S02 RFQ 36C10A25Q0079 9.17.25.pdf

PAGE 1 OF 1. REQUISITION NO.

2. CONTRACT NO. 3. AWARD/EFFECTIVE DATE 4. ORDER NO. 5. SOLICITATION NUMBER 6. SOLICITATION ISSUE DATE

a. NAME b. TELEPHONE NO. (No Collect Calls) 8. OFFER DUE DATE/LOCAL

TIME

9. ISSUED BY CODE 10. THIS ACQUISITION IS UNRESTRICTED OR SET ASIDE: % FOR:

SMALL BUSINESS

HUBZONE SMALL

BUSINESS

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

WOMEN-OWNED SMALL BUSINESS

(WOSB) ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

EDWOSB

8(A)

NAICS:

SIZE STANDARD:

11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

SEE SCHEDULE

12. DISCOUNT TERMS

13a. THIS CONTRACT IS A

RATED ORDER UNDER

DPAS (15 CFR 700)

13b. RATING

14. METHOD OF SOLICITATION

RFQ IFB RFP

15. DELIVER TO CODE 16. ADMINISTERED BY CODE

17a. CONTRACTOR/OFFEROR CODE FACILITY CODE 18a. PAYMENT WILL BE MADE BY CODE

TELEPHONE NO. UEI: EFT:

PHONE: FAX:

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN OFFER

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK BELOW IS CHECKED

SEE ADDENDUM

19. 20. 21. 22. 23. 24.

ITEM NO. SCHEDULE OF SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

(Use Reverse and/or Attach Additional Sheets as Necessary)

25. ACCOUNTING AND APPROPRIATION DATA 26. TOTAL AWARD AMOUNT (For Govt. Use Only)

27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1, 52.212-4. FAR 52.212-3 AND 52.212-5 ARE ATTACHED. ADDENDA ARE ARE NOT ATTACHED.

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA ARE ARE NOT ATTACHED

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN _______________ 29. AWARD OF CONTRACT: REF. ___________________________________ OFFER COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND DATED ________________________________. YOUR OFFER ON SOLICITATION DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY (BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED SET FORTH HEREIN IS ACCEPTED AS TO ITEMS:

30a. SIGNATURE OF OFFEROR/CONTRACTOR 31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER)

30b. NAME AND TITLE OF SIGNER (TYPE OR PRINT) 30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER (TYPE OR PRINT) 31c. DATE SIGNED

AUTHORIZED FOR LOCAL REPRODUCTION (REV. NOV 2021)

PREVIOUS EDITION IS NOT USABLE Prescribed by GSA - FAR (48 CFR) 53.212

7. FOR SOLICITATION

INFORMATION CALL:

STANDARD FORM 1449

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL PRODUCTS AND COMMERCIAL SERVICES

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 30

36C10A25Q0079 9-17-2025

Brianna Feaster 848-377-5084

9-18-2025

5:00PM EDT

36C10A Department of Veterans Affairs Technology Acquisition Center Procurement Service G 23 Christopher Way Eatontown NJ 07724

X

541519

$34M

N/A

X

See Schedule

36C10A

Department of Veterans Affairs Technology Acquisition Center Procurement Service G

Department of Veteran Affairs Financial Services Center P.O. Box 149971 Austin TX 78714-8971 See website at http://www.fsc.va.gov/einvoice.asp

(877) 353-9791

See CONTINUATION Page

Indefinite Delivery/Indefinite Quantity (IDIQ) National Contract for Document Storage Systems (DSS) Consult Tracking Manager Plus (CTM+) perpetual license annual maintenance, annual limited licenses as well as implementation, installation, testing

See Section B.1 – Schedule of Supplies/Services

See Continuation Pages

See CONTINUATION Page

X X

LORI L. WALKER

Request for Quotation: 36C10A25Q0079

SECTION B - CONTINUATION OF SF 1449 BLOCKS

B.1 SCHEDULE OF SUPPLIES AND SERVICES

Ordering Periods (Five 12-month Ordering Periods):

Ordering Period 1: September 26, 2025 through September 25, 2026 Ordering Period 2: September 26, 2026 through September 25, 2027 Ordering Period 3: September 26, 2027 through September 25 2028 Ordering Period 4: September 26, 2028 through September 25, 2029 Ordering Period 5: September 26, 2029 through September 25, 2030

All deliverables must be submitted to the VA Program Manager (PM), Contracting Officer’s Representative (COR), and Contracting Officer (CO) unless otherwise specified in the line item. Please be advised that in accordance with Federal Acquisition Regulation (FAR) Part 2.101, a “day” means, unless otherwise specified, a Calendar Day. Additionally, deliverables with due dates falling on a weekend or holiday shall be submitted the following Government workday after the weekend or holiday.

See Attachment 1 - National DSS CTM Plus IDIQ 9.17.25 for the contract schedule of supplies and services.

The Contracting Officer is authorized to issue task orders via electronic commerce methods.

Governing Law (continuation of Schedule of Supplies and Services above):

Federal law and regulations, including the Federal Acquisition Regulations (FAR), shall govern this Contract/Order. Commercial license agreements may be made a part of this Contract/Order but only if both parties expressly make them an addendum hereto, as permitted by FAR 12.212. If the commercial license agreement is not made an addendum, it shall not apply, govern, be a part of or have any effect whatsoever on the Contract/Order; this includes, but is not limited to, any agreement embedded in the computer software (clickwrap), any agreement that is otherwise delivered with or provided to the Government with the commercial computer software or documentation (shrinkwrap), or any other license agreement otherwise referred to in any document. If a commercial license agreement is made an addendum, only those provisions addressing data rights regarding the Government’s use, duplication and disclosure of data (e.g., restricted computer software) are included and made a part of this Contract/Order, and only to the extent that those provisions are not duplicative or inconsistent with Federal law, Federal regulation, the incorporated FAR clauses and the provisions of this Contract/Order; those provisions in the commercial license agreement that do not address data rights regarding the Government’s use, duplication and disclosure of data shall not be included or made a part of the Contract/Order. Federal law and regulation including, without limitation, the Contract Disputes Act (41 U.S.C. § 7101 et seq.), the Anti-Deficiency Act (31 U.S.C. § 1341 et seq.), the Competition in Contracting Act (41 U.S.C. § 3301 et seq.), the Prompt Payment Act (31 U.S.C. §3901 et seq.), Contracts for Data Processing or Maintenance (38 USC § 5725), and FAR clauses 52.212-4, 52.227-14, 52.227-19 shall supersede, control, and render ineffective any inconsistent, conflicting, or duplicative provision in any commercial license agreement. In the event of conflict between this clause and any provision in the Contract/Order or the commercial license agreement or elsewhere, the terms of this clause shall prevail. The Contractor shall deliver to the Government all data first produced under this Contract/Order with unlimited rights as defined by FAR 52.227-14. Claims of patent or copyright infringement brought against the Government as a party shall be defended by the U.S.

Department of Justice (DOJ in accordance with 28 U.S.C. § 516; at the discretion of DOJ, the Contractor may be allowed reasonable participation in the defense of the litigation. Any additional changes to the Contract/Order must be made by contract/order modification (Standard Form 30) and shall only be made by a warranted Contracting Officer. Nothing in this Contract/Order or any commercial license agreement shall be construed as a waiver of sovereign immunity.

SOFTWARE LICENSE, MAINTENANCE AND TECHNICAL SUPPORT:

(1) Definitions.

a) Licensee. The term “licensee” shall mean the U.S. Department of Veterans Affairs (“VA”) and is synonymous with “Government.”

b) Licensor. The term “licensor” shall mean the Contractor having the necessary license or ownership rights to deliver license, software maintenance and support of the computer software being acquired. The term “Contractor” is the party identified in Block 17a on the SF1449. If the Contractor is a reseller and not the Licensor, the Contractor remains responsible for performance under this Contract/Order.

c) Software. The term “software” shall mean the licensed computer software product(s) cited in the Schedule of Supplies/Services.

d) Maintenance. The term “maintenance” is the process of enhancing and optimizing software, as well as remedying defects. It shall include all new fixes, patches, releases, updates, versions and upgrades, as further defined below.

e) Technical Support. The term “technical support” refers to the range of services providing assistance for the software via the telephone, email, a website or otherwise.

f) Release or Update. The term “release” or “update” are terms that refer to a revision of software that contains defect corrections, minor enhancements or improvements of the software’s functionality. This is usually designated by a change in the number to the right of the decimal point (e.g., from Version 5.3 to 5.4). An example of an update is the addition of new hardware.

g) Version or Upgrade. The term “version” or “upgrade” are terms that refer to a revision of software that contains new or improved functionality. This is usually designated by a change in the number to the left of the decimal point (e.g., from Version 5.4 to 6).

(2) Software License.

a) Unless otherwise stated in the Schedule of Supplies/Services, the Performance Work Statement or Product Description, the software license provided to the Government is a perpetual, nonexclusive license to use the software.

b) The Government may use the software in a networked environment.

c) Any dispute regarding the license grant or usage limitations shall be resolved in accordance with the Disputes Clause incorporated in FAR 52.212-4(d).

d) All limitations of software usage are expressly stated in the Schedule of

Supplies/Services and the Performance Work Statement/Product Description.

(3) Software Maintenance and Technical Support.

a) If the Government desires to continue software maintenance and support beyond the period of performance identified in this Contract/Order, the Government will issue a separate contract or order for maintenance and support. Conversely, if a contract or order for continuing software maintenance and technical support is not received, the Contractor is neither authorized nor permitted to renew any of the previously furnished services.

b) The Contractor shall provide software support services, which includes periodic updates, enhancements and corrections to the software, and reasonable technical support, all of which are customarily provided by the Contractor to its commercial customers so as to cause the software to perform according to its specifications, documentation or demonstrated claims.

c) Any telephone support provided by Contractor shall be at no additional cost.

d) The Contractor shall provide all maintenance services in a timely manner in accordance with the Contractor’s customary practice or as defined in the Performance Work Statement or Product Description. However, prolonged delay (exceeding 2 business days) in resolving software problems will be noted in the Government’s various past performance records on the Contractor (e.g., www.cpars.gov).

e) If the Government allows the maintenance and support to lapse and subsequently wishes to reinstate it, any reinstatement fee charged shall not exceed the amounts that would have been charged if the Government had not allowed the subscription to lapse.

(4) Disabling Software Code.

The Government requires delivery of computer software that does not contain any code that will, upon the occurrence or the nonoccurrence of any event, disable the software.

Such code includes but is not limited to a computer virus, restrictive key, node lock, time-out or other function, whether implemented by electronic, mechanical, or other means, which limits or hinders the use or access to any computer software based on residency on a specific hardware configuration, frequency of duration of use, or other limiting criteria. If any such disabling code is present, the Contractor agrees to indemnify the Government for all damages suffered as a result of a disabling caused by such code, and the contractor agrees to remove such code upon the Government’s request at no extra cost to the Government. Inability of the Contractor to remove the disabling software code will be considered an inexcusable delay and a material breach of contract, and the Government may exercise its right to terminate for cause. In addition, the Government is permitted to remove the code as it deems appropriate and charge the Contractor for consideration for the time and effort expended in removing the code.

(5) Manuals and Publications.

Upon Government request, the Contractor shall furnish the most current version of the user manual and publications for all products/services provided under this Contract/Order at no cost.

http://www.cpars.gov/

B.2 CONTRACT MINIMUM GUARANTEE

In accordance with Section C, Federal Acquisition Regulation (FAR) Clause 52.216-22 entitled, “Indefinite Quantity” the Minimum guaranteed value under the National DSS CTM+ IDIQ contract is $150,000.00 and shall be met through the issuance of the first task order.

B.3 ORDERING PROCEDURES

a. Orders against this IDIQ contract will be issued in accordance with its terms and conditions at the sole discretion of the Government by a VA Contracting Officer during the period of the award date through 60 months thereafter. Individual task orders may include options for extended terms and increased quantities. Performance is authorized under any order issued against this IDIQ for up to 12 months after the end of the last ordering period. Upon receipt of a task order, the Contractor shall provide services at the prices set forth in the Schedule; Attachment 1.

b. Orders may be issued only as Firm Fixed Price. hourly rate CLINs identified in Attachment 1 shall be used as the basis for a Firm Fixed Price once a specific requirement is defined and negotiated for those services. Each order is a stand-alone order, with individual periods of performance. The price for services shall remain the same as the ordering period in which the task order was issued.

B.4 CONTRACT ADMINISTRATION DATA

1. Contract Administration: All contract administration matters will be handled by the following individuals:

a. CONTRACTOR: See Block 17a.

b. GOVERNMENT: Contracting Officer 36C10A

Department of Veterans Affairs Technology Acquisition Center – Procurement Service G

2. CONTRACTOR REMITTANCE ADDRESS: All payments by the Government to the contractor will be made in accordance with:

[X] 52.232-33, Payment by Electronic Funds Transfer—System For Award Management, or

[] 52.232-36, Payment by Third Party

3. INVOICES: Invoices shall be submitted in arrears:

a. Quarterly []

b. Semi-Annually []

c. Other [X] Upon delivery, inspection and acceptance

4. GOVERNMENT INVOICE ADDRESS: All Invoices from the contractor shall be submitted electronically in accordance with VAAR Clause 852.232-72 Electronic Submission of Payment Requests.

See website at:

http://www.fsc.va.gov/einvoice.asp

ACKNOWLEDGMENT OF AMENDMENTS: The respondent acknowledges receipt of amendments to the Solicitation numbered and dated as follows:

AMENDMENT NO DATE

B.5 ACCOUNTING AND APPROPRIATION DATA

Accounting and appropriation data will be specified on each individual task order.

B.6 SCHEDULE OF SUPPLIES AND SERVICES

The Respondent is required to complete and submit the Government provided Pricing Attachment 1. This spreadsheet will form the basis of the Schedule of Supplies and Services which will be incorporated into any subsequent award.

http://www.fsc.va.gov/einvoice.asp

B.7 PERFORMANCE WORK STATEMENT

PERFORMANCE WORK STATEMENT

DEPARTMENT OF VETERANS AFFAIRS

Office of Information & Technology

Integrated Veteran Care Program Office

Document Storage Systems Consult Tracker Manager Plus

Date: 9/16/2025 PWS Version Number: 1.0

1.0 BACKGROUND

The Department of Veterans Affairs (VA), Office of Information & Technology (OIT), Office of Integrated Veteran Care (IVC) strives to provide high quality, effective, and efficient Information Technology (IT) services to those responsible for providing care to the Veterans at the point-of-care as well as throughout all the points of the Veterans’ health care in an effective, timely and compassionate manner. VA depends on Information Management/Information Technology systems to meet mission goals.

Document Storage System (DSS) Consult Tracking Manager Plus (CTM+) is a web-based software solution providing instant, up to date dashboard view of the status of all patient consults in a clinical environment. CTM+ is server-based software which integrates with clinical data within the Veterans Health Information Systems and Technology Architecture (VistA) System using a Remote Procedure Call Broker interface connection and serves a Graphic User Interface/web application that is accessed through a client web browser. DSS CTM+ is classified as Class II software in

VA.

Currently, approximately 140 VA hospitals and their connected Community-based Outpatient Clinics (CBOCs) utilize the DSS CTM+ software. Approximately 20 sites have perpetual licenses and the remaining 120 sites have annual limited licenses. The VA requires brand name DSS CTM+ software and associated services for up to 170 VA Medical Centers (VAMCs) and approximately 1,193 CBOCs across the United States.

This action is for a comprehensive National DSS CTM+ Indefinite Delivery/Indefinite Quantity (IDIQ) contract that shall include up to 170 VA Medical Centers (VAMCs) and approximately 1,193 CBOCs across the enterprise.

2.0 APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. “Federal Information Security Modernization Act of 2014”

2. Federal Information Processing Standards (FIPS) Publication 140-3, “Security Requirements for Cryptographic Modules”, March 22, 2019

3. FIPS Pub 199. “Standards for Security Categorization of Federal Information and Information Systems,” February 2004

4. FIPS Pub 200, “Minimum Security Requirements for Federal Information and

Information Systems,” March 2006

5. FIPS Pub 201-3, “Personal Identity Verification of Federal Employees and

Contractors,” January 2022

6. 10 U.S.C. § 2224, "Defense Information Assurance Program", as amended

7. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

8. Public Law 109-461 (P.L. 109-461), Veterans Benefits, Health Care, and

Information Technology Act of 2006, as amended, Title IX, Information Security Matters

9. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”, as amended

10. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, https://www.va.gov/vapubs/index.cfm https://www.va.gov/vapubs/index.cfm

11. VA Handbook 0710, “Personnel Security and Suitability Program,” May 2, 2016, https://www.va.gov/vapubs/index.cfm

12. VA Directive 6102, “Internet/Intranet Services,” August 5, 2019

13. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and Guidelines,” as amended

14. Office of Management and Budget (OMB) Circular A-130, “Managing Federal

Information as a Strategic Resource,” July 28, 2016

15. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed

Services (CHAMPUS)”, as amended

16. NIST SP 800-66 Rev. 2, “Implementing the Health Insurance Portability and

Accountability Act (HIPAA) Security Rule: A Cybersecurity Resource Guide,” February 2024

17. 45 C.F.R Parts 160 and 164, Subparts A and E, the Standards for Privacy of Individually Identifiable Health Information (“Privacy Rule”); and 45 C.F.R.

Parts 160 and 164, Subparts A and C, the Security Standard (“Security Rule”); as amended

18. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended

19. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

20. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021 (see VA

NOTICE 24-18, dated September 27, 2024, “Update to VA Directive 6500 Cybersecurity Program”, and VA Notice 25-07, dated 3/18/25, “Amending VA Directive 6500 to incorporate M-24-15”)

21. VA Handbook 6500, “Risk Management Framework for VA Information Systems VA Information Security Program,” February 24, 2021 (see VA Notice 25-01, dated October 15, 2024, “Update to VA Handbook 6500 Risk Management Framework for VA Information Systems VA Information Security Program”, and VA Notice 25-06, dated 3/18/25, “Amending VA Directive 6500 to incorporate M-24-15”)

22. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI),” June 30, 2023

23. VA Handbook 6500.6, “Contract Security,” March 12, 2010 (see VA Notice 24-12, dated April 22, 2024, “Update to VA Handbook 6500.6, Contract Security, Appendix C VA Information and Information System Security/Privacy Language For Inclusion Into Contracts, As Appropriate”)

24. VA Handbook 6500.8, “Information System Contingency Planning,” March 25, 2025

25. VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018

26. VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017

27. OIT Process Asset Library (PAL), OIT Process Asset Library.

28. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

29. VA Directive 6508, “Implementation of Privacy Threshold Analysis and

Privacy Impact Assessment,” October 15, 2014

30. VA Directive 6510, “VA Identity, Credential and Access Management,”

September 3, 2024

31. VA Handbook 6510, “VA Identity, Credential and Access Management,”

September 27, 2024 https://www.va.gov/vapubs/index.cfm http://www.va.gov/vapubs http://www.va.gov/vapubs https://digital.va.gov/process-asset-library/ https://www.va.gov/trm/TRMHomePage.aspx

32. VA Directive and Handbook 6513, “Secure External Connections,” October 12, 2017

33. VA Directive 6300, “Records and Information Management,” September 21,

34. VA Handbook, 6300.1, “Records Management Procedures,“ March 24, 2010

35. NIST SP 800-37 Rev 2, “Risk Management Framework for Information

Systems and Organizations: A System Life Cycle Approach for Security and Privacy,” December 2018

36. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020)

37. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015

38. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-

12) Program,” March 24, 2014

39. OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005

40. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019

41. OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008

42. Federal Identity, Credential, and Access Management (FICAM) Architecture, June 30, 2023 (FICAM Architecture (idmanagement.gov))

43. NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access,“ June 2018

44. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, “Digital Identity Guidelines,” updated March 02, 2020

45. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014

46. VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland

Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

47. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

48. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

49. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

50. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019

51. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008

52. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (P.L. 110–140), December 19, 2007

53. Section 104 of the Energy Policy Act of 2005, (P.L. 109–58), August 8, 2005

54. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August

2, 2001 https://www.idmanagement.gov/arch/#:%7E:text=FICAM%20is%20the%20federal%20government%E2%80%99s%20enterprise%20approach%20to,identity%20processes%2C%20practices%2C%20policies%2C%20and%20information%20security%20disciplines.

https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514 https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896 https://www.cisa.gov/publication/tic-30-core-guidance-documents

55. VA Directive 0057, “VA Environmental Management Program,” October 25,

56. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

57. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

58. “Veteran Focused Integration Process (VIP) Guide 4.0,” March 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

59. VA Memorandum “Proper Use of Email and Other Messaging Services,”

January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

60. “Product Line Management Transformation Playbook” version 3.1, August 2023, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

61. NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020

62. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol

Version 6 (IPv6),” November 19, 2020

63. Social Security Number (SSN) Fraud Prevention Act of 2017

64. Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23,

65. C.F.R Title 15 Part 7, “Securing the Information and Communications

Technology and Services (ICTS) Supply Chain”, as amended

66. Executive Order 14028, “Executive Order on Improving the Nation's

Cybersecurity,” May 12, 2021, https://bidenwhitehouse.archives.gov/briefing-room/presidential-actions/2025/01/16/executive-order-on-strengthening-and-promoting-innovation-in-the-nations-cybersecurity/

67. OMB Memorandum M-22-09, “Moving the U.S. Government Toward Zero Trust Cybersecurity Principles”, January 26, 2022, https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf.

68. NIST SP 800-52 Revision 2, “Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations

69. OMB M-22-18, “Enhancing the Security of the Software Supply Chain through Secure Software Development Practices,” September 14, 2022

70. OMB M-23-16, “Update to Memorandum M-22-18,” June 9, 2023

71. OMB M-21-31, “Improving the Federal Government’s Investigative and

Remediation Capabilities Related to Cybersecurity Incidents,” August 27,

72. NIST SP 800-88 Revision 1 “Guidelines for Media Sanitization,” December

73. CISA Binding Operational Directive (BOD) 19-02: “Vulnerability Remediation Requirements of Internet-Accessible Systems,” April 29, 2019, BOD 19-02:

Vulnerability Remediation Requirements for Internet-Accessible Systems |

CISA

74. CISA BOD 22-01: “Reducing the Significant Risk of Known Exploited Vulnerabilities,” November 3, 2021, BOD 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities | CISA

75. CISA BOD 23-01: Improving Asset Visibility and Vulnerability Detection on Federal Networks.” Cybersecurity & Infrastructure Security Agency (CISA), BOD 23-01: Improving Asset Visibility and Vulnerability Detection on Federal Networks | CISA https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371 https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28 https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946 https://bidenwhitehouse.archives.gov/briefing-room/presidential-actions/2025/01/16/executive-order-on-strengthening-and-promoting-innovation-in-the-nations-cybersecurity/ https://bidenwhitehouse.archives.gov/briefing-room/presidential-actions/2025/01/16/executive-order-on-strengthening-and-promoting-innovation-in-the-nations-cybersecurity/ https://bidenwhitehouse.archives.gov/briefing-room/presidential-actions/2025/01/16/executive-order-on-strengthening-and-promoting-innovation-in-the-nations-cybersecurity/ https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf https://www.cisa.gov/news-events/directives/bod-19-02-vulnerability-remediation-requirements-internet-accessible-systems https://www.cisa.gov/news-events/directives/bod-19-02-vulnerability-remediation-requirements-internet-accessible-systems https://www.cisa.gov/news-events/directives/bod-19-02-vulnerability-remediation-requirements-internet-accessible-systems https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities https://www.cisa.gov/news-events/directives/bod-23-01-improving-asset-visibility-and-vulnerability-detection-federal-networks https://www.cisa.gov/news-events/directives/bod-23-01-improving-asset-visibility-and-vulnerability-detection-federal-networks

76. VA Directive 6550, Pre-Procurement Assessment and Implementation of Medical Devices/Systems, June 03, 2019

77. VA Memorandum, “VA Security Controls,” January 17, 2025, https://www.voa.va.gov/DocumentView.aspx?DocumentID=5010

3.0 SCOPE OF WORK

The Contractor shall provide a Commercial off the Shelf (COTS) brand name DSS CTM+ consult tracking manager plus tool software that includes perpetual license annual maintenance, and annual limited licenses as well as implementation; installation;

testing; software maintenance to include software updates, upgrades, bug fixes, help desk support; virtual training; reporting; and project management as specified in this PWS and in accordance with individual task orders executed.

Products and services shall be available to any VA facility/Veterans Integrated Service Network (VISN). Deployment of CTM+ in VA is local with on-premises VA/VISN servers that connect to facility VistA databases. VA will determine via task order the requirements for either a single server installation or a VISN server installation. The responsibilities of coordinating space/availability, hardware requirements, network connection requirements as well as maintaining the server(s) required by the software remains with the facilities and VA OIT. Support for software installations will be closely coordinated with the VA Contracting Officer’s Representative (COR) and the local facility. There is no development work under this effort.

To allow for enhanced functions that improve workflows such as, but not limited to, Patient Aligned Care Team (PACT) and Community Care, Contractor shall make available all add-ons for VAMC facilities that have existing licenses for the core CTM+ software. Future technical enhancements or improvements are considered in scope upon identification, evaluation and incorporation via modification to establish additional CLINs or licenses as appropriate.

4.0 PERFORMANCE DETAILS

4.1 CONTRACT TYPE

This is a single award Indefinite Delivery Indefinite Quantity contract. Individual Task Orders shall be issued on a firm fixed price basis.

4.2 ORDERING PERIOD

The Period of Performance (PoP) shall consist of five 12-month ordering periods. The overall Period of Performance for the IDIQ contract shall not exceed 60 months.

Performance is authorized under any order issued against this IDIQ for up to 12 months after the end of the last ordering period.

There are 11 Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

https://www.voa.va.gov/DocumentView.aspx?DocumentID=5010

Under current definitions, five are set by date:

New Year's Day January 1 Juneteenth June 19 Independence Day July 4 Veterans Day November 11 Christmas Day December 25

If any of the above falls on a Saturday, then Friday shall be observed as a holiday.

Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

Martin Luther King's Birthday Third Monday in January Washington's Birthday Third Monday in February Memorial Day Last Monday in May Labor Day First Monday in September Columbus Day Second Monday in October Thanksgiving Fourth Thursday in November

4.3 PLACE OF PERFORMANCE

Products and services ordered under this contract shall be delivered to and installed at VAMCs throughout all 50 states as well as Puerto Rico and Washington D.C. as specified in individual task orders. Incidental services, such as training or on-site maintenance, shall be provided at these locations. Work may be performed at Contractor facilities or remote locations other than Contractor facilities with prior concurrence from the local VA/VISN POC identified on the order or their designee and the COR.

4.4TRAVEL

Travel shall be in accordance with individual TO requirements. The Government anticipates travel under this effort to perform the tasks required in the PWS and individual task orders. All estimated travel costs should be included in the firm-fixed price line items. Travel costs will not be directly reimbursed by the Government as a separately priced item.

The Government encourages the Contractor to maximize its use of teleconferencing and video conferencing for meetings.

5.0 SPECIFIC TASKS AND DELIVERABLES

For delivery of all project artifacts, the Contractor shall utilize approved Process Asset Library (PAL) templates (refer to Section 2.0). When no PAL template exists, the Contractor shall design and develop a template that shall be reviewed and approved by the local VA/VISN POC identified on the order or their designee prior to delivery of the associated artifact. All documents shall be created using Microsoft Word, Microsoft Excel, Microsoft PowerPoint, and/or Microsoft Project. All draft documents shall be delivered in one of these formats. All final documents shall be delivered in one of these formats as well as PDF. Additionally, all shared documents shall also be in one of the above formats.

The Government shall review each artifact within five business days of receipt and shall provide comments. The Contractor shall have three business days to incorporate the Government ‘s comments, make appropriate revisions and provide a final artifact to the Government.

The Contractor shall provide and/or acquire services to include perpetual license annual maintenance and annual licenses, as well as implementation, installation, testing, maintenance (software updates, upgrades, bug fixes), help desk support, virtual training, reporting, and project management as specified in this PWS and in accordance with individual task orders executed.

5.1 PROJECT MANAGEMENT

A virtual kickoff meeting will be held within 10 business days after award. The Contractor shall coordinate the date, and time with the Contracting Officer (CO), Contract Specialist (CS), VA COR, and the VA IVC Program Manager (PM) or their assigned designee(s). The Contractor shall provide a draft agenda to the CO and VA COR at least five business days prior to the meeting. Upon VA approval of a final agenda, the Contractor shall distribute to all meeting attendees. During the kickoff meeting, the Contractor shall present, for review and approval by the VA, the details of the intended approach, work plan and project schedule via a Microsoft Office PowerPoint Presentation. At the conclusion of the meeting, the Contractor shall update the presentation with a final slide entitled “Summary Report” which shall include notes on any major issues, agreements or disagreements discussed during the kickoff meeting to be distributed with the meeting minutes. The Contractor shall prepare and distribute meeting minutes of the kickoff meeting to the CO, VA COR, and all attendees within three business days after the meeting. The Contractor shall obtain concurrence from the CS/CO/COR on the content of the meeting minutes prior to distribution of the document.

The Contractor will assign an Account Manager who will serve as the point of contact throughout the duration of contract performance. The contractor shall also designate an alternate Account Manager (local) who will serve as the POC when the Account Manager is not available (illness, vacation, training, etc.).

Deliverables:

A. Kickoff Meeting B. Kickoff Meeting Agenda C. Kickoff Meeting PowerPoint Presentation D. Kickoff Meeting Minutes

5.2 CTM+ Solution

The Contractor shall provide all software, licenses, and support as identified in this

PWS.

5.2.1. Consult Tracking Manager Plus Requirements

The Contractor shall provide a solution which supports at a minimum the following out of the box features, capabilities, and functionalities (salient characteristics):

1. A computer "web based" consult management solution

2. Use Remote Procedure Call Broker (RPC) interface connection with the VA VistA system and Computer Patient Record System (CPRS) that are already approved by VA OI&T (development or “new” interfaces are not acceptable) to provide real-time data”.

3. The product must be listed as authorized for use on VA computer and network systems as identified in the Technical Reference Model (TRM) Technology/Standard List – startup, new development and or products currently under review WILL NOT be considered.

4. Must provide options to sort by all consult toolbox codes that are available in Computer Patient Record System (CPRS) for example but not limited to Refer to Clinical Reviewer (RCR) and Consult has been reviewed for clinical appropriateness (CA1, CA2).

5. An instant "dashboard" view of the status of all consults.

6. A system that displays, sorts, and updates consult information in real time.

7. A platform that is optimized for access on mobile devices and or computers on wheels.

8. Capable of multiple queries across a variety of medical departments, providing views and status of all clinical consults.

9. Capable of multiple queries across a variety of medical departments, providing views defined by location, service line and other parameters.

10. Displays and updates consult information in real time.

11. Provide the ability to take action on consults from the dashboard view.

12. Allow the end user to customize the dashboard and worklist.

5.2.2 Implementation, Installation, and Testing

The Contractor shall review with the local VA/VISN POC, receipt of all contract line items for accuracy and completeness.

The Contractor shall manage the installation of software licenses and ensure the system is operational as prescribed in this PWS.

The Contractor shall provide an Implementation Plan and schedule and implementation meeting within one week of award.

The Contractor shall provide an implementation support team on site for end user, super user and administrative training, as well as shoulder-to-shoulder mentoring, no more than 25 users per session.

The Contactor shall provide milestones in the Implementation Plan.

The Contractor shall provide and maintain a detailed list of software license, including version released and product updates with System Version Guides.

The Contractor shall respond to reported issues and work directly with, the local VA/VISN POC, and OI&T to address issues with the software, including product configuration, product installation, hardware, bandwidth, and best practices.

The Contractor shall provide live reports on opened tickets, incidents, service requests, problems currently open and closed, known errors impacting the site along with the status and expected release date and workarounds to the local VA/VISN POC, and

OI&T.

Deliverables:

A. Software Perpetual License Annual Maintenance and Term Licenses B. Implementation Plan C. Detailed list of software, software license, version released and product updates D. System Version Guides

5.2.3 Maintenance and Support Services

The Contractor shall provide standard maintenance and support services for CTM+ to include but not limited to the following:

• For routine requests: Interface through a toll-free assistance phone and online support email. Monday through Friday 8:00am – 8:00pm EST.

• 24/7 emergency coverage on Nights, weekends, and Holidays through the toll-free system choosing the Emergency option.

• Emergency support service shall be available for catastrophic emergent issues (i.e., hosting platform issues, patient safety, or when a product is inaccessible to all VHA end-users).

The Contractor shall provide software updates, upgrades, bug fixes, and telephone support for the period of the maintenance term.

The Contractor shall provide maintenance coverage for the most recent version of CTM+ software at the time of requested support and the version immediately prior.

The Contractor shall provide a technical support staff to provide answer to questions regarding the operation and/or use of the Licensed Software by telephone without charge.

The Contractor shall provide a toll-free phone number for CTM+ service-related issues.

This includes a telephone line to an experienced on-call DSS Analyst operating 24 hours x 7 days x 365 days for VA customers for emergency service requirements.

The Contractor shall maintain records regarding all maintenance support provided by its personnel on the included system.

The Contractor shall comply with all VA Information Security Regulations when accessing CTM+ software system remotely.

The Contractor is expected to use remote access for work with the software being supported and will conform to all remote VPN security and functionality requirements.

The Contractor shall provide the local VA/VISN POC identified on the order or their designee(s) and the COR with a consolidated monthly progress report. It is due before the eighth of each month throughout the order’s duration. The progress report will cover all work completed during the preceding month and will present the work to be accomplished during the subsequent month. This report will identify any problems and/or issues that arose and a statement explaining how the problem and or issue was resolved. This report will also identify any problems that have arisen but have not been completely resolved with an explanation.

The Contractor shall work with the local VA/VISN POC identified on the order or their designee(s) to establish a process for receiving suggestions from field users, training attendees, and help desk ticket submitters. After following their established internal processes and if deemed approved by the Contractor, the enhancement shall be scheduled into Contractor’s software development cycle for inclusion into a future version at no cost to the Government to ensure the product meets VA’s needs for an enterprise solution.

Deliverables:

A. Operational and Maintenance Support Services B. Monthly Progress Report C. Process for Enhancement Suggestions

5.2.4 Virtual Training

The Contractor shall provide training to local sites on current and/or new functionality, upgraded features, processes, and provide supplemental training.

The Contractor shall provide refresher training to local sites to VA users previously trained; does not include full training for new staff. Web-based training shall be available on any VA desktop system in two-hour incremental training sessions. Training sessions must be coordinated with the local VA/VISN POC.

Within 90 days of contract award the Contractor will deliver training materials such as but not limited to user guides, recordings, etc. Training materials shall be updated concurrently with system updates and made available immediately upon system updates release.

A. Training Materials

5.3 OPTIONAL TASK 1: OUTGOING TRANSITION

With the expectation that legacy VistA VA sites will eventually transition to the Oracle Federal Electronic Health (FEHR)_Record platform in the future, the Contractor shall develop, provide, and execute an outgoing Transition Plan that includes:

• Inventory of current software at the site location provided to the local VA/VISN POC or their designee

• Transition tasks while bridging to Oracle FEHR platform system to ensure that there is no break in service (loss of CTM+ functionality/capabilities) until the new CTM+ solution is operational.

• Quote of transition software maintenance support by month up to 120 calendar days with the assumption that it will take 30 calendar days to transition to a new solution.

Data described herein is the exclusive property of the U.S. Government and shall be fully accessible to the Government in an unencrypted manner, freely readable and portable by VA so that the Data can be moved by VA at any time to any location and any platform of VA’s choosing, and the Contractor shall provide the Data to VA in an agreed upon readable format.

A. Transition Plan B. Readable, Portable Data

6.0 GENERAL REQUIREMENTS

6.1 ENTERPRISE AND IT FRAMEWORK

6.1.1 VA TECHNICAL REFERENCE MODEL

The Contractor shall comply with the VA OIT Technical Reference Model (VA TRM).

Compliance with the VA TRM is achieved by using only technologies and standards that are listed as approved for use in the VA TRM. The Contractor shall provide all necessary information requested by VA to ensure TRM approval is obtained prior to use on VA’s network.

6.1.2 ZERO TRUST – VA CRITICAL SECURITY CONTROLS

VA has established minimum mandatory security requirements and requires that any network connected software system or service must meet the VA Critical Security Controls as outlined in the VA Memorandum, “VA Security Controls”, https://www.voa.va.gov/DocumentView.aspx?DocumentID=5010. VA Critical Security Controls identify the minimum mandatory requirements that must be implemented across all VA enterprise infrastructure, cloud computing environments, information systems, networks, and specialized devices (medical devices/systems, special-purpose systems, and research scientific computing devices) that process, store, and/or transmit VA data. Effective July 1, 2025, the Contractor shall implement these VA Critical Security Controls, within any network connected software system or service prior to being authorized for use in the VA. This functional requirement is not negotiable, and Plan of Action & Milestones (POAM) will not be accepted in the event these controls cannot be implemented for new systems. Critical Security Controls are intended to increase VA’s security posture and provide security and privacy risk visibility into the VA network and is not a new requirement. The Contractor’s failure to maintain these VA Critical Controls after implementation will result in VA discontinuing the use of the system.

6.1.3 FEDERAL IDENTITY, CREDENTIAL, AND ACCESS MANAGEMENT (FICAM)

The Contractor shall ensure COTS product(s), software configuration and customization, and/or new software are Personal Identity Verification (PIV) card-enabled by accepting HSPD-12 PIV credentials using VA Enterprise Architecture (EA), and VA Identity and Access Management (IAM) approved Enterprise Technology Guidelines (ETG). The Contractor shall ensure all Contractor delivered applications and systems comply with the VA Identity, Credential, and Access Management policies and guidelines set forth in Executive Order 14028, VA Handbook 6510 VA Identity and Access Management, VA Handbook 0735 Homeland Security Presidential Directive 12 (HSPD-12) Program, CISA Binding Operational Directive 23-01, and align with the Federal Identity, Credential, and Access Management Roadmap and Implementation Guidance v2.0.

The Contractor shall ensure all Contractor delivered applications and systems provide user authentication services compliant with the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-63-3, VA Handbook 6500, and VA IAM enterprise requirements for direct, assertion-based authentication, and/or trust-based authentication, as determined by the ETGs. Direct authentication at a minimum must include Public Key Infrastructure (PKI) based authentication supportive of PIV card and/or Common Access Card (CAC), as determined by the business need.

The Contractor shall ensure all Contractor delivered applications and systems conform to the specific Identity and Access Management PIV requirements set forth in the Office of Management and Budget (OMB) Memoranda M-05-24, M-19-17, M-22-09, and NIST https://www.voa.va.gov/DocumentView.aspx?DocumentID=5010 https://www.ea.oit.va.gov/ https://digital.va.gov/office-of-information-and-technology/reference-library/enterprise-technology-guidelines/ https://digital.va.gov/office-of-information-and-technology/reference-library/enterprise-technology-guidelines/ https://bidenwhitehouse.archives.gov/wp-content/uploads/legacy_drupal_files/omb/memoranda/2005/m05-24.pdf https://bidenwhitehouse.archives.gov/wp-content/uploads/2019/05/M-19-17.pdf https://bidenwhitehouse.archives.gov/wp-content/uploads/2022/01/M-22-09.pdf

Federal Information Processing Standard (FIPS) 201-3. Contractor delivered applications and systems shall be on the FIPS 201 Approved Product List (APL). If the Contractor delivered application and system is not on the APL, the Contractor shall be responsible for taking the application and system through the FIPS 201 Evaluation Program.

The Contractor shall ensure all Contractor delivered applications and systems support:

1. Automated provisioning and are able to use enterprise provisioning service.

2. Interfacing with VA’s Master Person Index (MPI) to provision identity attributes, if the solution relies on VA user identities. MPI is the authoritative source for VA user identity data.

3. The VA defined unique identity (Secure Identifier [SEC ID] / Integrated Control Number [ICN]).

4. Multiple authenticators for a given identity and authenticators at every Authenticator Assurance Level…