36C10E19Q0049.docx

PAST PERFORMANCE QUESTIONNAIRE

PAGE 1 OF

1. REQUISITION NO.

2. CONTRACT NO.

3. AWARD/EFFECTIVE DATE

4. ORDER NO.

5. SOLICITATION NUMBER

6. SOLICITATION ISSUE DATE

a. NAME

b. TELEPHONE NO. (No Collect Calls)

8. OFFER DUE DATE/LOCAL

TIME

9. ISSUED BY

CODE

10. THIS ACQUISITION IS

UNRESTRICTED OR

SET ASIDE:

% FOR:

SMALL BUSINESS

HUBZONE SMALL

BUSINESS

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

WOMEN-OWNED SMALL BUSINESS

(WOSB) ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

EDWOSB

8(A)

NAICS:

SIZE STANDARD:

11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

SEE SCHEDULE

12. DISCOUNT TERMS

13a. THIS CONTRACT IS A

RATED ORDER UNDER

DPAS (15 CFR 700)

13b. RATING

14. METHOD OF SOLICITATION

RFQ

IFB

RFP

15. DELIVER TO

CODE

16. ADMINISTERED BY

CODE

17a. CONTRACTOR/OFFEROR

CODE

FACILITY CODE

18a. PAYMENT WILL BE MADE BY

CODE

TELEPHONE NO.

DUNS:

DUNS+4:

PHONE:

FAX:

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN OFFER 18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK BELOW IS CHECKED

SEE ADDENDUM

19.

20.

21.

22.

23.

24.

ITEM NO.

SCHEDULE OF SUPPLIES/SERVICES

QUANTITY

UNIT

UNIT PRICE

AMOUNT

(Use Reverse and/or Attach Additional Sheets as Necessary)

25. ACCOUNTING AND APPROPRIATION DATA

26. TOTAL AWARD AMOUNT (For Govt. Use Only) 27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1, 52.212-4. FAR 52.212-3 AND 52.212-5 ARE ATTACHED. ADDENDA

ARE

ARE NOT ATTACHED.

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA

ARE

ARE NOT ATTACHED

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN _______________

29. AWARD OF CONTRACT: REF. ___________________________________ OFFER

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND

DATED ________________________________. YOUR OFFER ON SOLICITATION

DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY

(BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE

ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED

SET FORTH HEREIN IS ACCEPTED AS TO ITEMS:

30a. SIGNATURE OF OFFEROR/CONTRACTOR 31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER) 30b. NAME AND TITLE OF SIGNER (TYPE OR PRINT) 30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER (TYPE OR PRINT) 31c. DATE SIGNED

AUTHORIZED FOR LOCAL REPRODUCTION

(REV. 2/2012)

PREVIOUS EDITION IS NOT USABLE

Prescribed by GSA - FAR (48 CFR) 53.212

7. FOR SOLICITATION

INFORMATION CALL:

STANDARD FORM 1449

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 30

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

VA

3479-000007 36C10E19Q0049 12-24 -2018 Ross Byrne 206-341-8500 Ext 8886 01-07- 6:00 pm (ET) 00101 Department of Veterans Affairs Veterans Benefits Administration Office of Acquisition 1800 G. Street N.W.

Washington DC 20006 X X 561210 $38.5 Million X Net 30 Days N/A X Department of Veterans Affairs Veterans Benefits Administration Boise Regional Office 444 West Fort Street Boise ID 83702 00101 Department of Veterans Affairs Veterans Benefits Administration Office of Acquisition 1800 G. Street N.W.

Washington DC 20006

All invoices must be emailed to:

See CONTINUATION Page The Contractor shall provide Facility Maintenance Services for the Boise Regional Office in accordance with the Performance Work Statement.

Quoters must submit required documents, Part 1 thru 4 Listed in Section E.2 Para. “Quote Preparation Instructions” To be considered responsive.

This Procurement is a Total Small Business Set-aside Please see site visit information on Page 61 Sect. E.6 Site Visit See CONTINUATION Page 347-309600-2543 000039600 0151A1 2019 X X X One Ross Byrne

VBA16L2-2584

36C10E19Q0049

SECTION B - CONTINUATION OF SF 1449 BLOCKS

B.1 CONTRACT ADMINISTRATION DATA

1. Contract Administration: All contract administration matters will be handled by the following individuals:

a. CONTRACTOR: To Be Determined

b. GOVERNMENT: Contracting Officer 36C10E Department of Veterans Affairs Veterans Benefits Administration Office of Acquisition 1800 G. Street N.W.

Washington DC 20006

2. CONTRACTOR REMITTANCE ADDRESS: All payments by the Government to the contractor will be made in accordance with:

3. INVOICES: Invoices shall be submitted in arrears:

4. GOVERNMENT INVOICE ADDRESS: All Invoices from the contractor shall be submitted electronically in accordance with VAAR Clause 852.232-72 Electronic Submission of Payment Requests.

All invoices must be emailed to: To Be Determined ACKNOWLEDGMENT OF AMENDMENTS: The offeror acknowledges receipt of amendments to the Solicitation numbered and dated as follows:

B.2 PRICE SCHEDULE

Base Period: Feb 1, 2019 thru Jan 31, 2020

BASE PERIOD TOTAL

Option Period One: Feb 1, 2020 thru Jan 31, 2021

OPTION PERIOD ONE TOTAL

Option Period Two: Feb 1, 2021 thru Jan 31, 2022

OPTION PERIOD TWO TOTAL

Option Period Three: Feb 1, 2022 thru Jan 31, 2023

OPTION PERIOD THREE TOTAL

Option Period Four: Feb 1, 2023 thru Jan 31, 2024

OPTION PERIOD FOUR TOTAL

Base Period Total

Option Period One Total

Option Period Two Total

Option Period Three Total

Option Period Four Total

Contract Value GRAND TOTAL

B.3 PERFORMANCE WORK STATEMENT

1. DESCRIPTION OF SERVICES. The Contractor shall provide all management, supervision, tools, equipment, supplies and labor necessary to ensure that facility maintenance services are performed at the Boise VA Regional Office (RO) in a manner that will maintain optimal facility operation and minimize the need for avoidable repair of building HVAC and mechanical systems. The square footage of the Boise RO is approximately 25,311.

0. MAINTENANCE AND INSPECTION SERVICES. The Contractor shall accomplish all maintenance and inspection tasks to meet the requirements of this performance work statement. The minimum frequencies are established in Appendix A, Deliverables. The contractor shall obtain and maintain at his/her own expense all necessary licenses, permits and insurance and shall conform to all laws, regulations, and ordinances applicable to performance of the contract. Upon award, the contractor shall provide to the Contracting Officer Representative (COR), proof of insurance coverage.

0. Verify Operations of the HVAC system. The building is serviced by McQuay Maverick II, Models MPS030A – 050A, Roof Top Units (RTU) 101 and 102. Ensure all HVAC systems are operational and in good repair.

0. Verify operation of DDC controls. The HVAC system is monitored by an Alerton Direct Digital Controls (DDC) system. Ensure DDC system is communicating with all systems as required to maintain optimal HVAC operation.

0. Resolve system alarms. Mechanical system alarms will be monitored on a 24/7 basis. All system alarm notifications will be investigated and remedied as soon as possible. Third parties will be used only when the repair is beyond the scope of this contract and the Contractor’s expertise. All alarms shall be recorded noting the reason for the alarm and any corrective action taken.

0. Record/monitor utility usage. The Contractor shall record utility usage trending data to determine if maintenance/repair is required.

0. Conduct geothermal system equipment maintenance to include basic troubleshooting and necessary repairs and adjustments. Make manual adjustments as needed to ensure proper operation of the system. Develop preventive maintenance schedule in accordance with manufacturer’s recommendations.

0. Resolve employee HVAC issues. Air temperature in office and public spaces is to be kept at 72o Fahrenheit, + or – 2o. Perform basic troubleshooting as needed to ensure these temperatures are maintained.

0. Conduct HVAC system inspection and change filters per manufacturer’s recommended guidelines. All filters shall be changed in accordance with the preventive maintenance schedule, to include the HEPA filter located in the mail room. Filters shall be supplied by the Contractor.

0. Inspect and record HVAC water chemical treatment levels. Ensure chemical treatment levels are within tolerance, correct as necessary.

0. Exterior and interior lighting.

1. Inspect interior and exterior lighting. Replace lights as needed. Replacement light bulbs will be furnished by the Government.

1. Inspect all building emergency lighting and exit signs and maintain an inspection log of results and any needed repairs. Perform monthly and annual function testing as required.

1.1.2.3. Clean interior light fixtures semi-annually, removing any accumulated debris. Remove light fixtures as necessary to clean interior.

0. Respond and coordinate inquiries with the Contracting Officer’s Representative (COR). Coordinate potential conflicts with the Performance Work Statement with the COR.

0. Inspect landscaping. Inspect irrigation system and repair as necessary. For downed trees, or trees and shrubbery that require trimming, etc., coordinate with the VA Medical Center (VAMC) Facilities Management Service for corrective action.

0. Inspect all door operations. Ensure all exit doors close properly. Inspect hydraulic door closers and panic bars monthly and adjust as necessary to maintain serviceability and proper building pressure.

0. Inspection of all plumbing and fixtures. Perform cursory inspection of all plumbing and fixtures weekly for obvious leaks or damage. Perform quarterly inspection of plumbing and fixtures for leaks or damaged elbow joints and other connections, dripping/running water and other defects.

0. Inspection of all flooring and walls. Inspect walls and flooring for damage and report any damage to the COR.

0. Inspect mechanical systems and prepare status report and submit to the COR. Provide a quarterly written report on the inspection of all mechanical systems. Include inspection results, preventive or corrective maintenance performed, and any conditions that require correction. The report shall be submitted to the COR no later than the 15th of the month at the beginning of each new quarter (i.e., January, April, July, October).

0. Inspect all building finishes (Carpet, Tile, Paint) for minor damage. Inspect walls and resilient floors for nicks, scratches, holes and other damage less than 2 sq. ft. in area, repair/repaint as necessary. Inspect carpeting for stains, holes and other obvious damage less than 2 sq. ft. in area, and clean or replace as needed.

0. Inspect roof, roof drains, and heat tape; clean roof drains. Inspect heat tape on roof drains monthly for serviceability and repair as needed. Inspect roof drains monthly for serviceability and clear any debris or other obstructions to ensure good drainage.

0. Inspect and clean mechanical and electrical rooms. Inspect and clean mechanical rooms weekly. Keep rooms free of excess storage items. Ensure all required equipment and supplies are stored neatly and do not present a safety hazard. Inspect and clean all electrical rooms monthly. Ensure electrical rooms are free of debris and are not used for storage. Notify the COR if stored items are found in any electrical room.

0. Perform annual fire alarm testing and inspection to include fire sprinkler system, backflow preventor and fire extinguisher recertification. Arrange for and maintain documentation for annual fire alarm and sprinkler system inspection and testing and fire extinguisher recertification. Arrange for and maintain documentation for the quarterly inspection of backflow preventor.

0. Inspect all fire extinguishers. Inspect fire extinguishers for serviceability, mounting, and proper charge monthly and annotate inspection card.

0. Maintain Leadership in Energy and Environmental Design (LEED) certification. Ensure all supplies and products used in the maintenance of the Regional Office meet the environmental requirements to maintain the building’s LEED Gold level certification.

0. Coordinate facility Contractor work. Act as a point of contact, consultant and coordinator. Act as liaison for the COR when third party contracted work is performed, to include but not limited to the reconfiguration of the offices, training rooms and other work areas. Work not covered in the PWS shall not be performed without prior approval of the Government.

0. Snow and Ice Removal. Contractor shall provide snow and ice removal services. Contractor shall ensure all walkways are free of ice and snow and spread ice melt as needed. This includes ensuring a clear pathway to allow access to the dumpster and in the front of the dumpster enclosure. Contractor shall ensure the front employee and visitor parking lots are plowed and de-iced no later than 5:30 AM and the rear parking lot is cleared and de-iced no later than 6:30 AM. Snow and ice removal shall also be performed in the aforementioned areas during the workday if snow accumulation necessitates.

0. Lawn Maintenance. Act as liaison with the VAMC Facilities Management Service to ensure mowing, watering and other lawn maintenance is performed as required. Report any issues to the COR.

0. Schedule preventative maintenance services as needed. Develop a preventive maintenance schedule in accordance with the manufacturer’s recommendations for the HVAC and all other mechanical systems, providing a copy of the schedule to the COR. At the beginning of the contract, the Contractor shall take into account the most recent completion of all preventative maintenance actions when developing the maintenance schedule. Perform all preventive maintenance as required. All belts, filters and other expendable supplies related to the performance of preventive maintenance shall be furnished by the Contractor.

0. Provide an on-site Facility Manager for at least four hours daily. This shall be either four hours in the morning or two hours in the morning and two hours in the afternoon. The morning on-site support must be present no later than 7:00 AM and the afternoon on-site support must take place during normal business hours. Outside of the on-site periods, the Contractor shall provide on-call support as needed during normal business hours.

0. Computer Room Air Conditioning or Special Systems. Quarterly, visually inspect and clean cooling unit condenser coils, check for proper glycol level and concentration at reservoir; add, if needed.

1.1.21. Hot Water Heater Gas. Annually, check pressure valve, check operation of thermostat, check all connections water, gas, electric, examine tank exterior for signs of corrosion or leaks, drain tank to remove sediment and refill.

1.1.22. Water Softener. Semi-annually, examine tank exterior, fittings and gauges for signs of corrosion or leaks, flush system, inspect salt bed for proper level.

1.1.23. Variable Air Volume System (VAV) and Filters. Semi-annually, check to see that operating control moves damper to desired position, check damper linkage for tightness or damage, check damper for free movement, inspect connecting duct work for air leaks, check the heating valve for proper operation, check electrical connections to actuators, replace filters as needed.

1.1.24. Humidification System. Semi-annually, remove and clean evaporation chamber and level sensor with vinegar or weak acid, check piping for leaks, clean the blower if there is an accumulation of dust, check that drain lines are free of debris, check condition of heating elements.

1.1.25. Fan, Centrifugal. Annually, check fan blades and moving parts for excessive wear, check bearings and grease when applicable, check belts for wear; adjust tension or alignment when needed, replace belts when needed.

0. Preventative maintenance of drinking water systems. Replace water filters on two water bottle filling stations; the filter shall be replaced every four months on the station located near the public restrooms in the lobby area and every two months on the station located in the employee hallway in the non-public area. Replace one water filter in hot water line and two water filters in the cold-water line quarterly located in the employee break room. Filters shall be supplied by the Contractor.

2. PERFORMANCE REQUIREMENTS SUMMARY. The Contractor service requirements are summarized into performance objectives that relate directly to mission essential items. The performance standards briefly describe the minimum acceptable levels of service required for each requirement. These thresholds are critical to mission success.

HVAC Maintenance

Not more than five valid customer complaints for the month regarding heating/cooling of building. Not more than one instance per month of HVAC rework due to inadequate/incorrect maintenance.

Maintenance and Inspection

3. GOVERNMENT FURNISHED PROPERTY. The only Government furnished equipment is the computer system integral to the HVAC system.

4. GENERAL INFORMATION.

4.1. QUALITY CONTROL PLAN. The Contractor shall develop and maintain a Quality Control Plan to ensure maintenance is performed in accordance with commonly accepted commercial practices. The Contractor shall develop and implement procedures to identify, prevent, and ensure non-recurrence of deficient services. As a minimum, the Contractor shall develop quality control procedures addressing the areas identified in paragraph 2, Performance Requirement Summary. The Contractor shall keep the Plan up to date and provide a copy to the COR, upon request.

The Government representative(s) will monitor performance and review performance reports furnished by the Contractor to determine how the contractor is performing against communicated performance objectives. The Government will make determination regarding incentives based on performance measurement metric data and notify the contractor of those decisions. The Contractor will be responsible for making required changes in processes and practices to ensure performance is managed effectively.

The Contractor shall take corrective action when any task associated with this contract is found deficient or substandard. The cost of correction is to be borne by the Contractor. The Contractor shall handle all records received to ensure unauthorized release of information cannot occur.

4.2. QUALITY ASSURANCE. The Government will routinely evaluate the Contractor’s performance in accordance with the Quality Assurance Surveillance Plan.

4.2.1. QUARTERLY PERFORMANCE MEETING. Representatives from each organization will participate in a quarterly performance meeting to review performance, quality control, progress, requirements, etc. Suggested representation is the Government Contracting Officer’s Representative, the Contractor’s manager and the Contractor’s quality control person, the facility manager and/or Support Services Chief. A date, time and location (teleconference or physical meeting) shall be established upon issuance of the Notice to Proceed.

4.3. GOVERNMENT REMEDIES. If for any reason the scheduled time for a deliverable cannot be met, the Contractor is required to explain why (include the original deliverable due date) in writing to the Contracting Officer (CO) and COR, including a firm commitment of when the work shall be completed. This notice to the CO shall cite the reasons for the delay, and the impact on the overall project. The CO will then review the facts and issue a response in accordance with applicable regulations. The Contracting Officer shall follow FAR 52.212.4, Contract Terms and Conditions-Commercial Items (FEB 2012), for Contractor’s failure to perform satisfactory services or failure to correct non-conforming services. The Government will be responsive to any requests for information needed to complete the contract’s tasks.

4.4. HOURS OF OPERATION. The core hours for the Boise VA Regional Office are from 6:00 AM to 6:00 PM. Normal business hours are from 8:00 AM to 4:30 PM. HVAC and mechanical systems are monitored 24/7 to ensure optimal performance, and the Contractor must respond immediately to HVAC and mechanical system emergencies. Contractor must also respond immediately for all emergency maintenance requirements (plumbing, lighting, etc.)

4.5. SECURITY REQUIREMENTS. All contract employees who require logical access or physical access to secured areas of the Regional Office must obtain a PIV card. Requirements for obtaining PIV cards are addressed in paragraph 5 of this contract.

4.6. SPECIAL QUALIFICATIONS. All maintenance performed on the HVAC and mechanical systems beyond the scope of routine filter changes, etc. must be performed by qualified/certified technicians. The cost of repairs will be borne by the Contractor if the HVAC or mechanical systems sustain damage due to work by unqualified technicians. Contractor shall possess a minimum of 24 months of technical working knowledge and experience of commercial HVAC, geothermal, and Direct Digital control (DDC) operations and maintenance, as well as the necessary experience and proficiency in various maintenance trade skills to meet all requirements contained in this Performance Work Statement.

4.7. CONTRACT POST-AWARD MEETING. The Contractor shall not commence performance on the tasks in this PWS until the Contracting Officer Representative has conducted a kick-off meeting or has advised the contractor that a kick-off meeting is waived.

4.8. PERFORMANCE PERIOD. See B.2 Price Schedule

Option periods do not commit the Government and will be exercised based on continuation of need and successful Contractor performance.

Work at the Government site shall only take place on Federal holidays or weekends in emergency situations or if directed by the CO.

4.9. CHANGES TO PERFORMANCE WORK STATEMENT. Any changes to this PWS shall be authorized and approved only through written correspondence from the CO. A copy of each change will be kept in a project folder along with all other products of the project. Costs incurred by the contractor through the actions of parties other than the CO shall be borne by the contractor.

4.10. TYPE OF CONTRACT. This is a firm fixed-price contract

5.0 SECURITY REQUIREMENTS

VA Information and Privacy Requirements General All Contractors and Contractor personnel shall be subject to the same Federal security and privacy laws, regulations, standards and VA policies as VA, including the Privacy Act, 5 U.S.C. §552a, and VA personnel, regarding information and information system security. Contractors must follow policies and procedures outlined in VA Directive 6500, Information Security Program; and VA Handbook 6500.6, Contract Security which are available at: http://www1.va.gov/vapubs and its handbooks to ensure appropriate security controls are in place.

Background Investigation The contract employee level of background investigation (BI) required for this effort is: MBI. This BI level is required for unescorted access to sensitive areas.

Contractor Responsibilities

1. The Government shall bear the expense of obtaining up to two (per Contract year) background investigations or reciprocals of previous investigations held that meet or exceed the required investigation level. The cost of background investigations is based on the current Office of Personnel Management (OPM) rate at the time the application is processed at OPM. Fiscal Year 2018 rates are as follows: Low Risk (NACI) $408, Moderate Risk (MBI) $1,747, High Risk (BI) $4,614 or Reciprocals are $65. VA will pay for investigations or reciprocals processed through the VA SIC and conducted by OPM in advance; however, beyond the first two investigations or reciprocals per Contract year, the Contractor shall reimburse the full cost of background investigations/reciprocals to VA within 30 days of Bill of Collections received from VA. VA shall send up to three plus one final delinquent notice to the Contractor. If the Contractor does not adhere to the Bill of Collections, future invoices may be subject to be offset by VA to recoup background investigation/reciprocal costs.

1. Immediately after contract or task order award, the COR will provide the Contractor with the following background investigation documents to be completed by the Contractor and returned to the COR to begin the background investigation process for all contract employees working on the contract who will have access to VA facilities, VA systems, or privacy data:

1. Background Investigation Request Worksheet

1. Optional Form 306 – Declaration of Federal Employment

1. Fingerprint Request Form (or arrangement of electronic capture of fingerprints)

1. Self Certification of Continuous Service Form

1. VA Form 0710 – Authorization for Release of Information

1. Upon receipt of the above-stated documents from the COR, the VBA Acquisition Staff will submit the background investigation package to the VSC Security Specialist for processing through the SIC. Upon notification of favorable fingerprint results, the contractor may begin work while the background investigation is ongoing. Thereafter, the Contractor will receive an email notification from the SIC identifying the website link that includes detailed instructions regarding completion of the background clearance application process in the Electronic Questionnaires for Investigations Processing (e-QIP) system. e-QIP is an online, Internet accessible system where the contractor employee shall complete the security questionnaire required for OPM to process the background investigation.

1. Contractors who have a current favorable background investigation previously conducted by OPM or Defense Security Service (DSS) may be accepted through reciprocation. When a previous clearance is currently held, it does not preclude the vendor from submitting a complete Background Investigation Package as stated above to the COR immediately after contract or task order award for all contract employees who will be working on the contract.

1. The Contractor shall prescreen all personnel who require access to VA site(s) to ensure they maintain a U.S. citizenship or Alien Registration that authorizes them to work in the U.S. and are able to read, write, speak and understand the English language.

1. Contract performance shall not commence before:

· The VSC has confirmed favorable fingerprint results, or

· SIC confirms that it has received the Contractor’s investigative documents, the documents are complete, and that the investigation information has been released to OPM for scheduling of the background investigation, or

· VSC or the SIC has confirmed that the verified investigation will be reciprocated.

1. The COR will notify and forward the Contractor a copy of the Certificate of Investigation when the background investigation has been favorably completed or a Certificate of Eligibility (Form 4236) if the investigation has been reciprocated. The Contractor, if notified of an unfavorable adjudication by the Government, shall withdraw the employee from consideration from working under the contract. Failure to comply with the Contractor personnel security requirements may result in termination of the contract for default.

1. The Contractor will be responsible for the actions of those contract and subcontract employees they provide to perform work for VA. In the event damage arises from work performed by Contractor personnel, under the auspices of the contract, the Contractor will be responsible for resources necessary to remedy the incident.

1. Should the Contractor, with concurrence of the Government if the Government is bearing the expense, use a vendor other than OPM or DSS to conduct investigations, the investigative company must be certified by OPM/DSS to conduct Contractor investigations. The Vendor Cage Code number must be provided to the VA SIC, which will verify the information and conclude whether access to the Government’s site(s) and/or VA LAN systems can be granted.

1. The investigative history for Contractor personnel working under this contract must be maintained in the databases of either OPM or the Defense Industrial Security Clearance Organization (DISCO).

Government Responsibilities

0. After the SIC has adjudicated the background investigation package from the Contractor, the SIC will send an e-mail notification to the Contractor and their POC identifying the e-QIP website link that includes detailed instructions regarding completion of the background clearance application process and the level of background that was requested.

0. Upon receipt of required investigative documents, SIC will review the investigative documents for completion and initiate the background investigation by forwarding the investigative documents to OPM to conduct the background investigation. If the investigative documents are not complete, the SIC will notify the vendor of deficiencies and include corrective instructions.

0. VA will pay for investigations and reciprocals processed through the VA SIC and conducted by OPM in advance, however, the Contractor shall reimburse the full cost of background investigations/reciprocals to VA within 30 days of Bill of Collections from VA. VA shall send up to three plus one final delinquent notice to the Contractor. If the Contractor does not adhere to the Bill of Collections, future invoices may be subject to be offset by VA to recoup background investigation costs and may be considered grounds for default.

0. The COR will notify and forward the Contractor a copy of the Certificate of Investigation when the background investigation has been favorably adjudicated or a Certificate of Eligibility (Form 4236) if the investigation has been reciprocated. The COR will also notify the Contractor of an unfavorable adjudication by the Government.

Security Incident Investigation

The term “security incident” means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action the breaches VA security procedures. The Contractor/subcontractor shall immediately notify the COR and simultaneously, the designated ISO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/subcontractor has access.

APPENDIX A

Deliverables

HVAC Maintenance

(These frequencies are minimums--the contractor may perform more frequently, at no additional cost to government, if required to maintain level of service.)

SERVICES

As needed

As needed

As required by PM schedule

Monthly

Maintenance and Inspection

(These frequencies are minimums--the contractor may perform more frequently, at no additional cost to government, if required to maintain level of service.)

SERVICES

Weekly

Monthly, Annually

Semi-annually

Weekly

Weekly

Weekly

Weekly

Quarterly

Monthly

Monthly

Weekly

Monthly

Annually

Quarterly

Monthly

As needed

As needed

As needed

Quarterly

Annually

Semi-Annually

Semi-Annually

Semi-Annually

Annually

Refer to 1.1.26

Preventive Maintenance

(These frequencies are minimums--the contractor may perform more frequently, at no additional cost to government, if required to maintain level of service.)

SERVICES

Per PM schedule

Per PM schedule

Per PM schedule

B.4 VA INFORMATION AND INFORMATION SYSTEM SECURITY/PRIVACY

1. GENERAL

Contractors, contractor personnel, subcontractors, and subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security.

2. ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS

a. A contractor/subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order.

b. All contractors, subcontractors, and third-party servicers and associates working with VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures.

c. Contract personnel who require access to national security programs must have a valid security clearance. National Industrial Security Program (NISP) was established by Executive Order 12829 to ensure that cleared U.S. defense industry contract personnel safeguard the classified information in their possession while performing work on contracts, programs, bids, or research and development efforts. The Department of Veterans Affairs does not have a Memorandum of Agreement with Defense Security Service (DSS). Verification of a Security Clearance must be processed through the Special Security Officer located in the Planning and National Security Service within the Office of Operations, Security, and Preparedness.

d. Custom software development and outsourced operations must be located in the U.S. to the maximum extent practical. If such services are proposed to be performed abroad and are not disallowed by other VA policy or mandates, the contractor/subcontractor must state where all non-U.S. services are provided and detail a security plan, deemed to be acceptable by VA, specifically to address mitigation of the resulting problems of communication, control, data protection, and so forth. Location within the U.S. may be an evaluation factor.

e. The contractor or subcontractor must notify the Contracting Officer immediately when an employee working on a VA system or with access to VA information is reassigned or leaves the contractor or subcontractor's employ. The Contracting Officer must also be notified immediately by the contractor or subcontractor prior to an unfriendly termination.

3. VA INFORMATION CUSTODIAL LANGUAGE

a. Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the contractor/subcontractor's rights to use data as described in Rights in Data - General, FAR 52.227-14(d) (1).

b. VA information should not be co-mingled, if possible, with any other data on the contractors/subcontractor's information systems or media storage systems in order to ensure VA requirements related to data protection and media sanitization can be met. If co-mingling must be allowed to meet the requirements of the business need, the contractor must ensure that VA's information is returned to the VA or destroyed in accordance with VA's sanitization requirements. VA reserves the right to conduct on site inspections of contractor and subcontractor IT resources to ensure data security controls, separation of data and job duties, and destruction/media sanitization procedures are in compliance with VA directive requirements.

c. Prior to termination or completion of this contract, contractor/ subcontractor must not destroy information received from VA, or gathered/ created by the contractor in the course of performing this contract without prior written approval by the VA. Any data destruction done on behalf of VA by a contractor/subcontractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self-certification by the contractor that the data destruction requirements above have been met must be sent to the VA Contracting Officer within 30 days of termination of the contract.

d. The contractor/subcontractor must receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with the terms of the contract and applicable Federal and VA information confidentiality and security laws, regulations and policies. If Federal or VA information confidentiality and security laws, regulations and policies become applicable to the VA information or information systems after execution of the contract, or if NIST issues or updates applicable FIPS or Special Publications (SP) after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations and policies in this contract.

e. The contractor/subcontractor shall not make copies of VA information except as authorized and necessary to perform the terms of the agreement or to preserve electronic information stored on contractor/subcontractor electronic storage media for restoration in case any electronic equipment or data used by the contractor/subcontractor needs to be restored to an operating state. If copies are made for restoration purposes, after the restoration is complete, the copies must be appropriately destroyed.

f. If VA determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12.

g. If a VHA contract is terminated for cause, the associated BAA must also be terminated and appropriate actions taken in accordance with VHA Handbook 1600.01, Business Associate Agreements. Absent an agreement to use or disclose protected health information, there is no business associate relationship.

h. The contractor/subcontractor must store, transport, or transmit VA sensitive information in an encrypted form, using VA-approved encryption tools that are, at a minimum, FIPS 140-2 validated.

i. The contractor/subcontractor's firewall and Web services security controls, if applicable, shall meet or exceed VA's minimum requirements. VA Configuration Guidelines are available upon request.

j. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor/subcontractor may use and disclose VA information only in two other situations: (i) in response to a qualifying order of a court of competent jurisdiction, or (ii) with VA's prior written approval. The contractor/subcontractor must refer all requests for, demands for production of, or inquiries about, VA information and information systems to the VA contracting officer for response.

k. Notwithstanding the provision above, the contractor/subcontractor shall not release VA records protected by Title 38 U.S.C. 5705, confidentiality of medical quality assurance records and/or Title 38 U.S.C. 7332, confidentiality of certain health records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse, or infection with human immunodeficiency virus. If the contractor/subcontractor is in receipt of a court order or other requests for the above mentioned information, that contractor/subcontractor shall immediately refer such court orders or other requests to the VA contracting officer for response.

l. For service that involves the storage, generating, transmitting, or exchanging of VA sensitive information but does not require C&A or an MOU-ISA for system interconnection, the contractor/subcontractor must complete a Contractor Security Control Assessment (CSCA) on a yearly basis and provide it to the COR.

4. INFORMATION SYSTEM DESIGN AND DEVELOPMENT

a. Information systems that are designed or developed for or on behalf of VA at non-VA facilities shall comply with all VA directives developed in accordance with FISMA, HIPAA, NIST, and related VA security and privacy control requirements for Federal information systems. This includes standards for the protection of electronic PHI, outlined in 45 C.F.R. Part 164, Subpart C, information and system security categorization level designations in accordance with FIPS 199 and FIPS 200 with implementation of all baseline security controls commensurate with the FIPS 199 system security categorization (reference Appendix D of VA Handbook 6500, VA Information Security Program). During the development cycle a Privacy Impact Assessment (PIA) must be completed, provided to the COR, and approved by the VA Privacy Service in accordance with Directive 6507, VA Privacy Impact Assessment.

b. The contractor/subcontractor shall certify to the COR that applications are fully functional and operate correctly as intended on systems using the VA Federal Desktop Core Configuration (FDCC), and the common security configuration guidelines provided by NIST or the VA. This includes Internet Explorer 7 configured to operate on Windows XP and Vista (in Protected Mode on Vista) and future versions, as required.

c. The standard installation, operation, maintenance, updating, and patching of software shall not alter the configuration settings from the VA approved and FDCC configuration. Information technology staff must also use the Windows Installer Service for installation to the default "program files" directory and silently install and uninstall.

d. Applications designed for normal end users shall run in the standard user context without elevated system administration privileges.

e. The security controls must be designed, developed, approved by VA, and implemented in accordance with the provisions of VA security system development life cycle as outlined in NIST Special Publication 800-37, Guide for Applying the Risk Management Framework to Federal Information Systems, VA Handbook 6500, Information Security Program and VA Handbook 6500.5, Incorporating Security and Privacy in System Development Lifecycle.

f. The contractor/subcontractor is required to design, develop, or operate a System of Records Notice (SOR) on individuals to accomplish an agency function subject to the Privacy Act of 1974, (as amended), Public Law 93-579, December 31, 1974 (5 U.S.C. 552a) and applicable agency regulations. Violation of the Privacy Act may involve the imposition of criminal and civil penalties.

g. The contractor/subcontractor agrees to:

(1) Comply with the Privacy Act of 1974 (the Act) and the agency rules and regulations issued under the Act in the design, development, or operation of any system of records on individuals to accomplish an agency function when the contract specifically identifies:

(a) The Systems of Records (SOR); and

(b) The design, development, or operation work that the contractor/ subcontractor is to perform;

(1) Include the Privacy Act notification contained in this contract in every solicitation and resulting subcontract and in every subcontract awarded without a solicitation, when the work statement in the proposed subcontract requires the redesign, development, or operation of a SOR on individuals that is subject to the Privacy Act; and

(2) Include this Privacy Act clause, including this subparagraph (3), in all subcontracts awarded under this contract which requires the design, development, or operation of such a SOR.

h. In the event of violations of the Act, a civil action may be brought against the agency involved when the violation concerns the design, development, or operation of a SOR on individuals to accomplish an agency function, and criminal penalties may be imposed upon the officers or employees of the agency when the violation concerns the operation of a SOR on individuals to accomplish an agency function. For purposes of the Act, when the contract is for the operation of a SOR on individuals to accomplish an agency function, the contractor/subcontractor is considered to be an employee of the agency.

(1) "Operation of a System of Records" means performance of any of the activities associated with maintaining the SOR, including the collection, use, maintenance, and dissemination of records.

(2) "Record" means any item, collection, or grouping of information about an individual that is maintained by an agency, including, but not limited to, education, financial transactions, medical history, and criminal or employment history and contains the person's name, or identifying number, symbol, or any other identifying particular assigned to the individual, such as a fingerprint or voiceprint, or a photograph.

(3) "System of Records" means a group of any records under the control of any agency from which information is retrieved by the name of the individual or by some identifying number, symbol, or other identifying particular assigned to the individual.

i. The vendor shall…