PWS VHA Website and Digital Communications Support draft for RFI.docx

VHA Website and Digital Communications Support

VA-24-00061742

TRANSFORMATION TWENTY-ONE TOTAL TECHNOLOGY NEXT GENERATION (T4NG)

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Office of Information & Technology Veteran Health Administration Office of Digital Media

VHA Website and Digital Communications Support

Date: May 08, 2024 VA-24-00061742Task Order PWS Version Number: 1.0

Contents

BACKGROUND

The mission of the Department of Veterans Affairs (VA), Office of Information & Technology (OI&T) is to provide benefits and services to Veterans of the United States. In meeting these goals, OI&T strives to provide high quality, effective, and efficient Information Technology (IT) services to those responsible for providing care to the Veterans at the point-of-care as well as throughout all the points of the Veterans’ health care in an effective, timely and compassionate manner. VA depends on Information Management/Information Technology (IM/IT) systems to meet mission goals. Some of those objectives include:

· Increasing the accessibility, reliability, and security of Veterans’ digital services,

· Reducing the time it takes for Veterans to find, use and receive VA services, and

· Delivering higher-quality health care and faster, more accurate benefits decisions by increasing VA staff access to the right information, in the right format, at the right time.

The Veterans Health Administration (VHA) Office of Digital Media is responsible for the web presence of VHA in partnership with VA OI&T Enterprise Web Infrastructure Support (EWIS), VA OI&T Enterprise Applications Support (EAS), and VA OI&T Office of the Chief Technology Officer (OCTO) who have responsibility for the overall coordination and support for all of VHA’s national internet websites and intranet web presence. VHA Digital Media is specifically responsible for the national oversight and support of program office websites within VHA Central Office (VHACO), all VA Medical Center (VAMC) Internet websites, all Veterans Integrated Services Networks (VISN) Internet websites, and all research-related Internet websites. Additionally, VHA Digital Media provides content, oversight, and support of all VHA social media outlets, including Facebook, Twitter, Instagram, YouTube and Flickr. VHA Digital Media responsibilities include:

1.) Principal oversight and primary jurisdiction of all VHA websites (internet/intranet) nationwide.

2.) Advisement of web content development and management for field VISNs, VAMCs and VHA Central Office (VHACO) Program Offices.

3.) Development and implementation of policies and strategies that maximize the effectiveness of online communication across VHA, aligned with the digital.gov and United States Wed Design System (USWDS) best practices.

4.) Website review and analysis to ensure web content is Veteran-focused, relevant and accurate.

5.) Designing templates, standards and policies that ensure effective web design, usability, and ease of use.

6.) Coordinating VHA branding for websites and social media.

7.) Ensuring all VHA websites are in compliance with VA and VHA Directives and Handbooks regarding website design and development, including compliance with and enforcement of Section 508 of the Rehabilitation Act of 1973, as amended.

8.) Development, management, implementation and training for updates to standard web design elements, including templates, across all VHA websites.

9.) Website approvals for new, transfers, changes in technology, and significant website redesigns.

10.) Participation in committees, task forces, workgroups, etc. concerning the development of standards, policies, and procedures for the VA web presence.

11.) Ongoing field-based educational initiatives and training events.

12.) Creation of web-based systems to enhance healthcare.

13.) Creating web content that follows the U.S. Web Design System and digitalgov.gov standards, conforming to all applicable HIPAA (Health Insurance Portability and Accountability Act) requirements, where required.

14.) Direct content creation and support for specific VHA program office websites.

APPLICABLE DOCUMENTS AND OTHER RESOURCES

The Contractor shall comply with the following documents and be familiar with these critical resources, in addition to the documents in Paragraph 2.0 in the T4NG Basic Performance Work Statement (PWS), in the performance of this effort:

1. “Veteran Focused Integration Process (VIP) Guide 4.0”, March 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

2. VA Directive 6102 Internet/Intranet Services

3. VA Directive 6515, Use of Web-Based Collaboration Techniques

4. VA’s Web Governance Framework (entire site): https://digital.va.gov/web-governance/

5. VA.gov Design System: A System to help you write, design, and build digital services on VA.gov (entire site), https://design.va.gov/

6. VA Platform Developer docs: TeamSite Overview, https://depo-platform-documentation.scrollhelp.site/developer-docs/teamsite-overview

7. VA.gov Drupal Content Management System (decoupled) Documentation, https://github.com/department-of-veterans-affairs/va.gov-cms

8. M-24-08 Strengthening Digital Accessibility and the Management of Section 508 of the Rehabilitation Act, https://www.whitehouse.gov/omb/management/ofcio/m-24-08-strengthening-digital-accessibility-and-the-management-of-section-508-of-the-rehabilitation-act/

9. WordPress VIP Documentation – https://docs.wpvip.com/

10. VA Tier 1 Graphics Standards: Foundation for Brand Maintenance and Evolution, Version 1.0, August 2012 (PDF, attached)

11. H.R.5759 – 21st Century Integrated Digital Experience (IDEA) Act, https://www.congress.gov/bill/115th-congress/house-bill/5759/text

SCOPE OF WORK

The Contractor shall provide sustainment including online technical support, troubleshooting, design, coding, mockups, testing, review of sustainment fixes, content management, documentation, and training for VHA websites.

APPLICABILITY

This Task Order (TO) effort PWS is within the scope of paragraph(s) 4.2.6 (Web Application Design and Development) of the T4NG Basic PWS.

ORDER TYPE

The effort shall be proposed on a Firm Fixed Price (FFP) basis.

PERFORMANCE DETAILS

PERFORMANCE PERIOD

The PoP shall be one 12-month base period with four 12-month option periods. There is also one 30-day optional task for transition support.

PLACE OF PERFORMANCE

Efforts under this TO shall be performed at Contractor facilities. The Contractor shall identify the Contractor’s place of performance in their Task Execution Plan submission.

TRAVEL OR SPECIAL REQUIREMENTS

The Government does not anticipate travel to perform the tasks associated with the effort.

CONTRACT MANAGEMENT

All requirements of Sections 7.0 and 8.0 of the T4NG Basic PWS apply to this effort. This TO shall be addressed in the Contractor’s Progress, Status and Management Report as set forth in the T4NG Basic contract.

GOVERNMENT FURNISHED PROPERTY

The Government has multiple remote access solutions available to include Citrix Access Gateway (CAG), Site-to-Site Virtual Private Network (VPN), and RESCUE VPN. Contractor will be provided access via one or more of these remote access solutions. The Contractor is solely responsible for obtaining Internet access needed to perform the work required by this performance work statement.

The Government’s issuance of Government Furnished Equipment (GFE) is limited to Contractor personnel requiring direct access to the network, with the following purposes: use of development environments; install, configure and run Technical Reference Model (TRM) approved software and tools (e.g., Oracle, Fortify, Eclipse, SoapUI, WebLogic, LoadRunner); upload/download/ manipulate code, run scripts, and apply patches; configure and change system settings; check logs, troubleshoot/debug, assist with Section 508 remediation efforts, and test/QA.

The Government will furnish laptops, for use by the Contractor to access VA networks, systems, or applications to meet the requirements of this PWS. The overarching goal is to determine the most cost-effective approach to providing needed access to the VA environment coupled with the need to ensure proper Change Management principles are followed. Contractor personnel shall adhere to all VA system access requirements for on-site and remote users in accordance with VA standards, local security regulations, policies and rules of behavior. GFE shall be approved by the COR and Program Manager on a case-by-case basis prior to issuance.

Based upon the Government assessment of remote access solutions and requirements of this TO, the Government estimates that the following GFE will be required by this TO:

1. Two (2) laptops

The Government will not provide IT accessories including but not limited to Mobile Wi-Fi hotspots/wireless access points, additional or specialized keyboards or mice, laptop bags, extra charging cables, extra Personal Identity Verification card readers, peripheral devices, or additional Random Access Memory (RAM). The Contractor is responsible for providing these types of IT accessories in support of the TO as necessary and any VA installation required for these IT accessories shall be coordinated with the COR.

The Status of Government Furnished Equipment Report under the T4NG Basic Contract requirements is applicable to this TO and shall be delivered to the COR/VA PM as required.

SECURITY AND PRIVACY

All requirements in Section 6.0 of the T4NG Basic PWS apply to this effort. All requirements in Section 6.0 of the T4NG Basic PWS apply. Addendum B requirements have been tailored to reflect the security and privacy requirements of this specific TO.

POSITION/TASK RISK DESIGNATION LEVEL(S)

In accordance with VA Handbook 0710, Personnel Security and Suitability Program, the position sensitivity and the level of background investigation commensurate with the required level of access for the following tasks within the PWS are:

Position Sensitivity and Background Investigation Requirements by Task

The Tasks identified above and the resulting Position Sensitivity and Background Investigation requirements identify, in effect, the Background Investigation requirements for Contractor individuals, based upon the tasks the particular Contractor individual will be working. The submitted Contractor Staff Roster must indicate the required Background Investigation Level for each Contractor individual based upon the tasks the Contractor individual will be working, in accordance with their submitted proposal.

SPECIFIC TASKS AND DELIVERABLES

The Contractor shall perform the following:

PROJECT MANAGEMENT

CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, timeline and tools to be used in execution of this TO effort. The CPMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks and resource support. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPMP shall be concurred upon and updated in accordance with Section B Price Schedule of the TO. The Contractor shall update and maintain the VA Program Manager (PM) approved CPMP throughout the PoP. The Contractor shall provide as part of the CPMP the Transition Plan that shall be used during the Optional Task for Transition Support (see section 5.1.1).

Deliverable:

A. Contractor Project Management Plan

REPORTING REQUIREMENTS

The Contractor shall present project objectives and status weekly, both orally and in writing via detailed Weekly Progress Reports, to the VA Project Manager for briefing during weekly conference calls and on an as needed basis. The Contractor shall provide the report in the format of Attachment 0002 and report shall address progress for the week ending. Remote conferencing technologies or virtual meeting spaces (Microsoft Teams, WebEx, etc.) will be used in lieu of telephonic conference calls provided they are accessible by VA employees and meet reporting expectations. The VHA Digital Media Director and VA Project Manager will review project status on a continuous basis and provide feedback as required. Final deliverable dates for each project will be determined by the scope of the project and priority as determined by the Director of Digital Media and/or the VA Project Manager. Final deliverables shall be provided to the COR and reviewed for completeness.

Deliverable:

A. Weekly Progress Report

TECHNICAL KICKOFF MEETING

A technical kickoff meeting shall be held within 10 days after TO award. The Contractor shall coordinate the date, time, and location (can be virtual) with the Contracting Officer (CO), as the Post-Award Conference Chairperson, the VA PM, as the Co-Chairperson, the Contract Specialist (CS), and the COR. The Contractor shall provide a draft agenda to the CO and VA PM at least five (5) calendar days prior to the meeting. Upon Government approval of a final agenda, the Contractor shall distribute to all meeting attendees. During the kickoff-meeting, the Contractor shall present, for review and approval by the Government, the details of the intended approach, work plan, and project schedule for each effort via a Microsoft Office PowerPoint presentation. At the conclusion of the meeting, the Contractor shall update the presentation with a final slide entitled “Summary Report” which shall include notes on any major issues, agreements, or disagreements discussed during the kickoff meeting. The Contractor shall submit the final updated presentation to the CO for review and signature within three (3) calendar days after the meeting. The Contractor shall also work with the CS, the Government’s designated note taker, to prepare and distribute the meeting minutes of the kickoff meeting to the CO, COR and all attendees within three (3) calendar days after the meeting. The Contractor shall obtain concurrence from the CS on the content of the meeting minutes prior to distribution of the document.

WEBSITE AND SOCIAL MEDIA SUPPORT

VA VHA Digital Media uses multiple enterpirse content management systems (ECMS) to manage the content on VHA’s 92,000+ web pages across approximately (~) 300 websites. VHA Digital Media is responsible for the ongoing development, enhancement, maintenance, support, review and oversight of all web presences of VHA. The current inventory of websites includes: 172VA Medical Centers (VAMCs) maintained in VA’s Drupal enterprise content management system, 18 Veterans Integrated Services Networks (VISNs) websites maintained in VA’s WordPress enterprise content management system, ~100 program office, and ~36 research websites maintained within VA’s TeamSite enterprise content management system as well as 2-3 websites that are maintained outside VA’s ECMS and utilize custom coding including HyperText Markup Language (HTML), ColdFusion, Active Server Pages (ASP), ASP.NET, jQuery, GraphQL, NextJS, Metalsmith & Liquid templates, React, and Ruby. These websites vary in complexity, size and function based on the requirements of the individual subject matter experts responsible for the content of the website. Approximately 6% of sites consist of only 5-10 simple pages (ex: https://www.sci.va.gov), 92% of sites consist of 40-50+ pages (https://www.va.gov/miami-health-care/) with generally basic functionality, and the remaining ~2% of sites consist of 1000+ pages (ex: https://www.research.va.gov).

Websites share files, templates, and widgets with content provided locally by website managers or may access data from databases or APIs that are not supported by VHA Digital Media. VHA Digital Media is also responsible for ad hoc support of some legacy applications, which utilize various coding technologies including ColdFusion, ASP, ASP.NET and some that include a Microsoft SQL Server backend database. For planning purposes, Attachment 0001 provides a listing of the specifics tasks that were completed each month under the previous effort from calendar year October 2022 to October 2023. VA anticipates that tasks of similar effort and complexity will be required throughout the period of performance of this TO.

The Contractor shall provide two Full Time Employee (FTE) resources located in the Metro Washington, DC area to perform the services below.

The Contractor shall perform sustainment of online and web-based applications and websites used by VHA and migration support for websites, including transitional and migration support for these web-based applications and websites from legacy content management platforms to newer content management platforms. Sustainment shall include troubleshooting of any issues with the website/applications and resolution of them including design/coding, mockups, testing unique to the issue, bug, or defect being addressed, to ensure functionality, or pushing a file to production, reviewing website/application fixes to ensure they are correct, content management, documentation, training, and assistance in addressing Section 508 accessibility defects for VHA’s web-based applications and websites.

The Contractor shall collaborate with other VA IT organizations (i.e. VHA Digital Media office, OI&T Enterprise Web Infrastructure Support {EWIS} office, OI&T Enterprise Applications Support {EAS} Enterprise Content Management Office, and Office of the Chief Technology Officer (OCTO)) to resolve digital media related issues only that cannot be fully resolved by OI&T, EWIS, or OCTO personnel. As such, contractor may be expected to utilize ticketing systems (Jira, ServiceNow, and similar) to manage and complete end user requests for VHA owned and operated content only. As each website content management system (TeamSite, Drupal, and WordPress) uses a different ticketing approach and issue management system, the contractor is expected to traverse these platforms for assistance resolving trouble issues, bug fixes, and coding problems, unique to each of the three content management systems in use at VA, as these incidents are reported by VHA website editors. The Contractor shall perform these tasks utilizing industry standards in combination with VA and VHA web policy and procedures. The Contractor shall perform and manage all tasks in compliance with CMMI Level 3 principles, and the VA EAS/EWIS Configuration Management (CM) processes, which both require utilizing a VA-approved CM tool. VA will provide the Contractor with website/application issues that need to be resolved, including the appropriate administrative access to these systems in cooporation with VHA’s strategic digital partners throughout VA.

The Contractor shall use Enterprise Content Management System (OpenText Teamsite) version 21.4.2.0.0 and newer, Drupal 10.2.2 Content Managagment System and newer, and WordPress VIP Content Management System, and newer, as well as the modifications to each made specifically for VA to maintain the websites. The Contractor shall work within the constraints of VHA’s Teamsite, Drupal, and WordPress systems and utilizing platform specific content management formats, templates, code, widgets, applications, and forms developed by VA EAS, VA OI&T, and VA OCTO for use by VA/VHA. The Contractor shall also use applications that are VA approved and in the OneVA TRM. The Contractor shall perform these tasks utilizing industry standards in combination with VA and VHA web policy and procedures.

The Contractor shall complete 6-10 special projects annually which require working with various web-based platforms and applications which require the use various coding technologies such as HTML, ASP, XML, javascript, jQuery, Extensible Stylesheet Language Transformations (XSLT), GraphQL, NextJS, Metalsmith & Liquid templates, React, Ruby, and/or other similar technologies, as assigned by VHA Digital Media. Examples of these projects include: developing dashboards with API interfaces, website content migration, retirement of legacy systems, strategy and plan for reducing VHA’s massive intranet footprint, developing HTML newsletters, support addressing VA Chief Information Officer (CIO) priority projects and initiatives, and communications and outreach.

Additionally, contractor shall provide remediation support for public facing, website hosted PDF documents and websites that have been identified as having one or more accessibility defects. As such, contractor shall utlilize OI&T procured tools such as CommonLook Office and CommonLook PDF to identify, address, and validate Section 508 accessibilty conformance against the minimally passing criteria of WCAG 2.0, level AA, or higher if a new minimally accepted accessibility standard is adopted at the VA-enterprise level. Contractor shall also be proficient in understanding how to read, interpret, and address complex accessibility issues both in visual display and coding languages. Multiple accessibility scanning tools are made available throughout VA.

The Contractor shall perform the following tasks daily:

a. Develop in coordination with the Digital Media Office new websites or repurpose existing websites as requested by the content managers, including the collection of requirements, development of mockups and prototypes, design and coding (open source and reuse), technical, Section 508 accessibility, usability testing and implementation. Websites range in complexity and may include integrated web applications, APIs, templates, and use a variety of modern coding languages and techniques unique to any of the 3 primary web content management systems in use at VA: TeamSite, WordPress, and Drupal. VHA Digital Media expects to support the development of a maximum of 2 new websites per year (utilizing any of the 3 primary web content management systems alongside minor custom coding using ASP, XML, javascript, jQuery, GraphQL, NextJS, Metalsmith & Liquid Templates, React, Ruby, Bricks, and/or other similar technologies), and plans redesign/modification support to approximately 300 existing websites per year, with 10-15 requiring additional development support utilizing custom coding at a minimal to moderate level of complexity.

b. Develop and/or update website internet/intranet templates, including Teamsite, WordPress, or Drupal presentation templates and forms (utilizing Teamsite, WordPress, Drupal alongside minor custom coding using ASP, XML, javascript, jQuery GraphQL, NextJS, Metalsmith & Liquid Templates, React, Ruby, Bricks, and/or other similar technologies), that are applied to all 300+ VHA websites, including modifications required to allow VHA websites to properly adjust to a variety of mobile/tablet devices (responsive design), modifications to increase standardization of similar websites such as VA Medical Centers, and modifications that reduce the effort required to maintain websites by field personnel across the nation. Tasks shall include creating new Teamsite, WordPress, and Drupal forms/templates that allow a common presentation of services options at VA Medical Centers and modifying existing Teamsite, WordPress, and Drupal templates/forms and corresponding cascading style sheets (CSS) to utilize HTML 5/CSS3 media queries and other responsive design techniques.

c. Provide supporting documentation, in the form of concise briefing guides and/or tutorials for any new or updated templates, custom coding, applications, and/or Teamsite, WordPress, or Drupal forms developed.

d. Provide ad-hoc bug fix support (utilizing Teamsite, WordPress, Drupal alongside minor custom coding using ASP, XML, javascript, jQuery, GraphQL, NextJS, Metalsmith & Liquid Templates, React, Ruby, Bricks, and/or other similar technologies) as needed.

e. Provide ad hoc support for minor updates to a variety of websites (utilizing Teamsite, WordPress, Drupal alongside minor custom coding using ASP, XML, javascript, jQuery, Extensible Stylesheet Language Transformations (XSLT), GraphQL, NextJS, Metalsmith & Liquid templates, React, Ruby, and/or other similar technologies). Updates expected would include tasks such as hyperlink changes, style modifications, copy/paste content, improve formatting, modifying CSS, moving pages and uploading images and/or documents as well as remediating section 508 issues.

f. Integrate social media technologies and government APIs, web services and datasets into new and/or existing VHA websites as requested by content managers’ or at the direction of the VHA Digital Media Office.

g. Participate in discussions with content managers and the VHA Digital Media office regarding requirements for new websites/applications and/or modifications to existing sites/applications.

h. Sustain web-based reporting tools to support VHA Digital Media Office oversight responsibilities.

i. Provide intake and triage support for VHA-centric trouble issues/tickets reported through any of the VA approved ticketing/customer management portals as they pertain to end user reported issues for VHA websites only, using TeamSite, WordPress, or Drupal content management systems. Examples of these tasks include but are not limited to the following: assistance with the creation of new user administrative accounts, accessibility fixes, troubleshooting file/video uploads, and limited one-on-one end user support. VHA Digital Media shall maintain discretion of which issues should be prioritized and resolved by the contractor, and those which must be resolved collaboratively with other OI&T, EWIS, OCTO, or VA entities.

The Contractor shall provide status of the special projects and all tasks listed above in the Weekly Progress Report.

Deliverable:

A. Concise Briefing Guides and/or Tutorials

OPTIONAL TASK - TRANSITION SUPPORT

If this Optional Task is exercised by VA, the Contractor shall assist the Government in implementing a complete transition, in accordance with the CPMP Transition Plan (see 5.1.1), from this contract to a new support provider. The new support provider may be a Government entity or another Contractor or the incumbent Contractor under a new task order. The Contractor shall complete this optional task no later than 30 days from date of exercise of this task. Transition shall include:

a. Coordination with Government staff and successor staff and management.

b. Review, evaluation, and transition of current support services.

c. Transfer of all artifacts delivered under this contract, as well as existing policies and procedures, and delivery of baseline metrics and statistics.

d. Transition of historic data in VA repository accounts.

e. Transition of system accounts.

f. Transfer of hardware and software warranties, code developed, maintenance agreements, and licenses.

g. Transfer of all necessary business and/or technical documentation.

h. Orientation phase and program to introduce Government and Contractor personnel, programs, and users to the Contractor's team, tools, methodologies, and business processes.

i. Turn-in of all Government keys, GFE, ID/access cards, and security codes.

j. All assets associated with the project, including all software assets, specification of support environments, tools; software licenses, warranties, and maintenance agreements; documentation, and any other assets that must be maintained throughout the asset lifecycle.

GENERAL REQUIREMENTS

PERFORMANCE METRICS

The table below defines the Performance Standards and Acceptable Levels of Performance associated with this effort.

2. Efficient and effective in meeting requirements

3. Meets technical needs and mission requirements

4. Provides quality services/products Satisfactory or higher

2. Products completed, reviewed, delivered in accordance with the established schedule

3. Notifies customer in advance of potential problems Satisfactory or higher

2. Personnel possess necessary knowledge, skills and abilities to perform tasks

Satisfactory or higher

The COR will utilize a Quality Assurance Surveillance Plan (QASP) throughout the life of the TO to ensure that the Contractor is performing the services required by this PWS in an acceptable level of performance. The Government reserves the right to alter or change the QASP at its own discretion. A Performance Based Service Assessment will be used by the COR in accordance with the QASP to assess Contractor performance.

SECTION 508 – INFORMATION AND COMMUNICATION TECHNOLOGY (ICT) STANDARDS

On January 18, 2017, the Architectural and Transportation Barriers Compliance Board (Access Board) revised and updated, in a single rulemaking, standards for electronic and information technology developed, procured, maintained, or used by Federal agencies covered by Section 508 of the Rehabilitation Act of 1973, as well as our guidelines for telecommunications equipment and customer premises equipment covered by Section 255 of the Communications Act of 1934. The revisions and updates to the Section 508-based standards and Section 255-based guidelines are intended to ensure that information and communication technology (ICT) covered by the respective .statutes is accessible to and usable by individuals with disabilities.

The following Section 508 Requirements supersede Addendum A, Section A3 from the T4NG Basic PWS.

The Section 508 standards established by the Access Board are incorporated into, and made part of all VA orders, solicitations and purchase orders developed to procure ICT. These standards are found in their entirety at: https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines. A printed copy of the standards will be supplied upon request.

Federal agencies must comply with the updated Section 508 Standards beginning on January 18, 2018. The Final Rule as published in the Federal Register is available from the Access Board: https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule.

The Contractor shall comply with “508 Chapter 2: Scoping Requirements” for all electronic ICT and content delivered under this contract. Specifically, as appropriate for the technology and its functionality, the Contractor shall comply with the technical standards marked here:

COMPATIBILITY WITH ASSISTIVE TECHNOLOGY

The standards do not require installation of specific accessibility-related software or attachment of an assistive technology device. Section 508 requires that ICT be compatible with such software and devices so that ICT can be accessible to and usable by individuals using assistive technology, including but not limited to screen readers, screen magnifiers, and speech recognition software.

ACCEPTANCE AND ACCEPTANCE TESTING

Deliverables resulting from this solicitation will be accepted based in part on satisfaction of the Section 508 Chapter 2: Scoping Requirements standards identified above.

The Government reserves the right to test for Section 508 Compliance before delivery. The Contractor shall be able to demonstrate Section 508 Compliance upon delivery.

SHIPMENT OF HARDWARE OR EQUIPMENT

Not applicable.

ENTERPRISE AND IT FRAMEWORK

ATTACHMENT 0001 – SAMPLE TASKS

The attachment below provides examples of the kinds of tasks that the Contactor will perform or accomplish during this task order.

ATTACHMENT 0002 – SAMPLE WEEKLY PROGRESS REPORT FORMAT

Below is a sample Weekly Progress Report format, which provides weekly tracking of projects or tasks being performed on this task order. This format has worked well for VHA. The Contractor can use this or another format, if preferred.

ATTACHMENT 0003 – va tier 1 graphics standards

The attachment below provides current branding requirements at the VA-enterprise level.

ADDENDUM B – VA INFORMATION AND INFORMATION SYSTEM SECURITY/PRIVACY LANGUAGE

APPLICABLE PARAGRAPHS TAILORED FROM: THE VA INFORMATION AND INFORMATION SYSTEM SECURITY/PRIVACY LANGUAGE, VA HANDBOOK 6500.6, APPENDIX C, MARCH 12, 2010

GENERAL

Contractors, Contractor personnel, Subcontractors, and Subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security.

ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS

a. A Contractor/Subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, Subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order.

b. All Contractors, Subcontractors, and third-party servicers and associates working with VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for Contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures.

c. Contract personnel who require access to national security programs must have a valid security clearance. National Industrial Security Program (NISP) was established by Executive Order 12829 to ensure that cleared U.S. defense industry contract personnel safeguard the classified information in their possession while performing work on contracts, programs, bids, or research and development efforts. The Department of Veterans Affairs does not have a Memorandum of Agreement with Defense Security Service (DSS). Verification of a Security Clearance must be processed through the Special Security Officer located in the Planning and National Security Service within the Office of Operations, Security, and Preparedness.

d. Custom software development and outsourced operations must be located in the U.S. to the maximum extent practical. If such services are proposed to be performed abroad and are not disallowed by other VA policy or mandates (e.g. Business Associate Agreement, Section 3G), the Contractor/Subcontractor must state where all non-U.S. services are provided and detail a security plan, deemed to be acceptable by VA, specifically to address mitigation of the resulting problems of communication, control, data protection, and so forth. Location within the U.S. may be an evaluation factor.

e. The Contractor or Subcontractor must notify the CO immediately when an employee working on a VA system or with access to VA information is reassigned or leaves the Contractor or Subcontractor’s employ. The CO must also be notified immediately by the Contractor or Subcontractor prior to an unfriendly termination.

VA INFORMATION CUSTODIAL LANGUAGE

1. Information made available to the Contractor or Subcontractor by VA for the performance or administration of this contract or information developed by the Contractor/Subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of VA. This clause expressly limits the Contractor/Subcontractor's rights to use data as described in Rights in Data - General, FAR 52.227-14(d) (1).

2. VA information should not be co-mingled, if possible, with any other data on the Contractors/Subcontractor’s information systems or media storage systems in order to ensure VA requirements related to data protection and media sanitization can be met. If co-mingling must be allowed to meet the requirements of the business need, the Contractor must ensure that VA information is returned to VA or destroyed in accordance with VA’s sanitization requirements. VA reserves the right to conduct on site inspections of Contractor and Subcontractor IT resources to ensure data security controls, separation of data and job duties, and destruction/media sanitization procedures are in compliance with VA directive requirements.

3. Prior to termination or completion of this contract, Contractor/Subcontractor must not destroy information received from VA, or gathered/created by the Contractor in the course of performing this contract without prior written approval by VA. Any data destruction done on behalf of VA by a Contractor/Subcontractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self-certification by the Contractor that the data destruction requirements above have been met must be sent to the VA CO within 30 days of termination of the contract.

4. The Contractor/Subcontractor must receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with the terms of the contract and applicable Federal and VA information confidentiality and security laws, regulations and policies. If Federal or VA information confidentiality and security laws, regulations and policies become applicable to VA information or information systems after execution of the contract, or if NIST issues or updates applicable FIPS or Special Publications (SP) after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations and policies in this contract.

5. The Contractor/Subcontractor shall not make copies of VA information except as authorized and necessary to perform the terms of the agreement or to preserve electronic information stored on Contractor/Subcontractor electronic storage media for restoration in case any electronic equipment or data used by the Contractor/Subcontractor needs to be restored to an operating state. If copies are made for restoration purposes, after the restoration is complete, the copies must be appropriately destroyed.

6. If VA determines that the Contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the Contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12.

7. If a VHA contract is terminated for cause, the associated Business Associate Agreement (BAA) must also be terminated and appropriate actions taken in accordance with VHA Handbook 1600.05, Business Associate Agreements. Absent an agreement to use or disclose protected health information, there is no business associate relationship.

8. The Contractor/Subcontractor must store, transport, or transmit VA sensitive information in an encrypted form, using VA-approved encryption tools that are, at a minimum, FIPS 140-2 validated.

9. The Contractor/Subcontractor’s firewall and Web services security controls, if applicable, shall meet or exceed VA minimum requirements. VA Configuration Guidelines are available upon request.

10. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the Contractor/Subcontractor may use and disclose VA information only in two other situations: (i) in response to a qualifying order of a court of competent jurisdiction, or (ii) with VA prior written approval. The Contractor/Subcontractor must refer all requests for, demands for production of, or inquiries about, VA information and information systems to the VA CO for response.

11. Notwithstanding the provision above, the Contractor/Subcontractor shall not release VA records protected by Title 38 U.S.C. 5705, confidentiality of medical quality assurance records and/or Title 38 U.S.C. 7332, confidentiality of certain health records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse, or infection with human immunodeficiency virus. If the Contractor/Subcontractor is in receipt of a court order or other requests for the above mentioned information, that Contractor/Subcontractor shall immediately refer such court orders or other requests to the VA CO for response.

12. For service that involves the storage, generating, transmitting, or exchanging of VA sensitive information but does not require Assessment and Authorization (A&A) or a Memorandum of Understanding-Interconnection Security Agreement (MOU-ISA) for system interconnection, the Contractor/Subcontractor must complete a Contractor Security Control Assessment (CSCA) on a yearly basis and provide it to the COR.

INFORMATION SYSTEM DESIGN AND DEVELOPMENT

INFORMATION SYSTEM HOSTING, OPERATION, MAINTENANCE, OR USE

SECURITY INCIDENT INVESTIGATION

a. The term “security incident” means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. The Contractor/Subcontractor shall immediately notify the COR and simultaneously, the designated ISO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the Contractor/Subcontractor has access.

b. To the extent known by the Contractor/Subcontractor, the Contractor/Subcontractor’s notice to VA shall identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the VA information or assets were placed at risk or compromised), and any other information that the Contractor/Subcontractor considers relevant.

c. With respect to unsecured protected health information, the business associate is deemed to have discovered a data breach when the business associate knew or should have known of a breach of such information. Upon discovery, the business associate must notify the covered entity of the breach. Notifications need to be made in accordance with the executed business associate agreement.

d. In instances of theft or break-in or other criminal activity, the Contractor/Subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG and Security and Law Enforcement. The Contractor, its employees, and its Subcontractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The Contractor/Subcontractor shall cooperate with VA in any civil litigation to recover VA information, obtain monetary or other compensation from a third party for damages arising from any incident, or obtain injunctive relief against any third party arising from, or related to, the incident.

LIQUIDATED DAMAGES FOR DATA BREACH

a. Consistent with the requirements of 38 U.S.C. §5725, a contract may require access to sensitive personal information. If so, the Contractor is liable to VA for liquidated damages in the event of a data breach or privacy incident involving any SPI the Contractor/Subcontractor processes or maintains under this contract. However, it is the policy of VA to forgo collection of liquidated damages in the event the Contractor provides payment of actual damages in an amount determined to be adequate by the agency.

b. The Contractor/Subcontractor shall provide notice to VA of a “security incident” as set forth in the Security Incident Investigation section above. Upon such notification, VA must secure from a non-Department entity or the VA Office of Inspector General an independent risk analysis of the data breach to determine the level of risk associated with the data breach for the potential misuse of any sensitive personal information involved in the data breach. The term 'data breach' means the loss, theft, or other unauthorized access, or any access other than that incidental to the scope of employment, to data containing sensitive personal information, in electronic or printed form, that results in the potential compromise of the confidentiality or integrity of the data. Contractor shall fully cooperate with the entity performing the risk analysis. Failure to cooperate may be deemed a material breach and grounds for contract termination.

c. Each risk analysis shall address all relevant information concerning the data breach, including the following:

1) Nature of the event (loss, theft, unauthorized access);

2) Description of the event, including:

a) date of occurrence;

b) data elements involved, including any PII, such as full name, social security number, date of birth, home address, account number, disability code;

3) Number of individuals affected or potentially affected;

4) Names of individuals or groups affected or potentially affected;

5) Ease of logical data access to the lost, stolen or improperly accessed data in light of the degree of protection for the data, e.g., unencrypted, plain text;

6) Amount of time the data has been out of VA control;

7) The likelihood that the sensitive personal information will or has been compromised (made accessible to and usable by unauthorized persons);

8) Known misuses of data containing sensitive personal information, if any;

9) Assessment of the potential harm to the affected individuals;

10) Data breach analysis as outlined in 6500.2 Handbook, Management of Breaches Involving Sensitive Personal Information, as appropriate; and

11) Whether credit protection services may assist record subjects in avoiding or mitigating the results of identity theft based on the sensitive personal information that may have been compromised.

d. Based on the determinations of the independent risk analysis, the Contractor shall be responsible for paying to VA liquidated damages in the amount of $37.50 per affected individual to cover the cost of providing credit protection services to affected individuals consisting of the following:

1) Notification;

2) One year of credit monitoring services consisting of automatic daily monitoring of at least 3 relevant credit bureau reports;

3) Data breach analysis;

4) Fraud resolution services, including writing dispute letters, initiating fraud alerts and credit freezes, to assist affected individuals to bring matters to resolution;

5) One year of identity theft insurance with $20,000.00 coverage at $0 deductible; and

6) Necessary legal expenses the subjects may incur to repair falsified or damaged credit records, histories, or financial affairs.

SECURITY CONTROLS COMPLIANCE TESTING

Not applicable.

TRAINING

a. All Contractor employees and Subcontractor employees requiring access to VA information and VA information systems shall complete the following before being granted access to VA information and its systems:

1) Sign and acknowledge (either manually or electronically) understanding of and responsibilities for compliance with the VA Information Security Rules of Behavior, relating to access to VA information and information systems;

2) Successfully complete the VA Privacy and Information Security Awareness and Rules of Behavior course (TMS 2.0 # VA 10176) and complete this required privacy and information security training annually;

3) Successfully complete any additional cyber security or privacy training, as required for VA personnel with equivalent information system access [to be defined by the VA program official and provided to the CO for inclusion in the solicitation document – e.g., any role-based information security training required in accordance with NIST Special Publication 800-16, Information Technology Security Training Requirements.]

b. The Contractor shall provide to the CO and/or the COR a copy of the training certificates and certification of signing the Contractor Rules of Behavior for each applicable employee within 2 days of the initiation of the contract and annually thereafter, as required.

c. Failure to complete the mandatory annual training and electronically sign the Rules of Behavior annually, within the timeframe required, is grounds for suspension or termination of all physical or electronic access privileges and removal from work on the contract until such time as the training and documents are complete.

CONTRACTOR EMPLOYEE

PERSONAL FINANCIAL INTEREST/PROTECTION OF SENSITIVE…