S02 - Attachment - PWS HRD Training Delivery Platform.pdf

HRD Training Delivery Platform PWS

Veterans Health Administration (VHA) Office of Workforce Management and Consulting (WMC)

Human Resources Development (HRD) Training Delivery Platform Performance Work Statement (PWS)

1. GENERAL

The Department of Veterans Affairs (VA), Veterans Health Administration (VHA) and Workforce Management and Consulting (WMC), Human Resources Development (HRD) supports the learning and professional development needs of approximately 10,000 HR Professionals across the agency. This includes the VHA Flagship Program, the Human Resources Specialist Training and Accelerated Readiness (HR STAR) program that onboards 1,000 trainees per year, using a college-level platform. HRD provides training services to support closing current and previously identified competency gaps among the VA HR workforce. Annually, HRD administers a competency gap assessment to identify existing gaps and develops and/or delivers training and learning opportunities to target closing gaps. Stakeholders include VA HR Professionals and HR Leadership across the Administrations: Veteran Health Administration (VHA), Veterans Benefits Administration (VBA), National Cemetery Administration (NCA), and Staff Offices. HRD has a need for contractor support to provide a hosted, system-wide, web-based classroom system known as a Virtual Learning Environment (VLE) with bi-directional integration with VA’s Talent Management System (TMS) and with agile, adaptable, and customizable features or its expected successor Learning Employee Development (LED) system (Success Factors) to centrally track and manage employee participation and completion records to deliver asynchronous and synchronous (virtual instructor-led) human resources (HR) training.

Additionally, HRD has a need for Contractor support to provide a VLE with community engagement modules to facilitate community of practices. This need includes the need for sophisticated, monitored knowledge checks throughout learning modules, capacity for live meetings within the curriculum system, grading by learner and tracking by instructor. HRD’s current course suite and HR STAR Program curriculum is currently housed in Blackboard® and Blackboard’s Learn Software-as-a-Service (SaaS) virtual learning platform allows HRD to maintain agile services without interruption, while updating course offerings readily. The HR STAR trainees’ continued employment is based on the ability to have sophisticated grading and tracking for every cohort throughout the program up to the point of placement.

VA SOFTWARE AS A SERVICE (SaaS)

1.1 ASSESSMENT, AUTHORIZATION, and CONTINUOUS MONITORING

1. The information system solution selected by the Contractor shall comply with the

FedRAMP and VA Approved Moderate Federal Information Security Management Act (FISMA) Software as a Service (SaaS) System.

2. The Contractor shall comply with FedRAMP requirements as mandated by Federal laws and policies, including making available any documentation, physical access, and logical access needed to support this requirement.

3. The Contractor shall, where applicable, assist with the Sustainment Process to help maintain health and quality of agency authorization of the cloud service or migrated application.

4. The Contractor shall provide access to FedRAMP and VA Approved Moderate Federal Information Security Management Act (FISMA) Software as a Service (SaaS) System.

5. The Contractor shall afford VA access to the Contractor’s and Cloud Service Provider’s (CSP) facilities, installations, technical capabilities, operations, documentation, records, and databases.

6. If new or unanticipated threats or hazards are discovered by either VA or the Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party in accordance with the security addendum B.

7. The Contractor shall not release any data without the consent of VA in writing. All requests for release must be submitted in writing to the Contracting Officer’s Representative (COR)/Contracting Officer (CO)

8. In order for live VA data to be used in this system, access must be provided to the FedRAMP Authorized and Agency Authorized environment

9. The Contractor shall participate in monthly Agency and FedRAMP Sustainment meetings

10. The Contractor shall participate monitoring and reoccurring security artifacts, including monthly POAM reports

Deliverables:

A. Dates for current ATO expiration, due at award B. Most recent monthly POAM (Plan of Action and Milestones) finding reports

2. BACKGROUND

The VA supports a culture of education and training. HRD has fostered this culture for the VA HR workforce since 2010. The transfer of newly trained skills to the worksite is a critical component of the program and has proven most beneficial. Linking learning to worksite performance requires a high degree of learner-instructor interactivity during the learning process. Web-based (E-Learning) content offers an environment where interactivity among participants, facilitators and content experts is available. Through this platform, training is enhanced through engaging content that is easily accessible at the point of work. Additionally, the ability to ‘grade’, assess and provide immediate feedback within the enclosed learning environment is critical. It will encourage participants’ active reflection on content and problem solving via facilitated discussion, action learning projects, coaching, and mentoring and continuous peer interactions. It also provides the instructors maximum flexibility to provide an appropriate learning environment which includes real-time feedback, modules, and opportunities for tracking.

Web-based virtual classrooms, or VLEs, provide an integrated mix of synchronous and asynchronous learning activities in combination with dynamic opportunities for collaboration with experts and peers. Asynchronous participation in a virtual course means that the learning process is not conducted in real time. This allows participants to collaborate in online discussions, access learning resources and study curriculum materials or review project assignments anytime during the workday, twenty-four hours a day/seven days a week.

Participation in scheduled synchronous learning opportunities must also be available where learners can collaborate at the same time in a virtual classroom or lab-like environment over the internet.

The ability to be able to leverage existing courses developed in a virtual learning environment and design new learning experiences, to be exported and used across the system will be essential to ensure cost effective strategies and sharing of resources.

As a result, VA is seeking a contractor(s) who can fulfill these services by providing a user-friendly automated, interactive, and integrated FedRAMP and VA Approved at a Moderate FISMA Impact Software as a Service (SaaS) system with the capability hosted, system-wide, web-based classroom system known as a Virtual Learning Environment (VLE) with bi-directional integration with VA’s Talent Management System (TMS) and with agile, adaptable, and customizable features or its expected successor Learning Employee Development (LED) system (Success Factors) to centrally track and manage employee participation and completion records to deliver asynchronous and synchronous (virtual instructor-led) human resources (HR) training. Ideally, this Moderate FISMA Impact FedRAMP and VA Approved SaaS solution would be an off-the-shelf product that can be configured to meet the agency’s needs rather than a customized product which would need to be fully developed from “scratch”.

No software shall be downloaded onto VA computers to access the SaaS solution. Also, the SaaS solution shall not require any VA-hosted servers and shall be Moderate FISMA Impact FedRAMP and VA Approved.

The SaaS solution shall be offered on a subscription basis which allows users to have unrestricted access to all the features and functionality which will provide web-based virtual classrooms, or VLEs, provide an integrated mix of synchronous and asynchronous learning activities in combination with dynamic opportunities for collaboration with experts and peers.

2.1 HRD utilizes the Analysis, Design, Development, Implementation and Evaluation

(ADDIE) Learning Model and Scalable Content Object Resource Model (SCORM) 1.2.

On rare occasions the HRD is required to develop SCORM 2004 (2nd through 4th Edition) (conditional to capabilities of the VA Plateau (Talent Management System) Version 6.3.3), and Active Server Pages (.asp) courseware for posting to the VA TMS and/or their Legacy Performance Management System, Librix or any successor.

2.2 Learning Products developed for promotion from the Talent Management System (TMS) require compliance with VA Directive 6102 and VA Handbook 6102.

2.3 In 1998, Congress amended the Rehabilitation Act of 1973 to require Federal agencies to make their electronic and information technology (EIT) accessible to people with disabilities. Inaccessible technology interferes with an ability to obtain and use information quickly and easily. Section 508 was enacted to eliminate barriers in information technology, open new opportunities for people with disabilities, and encourage development of technologies that will help achieve these goals. The law applies to all Federal agencies when they develop, procure, maintain, or use electronic and information technology. Under Section 508 (29 U.S.C. ‘794 d), agencies must give disabled employees and members of the public access to information that is comparable to access available to others. It is recommended that you review the laws and regulations listed below to further your understanding about Section 508 and how you can support implementation. Section 508 of the Rehabilitation Act (29 U.S.C. '794 d), as amended by the Workforce Investment Act of 1998 (P.L. 105 - 220), August 7, 1998 (original source in uscode.house.gov) CHAPTER 16 - VOCATIONAL

REHABILITATION AND OTHER REHABILITATION SERVICES, SUBCHAPTER V -

RIGHTS AND ADVOCACY http://uscode.house.gov/download/pls/29C16.txt Other Relevant Laws. All Learning Products developed for promotion electronically require compliance with and formal certification by the Office of Health Informatics, Section 508 utilizing VHA Section 508 Compliance Checklists.

The contractor shall provide/deliver all software/services in full compliance with the Revised Section 508 Standards guidance as published in the Federal Register notice available at: https://www.access-board.gov/ict/ict-final-rule.pdf. It will be the contractor’s sole responsibility to fully understand these requirements, ensure they meet these standards and, at a minimum, leverage and adhere to WCAG 2.0 level AA criteria and VA's Section 508 office supplemental requirements, for reviewing, assessing, and addressing all issues failing WCAG 2.0 and not meeting supplemental requirements of VA's Section 508 office on all documents created as part of this contracted effort. The VA Section 508 office supplemental requirements also include addressing issues identified as violations by VA's HTML scanning appliance(s). The contractor shall resolve all accessibility deficiencies for each deliverable to the government’s satisfaction and acceptance in alignment with all legal requirements.”

Supplies or services delivered as a result of this solicitation will be accepted based in part on satisfaction of identified Section 508 requirements for accessibility. If the deliverable includes features and functions in addition to those identified as requirements, these features and functions also need to conform to relevant Section 508 technical provisions, functional performance criteria, and information, documentation, and support.

NOTE FOR DELIVERABLE ACCEPTANCE / QUALITY ASSURANCE: Generally accepted inspection and test methods corresponding to the identified Section 508 standards is reflected in the attached EIT Acceptance Guide. This guide may be used to assist in the inspection and testing of software and services provided as contract deliverables corresponding to this solicitation.

3. SCOPE OF WORK

HRD requires a VLE for instructors to have several capabilities: dedicated course room(s) and modules, learning-lab capability such as module design for lengthy (months-long) courses, the ability to schedule as many new sessions as they want simultaneously, and a seamless availability on a variety of devices. HRD requires the capacity and capability to run multiple cohorts of content simultaneously over long periods of time, much like college semesters are designed, if not longer. This flexibility allows the instructor(s) to be agile enough to meet the needs of the learners, provide maximum experience-based and didactic learning and accurately assess learners to ensure appropriate placement in permanent positions where indicated. The training delivery platform will further support succession planning and Government HR personnel development efforts, provide a dynamic means of transferring corporate knowledge, and at the same time, determine the funding, resources, and support services required for the delivery of employee development programs using a virtual, interactive learning environment.

Program participants shall have 24/7, 365 days a year internet access to the training platform that houses the training material/curriculum content while allowing for engagement in a self-paced manner, communication with faculty, and collaboration with peers. This shall include the ability to call up just-in-time job aids when executing project assignments. Content grading, assessing knowledge checks, and learner tracking for any course or module is required.

4. PERIOD OF PERFORMANCE

The period of performance for this requirement consists of one (1) 12-month base period from the award date of the contract, and four (4) 12-month option periods.

5. TYPE OF CONTRACT

The Government anticipates award of a Firm Fixed Price contract.

6. PLACE OF PERFORMANCE

All work performed under this contract will be performed at Contractor facilities.

7. MINIMUM TECHNICAL REQUIREMENTS

The contractor shall provide the specific FedRAMP and VA Approved licensed services and a virtual education environment system with the capabilities described below within 10 business days from the award date of the contract providing 24/7 access throughout the period(s) of performance as stated in the PWS. If for any reason, any software/services cannot be provided on time according to the below schedule, the contractor shall provide a written explanation to the COR within five business days prior to deliverable due date. This written transmittal shall include a firm commitment of when the work shall be completed. This transmittal to the COR shall cite the reasons for the delay, and the impact on the overall project.

The contractor shall provide the following software/service accessibility, features, and functionality/capabilities:

(1) The Contractor shall provide services from a hosted VLE that includes technical support services for administrators daily from 8AM to 8PM, Eastern Time.

(2) Hosted virtual learning system that supports at least 10,000 active users to include instructors and students with multiple and simultaneous Agency-developed courses over time, such as a year-long program.

(3) Asynchronous and Synchronous system for course delivery

(4) Bi-directional integration with VA TMS and any follow-on system to TMS.

Users/profiles flow from TMS to VLE, completions/results from VLE to TMS.

(5) Community Engagement model to facilitate community of practices, informal and social learning, targeted content delivery, and community specific experiences.

(6) A platform containing a system of grading and assessing learners by course or content.

SaaS Training Delivery Platform Licensing Capabilities

(1) A mechanism for delivery of a variety of educational materials: Microsoft Office

(.Doc, PPT. XLS, etc.), Adobe Acrobat PDF, HTML, digital images, digital audio files, digital video files and interactive multimedia assets.

(2) Access control that is password based

(3) Administration: learner tracking, collation of grades and records of progress

(grade book). Schedule and automate release and recall of content for specific times and dates so instructors can control content release to learners.

(4) Assessment: Online surveys and testing options

(5) Communication: one-to-one, one-to-many, synchronous and asynchronous with sophisticated levels of threaded discussion capabilities by participants, by lecture topic and by date.

(6) Timetabling facilities: some explicit means of pacing materials and the ability to keep a course open at the instructor’s direction.

(7) Customizable instructional design features: Create sequential learning modules that establish paths through content and assessments; create folder structures to organize content; and announcement capabilities

(8) A resource base: a section for frequently asked questions, or a database assessed by keyword search

(9) Support facilities: for instance, online help about the environment

(10) User-friendly design: Offers learners ease of navigation and pop-up site maps, scheduling visuals such as a course calendar.

(11) The Contractor shall provide the COR with written directions for use of the VLE along with written documentation for developing and managing training within the

VLE.

(12) Content SCORM 1.2 and SCORM 2004 (2nd through 4th Edition) conformant.

(13) Synchronous online collaboration tools that include the capability to allow instructors and participants to hold audio and video conferences to share documents, applications, and presentations.

(14) Capability of using the platform on a variety of Government Furnished Equipment such as smartphone, tablet and/or laptop.

8. TRANSITION SUPPORT (Optional Task)

The Contractor shall provide transition support of the product. The Contractor shall provide a plan for 60 days of outgoing transition support for transitioning work from the current contract to a follow-on contract or other entity. This transition may be to a Government entity or to another Contractor or to the incumbent Contractor under a new contract. In accordance with the Government-approved plan, the Contractor shall assist the Government in implementing a complete transition from this contract to a new support provider. This shall include formal coordination with Government staff and successor staff and management. It shall also include delivery of copies of all artifacts delivered under this contract including all VA data, as well as existing policies and procedures, training materials, and delivery of baseline metrics and statistics.

The Contractor shall provide the licensed software/services to the Project Manager as described and in accordance with the below outlined performance standards/metrics. The Contractor shall provide/deliver all software/services within the time limits specified in the performance standards. The COR will notify the Contractor of approval, conditional approval, or disapproval.

The Contractor shall provide/deliver all software/services electronically or by a method that provides a receipt of transmission/delivery. The COR will notify the Contractor of the Contracting Officer’s approval or disapproval of submittal. The Contractor shall submit any required corrections within 10 days unless otherwise specified in writing by the COR.

9. SECURITY REQUIREMENTS

The contractor shall provide services, materials, and equipment to complete the tasks both as described below and further defined within the sub-sections of this Section.

The Software solution must be certified and/or accredited under FIPS 199 and NIST 800-60.

The Contractor shall protect personal information that is loaded within the site such as student name, training records and TMS User ID and will protect all information that is loaded according to common standards of information security for hosted web-based learning environments. In addition, the Contractor shall submit in writing that the VLE meets all the government policy guidelines including standards for 508 compliance and internet security as outlined in VA Directive 6102 and NIST Standard 800 Series specifically NIST Standard 800-37.

10. PERFORMANCE STANDARDS/METRICS:

In accordance with FAR 37.102, services provided under this contract will be performance‐ based to the maximum extent practicable. This approach will define the quality assurance surveillance plan (QSAP), to include specific performance standards and measures.

The table below defines the Performance Standards and Acceptable Performance Levels for Objectives associated with all tasks outlined in the PWS.

Software/Service Deliverables

Quality Standards Acceptable Quality Level

Means of Measurement

Training Delivery Platform Web Conferencing (up to 5,000 users)

VLE has the capacity to accommodate up to 10,000 active users

The VLE delivery order is operational effective October 1, The VLE Administrator(s) as access to the vendor’s ASP hosted website, the VLE’s administrative control panel and to the electronic User’s Manual for Administrators

Training Delivery Platform Course Delivery Managed Hosting (up to 10,000 users)

Project Managers and participants have full access to the VLE within two weeks of delivery order award

Project Managers and participants have full access to the VLE within two weeks of delivery order award

The VLE is fully functional by the scheduled deadline within two weeks of delivery order award

Training Delivery Platform Course Delivery (up to 10,000 users)

The vendor will provide the VLE administrator with electronic access to an administrative manual that provides guidance for managing and trouble-shooting the

VLE.

The vendor provides the VLE Administrator with access to the most current electronic Administrative User’s Manual 24/7

The VLE Administrator’s access to the electronic Administrative User’s Manual is not interrupted for more than 24 hours. Access for more than one administrator is required.

Fully Hosted Test and Development Server

Server is accessible to VA for data integration 100

Server is Accessible 95 percent of the time

Less than 5 percent of reported outages.

Test and Development Server

The server is acquired to support VA Data Integration

Server is Accessible 95 percent of the time

Less than 5 percent of reported outages.

Results Extraction Solution

Results are transferred 100% without error

Results Extraction at two percent error or less

Extraction Error Report

Results Extraction Solution – ICM

Results are transferred 100% without error

Results Extraction at two percent error or less

Extraction Error Report

TMS Data Integration

– ICM

Data transfers transferred 100% without error

Data transfers with two percent error or less

Extraction Error Report

TMS Single Sign-on

– ICM

Employees can sign-on without entering a password if they are already signed into TMS 100 percent of the time.

Employees can sign-on without entering a password if they are already signed into TMS 97 percent of the time.

Reported user single sign-on error.

Integration Framework Online Course

Course is accessible to HRD team for successful completion

Course is accessible to HRD team for successful completion

Reported user problems accessing training.

Annual Training/ Review

Course is accessible to HRD team for successful review of all materials

Course is accessible to HRD team for successful review of all materials

Reported user problems accessing training.

11. Operations and Maintenance Helpdesk Support

The Contractor shall provide operations and maintenance support for the SaaS (Software as a Service) solution, including but not limited to system configuration, change requests, and bug defects, found as necessary to meet the performance requirements of this effort. The Contractor shall provide technical helpdesk support of the solution. The Contractor shall provide business-day telephone and/or on-line support. A business day is defined as Monday through Friday during standard business hours, the times are 9:00 AM to 5:00 PM EST Monday – Friday, excluding Federal Holidays.

Support includes, but is not limited to, providing technical assistance in troubleshooting issues, problems or symptoms with the software and answering questions regarding documented properties, methods, events, function calls, parameters, and specific functionality of software components. The Contractor shall acknowledge receipt of all support inquires and provide resolution of support requests according to the timelines shown in the table below. The Contractor shall communicate to the VA PM (Project Manager) on system outages to include:

a. No later than 72 hours prior to scheduled outages.

b. Within 1 hour of identified emergency issues

The Contractor shall provide a System Performance Specification to the Government, showing system performance and up-time, specific indication of system issues, restarts and system maintenance activities including scheduled and unscheduled, and best practices used.

Table 1. Response Times for Support Severity Code Tier 2 initial response to customer

Tier 2 escalates to Tier 3 for initial contact

Tier 3 response back to Tier 2

Tier 2 requests updates from Tier 3 based on SLA resolution

Resolution time based on SLA from time incident initially reported

1 – Critical 15 minutes 0-15 minutes 15 minutes On call until issue resolved or hourly status check

0-2 business hours

2 – Serious 1 hour 30 minutes 1 hour On call until issue resolved or hourly status check

2-4 business hours

3 – Moderate 4 hours 1 hour 4 hours Daily 4-8 business hours

12. Changes to the Performance Work Statement

Only the CO is authorized to make any changes to this PWS; and the Contract Specialist (CS) will notify the contractor of such changes only through written correspondence. The CS will keep a copy of each change in a project folder along with all other products of the project. The contractor shall bear any and all costs incurred by the contractor through the actions of parties other than the CO.

The COR and PM representative or any other individual (including VA or other Government agency employees or employees of other contractors) other than the VA Contracting Officer are not authorized to make any changes of a contractually binding nature to the period of performance, funding and/or any other terms and conditions of any award or order resulting from this solicitation.

13. General Requirements

14.1 POSITION/TASK RISK DESIGNATION LEVEL(S) AND CONTRACTOR PERSONNEL

SECURITY REQUIREMENTS

POSITION/TASK RISK DESIGNATION LEVEL(S)

Position Sensitivity

Background Investigation (in accordance with Department of Veterans Affairs 0710 Handbook, “Personnel Security Suitability Program,” Appendix A)

Low

National Agency Check with Written Inquiries (NACI) A NACI is conducted by OPM and covers a 5-year period. It consists of a review of records contained in the OPM Security Investigations Index (SII) and the DOD Defense Central Investigations Index (DCII), FBI name check, FBI fingerprint check, and written inquiries to previous employers and references listed on the application for employment. In VA it is used for Non-sensitive or Low Risk positions.

Moderate

Moderate Background Investigation (MBI) A MBI is conducted by OPM and covers a 5-year period. It consists of a review of National Agency Check (NAC) records [OPM Security Investigations Index (SII), DOD Defense Central Investigations Index (DCII), FBI name check, and an FBI fingerprint check], a credit report covering a period of 5 years, written inquiries to previous employers and references listed on the application for employment;

an interview with the subject, law enforcement check; and a verification of the educational degree.

High

Background Investigation (BI) A BI is conducted by OPM and covers a 10-year period. It consists of a review of National Agency Check (NAC) records [OPM Security Investigations Index (SII), DOD Defense Central Investigations Index (DCII), FBI name check, and a FBI fingerprint check report], a credit report covering a period of 10 years, written inquiries to previous employers and references listed on the application for employment; an interview with the subject, spouse, neighbors, supervisor, co-workers; court records, law enforcement check, and a verification of the educational degree.

The position sensitivity and the level of background investigation commensurate with the required level of access for the following tasks within the Performance Work Statement are:

Position Sensitivity and Background Investigation Requirements

Task Number Low/NACI Moderate/MBI High/BI

ALL TASKS

The Tasks identified above, and the resulting Position Sensitivity and Background Investigation requirements identify, in effect, the Background Investigation requirements for Contractor individuals, based upon the tasks the particular Contractor individual will be working. The submitted Contractor Staff Roster must indicate the required Background Investigation Level for each Contractor individual based upon the tasks the Contractor individual will be working, in accordance with their submitted proposal.

Contractors, Contractor personnel, subcontractors, and subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security.

14. ADDENDUM A

Cyber and Information Security Requirements for VA IT Services The Contractor shall ensure adequate LAN/Internet, data, information, and system security in accordance with VA standard operating procedures and standard PWS language, conditions, laws, and regulations. The Contractor’s firewall and web server shall meet or exceed VA minimum requirements for security. All VA data shall be protected behind an approved firewall. Any security violations or attempted violations shall be reported to the VA Program Manager and VA Information Security Officer as soon as possible. The Contractor shall follow all applicable VA policies and procedures governing information security, especially those that pertain to certification and accreditation.

Contractor supplied equipment, PCs of all types, equipment with hard drives, etc. for contract services must meet all security requirements that apply to Government Furnished Equipment (GFE) and Government Owned Equipment (GOE). Security Requirements include a) VA Approved Encryption Software must be installed on all laptops or mobile devices before placed into operation, b) Bluetooth equipped devices are prohibited within VA; Bluetooth must be permanently disabled or removed from the device, c) VA approved anti-virus and firewall software, d) Equipment must meet all VA sanitization requirements and procedures before disposal. The COR, CO, the Project Manager, and the Information Security Officer (ISO) must be notified and verify all security requirements have been adhered to.

Each documented initiative under this contract incorporates VA Handbook 6500.6, “Contract Security,” March 12, 2010 by reference as though fully set forth therein. The VA Handbook 6500.6, “Contract Security” shall also be included in every related agreement, contract, or order. The VA Handbook 6500.6, Appendix C, is included in this document as Addendum B.

Training requirements: The Contractor shall complete all mandatory training courses on the current VA training site, the VA Talent Management System (TMS), and will be tracked therein.

The TMS may be accessed at https://www.tms.va.gov. If you do not have a TMS profile, go to https://www.tms.va.gov and click on the “Create New User” link on the TMS to gain access.

Contractor employees shall complete a VA Systems Access Agreement if they are provided access privileges as an authorized user of the computer system of VA.

VA Internet and Intranet Standards The Contractor shall adhere to and comply with VA Directive 6102 and VA Handbook 6102, Internet/Intranet Services, including applicable amendments and changes, if the Contractor’s work includes managing, maintaining, establishing, and presenting information on VA’s Internet/Intranet Service Sites. This pertains but is not limited to creating announcements;

collecting information; databases to be accessed, graphics and links to external sites.

Internet/Intranet Services Directive 6102 is posted at (copy and paste the following URL to browser): http://www1.va.gov/vapubs/viewPublication.asp?Pub_ID=409&FType=2 Internet/Intranet Services Handbook 6102 is posted at (copy and paste following URL to browser): http://www1.va.gov/vapubs/viewPublication.asp?Pub_ID=410&FType=2

Notice of the Federal Accessibility Law Affecting All Electronic and Information Technology Procurements (Section 508) On August 7, 1998, Section 508 of the Rehabilitation Act of 1973 was amended to require that when Federal departments or agencies develop, procure, maintain, or use Electronic and Information Technology, that they shall ensure it allows Federal employees with disabilities to have access to and use of information and data that is comparable to the access to and use of information and data by other Federal employees. Section 508 required the Architectural and Transportation Barriers Compliance Board (Access Board) to publish standards setting forth a definition of electronic and information technology and the technical and functional criteria for such technology to comply with Section 508. These standards have been developed are published with an effective date of December 21, 2000. Federal departments and agencies shall develop all Electronic and Information Technology requirements to comply with the standards found in 36 CFR 1194.

Section 508 – Electronic and Information Technology (EIT) Standards:

The Section 508 standards established by the Architectural and Transportation Barriers Compliance Board (Access Board) are incorporated into, and made part of all VA orders, solicitations and purchase orders developed to procure Electronic and Information Technology (EIT). These standards are found in their entirety at: http://www.section508.gov and http://www.access-board.gov/sec508/standards.htm. A printed copy of the standards will be supplied upon request. The Contractor shall comply with the technical standards as marked:

_x_§ 1194.21 Software applications and operating systems _x_§ 1194.22 Web-based intranet and internet information and applications _x_§ 1194.23 Telecommunications products _x_§ 1194.24 Video and multimedia products _x_§ 1194.25 Self-contained, closed products _x_§ 1194.26 Desktop and portable computers _x_§ 1194.31 Functional Performance Criteria _x_§ 1194.41 Information, Documentation, and Support

The standards do not require the installation of specific accessibility-related software or the attachment of an assistive technology device, but merely require that the EIT be compatible with such software and devices so that it can be made accessible if required by the agency in the future.

Physical Security & Safety Requirements:

The Contractor and their personnel shall follow all VA policies, standard operating procedures, applicable laws, and regulations while on VA property. Violations of VA regulations and policies may result in citation and disciplinary measures for persons violating the law.

1. The Contractor and their personnel shall wear visible identification at all times while they are on the premises.

2. VA does not provide parking spaces at the work site; the Contractor must obtain parking at the work site if needed. It is the responsibility of the Contractor to park in the appropriate designated parking areas. VA will not invalidate or make reimbursement for parking violations of the Contractor under any conditions.

3. Smoking is prohibited inside/outside any building other than the designated smoking areas.

4. Possession of weapons is prohibited.

5. The Contractor shall obtain all necessary licenses and/or permits required to perform the work, with the exception of software licenses that need to be procured from a Contractor or vendor in accordance with the requirements document. The Contractor shall take all reasonable precautions necessary to protect persons and property from injury or damage during the performance of this contract.

Confidentiality and Non-Disclosure The Contractor shall follow all VA rules and regulations regarding information security to prevent disclosure of sensitive information to unauthorized individuals or organizations.

The Contractor may have access to Protected Health Information (PHI) and Electronic Protected Health Information (EPHI) that is subject to protection under the regulations issued by the Department of Health and Human Services, as mandated by the Health Insurance Portability and Accountability Act of 1996 (HIPAA); 45 CFR Parts 160 and 164, Subcontracts A and E, the Standards for Privacy of Individually Identifiable Health Information (“Privacy Rule”);

and 45 CFR Parts 160 and 164, Subcontracts A and C, the Security Standard (“Security Rule”). Pursuant to the Privacy and Security Rules, the Contractor must agree in writing to certain mandatory provisions regarding the use and disclosure of PHI and EPHI.

1. The Contractor will have access to some privileged and confidential materials of VA. These printed and electronic documents are for internal use only, are not to be copied or released without permission, and remain the sole property of VA. Some of these materials are protected by the Privacy Act of 1974 (revised by PL 93-5791) and Title 38. Unauthorized disclosure of Privacy Act or Title 38 covered materials is a criminal offense.

2. The VA Contracting Officer will be the sole authorized official to release in writing, any data, draft deliverables, final deliverables, or any other written or printed materials pertaining to this contract. The Contractor shall release no information. Any request for information relating to this contract presented to the Contractor shall be submitted to the VA Contracting Officer for response.

3. Contractor personnel recognize that in the performance of this effort, Contractor personnel may receive or have access to sensitive information, including information provided on a proprietary basis by carriers, equipment manufacturers and other private or public entities. Contractor personnel agree to safeguard such information and use the information exclusively in the performance of this contract. Contractor shall follow all VA rules and regulations regarding information security to prevent disclosure of sensitive information to unauthorized individuals or organizations as enumerated in this section and elsewhere in this Contract and its subcontracts and appendices.

4. Contractor shall limit access to the minimum number of personnel necessary for contract performance for all information considered sensitive or proprietary in nature. If the Contractor is uncertain of the sensitivity of any information obtained during the performance this contract, the Contractor has a responsibility to ask the VA Contracting Officer.

5. Contractor shall train all of their employees involved in the performance of this contract on their roles and responsibilities for proper handling and nondisclosure of sensitive VA or proprietary information. Contractor personnel shall not engage in any other action, venture or employment wherein sensitive information shall be used for the profit of any party other than those furnishing the information. The sensitive information transferred, generated, transmitted, or stored herein is for VA benefit and ownership alone.

6. Contractor shall maintain physical security at all facilities housing the activities performed under this contract, including any Contractor facilities according to VA-approved guidelines and directives. The Contractor shall ensure that security procedures are defined and enforced to ensure all personnel who are provided access to patient data must comply with published procedures to protect the privacy and confidentiality of such information as required by VA.

7. Contractor must adhere to the following:

a. The use of “thumb drives” or any other medium for transport of information is expressly prohibited.

b. Controlled access to system and security software and documentation.

c. Recording, monitoring, and control of passwords and privileges.

d. All terminated personnel are denied physical and electronic access to all data, program listings, data processing equipment and systems.

e. VA, as well as any Contractor (or Subcontractor) systems used to support development, provide the capability to cancel immediately all access privileges and authorizations upon employee termination.

f. Contractor PM and VA PM are informed within twenty-four (24) hours of any employee termination.

g. Acquisition sensitive information shall be marked "Acquisition Sensitive" and shall be handled as "For Official Use Only (FOUO)".

h. Contractor does not require access to classified data.

8. Regulatory standard of conduct governs all personnel directly and indirectly involved in procurements. All personnel engaged in procurement and related activities shall conduct business in a manner above reproach and, except as authorized by statute or regulation, with complete impartiality and with preferential treatment for none. The general rule is to strictly avoid any conflict of interest or even the appearance of a conflict of interest in VA/Contractor relationships.

9. VA Form 0752 shall be completed by all Contractor employees working on this contract and shall be provided to the CO before any work is performed. In the case that Contractor personnel are replaced in the future, their replacements shall complete VA Form 0752 prior to beginning work.

15. ADDENDUM B – VA INFORMATION SYSTEM SECURITY AND PRIVACY

APPLICABLE PARAGRAPHS TAILORED FROM: THE VA INFORMATION AND

INFORMATION SYSTEM SECURITY/PRIVACY LANGUAGE, VA HANDBOOK 6500.6,

APPENDIX C, MARCH 12, 2010

GENERAL

Contractors, Contractor personnel, Subcontractors, and Subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security.

ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS

a. A Contractor/Subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, Subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order.

b. All Contractors, Subcontractors, and third-party servicers and associates working with VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for Contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures.

c. Contract personnel who require access to national security programs must have a valid security clearance. National Industrial Security Program (NISP) was established by Executive Order 12829 to ensure that cleared U.S. defense industry contract personnel safeguard the classified information in their possession while performing work on contracts, programs, bids, or research and development efforts. The Department of Veterans Affairs does not have a Memorandum of Agreement with Defense Security Service (DSS).

Verification of a Security Clearance must be processed through the Special Security Officer located in the Planning and National Security Service within the Office of Operations, Security, and Preparedness.

d. Custom software development and outsourced operations must be located in the U.S. to the maximum extent practical. If such services are proposed to be performed abroad and are not disallowed by other VA policy or mandates (e.g., Business Associate Agreement, Section 3G), the Contractor/Subcontractor must state where all non-U.S. services are provided and detail a security plan, deemed to be acceptable by VA, specifically to address mitigation of the resulting problems of communication, control, data protection, and so forth.

Location within the U.S. may be an evaluation factor.

e. The Contractor or Subcontractor must notify the CO immediately when an employee working on a VA system or with access to VA information is reassigned or leaves the Contractor or Subcontractor’s employ. The CO must also be notified immediately by the Contractor or Subcontractor prior to an unfriendly termination.

VA INFORMATION CUSTODIAL LANGUAGE

1. Information made available to the Contractor or Subcontractor by VA for the performance or administration of this contract or information developed by the Contractor/Subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of VA. This clause expressly limits the Contractor/Subcontractor's rights to use data as described in Rights in Data - General, FAR 52.227-14(d) (1).

2. VA information should not be co-mingled, if possible, with any other data on the Contractors/Subcontractor’s information systems or media storage systems in order to ensure VA requirements related to data protection and media sanitization can be met. If co-mingling must be allowed to meet the requirements of the business need, the Contractor must ensure that VA information is returned to VA or destroyed in accordance with VA’s sanitization requirements. VA reserves the right to conduct onsite inspections of Contractor and Subcontractor IT resources to ensure data security controls, separation of data and job duties, and destruction/media sanitization procedures are in compliance with VA directive requirements.

3. Prior to termination or completion of this contract, Contractor/Subcontractor must not destroy information received from VA, or gathered/created by the Contractor in the course of performing this contract without prior written approval by VA. Any data destruction done on behalf of VA by a Contractor/Subcontractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook

6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self-certification by the Contractor that the data destruction requirements above have been met must be sent to the VA CO within 30 days of termination of the contract.

4. The Contractor/Subcontractor must receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with the terms of the contract and applicable Federal and VA information confidentiality and security laws, regulations, and policies. If Federal or VA information confidentiality and security laws, regulations and policies become applicable to VA information or information systems after execution of the contract, or if NIST issues or updates applicable FIPS or Special Publications (SP) after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations, and policies in this contract.

5. The Contractor/Subcontractor shall not make copies of VA information except as authorized and necessary to perform the terms of the agreement or to preserve electronic information stored on Contractor/Subcontractor electronic storage media for restoration in case any electronic equipment or data used by the Contractor/Subcontractor needs to be restored to an operating state. If copies are made for restoration purposes, after the restoration is complete, the copies must be appropriately destroyed.

6. If VA determines that the Contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the Contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12.

7. If a VHA contract is terminated for cause, the associated Business Associate Agreement (BAA) must also be terminated and appropriate actions taken in accordance with VHA Handbook 1600.05, Business Associate Agreements. Absent an agreement to use or disclose protected health information, there is no business associate relationship.

8. The Contractor/Subcontractor must store, transport, or transmit VA sensitive information in an encrypted form, using VA-approved encryption tools that are, at a minimum, FIPS 140-2 validated.

9. The Contractor/Subcontractor’s firewall and Web services security controls, if applicable, shall meet or exceed VA minimum requirements. VA Configuration Guidelines are available upon request.

10. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the Contractor/Subcontractor may use and disclose VA information only in two other situations: (i) in response to a qualifying order of a court of competent jurisdiction, or (ii) with VA prior written approval. The Contractor/Subcontractor must refer all requests for, demands for production of, or inquiries about, VA information and information systems to the VA CO for response.

11. Notwithstanding the provision above, the Contractor/Subcontractor shall not release VA records protected by Title 38 U.S.C. 5705, confidentiality of medical quality assurance records and/or Title 38 U.S.C. 7332, confidentiality of certain health records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse, or infection with human immunodeficiency virus.