Edifecs (Brand Name or Equivalent) Software and Maintenance TAC Number: VA-26-00059261

PRODUCT DESCRIPTION (PD) TEMPLATE

DEPARTMENT OF VETERANS AFFAIRS

Office of Information & Technology (OIT) Community Care Product Line

Edifecs (Brand Name or Equivalent) Software and Maintenance

Date: 04/28/2026

VA-26-00059261

PD Version Number: 1.2

Contents

PRODUCT REQUIREMENTS

The Department of Veterans Affairs (VA) Office of Information and Technology (OI&T), and Veteran Health Administration (VHA) Integrated Veteran Care (IVC) requires brand name Edifecs (or equivalent) licenses and associated maintenance to support the introduction of Electronic Data Interchange (EDI) interoperability-driven referral and authorization for healthcare within Community Care in VA. The baseline product shall support all X12-N transactions sets. This product must be capable of meeting Health Insurance Portability and Accountability Act of 1996 (HIPAA) mandate and the HHS Final Rule (CMS-0053-F), published August 10, 2012, in the Federal Register (77 FR 48008); codified at 45 CFR Parts 160 and 162 as well as be prepared to support 91 FR 14350 Administrative Simplification; Adoption of Standards for Health Care Claims Attachments Transactions and Electronic Signatures. This includes the ability to meet Workgroup for Electronic Data Interchange (WEDI) Strategic National Implementation Plan (SNIP) Levels 1-5 out of the box. The product suite shall be configurable and deployable by existing VA development engineering teams executed outside of this order.

The Contractor shall provide all software maintenance services to ensure that the software performs according to its specifications, documentation or demonstrated claims. Such services shall include remedying any software defects and failures, including all new fixes, patches, corrections, releases, updates, versions, and upgrades to the software. Technical support shall include 24x7x365 assistance for the software via telephone, e-mail, and website. Additionally, the Contractor shall provide enterprise-level training programs for operational hand-off to OI&T and Veteran Health Administration (VHA) representatives for on-going use of the product. Training shall consist of 10 sessions, for up to 10 participants per session, delivered virtually in coordination with the product team per year.

The period of performance shall be a base period of 12 months from the date of award, with two 12-month option periods.

Base and Option Period CLINs – Software License and Maintenance

One instance for up to 4,500,000 (4.5M) Members and includes processing for:

· HIPAA X12N, NCPDP, OR 3, OR 4 & 5, attachments transaction types

· 834 transaction types for all Veterans Includes and is limited to the following:

· One hundred (100) Trading Partners

· Fifteen (15) Named Users

· One (1) Production

· Two (2) Non-Production

· One (1) Disaster Recovery

· Transaction Management HIPAA X12N CPT content

· Transaction Management NCPDP content

· Transaction Management Key Features: Trading partner management, Archiving, EDI reporting, Exception management and correction

· XEngine Server® (“XES®”) Key Features: External web services call, Database read/write, X12 translation, AWS connectivity

· Operating Rules 3 Module

· Operating Rules4 & 5 Module

· Attachments Module

· Two (2) instances of XEngine Server Enterprise Manager (“XESM®”)

· XEngine Server Connect (“XEC®”) SpecBuilder® Standard (“SB”)

· Ten (10) Named Users

· The following content included for use with SB: SpecBuilder HIPAA X12N CPT content, SpecBuilder NCPDP content

Any product and/or service being provided as an equivalent alternative to the brand name products/services list above, must meet all of the salient characteristics below, and all responses must provide evidence of such conformance in accordance with FAR 52.211-6 and 52.214-21 both included in Section E of this RFQ.

ITEM 1 SALIENT CHARACTERISTICS

· Out-of-the-box (OOTB) compliance with VA TRM Operating Systems (i.e., RHEL 8.x+)

· OOTB capability of supporting Workgroup for Electronic Data Interchange (WEDI) Strategic National Implementation Plan (SNIP) Levels 1-5

· Workgroup for Electronic Data Interchange (WEDI) Strategic National Implementation Plan (SNIP)

· Including the governance included in X12 Technical Reference Report Type 3 (TR3) documentation from X12.org and external Code Sets

· Including but not limited to Healthcare Code Checking, Financial Balancing of Charges and Payments, Rendering of both the X12 999 and 276/277 or 277CA Clam Status results

· Provides business rules capabilities, allowing WEDI SNIP Levels 6 and 7 to be defined at the trading partner level

· Able to implement upwards of 2,000 Government-defined trading partner rules for any given process without exceeding processing metrics (around 1 M transactions daily per the below table of transaction counts)

· OOTB capability of implementing Council for Affordable Quality Healthcare (CAQH) Committee on Operating Rules for Information Exchange (CORE) Payer Operating Rules

· CAQH - Streamlining the Business of Healthcare

· Council for Affordable Quality Healthcare (CAQH) Committee on Operating Rules for Information Exchange (CORE) Payer Operating Rules

· Able to Process (Performance Standard Compliance and extract transfer load (ETL) from source to destination) EDI Transaction Sets for Health Care Payer, ASC X12N Insurance Transaction Sets, and National Council for Prescription Drug Programs (NCPDP) Prescription Claims and Payments Full List of Transactions:

ASC X12 5010 Batch: 274, 275, 277CA, 834, 835, 837, 999 ASC X12 5010 Real Time: 276, 277, 270, 271, 278, 997 NCPDP D.0: B1, B2, RB1, RB2

· FHIR Ready Capability

· Capability to build custom maps for non-standard transactions

· Capable of meeting processing performance sufficient to meet the following transaction counts:

1.0 M Family Members

NCPDP:

· OOTB capability of interfacing via the following protocols:

· Secure File Transfer Protocol (SFTP), File Transfer Protocol Secure (FTPS), Hypertext Transfer Protocol Secure (HTTPS)

· Ability to support multiple Business-to-business (B2B) interconnections with varying security protocols

· Provides method to orchestrate all transaction tasks

· Can support Continuity of Operations (COOP) and Disaster Recovery Plans (DRP) including load-balancing, mirroring, or otherwise real-time distributed fail-over capabilities

· Provides built-in general operational reporting including:

· Lists of hosts, accounts, tasks, and orchestration configuration at-a-glance to track and maintain host and account utilization

· Real-time service endpoint uptime and downtime tracking

· Provides specialized reporting on transaction status and process monitoring capabilities, including alerting of transaction issues and tracing of transaction source, destination, and date/time stamps

· Ability to interface with both SQL and Non-SQL data sets for ETL tasks

· Ability to support and transact over Simple Object Access Protocol (SOAP), Representational State Transfer (REST), or other custom defined web service exchange standards

· Offering cloud or hybrid cloud deployments

· Including support for both AWS GovCloud and Azure MAG cloud deployments

· Able to employ Zero Trust Architecture (ZTA) Principles:

· Can employ VA-centrally controlled role-based access control (RBAC) / attribute-based access control (ABAC) oversight on both end user and service account authentication/authorization in accordance with Entra ID Single Sign-on Internal (SSOi) as a minimum

· All data sets may be encrypted at rest and follow guidelines on encryption throughout

· Ability to support connections through Transport Layer Security (TLS) versions 1.2 and 1.3

· Certified or Capable of being certified for Federal Information Processing Standard Publication (FIPS) 140-2 and 140-3

· Support for certificates encrypted via Security Hash Algorithm 2 (SHA-2)

1.2 SaaS Requirements

(Applicable when Optional Task CLINs 0004, 1004, and/or 2004 are exercised by the Government. See Section 1.2.)

The information system solution selected by the Contractor shall comply with the Federal Information Security Management Act (FISMA). The Contractor shall comply with FedRAMP requirements at the impact level designated by the Data Technology Center (DTC) as mandated by Federal laws and policies, including making available any documentation, physical access, and logical access needed to support this requirement.

The Contractor shall provide a SaaS product as defined by the following criteria: Software as a Service (SaaS) is an application delivery model in which the application is hosted on a cloud infrastructure outside the security boundary of VA and is provided to the Cloud Service Customer (CSC) over the internet. The CSC uses the SaaS offering via a thin-client interface, such as a web-browser or a program interface. The CSC subscribes to the SaaS offering and is only responsible for minor in-app customizations. The Cloud Service Provider (CSP) offering the application is responsible for management of the application, safeguarding of data stored or processed by the application, and all elements of the underlying infrastructure. Additionally, the CSP is responsible for all on-going compliance.

In order to qualify as SaaS for use at VA, and to align with FedRAMP requirements, the hosting for the offering must conform to the NIST 800-145 definition of Cloud Computing and contain the following key characteristics: On-Demand Self-Service; Broad Network Access; Resource Pooling; Rapid Elasticity; and Measured Service.

Following guidance from the Federal CIO, VA will utilize existing JAB ATO or agency ATO issued by another agency as a starting point for FedRAMP requirements. If neither of those exist, VA will sponsor the Cloud Service Provider for a FedRAMP Authorization.

The Contractor shall, where applicable, assist with the VA ATO Process to help achieve agency authorization of the cloud service or migrated application at the impact level required by VA. The Contractor shall comply with FedRAMP requirements surrounding data location within the Continental United States. The Contractor shall complete a FedRAMP System Security Plan (SSP) and supporting documentation including required attachments within 75 calendar days after exercise of the Optional Task CLIN. (If Data Security Categorization is High Impact, this will be due 94 calendar days after exercise.) The Contractor shall work with a VA DTC Subject Matter Expert to develop a specific system boundary diagram including any integration and connectivity components for VA use (VA Implementation Diagram – VAID) within 10 calendar days of exercise. The Contractor shall complete a 3PAO Security Assessment Plan (SAP) within 90 calendar days after exercise (113 days if High Impact). The Contractor shall complete a 3PAO Security Assessment Report (SAR) within 90 calendar days after the SSP is accepted by VA (113 days if High Impact). The Contractor shall work with VA SMEs to test the validity of the Incident Response Plan (IRP) within 30 calendar days of SSP delivery. The Contractor shall afford VA access to all Contractor and CSP facilities, documentation, records, and databases. Successful issuance of a VA ATO will be required before live VA data can be used in the system. The Contractor shall participate in FedRAMP Continuous Monitoring activities and monthly Agency and FedRAMP Sustainment meetings following the granting of a VA ATO. The Contractor shall provide continuous monitoring activities including scans, security artifacts, and monthly POAM reports. The Contractor shall provide a monthly inventory report of VA sites currently utilizing the cloud product post-ATO award.

SaaS Deliverables:

· FedRAMP System Security Plan (SSP) and required Attachments

· VA Implementation Diagram (VAID)

· 3PAO Security Assessment Plan (SAP)

· 3PAO Security Assessment Report (SAR)

· Plan of Action and Milestones Monthly Reports

· Monthly Inventory Report Service Level Requirements

The Contractor shall meet the Service Level Requirements set forth in the following table:

The Contractor shall maintain a ticketing system capable of recording incident severity classification, response timestamp, and resolution timestamp for all reported incidents. Severity classification shall be mutually agreed upon between the Contractor and the VA COR at the time of incident reporting. The Contractor shall notify the VA COR immediately upon identification of a Severity 1 or Severity 2 incident via telephone, followed by written notification within one (1) hour. All severity level performance data shall be included in the monthly Reliability and Availability Reports.

Service Level Deliverables:

· Reliability Report (Monthly)

· Availability Report (Monthly)

· Incident Response Log (Monthly) – documenting all incidents by severity, response time, and resolution time

Continuity of Operations The Contractor shall develop a Continuity of Operations Plan (COOP) that demonstrates the process for the continuous operation of its IT systems. The Contractor's COOP shall be submitted to VA prior to go-live and annually thereafter and shall be incorporated into the contract upon VA approval. The COOP must address: process for continuous operations; system maintenance (scheduled and unscheduled); hardware/software system failures (to include Incident Response Plan); temporary system unavailability; availability performance; and disaster recovery.

When unscheduled downtime occurs for more than one (1) cumulative hour in any given 24-hour period, the Contractor shall conduct a Root Cause Analysis and provide findings and recommended corrective actions to the COR within 10 days of the event. The Contractor shall provide VA with a schedule to resolve any identified issues within two (2) days of completion of the Root Cause Analysis.

The Contractor shall notify VA in writing of any scheduled system or network maintenance at least two (2) weeks in advance. For unscheduled system maintenance, the Contractor shall notify VA via email within one (1) hour of being alerted of an issue.

COOP Deliverables:

· Continuity of Operations Plan (COOP)

· Continuity of Operations Plan (COOP) Report

· Root Cause Analysis

· COOP Integrated Test Plan

1.3 OPTIONAL TASK – SaaS DEPLOYMENT CLINs

The Government reserves the right to exercise the following Optional Task CLINs at its sole discretion in accordance with FAR 52.217-7 or FAR 52.217-9, as applicable. Written notice shall be provided to the Contractor no later than 30 days prior to the desired exercise date. These CLINs are additive to and do not replace the corresponding base software license and maintenance CLINs (0001, 1001, 2001). If exercised, both the base CLIN and the corresponding Optional SaaS CLIN shall be in effect concurrently for the applicable period of performance.

Key Deliverables Upon Exercise of CLIN 0004, 1004, or 2004:

Note to Contracting Officer: The FedRAMP impact level designation for these Optional CLINs must be confirmed by the Data Technology Center (DTC) prior to solicitation release. Placeholder language (<<Insert Impact Level>>) must be updated accordingly before award. Confirm whether FAR 52.217-7 or FAR 52.217-9 is the applicable option authority based on contract structure.

1.4 OPTIONAL TASK – MEMBER TIER EXPANSION CLINs (Section C)

The Government reserves the right to exercise the following Optional Task CLINs at its sole discretion in accordance with FAR 52.217-7. Written notice shall be provided to the Contractor no later than 30 days prior to the desired exercise date. These CLINs are additive to and do not replace the corresponding Section A software license CLINs (0001, 1001, 2001). Member tier expansion CLINs allow the Government to scale the licensed member count above the 4.5M baseline in increments of 1.5M, up to a maximum of 9.0M Members. The Government reserves the right to exercise any combination of tiers independently per period of performance.

Pricing for all Section C CLINs is TBD pending receipt of vendor quotes for incremental member tier pricing from Edifecs/Cotiviti. The Contracting Officer shall obtain and incorporate tier-specific pricing prior to solicitation release and confirm that the tiered expansion structure aligns with the vendor's licensing model prior to award.

Base Period — Member Tier Expansion Options

Option Period 1 — Member Tier Expansion Options

Option Period 2 — Member Tier Expansion Options

Key Deliverables Upon Exercise of Section C CLINs

NOTICE OF THE FEDERAL ACCESSIBILITY LAW AFFECTING ALL INFORMATION AND COMMUNICATION TECHNOLOGY (ICT) PROCUREMENTS (SECTION 508)

On January 18, 2017, the Access Board issued a final rule that updated accessibility requirements covered by Section 508 and refreshed guidelines for telecommunications equipment subject to Section 255 of the Communications Act. The final rule went into effect on January 18, 2018. The revisions and updates to the Section 508-based standards and Section 255-based guidelines are intended to ensure that information and communication technology (ICT) covered by the respective statutes is accessible to and usable by individuals with disabilities.

SECTION 508 – INFORMATION AND COMMUNICATION TECHNOLOGY (ICT) STANDARDS

The Section 508 standards established by the Access Board are incorporated into, and made part of all VA orders, solicitations and purchase orders developed to procure ICT. These standards are found in their entirety at: Revised 508 Standards and 255 Guidelines (access-board.gov). A single PDF file version of the Revised Section 508 Standards and 255 Guidelines will be supplied upon request, or can be obtained from the Access Board website. Federal agencies must comply with the Rehabilitation Act of 1973, as amended.

The Contractor shall comply with “508 Chapter 2: Scoping Requirements” for all electronic ICT and content delivered under this contract. Specifically, as appropriate for the technology and its functionality, the Contractor shall comply with the technical standards marked here:

COMPATABILITY WITH ASSISTIVE TECHNOLOGY

The standards do not require installation of specific accessibility-related software or attachment of an assistive technology device. Section 508 requires that ICT be compatible with such software and devices so that ICT can be accessible to and usable by individuals using assistive technology, including but not limited to screen readers, screen magnifiers, and speech recognition software.

ACCEPTANCE AND ACCEPTANCE TESTING

Deliverables resulting from this solicitation will be accepted based in part on satisfaction of the Section 508 Chapter 2: Scoping Requirements standards identified above.

The Government reserves the right to test for Section 508 Compliance before delivery. The Contractor shall be able to demonstrate Section 508 Compliance upon delivery.

GENERAL REQUIREMENTS

VA TECHNICAL REFERENCE MODEL

The Contractor shall support the VA enterprise management framework. In association with the framework, the Contractor shall comply with OIT Technical Reference Model (VA TRM). The VA TRM is one component within the overall Enterprise Architecture (EA) that establishes a common vocabulary and structure for describing the information technology used to develop, operate, and maintain enterprise applications. Moreover, the VA TRM, which includes the Standards Profile and Product List, serves as a technology roadmap and tool for supporting OIT. Architecture & Engineering Services (AES) has overall responsibility for the VA TRM.

SOCIAL SECURITY NUMBER (SSN) REDUCTION

The Contractor solution shall support the Social Security Number (SSN) Fraud Prevention Act (FPA) of 2017 which prohibits the inclusion of SSNs on any document sent by mail. The Contractor support shall also be performed in accordance with Section 240 of the Consolidated Appropriations Act (CAA) 2018, enacted March 23, 2018, which mandates VA to discontinue using SSNs to identify individuals in all VA information systems as the Primary Identifier. The Contractor shall ensure that any new IT solution discontinues the use of SSN as the Primary Identifier to replace the SSN with the Integrated Control Number (ICN) in all VA information systems for all individuals. The Contractor shall ensure that all Contractor delivered applications and systems integrate with the VA Master Person Index (MPI) for identity traits to include the use of the ICN as the Primary Identifier. The Contractor solution may only use a Social Security Number to identify an individual in an information system if and only if the use of such number is required to obtain information VA requires from an information system that is not under the jurisdiction of VA.

INTERNET PROTOCOL VERSION 6 (IPV6)

The Contractor solution shall support Internet Protocol Version 6 (IPv6) based upon the memo issued by the Office of Management and Budget (OMB) on November 19, 2020 (https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-07.pdf). IPv6 technology, in accordance with the USGv6 Program (https://www.nist.gov/programs-projects/usgv6-program/usgv6-revision-1), NIST Special Publication (SP) 500-267B Revision 1 “USGv6 Profile” (https://doi.org/10.6028/NIST.SP.500-267Br1), and NIST SP 800-119 “Guidelines for the Secure Deployment of IPv6” (https://doi.org/10.6028/NIST.SP.800-119), compliance shall be included in all IT infrastructures, application designs, application development, operational systems and sub-systems, and their integration. In addition to the above requirements, all devices shall support native IPv6 and dual stack (IPv6 / IPv4) connectivity without additional memory or other resources being provided by the Government, so that they can function in a mixed environment. All public/external facing servers and services (e.g., web, email, DNS, ISP services, etc.) shall support native IPv6 and dual stack (IPv6 / IPv4) users and all internal infrastructure and applications shall communicate using native IPv6 and dual stack (IPv6 / IPv4) operations.

INFORMATION TECHNOLOGY USING SUSTAINABLE PRODUCTS

The Contractor shall comply with Sections 524 and Sections 525 of the Energy Independence and Security Act of 2007; Section 104 of the Energy Policy Act of 2005; Executive Order 14148, “Initial Rescissions of Harmful Executive Orders and Actions,” dated January 20, 2025; Executive Order 13221, “Energy-Efficient Standby Power Devices,” dated August 2, 2001; and the Revolutionary Federal Acquisition Regulation (FAR) Overhaul (RFO) to provide ENERGY STAR® certified and Federal Energy Management Program (FEMP) Designated Low Standby Power information technology products, see https://www.energy.gov/femp/search-energy-efficient-products. See http://www.energystar.gov for complete product specifications and updated lists of Energy Star certified products. FEMP low standby power product listing can be found at https://www.energy.gov/femp/low-standby-power-product-list.

The Contractor shall provide products that meet the definition of sustainable products if the products are delivered to the Government; furnished by the Contractor for use by the Government, incorporated into the construction of a public building or public work, or acquired by the Contractor for use in performing services under a Government contract where the cost of the products is a direct cost to a Government contract (versus costs which are normally applied to a contractor's general and administrative expenses or indirect costs).

Specifically, the Contractor shall provide sustainable products under this contract in accordance with RFO 52.223-23 (NOV 2025). The applicable products with their associated certification and/or designation required (e.g. Energy Star, FEMP Low Standby Power) are identified within the product requirements specifications in this PD. The Contractor shall self-certify that its proposed products meet the certification(s) and/or designation(s) specified.

SHIPMENT OF HARDWARE OR EQUIPMENT

(State the acceptance criteria and provide Shipping Address / Mark For requirements. For National Acquisitions, see below.)

Inspection: Destination Acceptance: Destination Free on Board (FOB): Destination

Ship To and Mark For:

Primary

Alternate

Name:

Name:

Address:

Address:

Voice:

Voice:

Email:

Email:

SPECIAL SHIPPING INSTRUCTIONS

Prior to shipping, Contractor shall notify Site POCs, by phone followed by email, of all incoming deliveries including line-by-line details for review of requirements. The Contractor shall not make any changes to the delivery schedule at the request of Site POC.

Contractors shall coordinate deliveries with Site POCs before shipment of <hardware> hardware to ensure sites have adequate storage space.

All shipments, either single or multiple container deliveries, shall bear the VA IFCAP Purchase Order number (if applicable) on external shipping labels and associated manifests or packing lists. In the case of multiple container deliveries, a statement readable near the VA Integrated Funds Distribution, Control Point Activity, Accounting and Procurement (IFCAP) Purchase Order (PO) or Contract number shall indicate total number of containers for the complete shipment (e.g. “Package 1 of 2”), clearly readable on manifests and external shipping labels.

Packing Slips/Labels and Lists shall also include the following:

IFCAP PO # or Contract No.: ____________ (e.g., 166-E11234 (the IFCAP PO number is located in block #20 of the Standard Form, SF 1449)) Project Description: (e.g. Tier I Lifecycle Refresh)

Total number of Containers: Package ___ of ___. (e.g., Package 1 of 3)

NATIONAL ACQUISITIONS

(If this requirement is for a National acquisition, replace paragraphs 4.0 and 4.1 above with the below information, change the text to black and convert the text to “No Spacing” style. (Please note this Master Delivery Schedule may be used for non-National Acquisitions, but must be used for National Acquisitions). In accordance with the IT Asset Management (ITAM) PAL Process ITAM-02.01.01 Notify Logistics of Pending Shipment, for National Acquisitions, the “Master Delivery Schedule” must be completed by the VA Program Manager (PM) (the Government portion as indicated within the Master Delivery Schedule Instructions) as it will become an attachment within the PD.

The PM must also add the contract deliverables specified in the below text to the Schedule for Deliverables table in the “Notes to the Contractor” section below. This Master Delivery Schedule will be updated by the Contractor and provided at delivery. See the Master Delivery Schedule Template within the PAL ITAM Process at http://vaww.oed.wss.va.gov/process/Library/master_delivery_schedule_template.xlsx.

All questions related to these instructions and the Master Delivery Schedule template/process shall be directed to the VA ITAAG and VA ITAAG RILOS distribution list in the Global Address List (GAL). For all equipment buys, ensure that this group is consulted to ensure proper cataloging of equipment early on in the planning stages of the procurement.)

The Contractor shall complete the Master Delivery Schedule in accordance with the Instructions, and shall coordinate with the COR for specifics. The Master Delivery Schedule shall be provided after award and updated prior to and after each delivery timeframe.

Shipment/Delivery Kick-off Meeting

The Contractor shall conduct a Shipment/Delivery Kick-off Meeting with the VA Program Manager (PM), COR, Delivery Date Coordinator, Implementation Manager, and Facility CIOs (or designee) to discuss delivery schedule requirements and facilitate delivery of equipment. This meeting may be held in conjunction with the post award conference or identified technical kickoff meeting, if applicable. The Contractor shall also present the Shipment/Delivery Weekly Progress Report format for review and approval by the Government. This meeting, if held independently, shall be conducted telephonically within ten days after award and shall incorporate any delivery schedule changes to the draft Delivery Schedule identified by the Government.

Shipment/Delivery Weekly Progress Report

The Contractor shall provide a Shipment/Delivery Weekly Progress Report which shall identify the items shipped, the serial number associated with each piece of equipment; the date of each shipment; the status of each shipment, tracking information, and information relative to Government-receipt of the equipment items at each delivery site. In addition, the Shipment/Delivery Weekly Progress Report shall identify any problems and provide a description of how the problems were resolved/addressed. If problems have not been completely resolved, the Contractor shall provide an explanation and status of resolution. Shipment/Delivery Weekly Progress Reports shall be submitted in Microsoft Excel Format and shall clearly identify each serial number of the equipment being delivered with one (1) serial number per cell.

Inspection: Destination Acceptance: Destination Free on Board (FOB): Destination

Packing Slips/Labels and Lists shall also include the following:

IFCAP PO #: ____________ (e.g., 166-E11234 (the IFCAP PO number is located in block #20 of the SF 1449)) Project Description: (e.g. Tier 1 Lifecycle Refresh)

Total number of Containers: Package ___ of ___. (e.g., Package 1 of 3)

Deliverables:

A. Master Delivery Schedule B. Shipment/Delivery Weekly Progress Report

GENERAL REQUIREMENTS

VA TECHNICAL REFERENCE MODEL

The Contractor shall comply with the VA OIT Technical Reference Model (VA TRM). Compliance with the VA TRM is achieved by using only technologies and standards that are listed as approved for use in the VA TRM. The Contractor shall provide all necessary information requested by VA to ensure TRM approval is obtained prior to use on VA’s network.

ZERO TRUST – VA CRITICAL SECURITY CONTROLS

VA has established minimum mandatory security requirements and requires that any network connected software system or service must meet the VA Critical Security Controls as outlined in the VA Memorandum, “VA Security Controls”, https://www.voa.va.gov/DocumentView.aspx?DocumentID=5010. VA Critical Security Controls identify the minimum mandatory requirements that must be implemented across all VA enterprise infrastructure, cloud computing environments, information systems, networks, and specialized devices (medical devices/systems, special-purpose systems, and research scientific computing devices) that process, store, and/or transmit VA data. Effective July 1, 2025, the Contractor shall implement these VA Critical Security Controls, within any network connected software system or service prior to being authorized for use in the VA. This functional requirement is not negotiable, and Plan of Action & Milestones (POAM) will not be accepted in the event these controls cannot be implemented for new systems. Critical Security Controls are intended to increase VA’s security posture and provide security and privacy risk visibility into the VA network and is not a new requirement. The Contractor’s failure to maintain these VA Critical Controls after implementation will result in VA discontinuing the use of the system.

SOCIAL SECURITY NUMBER (SSN) REDUCTION

The Contractor solution shall support the Social Security Number (SSN) Fraud Prevention Act (FPA) of 2017 which prohibits the inclusion of SSNs on any document sent by mail. The Contractor support shall also be performed in accordance with Section 240 of the Consolidated Appropriations Act (CAA) 2018, enacted March 23, 2018, which mandates VA to discontinue using SSNs to identify individuals in all VA information systems as the Primary Identifier. The Contractor shall ensure that any new IT solution discontinues the use of SSN as the Primary Identifier to replace the SSN with the Integrated Control Number (ICN) in all VA information systems for all individuals. The Contractor shall ensure that all Contractor delivered applications and systems integrate with the VA Master Person Index (MPI) for identity traits to include the use of the ICN as the Primary Identifier. The Contractor solution may only use a Social Security Number to identify an individual in an information system if and only if the use of such number is required to obtain information VA requires from an information system that is not under the jurisdiction of VA.

INTERNET PROTOCOL VERSION 6 (IPV6)

The Contractor solution shall support IPv6-Only based upon the memo issued by the Office of Management and Budget (OMB) on November 19, 2020 (https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-07.pdf). Which defines IPv6-only as the state of an operational system or service when IPv4 protocol functions (addressing, packet forwarding) are not in use. The NIST USGv6 profile defines technical requirements for a product to be capable of operating in IPv6-Only environments. IPv6-Only technology, in accordance with the USGv6 Program (https://www.nist.gov/programs-projects/usgv6-program/usgv6-revision-1), NIST Special Publication (SP) 500-267B Revision 1 “USGv6 Profile” (https://doi.org/10.6028/NIST.SP.500-267Br1), and NIST SP 800-119 “Guidelines for the Secure Deployment of IPv6” (https://doi.org/10.6028/NIST.SP.800-119), compliance shall be included in all IT infrastructures, application designs, application development, operational systems and sub-systems, and their integration. In addition to the above requirements, all devices, applications, and systems shall support all applicable functionality on native IPv6-Only as well as dual stack (IPv6 / IPv4) connectivity without additional memory or other resources being provided by the Government, so that they can function in a mixed environment. All public/external facing servers and services (e.g., web, email, DNS, ISP services, etc.) shall support native IPv6-Only and dual stack (IPv6 / IPv4) users and all internal infrastructure and applications shall support using native IPv6-Only and dual stack (IPv6 / IPv4) for all functionality and operations.

SOFTWARE AND LICENSING REQUIREMENTS

The Contractor shall be responsible for the provision of all software licenses and any associated licensing maintenance required for any development, delivery, integration, operation, and/or maintenance associated with its proposed application(s), software products, software solution, and/or system including, but not limited to, any and all application(s), software and/or software products that comprise, are a part of, or integrate with the Contractor’s proposed application(s), software products, software solution, and/or…