S02 36C10B26Q0335 Combined Syn-Sol.pdf

Request for Proposal: 36C10B26R0335

Contract: TDB

This is a combined synopsis/solicitation for commercial services prepared in accordance with Revolutionary Federal Acquisition Regulation (FAR) Overhaul (RFO) Part 12 as supplemented with additional information included in this solicitation. This announcement constitutes the only solicitation; proposals are being requested and a separate written solicitation will not be issued. Solicitation 36C10B26R0335 is issued as a Request for Proposal (RFP). The following are the Terms and Conditions for RFP 36C10B26R0335. Any resultant award will be issued on a Standard Form (SF) 1449 and will include Sections B, C, and D.

Section E will be removed at time of award.

1. The solicitation document and incorporated provisions and clauses are those in effect through Federal Acquisition Circular 2026-01.

2. The solicitation is under North American Industry Classification System Code 541330, Engineering Services, and the associated small business size standard is $25.5M.

3. DESCRIPTION: The Government contemplates the sole source (Justification provided in a separate document posted with this combined synopsis/solicitation) award of a requirements type contract in accordance with FAR RFO 16.503 for Wireless Medical Telemetry Systems (WMTS) frequency coordination, registration, and allocation services. Deliveries of WMTS frequency coordination, registration, and allocation services. Deliveries of WMTS frequency coordination, registration, and allocation services will be scheduled by placing orders. The quantity will be identified in each order. The minimum quantity the Government will order is one unit;

the maximum quantity for a single order is 1,771 units; and the cumulative total maximum quantity for all orders placed is 8,855 units of WMTS frequency coordination, registration, and allocation services.

4. Proposal Submission: The Offeror’s proposal shall be submitted electronically by the date and time indicated in the solicitation via electronic mail to Richard.Melton2@va.gov and Diana.Armesto@va.gov. The Offeror’s proposal shall consist of completed Representations and Certifications listed in Section E and the completed Price Schedule. The use of hyperlinks or embedded attachments is prohibited. Late submissions may not be accepted for evaluation. To avoid submission of late proposal, the Government recommends the Offeror transmit proposal files at least 24 hours prior to the required submission due date and time.

Please be advised that timeliness is determined by the date and time an Offeror’s proposal is received by the Government and not when an Offeror attempted transmission.

5. Offeror’s submission(s) shall be submitted in accordance with the following instructions:

a. Format. The submission shall be clearly indexed and logically assembled. Each submission shall be clearly identified and shall begin at the top of a page. All pages of each volume shall be appropriately numbered and identified by the complete company name, date and solicitation number in the header and/or footer.

b. All files shall be submitted as either a Microsoft Excel (.XLS) file or an Acrobat (PDF) file. Page size shall be no greater than 8 1/2" x 11" with printing on one side, only. The top, bottom, left and right margins shall be a minimum of one inch (1”) each. Font size shall be no smaller than 12-point. Arial or Times New Roman fonts are required. Characters shall be set at no less than normal spacing and 100% scale. Tables and illustrations may use a reduced font size not less than 8-point and may be landscape. Line spacing shall be set at no less than single space. Each paragraph shall be separated by at least one blank line. Page numbers, company logos, headers and footers may be within the page margins ONLY, and are not bound by the 12-point font requirement. Footnotes to text shall not be used. All proprietary information shall be clearly and properly marked. If the Offeror submits annexes, documentation, attachments or the like, not specifically required by this solicitation, such will count against the Offeror’s page limitations unless otherwise indicated in the specific volume instructions below. Pages in violation of these instructions, either by exceeding the margin, font or spacing restrictions or by exceeding the total page limit for a particular volume, will not be evaluated. Pages not evaluated due to violation of the margin, font or spacing restrictions will not count against the page limitations. The page count will be determined by counting the pages in the order they come up in the print layout view.

c. File Packaging. All of the proposal files may be compressed (zipped) into one file entitled “proposal.zip” using WinZip version 6.2 or later version or the proposal files may be submitted as individual attachments.

d. Content Requirements. Offerors are responsible for including sufficient details, in a concise manner, to permit a complete and accurate evaluation of each proposal.

SECTION B - SUPPLIES OR SERVICES AND PRICE/COSTS

B.1 Contract Type

This is a Requirements contract. Orders can be placed against this contract in accordance with (IAW) the Contract Line-Item Number (CLIN) structure listed in Section B on a Firm-Fixed-Price (FFP) basis. The Government may place orders on this contract from the effective date of this contract (as identified in Block 28 of the SF 1449) through 60 months thereafter. Orders will be placed IAW Paragraph B.11.

B.2 Contract Maximum/Minimum Amounts

Pursuant to FAR RFO 52.216-22(b), the maximum amount for this contract is To Be Determined (TBD) and the minimum amount is TBD. The minimum quantity the Government will order is one unit; the maximum quantity for a single order is 1,771 units; and the cumulative total maximum quantity for all orders placed is 8,855 units of WMTS frequency coordination, registration, and allocation services.

B.3 Schedule of Supplies/Services

All services shall be in accordance with the Performance Work Statement (PWS), entitled “Enterprise Wireless Medical Telemetry Systems Frequency Coordination, Registration, and Allocation Services,” dated April 8, 2026, as set forth in Section B.

Orders will be issued in accordance with the following Contract Line-Item Number (CLIN) structure:

CLIN

DESCRIPTION OF

SUPPLIES/SERVICES QTY UNIT UNIT PRICE AMOUNT

The contractor is required to provide the Enterprise Wireless Medical Telemetry Systems (WMTS) Frequency Coordination, Registration, and Allocation Services

Contract Type: FFP.

Product Service Code: DG11.

Inspection/Acceptance/F.O.B. Point:

Destination.

Integrated Financial and Acquisition Management System (iFAMS) Integrated Purchase Request (IPR) Number for the Contract: F363151-26- 0001092.

Acquisition Request Module (ARM):

200184 for this contract. In addition, Individual Orders will provide an ARM.

Period of Performance (POP): 60-month Ordering and Performance Period from the date of award.

Descriptive Data: This is a 60-month effort for enterprise WMTS frequency coordination, registration, and allocation services IAW the PWS set forth in Section B.4 of this contract. The Contractor shall furnish all personnel, facilities, services, materials, supplies, travel and otherwise perform all actions necessary to accomplish the requirements for the

SUPPLIES/SERVICES QTY UNIT UNIT PRICE AMOUNT

individual FFP orders issued under this Contract.

Individual Orders will use the appropriate unit price based on the total quantities ordered during the applicable ordering period

Ordering Period 1, from Date award through 12 months.

1001AA Enterprise WMTS Frequency

Coordination, Registration, and Allocation Services for quantities 1 through 500 ordered during the ordering period.

Up to

EA $ To Be Proposed

(TBP)

Not to Exceed

(NTE) $TBP

1001AB Enterprise WMTS Discounted Frequency Coordination, Registration, and Allocation Services for quantities 501 and up to 1,271 ordered during the ordering period.

through 1,271

EA $TBP NTE $TBP

Total NTE Value Ordering Period 1: $TBP

Ordering Period 2, 12 months from the end of Ordering Period 1 2001AA Enterprise WMTS Frequency

Coordination, Registration, and Allocation Services for the quantities 1 through 500

EA $TBP NTE $TBP

2001AB Enterprise WMTS Discounted Frequency Coordination, Registration, and Allocation Services for quantities 501 and up to 1,271 ordered during the ordering period.

1,271

Total NTE Value Ordering Period 2: $TBP

Ordering Period 3, 12 months from the end of Ordering Period 2 3001AA Enterprise WMTS Frequency

Coordination, Registration, and Allocation

EA $TBP NTE $TBP

3001AB Enterprise WMTS Discounted Frequency Coordination, Registration, and Allocation Services for quantities 501 through 1,271

1,271

Total NTE Value Ordering Period 3: $TBP

SUPPLIES/SERVICES QTY UNIT UNIT PRICE AMOUNT

Ordering Period 4, 12 months from the end of Ordering Period 3 4001AA Enterprise WMTS Frequency

Coordination, Registration, and Allocation

EA $TBP NTE $TBP

4001AB Enterprise WMTS Discounted Frequency Coordination, Registration, and Allocation

1,271

Total NTE Value Ordering Period 3: $TBP

Ordering Period 5, 12 months from the end of Ordering Period 4 5001AA Enterprise WMTS Frequency

Coordination, Registration, and Allocation

EA $TBP NTE $TBP

5001AB Enterprise WMTS Discounted Frequency Coordination, Registration, and Allocation ordered during the period.

1,271

EA $TBP NTE $TBP

Total NTE Value Ordering Period 5: $TBP

Total NTE Contract Value: $TBP

Governing Law Clause

Federal law and regulations, including the FAR RFO, shall govern this Contract/Order.

Commercial license agreements may be made a part of this Contract/Order but only if both parties expressly make them an addendum hereto. If the commercial license agreement is not made an addendum, it shall not apply, govern, be a part of or have any effect whatsoever on the Contract/Order; this includes, but is not limited to, any agreement embedded in the computer software (clickwrap), any agreement that is otherwise delivered with or provided to the Government with the commercial computer software or documentation (shrinkwrap), or any other license agreement otherwise referred to in any document. If a commercial license agreement is made an addendum, only those provisions addressing data rights regarding the Government’s use, duplication and disclosure of data (e.g., restricted computer software) are included and made a part of this Contract/Order, and only to the extent that those provisions are not duplicative or inconsistent with Federal law, Federal regulation, the incorporated FAR RFO clauses and the provisions of this Contract/Order; those provisions in the commercial license agreement that do not address data rights regarding the Government’s use, duplication and disclosure of data shall not be included or made a part of the Contract/Order. Federal law and regulation including, without limitation, the Contract Disputes Act (41 U.S.C. § 7101 et seq.), the Anti-Deficiency Act (31 U.S.C. § 1341 et seq.), the Competition in Contracting Act (41 U.S.C. § 3301 et seq.), the Prompt Payment Act (31 U.S.C. § 3901 et seq.), Contracts for Data Processing or Maintenance (38 USC § 5725), Source Code Harmonization and Reuse in Information Technology Act “SHARE IT Act” (P.L. 118-187), and FAR clauses 52.212-4, 52.227-14 shall supersede, control, and render ineffective any inconsistent, conflicting, or duplicative provision in any commercial license agreement. In the event of conflict between this clause and any provision in the Contract/Order or the commercial license agreement or elsewhere, the terms of this clause shall prevail. The Contractor shall deliver to the Government all data first produced under this Contract/Order with unlimited rights as defined by FAR 52.227-14, this includes any custom code developed for the purpose of performing under this contract. Claims of patent or copyright infringement brought against the Government as a party shall be defended by the U.S. Department of Justice (DOJ) in accordance with 28 U.S.C. § 516; at the discretion of DOJ, the Contractor may be allowed reasonable participation in the defense of the litigation. Any additional changes to the Contract/Order must be made by modification (Standard Form 30) and shall only be made by a warranted Contracting Officer. Nothing in this Contract/Order or any commercial license agreement shall be construed as a waiver of sovereign immunity.

B.4 PERFORMANCE WORK STATEMENT

DEPARTMENT OF VETERANS AFFAIRS

Office of Operations, Security, and Preparedness

Office of Operations, Mission Assurance and Resilience Office of Telecommunications

Enterprise Wireless Medical Telemetry Systems Frequency Coordination, Registration, and Allocation Services

Date: April 8, 2026 Version Number: 1.0

1.0 BACKGROUND

The Department of Veterans Affairs (VA) Office of Operations, Security, and Preparedness, Office of Operations, Mission Assurance and Resilience (OMAR), is responsible for ensuring the safety, security, and operational readiness of VA facilities, staff, and services. The tasks are linked by security classification and National Security/Emergency Preparedness (NS/EP) functionality. Many of the functions directly support mandatory capabilities required by National Communication System (NCS) Directive 3-10. NS/EP tasks require direct coordination and communications with other Federal agencies, including the Department of Homeland Security, NCS, the National Security Agency, and the National Telecommunications and Information Agency (NTIA).

OMAR also includes spectrum management services ensuring compliance with various regulations and guidelines for Wireless Medical Telemetry (WMT) Systems (WMTS). WMT is the remote monitoring of a patient’s health through radio technology.

The use of WMT gives patients greater mobility and increased comfort by freeing them from the need to be connected to hospital equipment that would otherwise be required to monitor their condition. WMT also serves the goal of reducing health care costs because it permits remote monitoring of several patients simultaneously.

VA coordinates and documents authorized spectrum sharing with state and local agencies and organizations in alignment with 47 Code of Federal Regulations Ch1 Part 95 Subpart H §§ 95.2301 – 95.2395. Medical telemetry devices in the WMTS bands must be coordinated with the FCC Frequency Coordinator to protect spectrum allocations. The WMTS contractor provides frequency coordination and registration services for wireless medical telemetry equipment at all VA medical facilities, other Government facilities, and hospitals.

VA must ensure interference-free, efficient and effective use of the radio frequency spectrum. This capability is critical in many facets of VA communications, including medical telemetry; paging systems; wireless networks; microwave systems; police, fire, and facility management radio networks; and National Security or Emergency Preparedness communications.

Code of Federal Regulation, Title 47, Telecommunication, Subparagraph H of Part 95, requires Federal Agencies to determine whether there are any systems whose operations could affect, or could be affected, by proposed wireless medical telemetry operations. This regulation requires the VA to ensure registration or removal of devices or equipment that would interfere with or be affected by authorized wireless medical telemetry devices. The American Society for Healthcare Engineering of the American Hospital Association (ASHE/AHA) of the American Hospital Association provides access to the WMTS Frequency Coordination Database by establishing an account for online registration. ASHE/AHA’s sole technical partner, Outdoor Wireless Networks, LLC, is responsible for providing frequency coordination and allocation services in the WMTS bands. Frequency coordination fees are paid directly to Outdoor Wireless Networks, LLC, for these services.

2.0 APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. “Federal Information Security Modernization Act of 2014.”

2. FIPS Pub 199. “Standards for Security Categorization of Federal Information and

Information Systems,” February 2004.

3. FIPS Pub 200, “Minimum Security Requirements for Federal Information and

Information Systems,” March 2006.

4. 10 U.S.C. § 2224, "Defense Information Assurance Program", as amended.

5. 5 U.S.C. § 552a, as amended, “Privacy Act of 1974.”

6. Public Law 109-461 (P.L. 109-461), “Veterans Benefits, Health Care, and

Information Technology Act of 2006,” as amended, Title IX, Information Security Matters.

7. 42 U.S.C. § 2000d from “Title VI of the Civil Rights Act of 1964”, as amended.

8. VA Directive 6102, “Internet and Intranet Services,” August 5, 2019.

9. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and

Guidelines,” as amended.

10. Office of Management and Budget (OMB) Circular A-130, “Managing Federal

Information as a Strategic Resource,” July 28, 2016.

11. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed Services

(CHAMPUS)”, as amended.

12. NIST SP 800-66 Rev. 2, “Implementing the Health Insurance Portability and

Accountability Act (HIPAA) Security Rule: A Cybersecurity Resource Guide,” February 2024.

13. 45 C.F.R. Parts 160 and 164, Subparts A and E, the Standards for Privacy of Individually Identifiable Health Information (“Privacy Rule”); and 45 C.F.R. Parts 160 and 164, Subparts A and C, the Security Standard (“Security Rule”); as amended.

14. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended

15. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004.

16. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021 (see VA

NOTICE 24-18, dated September 27, 2024, “Update to VA Directive 6500 Cybersecurity Program”, and VA Notice 25-07, dated 3/18/25, “Amending VA Directive 6500 to incorporate M-24-15”).

17. VA Handbook 6500, “Risk Management Framework for VA Information Systems VA Information Security Program,” February 24, 2021 (see VA Notice 25-01, dated October 15, 2024, “Update to VA Handbook 6500 Risk Management Framework for VA Information Systems VA Information Security Program”, and VA Notice 25-06, dated 3/18/25, “Amending VA Directive 6500 to incorporate M-24-15”, VA Notice 25- 16, dated September 15, 2025, “Amending VA Handbook 6500 to Replace Enterprise Mission Assurance Support Services Tool With Office of Information Technology Governance Risk Compliance Tool, and VA Notice 25-17, dated September 22, 2025, “Rescission Of Office Of Information Security (OIS) Deputy Assistant Secretary (DAS) Memorandum – Requirements of Proper Plan of Action and Milestones (POA&M) Completion).

18. OIT Process Asset Library (PAL), OIT Process Asset Library.

https://digital.va.gov/process-asset-library/

19. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy

Impact Assessment,” October 15, 2014.

20. VA Directive and Handbook 6513, “Secure External Connections,” October 12, 2017.

21. NIST SP 800-37 Rev 2, “Risk Management Framework for Information Systems and

Organizations: A System Life Cycle Approach for Security and Privacy,” December 2018.

22. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020).

23. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents.

24. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019.

25. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008.

26. Executive Order 14148, “Initial Rescissions of Harmful Executive Orders and Actions,” dated January 20, 2025.

27. OIS VAIQ #7424808 Memorandum, “Remote Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28.

28. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103.

29. NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020.

30. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol Version

6 (IPv6),” November 19, 2020.

31. Social Security Number (SSN) Fraud Prevention Act of 2017.

32. Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23, 2018.

33. C.F.R Title 15 Part 7, “Securing the Information and Communications Technology and Services (ICTS) Supply Chain”, as amended.

34. Executive Order 14028, “Executive Order on Improving the Nation's Cybersecurity,”

May 12, 2021, https://bidenwhitehouse.archives.gov/briefing-room/presidential-actions/2025/01/16/executive-order-on-strengthening-and-promoting-innovation-in-the-nations-cybersecurity/.

35. OMB Memorandum M-22-09, “Moving the U.S. Government Toward Zero Trust Cybersecurity Principles”, January 26, 2022, https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf.

36. NIST SP 800-52 Revision 2, “Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations.

37. OMB M-21-31, “Improving the Federal Government’s Investigative and Remediation Capabilities Related to Cybersecurity Incidents,” August 27, 2021.

38. CISA Binding Operational Directive (BOD) 19-02: “Vulnerability Remediation Requirements of Internet-Accessible Systems,” April 29, 2019, BOD 19-02:

Vulnerability Remediation Requirements for Internet-Accessible Systems | CISA.

39. CISA BOD 22-01: “Reducing the Significant Risk of Known Exploited Vulnerabilities,” November 3, 2021, BOD 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities | CISA.

https://www.cisa.gov/publication/tic-30-core-guidance-documents https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 https://bidenwhitehouse.archives.gov/briefing-room/presidential-actions/2025/01/16/executive-order-on-strengthening-and-promoting-innovation-in-the-nations-cybersecurity/ https://bidenwhitehouse.archives.gov/briefing-room/presidential-actions/2025/01/16/executive-order-on-strengthening-and-promoting-innovation-in-the-nations-cybersecurity/ https://bidenwhitehouse.archives.gov/briefing-room/presidential-actions/2025/01/16/executive-order-on-strengthening-and-promoting-innovation-in-the-nations-cybersecurity/ https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf https://www.cisa.gov/news-events/directives/bod-19-02-vulnerability-remediation-requirements-internet-accessible-systems https://www.cisa.gov/news-events/directives/bod-19-02-vulnerability-remediation-requirements-internet-accessible-systems https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities

40. CISA BOD 23-01: Improving Asset Visibility and Vulnerability Detection on Federal

Networks.” Cybersecurity & Infrastructure Security Agency (CISA), BOD 23-01:

Improving Asset Visibility and Vulnerability Detection on Federal Networks | CISA.

41. VA Directive 6550, Pre-Procurement Assessment and Implementation of Medical Devices/Systems, June 03, 2019.

42. VA Memorandum, “VA Security Controls,” January 17, 2025, https://www.voa.va.gov/DocumentView.aspx?DocumentID=5010.

43. E.O. 13960, “Promoting the Use of Trustworthy Artificial Intelligence in the Federal Government,” December 3, 2020.

44. E.O. 14319, “Preventing Woke AI in the Federal Government,” July 23, 2025.

45. OMB Memorandum M-25-21, “Accelerating Federal Use of AI through Innovation, Governance, and Public Trust,” April 3, 2025.

46. OMB Memorandum M-25-22, “Driving Efficient Acquisition of Artificial Intelligence in

Government,” April 3, 2025.

47. OMB Memorandum M-26-04, “Increasing Public Trust in Artificial Intelligence (AI)

Through Unbiased AI Principles,” December 11, 2025.

3.0 SCOPE OF WORK

The Contractor shall provide the necessary labor, materials, and travel to perform frequency coordination, registration, and allocation services for WMT devices at all VA medical facilities. VA requires a national approach to coordinate deployment, registration, and management service of high band frequency transmitters throughout VA Medical Centers. The contractor shall provide support services for VA Enterprise Frequency Coordination Registration.

4.0 PERFORMANCE DETAILS

4.1 PERFORMANCE PERIOD

The PoP shall be 60 months from the date of award.

There are Eleven (11) Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, five are set by date:

New Year's Day January 1 Juneteenth June 19 Independence Day July 4 Veterans Day November 11 Christmas Day December 25

If any of the above falls on a Saturday, then Friday shall be observed as a holiday.

Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

https://www.cisa.gov/news-events/directives/bod-23-01-improving-asset-visibility-and-vulnerability-detection-federal-networks https://www.cisa.gov/news-events/directives/bod-23-01-improving-asset-visibility-and-vulnerability-detection-federal-networks https://www.voa.va.gov/DocumentView.aspx?DocumentID=5010 https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-21-Accelerating-Federal-Use-of-AI-through-Innovation-Governance-and-Public-Trust.pdf https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-22-Driving-Efficient-Acquisition-of-Artificial-Intelligence-in-Government.pdf https://www.whitehouse.gov/wp-content/uploads/2025/12/M-26-04-Increasing-Public-Trust-in-Artificial-Intelligence-Through-Unbiased-AI-Principles-1.pdf?_bhlid=c0113a16495d987bc33f63e3dccf35c28d6bfd15

Martin Luther King's Birthday Third Monday in January Washington's Birthday Third Monday in February Memorial Day Last Monday in May Labor Day First Monday in September Columbus Day Second Monday in October Thanksgiving Fourth Thursday in November

4.2 PLACE OF PERFORMANCE

Tasks under this PWS shall be performed at Contractor facilities. The Contractor shall identify the Contractor’s place of performance in their proposal submission.

5.0 SPECIFIC TASKS AND DELIVERABLES

5.1 WMTS FREQUENCY BAND ASSIGNMENT

The contractor shall provide WMTS frequency coordination, registration, and allocation services in accordance with FCC regulations and ASHE/AHA guidance. The contractor shall respond to VA requests for assignments in one of the WMTS bands with a specific range of frequencies to use at that physical location. The contractor shall cite the FCC and ASHE/AHA guidance. The Government’s request will be supporting a specific number of transmitters at a specific geographical area. A WMTS transmitter is any device that transmits on a frequency in the WMTS bands (608-614 megahertz (MHz), 1395-1400 MHz, and 1427-1432 MHz). A unit is defined as a single WMTS transmitter, e.g., patient-worn transmitters, fixed access points, or other devices that transmit in the WMTS bands.

The contractor shall be familiar with Federal information technology and telecommunications security requirements and is expected to research Federal information technology and telecommunications requirements and best practices as part of the effort. The contractor shall be responsible for ensuring all WMTS parameters that are authorized for the given transmitter(s) comply with FCC’s guidelines for frequency coordination and assignment.

Deliverable:

WMTS frequency coordination, registration, and allocation.

6.0 GENERAL REQUIREMENTS

6.1 ENTERPRISE AND IT FRAMEWORK

6.1.1 VA TECHNICAL REFERENCE MODEL

The Contractor shall comply with the VA OIT Technical Reference Model (VA TRM).

Compliance with the VA TRM is achieved by using only technologies and standards that are listed as approved for use in the VA TRM. The Contractor shall provide all necessary information requested by VA to ensure TRM approval is obtained prior to use on VA’s network.

6.1.2 ZERO TRUST – VA CRITICAL SECURITY CONTROLS

VA has established minimum mandatory security requirements and requires that any network connected software system or service must meet the VA Critical Security Controls as outlined in the VA Memorandum, “VA Security Controls”, https://www.voa.va.gov/DocumentView.aspx?DocumentID=5010. VA Critical Security Controls identify the minimum mandatory requirements that must be implemented across all VA enterprise infrastructure, cloud computing environments, information systems, networks, and specialized devices (medical devices/systems, special-purpose systems, and research scientific computing devices) that process, store, and/or transmit VA data. Effective July 1, 2025, the Contractor shall implement these VA Critical Security Controls, within any network connected software system or service prior to being authorized for use in the VA. This functional requirement is not negotiable, and Plan of Action & Milestones (POAM) will not be accepted in the event these controls cannot be implemented for new systems. Critical Security Controls are intended to increase VA’s security posture and provide security and privacy risk visibility into the VA network and is not a new requirement. The Contractor’s failure to maintain these VA Critical Controls after implementation will result in VA discontinuing the use of the system.

6.1.3 INTERNET PROTOCOL VERSION 6 (IPv6)

The Contractor solution shall support IPv6-Only based upon the memo issued by the Office of Management and Budget (OMB) on November 19, 2020 (https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-07.pdf). Which defines IPv6-only as the state of an operational system or service when IPv4 protocol functions (addressing, packet forwarding) are not in use. The NIST USGv6 profile defines technical requirements for a product to be capable of operating in IPv6-Only environments. IPv6-Only technology, in accordance with the USGv6 Program (https://www.nist.gov/programs-projects/usgv6-program/usgv6-revision-1), NIST Special Publication (SP) 500-267B Revision 1 “USGv6 Profile” (https://doi.org/10.6028/NIST.SP.500-267Br1), and NIST SP 800-119 “Guidelines for the Secure Deployment of IPv6” (https://doi.org/10.6028/NIST.SP.800-119), compliance shall be included in all IT infrastructures, application designs, application development, operational systems and sub-systems, and their integration. In addition to the above requirements, all devices, applications, and systems shall support all applicable functionality on native IPv6-Only as well as dual stack (IPv6 / IPv4) connectivity without additional memory or other resources being provided by the Government, so that they can function in a mixed environment. All public/external facing servers and services (e.g., web, email, DNS, ISP services, etc.) shall support native IPv6-Only and dual stack (IPv6 / IPv4) users and all internal infrastructure and applications shall support using native IPv6-Only and dual stack (IPv6 / IPv4) for all functionality and operations.

https://www.voa.va.gov/DocumentView.aspx?DocumentID=5010 https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-07.pdf https://www.nist.gov/programs-projects/usgv6-program/usgv6-revision-1 https://doi.org/10.6028/NIST.SP.500-267Br1 https://doi.org/10.6028/NIST.SP.800-119

6.1.4 TRUSTED INTERNET CONNECTION (TIC)

The Contractor solution shall meet the requirements outlined in Office of Management and Budget Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative“ (https://www.whitehouse.gov/wp-content/uploads/2019/09/M-19-26.pdf), VA Directive 6513 “Secure External Connections”, and shall comply with the TIC 3.0 Core Guidance Documents, including all Volumes and TIC Use Cases, found at the Cybersecurity & Infrastructure Security Agency (CISA) (https://www.cisa.gov/publication/tic-30-core-guidance-documents).

6.1.5 SOCIAL SECURITY NUMBER (SSN) REDUCTION

The Contractor solution shall support the Social Security Number (SSN) Fraud Prevention Act (FPA) of 2017 which prohibits the inclusion of SSNs on any document sent by mail. The Contractor support shall also be performed in accordance with Section 240 of the Consolidated Appropriations Act (CAA) 2018, enacted March 23, 2018, which mandates VA to discontinue using SSNs to identify individuals in all VA information systems as the Primary Identifier. The Contractor shall ensure that any new IT solution discontinues the use of SSN as the Primary Identifier to replace the SSN with the ICN in all VA information systems for all individuals. The Contractor shall ensure that all Contractor delivered applications and systems integrate with the VA MPI for identity traits to include the use of the ICN as the Primary Identifier. The Contractor solution may only use a Social Security Number to identify an individual in an information system if and only if the use of such number is required to obtain information VA requires from an information system that is not under the jurisdiction of

VA.

6.1.6 GENERATIVE ARTIFICIAL INTELLIGENCE REQUIREMENTS

If Artificial Intelligence (AI) is part of the Contractor system/solution, the Contractor shall be in compliance with E.O. 13960 and 14319, OMB Memorandums M-25-21, M-25-22, and M-26-04, and VA Directive and Handbook 6500 to support VA in trustworthy, secure, responsible, accountable, Truth Seeking, and Ideologically Neutral AI innovation.

No web-based, publicly available generative AI service has been approved for use with VA-sensitive data including, but not limited to OpenAI’s ChatGPT, Microsoft’s Copilot, Google’s Gemini, and Anthropic’s Claude. No PII, protected health information (PHI), or VA-sensitive data should be entered into these unapproved services. The entire definition of VA Sensitive Data can be found at 38 U.S.C. § 5727 (23). The Contractor shall protect VA Sensitive data from unauthorized disclosure or use, and from being used to train or improve the functionality of the vendor's commercial offerings without express permission from VA. Only VA-hosted instances of generative AI services may be approved for use with VA-sensitive data.

The Contractor shall deliver the services, technical data, configurations, models, weights, documentation or other information, including source code, developed during https://www.whitehouse.gov/wp-content/uploads/2019/09/M-19-26.pdf https://www.cisa.gov/publication/tic-30-core-guidance-documents contract performance. The Contractor, in collaboration with VA, must evaluate the output of any AI tool for accuracy prior to using the output in VA efforts. All data, including models, weights, algorithms, and outputs generated using either Government-furnished data or data first developed under this contract shall be the property of the Government with unlimited rights as defined by FAR 52.227-14. The Contractor shall also deliver any custom-developed code developed with AI methodologies in accordance with the SHARE IT Act, if applicable. VA shall also retain unlimited rights to any improvements to that data, including the continued design, development, testing, and operation of AI systems and/or systems utilizing AI.

The Contractor shall ensure that all AI Systems, including Large Language Models (LLM), whether standalone LLMs or integrated into broader software platforms, procured under this effort and/or used in performance of this contract complies with the Unbiased AI Principles as defined in Executive Order 14319 and OMB Memorandum M- 26-04, e.g. Truth Seeking and Ideologically Neutral, as applicable to the intended use of the system.

The Contractor shall ensure that AI System/LLM generated outputs are truthful in responding to user prompts seeking factual information or analysis, prioritize historical accuracy, scientific inquiry, and objectivity, as well as acknowledge uncertainty where reliable information is incomplete or contradictory and do not fabricate, hallucinate, or present unverifiable information as fact.

The Contractor shall ensure that LLMs and AI outputs are neutral, nonpartisan tools that do not manipulate responses in favor of ideological dogmas such as Diversity, Equity, and Inclusion (DEI). The Contractor shall ensure that the LLMs, including the AI System, are not intentionally encoded with partisan or ideological judgments within an AI System’s/LLM’s outputs unless those judgments are prompted by or otherwise readily accessible to the end user.

Compliance with the AI requirements of this contract, including adherence to the Unbiased AI Principles, Truth-Seeking and Ideological Neutrality requirements, disclosure obligations, monitoring and reporting requirements, and corrective action responsibilities, is a material condition of eligibility for payment and continued performance. In accordance with OMB Memorandum M-26-04, failure to comply with these requirements, or refusal to take timely and appropriate corrective action to remedy identified noncompliance, may constitute a material breach of contract and may result in remedies consistent with the terms of the contract and applicable law including but not limited to withholding of payment, termination for cause/default, or other appropriate contractual remedies, as determined by the Contracting Officer.

All AI for delivery and/or use in performance of the contract shall adhere to the VA Trustworthy AI Framework, available at https://department.va.gov/ai/trustworthy/. Once the Contractor has obtained CO authorization to use specific AI in contract performance, the Contractor shall provide the Contracting Officer’s Representative (COR) a signed Statement of Attestation prior to AI implementation as identified in the https://department.va.gov/ai/trustworthy/

Artificial Intelligence in VA Contracts clause, to include its associated list of AI being used in contract performance.

Deliverable:

Statement of Attestation.

6.2 METHOD AND DISTRIBUTION OF DELIVERABLES AND GOVERNMENT

TECHNICAL POINT OF CONTACT

The Contractor shall deliver documentation in electronic format. Acceptable electronic media include: Microsoft 365 suite, MS Word, MS Excel, MS PowerPoint, MS Project, MS Access, MS Visio, AutoCAD, and Adobe Postscript Data Format (PDF).

All deliverables shall be delivered to the Government’s technical Point of Contact:

Name:

Address:

Phone:

Email:

6.3 PERFORMANCE METRICS

The table below defines the Performance Standards and Acceptable Levels of Performance associated with this effort.

Performance Objective Performance Standard

Acceptable Levels of Performance

A. Technical / Quality of Product or Service

1. Demonstrates understanding of requirements.

2. Efficient and effective in meeting requirements.

3. Meets technical needs and mission requirements.

4. Provides quality services/products.

5. Incorporates “ease of use” Human Centered Design principles in any software developed.

Satisfactory or higher

B. Project Milestones and Schedule

1. Established milestones and project dates are met.

2. Products completed, reviewed, delivered in accordance with the established schedule.

Satisfactory or higher

Performance

Objective Performance Standard Acceptable Levels of

Performance

3. Notifies customer in advance of potential problems.

C. Cost & Staffing 1. Currency of expertise and staffing levels appropriate to perform tasks required.

2. Personnel possess necessary knowledge, skills and abilities to perform tasks.

Satisfactory or higher

D. Management 1. Integration and coordination of all activities to execute effort.

Satisfactory or higher

The Contracting Officer’s Representative (COR) will use a Quality Assurance Surveillance Plan (QASP) throughout the life of the contract to ensure that the Contractor is performing the services required by this PWS in an acceptable level of performance. The Government reserves the right to alter or change the surveillance methods in the QASP at its own discretion. A Performance Based Service Assessment will be used by the COR in accordance with the QASP to assess Contractor performance.

6.4 GOVERNMENT FURNISHED PROPERTY

The Government does not anticipate providing any Government furnished property, material, equipment, or information.

ADDENDUM A – ADDITIONAL VA REQUIREMENTS, CONSOLIDATED

A1.0 Cyber and Information Security Requirements for VA IT Services

The Contractor shall ensure adequate LAN/Internet, data, information, and system security in accordance with VA standard operating procedures and standard PWS language, conditions, laws, and regulations. The Contractor’s firewall and web server shall meet or exceed VA minimum requirements for security. All VA data shall be protected behind an approved firewall. Any security violations or attempted violations shall be reported to the VA Program Manager and VA Information Security Officer as soon as possible. The Contractor shall follow all applicable VA policies and procedures governing information security, especially those that pertain to assessment and authorization and continuous monitoring.

Contractor supplied equipment, PCs of all types, equipment with hard drives, etc. for contract services must meet all security requirements that apply to Government Furnished Equipment (GFE) and Government Owned Equipment (GOE). Security Requirements include a) VA Approved Encryption Software must be installed on all laptops or mobile devices before being placed into operation, b) Bluetooth equipped devices are prohibited within VA; Bluetooth must be permanently disabled or removed from the device, unless the connection uses FIPS 140-2 (or its successor) validated encryption, c) VA approved anti-virus and firewall software, d) Equipment must meet all VA sanitization requirements and procedures before disposal. The Contractor shall notify the Contracting Officer’s Representative (if one is assigned) and Contracting Officer within one hour of disclosure or successful exploits of any vulnerability which can compromise the confidentiality, integrity, or availability of the information systems.

Each documented initiative under this contract incorporates VA Handbook 6500.6, “Contract Security,” March 12, 2010 (Appendix C updated April 22, 2024) by reference as though fully set forth therein. The VA Handbook 6500.6, “Contract Security” shall also be included in every related agreement, contract, or order. The VA Handbook 6500.6, Appendix C, is included in this document as Addendum B.

Training requirements: The Contractor shall complete all mandatory training courses on the current VA training site, the VA Talent Management System (TMS) 2.0, and will be tracked therein. The TMS 2.0 may be accessed at https://www.tms.va.gov/SecureAuth35/. If you do not have a TMS 2.0 profile, go to https://www.tms.va.gov/SecureAuth35/ and click on the “Create New User” link on the TMS 2.0 to gain access.

Contractor employees shall complete a VA Systems Access Agreement if they are provided access privileges as an authorized user of the computer system of VA.

A2.0 VA Enterprise Architecture Compliance

The applications, supplies, and services furnished under this contract must comply with VA Enterprise Architecture (EA), available at http://www.ea.oit.va.gov/index.asp in force https://www.tms.va.gov/SecureAuth35/ https://www.tms.va.gov/SecureAuth35/ http://www.ea.oit.va.gov/index.asp at the time of issuance of this contract, including the Program Management Plan and VA's rules, standards, and guidelines in the Technical Reference Model/Standards Profile (TRMSP). VA reserves the right to assess contract deliverables for EA compliance prior to acceptance.

A2.1. VA Internet and Intranet Standards

The Contractor shall adhere to and comply with VA Directive 6102 and VA’s Web Governance if the Contractor’s work includes building and maintaining VA’s digital presence. This pertains, but is not limited to: websites, social media, creating announcements; collecting information; databases to be accessed, graphics and links to external sites.

Internet/Intranet Services Directive 6102 is posted at (copy and paste the following URL to browser): https://www.va.gov/vapubs/viewPublication.asp?Pub_ID=1056&FType=2

VA Web Governance website can be found at Home - VA Web Governance.

A3.0 Notice of the Federal Accessibility Law Affecting All Information and

Communication Technology (ICT) Procurements (Section 508)

On January 18, 2017, the Access Board issued a final rule that updated accessibility requirements covered by Section 508 and refreshed guidelines for telecommunications equipment subject to Section 255 of the Communications Act. The final rule went into effect on January 18, 2018. The revisions and updates to the Section 508-based standards and Section 255-based guidelines are intended to ensure that information and communication technology (ICT) covered by the respective statutes is accessible to and usable by individuals with disabilities.

A3.1. Section 508 – Information and Communication Technology (ICT) Standards

The Section 508 standards established by the Access Board are incorporated into, and made part of all VA orders, solicitations and purchase orders developed to procure ICT.

These standards are found in their entirety at: Revised 508 Standards and 255 Guidelines (access-board.gov). A single PDF file version of the Revised Section 508 Standards and 255 Guidelines will be supplied upon request, or can be obtained from the Access Board website. Federal agencies must comply with the Rehabilitation Act of 1973, as amended.

The Contractor shall comply with “508 Chapter 2: Scoping Requirements” for all electronic ICT and content delivered under this contract. Specifically, as appropriate for the technology and its functionality, the Contractor shall comply with the technical standards marked here:

☒ E205 Electronic Content – (Accessibility Standard -WCAG 2.0 Level A and AA Guidelines) https://www.va.gov/vapubs/viewPublication.asp?Pub_ID=1056&FType=2 https://digital.va.gov/web-governance/ https://www.access-board.gov/ict/ https://www.access-board.gov/ict/

☒ E204 Functional Performance Criteria ☐ E206 Hardware Requirements ☐ E207 Software Requirements ☒ E208 Support Documentation and Services Requirements

A3.2. Compatibility with Assistive Technology

The standards do not require installation of specific accessibility-related software or attachment of an assistive technology device. Section 508 requires that ICT be compatible with such software and devices so that ICT can be accessible to and usable by individuals using assistive technology, including but not limited to screen readers, screen magnifiers, and speech recognition software.

A3.3. Acceptance and Acceptance Testing

Deliverables resulting from this solicitation will be accepted based in part on satisfaction of the Section 508 Chapter 2: Scoping Requirements standards identified above.

The Government reserves the right to test for Section 508 Compliance before delivery.

The Contractor shall be able to demonstrate Section 508 Compliance upon delivery.

A4.0 Physical Security & Safety Requirements:

The Contractor and their personnel shall follow all VA policies, standard operating procedures, applicable laws and regulations while on VA property. Violations of VA regulations and policies may result in citation and disciplinary measures for persons violating the law.

1. The Contractor and their personnel shall wear visible identification at all times while they are on the premises.

2. VA does not provide parking spaces at the work site; the Contractor must obtain parking at the work site if needed. It is the responsibility of the Contractor to park in the appropriate designated parking areas. VA will not invalidate or make reimbursement for parking violations of the Contractor under any conditions.

3. Smoking is prohibited inside/outside any building other than the designated smoking areas.

4. Possession of weapons is prohibited.

5. The Contractor shall obtain all necessary licenses and/or permits required to perform the work, with the exception of software licenses that need to be procured from a Contractor or vendor in accordance with the requirements document. The Contractor shall take all reasonable precautions necessary to protect persons and property from injury or damage during the performance of this contract.

A5.0 Confidentiality and Non-Disclosure

The Contractor shall follow all VA rules and regulations regarding information security to prevent disclosure of sensitive information to unauthorized individuals or organizations.

The Contractor may have access to Protected Health Information (PHI) and Electronic Protected Health Information (ePHI) that is subject to protection under the regulations issued by the Department of Health and Human Services, as mandated by the Health Insurance Portability and Accountability Act of 1996 (HIPAA); 45 CFR Parts 160 and 164, Subparts A and E, the Standards for Privacy of Individually Identifiable Health Information (“Privacy Rule”); and 45 CFR Parts 160 and 164, Subparts A and C, the Security Standard (“Security Rule”). Pursuant to the Privacy and Security Rules, the Contractor must agree in writing to certain mandatory provisions regarding the use and disclosure of PHI and ePHI.

1. The Contractor will have access to some privileged and confidential materials of VA.

These printed and electronic documents are for internal use only, are not to be copied or released without permission, and remain the sole property of VA. Some of these materials are protected by the Privacy Act of 1974 (revised by PL 93-5791) and Title 38. Unauthorized disclosure of Privacy Act or Title 38 covered materials is a criminal offense.

2. The VA CO will be the sole authorized official to release in writing, any data, draft deliverables, final deliverables, or any other written or printed materials pertaining to this contract. The Contractor shall release no information. Any request for information relating to this contract presented to the Contractor shall be submitted to the VA CO for response.

3. Contractor personnel recognize that in the performance of this effort, Contractor personnel may receive or have access to sensitive information,…