RFP 36C10B25R0013 update FINAL.pdf

PAGE 1 OF 1. REQUISITION NO.

2. CONTRACT NO. 3. AWARD/EFFECTIVE DATE 4. ORDER NO. 5. SOLICITATION NUMBER 6. SOLICITATION ISSUE DATE

a. NAME b. TELEPHONE NO. (No Collect Calls) 8. OFFER DUE DATE/LOCAL

TIME

9. ISSUED BY CODE 10. THIS ACQUISITION IS UNRESTRICTED OR SET ASIDE: % FOR:

SMALL BUSINESS

HUBZONE SMALL

BUSINESS

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

WOMEN-OWNED SMALL BUSINESS

(WOSB) ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

EDWOSB

8(A)

NAICS:

SIZE STANDARD:

11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

SEE SCHEDULE

12. DISCOUNT TERMS

13a. THIS CONTRACT IS A

RATED ORDER UNDER

DPAS (15 CFR 700)

13b. RATING

14. METHOD OF SOLICITATION

RFQ IFB RFP

15. DELIVER TO CODE 16. ADMINISTERED BY CODE

17a. CONTRACTOR/OFFEROR CODE FACILITY CODE 18a. PAYMENT WILL BE MADE BY CODE

TELEPHONE NO. UEI: EFT:

PHONE: FAX:

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN OFFER

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK BELOW IS CHECKED

SEE ADDENDUM

19. 20. 21. 22. 23. 24.

ITEM NO. SCHEDULE OF SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

(Use Reverse and/or Attach Additional Sheets as Necessary)

25. ACCOUNTING AND APPROPRIATION DATA 26. TOTAL AWARD AMOUNT (For Govt. Use Only)

27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1, 52.212-4. FAR 52.212-3 AND 52.212-5 ARE ATTACHED. ADDENDA ARE ARE NOT ATTACHED.

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA ARE ARE NOT ATTACHED

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN _______________ 29. AWARD OF CONTRACT: REF. ___________________________________ OFFER COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND DATED ________________________________. YOUR OFFER ON SOLICITATION DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY (BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED SET FORTH HEREIN IS ACCEPTED AS TO ITEMS:

30a. SIGNATURE OF OFFEROR/CONTRACTOR 31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER)

30b. NAME AND TITLE OF SIGNER (TYPE OR PRINT) 30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER (TYPE OR PRINT) 31c. DATE SIGNED

AUTHORIZED FOR LOCAL REPRODUCTION (REV. NOV 2021)

PREVIOUS EDITION IS NOT USABLE Prescribed by GSA - FAR (48 CFR) 53.212

7. FOR SOLICITATION

INFORMATION CALL:

STANDARD FORM 1449

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL PRODUCTS AND COMMERCIAL SERVICES

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 30

36C10B25R0013 03/10/2025

LaShell Garner, Contract Specialist 848-377-5041 03/19/2025

2:00 PM EST

36C10B Department of Veterans Affairs Technology Acquisition Center

23 Christopher Way Eatontown NJ 07724

X 100

X

541511

$34.0M

N/A

X

See Delivery Schedule

36C10B

Department of Veterans Affairs Technology Acquisition Center

36C10A

Technology Acquisition Center Financial Services Center PO Box 149971 Austin TX 78714-8971

See CONTINUATION Page

Mentoring Software (VA-25-00039447)

See CONTINUATION Page

Matthew J. Truex

36C10B25R0013

Table of Contents

SECTION B - CONTINUATION OF SF 1449 BLOCKS

B.1 CONTRACT ADMINISTRATION DATA

B.2 GOVERNING LAW CLAUSE

B.3 SOFTWARE MAINTENANCE AND SOFTWARE TECHNICAL SUPPORT…………5

B.4 PRICE SCHEDULE

B.5 PRODUCT DESCRIPTION…………………………………………………………11

SECTION C - CONTRACT CLAUSES

C.1 52.252-2 CLAUSES INCORPORATED BY REFERENCE (FEB 1998)

C.2 52.203-19 PROHIBITION ON REQUIRING CERTAIN INTERNAL

CONFIDENTIALITY AGREEMENTS OR STATEMENTS (JAN 2017)

C.3 52.212-5 CONTRACT TERMS AND CONDITIONS REQUIRED TO IMPLEMENT

STATUTES OR EXECUTIVE ORDERS—COMMERCIAL PRODUCTS AND COMMERCIAL

SERVICES (JAN 2025)………………………………………………………………………………37

C.4 52.216-1 TYPE OF CONTRACT

(APR1984)………………………………………………………………………………..…..48

C.5 52.217-9 Option to Extend the Term of the Contract (MAR 2000)…………………..48

C.6 VAAR 852.211-76 LIQUIDATED DAMAGES – REIMBURSEMENT FOR DATA

BREACH COSTS (FEB 2023)………………………………………………………………………..48

SECTION D - CONTRACT DOCUMENTS, EXHIBITS, OR ATTACHMENTS

SECTION E - SOLICITATION PROVISIONS

E.1 52.252-1 SOLICITATION PROVISIONS INCORPORATED BY REFERENCE (FEB

1998)

E.2 52.204-24 REPRESENTATION REGARDING CERTAIN TELECOMMUNICATIONS

AND VIDEO SURVEILLANCE SERVICES OR EQUIPMENT (NOV 2021)

E.3 52.209-7 INFORMATION REGARDING RESPONSIBILITY MATTERS (OCT

2018)…………………………………………………………………………………………………….55

E.4 52.212-3 OFFEROR REPRESENTATIONS AND CERTIFICATIONS —

COMMERCIAL PRODUCTS AND COMMERCIAL SERVICES (MAY 2024)

E.5 52.233-2 SERVICE OF PROTEST (SEP 2006)………………………………………88

E.6 BASIS FOR AWARD

E.7 PROPOSAL SUBMISSION INSTRUCTIONS

SECTION B - CONTINUATION OF SF 1449 BLOCKS

B.1 CONTRACT ADMINISTRATION DATA

1. Contract Administration: All contract administration matters will be handled by the following individuals:

a. CONTRACTOR: TBD

b. GOVERNMENT: Contracting Officer 36C10B, Matthew Truex

Technology Acquisition Center

2. CONTRACTOR REMITTANCE ADDRESS: All payments by the Government to the contractor will be made in accordance with:

[X] 52.232-33, Payment by Electronic Funds Transfer—System For Award Management, or

[] 52.232-36, Payment by Third Party

3. INVOICES: Invoices shall be submitted in arrears:

a. Quarterly []

b. Semi-Annually []

c. Other [X] IAW Section B.4 Price Schedule

4. GOVERNMENT INVOICE ADDRESS: All Invoices from the contractor shall be submitted electronically in accordance with VAAR Clause 852.232-72 Electronic Submission of Payment Requests.

https://www.fsc.va.gov/fsc/einvoice.asp

5. GOVERNMENT INVOICE ADDRESS: All Invoices from the contractor shall be submitted electronically in accordance with VAAR Clause 852.232-72 Electronic Submission of Payment Requests.

7. ACKNOWLEDGMENT OF AMENDMENTS: The offeror acknowledges receipt of amendments to the Solicitation numbered and dated as follows:

AMENDMENT NO DATE

https://www.fsc.va.gov/fsc/einvoice.asp

B.2 GOVERNING LAW CLAUSE

Federal law and regulations, including the Federal Acquisition Regulations (FAR), shall govern this Contract/Order. Commercial license agreements may be made a part of this Contract/Order but only if both parties expressly make them an addendum hereto, as permitted by FAR 12.212.

If the commercial license agreement is not made an addendum, it shall not apply, govern, be a part of or have any effect whatsoever on the Contract/Order; this includes, but is not limited to, any agreement embedded in the computer software (clickwrap), any agreement that is otherwise delivered with or provided to the Government with the commercial computer software or documentation (shrinkwrap), or any other license agreement otherwise referred to in any document. If a commercial license agreement is made an addendum, only those provisions addressing data rights regarding the Government’s use, duplication and disclosure of data (e.g., restricted computer software) are included and made a part of this Contract/Order, and only to the extent that those provisions are not duplicative or inconsistent with Federal law, Federal regulation, the incorporated FAR clauses and the provisions of this Contract/Order; those provisions in the commercial license agreement that do not address data rights regarding the Government’s use, duplication and disclosure of data shall not be included or made a part of the Contract/Order. Federal law and regulation including, without limitation, the Contract Disputes Act (41 U.S.C. § 7101 et seq.), the Anti-Deficiency Act (31 U.S.C. § 1341 et seq.), the Competition in Contracting Act (41 U.S.C. § 3301 et seq.), the Prompt Payment Act (31 U.S.C.

§ 3901 et seq.), Contracts for Data Processing or Maintenance (38 USC § 5725), and FAR clauses 52.212-4, 52.227-14, 52.227-19 shall supersede, control, and render ineffective any inconsistent, conflicting, or duplicative provision in any commercial license agreement. In the event of conflict between this clause and any provision in the Contract/Order or the commercial license agreement or elsewhere, the terms of this clause shall prevail. The Contractor shall deliver to the Government all data first produced under this Contract/Order with unlimited rights as defined by FAR 52.227-14. Claims of patent or copyright infringement brought against the Government as a party shall be defended by the U.S. Department of Justice (DOJ) in accordance with 28 U.S.C. § 516; at the discretion of DOJ, the Contractor may be allowed reasonable participation in the defense of the litigation. Any additional changes to the Contract/Order must be made by modification (Standard Form 30) and shall only be made by a warranted Contracting Officer. Nothing in this Contract/Order or any commercial license agreement shall be construed as a waiver of sovereign immunity.

B.3 SOFTWARE LICENSE, MAINTENANCE AND TECHNICAL SUPPORT

(1). Definitions.

a) Licensee. The term “licensee” shall mean the U.S. Department of Veterans Affairs (“VA”) and is synonymous with “Government.”

b) Licensor. The term “licensor” shall mean the Contractor having the necessary license or ownership rights to deliver license, software maintenance and support of the computer software being acquired. The term “Contractor” is the party identified in Block 17a on the SF1449. If the Contractor is a reseller and not the Licensor, the Contractor remains responsible for performance under this Contract/Order.

c) Software. The term “software” shall mean the licensed computer software product(s) cited in the Schedule of Supplies/Services.

d) Maintenance. The term “maintenance” is the process of enhancing and optimizing software, as well as remedying defects. It shall include all new fixes, patches, releases, updates, versions and upgrades, as further defined below.

e) Technical Support. The term “technical support” refers to the range of services providing assistance for the software via the telephone, email, a website or otherwise.

f) Release or Update. The term “release” or “update” are terms that refer to a revision of software that contains defect corrections, minor enhancements, or improvements of the software’s functionality. This is usually designated by a change in the number to the right of the decimal point (e.g., from Version 5.3 to 5.4). An example of an update is the addition of new hardware.

g) Version or Upgrade. The term “version” or “upgrade” are terms that refer to a revision of software that contains new or improved functionality. This is usually designated by a change in the number to the left of the decimal point (e.g., from Version 5.4 to 6).

(2). Software License.

a) Unless otherwise stated in the Schedule of Supplies/Services, the Performance Work Statement or Product Description, the software license provided to the Government is a perpetual, nonexclusive license to use the software.

b) The Government may use the software in a networked environment.

c) Any dispute regarding the license grant or usage limitations shall be resolved in accordance with the Disputes Clause incorporated in FAR 52.212-4(d).

d) All limitations of software usage are expressly stated in the Schedule of Supplies/Services and the Performance Work Statement/Product Description.

(3). Software Maintenance and/or Technical Support.

a) If the Government desires to continue software maintenance and support beyond the period of performance identified in this Contract/Order, the Government will issue a separate contract or order for maintenance and support. Conversely, if a contract or order for continuing software maintenance and technical support is not received, the Contractor is neither authorized nor permitted to renew any of the previously furnished services.

b) The Contractor shall provide software support services, which includes periodic updates, enhancements and corrections to the software, and reasonable technical support, all of which are customarily provided by the Contractor to its commercial customers to cause the software to perform according to its specifications, documentation or demonstrated claims.

c) Any telephone support provided by Contractor shall be at no additional cost.

d) The Contractor shall provide all maintenance services in a timely manner in accordance with the Contractor’s customary practice or as defined in the Performance Work Statement or Product Description. However, prolonged delay (exceeding two business days) in resolving software problems will be noted in the Government’s various past performance records on the Contractor (e.g., www.cpars.gov).

e) If the Government allows the maintenance and support to lapse and subsequently wishes to reinstate it, any reinstatement fee charged shall not exceed the amounts that would have been charged if the Government had not allowed the subscription to lapse.

(4). Disabling Software Code.

The Government requires delivery of computer software that does not contain any code that will, upon the occurrence or the nonoccurrence of any event, disable the software. Such code includes but is not limited to a computer virus, restrictive key, node lock, time-out, or other function, whether implemented by electronic, mechanical, or other means, which limits or hinders the use or access to any computer software based on residency on a specific hardware configuration, frequency of duration of use, or other limiting criteria. If any such disabling code is present, the Contractor agrees to indemnify the Government for all damages suffered as a result of a disabling caused by such code, and the contractor agrees to remove such code upon the Government’s request at no extra cost to the Government. Inability of the Contractor to remove the disabling software code will be considered an inexcusable delay and a material breach of contract, and the Government may exercise its right to terminate for cause. In addition, the Government is permitted to remove the code as it deems appropriate and charge the Contractor for consideration for the time and effort expended in removing the code.

(5). Manuals and Publications.

Upon Government request, the Contractor shall furnish the most current version of the user manual and publications for all products/services provided under this Contract/Order at no cost.

B.4 PRICE SCHEDULE

NOTE: Vendors are instructed to complete Section B.4, Price Schedule and submit with their quote. Vendors are cautioned that alterations to the line items as specified below may render quotes unacceptable. All questions shall be directed to the Contract Specialist, LaShell Garner, lashell.garner@va.gov and Contracting Officer, Matthew Truex, matthew.truex1 @va.gov prior to the closing date and time specified in the Request for Proposal (RFP).

VA Proposed Invoicing Schedule: Since this SaaS Product is processing VA data it cannot be utilized until FedRAMP Authorization and Agency ATO are both approved. Invoicing and Billing shall be as follows:

• Completed FedRAMP System Security Plan (SSP), VAID, and all supporting documentation (10% of contract value of the base period billable upon VA approval)

• 3PAO Security Assessment Plan (SAP) (10% of contract value of the base period billable upon VA approval)

• 3PAO Security Assessment Report (SAR) (10% of contract value of the base period billable upon VA approval)

• The remaining 70% of the base period will be billable when all ATO work is complete

Note this payment schedule does not apply to SaaS Products meeting VA’s FedRAMP requirements. Licensing and/or Subscription terms shall begin upon FedRAMP Authorization and Agency ATO approval.

BASE PERIOD

Period of Performance shall consist of 45-60 days for delivery/implementation of the solution, and 12-months of licenses/support from Government acceptance of implementation.

Contract Line Item Number

(CLIN)

Description Qty Unit Unit Price Extended Price

0001 Pre-Matching Service in accordance with (IAW) Product Description (PD) Section 1.0.

Period of Performance (PoP) is 12-months following Government acceptance.

Inspection/Acceptance/FOB: Destination

PSC:DA10

1 LT $ $

0002 Matching Service IAW PD 1.0.

The price of this CLIN shall be included in the FFP for the following SLINs.

1 LT Not Separately Priced

(NSP)

NSP

0002AA Mentoring Software IAW PD 1.0.

PoP: The software solution shall be available within 45-60 days after contract award, and 12-month term after Government acceptance.

Inspection/Acceptance/FOB: Destination

PSC: DA10

1 LT $ $

0002AB Integration IAW PD 1.0.

PoP: Integration shall be completed within 45-60 days of contract award.

Inspection/Acceptance/FOB: Destination

PSC: DA10

1 LT $ $

0002AC Subscriptions IAW PD 1.0.

The base period of the pilot will include up to 10,500 users.

PoP: The subscriptions shall be valid for 12-months from Government acceptance.

Inspection/Acceptance/FOB: Destination

PSC: DA10

0002AD Employee Retention Calculator IAW PD 1.0

PoP: The calculator shall be available for 12-months from Government acceptance.

Inspection/Acceptance/FOB: Destination

PSC: DA10

0002AE Training IAW PD 1.0.

PoP: 12-months from Government acceptance.

Inspection/Acceptance/FOB: Destination

PSC:DA10

1 LT $ $

0003 SaaS FedRAMP Requirements IAW PD 1.1 Note: Required Deliverables will be based on vendor offering and existing FedRAMP, if any.

PoP: 12-months from Government acceptance.

Inspection/Acceptance/FOB: Destination

PSC: DA10

1 LT NSP NSP

TOTAL BASE PERIOD $

OPTION PERIOD 1

This option may be exercised IAW FAR 52.217-9 Option to Extend the Term of the Contract (MAR 2000). Work shall not commence until, and unless, a formal modification is issued by the

Contracting Officer. If exercised, this option shall commence immediately after expiration of the base period.

CLIN Description Qty Unit Unit Price Extended

Price 1001 Pre-Matching Service IAW PD 1.0.

PoP shall be 12 months from expiration of base period.

Inspection/Acceptance/FOB: Destination

PSC: DA10

1 LT $ $

1002 Matching Service IAW PD 1.0.

The price of this CLIN shall be included in the FFP for the following SLINs.

1002AA Mentoring Software IAW PD 1.0.

PoP: 12-months from expiration of base period.

Inspection/Acceptance/FOB: Destination

PSC: DA10

1 LT $ $

1002AC Subscriptions IAW PD 1.0.

Option Year 1: up to 20K subscribers

PoP: The subscriptions shall be valid for 12-months.

Inspection/Acceptance/FOB: Destination

PSC: DA10

1 LT $ $

1003 SaaS FedRAMP Requirements IAW PD 1.1

PoP: 12-months.

Inspection/Acceptance/FOB: Destination

PSC: DA10

1 LT NSP NSP

1003AA DELIVERABLE:

Continuous monitoring security artifacts

IAW PD 1.1

Due as required.

Inspection/Acceptance/FOB: Destination

PSC: DA10

1 LT NSP NSP

1003AB DELIVERABLE:

Continuous monitoring scans IAW PD 1.1.

Due as required.

Inspection/Acceptance/FOB: Destination

PSC: DA10

1003AC DELIVERABLE:

Plan of Action and Milestones reports. IAW

PD 1.1.

Due as required.

Inspection/Acceptance/FOB: Destination

PSC: DA10

1 LT NSP NSP

TOTAL OPTION PERIOD 1 $

GRAND TOTAL (including all options) $

B.5 PRODUCT DESCRIPTION

PRODUCT DESCRIPTION (PD)

DEPARTMENT OF VETERANS AFFAIRS

Employee & Leadership Development Veterans Health Administration

Institute for Learning, Education and Development

Mentoring Software Platform

Date: 28 January 2025 PD Version Number: 3.0

1.0 PRODUCT REQUIREMENTS

The Institute for Learning, Education and Development (ILEAD) provides educational services and instruments to the Veterans Health Administration (VHA). One of the services ILEAD supports is mentoring. To continue supporting this service, ILEAD determined that a Software as a Service (SaaS) mentoring software platform is needed to create an enterprise mentoring program that will improve employee engagement and advancement by automating the mentor/mentee matching process.

The SaaS software will be acquired in the base period as a pilot to evaluate whether the product can meet ILEAD’s requirements. At the end of the pilot performance period, ILEAD will determine the software performance and if was successful we may add more participants to the program. The base period of the pilot will include up to 10,500 users.

The Contractor shall provide the following:

1. CLIN 0001: PRE-MATCHING SERVICE

Purpose Assessment Description

Need: Before matching mentees with mentors, ILEAD requires the vendor to ensure that the matching process pairs participants based on common personal goals .

Period of Performance: Provided during the base and option period, if exercised.

2. CLIN 0002: MATCHING SERVICE

SLIN 0002A: Mentoring Software

Need:

• Configure: ILEAD requires a customizable platform designed to improve retention, enable knowledge transfer and skill development, and support VHA employees along their career paths. Vendor works with VHA to configure a specific program, identifies challenges and outcomes, and configures a solution to meet the need of the organization.

Platform Requirements:

• Match: ILEAD expects use of technology that makes it easy to create effective mentor and mentee matches with proven methodology and an intelligent matching algorithm.

This technology will enable the creation of rich profiles in minutes, full of detailed information for mentorship matching and reporting. Mentors and mentees can quickly create their own profiles or can import profile data from Human Resources Information System (HRIS), Learning Management System (LMS) or other database(s). The proposed platform shall match mentees to mentors removing unconscious bias from the process.

• Guide: Platform–integrated training on how to be a successful mentor and mentee, an on–demand training system with, topics for common issues in mentoring relationships. Implementation manager will be available throughout the process to

SLIN 0002B: Integration

SLIN 0002C: Subscriptions

SLIN 0002D: Employee Retention Calculator

SLIN 0002E: Training provide required assistance. Furthermore, the vendor will be available to provide helpdesk support.

• Measure: Dashboards with integrated data analytics/reporting on all aspects of the program(s), configurable reporting for each program/sub-program with the ability to export data for use in VA-owned data analysis systems. Ability to create and track/manage the goals of the mentor/mentee program in-system. Develop and implement an Executive Dashboard as a one-stop-shop that can be accessed at anytime. Capability to integrate data in other processes to track all data.

• Scale: Capability to up-scale mentoring without losing functionality. Ability to support participants with mentoring through their entire employee experience, from their first day to their last.

Period of Performance: The software solution shall be available within 45-60 days after contract award.

Need: Build out integration with VA Talent Management System (TMS) as needed. FedRamp authorization required.

Period of Performance: Integration shall be completed within 45-60 days of contract award.

Need: Pilot Year/Base Year: 10.5 subscribers; Option Year 1: 20K subscribers

Period of Performance: The subscriptions shall be valid for one-year, with one option year for renewals/expansion.

Need: Utilization of employee retention calculator using HR data impact on retention. Provide report building with unique identifiers. Create a community of practice.

Period of Performance: The calculator shall be available the entire performance period.

Need: VA requires training for super users/admins, training for end-users (both mentors and mentees) on system use and training specific to being a mentor or tasks required of a mentee. See also “Platform Requirements”, “Guide” above.

Period of Performance: Provided during the base and option period, if exercised.

1.1 SaaS FedRAMP Requirements

If the solution is not FedRAMP authorized:

1. The information system solution selected by the Contractor shall comply with the Federal Information Security Management Act (FISMA).

2. The Contractor shall comply with FedRAMP requirements <<MODERATE IMPACT>> as mandated by Federal laws and policies, including making available any documentation, physical access, and logical access needed to support this requirement.

3. The Contractor shall provide a Software as a Service (SaaS) product as defined by the following criteria: SaaS is an application delivery model in which the application is hosted on a cloud infrastructure outside the security boundary of VA and is provided to the Cloud Service Customer (CSC) over the internet. The CSC uses the SaaS offering via a thin-client interface, such as a web-browser or a program interface. The CSC subscribes to the SaaS offering and is only responsible for minor in-app customizations. The CSP offering is responsible for management of the application, safeguarding of data stored or processed by the application, and all elements of the underlying infrastructure. Additionally, the CSP is responsible for all on-going compliance.

In order to qualify as SaaS for use at VA, and to align with FedRAMP requirements, the offering must conform to the NIST 800-145 definition of Cloud Computing and thus contain following key characteristics:

• On-Demand Self-Service: The CSP fully automates the provisioning of both the customer interface and the underlying cloud components of the SaaS offering.

In some cases, to the CSP may provision internal resources manually, while providing the CSC an automated interface to request and track the service.

• Broad Network Access: The SaaS capabilities are available over the internet or over a network that is available from all access points the CSC requires. The SaaS offering is accessible through common platforms (e.g., mobile phones, tablets, laptops, and workstations).

• Resource Pooling: The computing infrastructure supporting the SaaS offering is shared among more than one CSC using a multi-tenant model, and resources are dynamically assigned depending on customer demand.

• Rapid Elasticity: Computing capabilities are automatically provisioned and released in a manner that scales with customer demand. In some cases, the scaling of resources may not be fully automated, but it should be fast enough to support the needs of the CSC, which the CSC would have to define.

• Measured Service: Resource usage, such as storage, processing, bandwidth, and user activity are measured and reported in a manner that is relevant to the SaaS offering.

The SaaS offering must be hosted within the United States and data stored/processed/transmitted within the offering must remain within the United States. CSP should be aware of FedRAMP and ready to partner with VA through the SaaS FedRAMP Authorization process.

4. Following guidance from the Federal CIO, VA will utilize existing JAB Authorization To Operate (ATO) (JAB ATO) or agency ATO issued by another agency as a starting point for FedRAMP requirements. If neither of those exist, VA will sponsor the CSP for https://www.fedramp.gov/agency-authorization/ a FedRAMP Authorization. VA will be using the FedRAMP baselines as a starting point, since they are specifically tailored for cloud services.

5. The Contractor shall, where applicable, assist with the VA ATO process to help procure agency authorization of the cloud service or migrated application at the impact level required by VA. For this solution the required impact level is: <<MODERATE

IMPACT>>

6. The Contractor shall complete a FedRAMP System Security Plan (SSP) and provide supporting documentation and required attachments within 75 calendar days after contract award. (If Data Security Categorization is High Impact, the above will be due 94 calendar days after contract award.)

7. The Contractor shall develop a VA specific system boundary diagram including any integration and connectivity components that will be known as a VA Implementation Diagram (VAID) demonstrating the proposed implementation of the system at VA. The Contractor shall provide the VAID within 10 calendar days of contract award.

8. The Contractor shall complete a Third-Party Assessment Organization (3PAO) and Security Assessment Plan (SAP) within 90 calendar days after contract award. (If Data Security Categorization is High Impact, this will be due after 113 calendar days after contract award.)

9. The Contractor shall complete a 3PAO Security Assessment Report (SAR) within 90 calendar days after the SSP is accepted by VA. (If Data Security Categorization is High Impact, this will be due 113 calendar days after the SSP is accepted by VA.)

10. Contractor shall work with assigned VA SME to develop a VA-specific Incident Response Plan (IRP) and perform an IRP Table-Top Exercise with VA Stakeholders.

This should be completed within 30 calendar days of the SSP being delivered.

11. The Contractor shall afford VA access to the Contractor’s and Cloud Service Provider’s (CSP) facilities, installations, technical capabilities, operations, documentation, records, and databases.

12. If new or unanticipated vulnerabilities are discovered by either VA or the Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party in accordance with Addendum B, VA Information and Information System Security/Privacy Language.

13. The Contractor shall comply with VA’s data management requirements.

14. Successful issuance of a VA ATO will be required before live VA data can be used in the system.

Deliverables:

A. FedRAMP System Security Plan (SSP) and supporting documentation B. VA Implementation Diagram: This is a VA specific architecture diagram demonstrating the proposed implementation of this system at VA (VAID) C. 3PAO Security Assessment Plan (SAP) D. 3PAO Security Assessment Report (SAR) E. IRP Scenario

If the solution is FedRAMP Authorized but not VA Authorized:

1. The information system solution selected by the Contractor shall comply with the Federal Information Security Management Act (FISMA)

2. The Contractor shall comply with FedRAMP requirements as mandated by Federal laws and policies, including making available any documentation, physical access, and logical access needed to support this requirement

3. The system must be FedRAMP Authorized at no less than the <<MODERATE

IMPACT>>

4. The Contractor shall, where applicable, assist with the VA ATO process to help achieve agency authorization of the cloud service or migrated application.

5. The Contractor shall develop a VA specific system boundary diagram including any integration and connectivity components that will be known as a VA Implementation Diagram (VAID) demonstrating the proposed implementation of this system at VA.

The Contractor shall provide the VAID within 10 calendar days of contract award.

6. The Contractor shall provide confirmation of their FedRAMP System Security Plan (SSP) and supporting documentation completion via their repository ID number and a link for VA to download the SSP and all required artifacts within 5 calendar days of contract award.

7. The Contractor shall provide the results of their most recent Third-Party Assessment Organization (3PAO) Security Assessment Plan (SAP) within 10 calendar days of contract award.

8. The Contractor shall complete a 3PAO Security Assessment Report (SAR) within 10 calendar days after the SSP is accepted by VA.

9. The Contractor shall provide VA with the most recent monthly scans for the production environment within the authorization boundary and their scan upload schedule for FedRAMP within 30 calendar days of contract award.

10. The Contractor shall provide their availability to participate in monthly continuous monitoring meetings to be scheduled following successful VA ATO within 30 calendar days of contract award.

11. Contractor shall work with assigned VA SME to develop a VA specific Incident Response Plan (IRP) and perform an IRP Table Top Exercise with VA Stakeholders. This should be completed within 30 calendar days of the SAR being delivered.

12. If new or unanticipated vulnerabilities are discovered by either VA or the Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party per Addendum B, VA Information and Information System Security/Privacy Language

13. The Contractor shall comply with data management requirements.

14. Successful issuance of a VA ATO will be required before live VA data can be used in the system.

A. VA Implementation Diagram B. FedRAMP System Security Plan (SSP) and supporting documentation C. 3PAO Security Assessment Plan (SAP) D. 3PAO Security Assessment Report (SAR) E. IRP Scenario

If the solution is FedRAMP Authorized and VA Authorized:

1. The information system solution selected by the Contractor shall comply with the Federal Information Security Management Act (FISMA) and have a current VA authorization.

2. The Contractor shall comply with FedRAMP requirements as mandated by Federal laws and policies, including making available any documentation, physical access, and logical access needed to support this requirement.

3. The FedRAMP Authorization level and existing VA ATO should be no less than the level required for this use case which has been defined as <<MODERATE

IMPACT>>

4. The Contractor shall, where applicable, assist with the VA ATO Sustainment Process to help maintain health and quality of agency authorization of the cloud service or migrated application.

5. The Contractor shall exclusively provide licenses and/or accounts to FedRAMP authorized and VA authorized environments.

6. The Contractor shall afford VA access to the Contractor’s and Cloud Service Provider’s (CSP) facilities, installations, technical capabilities, operations, documentation, records, and databases.

7. If new or unanticipated vulnerabilities are discovered by either VA or the Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party in accordance with Addendum B, VA Information and Information System Security/Privacy Language

8. The Contractor shall comply with data management requirements.

9. Successful issuance of a VA ATO will be required before live VA data can be used in the system.

10. The Contractor shall participate in monthly Agency and FedRAMP Sustainment meetings following the granting of a VA ATO.

11. The Contractor shall provide continuous monitoring activities including scans, security artifacts, and monthly Plan of Action and Milestones (POAM) reports as outlined by FedRAMP requirements.

A. Continuous monitoring security artifacts B. Continuous monitoring scans C. Plan of Action and Milestones reports.

2.0 NOTICE OF THE FEDERAL ACCESSIBILITY LAW AFFECTING ALL INFORMATION AND

COMMUNICATION TECHNOLOGY (ICT) PROCUREMENTS (SECTION 508)

On January 18, 2017, the Architectural and Transportation Barriers Compliance Board (Access Board) revised and updated, in a single rulemaking, standards for electronic and information technology developed, procured, maintained, or used by Federal agencies covered by Section 508 of the Rehabilitation Act of 1973, as well as our guidelines for telecommunications equipment and customer premises equipment covered by Section 255 of the Communications Act of 1934. The revisions and updates to the Section 508-based standards and Section 255-based guidelines are intended to ensure that information and communication technology (ICT) covered by the respective statutes is accessible to and usable by individuals with disabilities.

2.1 SECTION 508 – INFORMATION AND COMMUNICATION TECHNOLOGY (ICT)

STANDARDS

The Section 508 standards established by the Access Board are incorporated into, and made part of all VA orders, solicitations and purchase orders developed to procure ICT. These standards are found in their entirety at: https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines. A printed copy of the standards will be supplied upon request.

Federal agencies must comply with the updated Section 508 Standards beginning on January 18, 2018. The Final Rule as published in the Federal Register is available from the Access Board: https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule.

The Contractor shall comply with “508 Chapter 2: Scoping Requirements” for all electronic ICT and content delivered under this contract. Specifically, as appropriate for the technology and its functionality, the Contractor shall comply with the technical standards marked here:

E205 Electronic Content – (Accessibility Standard -WCAG 2.0 Level A and AA Guidelines)

E204 Functional Performance Criteria E206 Hardware Requirements E207 Software Requirements E208 Support Documentation and Services Requirements

2.2 COMPATABILITY WITH ASSISTIVE TECHNOLOGY

The standards do not require installation of specific accessibility-related software or attachment of an assistive technology device. Section 508 requires that ICT be compatible with such software and devices so that ICT can be accessible to and usable by individuals using assistive technology, including but not limited to screen readers, screen magnifiers, and speech recognition software.

2.3 ACCEPTANCE AND ACCEPTANCE TESTING

Deliverables resulting from this solicitation will be accepted based in part on satisfaction of the Section 508 Chapter 2: Scoping Requirements standards identified above.

https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule

The Government reserves the right to test for Section 508 Compliance before delivery. The Contractor shall be able to demonstrate Section 508 Compliance upon delivery.

3.0 INFORMATION TECHNOLOGY USING ENERGY-EFFICIENT PRODUCTS

The Contractor shall comply with Sections 524 and Sections 525 of the Energy Independence and Security Act of 2007; Section 104 of the Energy Policy Act of 2005; Executive Order 13834, “Efficient Federal Operations”, dated May 17, 2018; Executive Order 13221, “Energy-Efficient Standby Power Devices,” dated August 2, 2001; and the Federal Acquisition Regulation (FAR) to provide ENERGY STAR®, Federal Energy Management Program (FEMP) designated, low standby power, and Electronic Product Environmental Assessment Tool (EPEAT) registered products in providing information technology products and/or services.

3.1 EPEAT

EPEAT product compliance is not required in this acquisition.

3.2 ENERGY STAR

Energy Star compliance is not required in this acquisition.

3.3 FEMP

FEMP or FEMP low standby power product compliance is not required in this acquisition.

4.0 SYSTEM ACCEPTANCE (PRE-PRODUCTION) TESTING – N/A

5.0 SHIPMENT OF HARDWARE OR EQUIPMENT – N/A

6.0 GENERAL REQUIREMENTS

6.1 VA TECHNICAL REFERENCE MODEL

The Contractor shall support the VA enterprise management framework. In association with the framework, the Contractor shall comply with OIT Technical Reference Model (VA TRM). The VA TRM is one component within the overall Enterprise Architecture (EA) that establishes a common vocabulary and structure for describing the information technology used to develop, operate, and maintain enterprise applications. Moreover, the VA TRM, which includes the Standards Profile and Product List, serves as a technology roadmap and tool for supporting OIT. Architecture & Engineering Services (AES) has overall responsibility for the VA TRM.

6.2 SOCIAL SECURITY NUMBER (SSN) REDUCTION

The Contractor solution shall support the Social Security Number (SSN) Fraud Prevention Act (FPA) of 2017 which prohibits the inclusion of SSNs on any document sent by mail. The Contractor support shall also be performed in accordance with Section 240 of the Consolidated Appropriations Act (CAA) 2018, enacted March 23, 2018, which mandates VA to discontinue using SSNs to identify individuals in all VA information systems as the Primary Identifier. The Contractor shall ensure that any new IT solution discontinues the use of SSN as the Primary Identifier to replace the SSN with the Integrated Control Number (ICN) in all VA information systems for all individuals. The Contractor shall ensure that all Contractor delivered applications and systems integrate with the VA Master Person Index (MPI) for identity traits to include the use of the ICN as the Primary Identifier. The Contractor solution may only use a Social Security Number to identify an individual in an information system if and only if the use of such number is required to obtain information VA requires from an information system that is not under the jurisdiction of VA.

6.3 INTERNET PROTOCOL VERSION 6 (IPV6)

The Contractor solution shall support Internet Protocol Version 6 (Ipv6) based upon the memo issued by the Office of Management and Budget (OMB) on November 19, 2020 (https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-07.pdf). Ipv6 technology, in accordance with the USGv6 Program (https://www.nist.gov/programs-projects/usgv6-program/usgv6-revision-1), NIST Special Publication (SP) 500-267B Revision 1 “USGv6 Profile” (https://doi.org/10.6028/NIST.SP.500-267Br1), and NIST SP 800-119 “Guidelines for the Secure Deployment of Ipv6” (https://doi.org/10.6028/NIST.SP.800-119), compliance shall be included in all IT infrastructures, application designs, application development, operational systems and sub-systems, and their integration. In addition to the above requirements, all devices shall support native Ipv6 and dual stack (Ipv6 / Ipv4) connectivity without additional memory or other resources being provided by the Government, so that they can function in a mixed environment. All public/external facing servers and services (e.g. web, email, DNS, ISP services, etc.) shall support native Ipv6 and dual stack (Ipv6 / Ipv4) users and all internal infrastructure and applications shall communicate using native Ipv6 and dual stack (Ipv6 / Ipv4) operations.

6.4 SOFTWARE AND LICENSING REQUIREMENTS

The Contractor shall be responsible for the provision of all software licenses and any associated licensing maintenance required for any development, delivery, integration, operation, and/or maintenance associated with its proposed application(s), software products, software solution, and/or system including, but not limited to, any and all application(s), software and/or software https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-07.pdf https://www.nist.gov/programs-projects/usgv6-program/usgv6-revision-1 https://www.nist.gov/programs-projects/usgv6-program/usgv6-revision-1 https://doi.org/10.6028/NIST.SP.500-267Br1 https://doi.org/10.6028/NIST.SP.800-119 products that comprise, are a part of, or integrate with the Contractor’s proposed application(s), software products, software solution, and/or system for the life of any resulting contract.

6.5 POSITION/TASK RISK DESIGNATION LEVEL(S)

In accordance with VA Handbook 0710, Personnel Security and Suitability Program, the position sensitivity and the level of background investigation commensurate with the required level of access for the following tasks within the PD are:

Position Sensitivity and Background Investigation Requirements by Task Task Number Tier1 / Low Risk Tier 2 / Moderate

Risk Tier 4 / High Risk

1.0 1.1

The Tasks identified above and the resulting Position Sensitivity and Background Investigation requirements identify, in effect, the Background Investigation requirements for Contractor individuals, based upon the tasks the particular Contractor individual will be working. The submitted Contractor Staff Roster must indicate the required Background Investigation Level for each Contractor individual based upon the tasks the Contractor individual will be working, in accordance with their submitted proposal.

6.5.1 CONTRACTOR PERSONNEL SECURITY REQUIREMENTS

Contractor Responsibilities:

a. The Contractor shall prescreen all personnel requiring access to the computer systems to ensure they maintain the appropriate Background Investigation, and are able to read, write, speak, and understand the English language.

b. Within 3 business days after award, the Contractor shall provide a roster of Contractor and Subcontractor employees to the COR to begin their background investigations in accordance with the PAL template artifact. The Contractor Staff Roster shall contain the Contractor’s Full Name, Date of Birth, Place of Birth, individual background investigation level requirement (based upon Section 6.2 Tasks), etc. The Contractor shall submit full Social Security Numbers either within the Contractor Staff Roster or under separate cover to the COR. The Contractor Staff Roster shall be updated and provided to VA within 1 day of any changes in employee status, training certification completion status, Background Investigation level status, additions/removal of employees, etc. throughout the Period of Performance. The Contractor Staff Roster shall remain a historical document indicating all past information and the Contractor shall indicate in the Comment field, employees no longer supporting this contract. The preferred method to send the Contractor Staff Roster or Social Security Number is by encrypted e-mail. If unable to send encrypted e-mail, other methods which comply with FIPS 140-2 are to encrypt the file, use a secure fax, or use a traceable mail service.

c. The Contractor should coordinate with the location of the nearest VA fingerprinting office through the COR. Only electronic fingerprints are authorized. The Contractor shall bring their completed Security and Investigations Center (SIC) Fingerprint request form with them (see paragraph d.4. below) when getting fingerprints taken.

d. The Contractor shall ensure the following required forms are submitted to the COR within 5 days after contract award:

1) Optional Form 306

2) Self-Certification of Continuous Service

3) VA Form 0710

4) Completed SIC Fingerprint Request Form

e. The Contractor personnel shall submit all required information related to their background investigations (completion of the investigation documents (SF85, SF85P, or SF 86) utilizing the Office of Personnel Management’s (OPM) Electronic Questionnaire for Investigations Processing (e-QIP) after receiving an email notification from the Security and Investigation Center (SIC).

f. The Contractor employee shall certify and release the e-QIP document, print, and sign the signature pages, and send them encrypted to the COR for electronic submission to the SIC. These documents shall be submitted to the COR within 3 business days of receipt of the e-QIP notification email. (Note: OPM is moving towards a “click to sign” process. If click to sign is used, the Contractor employee should notify the COR within 3 business days that documents were signed via e-

QIP).

g. The Contractor shall be responsible for the actions of all personnel provided to work for VA under this contract. In the event that damages arise from work performed by Contractor provided personnel, under the auspices of this contract, the Contractor shall be responsible for all resources necessary to remedy the incident.

h. A Contractor may be granted unescorted access to VA facilities and/or access to VA Information Technology resources (network and/or protected data) with a favorably adjudicated Special Agreement Check (SAC), completed training delineated in VA Handbook 6500.6 (Appendix C, Section 9), signed “Contractor Rules of Behavior”, and with a valid, operational PIV credential for PIV-only logical access to VA’s network. A PIV card credential can be issued once your SAC has been favorably adjudicated and your background investigation has been scheduled by OPM.

However, the Contractor will be responsible for the actions of the Contractor personnel they provide to perform work for VA. The investigative history for Contractor personnel working under this contract must be maintained in the database of OPM.

i. The Contractor, when notified of an unfavorably adjudicated background investigation on a Contractor employee as determined by the Government, shall withdraw the employee from consideration in working under the contract.

j. Failure to comply with the Contractor personnel security investigative requirements may result in loss of physical and/or logical access to VA facilities and systems by Contractor and Subcontractor employees and/or termination of the contract for default.

k. Identity Credential Holders must follow all HSPD-12 policies and procedures as well as use and protect their assigned identity credentials in accordance with VA policies and procedures, displaying their badges at all times, and returning the identity credentials upon termination of their relationship with VA.

Deliverable:

A. Contractor Staff Roster

6.6 PERFORMANCE METRICS

The Contractor shall develop and maintain an effective internal quality control program to ensure that services performed are in accordance with the PD. The Contractor shall develop and implement procedures to identify, prevent, and ensure non-recurrence of defective services.

As a minimum requirement, the Contractor shall internally develop quality control procedures that address the areas identified below in the Performance Requirements Summary (PRS).

Delivery and Performance Monitoring: Contractor’s delivery and training will be monitored by the Program Manager (PM) / Contracting Officer’s Representative (COR) in accordance with the PRS and the Quality Assurance Surveillance Plan (QASP).

The PM/COR will certify receipt of services and recommends acceptance of the services/deliverables. This process will be used for approval of payment for the Contractor’s invoices and will serve as the mechanism to document that the overall performance of the Contractor has been acceptable for the period of time covered by the invoice.

Performance Standard Minimum Acceptable

Standard Method of

Surveillance Frequency

Purpose Assessment Vendor provides assessments to participants within five days of request 90% of the time.

Utilization Report…