAA, NIST, and related VA security and privacy control requirements for Federal information systems. This includes standards for the protection of electronic PHI, outlined in 45 C.F.R. Part 164, Subpart C, information and system security categorization level designations in accordance with FIPS 199 and FIPS 200 with implementation of all baseline security controls commensurate with the FIPS 199 system security categorization (reference VA Handbook 6500, Risk Management Framework for VA Information Systems – Tier 3: VA Information Security Program, and the TIC Reference Architecture). During the development cycle a Privacy Impact Assessment (PIA) must be completed, provided to the COR, and approved by the VA Privacy Service in accordance with Directive 6508, Implementation of Privacy Threshold Analysis and Privacy Impact Assessment.

2. The Contractor/Subcontractor shall certify to the COR that applications are fully functional and operate correctly as intended on systems using the VA Federal Desktop Core Configuration (FDCC), and the common security configuration guidelines provided by NIST or VA. This includes Internet Explorer 11 configured to operate on Windows 10 and future versions, as required.

3. The standard installation, operation, maintenance, updating, and patching of software shall not alter the configuration settings from the VA approved and FDCC configuration. Information technology staff must also use the Windows Installer Service for installation to the default “program files” directory and silently install and uninstall.

4. Applications designed for normal end users shall run in the standard user context without elevated system administration privileges.

5. The security controls must be designed, developed, approved by VA, and implemented in accordance with the provisions of VA security system development life cycle as outlined in NIST Special Publication 800-37, Guide for Applying the Risk Management Framework to Federal Information Systems, VA Handbook 6500, Risk Management Framework for VA Information Systems – Tier 3: VA Information Security Program and VA Handbook 6500.5, Incorporating Security and Privacy in System Development Lifecycle.

6. The Contractor/Subcontractor is required to design, develop, or operate a System of Records Notice (SOR) on individuals to accomplish an agency function subject to the Privacy Act of 1974, (as amended), Public Law 93-579, December 31, 1974 (5 U.S.C. 552a) and applicable agency regulations. Violation of the Privacy Act may involve the imposition of criminal and civil penalties.

7. The Contractor/Subcontractor agrees to:

a. Comply with the Privacy Act of 1974 (the Act) and the agency rules and regulations issued under the Act in the design, development, or operation of any system of records on individuals to accomplish an agency function when the contract specifically identifies:

i. The Systems of Records (SOR); and

ii. The design, development, or operation work that the Contractor/Subcontractor is to perform;

b. Include the Privacy Act notification contained in this contract in every solicitation and resulting subcontract and in every subcontract awarded without a solicitation, when the work statement in the proposed subcontract requires the redesign, development, or operation of a SOR on individuals that is subject to the Privacy Act; and

c. Include this Privacy Act clause, including this subparagraph (c), in all subcontracts awarded under this contract which requires the design, development, or operation of such a SOR.

8. In the event of violations of the Act, a civil action may be brought against the agency involved when the violation concerns the design, development, or operation of a SOR on individuals to accomplish an agency function, and criminal penalties may be imposed upon the officers or employees of the agency when the violation concerns the operation of a SOR on individuals to accomplish an agency function. For purposes of the Act, when the contract is for the operation of a SOR on individuals to accomplish an agency function, the Contractor/Subcontractor is considered to be an employee of the agency.

a. “Operation of a System of Records” means performance of any of the activities associated with maintaining the SOR, including the collection, use, maintenance, and dissemination of records.

b. “Record” means any item, collection, or grouping of information about an individual that is maintained by an agency, including, but not…