36C10X21Q0192 0001.pdf

5. PROJECT NUMBER (if applicable)

CODE 7. ADMINISTERED BY

2. AMENDMENT/MODIFICATION NUMBER

CODE

6. ISSUED BY

8. NAME AND ADDRESS OF CONTRACTOR

4. REQUISITION/PURCHASE REQ. NUMBER 3. EFFECTIVE DATE

9A. AMENDMENT OF SOLICITATION NUMBER

9B. DATED

PAGE OF PAGES

10A. MODIFICATION OF CONTRACT/ORDER NUMBER

10B. DATED

BPA NO. 1. CONTRACT ID CODE

FACILITY CODE CODE

Offers must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended, by one of the following methods:

The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offers

E. IMPORTANT:

is extended,

(a) By completing Items 8 and 15, and returning __________ copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted; or (c) By separate letter or electronic communication which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGMENT TO BE RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY is not extended.

12. ACCOUNTING AND APPROPRIATION DATA

(REV. 11/2016)

is required to sign this document and return ___________ copies to the issuing office. is not, A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE CONTRACT ORDER NO. IN ITEM 10A.

15C. DATE SIGNED

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(b).

RESULT IN REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by letter or electronic communication, provided each letter or electronic communication makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER

Contractor

16C. DATE SIGNED

14. DESCRIPTION OF AMENDMENT/MODIFICATION

16B. UNITED STATES OF AMERICA

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15A. NAME AND TITLE OF SIGNER 16A. NAME AND TITLE OF CONTRACTING OFFICER

15B. CONTRACTOR/OFFEROR

STANDARD FORM 30 PREVIOUS EDITION NOT USABLE

Prescribed by GSA - FAR (48 CFR) 53.243

(Type or print) (Type or print)

(Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

(Number, street, county, State and ZIP Code)

(If other than Item 6)

(Specify type of modification and authority)

(such as changes in paying office, appropriation date, etc.)

(If required)

(SEE ITEM 11)

(SEE ITEM 13)

(X)

CHECK

ONE

13. THIS ITEM APPLIES ONLY TO MODIFICATIONS OF CONTRACTS/ORDERS,

IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

(Signature of person authorized to sign) (Signature of Contracting Officer)

1 16

36C10X

Strategic Acquisition Center - Frederick Department of Veterans Affairs

5202 Presidents Court, Suite 103 Frederick MD 21703

36C10X

Strategic Acquisition Center - Frederick Department of Veterans Affairs

5202 Presidents Court, Suite 103 Frederick MD 21703

To all Offerors/Bidders

36C10X21Q0192

07-08-2021

X x x

07/23/21, 14:00 ET

See Section A.1 CONTINUATION PAGE for details.

36C10X21Q0192 0001

Table of Contents

A.1 CONTINUATION PAGE

SECTION B - CONTINUATION OF SF 1449 BLOCKS

B.2 PERFORMANCE WORK STATEMENT

A.1 CONTINUATION PAGE

The purpose of this amendment is to:

A. Provide responses to questions received in response to the solicitation and Government responses (#1-27, below):

1. Who is the current incumbent?

RESPONSE: Safeguard Document Destruction Inc.

2. When does the contract end?

RESPONSE: 9/27/2021

3. Are there any bridge contracts in place that extend the current contract?

RESPONSE: The contract is in its final extension period

4. What is the last contract award number and total award amount?

RESPONSE: GS-03F-065BA VA101-16-F-0079; $100,391.09

5. Would you consider extending the offer date to go over answers from submitted questions?

RESPONSE: Extended until 07/23/2021

6. Are freight elevators available to move bins to ground level? Please confirm if there is a loading dock, and is there a ramp to the ground? Is there sufficient parking for our truck for the time it will take to retrieve containers, shred the contents and return the containers?"

RESPONSE: Yes-freight elevator; Yes-loading dock; Yes-space available for truck to complete service call

7. What is the historical volume, prior to COVID, of paper and media monthly and annually?

RESPONSE: Providing tonnage reports from the time the building re-opened average 2.06-

1.66. Do not foresee returning to pre-COVID levels due to changes in the organizational telework policy.

8. Will June 19th be added to the holiday list of days observed and closed?

RESPONSE: Updated*

9. Could the delivery time be extended to 14 days to allow time to order the containers and get them delivered?

RESPONSE: Updated to read “Contract start date”

10. Are the 68 small bins stationary consoles or rolling bins?

RESPONSE: Nine (9), 96 gal totes-rolling: 7 paper; 2 non-paper; Seventy (70), 30 gal-stationary: bins 68 paper; 2 non-paper

11. What type of non-paper multi-media is anticipated and in what quantities? This is needed in order to price the service.

RESPONSE: CDs/DVDs; Cassettes; Video Cassettes

12. There is not a line item for the paper, only for media, will a separate line be added for pricing of paper? Some media and paper cannot be mixed in large quantities due to recycling regulations.

RESPONSE: CLIN will be re-named to include both paper and non-paper media.

13. If there is an individual that has successfully completed a background investigation, are they able to escort other individuals who may not have completed a background investigation? Or is every person who enters the facility required to have a completed background investigation on file? Is the contractor ultimately responsible for the cost of all background investigations associated with the contract, and any subcontractors?

RESPONSE: The escort will be a Government employee coordinated through the COR for each service. Yes, the Awardee will need to submit a background information packet for each employee to the COR; Security clearances are not required; Any costs accrued will be paid by Contractor

14. Will the media frequency be 2x per year only? Please clarify

RESPONSE: Updated PWS-all paper and non-paper media will be collected monthly

15. Can the 2x a year non-paper be done off-site to be taken to an incinerator for destruction?

RESPONSE: Clarified-non-paper media to be collected monthly. Can be taken offsite and destroyed

16. Are all services taking place at the 425 I Street location? Or are there VSO offices at another location?

RESPONSE: All services are taking place at the I Street location

17. Will non-paper containers be labeled?

REPONSE: We will need these labeled by the Vendor

18. CLIN 0002 and associated CLINS – should this be priced as six full standard pickups, i.e.

are seven 96-gallon bins and 68 small containers serviced on each of the six visits? Please confirm that “media” throughout the CLINS refers to paper.

RESPONSE: All paper and non-paper totes and bins will be serviced as part of the 6 additional services. PWS clarified regarding what types of media instead of using the term to refer to both paper and non-paper

19. Can the additional service dates be scheduled a minimum of 4 days in advance?

RESPONSE: COR will approve additional service dates

20. Can the container count be clarified as there are 2 different counts?

RESPONSE: Nine (9), 96 gal totes: 7 paper; 2 non-paper; Seventy (70), 30 gal: bins 68 paper; 2 non-paper

21. Is it possible to change the servicing frequency from monthly to every 4 weeks? This would make your service mesh more easily with other regularly scheduled client services

RESPONSE: COR will approve proposed schedule at kickoff

22. Recycle Centers and Mills are generally not NAID certified. However, the Shredding company is, will that be sufficient? If yes, can that be removed?

RESPONSE: Stays as written.

23. Prior to COVID what was the prior service frequency? Will the current frequency have the possibility of changing back to that? SafeGaurd Document

RESPONSE: Originally, bi-weekly; with new organizational tele-work policy, we will most likely stay monthly

24. What are the four questions related to COVID-19 that will be asked? Is vaccination required for entry?

RESPONSE: Currently, no COVID-related protocols in place. Vaccination not required for entry

25. Is an escort required for our technician?

RESPONSE: Government escort required. Will coordinate through COR.

26. Is the contract firm-fixed price e.g. is invoicing to be for servicing every container on every visit?

RESPONSE: Yes

27. Will changes in container quantities or servicing frequency be handled via contract modification?

RESPONSE: Yes

B. Update Section B.2 PERFORMANCE WORK STATEMENT

All changes to the are noted in BLUE for ease of reference.

SECTION B - CONTINUATION OF SF 1449 BLOCKS

B.2 PERFORMANCE WORK STATEMENT

A. Destruction of Temporary Documents and Materials

1. Scope of Work:

The Contractor shall provide monthly (once a month) on-site mobile document shredding services at the Board of Veterans Appeals Site at 425 I Street NW, Washington DC for the destruction of paper. Mobile shredding shall take place onsite the Government’s facility and a certificate of destruction issued thereafter. Documents to be destroyed encompass unclassified documents that may contain personal identifiable information/sensitive information.

Procedures for removing and destroying these materials must be in compliance with Federal privacy laws and Department of Veterans Affairs (VA) policies including, but not limited to, VA Directive 6371 and VA Handbook 6300.1 on the destruction of sensitive records. Onsite shredding of Sensitive Information, such as Personally Identifiable Information (PII) may be required and must be protected from unauthorized disclosure. Non-paper media is to be collected monthly at the time paper media is collected and shredded and may be destroyed offsite.

2. Place of Performance: Location of facility is 425 I Street, NW, Washington, D.C. 20001.

3. All work is to be performed Monday through Friday between 8:00 am Eastern and 4:30 pm Eastern, except during Federal Government closures and holidays. Any work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO).

There are 11 Federal holidays set by law (5 U.S.C. § 6103) that the VA follows:

New Year’s Day January 1

Juneteenth June 19

Independence Day July 4

Veterans Day November 11

Christmas Day December 25

Martin Luther King’s Birthday Third Monday in January

Washington’s Birthday Third Monday in February

Memorial Day Last Monday in May

Labor Day First Monday in September

Columbus Day Second Monday in October

Thanksgiving Fourth Thursday in November

If any of the above falls on a Saturday, then Friday is observed as a holiday. If any falls on a Sunday, then Monday is observed as a holiday.

4. Abbreviations used throughout this document will be interpreted as follows:

1. BVA – Board of Veterans Appeals

2. COR – Contracting Officer’s Representative

3. e-QIP Electronic Questionnaires for Investigations Processing system

4. IT – Information Technology

5. LAN – Local Area Network

6. OPM – Office of Personnel Management

7. SIC – Security Investigations Center

8. VSO – Veteran Service Organization

9. VA – Department of Veterans Affairs

10. VA TMS – Talent Management System

B. SPECIFIC TASKS/REQUIREMENTS

1. For paper media, the contractor will provide and install 7 large wheeled totes (approx. 96 gallon capacity) and 68 small bins (approximately 30 gallon capacity and suitable for professional office space), with locks and five (5) sets of keys to be provided to the Contracting Officer’s Representative (COR). The contractor will place totes and bins in rooms throughout the building as determined by the COR. The Contractor and the COR will coordinate the delivery of the containers within two days of contract award. Container delivery will be completed on the contract start date, and the schedule for monthly service will be coordinated with the COR at contract kickoff.

2. For non-paper multi-media, the contractor will provide and install 2 large wheeled totes

(approx. 96 gallon capacity) and two small bins (approximately 30 gallon capacity and suitable for professional office space), with locks and five (5) sets of keys to be provided to the COR. The contractor will place totes and bins in rooms throughout the building as determined by the COR.

Container delivery will be completed on the contract start date, and the schedule for monthly service will be coordinated with the COR at contract kickoff.

3. The contractor’s personnel will be solely responsible for emptying all paper and non-paper media totes and bins monthly as approved by the COR. The pick-ups will occur during a pre-scheduled time, coordinated with the COR at contract kickoff, and any changes to the schedule must be approved by the COR in advance.

4. Contractor must be able to provide 6 additional, non-scheduled paper and non-paper media pick-ups within four business days of being notified by the COR.

C. DESTRUCTION PROTOCOL

1. Destruction of materials will be in compliance with VA’s Records Disposition Program which states: The destruction of restricted records must be by pulping, macerating, shredding, or otherwise definitively destroying the information contained in the records. VA Handbook 6300.1, Chapter 6, Paragraph 7. The destruction must be witnessed by a BVA employee or, at BVA’s discretion, by a contractor employee certified by BVA.

2. Interim destruction of temporary paper records refers to macerating, chopping, pulverizing, or shredding of these records to a degree that may not definitively ensure that they are not readable or re-constructable to any degree, but does ensure that they are not readable or re-constructable without extraordinary effort. This destruction of temporary records is a preliminary step that will allow for secure transport of records until such time as their final destruction.

3. The final method of destruction must be pulping, macerating, or otherwise shredding to a degree that definitively ensures that temporary paper records are not readable or re-constructable to any degree. If this final destruction is performed away from a VA facility it must be performed, where practicable, by a National Association for Information Destruction (NAID) certified, bonded and insured recycler or paper mill and any intermediary processes must protect the records until final destruction is completed, definitively destroying the information contained in the records. The contractor must ensure by way of appropriate documentation and established procedures that the sensitive temporary records are fully protected from any disclosure until they are actually destroyed.

4. The BVA’s preference is for a method of destruction that permits the material to be recycled while still meeting the requirements of definitively destroying the information on the documents or other non-paper media.

5. For each pick-up, regardless of the media, a Certificate of Destruction that indicates the weight of the material picked up will be issued by the contractor for the material destroyed and provided to the COR no later than the next business day.

D. DELIVERABLES

All deliverables shall be scheduled with the COR.

PWS Deliverable Due Method of Delivery B.1 Providing and installing (9) 96-gallon totes 7 paper; 2 non-paper; 70, 30 gal: bins 68 paper;

2 non-paper in accordance with this PWS.

Contract start date Physical delivery

B.2 Submitting schedule of monthly pick-up to

COR

At Contract Kickoff E-mail delivery

B.3 Pickup and destruction of paper media in accordance with this PWS

Monthly, on scheduled days and during scheduled time.

Physical emptying and destroying of content in all bins

B.4 Non-scheduled paper pickup and destruction of paper media as needed and directed and in accordance with this PWS

As needed.

Physical emptying and destroying of content in all bins

B.5 Pick-up of non-paper media as needed and directed and in accordance with this PWS.

Monthly, on scheduled days and during scheduled time.

Physical emptying and destroying of content in all bins

B.6 Non-scheduled pickup and destruction of non-paper media as needed and directed and in accordance with this PWS

As needed.

Physical emptying and destroying of content in all bins

B.7

Certificate of Destruction

To be provided to the COR no later than the Next Business Day (NBD) after service has been rendered.

If providing at time of service, may deliver by hand. If providing by the NBD, email to COR

E.4

Training Certificate

Within 1 week of initiation of contract, and annually of this date for each option year exercised.

Email to COR

D. INSPECTION AND ACCEPTANCE CRITERIA

Final inspection and acceptance of all work performed will occur at the place of delivery by the COR.

Final approval and acceptance of documentation required by this PWS shall be by written letter of approval and acceptance by the COR or designee.

E. SECURITY

Access to VA information systems will not be required during performance of this requirement.

1. Access:

Vendor personnel performing work under the anticipated contract must have a valid form of identification such as a driver license to access building. The vendor at time of submission must maintain the level of security required for the anticipated task order. This information is needed from the vendor for all key personnel at the submission of the vendor’s quote.

In case of pandemic, Contractor will be required to observe VA building access protocol. This will be coordinated in advance with the COR.

Vendor will be given access to buildings in coordination with the COR.

2. Informational Security

The Contractor shall not make copies of VA information, electronic or otherwise, except as necessary to perform the terms of the agreement or to preserve electronic information stored on Contractor electronic storage media for restoration in case any electronic equipment or data used by the Contractor needs to be restored to an operating state.

3. Physical Security

If the contract requires taking VA data to a contractor site and the data contains Personally Identifiable Information, the contractor will provide an independent physical security assessment of their facility to the COR prior to commencing work. General guidelines for physical security can be found in VA Directive 0730, Section 6 (Physical Security) and VA Memorandum (subj: IT Oversight & Compliance Information Physical Security Assessments) dated October 24, 2007.

4. Training

All Contractor and subcontractor personnel requiring access to VA information and VA information systems shall complete the following before being granted access to VA information and networks:

a. Successfully complete VA Information Security Awareness training and annual refresher training as required

b. Successfully complete VA Privacy Awareness training and annual refresher training as required

c. Successfully complete any additional Information Security or Privacy training as required for VA personnel with equivalent information system access

The Contractor shall provide to the COR a copy of the training certificates for each applicable employee within 1 week of the initiation of the contract and annually thereafter, as required.

These online courses are located at https:/EES-Learning.net. The VA Talent Management System (VA TMS) from any computer with Internet access at www.tms.va.gov. For training resources and other information, visit the VA TMS communications website, TMS Resources, at www.valu.va.gov/Home/TMSResources.

Failure to complete this mandatory training within the timeframe required will be grounds for suspension or termination of all physical and/or electronic access privileges and removal from work on the contract until such time as the training is completed.

F. Contractor Personnel Security

1. General All contract employees who require access to the VA site(s) and/or access to VA local area network (LAN) systems shall be the subject of a background investigation and must receive a favorable adjudication from the VA Security and Investigations Center (SIC). These requirements are applicable to all subcontractor personnel requiring the same level of Background Investigation.

https://ees-learning.net/ http://www.tms.va.gov/

The level of background security investigation will be in accordance with VA Directive 0710 dated September 10, 2004 and is available at http://www1.va.gov/vapubs/viewPublication.asp?Pub_ID=487&FType=2

2. Background Investigation

The work environment is considered sensitive but unclassified. VA is required under the Homeland Security Presidential Directive (HSPD) 12 “Policy for a Common Identification Standard for Federal Employees and Contractors” to perform a National Agency Check with Inquiries (NACI) for Contractors. The NACI is a brief form of background investigation that is conducted through the Office of Personnel Management (OPM). This investigation will be conducted for Contractor staff assigned to this Contract. Contractor staff will be required to provide two forms of acceptable identification, provide a current photograph, and be finger-printed. Successful clearance is required for an employee to continue working under this Contract.

Per the PERSONAL IDENTITY VERIFICATION OF CONTRACTOR PERSONNEL clause of the Federal Acquisition Regulation (FAR 52.204-9):

The Contractor shall comply with agency personal identity verification procedures identified in the contract that implement Homeland Security Presidential Directive-12 (HSPD-12), Office of Management and Budget (OMB) guidance M-05-24, and Federal Information Processing Standards Publication (FIPS PUB) Number 201.

The Contractor shall insert this clause in all subcontracts when the subcontractor is required to have physical access to a federally-controlled facility or access to a Federal information system.

3. Contractor Responsibilities

The Contractor shall bear the expense of obtaining background investigations or reciprocals of previous investigations held that meet or exceed the required investigation level. The cost of background investigations is based on the current Office of Personnel Management (OPM) rate at the time the application is processed at OPM. Fiscal Year 2012 rates are as follows: Low Risk (NACI) $267, Moderate Risk (MBI) $952, High Risk (BI) $3,998 or Reciprocals $27. VA will pay for investigations or reciprocals processed through the VA Security Investigations Center (SIC) and conducted by OPM in advance; however, the Contractor shall reimburse the full cost of background investigations/reciprocals to VA within 30 days of Bill of Collections received from VA. VA shall send up to three plus one final delinquent notice to the Contractor. If the Contractor does not adhere to the Bill of Collections, future invoices may be subject to be offset by VA to recoup background investigation/reciprocal costs.

Immediately after contract or task order award, the Contractor must submit the completed Attachment B form (VA Contractor Background Investigation Request Worksheet) to the COR to begin the background investigation process for all contract employees working on the contract, who will have access to VA facilities, VA systems, or privacy data.

http://www1.va.gov/vapubs/viewPublication.asp?Pub_ID=487&FType=2

After the VA inputs the Contractor’s information from the Attachment B, the Contractor and Contractor point of contact (POC) will receive an email notification from the SIC identifying the website link that includes detailed instructions regarding completion of the background clearance application process in the Electronic Questionnaires for Investigations Processing (e- QIP) system. E-QIP is an online, Internet accessible system where the contractor employee completes the security questionnaire required to process the background investigation.

The Contractor shall prescreen all personnel who require access to VA site(s) and/or access to VA LAN systems to ensure they maintain a U.S. citizenship or Alien Registration that authorizes them to work in the U.S. and are able to read, write, speak and understand the English language.

Contractors who have a current favorable background investigation previously conducted by OPM or Defense Security Service (DSS) may be accepted through reciprocation. When a previous clearance is currently held, it does not preclude the vendor from submitting a completed Attachment B form to the COR immediately after contract or task order award for all contract employees who will be working on the contract.

Contract performance shall not commence before SIC confirmation that it has received the Contractor’s investigative documents, that they are complete, and that the investigation information has been released to OPM for scheduling of the background investigation. Once the Contractor’s background investigation has been released to OPM for scheduling of the background investigation or the SIC has confirmed that the verified investigation will be reciprocated, contract performance may commence. The COR will notify and forward the Contractor a copy of the Certificate of Investigation when the background investigation has been favorably completed or a Certificate of Eligibility (Form 4236) if the investigation has been reciprocated. The Contractor, if notified of an unfavorable adjudication by the Government, shall withdraw the employee from consideration from working under the contract. Failure to comply with the Contractor personnel security requirements may result in termination of the contract for default.

If the security clearance investigation is not completed prior to the start date of the contract, the contract employee may work on the contract with an “initiated background investigation” status (when received from the SIC) while the security clearance is being processed. However, the Contractor will be responsible for the actions of those contract and subcontract employees they provide to perform work for VA. In the event damage arises from work performed by Contractor personnel, under the auspices of the contract, the Contractor will be responsible for resources necessary to remedy the incident.

Should the Contractor use a vendor other than OPM or DSS to conduct investigations, the investigative company must be certified by OPM/DSS to conduct Contractor investigations. The Vendor Cage Code number must be provided to the VA SIC, which will verify the information and conclude whether access to the Government’s site(s) and/or VA LAN systems can be granted.

The investigative history for Contractor personnel working under this contract must be maintained in the databases of either OPM or the Defense Industrial Security Clearance Organization (DISCO).

4. Government Responsibilities

After the COR has received Attachment B form(s) from the Contractor, the SIC will send an e-mail notification to the Contractor and their POC identifying the website link that includes detailed instructions regarding completion of the background clearance application process and what level of background was requested.

Upon receipt of required investigative documents, SIC will review the investigative documents for completion and initiate the background investigation by forwarding the investigative documents to OPM to conduct the background investigation. If the investigative documents are not complete, the SIC will notify the vendor of deficiencies and include corrective instructions.

VA will pay for investigations and reciprocals processed through the SIC and conducted by OPM in advance, however, the Contractor shall reimburse the full cost of background investigations/reciprocals to VA within 30 days of Bill of Collections from VA. VA shall send up to three plus one final delinquent notice to the Contractor. If the Contractor does not adhere to the Bill of Collections, future invoices may be subject to be offset by VA to recoup background investigation costs and may be considered grounds for default.

The COR will notify and forward the Contractor a copy of the Certificate of Investigation when the background investigation has been favorably adjudicated or a Certificate of Eligibility (Form 4236) if the investigation has been reciprocated. The COR will also notify the Contractor of an unfavorable adjudication by the Government.

5. Security Incident Investigation

The term “security incident” means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action the breaches VA security procedures. The contractor/subcontractor shall immediately notify the COR and simultaneously, the designated ISO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/subcontractor has access.

G. Contractor Personnel

1. General Contractors, contractor personnel, subcontractors, and subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security.

The Contractor will be responsible for ensuring compliance by its employees with the security regulations of VA, VACO and other Government installations or Contractor facilities where work is performed under this Contract. This includes the safekeeping and display of a Government-provided photo ID badge for employees of the Contractor and any subcontractors while these employees are in federally owned or leased property as described in Section 21, Place of Performance. The Contractor will ensure the security of all VA and VHA property, building ID badges, key cards and standard keys issued to Contractor staff. For employees leaving the project permanently or for an extended period of time, the Contractor will return all badges, property, key cards, parking placards, and keys, etc. the same day the employees leave the project.

2. Key Personnel The follow personnel are considered key personnel by the Government. These are skilled and experienced professional personnel that are essential for successful vendor accomplishment of the work to be performed for this requirement.

The vendor shall provide a Program Manager who shall be responsible for the performance of the work. The Program Manager, or alternate, shall have full authority to act for the vendor on all contract matters relating to daily operation of the anticipated task order. The Program Manager, or alternate, shall be available between 8:00 a.m. to 4:30p.m., Monday through Friday except Federal holidays or when the Government facility is closed for administrative reasons.

This person and an alternate shall, at all times, report directly to the Contract Officer’s Representative throughout the performance period.

All key personnel who require access to the VA facilities shall complete all required training and undergo the NACI background investigation. Copies of training certificates and results of the background investigation shall be provided to the COR.

3. Non Key Personnel

The non-key personnel are interchangeable; however, for security purposes the VA will require proof of identification for access to Government facilities.

Non-key personnel do not require the NACI background investigation. However, non-key personnel must be accompanied by key personnel when accessing VA facilities and handling Government property. Non-key personnel shall complete all required training and provide copies of certificates to the COR.

4. LIQUIDATED DAMAGES FOR DATA BREACH

a. Consistent with the requirements of 38 U.S.C. §5725, a contract may require access to sensitive personal information. If so, the contractor is liable to VA for liquidated damages in the event of a data breach or privacy incident involving any SPI the contractor/subcontractor processes or maintains under this contract.

b. The contractor/subcontractor shall provide notice to VA of a “security incident” as set forth in the Security Incident Investigation section above. Upon such notification, VA must secure from a non-Department entity or the VA Office of Inspector General an independent risk analysis of the data breach to determine the level of risk associated with the data breach for the potential misuse of any sensitive personal information involved in the data breach. The term 'data breach' means the loss, theft, or other unauthorized access, or any access other than that incidental to the scope of employment, to data containing sensitive personal information, in electronic or printed form, that results in the potential compromise of the confidentiality or integrity of the data. Contractor shall fully cooperate with the entity performing the risk analysis. Failure to cooperate may be deemed a material breach and grounds for contract termination.

c. Each risk analysis shall address all relevant information concerning the data breach, including the following:

(1) Nature of the event (loss, theft, unauthorized access);

(2) Description of the event, including:

(a) Date of occurrence;

(b) Data elements involved, including any PII, such as full name, social security number, date of birth, home address, account number, disability code;

(3) Number of individuals affected or potentially affected;

(4) Names of individuals or groups affected or potentially affected;

(5) Ease of logical data access to the lost, stolen or improperly accessed data in light of the degree of protection for the data, e.g., unencrypted, plain text;

(6) Amount of time the data has been out of VA control;

(7) The likelihood that the sensitive personal information will or has been compromised (made accessible to and usable by unauthorized persons);

(8) Known misuses of data containing sensitive personal information, if any;

(9) Assessment of the potential harm to the affected individuals;

(10) Data breach analysis as outlined in 6500.2 Handbook, Management of Security and Privacy Incidents, as appropriate; and

(11) Whether credit protection services may assist record subjects in avoiding or mitigating the results of identity theft based on the sensitive personal information that may have been compromised.

d. Based on the determinations of the independent risk analysis, the contractor shall be responsible for paying to the VA liquidated damages in the amount of $37.50 per affected individual to cover the cost of providing credit protection services to affected individuals consisting of the following:

(1) Notification;

(2) One year of credit monitoring services consisting of automatic daily monitoring of at least 3 relevant credit bureau reports;

(3) Data breach analysis;

(4) Fraud resolution services, including writing dispute letters, initiating fraud alerts and credit freezes, to assist affected individuals to bring matters to resolution;

(5) One year of identity theft insurance with $20,000.00 coverage at $0 deductible; and

(6) Necessary legal expenses the subjects may incur to repair falsified or damaged credit records, histories, or financial affairs.