Amendment -36C24526Q0429 0001.pdf

5. PROJECT NUMBER (if applicable)

CODE 7. ADMINISTERED BY

2. AMENDMENT/MODIFICATION NUMBER

CODE

6. ISSUED BY

8. NAME AND ADDRESS OF CONTRACTOR

4. REQUISITION/PURCHASE REQ. NUMBER 3. EFFECTIVE DATE

9A. AMENDMENT OF SOLICITATION NUMBER

9B. DATED

PAGE OF PAGES

10A. MODIFICATION OF CONTRACT/ORDER NUMBER

10B. DATED

BPA NO. 1. CONTRACT ID CODE

FACILITY CODE CODE

Offers must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended, by one of the following methods:

The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offers

E. IMPORTANT:

is extended,

(a) By completing Items 8 and 15, and returning __________ copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted; or (c) By separate letter or electronic communication which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR

ACKNOWLEDGMENT TO BE RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY is not extended.

12. ACCOUNTING AND APPROPRIATION DATA

(REV. 11/2016)

is required to sign this document and return ___________ copies to the issuing office. is not, A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE CONTRACT ORDER NO. IN ITEM 10A.

15C. DATE SIGNED

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES

SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(b).

RESULT IN REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by letter or electronic communication, provided each letter or electronic communication makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER

Contractor

16C. DATE SIGNED

14. DESCRIPTION OF AMENDMENT/MODIFICATION

16B. UNITED STATES OF AMERICA

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15A. NAME AND TITLE OF SIGNER 16A. NAME AND TITLE OF CONTRACTING OFFICER

15B. CONTRACTOR/OFFEROR

STANDARD FORM 30 PREVIOUS EDITION NOT USABLE

Prescribed by GSA - FAR (48 CFR) 53.243

(Type or print) (Type or print)

(Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

(Number, street, county, State and ZIP Code)

(If other than Item 6)

(Specify type of modification and authority)

(such as changes in paying office, appropriation date, etc.)

(If required)

(SEE ITEM 11)

(SEE ITEM 13)

(X)

CHECK

ONE

13. THIS ITEM APPLIES ONLY TO MODIFICATIONS OF CONTRACTS/ORDERS,

IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

(Signature of person authorized to sign) (Signature of Contracting Officer)

1 13

19ACQ

Department of Veterans Affairs

Perry Point VA Medical Center (NCO 5)

361 Boiler House Rd, Building 101C

Perry Point, MD 21902

19ACQ

Department of Veterans Affairs

Perry Point VA Medical Center (NCO 5)

361 Boiler House Rd, Building 101C

Perry Point, MD 21902

To all Offerors/Bidders

36C24526Q0429

X

X X

See CONTINUATION Page

X 1

RE: The purpose of this modification is to:

1. Update the Statement of Work

2. Update Line Items(s) Quantity and Unit

All other terms and conditions remain the same.

Jameel Gordon

Contracting Officer

CONTINUATION PAGE

A.1 PRICE/COST SCHEDULE

ITEM INFORMATION

ITEM

NUMBER

DESCRIPTION OF

SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

90.00 HR __________________ __________________

The collection of structural and functional MRI data during experiments relating to substance use disorders and chronic pain in accordance with the statement of work.

Contract Period: Base POP Begin: 05-04-2026 POP End: 05-03-2027 PRINCIPAL NAICS CODE: 541720 - Research and Development in the Social Sciences and Humanities PRODUCT/SERVICE CODE: R702 - Support - Management: Data Collection

85.00 HR __________________ __________________

experiments relating to substance use disorders and chronic pain in accordance with the statement of work.

Contract Period: Option 1 POP Begin: 05-04-2027 POP End: 05-03-2028 PRINCIPAL NAICS CODE: 541720 - Research and Development in the Social Sciences and Humanities

75.00 HR __________________ __________________

experiments relating to substance use disorders and chronic pain in accordance with the statement of work.

Contract Period: Option 2 POP Begin: 05-04-2028 POP End: 05-03-2029 PRINCIPAL NAICS CODE: 541720 - Research and Development in the Social Sciences and Humanities

GRAND TOTAL __________________

STATEMENT OF WORK

Data Collection of Magnetic Resonance Imaging (MRI) for Neuromodulation Research

A. General Information

1. Statement of Need and Purpose

The laboratory for Therapeutic Neuromodulation at the Washington DC VA Medical Center

(DCVAMC) requires collection of structural and functional MRI data during experiments relating to substance use disorders and chronic pain.

2. Studies and Funding

This contract supports two funded research studies:

1. Low Intensity Focused Ultrasound for Chronic Pain: High Resolution Targeting of

The Human Insula o Grant: VA Clinical Science R&D – Project #: I01CX002562-01A2

2. Low Intensity Focused Ultrasound for Tobacco Use Disorder: High Resolution

Targeting of the Human Insula o Grant: VA Clinical Science R&D – Project #: I01CX002427-01A1

3. Period of Performance

The period of performance for this contract is one base year plus two (2) 12-Month option periods

4. Place of Performance

Work associated with this contract shall take place at the contractor’s office. The MRI scans will be performed at the DC VAMC and/or at the Center for Molecular and Functional

Imaging (CFMI) at Georgetown University. The scans (de-identified) will be transferred to the Contractor via VA-approved encrypted flash drive.

B. Scope of Work

1. General Requirements

The contractor shall furnish all the necessary services, qualified personnel, material, equipment, and facilities as needed to perform the Statement of Work below.

The Contractor shall:

a. Provide expertise in structural and functional MRI methods in research.

b. Provide expertise in psychological and behavioral experiments in neuroscience research.

2. Level of Effort

During the period of performance of one year from the data of award in addition to 3 one-year options

3. Specific Mandatory Tasks and Associated Deliverables

Task 1 MRI scans

The contractor shall conduct functional and structural MRI scans in accordance with the described and approved research protocol for the study

Deliverable: data for functional MRI scan on participants in accordance with the research protocol.

C. INSPECTION AND ACCEPTANCE CRITERIA

The COR and/or VA Primary Investigator will review all work performed by the Contractor data analysts including their reports and deliverables and determine acceptability by evaluating for accuracy and clear presentation.

TASK DELIVERABLE METHOD(S) OF SURVEILLANCE

1: MRI Scan 1: MRI data securely transferred to VA Primary Investigator or delegate

COR and /or VA Primary Investigator will review the report and provide feedback to the Contractor

D. Other Considerations

1. Key Personnel

The Contractor is the key personnel identified for this requirement.

Key personnel requirements shall be:

- Ph.D. with expertise in neuroimaging research;

- Minimum of one (1) year experience in all the following:

o Structural and functional MRI methods in neuroscience research o Psychological and/or behavioral experiments in neuroscience research

- Demonstrated experience working with biomedical staff;

- Currently working within a University

2. Information Security Plan

Structural and functional MR images will be produced and securely transferred back to the

VA in accordance with the studies’ data use agreement(s).

3. Publications and Publicity

The contractor shall contribute to data gathering and will be acknowledged in all scientific publications relating to the studies mentioned in this SOW.

4. Confidentiality of Information

Confidentiality of information is required. The government will not provide the contractor any information or data of a personal nature about individual(s) or proprietary information or data pertaining to an institution or organization which is confidential. Whenever the contractor is uncertain regarding the confidentiality of or a property interest in information under this contract, the contractor should consult with the Contracting Officer prior to any release, disclosure, dissemination, or public

F. CHANGES TO STATEMENT OF WORK

Any changes to this SOW shall be authorized and approved only through written correspondence from the Contracting Officer. Costs incurred by the contractor through the actions of parties other than the Contracting Officer shall be borne by the contractor.

G. CONTRACTOR PERSONNEL

The contractor shall be responsible for recruiting, selecting, hiring, and supervising all contractor personnel. The contractor's management responsibilities shall include all activities necessary to ensure the accomplishment of timely and effective support, performed in accordance with the requirements contained in the SOW. The director of ERIC has obtained UW Institutional Review

Board (IRB) approval for the activities of the contractor data analysts.

H. SECURITY

Data and Information System Security

The contractor will require access to Department of Veterans Affairs computer systems. The contractor will receive only coded limited datasets, including unique study identifier and dates of testing, diagnoses, etc., utilizing VA-compliant procedures. The contractor will ensure the highest degree of security to protect personal and confidential data of participants from intentional or unintentional release, loss, or destruction. The contractor and contractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and

Handbooks as VA and VA personnel regarding information and information system security.

Data will be transferred, retained, utilized, and destroyed in accordance with VA and VHA policy including the following: (1) VA Directive and Handbook 6500, Information Security Program; (2)

VA Directive and Handbook 6502, Privacy Program; and (3) VHA Directive 1605, VHA

Handbook 1605.1 and 1605.2. Every effort must be made to avoid inadvertent breaches of confidentiality.

Security Training

All contractor personnel under this contract are required to complete training annually as specified in Appendix B. Contractors must provide signed certifications of completion to the

Contracting Officer during each year of the contract. This requirement is in addition to any other training that may be required of the contractor.

Sensitivity, Risk, and Level of Investigation

There are no national security position requirements, duties, or responsibilities.

The public trust position requirements, duties, or responsibilities include protection of personal, private, controlled unclassified, or proprietary information-with the potential to damage the public’s trust (includes access to or processing of personal information such as that protected by the Privacy Act (PA) of 1974, exempt from disclosure under the Freedom of Information Act

(FOIA), financial data, or privileged information involving the award of contracts, contractor proprietary information, etc.).

The potential impact of the position on the efficiency or integrity of the service is characterized as moderate: Access and control over personal, private, proprietary, or controlled unclassified information, the unauthorized disclosure of which could negatively impact the public’s trust, through serious damage/harm to: the integrity or efficiency of the service; individuals or business entities; and government programs or operations impacting the public’s trust.

Program operations affect only one agency. Misconduct or damage would have potential for a local impact on the agency, and/or the individuals or private entities affected by the agency.

The position requires close technical supervision, the ability to act independently infrequently, and continuing review of all work by a technical expert.

See Attachment B: Additional Security Language

I. SECTION 508

The contractor shall comply with Section 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended by the Workforce Investment Act of 1998 (P.L. 105-220), August 7, 1998.

In December 2000, the Architectural and Transportation Barriers Compliance Board (Access

Board), pursuant to Section 508(2) (A) of the Rehabilitation Act Amendments of 1998, established Information Technology accessibility standards for the Federal Government. Section

508(a)(1) requires that when Federal departments or agencies develop, procure, maintain, or use Electronic and Information Technology (EIT), they shall ensure that the EIT allows Federal employees with disabilities to have access to and use of information and data that is comparable to the access to and use of information and data by other Federal employees. The

Section 508 requirement also applies to members of the public seeking information or services from a Federal department or agency.

Section 508 text is available at:

http://www.opm.gov/HTML/508-textOfLaw.htm http://www.section508.gov/index.cfm?FuseAction=Content&ID=14

J. CONFIDENTIALITY AND NONDISCLOSURE

1. The preliminary and final deliverables and all associated working papers and other materials deemed relevant by the VA which have been generated by the contractor in the performance of this contract are the exclusive property of the U.S. Government and shall be submitted to the Contracting Officer at the conclusion of the contract.

2. The Contracting Officer will be the sole authorized official to release verbally or in writing any data, the draft deliverables, the final deliverables, or any other written or printed materials pertaining to this contract. No information shall be released by the contractor.

Any request for information relating to this contract presented to the contractor shall be submitted in writing to the Contracting Officer for response.

http://www.opm.gov/HTML/508-textOfLaw.htm http://www.section508.gov/index.cfm?FuseAction=Content&ID=14

3. Press releases, marketing material, or any other printed or electronic documentation related to this project shall not be publicized without the written approval of the Contracting Officer.

4. The service, function, or activity is characterized as research as defined in the Common Rule or as in Title 38 Code of Federal Regulations (CFR) 16.102(g), or VHA Handbook 1200.05; or the PHI is being disclosed to a researcher. Therefore it is not required for the contractor to sign a National Business Associate Agreement with the VA.

K. RIGHTS IN DATA

1. Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the contractor/subcontractor's rights to use data as described in Rights in Data- General, FAR 52.227-14(d) (1).

2. VA information should not be co-mingled, if possible, with any other data on the contractors/subcontractor’s information systems or media storage systems in order to ensure VA requirements related to data protection and media sanitization can be met. If co-mingling must be allowed to meet the requirements of the business need, the contractor must ensure that VA’s information is returned to the VA or destroyed in accordance with VA’s sanitization requirements. VA reserves the right to conduct on-site inspections of contractor and subcontractor IT resources to ensure data security controls, separation of data and job duties, and destruction/media sanitization procedures are in compliance with VA directive requirements.

3. Prior to termination or completion of this contract, contractor/subcontractor must not destroy information received from VA, or gathered/created by the contractor in the course of performing this contract without prior written approval by the VA. Any data destruction done on behalf of VA by a contractor/subcontractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook

6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self-certification by the contractor that the data destruction requirements above have been met must be sent to the VA Contracting Officer within 30 days of termination of the contract.

4. The contractor/subcontractor must receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with the terms of the contract and applicable Federal and VA information confidentiality and security laws, regulations and policies. If Federal or VA information confidentiality and security laws, regulations and policies become applicable to the VA information or information systems after execution of the contract, or if NIST issues or updates applicable FIPS or Special Publications (SP) after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations and policies in this contract.

5. The contractor/subcontractor shall not make copies of VA information except as authorized and necessary to perform the terms of the agreement or to preserve electronic information stored on contractor/subcontractor electronic storage media for restoration in case any electronic equipment or data used by the contractor/subcontractor needs to be restored to an operating state. If copies are made for restoration purposes, after the restoration is complete, the copies must be appropriately destroyed.

L. RECORDS MANAGEMENT

The following standard items relate to records generated in executing the contract and should be included in a typical Electronic Information Systems (EIS) procurement contract:

1. Citations to pertinent laws, codes and regulations such as 44 U.S.C chapters 21, 29, 31 and 33; Freedom of Information Act (5 U.S.C. 552); Privacy Act (5 U.S.C. 552a); 36 CFR Part 1222 and Part 1228.

2. Contractor shall treat all deliverables under the contract as the property of the U.S.

Government for which the Government Agency shall have unlimited rights to use, dispose of, or disclose such data contained therein as it determines to be in the public interest.

3. Contractor shall not create or maintain any records that are not specifically tied to or authorized by the contract using Government IT equipment and/or Government records.

4. Contractor shall not retain, use, sell, or disseminate copies of any deliverable that contains information covered by the Privacy Act of 1974 or that which is generally protected by the Freedom of Information Act.

5. Contractor shall not create or maintain any records containing any Government Agency records that are not specifically tied to or authorized by the contract.

6. The Government Agency owns the rights to all data/records produced as part of this contract.

7. The Government Agency owns the rights to all electronic information (electronic data, electronic information systems, electronic databases, etc.) and all supporting documentation created as part of this contract. Contractor must deliver sufficient technical documentation with all data deliverables to permit the agency to use the data.

8. Contractor agrees to comply with Federal and Agency records management policies, including those policies associated with the safeguarding of records covered by the Privacy Act of 1974. These policies include the preservation of all records created or received regardless of format [paper, electronic, etc.] or mode of transmission [e-mail, fax, etc.] or state of completion [draft, final, etc.].

9. No disposition of documents will be allowed without the prior written consent of the Contracting Officer. The Agency and its contractors are responsible for preventing the alienation or unauthorized destruction of records, including all forms of mutilation. Willful and unlawful destruction, damage or alienation of Federal records is subject to the fines and penalties imposed by 18 U.S.C. 2701. Records may not be removed from the legal custody of the Agency or destroyed without regard to the provisions of the agency records schedules.

10. Contractor is required to obtain the Contracting Officer's approval prior to engaging in any contractual relationship (sub-contractor) in support of this contract requiring the disclosure of information, documentary material and/or records generated under, or relating to, this contract. The Contractor (and any sub-contractor) is required to abide by Government and Agency guidance for protecting sensitive and proprietary information.

Additional Security Language

1. GENERAL. Contractors, contractor personnel, subcontractors and subcontractor personnel will be subject to the same federal laws, regulations, standards, VA directives and handbooks, as VA personnel regarding information and information system security and privacy.

2. VA INFORMATION CUSTODIAL LANGUAGE.

a. The Government shall receive unlimited rights to data/intellectual property first produced and delivered in the performance of this contract or order (hereinafter “contract”) unless expressly stated otherwise in this contract. This includes all rights to source code and all documentation created in support thereof. The primary clause used to define Government and Contractor data rights is FAR 52.227-14 Rights in Data – General. The primary clause used to define computer software license (not data/intellectual property first produced under this contractor or order) is FAR 52.227-19, Commercial Computer Software License.

b. Information made available to the contractor by VA for the performance or administration of this contract will be used only for the purposes specified in the service agreement, SOW, PWS, PD, and/or contract. The contractor shall not use VA information in any other manner without prior written approval from a VA Contracting Officer (CO). The primary clause used to define Government and Contractor data rights is FAR 52.227-14 Rights in Data – General.

c. VA information will not be co-mingled with any other data on the contractor’s information systems or media storage systems. The contractor shall ensure compliance with Federal and VA requirements related to data protection, data encryption, physical data segregation, logical data segregation, classification requirements and media sanitization.

d. VA reserves the right to conduct scheduled or unscheduled audits, assessments, or investigations of contractor Information Technology (IT) resources to ensure information security is compliant with Federal and VA requirements. The contractor shall provide all necessary access to records (including electronic and documentary materials related to the contracts and subcontracts) and support (including access to contractor and subcontractor staff associated with the contract) to VA, VA's Office Inspector General (OIG), and/or Government Accountability Office (GAO) staff during periodic control assessments, audits, or investigations.

e. The contractor may only use VA information within the terms of the contract and applicable Federal law, regulations, and VA policies. If new Federal information security laws, regulations or VA policies become applicable after execution of the contract, the parties agree to negotiate contract modification and adjustment necessary to implement the new laws, regulations, and/or policies.

f. The contractor shall not make copies of VA information except as specifically authorized and necessary to perform the terms of the contract. If copies are made for restoration purposes, after the restoration is complete, the copies shall be destroyed in accordance with VA Directive 6500, VA Cybersecurity Program and VA Information Security Knowledge Service.

g. If a Veterans Health Administration (VHA) contract is terminated for default or cause with a business associate, the related local Business Associate Agreement (BAA) shall also be terminated and actions taken in accordance with VHA Directive 1605.05, Business Associate Agreements. If there is an executed national BAA associated with the contract, VA will determine what actions are appropriate and notify the contactor.

h. The contractor shall store and transmit VA sensitive information in an encrypted form, using VA-approved encryption tools which are, at a minimum, Federal Information Processing Standards (FIPS) 140-2, Security Requirements for Cryptographic Modules (or its successor) validated and in conformance with VA Information Security Knowledge Service requirements. The contractor shall transmit VA sensitive information using VA approved Transport Layer Security (TLS) configured with FIPS based cipher suites in conformance with National Institute of Standards and Technology (NIST) 800-52, Guidelines for the Selection, Configuration and Use of Transport Layer Security (TLS) Implementations.

i. The contractor’s firewall and web services security controls, as applicable, shall meet or exceed VA’s minimum requirements.

j. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor may use and disclose VA information only in two situations: (i) in response to a qualifying order of a court of competent jurisdiction after notification to VA CO (ii) with written approval from the VA CO. The contractor shall refer all requests for, demands for production of or inquiries about, VA information and information systems to the VA CO for response.

k. Notwithstanding the provision above, the contractor shall not release VA records protected by Title 38 U.S.C. § 5705, Confidentiality of medical quality- assurance records and/or Title 38 U.S.C. § 7332, Confidentiality of certain medical records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse or infection with Human Immunodeficiency Virus (HIV). If the contractor is in receipt of a court order or other requests for the above- mentioned information, the contractor shall immediately refer such court order or other requests to the VA CO for response.

l. Information made available to the contractor by VA for the performance or administration of this contract or information developed by the contractor in performance or administration of the contract will be protected and secured in accordance with VA Directive 6500 and Identity and Access Management (IAM) Security processes specified in the VA Information Security Knowledge Service.

m. Any data destruction done on behalf of VA by a contractor shall be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management, VA Handbook 6300.1, Records Management Procedures, and applicable VA Records Control Schedules.

n. The contractor shall provide its plan for destruction of all VA data in its possession according to VA Directive 6500 and NIST 800-88, Guidelines for Media Sanitization prior to termination or completion of this contract. If directed by the COR/CO, the contractor shall return all Federal Records to VA for disposition.

o. Any media, such as paper, magnetic tape, magnetic disks, solid state devices or optical discs that is used to store, process, or access VA information that cannot be destroyed shall be returned to VA.The contractor shall hold the appropriate material until otherwise directed by the Contracting Officer’s Representative (COR) or CO.

Items shall be returned securely via VA-approved methods. VA sensitive information must be transmitted utilizing VA-approved encryption tools which are validated under FIPS 140-2 (or its successor) and NIST 800-52. If mailed, the contractor shall send via a trackable method (USPS, UPS, FedEx, etc.) and immediately provide the COR/CO with the tracking information. Self-certification by the contractor that the data destruction requirements above have been met shall be sent to the COR/CO within 30 business days of termination of the contract.

p. All electronic storage media (hard drives, optical disks, CDs, back-up tapes, etc.)

used to store, process or access VA information will not be returned to the contractor at the end of lease, loan, or trade-in. Exceptions to this paragraph will only be granted with the written approval of the VA CO.

3. ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS.

a. A contractor/subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees and subcontractors only to the extent necessary to perform the services specified in the solicitation or contract. This includes indirect entities, both affiliate of contractor/subcontractor and agent of contractor/subcontractor.

b. Contractors and subcontractors shall sign the VA Information Security Rule of Behavior (ROB) before access is provided to VA information and information systems (see Section 4, Training, below). The ROB contains the minimum user compliance requirements and does not supersede any policies of VA facilities or other agency components which provide higher levels of protection to VA’s information or information systems. Users who require privileged access shall complete the VA elevated privilege access request processes before privileged access is granted.

c. All contractors and subcontractors working with VA information are subject to the same security investigative and clearance requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors shall be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office of Human Resources and Administration/Operations, Security and Preparedness (HRA/OSP) is responsible for these policies and procedures. Contract personnel who require access to classified information or information systems shall have an appropriate security clearance. Verification of a Security Clearance shall be processed through the Special Security Officer located in HRA/OSP. Contractors shall conform to all requirements stated in the National Industrial Security Program Operating Manual (NISPOM).

d. All contractors and subcontractors shall comply with conditions specified in VAAR 852.204-71(d); Contractor operations required to be in United States. All contractors and subcontractors working with VA information must be permanently located within a jurisdiction subject to the law of the United States or its Territories to the maximum extent feasible. If services are proposed to be performed abroad the contractor must state where all non-U.S. services are provided. The contractor shall deliver to VA a detailed plan specifically addressing communications, personnel control, data protection and potential legal issues. The plan shall be approved by the COR/CO in writing prior to access being granted.

e. The contractor shall notify the COR/CO in writing immediately (no later than 24 hours) after personnel separation or occurrence of other causes. Causes may include the following:

(1) Contractor/subcontractor personnel no longer has a need for access to VA information or VA information systems.

(2) Contractor/subcontractor personnel are terminated, suspended, or otherwise has their work on a VA project discontinued for any reason.

(3) Contractor believes their own personnel or subcontractor personnel may pose a threat to their company’s working environment or to any company- owned property. This includes contractor-owned assets, buildings, confidential data, customers, employees, networks, systems, trade secrets and/or VA data.

(4) Any previously undisclosed changes to contractor/subcontractor background history are brought to light, including but not limited to changes to background investigation or employee record.

(5) Contractor/subcontractor personnel have their authorization to work in the United States revoked.

(6) Agreement by which contractor provides products and services to VA has either been fulfilled or terminated, such that VA can cut off electronic and/or physical access for contractor personnel.

f. In such cases of contract fulfillment, termination, or other causes; the contractor shall take the necessary measures to immediately revoke access to VA network, property, information, and information systems (logical and physical) by contractor/subcontractor personnel. These measures include (but are not limited to):

removing and then securing Personal Identity Verification (PIV) badges and PIV – Interoperable (PIV-I) access badges, VA-issued photo badges, credentials for VA facilities and devices, VA-issued laptops, and authentication tokens. Contractors shall notify the appropriate VA COR/CO immediately to initiate access removal.

g. Contractors/subcontractors who no longer require VA accesses will return VA-issued property to VA. This property includes (but is not limited to): documents, electronic equipment, keys, and parking passes. PIV and PIV-I access badges shall be returned to the nearest VA PIV Badge Issuance Office. Once they have had access to VA information, information systems, networks and VA property in their possessions removed, contractors shall notify the appropriate VA COR/CO.