S05 36C10D24Q0314.docx

Special Notice

Special Notice

GENERAL INFORMATION

RECOVERY ACT FUNDS

Veterans Benefits Administration Acquisition Directorate 1800 G Street NW Washington DC 20006

POINT OF CONTACT*

Contracting Officer Vernon Mario Quilici vernon.quilici@va.gov 240-215-1674

ADDITIONAL INFORMATION

AGENCY’S URL

URL DESCRIPTION

AGENCY CONTACT’S EMAIL ADDRESS

DESCRIPTION

1.0 INTRODUCTION

THIS IS NOT A SOLICITATION. The Department of Veterans Affairs (VA), Veterans Benefits Administration (VBA), is issuing this Request for Information (RFI) – Special Notice seeking Loan Origination and Loan Servicing System, Software as a Service (SaaS), Support Services. This RFI is issued solely for information and planning purposes only. There is no obligation for the Government to acquire any products or services described in this RFI. In accordance with the Federal Acquisition Regulations, responses to this notice are not offers and cannot be accepted by the Government to form a binding contract. No funds have been authorized, appropriated, or received for this effort. The information provided may be used by VBA in developing its acquisition strategy and informing, refining, and finalizing the Performance Work Statement (PWS). Interested parties are responsible for adequately marking proprietary, restricted or competition sensitive information contained in their RFI response. Only electronic responses to this RFI will be accepted. The Government will not pay for any time expended or information submitted in response to this RFI. Eligibility in participating in a future acquisition does not depend upon a response to this RFI.

2.0 BACKGROUND

The VBA, Loan Guaranty (LGY), is seeking Loan Origination and Loan Servicing System, Software as a Service (SaaS), Support Services to fully support both the origination of LGY’s current loan types and allow for additional loan type in the future, but to support and allow for the servicing oversite of the anticipated fifty thousand plus VASP loans. The requirement needed will be a Software as a Service (SaaS) that will focus on both the origination and servicing systems and will provide LGY with fully integrated real time analytics, data analysis, reporting with both prebuilt and customizable reports and can maintain and support all applicable State, CFPB and Federal Lending. The selected awardee will provide all resources to accomplish both the installation, implementation, training, and ongoing support of this effort in accordance with PWS. See attached PWS draft for requirements, tasks and deliverables.

The intent is to award a single Task Order pursuant to FAR Part 8 ordering procedures, as a 100% SDVOSB set-aside under GSA MAS, and with NAICS of 518210. However, may pursue sole-source options, as necessary. SDVOSBs need to be certified in VetCert Veteran Small Business Certification (sba.gov) to be eligible.

3.0 INFORMATION SOUGHT

The Government is seeking the following information to be provided by the Vendors when responding to the RFI:

· Company Information

· Capability Statement

3.1 Company Information

RFI respondents shall provide the following information:

· Company Name

· Company Address

· Company Point of Contact (name, address, telephone number, email address)

· SAM UEI Number

· NAICS Codes; and business size for NAICS code: 518210 Computing Infrastructure Providers, Data Processing, Web Hosting, and Related Services

· Identify if your company has any of the following business concern statuses (include all that apply): Small Business (SB); Certified Small Business Administration (SBA) 8(a) firm; Small Disadvantaged Business (SDB); Service-Disabled, Veteran-Owned Small Business (SDVOSB); Veteran-Owned Small Business (VOSB); Economically Disadvantaged Women-Owned Small Business (EDWOSB); Woman-Owned Small Business (WOSB); Historically Underutilized Business Zone (HUBZone) Small Business;

· Existing Multiple Award Contract (MAC) vehicles currently held by your company (examples may include General Service Administrations (GSA) schedules, Government-Wide Acquisition Contracts (GWACs), Indefinite Delivery Contracts (IDCs), Blanket Purchase Agreements (BPAs)) available for the Government’s use for this requirement. For each MAC vehicle provide:

· vehicle name

· vehicle number

· date of award

· expiration date

3.2 Capability Statement

RFI respondents shall provide a capability statement with an overview and approach of the entity’s ability, with listed expertise and experience, to accomplish all of tasks and deliverables within the attached draft PWS, and within this RFI.

4.0 RESPONSE INSTRUCTIONS

Please submit responses, via email, to the Contracting Officer, Vernon Mario Quilici at vernon.quilici@va.gov. Submissions are due no later than September 23, 2024, at 5:00 p.m. (EDT). The email subject line should contain the following: “Response to RFI 36C10D24Q0314, Loan Origination and Loan Servicing System, Software as a Service (SaaS), Support Services. VBA reserves the right to not reply to any emails, responses, questions, and materials submitted in response to the RFI. Mark your response as “Proprietary Information” if the information included is business sensitive and /or includes trade secrets. RFI responses shall not exceed 20 pages total, to include the capability statement. Responses shall be prepared on standard 8.5 x 11-inch paper (charts may be landscaped but must be on 8.5 x 11-inch paper) and shall be in Times New Roman, font size (12) with 1” margins (charts, graphs can be smaller, as needed). All pages of the response shall be appropriately numbered and identified with the RFI number.

See attached document: P09 LOS LSS PWS Revised Draft See attached document: P09 LOS LSS PWS Revised Draft.

P09 LOS LSS PWS Revised Draft.docx Performance Work Statement

Loan Guaranty Service Loan Origination and Loan Servicing System Services

1.0 Background

The mission of Loan Guaranty Service (LGY) is to maximize opportunities for Veterans and Service members to obtain, retain, and adapt homes by providing a viable and fiscally responsible benefit program in recognition of their service to the nation. LGY has experienced substantial growth and significant program change over the last several years. More Veterans, Service members and mortgage professionals have realized advantages that the Department of Veterans Affairs (VA) home loan benefit provides, Congress has also passed several pieces of legislation that expanded access, eligibility, and added operational complexity to the program. Part of this expansion is the creation and implementation of the Veterans Affairs Servicing Program (VASP).

LGY will be tasked with providing VA senior leaders and administration officials, Congress, the mortgage industry, and Veterans with information regarding VASP as it affects the VA Home Loan program. LGY seeks to acquire and implement a loan origination and Loan servicing system which will provide real time analytics, data analysis and reporting with both prebuilt and customizable reports. In addition, the Origination and Servicing system platform will maintain and support all applicable state, Consumer Financial Protection Bureau (CFPB), and Federal Lending Regulations. To meet these organizational requirements, LGY is seeking to engage a third party to provide the requested platforms to meets LGY’s current and future needs and requirements.

2.0 Scope or Purpose

The purpose of this Performance Work Statement (PWS) is to support the procurement of a Loan Origination and Loan Servicing Platform to fully support both the origination of LGY’s current loan types and allow for additional loan type in the future, but to support and allow for the servicing oversite of the anticipated fifty thousand plus VASP loans. The requirement needed will be a Software as a Service (SaaS) that will focus on both the origination and servicing systems and will provide LGY with fully integrated real time analytics, data analysis, reporting with both prebuilt and customizable reports and can maintain and support all applicable State, CFPB and Federal Lending. The selected awardee will provide all resources to accomplish both the installation, implementation, training, and ongoing support of this effort.

3.0 Task and Deliverables

The Vendor shall provide all required deliverables described within this document. All deliverables shall be submitted to the Contracting Officer Representative (COR) and/or Government Project Manager in accordance with the PWS and meet all quality standards.

1) 3.0.Task T1 Awardee to provide Project Management Plan

Deliverable: Project Management Plan

The Vendor shall provide a detailed Project Management Plan (PMP) and briefing for the VBA project team. The PMP shall provide the Vendor’s plan for completing the task identified in each task order. The Vendor’s plan shall be responsive to the PWS and describe, in further detail, the approach to be used for each aspect of the task order as defined in the technical quotation. At a minimum, the PMP shall include the risk, quality, and technical management approach, work breakdown structure (WBS), detailed schedule, and proposed personnel. The

Standard Operating Procedures (SOP) are part of the PMP, where applicable, and are kept updated by the vendor and provided to the Government. SOPs currently in place will be provided to task order awardee as a starting point and shall be revised as necessary by the task order awardee. New SOPs, if needed, will have to be provided, as well by the vendor. The Vendor shall keep the PMP up to date throughout the period of performance monthly.

2) Deliver to LGY a functional Loan Origination and Loan Servicing System using the SaaS model.

3) The vendor will work with LGY IT to fully implement systems for LGY benefit.

4) 3.0 Task T4: Competency Operating System Training Program

The vendor to provide onsite product training to selected LGY team members in the Nashville LGY location after product is installed and fully tested by OIT.

Deliverable: Competency Operating System Training Program

Upon award of the Task Order, the Vendor shall work with the VBA Project

Manager, target audience, and SMEs to aid in the development of organizational requirements for employee competencies and proficiencies, training and performance support, standards-based assessments, training plans, remediation, assessment, and evaluation.

5) The vendor to ongoing technical support to LGY with additional hours available as required per the contract document.

6) Additional seat license can be purchased from awardee via contract modification as required.

7) The vendor shall deliver the following performance objectives throughout the period of performance:

· All written deliverables and other information will be phrased in layperson language. Statistical and other technical terminology will not be used without providing a glossary of terms.

· The Vendor shall not deliver to the VBA any proprietary products or information, software, tools, or systems unless specifically specified in an Enterprise Term License Agreement. Company financial information provided in invoices and other documents are exempted from this requirement. If the vendor believes further exemption is required to this requirement as necessary for effective or efficient execution of this task order, the vendor shall request a specific exception in writing to the COR and shall not provide the proprietary tools or information until written approval is received from the Contracting Officer (CO).

· For all meetings, the vendor shall be responsible for administrative and facilitation support, as well as providing meeting materials. Meetings will be conducted virtually and/or in-person, as approved by the Contracting Officer.

· The Government intends to convene a post-award meeting with awardee within ten (10) calendar days after the task order is awarded. The CO shall notify all Prime Vendors of a specific date and agenda within five (5) calendar days after award. The kick-off meeting shall be held virtually. The Government shall specify dates and agenda. As required by the CO and the designated COR, a kickoff meeting may be held at the task order level after award. Dates, locations, and agenda shall be specified in the task order.

· At the sole discretion of the Government, intermittent project status reviews may be conducted on an informal basis (by telephone or teleconference) on an as needed requirements approved by the Contracting Officer or Program Manager. Minutes shall be provided by the vendor and provided to the COR and CO within five (5) calendar days after such meeting, in electronic format, compatible with VA systems (Word docx or Power Point).

3.1 Delivery Schedule

Task

Deliverable

Delivery Date

3.0 T 1

Proposed Project Management Plan

Due within 10 days of Award

3.0 T 2

LOS LSS system using the SaaS model

Delivery to be coordinated with OIT and LGY.

3.0 T 3

Implement and install LOS LSS System

Expedited within VA LGY IT constraints.

3.0 T 4

Provide onsite system training to selected LGY employees in LGY Nashville location. Employees to travel from several LGY locations for the training.

Following completion of LOS LSS system installation.

3.0 T 5

Provide ongoing product technical support

This phase starts following install and completed training.

4.0 Government- Furnished Information, Equipment, and Facilities

The selected Vendor for this contract will have access to Government furnished data. Vendor will supply both the Loan Origination System and the Loan Servicing System referenced in section 4.0 Task and Deliverables of this PWS. After contract award the selected vendor will be required to execute an ISA-MOU between VA LGY and the Vender.

5.0 Travel

Required for selected LGY staffing for training on the selected software. The vendor will send staff to Nashville to conduct onsite training of selected LGY staff on the acquired systems. The dates and length of this training shall be discussed on the initial kick off call and then agreed upon between LGY and the awardee following the call.

6.0 Period of Performance

The contract shall be awarded during FY24. The performance period will be September 30, 2024, through September 29, 2025. The total period of performance will be a one-year contract award. There will be a one-year base period and up to four years of renewable option periods. The Vendor and LGY Senior Management or its representative will coordinate the delivery of all deliverables as outlined in the delivery schedule included in this SOW. The information provided herein is an estimate.

There are ten (10) Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, five are set by date:

1. New Year's Day January 1

2. Juneteenth June 19

3. Independence Day July 4

4. Veterans Day November 11

5. Christmas Day December 25

If any of the above falls on a Saturday, then the Friday before said date shall be observed as a holiday. Similarly, if one falls on a Sunday, then the Monday following said date shall be observed as a holiday.

The other six federal holidays are set by a day of the week and month:

Martin Luther King, Jr.’s Birthday Third Monday in January

Washington’s Birthday Third Monday in February

Memorial Day Last Monday in May

Labor Day First Monday in September

Columbus Day Second Monday in October

Thanksgiving Day Fourth Thursday in November

7.0 Place of Performance and Implementation, Training

The vendor shall conduct onsite training for selected LGY staff in the Nashville location. The office address for training is Suite 760W, 3402 West End Ave., Nashville TN 37203. The installation of the operation systems shall be performed virtually over the internet in conjunction with LGY, ISO’s.

8.0 Vendor’s Key Personnel

The Vendor shall be responsible for managing and overseeing the activities of all Vendor personnel, as well as sub-contractor resources used in the delivery of this effort. Vendor management responsibilities shall include all activities necessary to ensure the accomplishment of timely and effective support and performed in accordance with the requirements contained in the PWS. The selected awardee shall have at a minimum 2 personnel, that are in their software development department go thru the VA background investigation process.

8.1 Vendor Personnel Administration

The Vendor shall provide a workforce—appropriately-sized and possessing the requisite skills, knowledge, abilities, experience, training, licensing, and certifications

(in compliance with all federal, state, local laws and regulations, and VA regulations)— necessary to accomplish the requirements of this PWS. The Vendor personnel are expected to be proficient working across the Microsoft Office Suite, including Excel, using office automation equipment and software, and having sufficient written and verbal communication skills to support VBA. Further, the Vendor shall ensure that alternate personnel is available when any staff member, including the regular point of contact and the key personnel, are unavailable. Alternate support personal, when assigned to cover during absences, must have comparable qualifications and the

Vendor shall provide a resume for every alternate support personnel proposed.

Also, Vendor personnel shall be acceptable to the Government in terms of personal and professional conduct and in technical knowledge. Should any Vendor personnel be determined by the Government to be unacceptable, in terms of technical competency or unacceptable personal or professional conduct while onsite or while working on contract activities, the Vendor shall immediately remove and replace the unacceptable personnel at no additional cost to the Government. The CO or COR may notify the Vendor and request immediate removal of any personnel assigned to any task by the Vendor that are deemed to have a conflict of interest with the

Government or if the performance is deemed to be unsatisfactory by the Government.

The Vendor shall identify replacement personnel within three (3) business days of the notification. Replacement personnel shall have comparable qualifications—at the very least, the same minimum qualifications—of the personnel being replaced and the

Vendor shall provide a resume for every alternate support personnel proposed.

Employment and staffing difficulties shall not be justification for failure to meet established schedules or performance measures.

Contractor Personnel Security

Any individual who requires access to the VA site(s), personally identifiable information (PII)and/or access to VA local area network (LAN) systems shall be the subject of a favorable fingerprint check (SAC) adjudicated by VBA Personnel Security Office (PERSEC). Individuals are required a background investigation and must receive a favorable adjudication from the VA Personnel Security and Adjudication Center (PSAC). These requirements are applicable to all sub-contractor personnel requiring any Background Investigation (BI) conducted by Defense Counterintelligence Security Agency (DCSA).

The level of BI will be in accordance with VA Directive 0710 dated June 4, 2010.Background Investigation: The Contractor employee level of background investigation required for this effort is:

Low Risk (T1) Security – Employees

Note: The position sensitivity should reflect the results from the completion of the PDAT versus the title of the individual.

Investigation Documents: Immediately after contract award, the COR will provide the Contractor with the following background investigation documents to be completed by the Contractor and returned thru the COR to VBA PERSEC to begin the background investigations process for all contract employees working on the contract who will have access to VA/VBA facilities, VA systems, or privacy data:

a. Background Investigation Request Worksheet

b. Optional Form 306 – Declaration for Federal Employment

c. Fingerprint Request Form

Upon receipt of documents listed above, the COR will submit the background investigation package to VBA’s Personnel Security Specialist. Upon notification of favorable fingerprint results, the COR should request the official VA email account and will be notified of all background investigation requirements preventing the Contractor from an immediate onboard. Thereafter, the Contractor shall receive an email notification from DCSA including detailed instructions regarding completion of the background clearance application process in the Electronic Questionnaires for Investigations Processing (e-QIP) system. e-QIP is an online, internet accessible system, where the Contractor employee shall complete the security questionnaire required for OPM to process background investigation. Once the e-QIP is released by VBA PERSEC, scheduled by OPM, the Contractor may begin work while the background investigation is ongoing.

Reciprocation: Contractors who have current favorable background investigation previously conducted by OPM or DCSA may be accepted through reciprocation. When a previous personnel security clearance is currently held, it does not preclude the Contractor from submitting a complete Background Investigation Package to the COR immediately after contract award for all Contractor employees who will be working on the resulting task orders written against the Task Order. Pre-Screen: The Contractor shall prescreen all personnel who require access to VA site(s) and/or access to VA LAN systems to ensure they maintain a U.S. citizenship or Alien Registration that authorizes them to work in the U.S., and are able to read, write, speak, and understand the English language.

Contractor Performance: Contractor performance shall not commence before:

The VBA has confirmed favorable fingerprint results, or PSAC confirms that it has received the Contractor’s investigative documents, the documents are complete, and that the background investigation information has been released to OPM for scheduling of the background investigation, or VBA or the PSAC has confirmed that the verified investigation will be reciprocated. Copy of Certificate of Investigation (COI): The COR will notify and forward the Contractor a copy of the Certificate of Investigation when the background investigation has been favorably completed or a Certificate of Eligibility (Form 4236) if the investigation has been reciprocated. The Contractor, if notified, of an unfavorable adjudication by the Government, shall withdraw the employee from consideration from working under the contract. Failure to comply, the Contractor personnel security requirements may result in termination of the contract for default.

Responsibility: The Contractor shall be responsible for the actions of those contract and subcontract employees it provides to perform work for the VBA. In the event damage arises from work performed by Contractor employees the Contractor will be responsible for resources necessary to remedy the incident. Vendor Selection: Should the Contractor use a vendor other than OPM or DCSA to conduct background investigations, the investigative company must be certified by OPM/DCSA to conduct Contractor background investigations. The Vendor Cage Code number must be provided to the VA PSAC, which will verify the information and conclude whether access to the Government’s site(s) and/or VA LAN systems can be granted.

Investigative History: The investigative history for Contractor personnel working under this contract must be maintained in the databases of either OPM or DCSA.

Government Responsibilities:

After the VBA PERSEC has quality controlled the BI package from the Contractor, the VBA PERSEC will send a courtesy e-mail notification to the Contractor and the COR identifying the e-QIP email from DCSA including detailed instructions regarding completion of the BI application process and the level of background that was requested. Upon receipt of required background investigative documents, VBA PERSEC will review the background investigative documents for completion and initiate the background investigation by forwarding the background investigative documents to OPM to conduct the BI. If the background documents are not complete, VBA PERSEC will notify the Contractor and COR of deficiencies and include corrective instructions. VBA PERSEC will pay for background investigations and reciprocals processed through the VAPSAC and conducted by OPM in advance. The COR will notify and forward the Contractor a copy of the Certificate of Investigation when the BI has been favorably adjudicated or a Certificate of Eligibility (Form 4236) if the investigation has been reciprocated. The COR will also notify the Contractor of an unfavorable adjudication by the Government.

Training

All Contractor and sub-contractor personnel requiring access to VA information and VA information systems shall complete the following before being granted access to VA information and networks:

Sign and acknowledge understanding of and responsibilities for compliance with the National Rules of Behavior related to access to VA information and information systems. Successfully complete any cyber security or privacy training as required for VA personnel with equivalent information and/or system access. The Contractor shall provide to the Contracting Officer a copy of the training certificates and signed Rules of Behavior for each applicable employee within 30 days from the date TMS access is granted and annually thereafter, as required.

CONFIDENTIALITY AND NONDISCLOSURE

The preliminary and final deliverables and all associated working papers, application source code, and other material deemed relevant by the VA which has been generated by the Contractor in the performance of this task order are the exclusive property of the U.S. Government and shall be submitted to the COR at the conclusion of the Task Order. The CO will be the sole authorized official to release verbally or in writing, any data, the draft deliverables, the final deliverables, or any other written or printed materials pertaining to this Task Order. No information shall be released by the Contractor. Any request for information relating to this Task Order presented to the Contractor shall be submitted to the CO for response. Press releases, marketing material or any other printed or electronic documentation related to this project, shall not be publicized without the express written approval of the CO.

9.0 Data Requirements / Rights

All data produced, furnished to, obtained by, or used by LGY becomes the property of VA.

10.0 Security Requirements

All data provided to LGY under the terms of this SOW/contract will be encrypted and the encryption key shall be provided to LGY separately from the encrypted data. An ISA MOU potentially will be required.

11.0 Confidentiality and Nondisclosure

The preliminary and final deliverables and all associated working papers, application source code, and other material deemed relevant by the VA which has been generated by the Vendor in the performance of this task order are the exclusive property of the U.S. Government and shall be submitted to the COR at the conclusion of the Task Order.

The CO will be the sole authorized official to release verbally or in writing, any data, the draft deliverables, the final deliverables, or any other written or printed materials pertaining to this Task Order. No information shall be released by the Vendor. Any request for information relating to this Task Order presented to the Vendor shall be submitted to the CO for response. Press releases, marketing material or any other printed or electronic documentation related to this project, shall not be publicized without the express written approval of the CO.

12.0 PERFORMANCE MEASURE STANDARDS

The Government shall utilize Performance Measure Standards throughout the life of this task order to ensure that the vendor is performing the services required by this PWS in an acceptable manner. The Government may utilize the Performance Based Service

Assessment Survey or other methods to compare vendor performance to the Acceptable Levels of Performance (ALP). The Government reserves the right to alter or change the surveillance methods at its own discretion. The table below defines the Performance Standards and Acceptable Quality Levels for this requirement. In addition, the following Performance Standards shall be used as a guide when completing the

Performance Based Service Assessment, as necessary:

12.1 Incentives

The Government shall consider the vendor’s performance when deciding to exercise any options. No other incentives are offered with this award.

12.2 Documenting Performance

12.2.1 Acceptable Performance

The Government shall document acceptable performance accordingly. Any report may become a part of the supporting documentation for any contractual action.

12.2.2 Unacceptable Performance

When unacceptable performance occurs, the COR shall inform the CO. This will always be in writing although when circumstances necessitate immediate verbal communication, that communication will be followed in writing. The COR shall document the discussion and place it in the COR file. When the CO determines formal written communication is required, the COR shall prepare a Contract Discrepancy Report (CDR) and presents it to the vendor’s Program Manager.

The Vendor shall acknowledge receipt of the CDR in writing to the CO. The CDR will state how long after receipt the vendor must take corrective action. The CDR will also specify if the Vendor is required to prepare a corrective action plan to document how the vendor shall correct the unacceptable performance and avoid a recurrence. The CO shall review the Vendor's corrective action plan to determine acceptability. Any CDRs may become a part of the supporting documentation for any contractual action deemed necessary by the CO.

12.3 Quality, Clarity, Appropriateness, and Timeliness of Performance

Quality, Clarity Appropriateness and Timeliness of submission shall be considered in measuring performance. Error rates or resubmits for content flaws shall be the quality and clarity measures associated with these standards. Measures shall include, at a minimum, the following:

Accuracy – Work Products shall be accurate in presentation, technical content, and adhere to accepted elements of style.

Clarity – Work Products shall be clear and concise. Any/All diagrams shall be easy to understand and be relevant to the supporting narrative.

Consistency to Requirements – All work products must satisfy the requirements of this PWS.

File Editing – All text and diagrammatic files shall be editable by the VA in

Windows-based or Adobe environments/platforms.

Format – Follow specified VA Directives or Manuals and/or best business practices.

Presentations – Presentations shall be clear, concise, executive-focused, and written in plain, clear English with minimal jargon, understandable by lay persons.

The quality of deliverables directly contributes to organizational communications.

Project Plan – Project Plan shall be comprehensive; recognize and address authority, perceptions, and concerns of stakeholders; incorporate scope of requisite requirements across the organization and/or agency.

Reports – There shall be no omissions in the reports, documents, or functional requirements.

Publications and Other Documents – Deliverables shall be in formats appropriate to target audiences, user friendly, clear, thorough, and comprehensive.

Meeting Support – Pre-meeting preparations and logistics; smooth meeting operations; comprehensive post-meeting summaries to include, at a minimum:

Minutes, Action Items, Attendees, Program Objectives and Milestones and major decision points.

Analyses and Assessments – Analyses and assessments are performed with accuracy, completeness, and adherence to industry best practices.

Obtain Stakeholder Input – Deliverables shall consist of the timely implementation of input mechanisms and shall consist of an accurate and comprehensive synthesis of results and recommendations. Integration of relevant stakeholder input documented for deliverable.

13.0 Section 508- Electronic and Information Technology Standards

This directive provides VA-wide policy to ensure that VA employees and members of the general public with disabilities have access to and use of VA’s electronic and information technology (EIT) comparable to that provided to persons without disabilities. This is in compliance with Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d), as amended by the Workforce Investment Act of 1998 (Public Law 105- 220). Section 508 of the Rehabilitation Act of 1973, as amended, requires that all EIT developed, procured, maintained, or used by Federal agencies on or after June 21, 2001, must meet EIT accessibility standards developed by the Architectural and Transportation Barriers Compliance Board (Access Board), as set forth at 36 CFR Part 1194. The law also requires Federal agencies to ensure that individuals with disabilities who are Federal employees or members of the public seeking information or services from a federal agency, have access to and use of information and data comparable to that provided to Federal employees or members of the public who are not individuals with disabilities, unless an undue burden would be imposed on the agency.

This policy supports one of the goals of VA’s Strategic Plan: “To create an environment that fosters the delivery of One-VA world class service to VA employees, veterans and their families through effective communication and management of people, technology, business processes, and financial resources.”

14.0 VA INFORMATION AND INFORMATION SYSTEM SECURITY AND PRIVACY LANGUAGE FOR INCLUSION IN CONTRACTS, AS APPROPRIATE

1. GENERAL. This entire section applies to all acquisitions requiring any Information Security and Privacy language. Vendors, vendor personnel, sub-contractors and sub-contractor personnel will be subject to the same federal laws, regulations, standards, VA directives and handbooks, as VA personnel regarding information and information system security and privacy.

2. VA INFORMATION CUSTODIAL LANGUAGE. This entire section applies to all acquisitions requiring any Information Security and Privacy language.

a. The Government shall receive unlimited rights to data/intellectual property first produced and delivered in the performance of this contract or order (hereinafter “contract”) unless expressly stated otherwise in this contract. This includes all rights to source code and all documentation created in support thereof. The primary clause used to define Government and Vendor data rights is FAR 52.227-14 Rights in Data – General. The primary clause used to define computer software license (not data/intellectual property first produced under this vendor or order) is FAR 52.227-19, Commercial Computer Software License.

b. Information made available to the vendor by VA for the performance or administration of this contract will be used only for the purposes specified in the service agreement, SOW, PWS, PD, and/or contract. The vendor shall not use VA information in any other manner without prior written approval from a VA Contracting Officer (CO). The primary clause used to define Government and Vendor data rights is FAR 52.227-14 Rights in Data – General.

c. VA information will not be co-mingled with any other data on the vendor’s information systems or media storage systems. The vendor shall ensure compliance with Federal and VA requirements related to data protection, data encryption, physical data segregation, logical data segregation, classification requirements and media sanitization.

d. VA reserves the right to conduct scheduled or unscheduled audits, assessments, or investigations of vendor Information Technology (IT) resources to ensure information security is compliant with Federal and VA requirements. The vendor shall provide all necessary access to records (including electronic and documentary materials related to the contracts and subcontracts) and support (including access to vendor and sub-contractor staff associated with the contract) to VA, VA's Office Inspector General (OIG), and/or Government Accountability Office (GAO) staff during periodic control assessments, audits, or investigations.

e. The vendor may only use VA information within the terms of the contract and applicable Federal law, regulations, and VA policies. If new Federal information security laws, regulations or VA policies become applicable after execution of the contract, the parties agree to negotiate contract modification and adjustment necessary to implement the new laws, regulations, and/or policies.

f. The vendor shall not make copies of VA information except as specifically authorized and necessary to perform the terms of the contract. If copies are made for restoration purposes, after the restoration is complete, the copies shall be destroyed in accordance with VA Directive 6500, VA Cybersecurity Program and VA Information Security Knowledge Service.

g. If a Veterans Health Administration (VHA) contract is terminated for default or cause with a business associate, the related local Business Associate Agreement (BAA) shall also be terminated and actions taken in accordance with VHA Directive 1605.05, Business Associate Agreements. If there is an executed national BAA associated with the contract, VA will determine what actions are appropriate and notify the contactor.

h. The vendor shall store and transmit VA sensitive information in an encrypted form, using VA-approved encryption tools which are, at a minimum, Federal Information Processing Standards (FIPS) 140-2, Security Requirements for Cryptographic Modules (or its successor) validated and in conformance with VA Information Security Knowledge Service requirements. The vendor shall transmit VA sensitive information using VA approved Transport Layer Security (TLS) configured with FIPS based cipher suites in conformance with National Institute of Standards and Technology (NIST) 800-52, Guidelines for the Selection, Configuration and Use of Transport Layer Security (TLS) Implementations.

i. The vendor’s firewall and web services security controls, as applicable, shall meet or exceed VA’s minimum requirements.

j. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the vendor may use and disclose VA information only in two situations: (i) in response to a qualifying order of a court of competent jurisdiction after notification to VA CO (ii) with written approval from the VA CO. The vendor shall refer all requests for, demands for production of or inquiries about, VA information and information systems to the VA CO for response.

k. Notwithstanding the provision above, the vendor shall not release VA records protected by Title 38 U.S.C. § 5705, Confidentiality of medical quality- assurance records and/or Title 38 U.S.C. § 7332, Confidentiality of certain medical records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse or infection with Human Immunodeficiency Virus (HIV). If the vendor is in receipt of a court order or other requests for the above- mentioned information, the vendor shall immediately refer such court order or other requests to the VA CO for response.

l. Information made available to the vendor by VA for the performance or administration of this contract or information developed by the vendor in performance or administration of the contract will be protected and secured in accordance with VA Directive 6500 and Identity and Access Management (IAM) Security processes specified in the VA Information Security Knowledge Service.

m. Any data destruction done on behalf of VA by a vendor shall be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management, VA Handbook 6300.1, Records Management Procedures, and applicable VA Records Control Schedules.

n. The vendor shall provide its plan for destruction of all VA data in its possession according to VA Directive 6500 and NIST 800-88, Guidelines for Media Sanitization prior to termination or completion of this contract. If directed by the COR/CO, the vendor shall return all Federal Records to VA for disposition.

o. Any media, such as paper, magnetic tape, magnetic disks, solid state devices or optical discs that is used to store, process, or access VA information that cannot be destroyed shall be returned to VA. The vendor shall hold the appropriate material until otherwise directed by the Contracting Officer’s Representative (COR) or CO. Items shall be returned securely via VA-approved methods. VA sensitive information must be transmitted utilizing VA-approved encryption tools which are validated under FIPS 140-2 (or its successor) and NIST 800-52. If mailed, the vendor shall send via a trackable method (USPS, UPS, FedEx, etc.) and immediately provide the COR/CO with the tracking information. Self-certification by the vendor that the data destruction requirements above have been met shall be sent to the COR/CO within 30 business days of termination of the contract.

p. All electronic storage media (hard drives, optical disks, CDs, back-up tapes, etc.) used to store, process or access VA information will not be returned to the vendor at the end of lease, loan, or trade-in. Exceptions to this paragraph will only be granted with the written approval of the VA CO.

3. ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS. This section applies when any person requires access to information made available to the vendor by VA for the performance or administration of this contract or information developed by the vendor in performance or administration of the contract.

a. A vendor/sub-contractor shall request logical (technical) or physical access to VA information and VA information systems for their employees and sub-contractors only to the extent necessary to perform the services specified in the solicitation or contract. This includes indirect entities, both affiliate of vendor/sub-contractor and agent of vendor/sub-contractor.

b. Vendors and sub-contractors shall sign the VA Information Security Rule of Behavior (ROB) before access is provided to VA information and information systems (see Section 4, Training, below). The ROB contains the minimum user compliance requirements and does not supersede any policies of VA facilities or other agency components which provide higher levels of protection to VA’s information or information systems. Users who require privileged access shall complete the VA elevated privilege access request processes before privileged access is granted.

c. All vendors and sub-contractors working with VA information are subject to the same security investigative and clearance requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for vendors shall be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office of Human Resources and Administration/Operations, Security and Preparedness (HRA/OSP) is responsible for these policies and procedures. Contract personnel who require access to classified information or information systems shall have an appropriate security clearance. Verification of a Security Clearance shall be processed through the Special Security Officer located in HRA/OSP. Vendors shall conform to all requirements stated in the National Industrial Security Program Operating Manual (NISPOM).

d. All vendors and sub-contractors shall comply with conditions specified in VAAR 852.204-71(d); Vendor operations required to be in United States. All vendors and sub-contractors working with VA information must be permanently located within a jurisdiction subject to the law of the United States or its Territories to the maximum extent feasible. If services are proposed to be performed abroad the vendor must state where all non-U.S. services are provided. The vendor shall deliver to VA a detailed plan specifically addressing communications, personnel control, data protection and potential legal issues. The plan shall be approved by the COR/CO in writing prior to access being granted.

e. The vendor shall notify the COR/CO in writing immediately (no later than 24 hours) after personnel separation or occurrence of other causes. Causes may include the following:

(1) Vendor/sub-contractor personnel no longer has a need for access to VA information or VA information systems.

(2) Vendor/sub-contractor personnel are terminated, suspended, or otherwise has their work on a VA project discontinued for any reason.

(3) Vendor believes their own personnel or sub-contractor personnel may pose a threat to their company’s working environment or to any company- owned property. This includes vendor-owned assets, buildings, confidential data, customers, employees, networks, systems, trade secrets and/or VA data.

(4) Any previously undisclosed changes to vendor/sub-contractor background history are brought to light, including but not limited to changes to background investigation or employee record.

(5) Vendor/sub-contractor personnel have their authorization to work in the United States revoked.

(6) Agreement by which vendor provides products and services to VA has either been fulfilled or terminated, such that VA can cut off electronic and/or physical access for vendor personnel.

f. In such cases of contract fulfillment, termination, or other causes; the vendor shall take the necessary measures to immediately revoke access to VA network, property, information, and information systems (logical and physical) by vendor/sub-contractor personnel. These measures include (but are not limited to): removing and then securing Personal Identity Verification (PIV) badges and PIV – Interoperable (PIV-I) access badges, VA-issued photo badges, credentials for VA facilities and devices, VA-issued laptops, and authentication tokens. Vendors shall notify the appropriate VA COR/CO immediately to initiate access removal.

g. Vendors/sub-contractors who no longer require VA accesses will return VA- issued property to VA. This property includes (but is not limited to): documents, electronic equipment, keys, and parking passes. PIV and PIV-I access badges shall be returned to the nearest VA PIV Badge Issuance Office. Once they have had access to VA information, information systems, networks and VA property in their possessions removed, vendors shall notify the appropriate VA COR/CO.

4. TRAINING.

a. All vendors and sub-contractors requiring access to VA information and VA information systems shall successfully complete the following before being granted access to VA information and its systems:

(1) VA Privacy and Information Security Awareness and Rules of Behavior course (Talent Management System (TMS) #10176) initially and annually thereafter.

(2) Sign and acknowledge (electronically through TMS #10176) understanding of and responsibilities for compliance with the Organizational Rules of Behavior, relating to access to VA information and information systems initially and annually thereafter; and

(3) Successfully complete any additional cyber security or privacy training, as required for VA personnel with equivalent information system or information access [to be defined by the VA program official and provided to the VA CO for inclusion in the solicitation document – i.e., any role- based information security training].

b. The vendor shall provide to the COR/CO a copy of the training certificates and certification of signing the Organizational Rules of Behavior for each applicable employee within five days of the initiation of the contract and annually thereafter, as required.

c. Failure to complete the mandatory annual training is grounds for suspension or termination of all physical or electronic access privileges and removal from work on the contract until such time as the required training is complete.

5. SECURITY INCIDENT INVESTIGATION. This entire section applies to all acquisitions requiring any Information Security and Privacy language.

a. The vendor, sub-contractor, their employees, or business associates shall immediately (within one hour) report suspected security / privacy incidents to the VA OIT’s Enterprise Service Desk (ESD) by calling (855) 673-4357 (TTY: 711). The ESD is OIT’s 24/7/365 single point of contact for IT-related issues. After reporting to the ESD, the vendor, sub-contractor, their employees, or business associates shall, within one hour, provide the COR/CO the incident number received from the ESD.

b. To the extent known by the vendor/sub-contractor, the vendor/ sub-contractor's notice to VA shall identify the information involved and the circumstances surrounding the incident, including the following:

(1) The date and time (or approximation of) the Security Incident occurred.

(2) The names of individuals involved (when applicable).

(3) The physical and logical (if applicable) location of the incident.

(4) Why the Security Incident took place (i.e., catalyst for the failure).

(5) The amount of data belonging to VA believed to have been compromised.

(6) The remediation measures the vendor is taking to ensure no future incidents of a similar nature.

c. After the vendor has provided the initial detailed incident summary to VA, they will continue to provide written updates on any new and relevant circumstances or facts they discover. The vendor, sub-contractor, and their employes shall fully cooperate with VA or third-party entity performing an independent risk analysis on behalf of VA.