S02 - PWS v2 - Security Architecture Services v2 - Copy.docx

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Veterans Health Administration Office of Health Informatics Health Information Governance Health Care Security (HCS) Office

Security Architecture Services

Date: August 17, 2021

1.0 BACKGROUND

This requirement involves the gathering of data and transfer of knowledge to the Veterans Health Administration (VHA), Office of Health Informatics (OHI), Health Information Governance (HIG), Health Care Security (HCS) Program Office, and the VHA Security Architect. The contractor is tasked with identifying, researching, and assessing emerging technologies in the healthcare security space as potential candidates for improving the quality and efficiency of VHA healthcare. The Contractor further reviews, analyzes, and parses federal policy, regulations, and industry standards to develop security and privacy requirements to guide healthcare information technology development. And the Contractor finally develops a security architecture and strategic plan to outline the results of the above stated work and presents a plan for VHA to leverage that work. All work is completed under the auspices, and for the support, or the Health Care Security (HCS) Program Office.

The HCS mission is to lead the integration of security solutions within the Veterans Health Administration (VHA) through architecture, requirements, and compliance built upon robust foundations of internal and external cross-organizational collaborations to safeguard Veteran health information.

HCS ensures that the VHA healthcare security program supports compliance with the Health Insurance Portability and Accountability Act (HIPAA) through:

1. The development and use of a secure enterprise architecture based on approved standards;

2. The integration of health care security requirements implemented throughout the System/Software Development Life Cycle (SDLC); and,

3. The assessment and support of HIPAA compliance efforts for VHA facilities and business associates.

APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. 44 U.S.C. § 3541, “Federal Information Security Management Act (FISMA) of 2002”

2. Federal Information Processing Standards (FIPS) Publication 140-2, “Security Requirements for Cryptographic Modules”

3. FIPS Pub 201-2, “Personal Identity Verification of Federal Employees and Contractors,” August 2013

4. 10 U.S.C. § 2224, "Defense Information Assurance Program"

5. Carnegie Mellon Software Engineering Institute, Capability Maturity Model® Integration for Development (CMMI-DEV), Version 1.3 November 2010; and Carnegie Mellon Software Engineering Institute, Capability Maturity Model® Integration for Acquisition (CMMI-ACQ), Version 1.3 November 2010

6. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

7. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”

8. VA Directive 0710, “Personnel Suitability and Security Program,” June 4, 2010, http://www.va.gov/vapubs/

9. VA Handbook 0710, Personnel Suitability and Security Program, September 10, 2004, http://www.va.gov/vapubs

10. VA Directive and Handbook 6102, “Internet/Intranet Services,” July 15, 2008

11. 36 C.F.R. Part 1194 “Electronic and Information Technology Accessibility Standards,” July 1, 2003

12. Office of Management and Budget (OMB) Circular A-130, “Management of Federal Information Resources,” November 28, 2000

13. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed Services (CHAMPUS)”

14. An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule, October 2008

15. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended by the Workforce Investment Act of 1998 (P.L. 105-220), August 7, 1998

16. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

17. VA Directive 6500, “Managing Information Security Risk: VA Information Security Program,” September 20, 2012

18. VA Handbook 6500, “Risk Management Framework for VA Information Systems – Tier 3: VA Information Security Program,” March 10, 2015

19. VA Handbook 6500.1, “Electronic Media Sanitization,” November 03, 2008

20. VA Handbook 6500.2, “Management of Data Breaches Involving Sensitive Personal Information (SPI)”, January 6, 2012

21. VA Handbook 6500.3, “Assessment, Authorization, And Continuous Monitoring Of VA Information Systems,” February 3, 2014

22. VA Handbook 6500.5, “Incorporating Security and Privacy in System Development Lifecycle” March 22, 2010

23. VA Handbook 6500.6, “Contract Security,” March 12, 2010

24. VA Handbook 6500.8, “Information System Contingency Planning”, April 6, 2011

25. Project Management Accountability System (PMAS) portal (reference https://www.voa.va.gov/pmas/)

26. OI&T ProPath Process Methodology (reference process maps at http://www.va.gov/PROPATH/Maps.asp and templates at http://www.va.gov/PROPATH/Templates.asp

27. NOTE: In the event of a conflict, OI&T ProPath takes precedence over other processes or methodologies.

28. One-VA Technical Reference Model (TRM) (reference at http://www.va.gov/trm/TRMHomePage.asp)

29. National Institute Standards and Technology (NIST) Special Publications (SP)

30. VA Directive 6508, VA Privacy Impact Assessment, October 3, 2008

31. VA Directive 6300, Records and Information Management, February 26, 2009

32. VA Handbook, 6300.1, Records Management Procedures, March 24, 2010

33. OMB Memorandum, “Transition to IPv6”, September 28, 2010

34. VA Directive 0735, Homeland Security Presidential Directive 12 (HSPD-12) Program, February 17, 2011

35. VA Handbook 0735, Homeland Security Presidential Directive 12 (HSPD-12) Program, March 20, 2014

36. OMB Memorandum M-06-18, Acquisition of Products and Services for Implementation of HSPD-12, June 30, 2006

37. OMB Memorandum 05-24, Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors, August 5, 2005

38. OMB memorandum M-11-11, “Continued Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors, February 3, 2011

39. OMB Memorandum, Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation, May 23, 2008

40. Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance, December 2, 2011

41. NIST SP 800-116, A Recommendation for the Use of Personal Identity Verification (PIV) Credentials in Physical Access Control Systems, November 20, 2008

42. OMB Memorandum M-07-16, Safeguarding Against and Responding to the Breach of Personally Identifiable Information, May 22, 2007

43. NIST SP 800-63-2, Electronic Authentication Guideline, August 2013

44. Draft NIST Special Publication 800-157, Guidelines for Derived PIV Credentials, March 2014

45. NIST Special Publication 800-164, Guidelines on Hardware-Rooted Security in Mobile Devices (Draft), October 2012

46. Draft National Institute of Standards and Technology Interagency Report (NISTIR) 7981 Mobile, PIV, and Authentication, March 2014

47. VA Memorandum, VAIQ #7100147, Continued Implementation of Homeland Security Presidential Directive 12 (HSPD-12), April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

48. VA Memorandum, VAIQ # 7011145, VA Identity Management Policy, June 28, 2010 (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

49. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

50. Trusted Internet Connections (TIC) Reference Architecture Document, Version 2.0, Federal Interagency Technical Reference Architectures, Department of Homeland Security, October 1, 2013, https://www.fedramp.gov/files/2015/04/TIC_Ref_Arch_v2-0_2013.pdf

51. OMB Memorandum M-08-05, “Implementation of Trusted Internet Connections (TIC), November 20, 2007

52. OMB Memorandum M-08-23, Securing the Federal Government’s Domain Name System Infrastructure, August 22, 2008

53. VA Memorandum, VAIQ #7497987, Compliance – Electronic Product Environmental Assessment Tool (EPEAT) – IT Electronic Equipment, August 11, 2014 (reference Document Libraries, EPEAT/Green Purchasing Section, https://www.voa.va.gov/documentlistpublic.aspx?NodeID=552)

54. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (Public Law 110–140), December 19, 2007

55. Section 104 of the Energy Policy Act of 2005, (Public Law 109–58), August 8, 2005

56. Executive Order 13514, “Federal Leadership in Environmental, Energy, and Economic Performance,” October 5, 2009

57. Executive Order 13423, “Strengthening Federal Environmental, Energy, and Transportation Management,” January 24, 2007

58. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 2, 2001

59. VA Directive 0058, “VA Green Purchasing Program”, July 19, 2013

60. VA Handbook 0058, “VA Green Purchasing Program”, July 19, 2013

61. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote Access”, January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

62. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

63. VA Directive 6071, Project Management Accountability System (PMAS), February 20, 2013

64. VA Memorandum, “Implementation of Federal Personal Identity Verification (PIV) Credentials for Federal and Contractor Access to VA IT Systems”, (VAIQ# 7614373) July 9, 2015, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

65. VA Memorandum “Mandatory Use of PIV Multifactor Authentication to VA Information System” (VAIQ# 7613595), June 30, 2015, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

66. VA Memorandum “Mandatory Use of PIV Multifactor Authentication for Users with Elevated Privileges” (VAIQ# 7613597), June 30, 2015; https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

SCOPE OF WORK

In support of technology and policy interests, emerging health technology projects, programs and initiatives investigative work, the contractor shall perform targeted research, produce analysis reports and white papers; provide policy documentation support; conduct analyses of existing or best practice processes or discovery methodologies; produce processes and make recommendations to establish repeatable practices; and identify potential business requirements suggested by selected emerging technologies and policies. Analysts act as subject experts for targeted technologies and near-term and strategic teams in conducting hands-on investigations that validate or extend their investigative work.

PERFORMANCE DETAILS

4.1 PERFORMANCE PERIOD

The period of performance (POP) shall be one year from the date of award, plus one (1), one (1) year option period, to be exercised at the Government’s discretion.

4.2 PLACE OF PERFORMANCE

Tasks under this PWS shall be performed at Contractor facilities.

4.3 TRAVEL

Travel is not authorized under this contract.

4.4 FORMAL ACCEPTANCE OR REJECTION OF DELIVERABLES

The Government will review each deliverable within 10 business days and provide comments. The contractor shall have five (5) business days to incorporate the Government’s comments and make appropriate revisions.

4.5 CHANGES TO THE PWS

Any changes to this PWS shall be authorized and approved only through written correspondence from the CO. A copy of each change will be kept in a contract folder, along with all other products of the contract. Costs incurred by the contractor through the actions of parties other than the CO shall be borne by the contractor.

4.6 CONFIDENTIALITY AND NON-DISCLOSURE

It is agreed that:

1. The preliminary and final deliverables, as well as all associated working papers and other material deemed relevant by VA that have been generated by the contractor in the performance of this contract, are the exclusive property of the U.S. Government and shall be submitted upon request to the CO at the time of final delivery.

1. The CO will be the sole authorized official to release, verbally or in writing, any data, draft deliverables, final deliverables, or any other written or printed materials pertaining to this contract. No information shall be released by the contractor. Any request for information relating to this contract presented to the contractor shall be submitted to the CO for response.

1. Press releases, marketing material, or any other printed or electronic documentation related to this contract shall not be publicized without the written approval of the CO.

SPECIFIC WORK GROUPS, TASKS AND DELIVERABLES

Task 1 - VHA Security Architecture

Task 1 Background: Work entailed under Task 1, VHA Security Architecture, involves the identification and development of security and privacy related artifacts that would inform a new and restructured architecture. The architecture would be a business security architecture in general, but also demonstrate some characteristics of a strategic plan as required. The architecture would be based on elements from both the Federal Enterprise Architecture Framework (FEAF) and the Sherwood Applied Business Security Architecture (SABSA). Representative organizations that would inform the architecture include, but are not limited to, Health Level Seven International (HL7), Federal Health Information Modeling and Standards (FHIMS), Office of the National Coordinator for Health Information Technology (ONC), the National Strategy for Trusted Identities in Cyberspace, the Federal Identity, Credential and Access Management initiatives, and National Institute of Standards and Technology (NIST).

Task 1 Objectives: The overall objective of Task 1, VHA Security Architecture, is to create a harmonized VHA Business Security Architecture, incorporating emerging health care technology and policy trends appropriate to support major VHA programs and projects.

Tasks in Work Group 1, VHA Security Architecture, involve liaison activities with the VHA Business Architecture Program Office. This liaison activity is expected to enable the VHA to identify synergies and establish common understandings between the two groups in various areas, including a unified VHA security and privacy architecture, common modeling methodologies, and shared security and privacy artifacts. The contractor shall summarize the collaboration activity for each month in a Monthly Activity Report that describes all the meetings, presentations, work products produced, and components addressed during that month.

Subtask 1A: VHA Security Architecture.

The VHA Security Architecture is a 1-5 year forward looking view, facilitates a business-wide, standards-based approach to security. The architecture is Veteran-centric and is directly mapped to various organizational goals including the Department of Defense and Department of Veterans Affairs Interoperability Modernization Strategy for high level guidance, and the VHA Health Information Strategic Plan for more detailed guidance. In addition, all architecture work must be considered in context with the VHA Electronic Health Record Monetarization effort in transition from the current VistA Electronic Health Record to CERNER.

Subtask 1B: Architecture Security Artifacts/Reports The contractor shall perform directed analysis, review, and reporting of relevant security architecture topics of emerging interest. Analysis shall include support for the identification and proper placement of security requirements. Typical form of reports are short papers (5-10 pages) or slide presentations as appropriate.

Deliverables for Task 1 (Subtask 1A and 1B):

1A: VHA Security and Privacy Architecture (SPA) Schedule: Draft delivered three (3) months and final delivered nine (9) months after award.

1B: Architecture Topics/White Papers/Reports Schedule: Delivered three (3), six (6), nine (9) and twelve (12) months after award.

Task 2 – Healthcare Information Security and Privacy Requirements (HISPR) Support General Objectives: Provide support for the conduct of HISPR activities.

The contractor shall support a working group to baseline VHA health care security and privacy requirements derived from policies, regulations, and healthcare industry standards. Standards-based requirements are correlated with applicable NIST security and privacy publications. Standards-based requirements are non-functional in nature as distinguished from purely project focused and/or developmental requirements.

The contractor shall administratively facilitate and manage content and materials of the HISPR. The contractor shall summarize VHA healthcare business interests in healthcare privacy and security standards requirements that may be deemed by the HISPR as supportive of VHA business requirements. This includes meeting invitations, meeting minutes, maintenance of the HISPR requirements, integration with VA requirements systems (if applicable), conducting requirements reviews, and balloting. The HISPR exercises oversight authority regarding the development and approval of healthcare security and privacy requirements for use within VA. The contractor acts to ensure that the HISPR maintains ultimate responsibility for gathering, validating, and maintaining all healthcare security and privacy requirements. Activities shall be conducted in accordance with the HISPR Charter and operational guidelines (available upon contract award). There is no expectation to maintain a database. However, the requirements will be maintained using spreadsheets.

Task 2 – Detailed Objectives:

The contractor shall perform tasks and provide deliverables related to developing, balloting, and managing VHA business security requirements, coordinating with Office of Information and Technology (OI&T), and other VHA stakeholders. In performing these duties, the overarching objective is to produce an business-wide authoritative view of security and privacy that includes VHA healthcare-specific needs and which can be used by VA leadership, developers, operational staff, policy/administrative authorities, business requirements developers and system architects. To achieve these overarching objectives, HISPR activities must support a number of technical activities including:

· A single authoritative view of business security and privacy standards-based requirements across the VA enterprise,

· Compliance with NIST and other regulatory guidance,

· Compliance with VHA adopted Standards,

· Compliance with VA, VHA. and Federal security policies and requirements governance,

· Consistency with VHA business security and privacy requirements,

· Requirements management following established guidelines (to be provided upon award), and

· Integration with OI&T managed requirements services and databases if required (e.g., Technical Reference Model).

Sub-Task 2A HISPR Operations. Prepare agenda for and facilitate HISPR meetings, publish announcements, and meeting minutes.

Deliverable for Sub-Task 2A:

HISPR Meeting Announcements and Agenda/Minutes Schedule: Quarterly

Sub-Task 2B Prepare and conduct HISPR Ballots.

This includes parsing of source materials to extract requirements, creation of ballots, conduct of ballot activities, and resolution of comments.

Deliverable for Task 2B:

HISPR Ballot Preparation and Resolution Schedule: Three (3) and nine (9) months after award

TASK 3 Monthly Activity Report

The contractor shall meet monthly with the program manager to discuss the Contractor's written status of the deliverables, issues, external activities, and reportable management-level items. The format of this report shall follow a VHA style to be provided upon contract award.

Deliverable for Task 3:

Monthly Activity Report Schedule: Monthly

6.1.1 POSITION/TASK RISK DESIGNATION LEVEL(S)

The position sensitivity and the level of background investigation commensurate with the required level of access for the following tasks/subtasks/optional tasks within the Performance Work Statement are:

Position Sensitivity and Background Investigation Requirements

Background Investigation requirements identify, in effect, the Background Investigation requirements for contractor individuals, based upon the tasks the particular contractor individual will be working. The submitted contractor Staff Roster must indicate the required Background Investigation Level for each contractor individual based upon the tasks the contractor individual will be working, in accordance with their submitted proposal.

6.2 CONTRACTOR PERSONNEL SECURITY REQUIREMENTS

Contractor Responsibilities:

1. The contractor shall prescreen all personnel requiring access to the computer systems to ensure they maintain the appropriate Background Investigation, and are able to read, write, speak and understand the English language.

1. The contractor shall bear the expense of obtaining background investigations, regardless of the final adjudication determination. A Bill of Collections shall be generated by the VA after final adjudication determination has been received. Final adjudication results may take up to six months but normally received within 90 days after submission. The VA has determined this contract requires the following levels of investigations and associated costs (per person):

The amounts stated above are the current for fiscal year 2013, but subject to annual price changes as established by OPM in the Federal Investigation Notices. Contractors shall be billed per Office of Personnel Management/Security Investigations Center (OPM/ SIC) guidelines and should anticipate annual increases. All fee schedule questions should be directed to the SIC at 501-257-4031 or e-mail: vhalitsiccontracting@va.gov.

1. Within 3 business days after award, the contractor shall provide a roster of contractor and Subcontractor employees to the COR to begin their background investigations. The roster shall contain the contractor’s Full Name, Full Social Security Number, Date of Birth, Place of Birth, and individual background investigation level requirement (based upon Section 5.0 Tasks).

1. The contractor should coordinate the location of the nearest VA fingerprinting office through the COR. Only electronic fingerprints are authorized.

1. For a Low Risk designation, the following forms are required to be completed: 1. OF-306 and 2. DVA Memorandum – Electronic Fingerprints. For Moderate or High Risk, the following forms are required to be completed: 1. VA Form 0710 and 2. DVA Memorandum – Electronic Fingerprints. These should be submitted to the COR within 5 business days after award.

1. The contractor personnel will receive an email notification from the Security and Investigation Center (SIC); through the Electronics Questionnaire for Investigations Processes (e-QIP) identifying the website link that includes detailed instructions regarding completion of the investigation documents (SF85, SF85P, or SF 86). The contractor personnel shall submit all required information related to their background investigations utilizing the Office of Personnel Management’s (OPM) Electronic Questionnaire for Investigations Processing (e-QIP).

1. The contractor is to certify and release the e-QIP document, print and sign the signature pages, and send them to the COR for electronic submission to the SIC. These should be submitted to the COR within 3 business days of receipt of the e-QIP notification email.

1. The contractor shall be responsible for the actions of all personnel provided to work for VA under this contract. If damages arise from work performed by contractor provided personnel, under the auspices of this contract, the contractor shall be responsible for all resources necessary to remedy the incident.

1. A contractor may be granted unescorted access to VA facilities and/or access to VA Information Technology resources (network and/or protected data) with a favorably adjudicated Special Agreement Check (SAC) or “Closed, No Issues” (SAC) finger print results, training delineated in VA Handbook 6500.6 (Appendix C, Section 9), and, the signed “Contractor Rules of Behavior.” However, the contractor will be responsible for the actions of the contractor personnel they provide to perform work for VA. The investigative history for contractor personnel working under this contract must be maintained in the database of the Office of Personnel Management (OPM).

1. The contractor, when notified of an unfavorably adjudicated background investigation on a contractor employee as determined by the Government, shall withdraw the employee from consideration in working under the contract.

1. Failure to comply with the contractor personnel security investigative requirements may result in termination of the contract for default.

Government Responsibilities:

The Security Investigations Center will require the following forms from the contractor or from the contractor’s personnel:

1. Within 3 business days after award, the contractor shall provide a roster of contractor and Subcontractor employees to the COR to begin their background investigations. The roster shall contain the contractor’s Full Name, Full Social Security Number, Date of Birth, Place of Birth, and individual background investigation level requirement (based upon Section 6.2).

1. The contractor should coordinate the location of the nearest VA fingerprinting office through the COR. Only electronic fingerprints are authorized.

1. For a Low Risk designation, the following forms are required to be completed: 1. OF-306 and 2. DVA Memorandum – Electronic Fingerprints. For Moderate or High Risk, the following forms are required to be completed: 1. VA Form 0710 and 2. DVA Memorandum – Electronic Fingerprints. These should be submitted to the COR within 5 business days after award. (DVA Memorandum – Electronic Fingerprints is filled out by the VA Facility that took the electronic fingerprints)

1. The contractor personnel will receive an email notification from the Security and Investigation Center (SIC), through the Electronics Questionnaire for Investigations Processes (e-QIP) identifying the website link that includes detailed instructions regarding completion of the investigation documents (SF85, SF85P, or SF 86). (The SF85 does not need to be uploaded because OPM is going paperless and the contractor will complete this questionnaire online when the e-QIP link is sent.) (DVA Memorandum – Electronic Fingerprints is filled out by the VA Facility that took the electronic fingerprints) (Please be advised that the contractor will need all the necessary information easily accessible as the website will time out and they can lose the information they inputted if they take too long to fill it in.)The contractor personnel shall submit all required information related to their background investigations utilizing the Office of Personnel Management’s (OPM) Electronic Questionnaire for Investigations Processing (e-QIP).

1. The contractor is to certify and release the e-QIP document, print and sign the signature pages, and send them to the COR for electronic submission to the SIC. These should be submitted to the COR within 3 business days of receipt of the e-QIP notification email.

1. The SIC will then upload the e-QIP signature pages to e-QIP and release the case file to OPM for investigation.

1. The SIC will notify the CO and contractor after adjudicating the results of the background investigations received from OMB.

6.3 METHOD AND DISTRIBUTION OF DELIVERABLEs

The contractor shall deliver documentation in electronic format, unless otherwise directed in Section B of the solicitation/contract. Acceptable electronic media include MS Word 2010/2013, MS Excel 2010/2013, MS PowerPoint 2010/2013, MS Project 2010/2013, MS Access 2010/2013, MS Visio 2010/2013, AutoCAD 2010/2013, and Adobe Postscript Data Format (PDF).

6.4 PERFORMANCE METRICS

The Government will utilize a Quality Assurance Surveillance Plan (QASP) throughout the life of the contract to ensure that the Contractor is performing the services required by this PWS in an acceptable manner. The Government reserves the right to alter or change the surveillance methods in the QASP at its own discretion.

The table below defines the Performance Standards, Acceptable Quality Levels, Methods of Surveillance, and Incentives for the Required Services (Deliverables) associated with this effort.

Required Services (Deliverables)

Deliverable 1A VHA Security Architecture Document 100% of deliverable shall be performed with accuracy, timeliness, and comprehensiveness No deviation without CO approval.

Conformance with specified data formats and content requirements per task descriptions. Format and content requirements are per previous versions available in VA Pulse.

File reviews, periodic inspections, and random observations.

Contractor shall re-work products found to be unacceptable or not meeting the intent of the task and the re-work will be considered to be within scope of this PWS. May receive favorable or unfavorable performance evaluation.

Required Services (Deliverables)

Conformance with specified data formats and content requirements per task descriptions. Format and content requirements are per previous versions available upon contract award.

File reviews, periodic inspections, and random observations.

Contractor shall re-work products found to be unacceptable or not meeting the intent of the task and the re-work will be considered to be within scope of this PWS. May receive favorable or unfavorable performance evaluation.

Conformance with specified data formats and content requirements per task descriptions. Format and content requirements are per previous versions available in VA Pulse.

File reviews, periodic inspections, and random observations.

Contractor shall re-work products found to be unacceptable or not meeting the intent of the task and the re-work will be considered to be within scope of this PWS. May receive favorable or unfavorable performance evaluation.

FACILITY/RESOURCE PROVISIONS

All procedural guides, reference materials, and program documentation for the project and other Government applications will also be provided on an as-needed basis.

The Contractor shall request other Government documentation deemed pertinent to the work accomplishment directly from the Government officials with whom the Contractor has contact. The Contractor shall consider the COR as the final source for needed Government documentation when the Contractor fails to secure the documents by other means. The Contractor is expected to use common knowledge and resourcefulness in securing all other reference materials, standard industry publications, and related materials that are pertinent to the work.

VA may provide remote access to VA specific systems/network in accordance with VA Handbook 6500, which requires the use of a VA approved method to connect external equipment/systems to VA’s network. Citrix Access Gateway (CAG) is the current and only VA approved method for remote access users when using or manipulating VA information for official VA Business. VA permits CAG remote access through approved Personally Owned Equipment (POE) and Other Equipment (OE) provided the equipment meets all applicable 6500 Handbook requirements for POE/OE. All of the security controls required for Government furnished equipment (GFE) must be utilized in approved POE or OE. The Contractor shall provide proof to the COR for review and approval that their POE or OE meets the VA Handbook 6500 requirements and VA Handbook 6500.6 Appendix C, herein incorporated as Addendum B, before use. CAG authorized users shall not be permitted to copy, print or save any VA information accessed via CAG at any time. VA prohibits remote access to VA’s network from non-North Atlantic Treaty Organization (NATO) countries. The exception to this is countries where VA has approved operations established (e.g. Philippines and South Korea). Exceptions are determined by the COR in coordination with the Information Systems Security Officer (ISSO) and Privacy Officer (PO).

This remote access may provide access to VA specific software such as Veterans Health Information System and Technology Architecture (VistA), ClearQuest, ProPath, Primavera, and Remedy, including appropriate seat management and user licenses, depending upon the level of access granted. The Contractor shall utilize government-provided software development and test accounts, document and requirements repositories, etc. as required for the development, storage, maintenance and delivery of products within the scope of this effort. The Contractor shall not transmit, store or otherwise maintain sensitive data or products in Contractor systems (or media) within the VA firewall IAW VA Handbook 6500.6 dated March 12, 2010. All VA sensitive information shall be protected at all times in accordance with VA Handbook 6500, local security field office System Security Plans (SSP’s) and Authority to Operate (ATO)’s for all systems/LAN’s accessed while performing the tasks detailed in this PWS. The Contractor shall ensure all work is performed in countries deemed not to pose a significant security risk. For detailed Security and Privacy Requirements (additional requirements of the contract consolidated into an addendum for easy reference) refer to ADDENDUM A – ADDITIONAL VA REQUIREMENTS, CONSOLIDATED and ADDENDUM B - VA INFORMATION AND INFORMATION SYSTEM SECURITY/PRIVACY LANGUAGE.

ADDENDUM A – ADDITIONAL VA REQUIREMENTS, CONSOLIDATED

Cyber and Information Security Requirements for VA IT Services The Contractor shall ensure adequate LAN/Internet, data, information, and system security in accordance with VA standard operating procedures and standard PWS language, conditions, laws, and regulations. The Contractor’s firewall and web server shall meet or exceed VA minimum requirements for security. All VA data shall be protected behind an approved firewall. Any security violations or attempted violations shall be reported to the VA Program Manager and VA Information Security Officer as soon as possible. The Contractor shall follow all applicable VA policies and procedures governing information security, especially those that pertain to certification and accreditation.

Contractor supplied equipment, PCs of all types, equipment with hard drives, etc. for contract services must meet all security requirements that apply to Government Furnished Equipment (GFE) and Government Owned Equipment (GOE). Security Requirements include: a) VA Approved Encryption Software must be installed on all laptops or mobile devices before placed into operation, b) Bluetooth equipped devices are prohibited within VA; Bluetooth must be permanently disabled or removed from the device, c) VA approved anti-virus and firewall software, d) Equipment must meet all VA sanitization requirements and procedures before disposal. The COR, CO, the PM, and the Information Systems Security Officer (ISSO) must be notified and verify all security requirements have been adhered to.

Each documented initiative under this contract incorporates VA Handbook 6500.6, “Contract Security,” March 12, 2010 by reference as though fully set forth therein. The VA Handbook 6500.6, “Contract Security” shall also be included in every related agreement, contract or order. The VA Handbook 6500.6, Appendix C, is included in this document as Addendum B.

Training requirements: The Contractor shall complete all mandatory training courses on the current VA training site, the VA Talent Management System (TMS), and will be tracked therein. The TMS may be accessed at https://www.tms.va.gov. If you do not have a TMS profile, go to https://www.tms.va.gov and click on the “Create New User” link on the TMS to gain access.

Contractor employees shall complete a VA Systems Access Agreement if they are provided access privileges as an authorized user of the computer system of VA.

VA Enterprise Architecture Compliance The applications, supplies, and services furnished under this contract must comply with One-VA Enterprise Architecture (EA), available at http://www.ea.oit.va.gov/index.asp in force at the time of issuance of this contract, including the Program Management Plan and VA's rules, standards, and guidelines in the Technical Reference Model/Standards Profile (TRMSP). VA reserves the right to assess contract deliverables for EA compliance prior to acceptance.

VA Internet and Intranet Standards The Contractor shall adhere to and comply with VA Directive 6102 and VA Handbook 6102, Internet/Intranet Services, including applicable amendments and changes, if the Contractor’s work includes managing, maintaining, establishing and presenting information on VA’s Internet/Intranet Service Sites. This pertains, but is not limited to: creating announcements; collecting information; databases to be accessed, graphics and links to external sites.

Internet/Intranet Services Directive 6102 is posted at (copy and paste the following URL to browser): http://www1.va.gov/vapubs/viewPublication.asp?Pub_ID=409&FType=2

Internet/Intranet Services Handbook 6102 is posted at (copy and paste following URL to browser): http://www1.va.gov/vapubs/viewPublication.asp?Pub_ID=410&FType=2

Notice of the Federal Accessibility Law Affecting All Electronic and Information Technology Procurements (Section 508)

On August 7, 1998, Section 508 of the Rehabilitation Act of 1973 was amended to require that when Federal departments or agencies develop, procure, maintain, or use Electronic and Information Technology, that they shall ensure it allows Federal employees with disabilities to have access to and use of information and data that is comparable to the access to and use of information and data by other Federal employees. Section 508 required the Architectural and Transportation Barriers Compliance Board (Access Board) to publish standards setting forth a definition of electronic and information technology and the technical and functional criteria for such technology to comply with Section 508. These standards have been developed and published with an effective date of December 21, 2000. Federal departments and agencies shall develop all Electronic and Information Technology requirements to comply with the standards found in 36 CFR 1194.

Section 508 – Electronic and Information Technology (EIT) Standards The Section 508 standards established by the Architectural and Transportation Barriers Compliance Board (Access Board) are incorporated into, and made part of all VA orders, solicitations and purchase orders developed to procure Electronic and Information Technology (EIT). These standards are found in their entirety at: http://www.section508.gov and http://www.section508.gov/acquisition-regulations.

A printed copy of the standards will be supplied upon request. The Contractor shall comply with the technical standards as marked:

Equivalent Facilitation Alternatively, offerors may propose products and services that provide equivalent facilitation, pursuant to Section 508, subpart A, §1194.5. Such offerors will be considered to have provided equivalent facilitation when the proposed deliverables result in substantially equivalent or greater access to and use of information for those with disabilities.

Compatibility with Assistive Technology The Section 508 standards do not require the installation of specific accessibility-related software or the attachment of an assistive technology device. Section 508 requires that the EIT be compatible with such software and devices so that EIT can be accessible to and usable by individuals using assistive technology, including but not limited to screen readers, screen magnifiers, and speech recognition software.

Acceptance and Acceptance Testing Deliverables resulting from this solicitation will be accepted based in part on satisfaction of the identified Section 508 standards’ requirements for accessibility and must include final test results demonstrating Section 508 compliance.

Deliverables should meet applicable accessibility requirements and should not adversely affect accessibility features of existing EIT technologies. The Government reserves the right to independently test for 508 Compliance before delivery. The Contractor shall be able to demonstrate 508 Compliance upon delivery.

Automated test tools and manual techniques are used in the VA Section 508 compliance assessment. Additional information concerning tools and resources can be found at Section 508 Office Home Page. http://www.section508.va.gov/section508/Resources.asp.

Deliverables:

A. Final Section 508 Compliance Test Results

Physical Security & Safety Requirements:

The Contractor and their personnel shall follow all VA policies, standard operating procedures, applicable laws and regulations while on VA property. Violations of VA regulations and policies may result in citation and disciplinary measures for persons violating the law.

1. The Contractor and their personnel shall wear visible identification at all times while they are on the premises.

2. VA does not provide parking spaces at the work site; the Contractor must obtain parking at the work site if needed. It is the responsibility of the Contractor to park in the appropriate designated parking areas. VA will not invalidate or make reimbursement for parking violations of the Contractor under any conditions.

3. Smoking is prohibited inside/outside any building other than the designated smoking areas.

4. Possession of weapons is prohibited.

5. The Contractor shall obtain all necessary licenses and/or permits required to perform the work, with the exception of software licenses that need to be procured from a Contractor or vendor in accordance with the requirements document. The Contractor shall take all reasonable precautions necessary to protect persons and property from injury or damage during the performance of this contract.

Confidentiality and Non-Disclosure The Contractor shall follow all VA rules and regulations regarding information security to prevent disclosure of sensitive information to unauthorized individuals or organizations.

The Contractor may have access to Protected Health Information (PHI) and Electronic Protected Health Information (EPHI) that is subject to protection under the regulations issued by the Department of Health and Human Services, as mandated by the Health Insurance Portability and Accountability Act of 1996 (HIPAA); 45 CFR Parts 160 and 164, Subparts A and E, the Standards for Privacy of Individually Identifiable Health Information (“Privacy Rule”); and 45 CFR Parts 160 and 164, Subparts A and C, the Security Standard (“Security Rule”). Pursuant to the Privacy and Security Rules, the Contractor must agree in writing to certain mandatory provisions regarding the use and disclosure of PHI and EPHI.

1. The Contractor will have access to some privileged and confidential materials of VA. These printed and electronic documents are for internal use only, are not to be copied or released without permission, and remain the sole property of VA. Some of these materials are protected by the Privacy Act of 1974 (revised by PL 93-5791) and Title 38. Unauthorized disclosure of Privacy Act or Title 38 covered materials is a criminal offense.

2. The VA CO will be the sole authorized official to release in writing, any data, draft deliverables, final deliverables, or any other written or printed materials pertaining to this contract. The Contractor shall release no information. Any request for information relating to this contract presented to the Contractor shall be submitted to the VA CO for response.

3. Contractor personnel recognize that in the performance of this effort, Contractor personnel may receive or have access to sensitive information, including information provided on a proprietary basis by carriers, equipment manufacturers and other private or public entities. Contractor personnel agree to safeguard such information and use the information exclusively in the performance of this contract. Contractor shall follow all VA rules and regulations regarding information security to prevent disclosure of sensitive information to unauthorized individuals or organizations as enumerated in this section and elsewhere in this Contract and its subparts and appendices.

4. Contractor shall limit access to the minimum number of personnel necessary for contract performance for all information considered sensitive or proprietary in nature. If the Contractor is uncertain of the sensitivity of any information obtained during the performance this contract, the Contractor has a responsibility to ask the VA CO.

5. Contractor shall train all of their employees involved in the performance of this contract on their roles and responsibilities for proper handling and nondisclosure of sensitive VA or proprietary information. Contractor personnel shall not engage in any other action, venture or employment wherein sensitive information shall be used for the profit of any party other than those furnishing the information. The sensitive information transferred, generated, transmitted, or stored herein is for VA benefit and ownership alone.

6. Contractor shall maintain physical security at all facilities housing the activities performed under this contract, including any Contractor facilities according to VA-approved guidelines and directives. The Contractor shall ensure that security procedures are defined and enforced to ensure all personnel who are provided access to patient data must comply with published procedures to protect the privacy and confidentiality of such information as required by VA.

7. Contractor must adhere to the following:

a. The use of “thumb drives” or any other medium for transport of information is expressly…