36C24818Q9221-001.pdf

PDF 117 KB Posted Jun 13, 2018

Attached to: Circuit Breakers Federal contract opportunity
Solicitation number: 36C24818Q9221
Issued by: Department of Veterans Affairs Veterans Health Administration Veterans Integrated Service Network 8

About this file

From the source

36C24818Q9221 Attachment A Salient Characteristics.pdf

View the file

Other files for this federal contract opportunity

Other files attached to Circuit Breakers, newest first.
File	Type	Posted
-14165.docx	DOCX document	Jul 6, 2018
36C24818Q9221-0002000.docx	DOCX document	Jun 29, 2018
36C24818Q9221-0001000.docx	DOCX document	Jun 15, 2018
36C24818Q9221-000.docx	DOCX document	Jun 13, 2018
36C24818Q9221-003.pdf	PDF	Jun 13, 2018
36C24818Q9221-002.pdf	PDF	Jun 13, 2018

On GovTribe

Work with this file on GovTribe

Download the original file
Contacts named in this file
Similar government files
Ask GovTribe AI about this file

Try for free Login

Text version

The file's text, extracted by GovTribe without its formatting.

Attachment A

Salient Characteristics

Lee County VA Healthcare Center Circuit Breakers Replacement

Brand Name or Equal: GE

A. General

The

Department

Veteran

Affairs

seeking

contractors

provide

replacement

and

installation

breakers

identified

this

Salient

Characteristics.

The

location

Lee

County

Healthcare

Center,

2489

Diplomat

Parkway

East,

Cape

Coral,

Florida

33909.

B. Salient Characteristics

1. (7)

‐

SKLC3608L4XX

800

AMP

CIRCUIT

BREAKERS

(Or

Equal).

Direct

replacement

for

SKLB3608D0800.

Bench

tested

and

certified

with

NETA

primary

injection

testing.

2. (2)

‐

SKLC3604L4XX

400

AMP

CIRCUIT

BREAKERS

(Or

Equal).

Direct

replacement

for

SKLB3604D0800.

Bench

tested

and

certified

with

NETA

primary

injection

testing.

3. The	contractor	shall	provide	all	management,	supervision,	labor,	materials,	supplies,	tools
and	equipment,	necessary	to	complete	the	replacement,	and	installation	of	the	nine
breakers	specified	above	at	the	VA	Lee	County	Healthcare	Center.

4. Contractor

shall

provide

installation

all

breakers

directed

the

and

work

must

done

after

clinic

business

hours.

5. Contractor shall provide FLIR thermal imaging of all the newly installed breakers following installation.

6. All material supplied shall be NEW. No used, rebuilt, or refurbished equipment will be accepted.

7. Minimum one‐year warrantee on all items supplied.

CONTRACTOR SECURITY REQUIREMENTS (VA HANDBOOK 6500.6)

1. INFORMATION AND INFORMATION TECHNOLOGY SECURITY REQUIREMENTS

Due

the

threat

data

breach,

compromise

loss

information

that

resides

either

VA‐owned

Contractor‐owned

systems,

and

comply

with

Federal

laws

and

regulations,

has

developed

Information

and

Information

Technology

Security

clause

used

when

sensitive

information

accessed,

used,

stored,

generated,

transmitted,

exchanged

and

between

and

Contractor,

subcontractor

third

party

any

format

(e.g.,

paper,

microfiche,

electronic

magnetic

portable

media).

solicitations

and

contracts

where

Sensitive

Information

Technology

will

accessed

utilized,

the

shall

insert

the

clause

found

852.273‐75,

Security

Requirements

for

Unclassified

Information

Technology

Resources.

2. SECURITY REQUIREMENTS FOR UNCLASSIFIED INFORMATION TECHNOLOGY RESOURCES

The

Contractor,

their

personnel,

and

their

subcontractors

shall

subject

the

Federal

laws,

regulations,

standards,

and

Directives

and

Handbooks

regarding

information

and

information

system

security

delineated

this

contract

1. GENERAL

Contractors,

Contractor

personnel,

subcontractors,

and

subcontractor

personnel

shall

subject

the

same

Federal

laws,

regulations,

standards,

and

Directives

and

Handbooks

and

personnel

regarding

information

and

information

system

security.

2. ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS

Contractor/subcontractor

shall

request

logical

(technical)

physical

access

information

and

information

systems

for

their

employees,

subcontractors,

and

affiliates

only

the

extent

necessary

perform

the

services

specified

the

contract,

agreement,

task

order.

All

contractors,

subcontractors,

and

third‐party

servicers

and

associates

working

with

information

are

subject

the

same

investigative

requirements

those

appointees

employees

who

have

access

the

same

types

information.

The

level

and

process

background

security

investigations

for

contractors

must

accordance

with

Directive

and

Handbook

0710,

Personnel

Suitability

and

Security

Program.

The

Office

for

Operations,

Security,

and

Preparedness

responsible

for

these

policies

and

procedures.

Contract

personnel

who

require

access

national

security

programs

must

have

valid

security

clearance.

National

Industrial

Security

Program

(NISP)

was

established

Executive

Order

12829

ensure

that

cleared

U.S.

defense

industry

contract

personnel

safeguard

the

classified

information

their

possession

while

performing

work

contracts,

programs,

bids,

research

and

development

efforts.

The

Department

Veterans

Affairs

does

not

have

Memorandum

Agreement

with

Defense

Security

Service

(DSS).

Verification

Security

Clearance

must

processed

through

the

Special

Security

Officer

located

the

Planning

and

National

Security

Service

within

the

Office

Operations,

Security,

and

Preparedness.

Custom

software

development

and

outsourced

operations

must

located

the

U.S.

the

maximum

extent

practical.

such

services

are

proposed

performed

abroad

and

are

not

disallowed

other

policy

mandates,

the

Contractor/subcontractor

must

state

where

all

non‐

U.S.

services

are

provided

and

detail

security

plan,

deemed

acceptable

VA,

specifically

address

mitigation

the

resulting

problems

communication,

control,

data

protection,

and

forth.

Location

within

the

U.S.

may

evaluation

factor.

The

Contractor

subcontractor

must

notify

the

Contracting

Officer

immediately

when

employee

working

system

with

access

information

reassigned

leaves

the

Contractor

subcontractor’s

employ.

The

Contracting

Officer

must

also

notified

immediately

the

Contractor

subcontractor

prior

unfriendly

termination.

3. VA INFORMATION CUSTODIAL LANGUAGE

Information

made

available

the

Contractor

subcontractor

for

the

performance

administration

this

contract

information

developed

the

Contractor/subcontractor

performance

administration

the

contract

shall

used

only

for

those

purposes

and

shall

not

used

any

other

way

without

the

prior

written

agreement

the

VA.

This

clause

expressly

limits

the

Contractor/subcontractor's

rights

use

data

described

Rights

Data

‐

General,

FAR

52.227‐14(d)

(1).

information

should

not

co‐mingled,

possible,

with

any

other

data

the

contractors/subcontractor’s

information

systems

media

storage

systems

order

ensure

requirements

data

protection

and

media

sanitization

can

met.

co‐mingling

must

allowed

meet

the

requirements

the

business

need,

the

Contractor

must

ensure

that

VA’s

information

returned

the

destroyed

accordance

with

VA’s

sanitization

requirements.

reserves

the

right

conduct

onsite

inspections

Contractor

and

subcontractor

resources

ensure

data

security

controls,

separation

data

and

job

duties,

and

destruction/media

sanitization

procedures

are

compliance

with

directive

requirements.

Prior

termination

completion

this

contract,

Contractor/subcontractor

must

not

destroy

information

received

from

VA,

gathered/created

the

Contractor

the

course

performing

this

contract

without

prior

written

approval

the

VA.

Any

data

destruction

done

behalf

Contractor/subcontractor

must

done

accordance

with

National

directory

and

silently

install

and

uninstall.

Applications

designed

for

normal

end

users

shall

run

the

standard

user

context

without

elevated

system

administration

privileges.

The

security

controls

must

designed,

developed,

approved

VA,

and

implemented

accordance

with

the

provisions

security

system

development

life

cycle

outlined

NIST

Special

Publication

800‐37,

Guide

for

Applying

the

Risk

Management

Framework

Federal

Information

Systems,

Handbook

6500,

Information

Security

Program

and

Handbook

6500.5,

Incorporating

Security

and

Privacy

System

Development

Lifecycle

(or

subsequent

revisions

thereto).

The

Contractor/subcontractor

required

design,

develop,

operate

System

Records

Notice

(SOR)

individuals

accomplish

agency

function

subject

the

Privacy

Act

1974,

(as

amended),

Public

Law

93‐579,

December

31,

1974

U.S.C.

552a)

and

applicable

agency

regulations.

Violation

the

Privacy

Act

may

involve

the

imposition

criminal

and

civil

penalties.

g. The Contractor/subcontractor agrees to:

(1)

Comply

with

the

Privacy

Act

1974

(the

Act)

and

the

agency

rules

and

regulations

issued

under

the

Act

the

design,

development,

operation

any

system

records

individuals

accomplish

agency

function

when

the

contract

specifically

identifies:

(a) The Systems of Records (SOR); and

(b) The design, development, or operation work that the Contractor/subcontractor is to perform;

(2)

Include

the

Privacy

Act

notification

contained

this

contract

every

solicitation

and

resulting

subcontract

and

every

subcontract

awarded

without

solicitation,

when

the

work

statement

the

proposed

subcontract

requires

the

redesign,

development,

operation

SOR

individuals

that

subject

the

Privacy

Act;

and

(3)

Include

this

Privacy

Act

clause,

including

this

subparagraph

(3),

all

subcontracts

awarded

under

this

contract

which

requires

the

design,

development,

operation

such

SOR.

the

event

violations

the

Act,

civil

action

may

brought

against

the

agency

involved

when

the

violation

concerns

the

design,

development,

operation

SOR

individuals

accomplish

agency

function,

and

criminal

penalties

may

imposed

upon

the

officers

employees

the

agency

when

the

violation

concerns

the

operation

SOR

individuals

accomplish

agency

function.

For

purposes

the

Act,

when

the

contract

for

the

operation

SOR

individuals

accomplish

agency

function,

the

Contractor/subcontractor

considered

employee

the

agency.

(1)

“Operation

System

Records”

means

performance

any

the

activities

associated

with

maintaining

the

SOR,

including

the

collection,

use,

maintenance,

and

dissemination

records.

(2)

“Record”

means

any

item,

collection,

grouping

information

about

individual

that

maintained

agency,

including,

but

not

limited

to,

education,

financial

transactions,

medical

history,

and

criminal

employment

history

and

contains

the

person’s

name,

identifying

number,

symbol,

any

other

identifying

particular

assigned

the

individual,

such

fingerprint

voiceprint,

photograph.

(3)

“System

Records”

means

group

any

records

under

the

control

any

agency

from

which

information

retrieved

the

name

the

individual

some

identifying

number,

symbol,

other

identifying

particular

assigned

the

individual.

The

vendor

shall

ensure

the

security

all

procured

developed

systems

and

technologies,

including

their

subcomponents

(hereinafter

referred

“Systems”),

throughout

the

life

this

contract

and

any

extension,

warranty,

maintenance

periods.

This

includes,

but

not

limited

workarounds,

patches,

hotfixes,

upgrades,

and

any

physical

components

(hereafter

referred

Security

Fixes)

which

may

necessary

fix

all

security

vulnerabilities

published

known

the

vendor

anywhere

the

Systems,

including

Operating

Systems

and

firmware.

The

vendor

shall

ensure

that

Security

Fixes

shall

not

negatively

impact

the

Systems.

The

vendor

shall

notify

within

hours

the

discovery

disclosure

successful

exploits

the

vulnerability

which

can

compromise

the

security

the

Systems

(including

the

confidentiality

integrity

its

data

and

operations,

the

availability

the

system).

Such

issues

shall

remediated

quickly

practical,

but

event

longer

than

days.

When

the

Security

Fixes

involve

installing

third

party

patches

(such

Microsoft

patches

Adobe

Acrobat),

the

vendor

will

provide

written

notice

the

that

the

patch

has

been

validated

not

affecting

the

Systems

within

working

days.

When

the

vendor

responsible

for

operations

maintenance

the

Systems,

they

shall

apply

the

Security

Fixes

within

days.

All

other

vulnerabilities

shall

remediated

specified

this

paragraph

timely

manner

based

risk,

but

within

days

discovery

disclosure.

Exceptions

this

paragraph

(e.g.

for

the

convenience

VA)

shall

only

granted

with

approval

the

contracting

officer

and

the

Assistant

Secretary

for

Office

Information

and

Technology.

5. INFORMATION SYSTEM HOSTING, OPERATION, MAINTENANCE, OR USE

For

information

systems

that

are

hosted,

operated,

maintained,

used

behalf

non‐VA

facilities,

contractors/subcontractors

are

fully

responsible

and

accountable

for

ensuring

compliance

with

all

HIPAA,

Privacy

Act,

FISMA,

NIST,

FIPS,

and

security

and

privacy

directives

and

handbooks.

This

includes

conducting

compliant

risk

assessments,

routine

vulnerability

scanning,

system

patching

and

change

management

procedures,

and

the

completion

acceptable

contingency

plan

for

each

system.

The

Contractor’s

security

control

procedures

must

equivalent,

those

procedures

used

secure

systems.

Privacy

Impact

Assessment

(PIA)

must

also

provided

the

COR

and

approved

Privacy

Service

prior

operational

approval.

All

external

Internet

connections

VA’s

network

involving

information

must

reviewed

and

approved

prior

implementation.

Adequate

security

controls

for

collecting,

processing,

transmitting,

and

storing

Personally

Identifiable

Information

(PII),

determined

the

Privacy

Service,

must

place,

tested,

and

approved

prior

hosting,

operation,

maintenance,

use

the

information

system,

systems

behalf

VA.

These

security

controls

are

assessed

and

stated

within

the

PIA

and

these

controls

are

determined

not

place,

inadequate,

Plan

Action

and

Milestones

(POA&M)

must

submitted

and

approved

prior

the

collection

PII.

c.	Outsourcing	(Contractor	facility,	Contractor	equipment	or	Contractor	staff)	of	systems	or
network	operations,	telecommunications	services,	or	other	managed	services	requires	certification
and	accreditation	(authorization)	(C&A)	of	the	Contractor’s	systems	in	accordance	with	VA

Handbook

6500.3,

Certification

and

Accreditation

and/or

the

OCS

Certification

Program

Office.

Government‐owned

(government

facility

government

equipment)

Contractor‐operated

systems,

third

party

business

partner

networks

require

memorandums

understanding

and

interconnection

agreements

(MOU‐ISA)

which

detail

what

data

types

are

shared,

who

has

access,

and

the

appropriate

level

security

controls

for

all

systems

connected

networks.

The

Contractor/subcontractor’s

system

must

adhere

all

FISMA,

FIPS,

and

NIST

standards

the

annual

FISMA

security

controls

assessment

and

review

and

update

the

PIA.

Any

deficiencies

noted

during

this

assessment

must

provided

the

contracting

officer

and

the

ISO

for

entry

into

VA’s

POA&M

management

process.

The

Contractor/subcontractor

must

use

VA’s

POA&M

process

document

planned

remedial

actions

address

any

deficiencies

information

security

policies,

procedures,

and

practices,

and

the

completion

those

activities.

Security

deficiencies

must

corrected

within

the

timeframes

approved

the

government.

Contractor/subcontractor

procedures

are

subject

periodic,

unannounced

assessments

officials,

including

the

Office

Inspector

General.

The

physical

security

aspects

associated

with

Contractor/subcontractor

activities

must

also

subject

such

assessments.

major

changes

the

system

occur

that

may

affect

the

privacy

security

the

data

the

system,

the

C&A

the

system

may

need

reviewed,

retested

and

re‐authorized

per

Handbook

6500.3.

This

may

require

reviewing

and

updating

all

the

documentation

(PIA,

System

Security

Plan,

Contingency

Plan).

The

Certification

Program

Office

can

provide

guidance

whether

new

C&A

would

necessary.

The

Contractor/subcontractor

must

conduct

annual

self‐assessment

all

systems

and

outsourced

services

required.

Both

hard

copy

and

electronic

copies

the

assessment

must

provided

the

COR.

The

government

reserves

the

right

conduct

such

assessment

using

government

personnel

another

Contractor/subcontractor.

The

Contractor/subcontractor

must

take

appropriate

and

timely

action

(this

can

specified

the

contract)

correct

mitigate

any

weaknesses

discovered

during

such

testing,

generally

additional

cost.

prohibits

the

installation

and

use

personally‐owned

Contractor/subcontractor‐

owned

equipment

software

VA’s

network.

non‐VA

owned

equipment

must

used

fulfill

the

requirements

contract,

must

stated

the

service

agreement,

SOW

contract.

All

the

security

controls

required

for

government

furnished

equipment

(GFE)

must

utilized

approved

other

equipment

(OE)

and

must

funded

the

owner

the

equipment.

All

remote

systems

must

equipped

with,

and

use,

VA‐approved

antivirus

(AV)

software

and

personal

(host‐based

enclave

based)

firewall

that

configured

with

VA‐approved

configuration.

Software

must

kept

current,

including

all

critical

updates

and

patches.

Owners

approved

are

responsible

for

providing

and

maintaining

the

anti‐viral

software

and

the

firewall

the

non‐

owned

OE.

All

electronic

storage

media

used

non‐VA

leased

non‐VA

owned

equipment

that

used

store,

process,

access

information

must

handled

adherence

with

Handbook

6500.1,

Electronic

Media

Sanitization

upon:

(i)

completion

termination

the

contract

(ii)

disposal

return

the

equipment

the

Contractor/subcontractor

any

person

acting

behalf

the

Contractor/subcontractor,

whichever

earlier.

Media

(hard

drives,

optical

disks,

CDs,

back‐up

tapes,

etc.)

used

the

contractors/subcontractors

that

contain

information

must

returned

the

for

sanitization

destruction

the

Contractor/subcontractor

must

self‐certify

that

the

media

has

been

disposed

per

6500.1

requirements.

This

must

completed

within

days

termination

the

contract.

Bio‐Medical

devices

and

other

equipment

systems

containing

media

(hard

drives,

optical

disks,

etc.)

with

sensitive

information

must

not

returned

the

vendor

the

end

lease,

for

trade‐in,

other

purposes.

The

options

are:

a. Vendor must accept the system without the drive;

VA’s

initial

medical

device

purchase

includes

spare

drive

which

must

installed

place

the

original

drive

time

turn‐in;

must

reimburse

the

company

for

media

reasonable

open

market

replacement

cost

time

purchase.

Due

the

highly

specialized

and

sometimes

proprietary

hardware

and

software

associated

with

medical

equipment/systems,

not

possible

for

the

retain

the

hard

drive,

then;

(1)

The

equipment

vendor

must

have

existing

BAA

the

device

being

traded

has

sensitive

information

stored

and

hard

drive(s)

from

the

system

are

being

returned

physically

intact;

and

(2)

Any

fixed

hard

drive

the

device

must

non‐destructively

sanitized

the

greatest

extent

possible

without

negatively

impacting

system

operation.

Selective

clearing

down

patient

data

folder

level

recommended

using

approved

and

validated

overwriting

technologies/methods/tools.

Applicable

media

sanitization

specifications

need

pre‐approved

and

described

the

purchase

order

contract.

(3)

statement

needs

signed

the

Director

(System

Owner)

that

states

that

the

drive

could

not

removed

and

that

(a)

and

(b)

controls

above

are

place

and

completed.

The

ISO

needs

maintain

the

documentation.

6. SECURITY INCIDENT INVESTIGATION

The

term

“security

incident”

means

event

that

has,

could

have,

resulted

unauthorized

access

to,

loss

damage

assets,

sensitive

information,

action

that

breaches

security

procedures.

The

Contractor/subcontractor

shall

immediately

notify

the

COR

and

simultaneously,

the

designated

ISO

and

Privacy

Officer

for

the

contract

any

known

suspected

security/privacy

incidents,

any

unauthorized

disclosure

sensitive

information,

including

that

contained

system(s)

which

the

Contractor/subcontractor

has

access.

the

extent

known

the

Contractor/subcontractor,

the

Contractor/subcontractor’s

notice

shall

identify

the

information

involved,

the

circumstances

surrounding

the

incident

(including

whom,

how,

when,

and

where

the

information

assets

were

placed

risk

compromised),

and

any

other

information

that

the

Contractor/subcontractor

considers

relevant.

With

respect

unsecured

protected

health

information,

the

business

associate

deemed

have

discovered

data

breach

when

the

business

associate

knew

should

have

known

breach

such

information.

Upon

discovery,

the

business

associate

must

notify

the

covered

entity

the

breach.

Notifications

need

made

accordance

with

the

executed

business

associate

agreement.

instances

theft

break‐in

other

criminal

activity,

the

Contractor/subcontractor

must

concurrently

report

the

incident

the

appropriate

law

enforcement

entity

(or

entities)

jurisdiction,

including

the

OIG

and

Security

and

Law

Enforcement.

The

Contractor,

its

employees,

and

its

subcontractors

and

their

employees

shall

cooperate

with

and

any

law

enforcement

authority

responsible

for

the

investigation

and

prosecution

any

possible

criminal

law

violation(s)

associated

with

any

incident.

The

Contractor/subcontractor

shall

cooperate

with

any

civil

litigation

recover

information,

obtain

monetary

other

compensation

from

third

party

for

damages

arising

from

any

incident,

obtain

injunctive

relief

against

any

third

party

arising

from,

to,

the

incident.

7. LIQUIDATED DAMAGES FOR DATA BREACH

Consistent

with

the

requirements

U.S.C.

§5725,

contract

may

require

access

sensitive

personal

information.

so,

the

Contractor

liable

for

liquidated

damages

the

event

data

breach

privacy

incident

involving

any

SPI

the

Contractor/subcontractor

processes

maintains

under

this

contract.

However,

the

policy

forego

collection

liquidated

damages

the

event

the

contractor

provides

payment

actual

damages

amount

determined

adequate

the

agency.

The

Contractor/subcontractor

shall

provide

notice

“security

incident”

set

forth

the

Security

Incident

Investigation

section

above.

Upon

such

notification,

must

secure

from

non‐Department

entity

the

Office

Inspector

General

independent

risk

analysis

the

data

breach

determine

the

level

risk

associated

with

the

data

breach

for

the

potential

misuse

any

sensitive

personal

information

involved

the

data

breach.

The

term

'data

breach'

means

the

loss,

theft,

other

unauthorized

access,

any

access

other

than

that

incidental

the

scope

employment,

data

containing

sensitive

personal

information,

electronic

printed

form,

that

results

the

potential

compromise

the

confidentiality

integrity

the

data.

Contractor

shall

fully

cooperate

with

the

entity

performing

the

risk

analysis.

Failure

cooperate

may

deemed

material

breach

and

grounds

for

contract

termination.

Each

risk

analysis

shall

address

all

relevant

information

concerning

the

data

breach,

including

the

following:

(1) Nature of the event (loss, theft, unauthorized access);

(2) Description of the event, including:

(a) date of occurrence;

(b)

data

elements

involved,

including

any

PII,

such

full

name,

social

security

number,

date

birth,

home

address,

account

number,

disability

code;

(3)

Number

individuals

affected

potentially

affected;

(3) Names of individuals or groups affected or potentially affected;

(4)

Ease

logical

data

access

the

lost,

stolen

improperly

accessed

data

light

the

degree

protection

for

the

data,

e.g.,

unencrypted,

plain

text;

(5) Amount of time the data has been out of VA control;

(6)

The

likelihood

that

the

sensitive

personal

information

will

has

been

compromised

(made

accessible

and

usable

unauthorized

persons);

(7) Known misuses of data containing sensitive personal information, if any;

(8) Assessment of the potential harm to the affected individuals;

(9)

Data

breach

analysis

outlined

6500.2

Handbook,

Management

Security

and

Privacy

Incidents,

appropriate;

and

(10)

Whether

credit

protection

services

may

assist

record

subjects

avoiding

mitigating

the

results

identity

theft

based

the

sensitive

personal

information

that

may

have

been

compromised.

Based

the

determinations

the

independent

risk

analysis,

the

Contractor

shall

responsible

for

paying

the

liquidated

damages

the

amount

$37.50

per

affected

individual

cover

the

cost

providing

credit

protection

services

affected

individuals

consisting

the

following:

(1) Notification;

(2)

One

year

credit

monitoring

services

consisting

automatic

daily

monitoring

least

relevant

credit

bureau

reports;

(3) Data breach analysis;

(4)

Fraud

resolution

services,

including

writing

dispute

letters,

initiating

fraud

alerts

and

credit

freezes,

assist

affected

individuals

bring

matters

resolution;

(5) One year of identity theft insurance with $20,000.00 coverage at $0 deductible; and

(6)

Necessary

legal

expenses

the

subjects

may

incur

repair

falsified

damaged

credit

records,

histories,

financial

affairs.

8. SECURITY CONTROLS COMPLIANCE TESTING

periodic

basis,

VA,

including

the

Office

Inspector

General,

reserves

the

right

evaluate

any

all

the

security

controls

and

privacy

practices

implemented

the

Contractor

under

the

clauses

contained

within

the

contract.

With

working‐days’

notice,

the

request

the

government,

the

Contractor

must

fully

cooperate

and

assist

government‐sponsored

security

controls

assessment

each

location

wherein

information

processed

stored,

information

systems

are

developed,

operated,

maintained,

used

behalf

VA,

including

those

initiated

the

Office

Inspector

General.

The

government

may

conduct

security

control

assessment

shorter

notice

(to

include

unannounced

assessments)

determined

the

event

security

incident

any

other

time.

9. TRAINING

All

Contractor

employees

and

subcontractor

employees

requiring

access

information

and

information

systems

shall

complete

the

following

before

being

granted

access

information

and

its

systems:

(1)

Sign

and

acknowledge

(either

manually

electronically)

understanding

and

responsibilities

for

compliance

with

the

Contractor

Rules

Behavior,

Appendix

relating

access

information

and

information

systems;

(2)

Successfully

complete

the

Cyber

Security

Awareness

and

Rules

Behavior

training

and

annually

complete

required

security

training;

(3)	Successfully	complete	the	appropriate	VA	privacy	training	and	annually	complete	required
privacy	training;	and

(4)

Successfully

complete

any

additional

cyber

security

privacy

training,

required

for

personnel

with

equivalent

information

system

access

[to

defined

the

program

official

and

provided

the

contracting

officer

for

inclusion

the

solicitation

document

–

e.g.,

any

role‐based

information

security

training

required

accordance

with

NIST

Special

Publication

800‐16,

Information

Technology

Security

Training

Requirements.]

The

Contractor

shall

provide

the

contracting

officer

and/or

the

COR

copy

the

training

certificates

and

certification

signing

the

Contractor

Rules

Behavior

for

each

applicable

employee

within

week

the

initiation

the

contract

and

annually

thereafter,

required.

Failure

complete

the

mandatory

annual

training

and

sign

the

Rules

Behavior

annually,

within

the

timeframe

required,

grounds

for

suspension

termination

all

physical

electronic

access

privileges

and

removal

from

work

the

contract

until

such

time

the

training

and

documents

are

complete.

File details come from the government source that posted it.