36C24422Q1161_1.docx

SUBJECT*

642-22-3-315-0255 | GE ComboLab AltiX Hemodynamic and EP Recording System Upgrade (VA-22-00081998)

GENERAL INFORMATION

SET-ASIDE

Network Contracting Office 4

1010 Delafield Road

POINT OF CONTACT*

Contracting Officer Mark E. Murray mark.murray4@va.gov 412-822-3745

PLACE OF PERFORMANCE

Philadelphia VA Medical Center

3900 Woodland Avenue

Philadelphia PA

ADDITIONAL INFORMATION

Combined Synopsis/Solicitation Notice Combined Synopsis/Solicitation Notice

DESCRIPTION

Combined Synopsis/Solicitation Notice

Description This is a combined synopsis/solicitation for commercial items prepared in accordance with the format in Federal Acquisition Regulation (FAR) subpart 12.6, “Streamlined Procedures for Evaluation and Solicitation for Commercial Items,” as supplemented with additional information included in this notice. This announcement constitutes the only solicitation; quotes are being requested, and a written solicitation document will not be issued.

This solicitation is issued as an RFQ. The solicitation document and incorporated provisions and clauses are those in effect through Federal Acquisition Circular (FAC) 2022-07 (effective 08-01-2022) and Veteran Affairs Acquisition Regulation (VAAR) 2008-32 (effective 11-01-2021).

This solicitation is a sole source acquisition for a Service Disabled Veteran Owned Small Business in accordance with FAR Part 13.5 and VAAR 819.7007.

The associated North American Industrial Classification System (NAICS) code for this procurement is 334510 with a small business size standard of 1,250 employees.

The FSC/PSC is 6515.

The Network Contracting Office 4, 1010 Delafield Road, Pittsburgh, PA 15215-1802 is seeking to purchase the Delivery, Installation, and Training of GE CardioLab Upgrade meeting Salient Characteristics specified in the Statement of Need (SON), paragraph C, for the Philadelphia (Corporal Michael Crescenz) VA Medical Center, Philadelphia, PA.

All interested companies shall provide quotations for the following: See Attachments 02A and 02B (Attachment 02A is informational and Attachment 02B is required for Response [submission]); Certifications at Attachments 03, 04, 05, and 06; Original Equipment Manufacturer Warranty information; and Certification (endorsed letter/memo) from the Manufacturer that your firm is an authorized distributor of the equipment supplies offered.

Statement of Need is included as Attachment 01.

Delivery shall be provided: No Later than 60 Days after receipt of order (ARO). Delivery Terms are Freight On Board (FOB).

Place of Performance/Place of Delivery

Philadelphia, PA

The full text of FAR provisions or clauses may be accessed electronically at http://acquisition.gov/comp/far/index.html.

The full text of VAAR provisions or clauses may be accessed electronically at https://www.acquisition.gov/vaar.

Questions regarding this solicitation are due by 09-07-2022. No questions will be answered following this date. Questions received after this time may not be considered for review. Questions shall be submitted to mark.murray4@va.gov. Prospective Vendors are asked to submit their questions grouped by solicitation section and make reference to the particular paragraph in that section. The Subject Line for questions shall state ‘GE ComboLab Upgrade – Questions’. Responses to all inquiries/questions will be posted to System for Award Management Contract Opportunities (CO) as an Amendment. Vendors shall be responsible for monitoring SAM CO for the agency’s responses. No information concerning this solicitation shall be provided in response to telephone calls.

Submission of your response shall be received not later than 16:30 ET on 09-09-2022 at mark.murray4@va.gov in order to be considered for award.

Late submissions shall be treated in accordance with the solicitation provision at VAAR 852.273-70.

Any questions or concerns regarding this solicitation should be forwarded in writing via e-mail to the Point of Contact listed below.

Point of Contact

Mark Murray, Contracting Officer, mark.murray4@va.gov

SOLICITATION PROVISIONS

52.212-1 INSTRUCTIONS TO OFFERORS—COMMERCIAL ITEMS (SEP 2021)

The following FAR and Veterans Affairs Acquisition Regulation (VAAR) apply to this acquisition:

52.212-1 Instructions to Offerors -- Commercial Items (SEP 2021) applies to this acquisition.

Addenda to 52.212-1:

Reference word “offer”: delete “offer” and insert “quote” in its place.

Reference word “offeror”: delete “offeror” and insert “vendor” in its place.

Reference paragraph (c) period for acceptance of quotes: delete “30 calendar days” and insert “60 calendar days” in its place.

The following paragraphs are hereby deleted from this provision: (d) product samples, (e) multiple offers, and (h) multiple awards.

Quote Submission Instructions:

Vendors should review RFQ and are ultimately responsible for ensuring that their quotes fully comply with submission requirements for this RFQ. Each quote shall clearly demonstrate that the Vendor understands both the general and specific technical requirements of the Statement of Need. Failure to explain Vendor’s ability to meet all requirements may result in the Vendor's quote not being considered. Along with their quote and documentation of understanding the vendor must submit the documentation of certification to work on the subject equipment. Clarity and completeness of quotes are of the utmost importance. Therefore, quotes must be organized in a practical, clear, and concise manner.

Quotes shall be sent electronically via e-mail. All quotes shall include one (1) separate copy of each of the items listed below. Submission of a quote that does not contain all items requested below may result in elimination from consideration of award. Offerors must submit each item of quote in a separate electronic attachment clearly identified as described below. No price information shall be included in the technical or past performance section. Offerors are responsible for including sufficient details to permit a complete and accurate evaluation of each quote.

Attachment 1

1. Completed Schedule of Supplies and Services (Attachment 002B (Price Cost Schedule-Excel Document) to this solicitation). Completed CLIN price information in the Schedule of Supplies/Services. *Offerors must use the CLINs specified in the Schedule of Supplies/Services. It is not permissible for offerors to use offeror created CLINs or SUBCLINs. The Vendor is required to provide all CLIN pricing, including Delivery Dates. The Vendor shall provide all the Items listed in the Pricing Schedule listed in this Request for Quotation. The Vendor is required to provide the Data Value Spreadsheet in order to be considered responsive.

2. Completed certifications and representations located at FAR 52.212-3, or an indication that said certifications and representations are current and located in the SAM database.

3. Signed Certifications that may be included as Addenda to FAR 52.212-1. (Attachments Numbers 03, 04, 05, 06, and 07).

4. Signed acknowledgements of amendments (SF30). Applicable only if any amendments are issued against this solicitation.

5. The Vendor must be an Authorized Distributor of the required items as demonstrated by their Authorized Distribution Letter.

6. Provide manufacturer’s warranty information for each product listed with the Contract Line Items Numbers for all provided equipment so that the manufacturer’s warranty can be put in place. The contractor will be responsible for providing continuity of all warranties and will ensure transfer of all warranties to VA is completed.

Attachment 2 Vendors shall provide a narrative (including any descriptive literature and/or certifications) which demonstrates the offeror’s ability to meet the technical credentials and capability stated in the Statement of Need (SON) and the Requirements specified in the SON. The narrative shall not exceed twenty (20) pages and address requirements stated in the SON.

The Government may utilize the Federal Past Performance Information Retrieval System (PPIRS), the Contractor Performance Assessment Reporting System (CPARS), responses from the Performance Risk Assessment Questionnaire, data submitted by the vendor, and any other information available to determine the quality and relevance of the vendor’s past performance.

Prospective Vendors are warned against contacting any DVA personnel outside the Procurement Department prior to award of a Contract resulting from this solicitation. If such contact occurs and is found to be prejudicial to competing Vendors, the Vendor making such contact may be excluded from award consideration.

The following provisions apply and are incorporated by reference and full text:

(End of Provision) ADDENDUM to FAR 52.212-1 INSTRUCTIONS TO OFFERORS—COMMERCIAL PRODUCTS AND COMMERCIAL SERVICES Provisions that are incorporated by reference (by Citation Number, Title, and Date), have the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available.

The following provisions are incorporated into 52.212-1 as an addendum to this solicitation:

52.252-1 SOLICITATION PROVISIONS INCORPORATED BY REFERENCE (FEB 1998)

This solicitation incorporates one or more solicitation provisions by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. The offeror is cautioned that the listed provisions may include blocks that must be completed by the offeror and submitted with its quotation or offer. In lieu of submitting the full text of those provisions, the offeror may identify the provision by paragraph identifier and provide the appropriate information with its quotation or offer. Also, the full text of a solicitation provision may be accessed electronically at this/these address(es):

http://www.acquisition.gov/far/index.html http://www.va.gov/oal/library/vaar/

(End of Provision)

52.233-2 SERVICE OF PROTEST (SEP 2006)

Protests, as defined in section 33.101 of the Federal Acquisition Regulation, that are filed directly with an agency, and copies of any protests that are filed with the Government Accountability Office (GAO), shall be served on the Contracting Officer (addressed as follows) by obtaining written and dated acknowledgment of receipt from:

Mark E. Murray mark.murray4@va.gov Hand-Carried Address:

Department of Veterans Affairs Network Contracting Office 4

1010 Delafield Road Pittsburgh PA 15215-1802 Mailing Address:

Department of Veterans Affairs Network Contracting Office 4

1010 Delafield Road Pittsburgh PA 15215-1802

(b) The copy of any protest shall be received in the office designated above within one day of filing a protest with the GAO.

(End of Provision) (End of Addendum to 52.212-1)

13.106-2 EVALUATION OF QUOTATION OR OFFERS

The Government intends to award one purchase order as a result of this Request for Quote to the responsible offeror whose quote conforms to the solicitation requirements and will be most advantageous to the Government, price, technical capability of the items offered to meet the Government requirement, and past performance considered.

The Government is not limited to the Past Performance Record information provided above, but reserves the right to independently seek past performance information through open market contracts, government systems, and other government agencies.

The Contracting Officer does anticipate adequate price competition for this RFQ. Should that not happen, the Contracting Officer may need to ask for Data Other than Certified Cost and Price Data to assist with the determination of price reasonableness.

Vendors are advised that submitting an unrealistically low price may be grounds for eliminating a quote from competition. This could be on the basis that the vendor does not understand the requirement or has made an incautious quote.

Award for this requirement will be made to the vendor who proposes the Lowest Price Technically Acceptable quote to the Government. To be Technically Acceptable, the vendor must be an authorized reseller of the required items as demonstrated by their Authorized Distributor Letter. A review will be conducted. The Department of Veteran’s Affairs (DVA) will award to the vendor proposing the best value to the Government, price and other factors considered.

The evaluation matrix is as follows:

1. Authorized Distributor Letter.

2. A completed Pricing Schedule.

3. A Delivery Date no more than 60 calendar days ARO.

4. CLIN Data Value Spreadsheet included.

The DVA will evaluate quotes for award purposes by adding the total price of all Base and Option amounts for each CLIN. Evaluation of options will not obligate the DVA to exercise the option(s).

At the time of evaluation, all quotes will be evaluated to determine the Lowest Priced Quote. At that time, only the Lowest Priced Quote will be forwarded on for Technical Evaluation. If the lowest price quote is found to NOT be technically acceptable, the next lowest priced quote will be forwarded on for technical acceptability. This process will continue until the lowest priced, technically acceptable quote is identified.

All optional services must be priced in order for the proposal to be evaluated.

The DVA may reject a quote as non-responsive if it is materially unbalanced. A quote is unbalanced when it is based on prices significantly less for some work and significantly overstated for other work, or the prices do not reflect market value.

(End of Provision)

Offerors must complete annual representations and certifications electronically via the System for Award Management (SAM) website located at https://www.sam.gov/portal in accordance with FAR 52.212-3, “Offerors Representations and Certifications–Commercial Items.” If paragraph (j) of the provision is applicable, a written submission is required.

End of Document

Page 1 of Page 1 of

CONTRACT CLAUSES

ADDENDUM to FAR 52.212-4 CONTRACT TERMS AND CONDITIONS—COMMERCIAL PRODUCTS AND COMMERCIAL SERVICES Clauses that are incorporated by reference (by Citation Number, Title, and Date), have the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available.

The following clauses are incorporated into 52.212-4 as an addendum to this contract:

52.252-2 CLAUSES INCORPORATED BY REFERENCE (FEB 1998)

This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. Also, the full text of a clause may be accessed electronically at this/these address(es):

http://www.acquisition.gov/far/index.html http://www.va.gov/oal/library/vaar/

(End of Clause)

VAAR 852.212-71 GRAY MARKET ITEMS (APR 2020)

(a) No gray market or remanufactured items will be acceptable. Gray market items are Original Equipment Manufacturers’ (OEM) goods sold through unauthorized channels in direct competition with authorized distributors. This procurement is for new OEM medical equipment only for VA medical facilities.

(b) Vendor shall be an OEM, authorized dealer, authorized distributor or authorized reseller for the proposed equipment/system, verified by an authorization letter or other documents from the OEM. All software licensing, warranty and service associated with the equipment/system shall be in accordance with the OEM terms and conditions.

(End of Clause) VAAR 852.219-74 LIMITATIONS ON SUBCONTRACTING—MONITORING AND COMPLIANCE (JUL 2018)

(a) This solicitation includes VAAR 852.219-10.

(b) Accordingly, any contract resulting from this solicitation is subject to the limitation on subcontracting requirements in 13 CFR 125.6, or the limitations on subcontracting requirements in the FAR clause, as applicable. The Contractor is advised that in performing contract administration functions, the Contracting Officer may use the services of a support contractor(s) retained by VA to assist in assessing the Contractor's compliance with the limitations on subcontracting or percentage of work performance requirements specified in the clause. To that end, the support contractor(s) may require access to Contractor's offices where the Contractor's business records or other proprietary data are retained and to review such business records regarding the Contractor's compliance with this requirement.

(c) All support contractors conducting this review on behalf of VA will be required to sign an “Information Protection and Non-Disclosure and Disclosure of Conflicts of Interest Agreement” to ensure the Contractor's business records or other proprietary data reviewed or obtained in the course of assisting the Contracting Officer in assessing the Contractor for compliance are protected to ensure information or data is not improperly disclosed or other impropriety occurs.

(d) Furthermore, if VA determines any services the support contractor(s) will perform in assessing compliance are advisory and assistance services as defined in FAR 2.101, Definitions, the support contractor(s) must also enter into an agreement with the Contractor to protect proprietary information as required by FAR 9.505-4, Obtaining access to proprietary information, paragraph (b). The Contractor is required to cooperate fully and make available any records as may be required to enable the Contracting Officer to assess the Contractor's compliance with the limitations on subcontracting or percentage of work performance requirement.

(End of Clause) VAAR 852.212-70 PROVISIONS AND CLAUSES APPLICABLE TO VA ACQUISITION OF COMMERCIAL ITEMS (APR 2020)

(a) The Contractor agrees to comply with any provision or clause that is incorporated herein by reference to implement agency policy applicable to acquisition of commercial items or components. The following provisions and clauses that have been checked by the Contracting Officer are incorporated by reference.

[ X ] 852.203–70, Commercial Advertising.

[ X ] 852.211–70, Equipment Operation and Maintenance Manuals.

[ X ] 852.219–10, VA Notice of Total Service-Disabled Veteran-Owned Small Business Set-Aside.

[ X ] 852.232–72, Electronic Submission of Payment Requests.

[ X ] 852.233–70, Protest Content/Alternative Dispute Resolution.

[ X ] 852.233–71, Alternate Protest Procedure.

[ X ] 852.246–71, Rejected Goods.

[ X ] 852.270–1, Representatives of Contracting Officers.

[ X ] 852.273–70, Late Offers.

(b) All requests for quotations, solicitations, and contracts for commercial item services to be provided to beneficiaries must include the following clause:

Not Applicable (End of Clause)

VAAR 852.242-71 ADMINISTRATIVE CONTRACTING OFFICER (OCT 2020)

The Contracting Officer reserves the right to designate an Administrative Contracting Officer (ACO) for the purpose of performing certain tasks/duties in the administration of the contract. Such designation will be in writing through an ACO Letter of Delegation and will identify the responsibilities and limitations of the ACO. A copy of the ACO Letter of Delegation will be furnished to the Contractor.

(End of Clause)

VAAR 852.247-71 DELIVERY LOCATION (OCT 2018)

Shipment of deliverable items, other than reports, shall be to:

Department of Veterans Affairs Philadelphia VA Medical Center

3900 Woodland Avenue Philadelphia PA 19104-4551 (End of Clause)

VAAR 852.247-72 MARKING DELIVERABLES (OCT 2018)

(a) The contract number shall be placed on or adjacent to all exterior mailing or shipping labels of deliverable items called for by the contract.

(b) Mark deliverables, except reports, for:

To Be published in award (SF 1449, Blocks 2 and 4).

(End of Clause) LOCAL CLAUSE Information and Information Security Requirements

The following Terms and Conditions are included in this Contract.

VA ACQUISITION REGULATION SOLICITATION PROVISION AND CONTRACT CLAUSE

NOTE: This clause will undergo official rule making by the Office of Acquisitions and Logistics.

The below language will be submitted for public review through the Federal Register. The final wording of the clause may be changed from what is outlined below based on public review and comment. Once approved, the final language in the clause can be obtained from the Office of Acquisitions and Logistics Programs and Policy.

1. SUBPART 839.2 – INFORMATION AND INFORMATION TECHNOLOGY SECURITY

REQUIREMENTS

839.201 Contract clause for Information and Information Technology Security:

a. Due to the threat of data breach, compromise or loss of information that resides on either VA-owned or contractor-owned systems, and to comply with Federal laws and regulations, VA has developed an Information and Information Technology Security clause to be used when VA sensitive information is accessed, used, stored, generated, transmitted, or exchanged by and between VA and a contractor, subcontractor or a third party in any format (e.g., paper, microfiche, electronic or magnetic portable media).

b. In solicitations and contracts where VA Sensitive Information or Information Technology will be accessed or utilized, the CO shall insert the clause found at 852.273-75, Security Requirements for Unclassified Information Technology Resources.

2. 852.273-75 - SECURITY REQUIREMENTS FOR UNCLASSIFIED INFORMATION

TECHNOLOGY RESOURCES (INTERIM- OCTOBER 2008)

As prescribed in 839.201, insert the following clause:

The contractor, their personnel, and their subcontractors shall be subject to the Federal laws, regulations, standards, and VA Directives and Handbooks regarding information and information system security as delineated in this contract.

(END OF CLAUSE)

LOCAL CLAUSE Information and Information System Security/Privacy Language

The following Terms and Conditions are included in this Contract.

1. GENERAL

Contractors, contractor personnel, subcontractors, and subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security.

2. ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS

a. A contractor/subcontrator shall request logical (technical) or physical access to VA information and VA information systems for their employees, subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order.

b. All contractors, subcontractors, and third-party servicers and associates working with VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures.

c. Contract personnel who require access to national security programs must have a valid security clearance. National Industrial Security Program (NISP) was established by Executive Order 12829 to ensure that cleared U.S. defense industry contract personnel safeguard the classified information in their possession while performing work on contracts, programs, bids, or research and development efforts. The Department of Veterans Affairs does not have a Memorandum of Agreement with Defense Security Service (DSS). Verification of a Security Clearance must be processed through the Special Security Officer located in the Planning and National Security Service within the Office of Operations, Security, and Preparedness.

d. Custom software development and outsourced operations must be located in the U.S.

to the maximum extent practical. If such services are proposed to be performed abroad and are not disallowed by other VA policy or mandates, the contractor/subcontractor must state where all non-U.S. services are provided and detail a security plan, deemed to be acceptable by VA, specifically to address mitigation of the resulting problems of communication, control, data protection, and so forth. Location within the U.S. may be an evaluation factor.

e. The contractor or subcontractor must notify the Contracting Officer immediately when an employee working on a VA system or with access to VA information is reassigned or leaves the contractor or subcontractor’s employ. The Contracting Officer must also be notified immediately by the contractor or subcontractor prior to an unfriendly termination.

3. VA INFORMATION CUSTODIAL LANGUAGE

a. Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the contractor/subcontractor's rights to use data as described in Rights in Data

- General, FAR 52.227-14(d) (1).

b. VA information should not be co-mingled, if possible, with any other data on the contractors/subcontractor’s information systems or media storage systems in order to ensure VA requirements related to data protection and media sanitization can be met. If co-mingling must be allowed to meet the requirements of the business need, the contractor must ensure that VA’s information is returned to the VA or destroyed in accordance with VA’s sanitization requirements. VA reserves the right to conduct on site inspections of contractor and subcontractor IT resources to ensure data security controls, separation of data and job duties, and destruction/media sanitization procedures are in compliance with VA directive requirements.

c. Prior to termination or completion of this contract, contractor/subcontractor must not destroy information received from VA, or gathered/created by the contractor in the course of performing this contract without prior written approval by the VA. Any data destruction done on behalf of VA by a contractor/subcontractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self-certification by the contractor that the data destruction requirements above have been met must be sent to the VA Contracting Officer within 30 days of termination of the contract.

d. The contractor/subcontractor must receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with the terms of the contract and applicable Federal and VA information confidentiality and security laws, regulations and policies. If Federal or VA information confidentiality and security laws, regulations and policies become applicable to the VA information or information systems after execution of the contract, or if NIST issues or updates applicable FIPS or Special Publications (SP) after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations and policies in this contract.

e. The contractor/subcontractor shall not make copies of VA information except as authorized and necessary to perform the terms of the agreement or to preserve electronic information stored on contractor/subcontractor electronic storage media for restoration in case any electronic equipment or data used by the contractor/subcontractor needs to be restored to an operating state. If copies are made for restoration purposes, after the restoration is complete, the copies must be appropriately destroyed.

f. If VA determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12.

g. If a VHA contract is terminated for cause, the associated BAA must also be terminated and appropriate actions taken in accordance with VHA Handbook 1600.01, Business Associate Agreements. Absent an agreement to use or disclose protected health information, there is no business associate relationship.

h. The contractor/subcontractor must store, transport, or transmit VA sensitive information in an encrypted form, using VA-approved encryption tools that are, at a minimum, FIPS 140-2 validated.

i. The contractor/subcontractor’s firewall and Web services security controls, if applicable, shall meet or exceed VA’s minimum requirements. VA Configuration Guidelines are available upon request.

j. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor/subcontractor may use and disclose VA information only in two other situations: (i) in response to a qualifying order of a court of competent jurisdiction, or (ii) with VA’s prior written approval. The contractor/subcontractor must refer all requests for, demands for production of, or inquiries about, VA information and information systems to the VA contracting officer for response.

k. Notwithstanding the provision above, the contractor/subcontractor shall not release VA records protected by Title 38 U.S.C. 5705, confidentiality of medical quality assurance records and/or Title 38 U.S.C. 7332, confidentiality of certain health records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse, or infection with human immunodeficiency virus. If the contractor/subcontractor is in receipt of a court order or other requests for the above mentioned information, that contractor/subcontractor shall immediately refer such court orders or other requests to the VA contracting officer for response.

l. For service that involves the storage, generating, transmitting, or exchanging of VA sensitive information but does not require C&A or an MOU-ISA for system interconnection, the contractor/subcontractor must complete a Contractor Security Control Assessment (CSCA) on a yearly basis and provide it to the COTR.

6. SECURITY INCIDENT INVESTIGATION

a. The term “security incident” means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. The contractor/subcontractor shall immediately notify the COTR and simultaneously, the designated ISO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/subcontractor has access.

b. To the extent known by the contractor/subcontractor, the contractor/subcontractor’s notice to VA shall identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the VA information or assets were placed at risk or compromised), and any other information that the contractor/subcontractor considers relevant.

c. With respect to unsecured protected health information, the business associate is deemed to have discovered a data breach when the business associate knew or should have known of a breach of such information. Upon discovery, the business associate must notify the covered entity of the breach. Notifications need to be made in accordance with the executed business associate agreement.

d. In instances of theft or break-in or other criminal activity, the contractor/subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG and Security and Law Enforcement. The contractor, its employees, and its subcontractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The contractor/subcontractor shall cooperate with VA in any civil litigation to recover VA information, obtain monetary or other compensation from a third party for damages arising from any incident, or obtain injunctive relief against any third party arising from, or related to, the incident.

7. LIQUIDATED DAMAGES FOR DATA BREACH

a. Consistent with the requirements of 38 U.S.C. §5725, a contract may require access to sensitive personal information. If so, the contractor is liable to VA for liquidated damages in the event of a data breach or privacy incident involving any SPI the contractor/subcontractor processes or maintains under this contract.

b. The contractor/subcontractor shall provide notice to VA of a “security incident” as set forth in the Security Incident Investigation section above. Upon such notification, VA must secure from a non-Department entity or the VA Office of Inspector General an independent risk analysis of the data breach to determine the level of risk associated with the data breach for the potential misuse of any sensitive personal information involved in the data breach. The term 'data breach' means the loss, theft, or other unauthorized access, or any access other than that incidental to the scope of employment, to data containing sensitive personal information, in electronic or printed form, that results in the potential compromise of the confidentiality or integrity of the data. Contractor shall fully cooperate with the entity performing the risk analysis. Failure to cooperate may be deemed a material breach and grounds for contract termination.

c. Each risk analysis shall address all relevant information concerning the data breach, including the following:

(1) Nature of the event (loss, theft, unauthorized access);

(2) Description of the event, including:

(a) date of occurrence;

(b) data elements involved, including any PII, such as full name, social security number, date of birth, home address, account number, disability code;

(3) Number of individuals affected or potentially affected;

(4) Names of individuals or groups affected or potentially affected;

(5) Ease of logical data access to the lost, stolen or improperly accessed data in light of the degree of protection for the data, e.g., unencrypted, plain text;

(6) Amount of time the data has been out of VA control;

(7) The likelihood that the sensitive personal information will or has been compromised (made accessible to and usable by unauthorized persons);

(8) Known misuses of data containing sensitive personal information, if any;

(9) Assessment of the potential harm to the affected individuals;

(10) Data breach analysis as outlined in 6500.2 Handbook, Management of Security and Privacy Incidents, as appropriate; and

(11) Whether credit protection services may assist record subjects in avoiding or mitigating the results of identity theft based on the sensitive personal information that may have been compromised.

d. Based on the determinations of the independent risk analysis, the contractor shall be responsible for paying to the VA liquidated damages in the amount of $37.50 per affected individual to cover the cost of providing credit protection services to affected individuals consisting of the following:

(1) Notification;

(2) One year of credit monitoring services consisting of automatic daily monitoring of at least 3 relevant credit bureau reports;

(3) Data breach analysis;

(4) Fraud resolution services, including writing dispute letters, initiating fraud alerts and credit freezes, to assist affected individuals to bring matters to resolution;

(5) One year of identity theft insurance with $20,000.00 coverage at $0 deductible; and

(6) Necessary legal expenses the subjects may incur to repair falsified or damaged credit records, histories, or financial affairs.

9. TRAINING

a. All contractor employees and subcontractor employees requiring access to VA information and VA information systems shall complete the following before being granted access to VA information and its systems:

(1) Sign and acknowledge (either manually or electronically) understanding of and responsibilities for compliance with the Contractor Rules of Behavior, Appendix E relating to access to VA information and information systems;

(2) Successfully complete the VA Cyber Security Awareness and Rules of Behavior training and annually complete required security training;

(3) Successfully complete the appropriate VA privacy training and annually complete required privacy training; and

(4) Successfully complete any additional cyber security or privacy training, as required for VA personnel with equivalent information system access [to be defined by the VA program official and provided to the contracting officer for inclusion in the solicitation document – e.g., any role-based information security training required in accordance with NIST Special Publication 800-16, Information Technology Security Training Requirements.]

b. The contractor shall provide to the contracting officer and/or the COTR a copy of the training certificates and certification of signing the Contractor Rules of Behavior for each applicable employee within 1 week of the initiation of the contract and annually thereafter, as required.

c. Failure to complete the mandatory annual training and sign the Rules of Behavior annually, within the timeframe required, is grounds for suspension or termination of all physical or electronic access privileges and removal from work on the contract until such time as the training and documents are complete.

(End of Addendum to 52.212-4)

52.212-5 CONTRACT TERMS AND CONDITIONS REQUIRED TO IMPLEMENT STATUTES OR EXECUTIVE ORDERS—COMMERCIAL PRODUCTS AND COMMERCIAL SERVICES (MAY 2022) (JUL 2020) (DEVIATION)

(a) The Contractor shall comply with the following Federal Acquisition Regulation (FAR) clauses, which are incorporated in this contract by reference, to implement provisions of law or Executive orders applicable to acquisitions of commercial products and commercial services:

(1) 52.203-19, Prohibition on Requiring Certain Internal Confidentiality Agreements or Statements (JAN 2017) (section 743 of Division E, Title VII, of the Consolidated and Further Continuing Appropriations Act, 2015 (Pub. L. 113-235) and its successor provisions in subsequent appropriations acts (and as extended in continuing resolutions)).

(2) 52.204–23, Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by Kaspersky Lab and Other Covered Entities (NOV 2021) (Section 1634 of Pub. L. 115–91).

(3) 52.204–25, Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment. (NOV 2021) (Section 889(a)(1)(A) of Pub. L. 115–232).

(4) 52.209-10, Prohibition on Contracting with Inverted Domestic Corporations (NOV 2015).

(5) 52.233-3, Protest After Award (Aug 1996) (31 U.S.C. 3553).

(6) 52.233-4, Applicable Law for Breach of Contract Claim (Oct 2004) (Public Laws 108-77 and 108-78 (19 U.S.C. 3805 note)).

(b) The Contractor shall comply with the FAR clauses in this paragraph (b) that the Contracting Officer has indicated as being incorporated in this contract by reference to implement provisions of law or Executive orders applicable to acquisitions of commercial products and commercial services:

[ X ] (1) 52.203–6, Restrictions on Subcontractor Sales to the Government (JUN 2020), with Alternate I (NOV 2021) (41 U.S.C. 4704 and 10 U.S.C. 2402).

[ X ] (4) 52.204–10, Reporting Executive Compensation and First-Tier Subcontract Awards (JUN 2020) (Pub. L. 109–282) (31 U.S.C. 6101 note).

[ X ] (8) 52.209–6, Protecting the Government’s Interest When Subcontracting with Contractors Debarred, Suspended, or Proposed for Debarment. (NOV 2021) (31 U.S.C. 6101 note).

[ X ] (16) 52.219-8, Utilization of Small Business Concerns (Oct 2018) (15 U.S.C. 637(d)(2) and (3)).

[ X ] (19) 52.219–14, Limitations on Subcontracting (SEP 2021) (15 U.S.C. 657s).

[] (22) (i) 52.219–28, Post-Award Small Business Program Rerepresentation (SEP 2021) (15 U.S.C. 632(a)(2)).

[ X ] (28) 52.222–19, Child Labor—Cooperation with Authorities and Remedies (JUL 2020) (DEVIATION) (E.O. 13126).

[ X ] (29) 52.222-21, Prohibition of Segregated Facilities (APR 2015).

[ X ] (31)(i) 52.222–35, Equal Opportunity for Veterans (JUN 2020) (38 U.S.C. 4212).

[ X ] (32)(i) 52.222–36, Equal Opportunity for Workers with Disabilities (JUN 2020) (29 U.S.C. 793).

[ X ] (33) 52.222–37, Employment Reports on Veterans (JUN 2020) (38 U.S.C. 4212).

[ X ] (34) 52.222-40, Notification of Employee Rights Under the National Labor Relations Act (DEC 2010) (E.O. 13496).

[ X ] (35)(i) 52.222-50, Combating Trafficking in Persons (NOV 2021) (22 U.S.C. chapter 78 and E.O. 13627).

[ X ] (36) 52.222-54, Employment Eligibility Verification (MAY 2022). (E. O. 12989). (Not applicable to the acquisition of commercially available off-the-shelf items or certain other types of commercial products or commercial services as prescribed in FAR 22.1803.)

[ X ] (44) 52.223–18, Encouraging Contractor Policies to Ban Text Messaging While Driving (JUN 2020) (E.O. 13513).

[ X ] (50) 52.225–5, Trade Agreements (JUL 2020) (DEVIATION) (19 U.S.C. 2501, et seq., 19 U.S.C. 3301 note).

[ X ] (51) 52.225-13, Restrictions on Certain Foreign Purchases (FEB 2021) (E.O.'s, proclamations, and statutes administered by the Office of Foreign Assets Control of the Department of the Treasury).

[ X ] (55) 52.229–12, Tax on Certain Foreign Procurements (FEB 2021).

[ X ] (58) 52.232-33, Payment by Electronic Funds Transfer—System for Award Management (Oct 2018) (31 U.S.C. 3332).

(c) The Contractor shall comply with the FAR clauses in this paragraph (c), applicable to commercial services, that the Contracting Officer has indicated as being incorporated in this contract by reference to implement provisions of law or Executive orders applicable to acquisitions of commercial products and commercial services:

None. Not Applicable.

(d) Comptroller General Examination of Record. The Contractor shall comply with the provisions of this paragraph (d) if this contract was awarded using other than sealed bid, is in excess of the simplified acquisition threshold, as defined in FAR 2.101, on the date of award of this contract, and does not contain the clause at 52.215-2, Audit and Records—Negotiation.

(1) The Comptroller General of the United States, or an authorized representative of the Comptroller General, shall have access to and right to examine any of the Contractor's directly pertinent records involving transactions related to this contract.

(2) The Contractor shall make available at its offices at all reasonable times the records, materials, and other evidence for examination, audit, or reproduction, until 3 years after final payment under this contract or for any shorter period specified in FAR Subpart 4.7, Contractor Records Retention, of the other clauses of this contract. If this contract is completely or partially terminated, the records relating to the work terminated shall be made available for 3 years after any resulting final termination settlement. Records relating to appeals under the disputes clause or to litigation or the settlement of claims arising under or relating to this contract shall be made available until such appeals, litigation, or claims are finally resolved.

(3) As used in this clause, records include books, documents, accounting procedures and practices, and other data, regardless of type and regardless of form. This does not require the Contractor to create or maintain any record that the Contractor does not maintain in the ordinary course of business or pursuant to a provision of law.

(e)(1) Notwithstanding the requirements of the clauses in paragraphs (a), (b), (c), and (d) of this clause, the Contractor is not required to flow down any FAR clause, other than those in this paragraph (e)(1) in a subcontract for commercial products or commercial services. Unless otherwise indicated below, the extent of the flow down shall be as required by the clause—

(i) 52.203–13, Contractor Code of Business Ethics and Conduct (NOV 2021) (41 U.S.C. 3509).

(ii) 52.203-19, Prohibition on Requiring Certain Internal Confidentiality Agreements or Statements (JAN 2017) (section 743 of Division E, Title VII, of the Consolidated and Further Continuing Appropriations Act, 2015 (Pub. L. 113-235) and its successor provisions in subsequent appropriations acts (and as extended in continuing resolutions)).

(iii) 52.204–23, Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by Kaspersky Lab and Other Covered Entities (NOV 2021) (Section 1634 of Pub. L. 115–91).

(iv) 52.204–25, Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment. (NOV 2021) (Section 889(a)(1)(A) of Pub. L. 115–232).

(v) 52.219–8, Utilization of Small Business Concerns (Oct 2018) (15 U.S.C. 637(d)(2) and (3)), in all subcontracts that offer further subcontracting opportunities. If the subcontract (except subcontracts to small business concerns) exceeds the applicable threshold specified in FAR 19.702(a) on the date of subcontract award, the subcontractor must include 52.219–8 in lower tier subcontracts that offer subcontracting opportunities.

(vi) 52.222-21, Prohibition of Segregated Facilities (APR 2015).

(vii) 52.222–26, Equal Opportunity (SEP 2016) (E.O. 11246).

(viii) 52.222–35, Equal Opportunity for Veterans (JUN 2020) (38 U.S.C. 4212).

(ix) 52.222–36, Equal Opportunity for Workers with Disabilities (JUN 2020) (29 U.S.C. 793).

(x) 52.222–37, Employment Reports on Veterans (JUN 2020) (38 U.S.C. 4212).

(xi) 52.222-40, Notification of Employee Rights Under the National Labor Relations Act (DEC 2010) (E.O. 13496). Flow down required in accordance with paragraph (f) of FAR clause 52.222-40.

(xii) 52.222-41, Service Contract Labor Standards (AUG 2018) (41 U.S.C. chapter 67).

(xiii)(A) 52.222-50, Combating Trafficking in Persons (NOV 2021) (22 U.S.C. chapter 78 and E.O. 13627).

(B) Alternate I (MAR 2015) of 52.222-50 (22 U.S.C. chapter 78 and E.O. 13627).

(xiv) 52.222-51, Exemption from Application of the Service Contract Labor Standards to Contracts for Maintenance, Calibration, or Repair of Certain Equipment—Requirements (MAY 2014) (41 U.S.C. chapter 67).

(xv) 52.222-53, Exemption from Application of the Service Contract Labor Standards to Contracts for Certain Services—Requirements (MAY 2014) (41 U.S.C. chapter 67).

(xvi) 52.222-54, Employment Eligibility Verification (MAY 2022) (E. O. 12989).

(xvii) 52.222-55, Minimum Wages for Contractor Workers Under Executive Order 14026 (JAN 2022).

(xviii) 52.222-62 Paid Sick Leave Under Executive Order 13706 (JAN 2022) (E.O. 13706).

(xix)(A) 52.224-3, Privacy Training (JAN 2017) (5 U.S.C. 552a).

(B) Alternate I (JAN 2017) of 52.224-3.

(xx) 52.225–26, Contractors Performing Private Security Functions Outside the United States (OCT 2016) (Section 862, as amended, of the National Defense Authorization Act for Fiscal Year 2008; 10 U.S.C. 2302 Note).

(xxi) 52.226–6, Promoting Excess Food Donation to Nonprofit Organizations (JUN 2020) (42 U.S.C. 1792). Flow down required in accordance with paragraph (e) of FAR clause 52.226-6.

(xxii) 52.247-64, Preference for Privately Owned U.S.-Flag Commercial Vessels (NOV 2021) (46 U.S.C. 55305 and 10 U.S.C. 2631). Flow down required in accordance with paragraph (d) of FAR clause 52.247-64.

(2) While not required, the Contractor may include in its subcontracts for commercial products and commercial services a minimal number of additional clauses necessary to satisfy its contractual obligations.

(End of Clause)

Spreadsheet

See attached document: Attach 01 SON GE CardioLab Upgrade.

See attached document: Attach 02A Informational Only Price Cost Schedule.

See attached document: Attach 02B Price Cost Scehdule--.

See attached document: Attach 03 52.225-2 BUY AMERICAN CERTIFICATE.

See attached document: Attach 04…