S02 - 36C25623Q1542_1_Network Software System RFQ.pdf

36C25623Q1542

COMBINED SYNOPSIS/SOLICITATION FOR COMMERCIAL ITEMS

General Information:

Document Type: Combined Solicitation/Synopsis Solicitation Number: 36C25623Q1542

Posted Date: September 20,2023 Questions Due Date/Time: September 25, 2023/13:00pm (CST) Response Due Date/Time: September 26, 2023/2:00pm (CST Product or Service Code: DA10 Set Aside: Sole source.

NAICS Code: 541519 Size Standard $34.0 Million Point of Contact: Justin Clark – Email: justin.clark2@va.gov

Contracting Office Address Department of Veterans Affairs Network Contracting Office 16 Michael E. DeBakey VA Medical Center (MEDVAMC) 5075 Westheimer Road Ste. 750 Houston, TX 77056

Description This is a combined synopsis/solicitation for commercial items prepared in accordance with the format in Federal Acquisition Regulation (FAR) subpart 12.6, “Streamlined Procedures for

Evaluation and Solicitation for Commercial Items,” in conjunction with FAR Part 13.5 Simplified

Procedures for Certain Commercial Products and Commercial Services, as supplemented with additional information included in this notice. This announcement constitutes the only solicitation; quotes are being requested, and a written solicitation document will not be issued.

This solicitation is issued as a Request for Quotation (RFQ). The solicitation document and incorporated provisions and clauses are those in effect through Federal Acquisition Circular:

2023-05, 09-07-2023. This solicitation is being issued as a sole source.

The associated North American Industrial Classification System (NAICS) code for this procurement is 541519, with a small business size standard of $34.0 million.

The Department of Veterans Affairs (VA), Michael E. DeBakey VA Medical Center (MEDVAMC),5075 Westheimer Road Ste. 750 Houston, TX 77056 is requesting to procure a Media Lab Document Control System. This is a sole source. See B.3 Price/Cost Schedule/B.2 Statement of Work (SOW) for details of the Government’s requirement.

Table of Contents

SECTION B - CONTINUATION CONTRACT OPPORTUNITIES COMBINED SYNOPSIS

SOLICITATION

B.1 CONTRACT ADMINISTRATION DATA

B.2 PRICE/COST SCHEDULE

B.3 DELIVERY SCHEDULE

SECTION C - CONTRACT CLAUSES

C.1 52.252-2 CLAUSES INCORPORATED BY REFERENCE (FEB 1998)

C.2 VAAR 852.203-70 COMMERCIAL ADVERTISING (MAY 2018)

C.3 VAAR 852.211-70 EQUIPMENT OPERATION AND MAINTENANCE MANUALS

(NOV 2018)

C.4 VAAR 852.211-72 TECHNICAL INDUSTRY STANDARDS (NOV 2018)

C.5 VAAR 852.212-72 GRAY MARKET AND COUNTERFEIT ITEMS— INFORMATION

TECHNOLOGY MAINTENANCE ALLOWING OTHER-THAN-NEW PARTS (FEB 2023)

C.6 VAAR 852.219-75 VA NOTICE OF LIMITATIONS ON SUBCONTRACTING—

CERTIFICATE OF COMPLIANCE FOR SERVICES AND CONSTRUCTION (JAN 2023)

(DEVIATION)

C.7 VAAR 852.232-72 ELECTRONIC SUBMISSION OF PAYMENT REQUESTS (NOV

2018)

C.8 VAAR 852.239-70 SECURITY REQUIREMENTS FOR INFORMATION

TECHNOLOGY RESOURCES (FEB 2023)

C.9 VAAR 852.239-73 INFORMATION SYSTEM HOSTING, OPERATION,

MAINTENANCE, OR USE (FEB 2023)

C.10 VAAR 852.239-76 INFORMATION AND COMMUNICATION TECHNOLOGY

ACCESSIBILITY (FEB 2023)

C.11 VAAR 852.242-71 ADMINISTRATIVE CONTRACTING OFFICER (OCT 2020)

C.12 VAAR 852.246-71 REJECTED GOODS (OCT 2018)

C.13 VAAR 852.247-71 DELIVERY LOCATION (OCT 2018)

SECTION D - CONTRACT DOCUMENTS, EXHIBITS, OR ATTACHMENTS

D.1 STATEMENT OF WORK

D.2 INFORMATION SECURITY IN ACCORDANCE WITH VA HANDBOOK 6500.6

Appendix C

D.3 VETERANS AFFAIRS VETERANS (VHA) BUSINESS ASSOCIATE AGREEMENT

(BAA)

D.4 JUSTIFICATION AND APPROVAL (JA) REDACTED

SECTION E - SOLICITATION PROVISIONS

E.1 52.252-1 SOLICITATION PROVISIONS INCORPORATED BY REFERENCE (FEB

1998)

E.2 52.204-24 REPRESENTATION REGARDING CERTAIN TELECOMMUNICATIONS

AND VIDEO SURVEILLANCE SERVICES OR EQUIPMENT (NOV 2021) [Completed by

Offeror]

E.3 52.227-15 REPRESENTATION OF LIMITED RIGHTS DATA AND RESTRICTED

COMPUTER SOFTWARE (DEC 2007) [Completed by Offeror]

E.4 VAAR 852.239-71 INFORMATION SYSTEM SECURITY PLAN AND

ACCREDITATION (FEB 2023)

E.5 VAAR 852.239-75 INFORMATION AND COMMUNICATION TECHNOLOGY

ACCESSIBILITY NOTICE (FEB 2023)

E.6 52.212-2 EVALUATION—COMMERCIAL PRODUCTS AND COMMERCIAL

SERVICES (NOV 2021)

E.6 52.212-3 OFFEROR REPRESENTATIONS AND CERTIFICATIONS—

COMMERCIAL PRODUCTS AND COMMERCIAL SERVICES (DEC 2022) [Completed by Offeror]

SECTION B - CONTINUATION CONTRACT OPPORTUNITIES

COMBINED SYNOPSIS SOLICITATION

B.1 CONTRACT ADMINISTRATION DATA

(Continuation from Combined Synopsis Solicitation)

1. Contract Administration: All contract administration matters will be handled by the following individual:

[Completed by Offeror]

a. CONTRACTOR: Company Name:

ATTN/POC Name:

Address:

Phone:

Email:

UEI:

Tax ID:

GSA/FSS, NAC, SEWP Contract# (if applicable):

b. GOVERNMENT: Contracting Officer 36C256

Department of Veterans Affairs Network Contracting Office 16 Galleria Financial Center 5075 Westheimer Road, Suite 750 Houston TX 77056-5643

2. CONTRACTOR REMITTANCE ADDRESS: All payments by the Government to the contractor will be made in accordance with:

a. 52.232-33 Payment by Electronic Funds Transfer - System for Award

Management through TUNGSTEN

3. INVOICES: Invoices shall be submitted in arrears:

b. Other: Upon receipt and acceptance by the Government

4. GOVERNMENT INVOICE ADDRESS: All Invoices from the contractor shall be submitted electronically in accordance with VAAR Clause 852.232-72 Electronic Submission of

Payment Requests.

5. Offeror shall complete the following located in Sections B thru E of this solicitation to be deemed eligible:

a. Section B- CONTRACT ADMINISTRATION DATA, CONTRACTOR contact information.

b. Section B- PRICE/COST SCHEDULE, unit price, amount, and grand total

c. Section C- 852.219-75 VA NOTICE OF LIMITATIONS ON SUBCONTRACTING

– CERTIFICATE OF COMPLIANCE FOR SERVICES

d. Section E- 52.204-24 REPRESENTATION REGARDING CERTAIN

TELECOMMUNICATIONS AND VIDEO SURVEILLANCE SERVICES OR

EQUIPMENT

e. Section E- E.3 52.227-15 REPRESENTATION OF LIMITED RIGHTS DATA AND

RESTRICTED COMPUTER SOFTWARE (DEC 2007)

f. Section E- 52.212-3 OFFEROR REPRESENTATIONS AND CERTIFICATIONS

6. ACKNOWLEDGMENT OF AMENDMENTS: The offeror acknowledges receipt of amendments to the Solicitation numbered and dated as follows:

AMENDMENT NO DATE

N/A N/A

(End of Contract Administration Data)

B.2 PRICE/COST SCHEDULE

ITEM INFORMATION [Completed by Offeror]

ITEM

DESCRIPTION OF

SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

1.00 EA __________________ __________________

Document Control: 250 users [Federal]

Contract Period: Base POP Begin: 10-01-2023 POP End: 09-30-2024 PRINCIPAL NAICS CODE: 541519 - Other Computer Related Services PRODUCT/SERVICE CODE: DA10 - IT and Telecom - Business Application/Application Development Software as A Service

LOCAL STOCK NUMBER: NA

InspectionProof - up to ten CLIA numbers [Federal]

Contract Period: Base POP Begin: 10-01-2023 POP End: 09-30-2024 PRINCIPAL NAICS CODE: 541519 - Other Computer Related Services PRODUCT/SERVICE CODE: DA10 - IT and Telecom - Business

Compliance & CE: 250 users [Federal]

Contract Period: Base POP Begin: 10-01-2023 POP End: 09-30-2024 PRINCIPAL NAICS CODE: 541519 - Other Computer Related Services PRODUCT/SERVICE CODE: DA10 - IT and Telecom - Business

Personnel Documentation: 250 users [Federal]

Contract Period: Base POP Begin: 10-01-2023 POP End: 09-30-2024 PRINCIPAL NAICS CODE: 541519 - Other Computer Related Services PRODUCT/SERVICE CODE: DA10 - IT and Telecom - Business

Compass: 250 users [Federal]

Contract Period: Base POP Begin: 10-01-2023 POP End: 09-30-2024 PRINCIPAL NAICS CODE: 541519 - Other Computer Related Services

PRODUCT/SERVICE CODE: DA10 - IT and Telecom - Business Application/Application Development Software as A Service

Histology Compliance & CE: 25 users [Federal]

Contract Period: Base POP Begin: 10-01-2023 POP End: 09-30-2024 PRINCIPAL NAICS CODE: 541519 - Other Computer Related Services PRODUCT/SERVICE CODE: DA10 - IT and Telecom - Business

IQE - CAPA: 10-14 CLIA Lincenses, 30 forms [Federal]

Contract Period: Base POP Begin: 10-01-2023 POP End: 09-30-2024 PRINCIPAL NAICS CODE: 541519 - Other Computer Related Services PRODUCT/SERVICE CODE: DA10 - IT and Telecom - Business

125.00 EA __________________ __________________

Exam Simulator (Group price)

Contract Period: Base POP Begin: 10-01-2023 POP End: 09-30-2024 PRINCIPAL NAICS CODE: 541519 - Other Computer Related Services PRODUCT/SERVICE CODE: DA10 - IT and Telecom - Business

60.00 EA __________________ __________________

Phlebotomy Exam Simulator (Group price)

Contract Period: Base POP Begin: 10-01-2023 POP End: 09-30-2024 PRINCIPAL NAICS CODE: 541519 - Other Computer Related Services PRODUCT/SERVICE CODE: DA10 - IT and Telecom - Business

14.00 EA __________________ __________________

NSH + LabCE Histology Exam Simulator

Contract Period: Base POP Begin: 10-01-2023 POP End: 09-30-2024 PRINCIPAL NAICS CODE: 541519 - Other Computer Related Services PRODUCT/SERVICE CODE: DA10 - IT and Telecom - Business

White Blood Cell Differential Simulator: 25 users

Contract Period: Base POP Begin: 10-01-2023 POP End: 09-30-2024 PRINCIPAL NAICS CODE: 541519 - Other Computer Related Services PRODUCT/SERVICE CODE: DA10 - IT and Telecom - Business

Advanced White Blood Cell Differential Simulator: 25 users

Contract Period: Base POP Begin: 10-01-2023 POP End: 09-30-2024 PRINCIPAL NAICS CODE: 541519 - Other Computer Related Services PRODUCT/SERVICE CODE: DA10 - IT and Telecom - Business

Red Blood Cell Morphology Case Simulator: 25 users

Contract Period: Base POP Begin: 10-01-2023 POP End: 09-30-2024 PRINCIPAL NAICS CODE: 541519 - Other Computer Related Services PRODUCT/SERVICE CODE: DA10 - IT and Telecom - Business

Body Fluid Case Simulator: 25 users

Contract Period: Base POP Begin: 10-01-2023 POP End: 09-30-2024 PRINCIPAL NAICS CODE: 541519 - Other Computer Related Services PRODUCT/SERVICE CODE: DA10 - IT and Telecom - Business

Urinalysis Case Simulator: 25 users

Contract Period: Base POP Begin: 10-01-2023 POP End: 09-30-2024 PRINCIPAL NAICS CODE: 541519 - Other Computer Related Services PRODUCT/SERVICE CODE: DA10 - IT and Telecom - Business

Single sign-on connection

Contract Period: Base

POP Begin: 10-01-2023 POP End: 09-30-2024 PRINCIPAL NAICS CODE: 541519 - Other Computer Related Services PRODUCT/SERVICE CODE: DA10 - IT and Telecom - Business Application/Application Development Software as A Service

Premium Support

Contract Period: Base POP Begin: 10-01-2023 POP End: 09-30-2024 PRINCIPAL NAICS CODE: 541519 - Other Computer Related Services PRODUCT/SERVICE CODE: DA10 - IT and Telecom - Business

BASE YEAR ORDERING TOTAL:

Contract Period: Option 1 POP Begin: 10-01-2024 POP End: 09-30-2025 PRINCIPAL NAICS CODE: 541519 - Other Computer Related Services PRODUCT/SERVICE CODE: DA10 - IT and Telecom - Business

Contract Period: Option 1 POP Begin: 10-01-2024 POP End: 09-30-2025 PRINCIPAL NAICS CODE: 541519 - Other Computer Related Services PRODUCT/SERVICE CODE: DA10 - IT and Telecom - Business

Contract Period: Option 1 POP Begin: 10-01-2024 POP End: 09-30-2025 PRINCIPAL NAICS CODE: 541519 - Other Computer Related Services PRODUCT/SERVICE CODE: DA10 - IT and Telecom - Business

Contract Period: Option 1 POP Begin: 10-01-2024

POP End: 09-30-2025 PRINCIPAL NAICS CODE: 541519 - Other Computer Related Services PRODUCT/SERVICE CODE: DA10 - IT and Telecom - Business Application/Application Development Software as A Service

Contract Period: Option 1 POP Begin: 10-01-2024 POP End: 09-30-2025 PRINCIPAL NAICS CODE: 541519 - Other Computer Related Services PRODUCT/SERVICE CODE: DA10 - IT and Telecom - Business

Contract Period: Option 1 POP Begin: 10-01-2024 POP End: 09-30-2025 PRINCIPAL NAICS CODE: 541519 - Other Computer Related Services PRODUCT/SERVICE CODE: DA10 - IT and Telecom - Business

Contract Period: Option 1 POP Begin: 10-01-2024 POP End: 09-30-2025 PRINCIPAL NAICS CODE: 541519 - Other Computer Related Services PRODUCT/SERVICE CODE: DA10 - IT and Telecom - Business

Contract Period: Option 1 POP Begin: 10-01-2024 POP End: 09-30-2025 PRINCIPAL NAICS CODE: 541519 - Other Computer Related Services PRODUCT/SERVICE CODE: DA10 - IT and Telecom - Business

Contract Period: Option 1 POP Begin: 10-01-2024 POP End: 09-30-2025

PRODUCT/SERVICE CODE: DA10 - IT and Telecom - Business Application/Application Development Software as A Service

Contract Period: Option 1 POP Begin: 10-01-2024 POP End: 09-30-2025 PRINCIPAL NAICS CODE: 541519 - Other Computer Related Services PRODUCT/SERVICE CODE: DA10 - IT and Telecom - Business

Contract Period: Option 1 POP Begin: 10-01-2024 POP End: 09-30-2025 PRINCIPAL NAICS CODE: 541519 - Other Computer Related Services PRODUCT/SERVICE CODE: DA10 - IT and Telecom - Business

Contract Period: Option 1 POP Begin: 10-01-2024 POP End: 09-30-2025 PRINCIPAL NAICS CODE: 541519 - Other Computer Related Services PRODUCT/SERVICE CODE: DA10 - IT and Telecom - Business

Contract Period: Option 1 POP Begin: 10-01-2024 POP End: 09-30-2025 PRINCIPAL NAICS CODE: 541519 - Other Computer Related Services PRODUCT/SERVICE CODE: DA10 - IT and Telecom - Business

Contract Period: Option 1 POP Begin: 10-01-2024 POP End: 09-30-2025 PRINCIPAL NAICS CODE: 541519 - Other Computer Related Services PRODUCT/SERVICE CODE: DA10 - IT and Telecom - Business

Contract Period: Option 1 POP Begin: 10-01-2024 POP End: 09-30-2025 PRINCIPAL NAICS CODE: 541519 - Other Computer Related Services PRODUCT/SERVICE CODE: DA10 - IT and Telecom - Business

Contract Period: Option 1 POP Begin: 10-01-2024 POP End: 09-30-2025 PRINCIPAL NAICS CODE: 541519 - Other Computer Related Services PRODUCT/SERVICE CODE: DA10 - IT and Telecom - Business

Contract Period: Option 1 POP Begin: 10-01-2024 POP End: 09-30-2025 PRINCIPAL NAICS CODE: 541519 - Other Computer Related Services PRODUCT/SERVICE CODE: DA10 - IT and Telecom - Business

OPTION YEAR 1 ORDERING TOTAL:

Contract Period: Option 2 POP Begin: 10-01-2025 POP End: 09-30-2026 PRINCIPAL NAICS CODE: 541519 - Other Computer Related Services PRODUCT/SERVICE CODE: DA10 - IT and Telecom - Business

Contract Period: Option 2 POP Begin: 10-01-2025 POP End: 09-30-2026 PRINCIPAL NAICS CODE: 541519 - Other Computer Related Services PRODUCT/SERVICE CODE: DA10 - IT and Telecom - Business

Compliance & CE: 250 users [Federal] Contract Period: Option 2 POP Begin: 10-01-2025 POP End: 09-30-2026 PRINCIPAL NAICS CODE: 541519 - Other Computer Related Services PRODUCT/SERVICE CODE: DA10 - IT and Telecom - Business

Contract Period: Option 2 POP Begin: 10-01-2025 POP End: 09-30-2026 PRINCIPAL NAICS CODE: 541519 - Other Computer Related Services PRODUCT/SERVICE CODE: DA10 - IT and Telecom - Business

Contract Period: Option 2 POP Begin: 10-01-2025 POP End: 09-30-2026 PRINCIPAL NAICS CODE: 541519 - Other Computer Related Services PRODUCT/SERVICE CODE: DA10 - IT and Telecom - Business

Contract Period: Option 2 POP Begin: 10-01-2025 POP End: 09-30-2026 PRINCIPAL NAICS CODE: 541519 - Other Computer Related Services PRODUCT/SERVICE CODE: DA10 - IT and Telecom - Business

Contract Period: Option 2 POP Begin: 10-01-2025 POP End: 09-30-2026 PRINCIPAL NAICS CODE: 541519 - Other Computer Related Services PRODUCT/SERVICE CODE: DA10 - IT and Telecom - Business

Contract Period: Option 2 POP Begin: 10-01-2025

POP End: 09-30-2026 PRINCIPAL NAICS CODE: 541519 - Other Computer Related Services PRODUCT/SERVICE CODE: DA10 - IT and Telecom - Business Application/Application Development Software as A Service

Contract Period: Option 2 POP Begin: 10-01-2025 POP End: 09-30-2026 PRINCIPAL NAICS CODE: 541519 - Other Computer Related Services PRODUCT/SERVICE CODE: DA10 - IT and Telecom - Business

Contract Period: Option 2 POP Begin: 10-01-2025 POP End: 09-30-2026 PRINCIPAL NAICS CODE: 541519 - Other Computer Related Services PRODUCT/SERVICE CODE: DA10 - IT and Telecom - Business

Contract Period: Option 2 POP Begin: 10-01-2025 POP End: 09-30-2026 PRINCIPAL NAICS CODE: 541519 - Other Computer Related Services PRODUCT/SERVICE CODE: DA10 - IT and Telecom - Business

Contract Period: Option 2 POP Begin: 10-01-2025 POP End: 09-30-2026 PRINCIPAL NAICS CODE: 541519 - Other Computer Related Services PRODUCT/SERVICE CODE: DA10 - IT and Telecom - Business

Contract Period: Option 2 POP Begin: 10-01-2025 POP End: 09-30-2026

PRODUCT/SERVICE CODE: DA10 - IT and Telecom - Business Application/Application Development Software as A Service

Contract Period: Option 2 POP Begin: 10-01-2025 POP End: 09-30-2026 PRINCIPAL NAICS CODE: 541519 - Other Computer Related Services PRODUCT/SERVICE CODE: DA10 - IT and Telecom - Business

Contract Period: Option 2 POP Begin: 10-01-2025 POP End: 09-30-2026 PRINCIPAL NAICS CODE: 541519 - Other Computer Related Services PRODUCT/SERVICE CODE: DA10 - IT and Telecom - Business

Contract Period: Option 2 POP Begin: 10-01-2025 POP End: 09-30-2026 PRINCIPAL NAICS CODE: 541519 - Other Computer Related Services PRODUCT/SERVICE CODE: DA10 - IT and Telecom - Business

Contract Period: Option 2 POP Begin: 10-01-2025 POP End: 09-30-2026 PRINCIPAL NAICS CODE: 541519 - Other Computer Related Services PRODUCT/SERVICE CODE: DA10 - IT and Telecom - Business

OPTION YEAR 2 ORDERING TOTAL:

Contract Period: Option 3 POP Begin: 10-01-2026 POP End: 09-30-2027 PRINCIPAL NAICS CODE: 541519 - Other Computer Related

PRODUCT/SERVICE CODE: DA10 - IT and Telecom - Business

Application/Application Development Software as A Service

Contract Period: Option 3 POP Begin: 10-01-2026 POP End: 09-30-2027 PRINCIPAL NAICS CODE: 541519 - Other Computer Related Services PRODUCT/SERVICE CODE: DA10 - IT and Telecom - Business

Contract Period: Option 3 POP Begin: 10-01-2026 POP End: 09-30-2027 PRINCIPAL NAICS CODE: 541519 - Other Computer Related Services PRODUCT/SERVICE CODE: DA10 - IT and Telecom - Business

Contract Period: Option 3 POP Begin: 10-01-2026 POP End: 09-30-2027 PRINCIPAL NAICS CODE: 541519 - Other Computer Related Services PRODUCT/SERVICE CODE: DA10 - IT and Telecom - Business

Contract Period: Option 3 POP Begin: 10-01-2026 POP End: 09-30-2027 PRINCIPAL NAICS CODE: 541519 - Other Computer Related Services PRODUCT/SERVICE CODE: DA10 - IT and Telecom - Business

Contract Period: Option 3 POP Begin: 10-01-2026 POP End: 09-30-2027 PRINCIPAL NAICS CODE: 541519 - Other Computer Related Services PRODUCT/SERVICE CODE: DA10 - IT and Telecom - Business

IQE - CAPA: 10-14 CLIA Lincenses, 30 forms [Federal] Contract Period: Option 3 POP Begin: 10-01-2026 POP End: 09-30-2027 PRINCIPAL NAICS CODE: 541519 - Other Computer Related Services PRODUCT/SERVICE CODE: DA10 - IT and Telecom - Business

Contract Period: Option 3 POP Begin: 10-01-2026 POP End: 09-30-2027 PRINCIPAL NAICS CODE: 541519 - Other Computer Related Services PRODUCT/SERVICE CODE: DA10 - IT and Telecom - Business

Contract Period: Option 3 POP Begin: 10-01-2026 POP End: 09-30-2027 PRINCIPAL NAICS CODE: 541519 - Other Computer Related Services PRODUCT/SERVICE CODE: DA10 - IT and Telecom - Business

Contract Period: Option 3 POP Begin: 10-01-2026 POP End: 09-30-2027 PRINCIPAL NAICS CODE: 541519 - Other Computer Related Services PRODUCT/SERVICE CODE: DA10 - IT and Telecom - Business

Contract Period: Option 3 POP Begin: 10-01-2026 POP End: 09-30-2027 PRINCIPAL NAICS CODE: 541519 - Other Computer Related Services PRODUCT/SERVICE CODE: DA10 - IT and Telecom - Business

Contract Period: Option 3 POP Begin: 10-01-2026

POP End: 09-30-2027 PRINCIPAL NAICS CODE: 541519 - Other Computer Related Services PRODUCT/SERVICE CODE: DA10 - IT and Telecom - Business Application/Application Development Software as A Service

Contract Period: Option 3 POP Begin: 10-01-2026 POP End: 09-30-2027 PRINCIPAL NAICS CODE: 541519 - Other Computer Related Services PRODUCT/SERVICE CODE: DA10 - IT and Telecom - Business

Contract Period: Option 3 POP Begin: 10-01-2026 POP End: 09-30-2027 PRINCIPAL NAICS CODE: 541519 - Other Computer Related Services PRODUCT/SERVICE CODE: DA10 - IT and Telecom - Business

Contract Period: Option 3 POP Begin: 10-01-2026 POP End: 09-30-2027 PRINCIPAL NAICS CODE: 541519 - Other Computer Related Services PRODUCT/SERVICE CODE: DA10 - IT and Telecom - Business

Contract Period: Option 3 POP Begin: 10-01-2026 POP End: 09-30-2027 PRINCIPAL NAICS CODE: 541519 - Other Computer Related Services PRODUCT/SERVICE CODE: DA10 - IT and Telecom - Business

Contract Period: Option 3 POP Begin: 10-01-2026 POP End: 09-30-2027

PRODUCT/SERVICE CODE: DA10 - IT and Telecom - Business

OPTION YEAR 3 ORDERING TOTAL:

Contract Period: Option 4 POP Begin: 10-01-2027 POP End: 09-30-2028 PRINCIPAL NAICS CODE: 541519 - Other Computer Related Services PRODUCT/SERVICE CODE: DA10 - IT and Telecom - Business

Contract Period: Option 4 POP Begin: 10-01-2027 POP End: 09-30-2028 PRINCIPAL NAICS CODE: 541519 - Other Computer Related Services PRODUCT/SERVICE CODE: DA10 - IT and Telecom - Business

Contract Period: Option 4 POP Begin: 10-01-2027 POP End: 09-30-2028 PRINCIPAL NAICS CODE: 541519 - Other Computer Related Services PRODUCT/SERVICE CODE: DA10 - IT and Telecom - Business

Contract Period: Option 4 POP Begin: 10-01-2027 POP End: 09-30-2028 PRINCIPAL NAICS CODE: 541519 - Other Computer Related Services PRODUCT/SERVICE CODE: DA10 - IT and Telecom - Business

Contract Period: Option 4 POP Begin: 10-01-2027 POP End: 09-30-2028 PRINCIPAL NAICS CODE: 541519 - Other Computer Related

PRODUCT/SERVICE CODE: DA10 - IT and Telecom - Business

Application/Application Development Software as A Service

Contract Period: Option 4 POP Begin: 10-01-2027 POP End: 09-30-2028 PRINCIPAL NAICS CODE: 541519 - Other Computer Related Services PRODUCT/SERVICE CODE: DA10 - IT and Telecom - Business

Contract Period: Option 4 POP Begin: 10-01-2027 POP End: 09-30-2028 PRINCIPAL NAICS CODE: 541519 - Other Computer Related Services PRODUCT/SERVICE CODE: DA10 - IT and Telecom - Business

Contract Period: Option 4 POP Begin: 10-01-2027 POP End: 09-30-2028 PRINCIPAL NAICS CODE: 541519 - Other Computer Related Services PRODUCT/SERVICE CODE: DA10 - IT and Telecom - Business

Contract Period: Option 4 POP Begin: 10-01-2027 POP End: 09-30-2028 PRINCIPAL NAICS CODE: 541519 - Other Computer Related Services PRODUCT/SERVICE CODE: DA10 - IT and Telecom - Business

Contract Period: Option 4 POP Begin: 10-01-2027 POP End: 09-30-2028 PRINCIPAL NAICS CODE: 541519 - Other Computer Related Services PRODUCT/SERVICE CODE: DA10 - IT and Telecom - Business

White Blood Cell Differential Simulator: 25 users Contract Period: Option 4 POP Begin: 10-01-2027 POP End: 09-30-2028 PRINCIPAL NAICS CODE: 541519 - Other Computer Related Services PRODUCT/SERVICE CODE: DA10 - IT and Telecom - Business

Contract Period: Option 4 POP Begin: 10-01-2027 POP End: 09-30-2028 PRINCIPAL NAICS CODE: 541519 - Other Computer Related Services PRODUCT/SERVICE CODE: DA10 - IT and Telecom - Business

Contract Period: Option 4 POP Begin: 10-01-2027 POP End: 09-30-2028 PRINCIPAL NAICS CODE: 541519 - Other Computer Related Services PRODUCT/SERVICE CODE: DA10 - IT and Telecom - Business

Contract Period: Option 4 POP Begin: 10-01-2027 POP End: 09-30-2028 PRINCIPAL NAICS CODE: 541519 - Other Computer Related Services PRODUCT/SERVICE CODE: DA10 - IT and Telecom - Business

Contract Period: Option 4 POP Begin: 10-01-2027 POP End: 09-30-2028 PRINCIPAL NAICS CODE: 541519 - Other Computer Related Services PRODUCT/SERVICE CODE: DA10 - IT and Telecom - Business

Contract Period: Option 4 POP Begin: 10-01-2027

POP End: 09-30-2028 PRINCIPAL NAICS CODE: 541519 - Other Computer Related Services PRODUCT/SERVICE CODE: DA10 - IT and Telecom - Business Application/Application Development Software as A Service

Contract Period: Option 4 POP Begin: 10-01-2027 POP End: 09-30-2028 PRINCIPAL NAICS CODE: 541519 - Other Computer Related Services PRODUCT/SERVICE CODE: DA10 - IT and Telecom - Business

OPTION YEAR 4 ORDERING TOTAL:

OVERALL GRAND TOTAL

B.3 DELIVERY SCHEDULE

ITEM # QTY/UNIT DELIVERY DATE

0001-0017 SHIP TO: Department of Veterans Affairs Michael E. DeBakey VA Medical Center 2002 Holcombe Blvd Houston, TX 77030 4211

USA

1.00/YR 10/01/2023-09/30/2024

MARK

FOR:

Hudson, Bernita Y (HOU) 713-794-7256 bernita.hudson@va.gov

1001-1017 Same as above 1.00/YR 10/01/2024-09/30/2025

2001-2017 Same as above 1.00/YR 10/01/2025-09/30/2026

3001-3017 Same as above 1.00/YR 10/01/2026-09/30/2027

4001-4017 Same as above 1.00/YR 10/01/2027-09/30/2028

[End of Section B] mailto:bernita.hudson@va.gov

SECTION C - CONTRACT CLAUSES

ADDENDUM to FAR 52.212-4 CONTRACT TERMS AND CONDITIONS—COMMERCIAL

PRODUCTS AND COMMERCIAL SERVICES

Clauses that are incorporated by reference (by Citation Number, Title, and Date), have the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available.

The following clauses are incorporated into 52.212-4 as an addendum to this contract:

C.1 52.252-2 CLAUSES INCORPORATED BY REFERENCE (FEB 1998)

This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. Also, the full text of a clause may be accessed electronically at this/these address(es):

https://www.acquisition.gov/browse/index/far https://www.va.gov/oal/library/vaar/

FAR

Number

Title Date

52.204-13 SYSTEM FOR AWARD MANAGEMENT MAINTENANCE OCT 2018

52.204-18 COMMERCIAL AND GOVERNMENT ENTITY CODE

MAINTENANCE

AUG 2020

52.212-4 CONTRACT TERMS AND CONDITIONS—COMMERCIAL

PRODUCTS AND COMMERCIAL SERVICES

DEC 2022

52.212-5 CONTRACT TERMS AND CONDITIONS REQUIRED TO

IMPLEMENT STATUTES OR EXECUTIVE ORDERS—

COMMERCIAL PRODUCTS AND COMMERCIAL

SERVICES

JUN 2023

52.217-6 OPTION FOR INCREASED QUANTITY MAR 1989

52.217-7 OPTION FOR INCREASED QUANTITY—SEPARATELY

PRICED LINE ITEM

MAR 1989

52.217-8 OPTION TO EXTEND SERVICES NOV 1999

52.217-9 OPTION TO EXTEND THE TERM OF THE CONTRACT MAR 2000

52.227-19 COMMERCIAL COMPUTER SOFTWARE LICENSE DEC 2007

52.232-40 PROVIDING ACCELERATED PAYMENTS TO SMALL

BUSINESS SUBCONTRACTORS

(End of Clause)

MAR 2023

C.2 VAAR 852.203-70 COMMERCIAL ADVERTISING (MAY 2018)

The Contractor shall not make reference in its commercial advertising to Department of

Veterans Affairs contracts in a manner that states or implies the Department of Veterans Affairs approves or endorses the Contractor’s products or services or considers the Contractor’s products or services superior to other products or services.

(End of Clause) https://www.acquisition.gov/browse/index/far https://www.va.gov/oal/library/vaar/

C.3 VAAR 852.211-70 EQUIPMENT OPERATION AND MAINTENANCE

MANUALS (NOV 2018)

The Contractor shall follow standard commercial practices to furnish manual(s), handbook(s) or brochure(s) containing operation, installation, and maintenance instructions, including pictures or illustrations, schematics, and complete repair/test guides, as necessary, for technical medical equipment and devices, and/or other technical and mechanical equipment provided per CLIN(s).

The manuals, handbooks or brochures shall be provided in hard copy, soft copy or with electronic access instructions, consistent with standard industry practices for the equipment or device. Where applicable, the manuals, handbooks or brochures will include electrical data and connection diagrams for all utilities. The documentation shall also contain a complete list of all replaceable parts showing part number, name, and quantity required.

(End of Clause)

C.4 VAAR 852.211-72 TECHNICAL INDUSTRY STANDARDS (NOV 2018)

(a) The Contractor shall conform to the standards established by Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security, see Section D.

(b) The Contractor shall submit proof of conformance to the standard. This proof may be a label or seal affixed to the equipment or supplies, warranting that the item(s) have been tested in accordance with the standards and meet the contract requirement. Proof may also be furnished by the organization listed above certifying that the item(s) furnished have been tested in accordance with and conform to the specified standards.

(c) Offerors may obtain the standards cited in this provision by submitting a request, including the solicitation number, title and number of the publication to:

(d) The offeror shall contact the Contracting Officer if response is not received within two weeks of the request.

(End of Clause)

C.5 VAAR 852.212-72 GRAY MARKET AND COUNTERFEIT ITEMS—

INFORMATION TECHNOLOGY MAINTENANCE ALLOWING OTHER-THAN-

NEW PARTS (FEB 2023)

(a) Used, refurbished, or remanufactured parts may be provided. No gray market supplies or equipment shall be provided. Gray market items are Original Equipment Manufacturer (OEM) goods intentionally or unintentionally sold outside an authorized sales territory or sold by non-authorized dealers in an authorized sales territory.

(b) No counterfeit supplies or equipment shall be provided. Counterfeit items include unlawful or unauthorized reproductions, substitutions, or alterations that have been mismarked, misidentified, or otherwise misrepresented to be an authentic, unmodified item from the original manufacturer, or a source with the express written authority of the original manufacturer or current design activity, including an authorized aftermarket manufacturer. Unlawful or unauthorized substitutions include used items represented as new, or the false identification of grade, serial number, lot number, date code, or performance characteristics.

(c) Vendor shall be an OEM, authorized dealer, authorized distributor or authorized reseller for the proposed equipment/system, verified by an authorization letter or other documents from the

OEM. All software licensing, warranty and service associated with the equipment/system shall be in accordance with the OEM terms and conditions.

(End of Clause)

C.6 VAAR 852.219-75 VA NOTICE OF LIMITATIONS ON

SUBCONTRACTING—CERTIFICATE OF COMPLIANCE FOR SERVICES AND

CONSTRUCTION (JAN 2023) (DEVIATION)

(a) Pursuant to 38 U.S.C. 8127(l)(2), the offeror certifies that—

(1) If awarded a contract (see FAR 2.101 definition), it will comply with the limitations on subcontracting requirement as provided in the solicitation and the resultant contract, as follows:

(i) [X] Services. In the case of a contract for services (except construction), the contractor will not pay more than 50% of the amount paid by the government to it to firms that are not certified SDVOSBs listed in the SBA certification database as set forth in 852.219–73 or certified VOSBs listed in the SBA certification database as set forth in 852.219–74. Any work that a similarly situated certified SDVOSB/VOSB subcontractor further subcontracts will count towards the 50% subcontract amount that cannot be exceeded. Other direct costs may be excluded to the extent they are not the principal purpose of the acquisition and small business concerns do not provide the service as set forth in 13 CFR 125.6.

(ii) [] General construction. In the case of a contract for general construction, the contractor will not pay more than 85% of the amount paid by the government to it to firms that are not certified SDVOSBs listed in the SBA certification database as set forth in 852.219–73 or certified VOSBs listed in the SBA certification database as set forth in 852.219–74. Any work that a similarly situated certified SDVOSB/VOSB subcontractor further subcontracts will count towards the 85% subcontract amount that cannot be exceeded. Cost of materials are excluded and not considered to be subcontracted.

(iii) [] Special trade construction contractors. In the case of a contract for special trade contractors, the contractor will not pay more than 75% of the amount paid by the government to it to firms that are not certified SDVOSBs listed in the SBA certification database as set forth in

852.219–73 or certified VOSBs listed in the SBA certification database as set forth in 852.219–

74. Any work that a similarly situated certified SDVOSB/VOSB subcontractor further subcontracts will count towards the 75% subcontract amount that cannot be exceeded. Cost of materials are excluded and not considered to be subcontracted.

(2) The offeror acknowledges that this certification concerns a matter within the jurisdiction of an Agency of the United States. The offeror further acknowledges that this certification is subject to Title 18, United States Code, Section 1001, and, as such, a false, fictitious, or fraudulent certification may render the offeror subject to criminal, civil, or administrative penalties, including prosecution.

(3) If VA determines that an SDVOSB/ VOSB awarded a contract pursuant to 38 U.S.C. 8127 did not act in good faith, such SDVOSB/VOSB shall be subject to any or all of the following:

(i) Referral to the VA Suspension and Debarment Committee;

(ii) A fine under section 16(g)(1) of the Small Business Act (15 U.S.C. 645(g)(1)); and

(iii) Prosecution for violating 18 U.S.C. 1001.

(b) The offeror represents and understands that by submission of its offer and award of a contract it may be required to provide copies of documents or records to VA that VA may review to determine whether the offeror complied with the limitations on subcontracting requirement specified in the contract. Contracting officers may, at their discretion, require the contractor to demonstrate its compliance with the limitations on subcontracting at any time during performance and upon completion of a contract if the information regarding such compliance is not already available to the contracting officer. Evidence of compliance includes, but is not limited to, invoices, copies of subcontracts, or a list of the value of tasks performed.

(c) The offeror further agrees to cooperate fully and make available any documents or records as may be required to enable VA to determine compliance with the limitations on subcontracting requirement. The offeror understands that failure to provide documents as requested by VA may result in remedial action as the Government deems appropriate.

(d) Offeror completed certification/fill-in required. The formal certification must be completed, signed and returned with the offeror’s bid, quotation, or proposal. The Government will not consider offers for award from offerors that do not provide the certification, and all such responses will be deemed ineligible for evaluation and award.

Certification [Completed by Offeror]

I hereby certify that if awarded the contract, [insert name of offeror] will comply with the limitations on subcontracting specified in this clause and in the resultant contract. I further certify that I am authorized to execute this certification on behalf of [insert name of offeror].

Printed Name of Signee: ___________________________________________________

Printed Title of Signee: ____________________________________________________

Signature: ______________________________________________________________

Date: __________________________________________________________________

Company Name and Address: ______________________________________________

(End of Clause)

C.7 VAAR 852.232-72 ELECTRONIC SUBMISSION OF PAYMENT

REQUESTS (NOV 2018)

(a) Definitions. As used in this clause—

(1) Contract financing payment has the meaning given in FAR 32.001;

(2) Designated agency office means the office designated by the purchase order, agreement, or contract to first receive and review invoices. This office can be contractually designated as the receiving entity. This office may be different from the office issuing the payment;

(3) Electronic form means an automated system transmitting information electronically according to the accepted electronic data transmission methods and formats identified in paragraph (c) of this clause. Facsimile, email, and scanned documents are not acceptable electronic forms for submission of payment requests;

(4) Invoice payment has the meaning given in FAR 32.001; and

(5) Payment request means any request for contract financing payment or invoice payment submitted by the contractor under this contract.

(b) Electronic payment requests. Except as provided in paragraph (e) of this clause, the contractor shall submit payment requests in electronic form. Purchases paid with a government-wide commercial purchase card are considered to be an electronic transaction for purposes of this rule, and therefore no additional electronic invoice submission is required.

(c) Data transmission. A contractor must ensure that the data transmission method and format are through one of the following:

(1) VA’s Electronic Invoice Presentment and Payment System at the current website address provided in the contract.

(2) Any system that conforms to the X12 electronic data interchange (EDI) formats established by the Accredited Standards Center (ASC) and chartered by the American National

Standards Institute (ANSI).

(d) Invoice requirements. Invoices shall comply with FAR 32.905.

(e) Exceptions. If, based on one of the circumstances in this paragraph (e), the Contracting

Officer directs that payment requests be made by mail, the Contractor shall submit payment requests by mail through the United States Postal Service to the designated agency office.

Submission of payment requests by mail may be required for—

(1) Awards made to foreign vendors for work performed outside the United States;

(2) Classified contracts or purchases when electronic submission and processing of payment requests could compromise the safeguarding of classified or privacy information;

(3) Contracts awarded by contracting officers in the conduct of emergency operations, such as responses to national emergencies;

(4) Solicitations or contracts in which the designated agency office is a VA entity other than the VA Financial Services Center in Austin, Texas; or

(5) Solicitations or contracts in which the VA designated agency office does not have electronic invoicing capability as described above.

C.8 VAAR 852.239-70 SECURITY REQUIREMENTS FOR INFORMATION

TECHNOLOGY RESOURCES (FEB 2023)

(a) Definitions. As used in this clause— Information technology has the same meaning in FAR

2.101 and also means Information and Communication Technology (ICT).

Information system security plan means a formal document that provides an overview of the security requirements for an information system and describes the security controls in place or planned for meeting those requirements.

(b) Responsibilities. The Contractor shall be responsible for information system security for all systems connected to a Department of Veterans Affairs (VA) network or operated by the

Contractor for VA, regardless of location. This clause is applicable to all or any part of the contract that includes information technology resources or services in which the Contractor has physical or other system access to VA information that directly supports the mission of VA.

Examples of tasks that require security provisions include—

(1) Hosting of VA e-Government sites or other information technology operations;

(2) Acquisition, transmission, or analysis of data owned by VA with significant replacement cost should the contractor’s copy be corrupted; and

(3) Access to VA general support systems/ major applications at a level beyond that granted the general public, e.g., bypassing a firewall.

(c) Information system security plan. The Contractor shall develop, provide, implement, and maintain an Information System Security Plan. VA information systems must have an information system security plan that provides an overview of the security requirements for the system and describes the security controls in place or the plan for meeting those requirements.

This plan shall describe the processes and procedures that the Contractor will follow to ensure appropriate security of information system resources developed, processed, or used under this contract. The information system security plan should include implementation status, responsible entities, resources, and estimated completion dates. Information system security plans may also include, but are not limited to, a compiled list of system characteristics, and key security-related documents such as a risk assessment, PIA, system interconnection agreements, contingency plan, security configurations, configuration management plan, and incident response plan. The plan shall address the specific contract requirements regarding information systems related support or services included in the contract, to include the performance work statement (PWS) or statement of work (SOW). The Contractor’s Information

System Security Plan shall comply with applicable Federal Laws that include, but are not limited to, 40 U.S.C. 11331, the Federal Information Security Modernization Act (FISMA) of 2014 and the E-Government Act of 2002. The plan shall meet information system security requirements in accordance with Federal and VA policies and procedures, and as amended during the term of this contract, and include, but are not limited to the following.

(1) OMB Circular A–130, Managing Information as a Strategic Resource;

(2) National Institute of Standards and Technology (NIST) Guidelines; and

(3) VA Directive 6500, VA Cybersecurity Program, and the directives and handbooks in the

VA 6500 series related to VA information (including VA sensitive information and sensitive personal information and information systems security and privacy), as well as those set forth in the contract specifications, statement of work, or performance work statement. These include, but are not limited to, VA Handbook 6500.6, Contract Security; and VA Directive and Handbook

0710, Personnel Security and Suitability Program, which establishes VA’s procedures, responsibilities, and processes for complying with current Federal law, Executive Orders, policies, regulations, standards and guidance for protecting VA information, information systems

(see 802.101, Definitions) security and privacy, and adhering to personnel security requirements when accessing VA information or information systems.

(d) Submittal of plan. Within 90 days after contract award, the Contractor shall submit the

Information System Security Plan to the Contracting Officer for review and approval.

(e) Security accreditation. As required by current VA policy, the Contractor shall submit written proof of information system security accreditation to the Contracting Officer for non-VA owned systems. Such written proof may be furnished either by the Contractor or by a third party.

Accreditation shall be in accordance with VA policy available from the Contracting Officer upon request. The Contractor shall submit for acceptance by the Contracting Officer along with this accreditation a final information system security plan, such as a risk assessment, security test and evaluation, and disaster recovery plan/continuity of operations plan. The accreditation and the final information system security plan and the accompanying documents, such as a risk assessment, security test and evaluation, and disaster recovery/continuity of operations plan.

(f) Annual validation. On an annual basis, the Contractor shall verify in writing to the

Contracting Officer that the Information System Security Plan remains valid.

(g) Banners. The Contractor shall ensure that the official VA banners are displayed on all VA systems (both public and private) operated by the Contractor that contain Privacy Act information before allowing anyone access to the system. The Office of Information Technology will make official VA banners available to the Contractor.

(h) Screening and access. The Contractor shall screen all personnel requiring privileged access or limited privileged access to systems operated by the Contractor for VA or interconnected to a VA network in accordance with VA Directives and Handbooks referenced in paragraph (c) of this clause.

(i) Training. The Contractor shall ensure that its employees performing services under this contract complete VA security awareness training on an annual basis. This includes signing an acknowledgment that they have read, understand, and agree to abide by the VA Information

Security Rules of Behavior (VA National Rules of Behavior) as required by 38 U.S.C. 5723; FAR

39.105, Privacy; clause 852.204–71, Information and Information Systems Security, and this clause on an annual basis.

(j) Government access. The Contractor shall provide the Government access to the

Contractor’s and subcontractors’ facilities, installations, operations, documentation, databases, and personnel used in performance of the contract. The Contractor shall provide access to enable a program of information system inspection (to include vulnerability testing), investigation and audit (to safeguard against threats and hazards to the integrity, availability and confidentiality of VA data or to the function of information systems operated on behalf of VA), and to preserve evidence of computer crime.

(k) Notification of termination of employees. The Contractor shall immediately notify the

Contracting Officer when an employee who has access to VA information systems or data terminates employment.

(l) Subcontractor flow down requirement. The Contractor shall incorporate and flow down the substance of this clause to all subcontracts that meet the conditions in paragraph (a) of this clause.

(End of Clause)

C.9 VAAR 852.239-73 INFORMATION SYSTEM HOSTING, OPERATION,

MAINTENANCE, OR USE (FEB 2023)

(a) Definitions. As used in this clause— Assessment and Authorization (A&A) means the process used to ensure information systems including Major Applications and General Support

Systems have effective security safeguards which have been implemented, planned for, and documented in an Information Technology Security Plan. The A&A process per applicable VA policies and procedures is the mechanism by which VA provides an Authorization to Operate

(ATO), the official management decision given by the VA to authorize operation of an information system (see VA Handbook 6500 for additional details). Information system security plan means a formal document that provides an overview of the security requirements for an information system and describes the security controls in place or planned for meeting those requirements.

(b) Hosting, operation, maintenance, or use at non-VA facilities. For information systems that are hosted, operated, maintained, or used on behalf of VA at non-VA facilities, Contractors/subcontractors are fully responsible and accountable for ensuring compliance with the applicable Health Insurance Portability and Accountability (HIPAA) Act of 1996 (HIPAA)

Privacy and Security Rules, the Privacy Act and other required VA confidentiality statutes included in VA’s mandatory yearly training and privacy handbooks, Federal Information Security

Modernization Act (FISMA), National Institute of Standards and Technology (NIST), Federal

Information Processing Standards (FIPS), and VA security and privacy directives and handbooks. This includes conducting compliant risk assessments, routine vulnerability scanning, system patching and change management procedures, and the completion of an acceptable contingency plan for each system. The Contractor’s security control procedures must be equivalent to or exceed, those procedures used to secure VA systems. A Privacy

Impact Assessment (PIA) must also be provided to the COR and approved by VA Privacy

Service prior to approval to operate. All external internet connections to VA’s network involving

VA information must be in accordance with the Trusted internet Connections (TIC) Reference

Architecture and reviewed and approved by VA prior to implementation. For Cloud Services hosting, the Contractor shall also ensure compliance with the Federal Risk and Authorization

Management Program (FedRAMP).

(c) Collecting, processing, transmitting, and storing of VA sensitive information. Adequate security controls for collecting, processing, transmitting, and storing of VA sensitive information, must be in place, tested, and approved by VA prior to hosting, operation, maintenance, or use of the information system, or systems by or on behalf of VA. These security controls are to be assessed and stated within the Information System Security Plan and if these controls are determined not to be in place, or inadequate, a Plan of Action and Milestones (POA&M) must be submitted and approved prior to the collection, processing, transmitting, and storing of VA sensitive information.

(d) Annual FISMA security controls assessment. The Contractor/subcontractor’s system must adhere to all FISMA, FIPS, and NIST standards related to the annual FISMA security controls assessment and review and update the Privacy Impact Assessment. Any deficiencies noted during this assessment must be provided to the Contracting Officer for entry into VA’s POA&M management process. The Contractor/subcontractor must use VA’s POA&M process to document planned remedial actions to address any deficiencies in information security policies, procedures, and practices, and the completion of those activities. Security deficiencies must be corrected within the timeframes specified by the VA in the performance work statement (PWS) or statement of work (SOW), or in the approved remediation plan through the VA POA&M process. Contractor/subcontractor procedures are subject to periodic, unannounced assessments by VA officials, including the VA Office of Inspector General. The physical security aspects associated with Contractor/ subcontractor activities must also be subject to such assessments. The results of an annual review or a major change in the cybersecurity posture at any time may indicate the need for reassessment and reauthorization of the system. If major changes to the system occur that may affect the privacy or security of the data or the system, the A&A of the system may need to be reviewed, retested and re1authorized per VA Handbook

6500. This may require reviewing and updating all of the documentation as described in VA

Handbook 6500.6 (e.g., System Security Plan, Contingency Plan). See VA Handbook 6500.6 for a list of documentation. The VA Information System Risk Management (ISRM) office can provide guidance on whether a new A&A would be necessary.

(e) Annual self-assessment. The Contractor/subcontractor must conduct an annual self-assessment on all systems and outsourced services as required.