36C24126Q0809.docx

Attachment 1: Combined Synopsis-Solicitation for Commercial Products and Commercial Services RFQ: 36C24126Q0809 Radioactive Contamination Survey

GENERAL INFORMATION

Network Contracting Office 1 (NCO 1) Contracting Officer (90C) 1 VA Center Augusta ME 04330

POINT OF CONTACT*

Contract Specialist Pamela L. Parham pamela.parham3@va.gov Email Only Please No Fax Accepted

PLACE OF PERFORMANCE

VAMC West Haven

950 Campbell Ave

West Haven, CT

ADDITIONAL INFORMATION

DESCRIPTION

This is a combined synopsis/solicitation with a 100% SDVOSB/VOSB set-aside for commercial items prepared in accordance with the format in RFO Federal Acquisition Regulation (FAR) subpart 12.6, “Solicitation, Evaluation, and Award” as supplemented with additional information included in this notice. This announcement constitutes the only solicitation; quotes are being requested, and a written solicitation document will not be issued. This solicitation is a request for quotations (RFQ). The solicitation document and incorporated provisions and clauses are those in effect through Federal Acquisition Circular 2025-06. The associated North American Industrial Classification System (NAICS) code for this procurement is 562910 with a small business size standard of $19 million. The Department of Veterans Affairs Network Contracting Officer 01 is seeking to purchase the supplies or services described in the following Statement of Work.

This is a combined synopsis/solicitation notice synopsizing a solicitation to satisfy the requirements of RFO FAR 5.2 and RFO FAR 5.3. All interested parties should register via SAM.gov interested vendors list. It is the responsibility of the offeror to monitor and download amendments from SAM.gov Federal Business Opportunities, which may be issued to this solicitation. In accordance with RFO FAR 52.204-7, RFO FAR 2.101, and VAAR 802.101, prospective firms must be registered in SAM (www.sam.gov), and in VetCert (Veteran Small Business Certification (sba.gov)) databases prior to award. (Note: In accordance with Public Law 109-461, 38 USC 8127, and NDAA 2021, all vendors claiming Small Business status in accordance with the Veteran's First Contracting Program must be VERIFIED by the Small Business Administration (SBA)). Also, to qualify for a VA contract, vendors must be vendorized by completing Form 10091 at URL https://www.cep.fsc.va.gov/.

Offerors should carefully follow instructions included in 52.212-1 and for evaluation criteria specified in (52.212-2). Pricing should be identified B. Price/Cost Schedule located on Page 2.

Combined Synopsis/Solicitation Notice Combined Synopsis/Solicitation Notice Interested persons may contact the Contracting Officer via email at Pamela.parham3@va.gov regarding this procurement. The determination to conduct a competitive procurement based on responses to this notice is solely within the discretion of the Contracting Officer.

Combined Synopsis/Solicitation Notice

Description of Services All interested companies shall provide quotations for the following:

Supplies/Services

Products

(START OF STATEMENT OF WORK)

BACKGROUND

VA Connecticut Healthcare System of West Haven is in the process of scheduling the demolition of Building 9. While conducting site investigations of Building 9, it was observed that a radioactive waste label tape was adhered on to the lip of a sink located in the basement of the building. To be able to demolish the building, the National Health Physics Program [NHPP] will require a decommissioning survey report. The survey shall evaluate all relevant structural and environmental surfaces for potential residual radiological contamination, quantify and characterize any detected contaminants, and document all findings, conditions, and deficiencies in accordance with applicable NHPP, federal and VA radiological decommissioning standards.

The NHPP may request 30 days review period when they are in receipt of the final report to review and grant that approval. The building involved has a sink with ‘caution radioactive material’ label on it. There is no record of radioactive material use in the building as far back as 1998 records which are available but the building dates back to the 1940’s. The building has a history of use as living quarters, and office space.

JUSTIFICATION

Building 9 is currently scheduled for demolition. Prior to demolition, Building 9 will need to have a decommissioning survey performed to free release the basement sink where a radioactive waste sticker was found and the surrounding area. As the medical center has no information on whether this area was indeed used in conjunction with radioactive waste material or not, it must be treated as a potentially contaminated site until further investigation needed to verify that the area is free released/decommissioned.

The survey shall evaluate all relevant structural and environmental surfaces for potential residual radiological contamination, quantify and characterize any detected contaminants, and document all findings, conditions, and deficiencies in accordance with applicable NHPP, federal and VA radiological decommissioning standards and if necessary perform decontamination efforts of the space as necessary to allow for the building to be free released.

PLACE OF PERFORMANCE

The place of performance for this contract is VA Connecticut Healthcare System, West Haven VA Medical Center, Building 9, located at 950 Campbell Avenue, West Haven, CT 06516.

PERIOD OF PERFORMANCE

The Contract Time Period of Performance will 30 days upon contract award and Notice to Proceed (NTP).

QUALIFICATIONS

To be considered eligible for consideration, potential bidders shall have a field service representative located within 150 miles of the West Haven Campus of the VA Connecticut Healthcare System. Service Provider acting as a Prime with subcontracted labor shall meet this requirement.

Bidders shall provide, upon request, documentation of certification/training on the specific equipment under the terms of this contract.

Bidders shall be qualified to perform release-related survey work or decommissioning survey of the radioactive waste or contamination sort and have successfully prepared and submitted at least two prior Final Status Survey Reports that were accepted by the US Nuclear Regulatory Commission, the NHPP, or an Agreement State. They must be licensed/authorized to perform survey, remediation work, and must possess the survey instruments and equipment to complete the radiation surveys. Their instruments must be properly calibrated.

The Service Provider that supplies this service will need to successfully complete the survey and issue to VACT [RSO] a Final Status Survey Report that includes training and experience of personnel performing or otherwise involved in the project, methods, instruments used, instrument calibration certificates and daily checks, determination of MDCs, background determination, any calculations performed, and final results and conclusions. The Service Provider will provide their personnel with radiation monitors and all PPE needed for their workers. The personnel that perform the work must be experienced with such work, have performed other release surveys, and be up to date on their training that includes Radiation Safety Training, DOT training, RCRA training, and Haz-Mat Training.

The vendor must have the knowledge, manpower, tools, transportation, licenses and resources to complete this project. The vendor needs to be familiar with and able to comply with NHPP and VA requirements for such work. They will need to work with the VA COR to minimize impact on daily operations. They must have insurance as required by VA. The vendor’s project manager must be able to supervise the work and detect any unsafe acts or conditions, providing corrective actions. The project manager must keep accurate records of the work, and verify completion of the work.

Scheduled repairs shall be completed during regular 1st shift business hours Monday – Friday but can be addressed during off hours as required and per prior coordination with VA COR.

Bidders will be responsible for complying with the VA Connecticut Healthcare System policies for confined space, Lock Out Tag Out, all equipment, supplies, and external support to safely enter the confined space to document and investigate existing conditions, determine quantities, and confirm scope of work.

SCOPE OF WORK

The Service Provider shall perform a release or decommissioning survey for the basement of Building 9 to verify the level of radioactive trace material in basement components such as sink, piping, vent hood, ductwork and concrete walls/floors. Limited scope surveys will also be required for the first floor through third floor/attic due to the less than full available information about he historical use of Building 9.

The vendor that supplies this service will need to successfully complete the survey and issue to VACT’s Radiation Safety Officer [RSO] a Final Status Survey Report that includes training and experience of personnel performing or otherwise involved in the project, methods, instruments used, instrument calibration and daily checks, determination of MDCs, background determination, any calculations performed, and final results and conclusions. VACT requires the release criteria to be at or less than “19 mRem/yr total effective dose equivalent [TEDE] to the average member of the critical group” so VACT satisfies not just US NRC/NHPP requirements, but CT DEEP ones as well.

The Service Provider shall submit a project schedule, work procedures, inspection procedures, testing procedures, all safety documentation, radiation safety procedures, Radiation Worker permit/certifications, etc. for review and approval by VA Contracting Officer Representative, Radiation Safety Officer and Safety Office before the start of work on site.

The vendor will provide their personnel with radiation monitors and all PPE needed for their workers.

The personnel that perform the work must be experienced with such work, have performed other release surveys, and be up to date on their training that includes Radiation Safety Training, DOT training, RCRA training, and Haz-Mat Training.

The vendor must have the knowledge, manpower, tools, transportation, licenses and resources to complete this project. The vendor needs to be familiar with and able to comply with NHPP and VA requirements for such work. They will need to work with the VA COR to minimize impact on daily operations. They must have insurance as required by VA. The vendor’s project manager must be able to supervise the work and detect any unsafe acts or conditions, providing corrective actions. The project manager must keep accurate records of the work, and verify completion of the work.

Should the service provider not be able to meet the VACT requirement of the release criteria to be at or less than “19 mRem/yr total effective dose equivalent [TEDE] to the average member of the critical group”, then a scope of work needs to be developed and provided to VA Medical Center of what remediation efforts are needed to occur to lower the mRem count within the allowable means stated above.

Remediation Scope of Work (if Required)

To be able to demolish a building where residual radioactive contamination above acceptable limits is identified, remediation is required. This may involve cleaning/decontamination of surfaces, or the physical removal of items including, but not limited to, plumbing lines, ductwork, concrete removal, wood floor boards or plumbing fixtures.

VACT needs our radiation regulator’s approval prior to demolition of a building.

The National Health Physics Program [NHPP] will require a decommissioning survey report.

To complete this, some items or materials may need to be removed from the building, packaged and shipped for disposal to an off-site, authorized radioactive waste disposal site. VACT will need a contracted vendor to do this remediation work. [The vendor may be a subcontractor of the vendor selected to perform the MARISSM survey of the building or may be the vendor which performed the MARISSM survey. There will need to be close collaboration between those performing the MARISSM survey and those performing remediation work.]

The building involved has a sink with ‘caution radioactive material’ label on it.

There is no record of radioactive material use in the building as far back as 1998 records which are available. The building dates back to the 1940’s, so there are unknowns.

Work shall occur between the hours of 7:30 a.m. and 4:00 p.m. with a minimum 7 calendar day notice. No work shall be performed on Federal Holidays unless an emergency status has been indicated by the Contracting Officer.

US Federal Holidays:

VA Connecticut Healthcare System West Haven Building 9 Basement Sink Radioactive Contamination Survey for Decommissioning

Page 1 of

Page 1 of

Effective Date: 01/15/2026 Revision: 03

New Year’s Day Martin Luther King Jr. Day President’s Day Memorial Day Juneteenth Independence Day Labor Day Columbus Day Veterans Day Thanksgiving Day Christmas Day

Page 1 of Page 1 of Page 1 of

Description of Services:

The project will include but not be limited to the following:

1. Service Provider shall schedule and coordinate all work with VA COR, Radiation Safety Officer, and Chief of Safety or designee.

2. All Lock Out Tag Out (LOTO) requests and procedures, if applicable, shall be in compliance with the VA Connecticut Healthcare System Medical Center Policy 138-075.

3. Coordinate access to Building 9 with VA Contracting Officer Representative and Radiation Safety Officer.

4. Coordinate all placement and removal of Lock Out Tag Out devices for any energy sources with the VA COR/Maintenance & Operations.

5. All Confined Space entries shall be in compliance with the VA Connecticut Healthcare System Standard Operating Procedure Confined Space SOP-SO-010.

6. The VACHS confined space acknowledgement, and permit is required to be completed by qualified individuals identified to perform entry into any confined space and will be coordinated with the VACHS Safety & Outage Coordinator and VACHS Safety Representative on site.

7. Protect all staff, equipment, etc. in place during work activities.

8. Equipment considered necessary to accomplish all work required per this contract includes but is not limited to equipment required for metal work, welding, cutting, inspection, testing, rigging & handling, de-watering, containment, and cleaning of any debris resulting from this work.

9. The service provider shall provide their own personnel with radiation monitors and all PPE needed for their workers. There personnel that perform the work must be experienced with such work, have performed other radiation remediation work in the past, and be up-to-date with their training that includes Radiation Safety Training, DOT Training, RCRA training, and HazMat Training.

10. The vendor must have the knowledge, manpower, tools, transportation, licenses and resources to complete this project including but not limited to:

a. The vendor needs to be familiar with and able to comply with NRC, DOT, NHPP and VA requirements for such work.

b. Waste shipments must satisfy US DOT and all other relevant regulations.

c. They will need to work with the VA COR to minimize impact on daily operations.

d. They must have insurance as required by VA.

e. The vendor’s project manager must be able to supervise the work and detect any unsafe acts or conditions, providing corrective actions.

f. The project manager must keep accurate records of the work, and verify completion of the work.

11. Remediation and removal of any found radioactive waste shall be in full compliance with NRC, DOT, NHPP and VA and work is to be performed and/or supervised by a licensed and qualified Radiation Safety Officer.

a. The vendor selected must have successfully remediated several radioactive material-use facilities, removing contamination, packaging radioactive waste, and shipping for proper disposal to an authorized waste processing or disposal site, complying with all Federal, state and other relevant regulations and standards. They must be licensed/authorized to perform remediation work, and must provide all needed labor, packaging, containers, marking, labeling, manifests, shipping, and all disposal costs and fees for proper management, and disposal of any and all radioactive waste. Vendor must provide transportation vehicle and driver, managing the waste disposal project in full.

b. Vendor must be able to identify and quantify all removed radioactive material and/or radioactively contaminated items.

c. For surface cleaning, the vendor must provide all labor, cleaning tools and materials.

d. The vendor will provide their personnel with radiation monitors and all PPE needed for their workers.

e. The personnel that performs the work must be experienced with such work, have performed other radiation remediation work, and be up to date on their training that includes Radiation Safety Training, DOT training, RCRA training, and Haz-Mat Training.

f. The vendor must have the knowledge, manpower, tools, transportation, licenses and resources to complete this project.

g. The vendor needs to be familiar with and able to comply with NRC, DOT, NHPP and VA requirements for such work.

h. Waste shipments must satisfy US DOT and all other relevant regulations.

i. They will need to work with the VA COR to minimize impact on daily operations.

j. They must have insurance as required by VA.

k. The vendor’s project manager must be able to supervise the work and detect any unsafe acts or conditions, providing corrective actions. The project manager must keep accurate records of the work, and verify completion of the work.

l. VACT must be given copies of all reports, manifests, shipping papers, and must be provided with documentation of proper disposal of the material. A written report that includes personnel involved, their training, information about any radiation detectors used and their calibration, along with photos of the materials removed [such as pipes, plumbing, sinks, etc.]

m. The survey should follow guidelines of MARSSIM.

n. In additional the vendor must provide information and explanations to the VACT Radiation Safety Officer as requested.

o. The vendor or their subcontractor must have a record of removing, packaging, and shipping radioactive waste successfully to an authorized waste disposal site. Any radioactive material removed will need to be properly quantified and characterized for legal packaging, shipment and disposal.

p. The vendor will not need to use any VACT computers nor have access to any sensitive VACT information.

q. The project will be complete when the building is returned to unrestricted use and may be demolished.

12. After completion of remediation work, Service Provider shall develop a second release or decommission report to document remediated condition of the space as well as provide all visual findings and post radiation testing with photographs, videos and/or other documentation necessary to confirm information within the report. The survey should follow guidelines of MARSSIM.

SUBMITTALS/DELIVERABLES

1. Service Provider shall provide a release or decommission survey/Final Status Survey with a documented release criteria of 19 mRem /yr total effective dose equivalent [TEDE] to the VA’s Radiation Safety Officer for review and approval and ultimately to be submitted to National Health Physics Program (NHPP) for their review and approval and release to decommission.

2. Service provider shall furnish all submittal item documentations (with final dispositions) and final documentation report with all tests, photos, corrections made within 14 business days after work is completed.

3. Service provider shall furnish all material certifications for any replacement parts used.

4. Service provider shall furnish a waste manifest as required, of remediation methods are required.

SPECIAL INSTRUCTIONS

1. Service Provider Check-in: All employees of the service provider shall comply with VA Security Management Program and obtain permission of the VA Police and restricted from unauthorized access. Upon arrival, the Service Provider shall sign-in at Building 15 in West Haven and receive a temporary identification badge prior to performing services at VA Connecticut Healthcare System. The Service Provider shall wear visible identification always displaying the name and company ID while on site. All site visits shall be coordinated with the VA COR or assigned POC.

2. Per Directive 1805, smoking, vaping, and smokeless tobacco are prohibited on the grounds of VA facilities, including in vehicles. This Directive applies to all Service providers and their employees.

3. No photography of VA premises is allowed without written permission of the contracting officer. Patients and staff are not to be photographed at any time.

4. Parking for Service provider and employees shall be in designated areas only. Service provider shall coordinate with VA COR.

5. The Service provider shall confine all operations (including storage of materials) on government premises to areas authorized or approved by the VA Contracting Officer. The Service provider shall confine all operations (including storage of materials) on government premises to areas authorized or approved by the VA Contracting Officer. The Service provider shall hold and save the government, its officers, and agents, free and harmless from liability of any nature occasioned by the Service provider’s performance. Working space and space available for storing materials shall be as determined by the COR. Workers are subject to the rules of the Medical Center applicable to their conduct. Execute work in such a manner as to reduce impacts with work being done by others.

6. Billing: Provide COR with a report or statement of work completed and include statements with request for payment. Statement should include service completed and the date each service item was completed. Labor charges shall be billed hourly, and any unused labor totals will be credited back to the VA Medical Center on the next billing cycle, upon receipt of the service report.

Safety Codes / Certification / Licensing:

Environmental abatement work, if necessary, is to be performed by Service Provider under supervision and monitoring for the VA by a Certified Industrial Hygienist. If suspected ACM, reach out immediately to the VA Contracting Officer and Contracting Officer Representative.

The Service Provider shall comply with all codes as described above, as well as codes customarily applied in VA construction jobs such as NFPA fire code, OSHA, VA Design Guides, etc. Labs used by the Service Provider shall be licensed as required by any applicable governing agencies, and their certifications and licenses shall be included in the reports.

Travel:

Service Provider and/or subcontractors will travel from their place of business to the West Haven Medical Center of the VA Connecticut Healthcare System.

NARA Records Management Requirements

The following standard items relate to records generated in executing this contract:

1. Citations to pertinent laws, codes and regulations such as 44 U.S.C. Chapter 21, 29, 31, and 33; Freedom of Information Act (5 U.S.C. 552); Privacy Act (5 U.S.C. 552a); 36 CFR Part 1222 and Part 1228.

2. Contractor shall treat all deliverables under the contract as the property of the U.S. Government for which the Government Agency shall have unlimited rights to use, dispose of, or disclose such data contained therein as it determines to be in the public interest.

3. Contractor shall not create or maintain any records that are not specifically tied to or authorized by the contract using Government ‘IT’ equipment and/or Government records.

4. Contractor shall not retain, use, sell, or disseminate copies of any deliverable that contains information covered by the Privacy Act of 1974 or that which is generally protected by the Freedom of Information Act.

5. The Contractor shall not create or maintain any records containing any Government Agency records that are not specifically tied to or authorized by the contract.

6. The Government Agency owns the rights to all data/records produced as part of this contract.

7. The Government Agency owns the rights to all electronic information (electronic data, electronic information systems, electronic databases, etc.) and all supporting documentation created as part of this contract. The Contractor must deliver sufficient technical documentation with all data deliverables to permit the agency to use the data.

8. The Contractor agrees to comply with Federal and Agency records management policies, including those policies associated with the safeguarding of records covered by the Privacy Act of 1974. These policies include the preservation of all records created or received regardless of format [paper, electronic, etc.] or mode of transmission [e-mail, fax, etc.] or state of completion [draft, final, etc.].

9. No disposition of documents will be allowed without the prior written consent of the Contracting Officer. The Agency and its contractors are responsible for preventing the alienation or unauthorized destruction of records, including all forms of mutilation. Willful and unlawful destruction, damage, or alienation of Federal records is subject to the fines and penalties imposed by 18 U.S.C. 2701. Records may not be removed from the legal custody of the Agency or destroyed without regard to the provisions of the agency records schedules.

10. The Contractor is required to obtain the Contracting Officer’s approval prior to engaging in any contractual relationship (sub-contractor) in support of this contract requiring the disclosure of information, documentary material and/or records generated under or relating to this contract. The Contractor (and any sub-contractor) is required to abide by Government and Agency guidance for protecting sensitive and proprietary information.

APPENDIX A

INFECTION PREVENTION MEASURES

A. Implement the requirements of VA Medical Center’s Infection Control Risk Assessment (ICRA) team. ICRA Group may monitor dust, in the vicinity of the construction work, and require the Service Provider to take corrective action immediately if the safe levels are exceeded.

B. Establish and maintain a dust control program as part of the contractor’s infection preventive measures in accordance with the guidelines provided by ICRA Group as specified here. Prior to start of work, prepare a plan detailing project-specific dust protection measures, including periodic status reports, and submit to Project Manager and Facility ICRA team for review for compliance with contract requirements in accordance with Section 01340, SAMPLES AND SHOP DRAWINGS.

1. All personnel involved in the construction or renovation activity shall be educated and trained in infection prevention measures established by the medical center.

C. Medical Center Infection Control personnel shall monitor for airborne disease (e.g. aspergillosis) as appropriate during construction. A baseline of conditions may be established by the medical center prior to the start of work and periodically during the construction stage to determine impact of construction activities on indoor air quality. In addition:

1. The Project Manager and VAMC Infection Control personnel shall review pressure differential monitoring documentation to verify that pressure differentials in the construction zone and in the patient-care rooms are appropriate for their settings. The requirement for negative air pressure in the construction zone shall depend on the location and type of activity.

Upon notification, the contractor shall implement corrective measures to restore proper pressure differentials as needed.

2. In case of any problem, the medical center, along with assistance from the contractor, shall conduct an environmental assessment to find and eliminate the source.

D. In general, following preventive measures shall be adopted during construction to keep down dust and prevent mold.

1. Dampen debris to keep down dust and provide temporary construction partitions in existing structures where directed by Resident Engineer. Blank off ducts and diffusers to prevent circulation of dust into occupied areas during construction.

2. Analyze each site during design to determine the effects of blocking HVAC ducts and their impact on existing air handling systems that must remain operational before initiating a dust control program. The method of capping ducts shall be dust tight and withstand airflow.

3. Construct anteroom to maintain negative airflow from clean area through anteroom and into work area where required.

4. High risk patient care areas may require additional measures like air locks, special signage, smoke and negative pressure alarms.

5. Identify these areas clearly on the drawings and work with Medical Center personnel to achieve desired level of isolation suited to the scope of risk involved.

6. Do not perform dust- producing tasks within occupied areas without the approval of the Project Manager. For construction in any areas that will remain jointly occupied by the medical Center and Contractor’s workers, the Contractor shall:

a. Provide dust proof fire-rated temporary drywall construction barriers to completely separate construction from the operational areas of the hospital in order to contain dirt debris and dust. Barriers shall be sealed and made presentable on hospital occupied side. Install a self-closing rated door in a metal frame, commensurate with the partition, to allow worker access. Maintain negative air at all times. A fire retardant polystyrene, 6-mil thick or greater plastic barrier meeting local fire codes may be used where dust control is the only hazard, and an agreement is reached with the Resident Engineer and Medical Center.

b. HEPA filtration is required where the exhaust dust may reenter the breathing zone. Contractor shall verify that construction exhaust to exterior is not reintroduced to the medical center through intake vents, or building openings. Install HEPA (High Efficiency Particulate Accumulator) filter vacuum system rated at 95% capture of 0.3 microns including pollen, mold spores and dust particles. Insure continuous negative air pressures occurring within the work area. HEPA filters should have ASHRAE 85 or other pre-filter to extend the useful life of the HEPA. Provide both primary and secondary filtrations units. Exhaust hoses shall be heavy duty, flexible steel reinforced and exhausted so that dust is not reintroduced to the medical center.

c. Adhesive Walk-off/Carpet Walk-off Mats, minimum 24” x 36”, shall be used at all Interior transitions from the construction area to occupied medical center area. These mats shall be changed as often as required to maintain clean work areas directly outside construction area at all times.

d. Vacuum and wet mop all transition areas from construction to the occupied medical center at the end of each workday. Vacuum shall utilize HEPA filtration.

Maintain surrounding area frequently. Remove debris as they are created. Transport these outside the construction area in containers with tightly fitting lids.

e. The contractor shall not haul debris through patient-care areas without prior approval of the Resident Engineer and the Medical Center. When, approved, debris shall be hauled in enclosed dust proof containers or wrapped in plastic and sealed with duct tape. No sharp objects should be allowed to cut through the plastic. Wipe down the exterior of the containers with a damp rag to remove dust. All equipment, tools, material, etc. transported through occupied areas shall be made free from dust and moisture by vacuuming and wipe down.

f. Using a HEPA vacuum, clean inside the barrier and vacuum ceiling tile prior to replacement. Any ceiling access panels opened for investigation beyond sealed areas shall be sealed immediately when unattended.

g. There shall be no standing water during construction. This includes water in equipment drip pans and open containers within the construction areas. All accidental spills must be cleaned up and dried within 12 hours. Remove and dispose of porous materials that remain damp for more than 72 hours.

h. At completion, remove construction barriers and ceiling protection carefully, outside of normal work hours. Vacuum and clean all surfaces free of dust after the removal.

E. Final Cleanup:

1. Upon completion of project, or as work progresses, remove all construction debris from above ceiling, vertical shafts and utility chases that have been part of the construction.

2. Perform HEPA vacuum cleaning of all surfaces in the construction area. This includes walls, ceilings, cabinets, furniture (built-in or free standing), partitions, flooring, etc.

1. All new air ducts shall be cleaned prior to final inspection. SPEC WRITER NOTE: On small projects developed at Medical Center, Engineering Officer may tag items to be removed and stored, instead of noting such items on drawings or in specifications.

END OF APPENDIX

APPENDIX B

VA INFORMATION AND INFORMATION SYSTEM SECURITY/PRIVACY LANGUAGE FOR

INCLUSION INTO CONTRACTS, AS APPROPRIATE

NOTE: Any sections (1-14) which DO NOT apply should not be included in the Statement of Work (SOW), Performance Work Statement (PWS), Product Description (PD) or contract.

1. GENERAL. This entire section applies to all acquisitions requiring any Information Security and Privacy language. Contractors, contractor personnel, subcontractors and subcontractor personnel will be subject to the same federal laws, regulations, standards, VA directives and handbooks, as VA personnel regarding information and information system security and privacy.

2. VA INFORMATION CUSTODIAL LANGUAGE. This entire section applies to all acquisitions requiring any Information Security and Privacy language. a. The Government shall receive unlimited rights to data/intellectual property first produced and delivered in the performance of this contract or order (hereinafter “contract”) unless expressly stated otherwise in this contract. This includes all rights to source code and all documentation created in support thereof. The primary clause used to define Government and Contractor data rights is FAR 52.227-14 Rights in Data – General. The primary clause used to define computer software license (not data/intellectual property first produced under this contractor or order) is FAR 52.227-19, Commercial Computer Software License.

b. Information made available to the contractor by VA for the performance or administration of this contract will be used only for the purposes specified in the service agreement, SOW, PWS, PD, and/or contract. The contractor shall not use VA information in any other manner without prior written approval from a VA Contracting Officer (CO). The primary clause used to define Government and Contractor data rights is FAR 52.227-14 Rights in Data – General.

c. VA information will not be co-mingled with any other data on the contractor’s information systems or media storage systems. The contractor shall ensure compliance with Federal and VA requirements related to data protection, data encryption, physical data segregation, logical data segregation, classification requirements and media sanitization.

d. VA reserves the right to conduct scheduled or unscheduled audits, assessments, or investigations of contractor Information Technology (IT) resources to ensure information security is compliant with Federal and VA requirements. The contractor shall provide all necessary access to records (including electronic and documentary materials related to the contracts and subcontracts) and support (including access to contractor and subcontractor staff associated with the contract) to VA, VA's Office Inspector General (OIG), and/or Government Accountability Office (GAO) staff during periodic control assessments, audits, or investigations.

e. The contractor may only use VA information within the terms of the contract and applicable Federal law, regulations, and VA policies. If new Federal information security laws, regulations or VA policies become applicable after execution of the contract, the parties agree to negotiate contract modification and adjustment necessary to implement the new laws, regulations, and/or policies.

f. The contractor shall not make copies of VA information except as specifically authorized and necessary to perform the terms of the contract. If copies are made for restoration purposes, after the restoration is complete, the copies shall be destroyed in accordance with VA Directive 6500, VA Cybersecurity Program and VA Information Security Knowledge Service.

g. If a Veterans Health Administration (VHA) contract is terminated for default or cause with a business associate, the related local Business Associate Agreement (BAA) shall also be terminated and actions taken in accordance with VHA Directive 1605.05, Business Associate Agreements. If there is an executed national BAA associated with the contract, VA will determine what actions are appropriate and notify the contactor.

h. The contractor shall store and transmit VA sensitive information in an encrypted form, using VA-approved encryption tools which are, at a minimum, Federal Information Processing Standards (FIPS) 140-2, Security Requirements for Cryptographic Modules (or its successor) validated and in conformance with VA Information Security Knowledge Service requirements. The contractor shall transmit VA sensitive information using VA approved Transport Layer Security (TLS) configured with FIPS based cipher suites in conformance with National Institute of Standards and Technology (NIST) 800-52, Guidelines for the Selection, Configuration and Use of Transport Layer Security (TLS) Implementations.

i. The contractor’s firewall and web services security controls, as applicable, shall meet or exceed VA’s minimum requirements.

j. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor may use and disclose VA information only in two situations: (i) in response to a qualifying order of a court of competent jurisdiction after notification to VA CO (ii) with written approval from the VA CO. The contractor shall refer all requests for, demands for production of or inquiries about, VA information and information systems to the VA CO for response.

k. Notwithstanding the provision above, the contractor shall not release VA records protected by Title 38 U.S.C. § 5705, Confidentiality of medical quality-assurance records and/or Title 38 U.S.C. § 7332, Confidentiality of certain medical records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse or infection with Human Immunodeficiency Virus (HIV). If the contractor is in receipt of a court order or other requests for the above-mentioned information, the contractor shall immediately refer such court order or other requests to the VA CO for response.

l. Information made available to the contractor by VA for the performance or administration of this contract or information developed by the contractor in performance or administration of the contract will be protected and secured in accordance with VA Directive 6500 and Identity and Access Management (IAM) Security processes specified in the VA Information Security Knowledge Service.

m. Any data destruction done on behalf of VA by a contractor shall be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management, VA Handbook 6300.1, Records Management Procedures, and applicable VA Records Control Schedules.

n. The contractor shall provide its plan for destruction of all VA data in its possession according to VA Directive 6500 and NIST 800-88, Guidelines for Media Sanitization prior to termination or completion of this contract. If directed by the COR/CO, the contractor shall return all Federal Records to VA for disposition.

o. Any media, such as paper, magnetic tape, magnetic disks, solid state devices or optical discs that is used to store, process, or access VA information that cannot be destroyed shall be returned to VA.The contractor shall hold the appropriate material until otherwise directed by the Contracting Officer’s Representative (COR) or CO. Items shall be returned securely via VA-approved methods. VA sensitive information must be transmitted utilizing VA-approved encryption tools which are validated under FIPS 140-2 (or its successor) and NIST 800-52. If mailed, the contractor shall send via a trackable method (USPS, UPS, FedEx, etc.) and immediately provide the COR/CO with the tracking information. Self-certification by the contractor that the data destruction requirements above have been met shall be sent to the COR/CO within 30 business days of termination of the contract.

p. All electronic storage media (hard drives, optical disks, CDs, back-up tapes, etc.) used to store, process or access VA information will not be returned to the contractor at the end of lease, loan, or trade-in. Exceptions to this paragraph will only be granted with the written approval of the VA CO.

3. ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS. This section applies when any person requires access to information made available to the contractor by VA for the performance or administration of this contract or information developed by the contractor in performance or administration of the contract.

a. A contractor/subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees and subcontractors only to the extent necessary to perform the services specified in the solicitation or contract. This includes indirect entities, both affiliate of contractor/subcontractor and agent of contractor/subcontractor.

b. Contractors and subcontractors shall sign the VA Information Security Rule of Behavior (ROB) before access is provided to VA information and information systems (see Section 4, Training, below). The ROB contains the minimum user compliance requirements and does not supersede any policies of VA facilities or other agency components which provide higher levels of protection to VA’s information or information systems. Users who require privileged access shall complete the VA elevated privilege access request processes before privileged access is granted.

c. All contractors and subcontractors working with VA information are subject to the same security investigative and clearance requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors shall be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office of Human Resources and Administration/Operations, Security and Preparedness (HRA/OSP) is responsible for these policies and procedures. Contract personnel who require access to classified information or information systems shall have an appropriate security clearance. Verification of a Security Clearance shall be processed through the Special Security Officer located in HRA/OSP. Contractors shall conform to all requirements stated in the National Industrial Security Program Operating Manual (NISPOM).

d. All contractors and subcontractors shall comply with conditions specified in VAAR 852.204-71(d); Contractor operations required to be in United States. All contractors and subcontractors working with VA information must be permanently located within a jurisdiction subject to the law of the United States or its Territories to the maximum extent feasible. If services are proposed to be performed abroad the contractor must state where all non-U.S. services are provided. The contractor shall deliver to VA a detailed plan specifically addressing communications, personnel control, data protection and potential legal issues. The plan shall be approved by the COR/CO in writing prior to access being granted.

e. The contractor shall notify the COR/CO in writing immediately (no later than 24 hours) after personnel separation or occurrence of other causes. Causes may include the following:

(1) Contractor/subcontractor personnel no longer has a need for access to VA information or VA information systems.

(2) Contractor/subcontractor personnel are terminated, suspended, or otherwise has their work on a VA project discontinued for any reason.

(3) Contractor believes their own personnel or subcontractor personnel may pose a threat to their company’s working environment or to any company-owned property. This includes contractor-owned assets, buildings, confidential data, customers, employees, networks, systems, trade secrets and/or VA data.

(4) Any previously undisclosed changes to contractor/subcontractor background history are brought to light, including but not limited to changes to background investigation or employee record.

(5) Contractor/subcontractor personnel have their authorization to work in the United States revoked.

(6) Agreement by which contractor provides products and services to VA has either been fulfilled or terminated, such that VA can cut off electronic and/or physical access for contractor personnel.

f. In such cases of contract fulfillment, termination, or other causes; the contractor shall take the necessary measures to immediately revoke access to VA network, property, information, and information systems (logical and physical) by contractor/subcontractor personnel. These measures include (but are not limited to): removing and then securing Personal Identity Verification (PIV) badges and PIV – Interoperable (PIV-I) access badges, VA-issued photo badges, credentials for VA facilities and devices, VA-issued laptops, and authentication tokens. Contractors shall notify the appropriate VA COR/CO immediately to initiate access removal.

g. Contractors/subcontractors who no longer require VA accesses will return VA-issued property to VA. This property includes (but is not limited to): documents, electronic equipment, keys, and parking passes. PIV and PIV-I access badges shall be returned to the nearest VA PIV Badge Issuance Office. Once they have had access to VA information, information systems, networks and VA property in their possessions removed, contractors shall notify the appropriate VA COR/CO.

4. TRAINING. This entire section applies to all acquisitions which include section 3. a. All contractors and subcontractors requiring access to VA information and VA information systems shall successfully complete the following before being granted access to VA information and its systems: (1) VA Privacy and Information Security Awareness and Rules of Behavior course (Talent Management System (TMS) #10176) initially and annually thereafter.

(2) Sign and acknowledge (electronically through TMS #10176) understanding of and responsibilities for compliance with the Organizational Rules of Behavior, relating to access to VA information and information systems initially and annually thereafter; and

(3) Successfully complete any additional cyber security or privacy training, as required for VA personnel with equivalent information system or information access [to be defined by the VA program official and provided to the VA CO for inclusion in the solicitation document – i.e., any role-based information security training].

b. The contractor shall provide to the COR/CO a copy of the training certificates and certification of signing the Organizational Rules of Behavior for each applicable employee within five days of the initiation of the contract and annually thereafter, as required.

c. Failure to complete the mandatory annual training is grounds for suspension or termination of all physical or electronic access privileges and removal from work on the contract until such time as the required training is complete.

5. SECURITY INCIDENT INVESTIGATION. This entire section applies to all acquisitions requiring any Information Security and Privacy language. a. The contractor, subcontractor, their employees, or business associates shall immediately (within one hour) report suspected security / privacy incidents to the VA OIT’s Enterprise Service Desk (ESD) by calling (855) 673-4357 (TTY: 711). The ESD is OIT’s 24/7/365 single point of contact for IT-related issues. After reporting to the ESD, the contractor, subcontractor, their employees, or business associates shall, within one hour, provide the COR/CO the incident number received from the ESD.

b. To the extent known by the contractor/subcontractor, the contractor/ subcontractor's notice to VA shall identify the information involved and the circumstances surrounding the incident, including the following: (1) The date and time (or approximation of) the Security Incident occurred.

(2) The names of individuals involved (when applicable).

(3) The physical and logical (if applicable) location of the incident.

(4) Why the Security Incident took place (i.e., catalyst for the failure).

(5) The amount of data belonging to VA believed to have been compromised.

(6) The remediation measures the contractor…