36C25025Q0269.docx

SUBJECT*

SCRAP Metal Recycling Cincinnati VA Medical Center

GENERAL INFORMATION

CONTRACTING OFFICE ADDRESS

Department of Veterans Affairs Network Contracting Office (NCO 10) 3140 Governor’s Place Blvd. Suite 210 Kettering OH 45409-1337

POINT OF CONTACT*

Contracting Officer Josh Kovar Joshua.Kovar@VA.gov

All questions shall be emailed to POC above

PLACE OF PERFORMANCE

Cincinnati VA Medical Center

Facilities Management Services

3200 Vine Street

Cincinnati OH

ADDITIONAL INFORMATION

AGENCY’S URL

URL DESCRIPTION

AGENCY CONTACT’S EMAIL ADDRESS

EMAIL DESCRIPTION

DESCRIPTION

This is a combined synopsis/solicitation for commercial products and commercial services prepared in accordance with the format in Federal Acquisition Regulation (FAR) subpart 12.6, “Streamlined Procedures for Evaluation and Solicitation for Commercial Products and Commercial Services,” as supplemented with additional information included in this notice. This announcement constitutes the only solicitation; quotes are being requested, and a written solicitation document will not be issued.

This solicitation is issued as an RFQ. The solicitation document and incorporated provisions and clauses are those in effect through Federal Acquisition Circular 2024-08.

This solicitation is set-aside for SMALL BUSINESSES (SBA)

Offerors are to submit all items located in the Quote Preparation Instructions / Instructions to offerors.

The associated North American Industrial Classification System (NAICS) code for this procurement is 562119 – Other Waste Collection, with a small business size standard of $ 47.0 Million Dollars. The FSC/PSC is P100 – Salvage- Preparation and Disposal Of Excess/surplus Property.

The Network Contracting Office (NCO-10) is seeking to purchase Recycling Services.

All interested companies shall provide quotations for the following:

Combined Synopsis/Solicitation Notice Combined Synopsis/Solicitation Notice

Combined Synopsis/Solicitation Notice

ITEM INFORMATION

The guaranteed minimum only applies to the Federal Government Fiscal Year in which the contract is awarded. The guaranteed minimum of this contract is $4,000.00. The guaranteed amount shall be expended in the initial fiscal year in which this contract is awarded. The maximum total value of the contract, inclusive of the base year and all options exercised, shall not exceed $32,000.00.

Individual task orders shall be funded annually. The Contracting Officer is the only authorized individual that can place annual task orders against this contract for the estimated amount of services for the specific timeframe, and the task orders shall be issued to the contractor. Offerors shall offer pricing for the entire estimated quantity for each CLIN.

Task order minimums and maximums are addressed in clause 52.216-19.

Some items listed below are estimated quantities: CLINS: 0002, 1002, 2002, 3002, 4002.

Vendor shall invoice monthly in arrears, for ONLY actual services rendered. DO NOT perform other than those identified, unless the ACO has issued a modification to the contract to add a CLIN for that specific action. Contractor shall invoice for actual performance and shall indicate CLINs/SLINS on all Tungsten Network invoices.

AMOUNT

Dumpster Rental Services

(1) 30 Yard Dumpster for SCRAP Metal Recycling Contract Period: Base POP Begin: 02-17-2025 POP End: 02-16-2026 PRINCIPAL NAICS CODE: 562119 - Other Waste Collection PRODUCT/SERVICE CODE: P100 - Salvage - Preparation and Disposal of Excess/Surplus Property

Recycling Hauls per Year Estimated Quantity (6) Hauls Not to Exceed, Bill for Actual Usage Contract Period: Base POP Begin: 02-17-2025 POP End: 02-16-2026

Dumpster Rental Services

Contract Period: Option 1 POP Begin: 02-17-2026 POP End: 02-16-2027

Recycling Hauls per Year

Not to Exceed, Bill for Actual Usage Contract Period: Option 1 POP Begin: 02-17-2026 POP End: 02-16-2027

Dumpster Rental Services

Contract Period: Option 2 POP Begin: 02-17-2027 POP End: 02-16-2028

Recycling Hauls per Year

Not to Exceed, Bill for Actual Usage Contract Period: Option 2 POP Begin: 02-17-2027 POP End: 02-16-2028

Dumpster Rental Services

Contract Period: Option 3 POP Begin: 02-17-2028 POP End: 02-16-2029

Recycling Hauls per Year

Not to Exceed, Bill for Actual Usage Contract Period: Option 3 POP Begin: 02-17-2028 POP End: 02-16-2029

Dumpster Rental Services

Contract Period: Option 4 POP Begin: 02-17-2029 POP End: 02-16-2030

Recycling Hauls per Year

Not to Exceed, Bill for Actual Usage Contract Period: Option 4 POP Begin: 02-17-2029 POP End: 02-16-2030

A.1 PERFORMANCE WORK STATEMENT

Recycling Services – Cincinnati VA Medical Center Updated: 12/30/2024

I. BACKGROUND

The Cincinnati VAMC– Cincinnati Ohio, located at 3200 Vine Street 45220 (539) generates thousands of pounds of scrap materials and equipment on a weekly basis that need to be removed from property and disposed appropriately via authorized scrap contractors. Scrap for this individual container will be in the form of pieces of metal, or unserviceable equipment (refrigerators, compressors, A/C coil, etc.) that can be rendered as scrap for recycle that cannot be disposed in a dunnage bin. Due to limited space and unknown deadlines to remove unnecessary scrap materials it is necessary to maintain a scrap service that will remove scrap items from the facility. The Cincinnati VAMC– requires a vendor to provide the monthly rental, pickup, sorting and disposal for one (1) 30 yard open top roll-off dumpster for Scrap metals.

Any freight fees are for zero sort disposal of the container including placement, and removal as needed. There shall be no additional fees or surcharges sent to the government. All CLINS in the schedule shall be priced as an all-inclusive service.

II. STATEMENT OF WORK

This procurement entails the monthly rental of one (1) 30-yard open-top roll-off dumpster for Scrap metals. Vendor shall provide per day rental fees for the container and an all-inclusive fee for zero sort disposal of the container including placement, and removal as needed.

It is estimated that there will be approximately 6 hauls per year, minimum of one haul per calendar quarter (3 months), at the request of the Cincinnati VAMC. Total estimated quantity shall not exceed 6 pulls per year unless the quantity is increased through a contract modification.

***NOTE: The Government reserves the right to add or remove any additional locations, Community Based Outreach Clinics (CBOCs) or other facilities to the contract as they become available. Furthermore, the Government reserves the right to add, increase, or decrease the quantities of containers, frequencies of collections, or quantities to allow for fluctuations of client demand that are otherwise unknown at time of solicitation. The total contract value may increase up to 20% of the base award.

The facility is to receive a rebate for the weighted contents via an authorized Metal Recycling Company.

The Site POC will provide forty-eight (48) hours’ notice when hauls need to be made. The 30-yard dumpster that is picked up shall be swapped for an empty dumpster within 24 hours in order to ensure no lapse in service. Pick-ups will occur on dumpster/container Monday – Friday during normal business hours 8:00am – 4:00 pm, excluding Federal Holidays.

2024 Federal Holidays shall be defined as:

New Year’s Day – January 1st Martin Luther King’s Birthday – January 15th Washington’s Birthday – February 19th Memorial Day – May 27th Juneteenth – June 19th Independence Day – July 4th Labor Day – September 2nd Columbus Day – October 14th Veterans Day – November 11th Thanksgiving Day – November 28th Christmas Day – December 25th

III. SPECIFIC TASKS

Task 1 - Enterprise Management Controls.

Subtask 1 - The contractor will be called by Logistics Service authorized personnel notifying the contractor of pick-up service needed. They will provide a description and location of the pick-up. The contractor will respond within a 48-hour period (excluding weekends and Federal holidays). Includes a minimum container size of 30 yards and an estimated minimum of 6 hauls a year with the flexibility to increase container size and frequency to increase the estimated number of calls per year, in addition to warehouse and CBOC locations as needed.

Subtask 2 - The contractor shall pick up the materials and provide the Site POC a receipt. The contractor will be provided release document(s) and inspected by site personnel before leaving the premises.

Subtask 3 - The contractor shall provide all personnel, equipment, tools, materials, vehicles, supervision, and other items and services necessary to perform these tasks.

IV. DELIVERABLES

Task 1 - Recycle Proceeds Subtask 1 - The contractor shall provide recycle proceeds of any items that were scrapped, and any monies received shall be delivered to the Agent Cashier at Cincinnati VA Medical Center (539). All proceed checks must be received by the Agent Cashier within 14 days of removing recycled items.

Subtask 2 - Copies of recycle proceeds document(s) will be provided to Logistics Service 90 (W) within 14 business days of removing recyclable items that were disposed at local recycle centers.

TASK 2 – Reporting Requirements Subtask 1 - Contractor shall maintain a log of all shipments. The log shall identify the date, time and quantities, and type of waste shipped.

Subtask 2 – The vendor shall provide a monthly report to the facility POC within 5 calendar days of end of previous month for any hauls and shall identify the following information.

3. Weight of container at the time of pickup

4. Applicable date of proceeds

5. Materials collected

6. Final disposal site(s)

V. GENERAL REQUIREMENTS

1. 30-Yard Open Top Roll-Off Dumpster for Scrap metals:

· Monthly rental and placement (replacement)at the designated site.

· Monthly Facility called in pickups for disposal of scrap metals.

· Coordination with the dumpster rental provider for timely deliveries and pickups.

· Adherence to local regulations and guidelines for metal disposal. Collection and transport of metal materials to a designated metal recycling company.

· Documentation of recycled materials such as weight of each haul for rebate verification purposes. Collaboration with metal recycling company to ensure efficient disposal and maximize rebates.

· Rebate shall be made at the current market value.

· If rebate comes directly from a metal recycling company, please ensure that is annotated on the contract who is returning the rebate to the facility.

· Located at the East Shields Street, behind Central Receiving (Warehouse) left empty bay (adjacent to the emergency oxygen, leaving room for access).

VI. SECURITY

The C & A requirements do not apply, a security accreditation package is not required.

VII. RISK CONTROL

The contractor will have their own supervisor authorized to communicate with facility warehouse personnel. Contractor shall have no contact with patients. The contractor will assume all safety precautions prior to removing items from premises and will supply their own personnel protective materials.

The contractor shall provide all training necessary to perform the work as defined in this contract. Training shall not hamper the quantity, quality, or timeliness of work requirements of the contract.

VIII. PLACE OF PERFORMANCE

The locations of performance will be at Cincinnati VA Medical Center, associated sites, and offsite warehouse. The contractor is to provide their own transportation to travel up to a 50-mile radius from Cincinnati VA Medical Center.

IX. PERIOD OF PERFORMANCE

· Base Year: 2/17/2025 – 2/16/2026

· Option 1: 2/17/2026 – 2/16/2027

· Option 2: 2/17/2027 – 2/16/2028

· Option 3: 2/17/2028 – 2/16/2029

· Option 4: 2/17/2029 – 2/16/2030

X. QUALITY CONTROL AND QUALITY ASSURANCE FOR CONTRACT SERVICE:

The contractor shall be responsible for effective implementation of their Quality Control Program and shall be responsive to the requirements of the Government’s Quality Assurance Plan conducted by the Station POC.

Quality Control. The contractor shall have a Quality Control program to assure that the requirements of the contract are provided as specified. One copy of the Contractor’s basic Quality Control Program shall be submitted for approval by the Station POC. Subsequent changes to the approved Quality Control Program must also be reviewed and approved by the Station POC. with final approval by the Contracting officer. The program shall include, but not be limited to the following.

An inspection system covering the performance indicators given in the Quality Assurance/Performance Requirements table below.

A method for identifying deficiencies in the quality of services performed before the level of performance becomes unacceptable.

A file of all quality control inspections inspection results, and any corrective action required shall be maintained by the Contractor throughout the duration of this contract. This file shall be the property of the Government and shall be available to the Station POC. during normal working hours. The file shall be turned over to the Government within 14 days of completion of termination of the contract.

QASP: A (Quality Assurance Surveillance Plan (QASP) has been developed for in-house operations or to implement a service contract. It is designed to aid the Government in providing effective and systematic surveillance of all aspects of document and media destruction. This plan provides for monitoring all contract requirements through a combination of methods. These are:

· Check in at all locations using hospital tracking system were applicable.

· Furnishing reports including pick up data.

· Random observation

· Client/Customer Complaints

· Surveillance Activity Checklist

The contractor is required to conduct a check-in process upon arrival at all designated locations. This procedure shall be executed using the hospital tracking system, where applicable. QR Codes, accessible at entry points and front desks or can be provided by point of contact (POC). This must be utilized by the contractor to gain access to the app. The App will capture and record details such as time, date, and location upon check-in. Additionally, the contractor is obligated to input details regarding the services provided into the available slots within the app.

The contractor shall be responsible for furnishing comprehensive details regarding waste pick-up including but not limited to schedules, types of waste accepted, and quantities in the form of a monthly reports. This information will be delivered via email to identified Government officials in the role of Station POC., and the GEMs coordinator. Alternate POC or To BE PROVIDED AT TIME OF CONTRACT AWARD if Station POC is not available. This data is required to be submitted simultaneously with the invoicing for the preceding month.

The QASP is a “living document” and the Government may review and revise it on a regular basis. However, the Government shall coordinate changes with the contractor. Updates shall ensure that the QASP remains a valid, useful, and enforceable document. Copies of the original QASP and revisions shall be provided to the contractor and Government officials implementing surveillance activities.

The objective of this surveillance plan is to evaluate how the Government or contractor is performing in key areas.

We are primarily interested in the final product or service being provided and not the details of the accomplishment.

QUALITY ASSURANCE / PERFORMANCE REQUIREMENTS STANDARDS

Threshold

Disincentive: The CO will refer the matter to the Department of Labor for review and action.

PERFORMANCE MONITORING: The government will periodically evaluate the contractor's performance by appointing representative(s) from serviced facilities to monitor performance to ensure services are received.

The government representative will evaluate the contractor's performance through intermittent observation and on-site inspections of the contractor's quality control program and receipt of complaints from facility personnel.

Routine collections and container movements will be observed by a government representative at random intervals no less than once per month.

The government representative may perform on-site inspections of the contractor's facility(s) if applicable no less than once annually. The government may increase the number of quality control inspections if deemed appropriate because of repeated failures discovered during quality control inspections or because of repeated customer complaints. The government will also receive and investigate complaints from various customers located on the installation.

The contractor shall be responsible for initially validating customer complaints. However, the government representative shall make final determination of the validity of customer complaint(s) in cases of disagreement with customer(s).

ACCEPTABLE PERFORMANCE

The Government shall document positive performance. Any report may become a part of the supporting documentation for any contractual action.

UNACCEPTABLE PERFORMANCE

When unacceptable performance occurs, the Station POC shall inform the contractor. This will normally be in writing unless circumstances necessitate verbal communication. In any case the Station POC shall document the discussion and send to the CO who places it in the contract file.

a. When the Station POC determines formal written communication is required, the Station POC shall prepare a Contract Discrepancy Report (CDR) and present it to the contractor's program manager.

b. The contractor shall acknowledge receipt of the CDR in writing. The CDR will specify if the contractor is required to prepare a corrective action plan to document how the contractor shall correct the unacceptable performance and avoid a recurrence. The CDR will also state how long after receipt the contractor has to present this corrective action plan to the Station POC. The Government shall review the contractor's corrective action plan to determine acceptability.

c. Any CDRs may become a part of the supporting documentation for any contractual action deemed necessary by the CO.

The Contractor shall appoint a point of contact that will have the responsibility to respond to customer needs in accordance with this contract. He/she will ensure emergent needs are appropriately addressed within 24 hours and non-emergent needs addressed within the normal delivery period specified by the contract. Facility POC’s are listed above.

XI. SPECIAL CONTRACT REQUIREMENTS:

VA INFORMATION AND INFORMATION SYSTEM SECURITY AND PRIVACY LANGUAGE

1. GENERAL.

This entire section applies to all acquisitions requiring any Information Security and Privacy language. Contractors, contractor personnel, subcontractors and subcontractor personnel will be subject to the same federal laws, regulations, standards, VA directives and handbooks, as VA personnel regarding information and information system security and privacy.

2. VA INFORMATION CUSTODIAL LANGUAGE.

This entire section applies to all acquisitions requiring any Information Security and Privacy language.

a. The Government shall receive unlimited rights to data/intellectual property first produced and delivered in the performance of this contract or order (hereinafter “contract”) unless expressly stated otherwise in this contract. This includes all rights to source code and all documentation created in support thereof. The primary clause used to define Government and Contractor data rights is FAR 52.227-14 Rights in Data – General. The primary clause used to define computer software license (not data/intellectual property first produced under this contractor or order) is FAR 52.227-19, Commercial Computer Software License.

b. Information made available to the contractor by VA for the performance or administration of this contract will be used only for the purposes specified in the service agreement, SOW, PWS, PD, and/or contract. The contractor shall not use VA information in any other manner without prior written approval from a VA Contracting Officer (CO). The primary clause used to define Government and Contractor data rights is FAR 52.227-14 Rights in Data – General.

c. VA information will not be co-mingled with any other data on the contractor’s information systems or media storage systems. The contractor shall ensure compliance with Federal and VA requirements related to data protection, data encryption, physical data segregation, logical data segregation, classification requirements and media sanitization.

d. VA reserves the right to conduct scheduled or unscheduled audits, assessments, or investigations of contractor Information Technology (IT) resources to ensure information security is compliant with Federal and VA requirements. The contractor shall provide all necessary access to records (including electronic and documentary materials related to the contracts and subcontracts) and support (including access to contractor and subcontractor staff associated with the contract) to VA, VA's Office Inspector General (OIG), and/or Government Accountability Office (GAO) staff during periodic control assessments, audits, or investigations.

e. The contractor may only use VA information within the terms of the contract and applicable Federal law, regulations, and VA policies. If new Federal information security laws, regulations or VA policies become applicable after execution of the contract, the parties agree to negotiate contract modification and adjustment necessary to implement the new laws, regulations, and/or policies.

f. The contractor shall not make copies of VA information except as specifically authorized and necessary to perform the terms of the contract. If copies are made for restoration purposes, after the restoration is complete, the copies shall be destroyed in accordance with VA Directive 6500, VA Cybersecurity Program and VA Information Security Knowledge Service.

g. If a Veterans Health Administration (VHA) contract is terminated for default or cause with a business associate, the related local Business Associate Agreement (BAA) shall also be terminated and actions taken in accordance with VHA Directive 1605.05, Business Associate Agreements. If there is an executed national BAA associated with the contract, VA will determine what actions are appropriate and notify the contactor.

h. The contractor shall store and transmit VA sensitive information in an encrypted form, using VA-approved encryption tools which are, at a minimum, Federal Information Processing Standards (FIPS) 140-2, Security Requirements for Cryptographic Modules (or its successor) validated and in conformance with VA Information Security Knowledge Service requirements. The contractor shall transmit VA sensitive information using VA approved Transport Layer Security (TLS) configured with FIPS based cipher suites in conformance with National Institute of Standards and Technology (NIST) 800-52, Guidelines for the Selection, Configuration and Use of Transport Layer Security (TLS) Implementations.

i. The contractor’s firewall and web services security controls, as applicable, shall meet or exceed VA’s minimum requirements.

j. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor may use and disclose VA information only in two situations:

(i) in response to a qualifying order of a court of competent jurisdiction after notification to VA CO

(ii) with written approval from the VA CO. The contractor shall refer all requests for, demands for production of or inquiries about, VA information and information systems to the VA CO for response.

k. Notwithstanding the provision above, the contractor shall not release VA records protected by Title 38 U.S.C. § 5705, Confidentiality of medical quality assurance records and/or Title 38 U.S.C. § 7332, Confidentiality of certain medical records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse or infection with Human Immunodeficiency Virus (HIV). If the contractor is in receipt of a court order or other requests for the abovementioned information, the contractor shall immediately refer such court order or other requests to the VA CO for response.

l. Information made available to the contractor by VA for the performance or administration of this contract or information developed by the contractor in performance or administration of the contract will be protected and secured in accordance with VA Directive 6500 and Identity and Access Management (IAM) Security processes specified in the VA Information Security Knowledge Service.

m. Any data destruction done on behalf of VA by a contractor shall be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management, VA Handbook 6300.1, Records Management Procedures, and applicable VA Records Control Schedules.

n. The contractor shall provide its plan for destruction of all VA data in its possession according to VA Directive 6500 and NIST 800-88, Guidelines for Media Sanitization prior to termination or completion of this contract. If directed by the COR/CO, the contractor shall return all Federal Records to VA for disposition.

o. Any media, such as paper, magnetic tape, magnetic disks, solid state devices or optical discs that is used to store, process, or access VA information that cannot be destroyed shall be returned to VA. The contractor shall hold the appropriate material until otherwise directed by the Contracting Officer’s Representative (COR) or CO. Items shall be returned securely via VA-approved methods. VA sensitive information must be transmitted utilizing VA-approved encryption tools which are validated under FIPS 140-2 (or its successor) and NIST 800-52. If mailed, the contractor shall send via a trackable method (USPS, UPS, FedEx, etc.) and immediately provide the COR/CO with the tracking information. Self- certification by the contractor that the data destruction requirements above have been met shall be sent to the COR/CO within 30 business days of termination of the contract.

p. All electronic storage media (hard drives, optical disks, CDs, back-up tapes, etc.) used to store, process or access VA information will not be returned to the contractor at the end of lease, loan, or trade-in. Exceptions to this paragraph will only be granted with the written approval of the VA CO.

3. ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS.

This section applies when any person requires access to information made available to the contractor by VA for the performance or administration of this contract or information developed by the contractor in performance or administration of the contract.

a. A contractor/subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees and subcontractors only to the extent necessary to perform the services specified in the solicitation or contract. This includes indirect entities, both affiliate of contractor/subcontractor and agent of contractor/subcontractor.

b. Contractors and subcontractors shall sign the VA Information Security Rule of Behavior (ROB) before access is provided to VA information and information systems (see Section 4, Training, below). The ROB contains the minimum user compliance requirements and does not supersede any policies of VA facilities or other agency components which provide higher levels of protection to VA’s information or information systems. Users who require privileged access shall complete the VA elevated privilege access request processes before privileged access is granted.

c. All contractors and subcontractors working with VA information are subject to the same security investigative and clearance requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors shall be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office of Human Resources and Administration/Operations, Security and Preparedness (HRA/OSP) is responsible for these policies and procedures. Contract personnel who require access to classified information or information systems shall have an appropriate security clearance. Verification of a Security Clearance shall be processed through the Special Security Officer located in HRA/OSP. Contractors shall conform to all requirements stated in the National Industrial Security Program Operating Manual (NISPOM).

d. All contractors and subcontractors shall comply with conditions specified in VAAR 852.204-71(d); Contractor operations required to be in United States. All contractors and subcontractors working with VA information must be permanently located within a jurisdiction subject to the law of the United States or its Territories to the maximum extent feasible. If services are proposed to be performed abroad the contractor must state where all non-U.S. services are provided. The contractor shall deliver to VA a detailed plan specifically addressing communications, personnel control, data protection and potential legal issues. The plan shall be approved by the COR/CO in writing prior to access being granted.

e. The contractor shall notify the COR/CO in writing immediately (no later than 24 hours) after personnel separation or occurrence of other causes. Causes may include the following:

(1) Contractor/subcontractor personnel no longer has a need for access to VA information or VA information systems.

(2) Contractor/subcontractor personnel are terminated, suspended, or otherwise has their work on a VA project discontinued for any reason.

(3) Contractor believes their own personnel or subcontractor personnel may pose a threat to their company’s working environment or to any company owned property. This includes contractor-owned assets, buildings, confidential data, customers, employees, networks, systems, trade secrets and/or VA data.

(4) Any previously undisclosed changes to contractor/subcontractor background history are brought to light, including but not limited to changes to background investigation or employee record.

(5) Contractor/subcontractor personnel have their authorization to work in the United States revoked.

(6) Agreement by which contractor provides products and services to VA has either been fulfilled or terminated, such that VA can cut off electronic and/or physical access for contractor personnel.

f. In such cases of contract fulfillment, termination, or other causes; the contractor shall take the necessary measures to immediately revoke access to VA network, property, information, and information systems (logical and physical) by contractor/subcontractor personnel. These measures include (but are not limited to): removing and then securing Personal Identity Verification (PIV) badges and PIV – Interoperable (PIV-I) access badges, VA-issued photo badges, credentials for VA facilities and devices, VA-issued laptops, and authentication tokens. Contractors shall notify the appropriate VA COR/CO immediately to initiate access removal.

g. Contractors/subcontractors who no longer require VA accesses will return VA issued property to VA. This property includes (but is not limited to): documents, electronic equipment, keys, and parking passes. PIV and PIV-I access badges shall be returned to the nearest VA PIV Badge Issuance Office. Once they have had access to VA information, information systems, networks and VA property in their possessions removed, contractors shall notify the appropriate VA COR/CO.

4. TRAINING.

This entire section applies to all acquisitions which include section 3.

a. All contractors and subcontractors requiring access to VA information and VA information systems shall successfully complete the following before being granted access to VA information and its systems:

(1) VA Privacy and Information Security Awareness and Rules of Behavior course (Talent Management System (TMS) #10176) initially and annually thereafter.

(2) Sign and acknowledge (electronically through TMS #10176) understanding of and responsibilities for compliance with the Organizational Rules of Behavior, relating to access to VA information and information systems initially and annually thereafter; and

(3) Successfully complete any additional cyber security or privacy training, as required for VA personnel with equivalent information system or information access [to be defined by the VA program official and provided to the VA CO for inclusion in the solicitation document – i.e., any role based information security training].

b. The contractor shall provide to the COR/CO a copy of the training certificates and certification of signing the Organizational Rules of Behavior for each applicable employee within five days of the initiation of the contract and annually thereafter, as required.

c. Failure to complete the mandatory annual training is grounds for suspension or termination of all physical or electronic access privileges and removal from work on the contract until such time as the required training is complete.

5. SECURITY INCIDENT INVESTIGATION.

This entire section applies to all acquisitions requiring any Information Security and Privacy language.

a. The contractor, subcontractor, their employees, or business associates shall immediately (within one hour) report suspected security / privacy incidents to the VA OIT’s Enterprise Service Desk (ESD) by calling (855) 673-4357 (TTY: 711). The ESD is OIT’s 24/7/365 single point of contact for IT-related issues. After reporting to the ESD, the contractor, subcontractor, their employees, or business associates shall, within one hour, provide the COR/CO the incident number received from the ESD.

b. To the extent known by the contractor/subcontractor, the contractor/subcontractor's notice to VA shall identify the information involved and the circumstances surrounding the incident, including the following:

(1) The date and time (or approximation of) the Security Incident occurred.

(2) The names of individuals involved (when applicable).

(3) The physical and logical (if applicable) location of the incident.

(4) Why the Security Incident took place (i.e., catalyst for the failure).

(5) The amount of data belonging to VA believed to have been compromised.

(6) The remediation measures the contractor is taking to ensure no future incidents of a similar nature.

c. After the contractor has provided the initial detailed incident summary to VA, they will continue to provide written updates on any new and relevant circumstances or facts they discover. The contractor, subcontractor, and their employes shall fully cooperate with VA or third-party entity performing an independent risk analysis on behalf of VA. Failure to cooperate may be deemed a material breach and grounds for contract termination.

d. VA IT contractors shall follow VA Handbook 6500, Risk Management Framework for VA Information Systems VA Information Security Program, and VA Information Security Knowledge Service guidance for implementing an Incident Response Plan or integrating with an existing VA implementation.

e. In instances of theft or break-in or other criminal activity, the contractor/subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG, and the VA Office of Security and Law Enforcement. The contractor, its employees, and its subcontractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The contractor/subcontractor shall cooperate with VA in any civil litigation to recover VA information, obtain monetary or other compensation from a third party for damages arising from any incident, or obtain injunctive relief against any third party arising from, or related to, the incident.

f. The contractor shall comply with VA Handbook 6500.2, Management of Breaches Involving Sensitive Personal Information, which establishes the breach management policies and assigns responsibilities for the oversight, management and reporting procedures associated with managing of breaches.

g. With respect to unsecured Protected Health Information (PHI), the contractor is deemed to have discovered a data breach when the contractor knew or should have known of breach of such information. When a business associate is part of VHA contract, notification to the covered entity (VHA) shall be made in accordance with the executed BAA.

h. If the contractor or any of its agents fails to protect VA sensitive personal information or otherwise engages in conduct which results in a data breach involving any VA sensitive personal information the contractor/subcontractor processes or maintains under the contract; the contractor shall pay liquidated damages to the VA as set forth in clause 852.211-76, Liquidated Damages— Reimbursement for Data Breach Costs.

Service Contract Labor Standards are applicable to this contract. Please reference SAM.gov for locations below. All applicable Wage Determinations can be found at SAM.gov | Search

Cincinnati, OH 45220-2637

The full text of FAR and VAAR provisions or clauses may be accessed electronically at http://acquisition.gov/comp/far/index.html.

The following solicitation provisions apply to this acquisition:

1. FAR 52.212-1, “Instructions to Offerors–Commercial Products and Commercial Services”

ADDENDUM to FAR 52.212-1 INSTRUCTIONS TO OFFERORS—COMMERCIAL PRODUCTS AND COMMERCIAL SERVICES (NOV 2021) Provisions that are incorporated by reference (by Citation Number, Title, and Date), have the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. The version of FAR 52.212-1 in the addendum is tailored for Simplified Acquisition Procedures and supersedes the current version of FAR 52.212-1 contained in the FAR.

The following provision is incorporated into 52.212-1 as an addendum to this solicitation:

52.212-1 Instructions to Offerors – Commercial Products and Commercial Services (Nov 2021)

(a) North American Industry Classification System (NAICS) code and small business size standard. The NAICS code(s) and small business size standard(s) for this acquisition appear elsewhere in the Request for Quote (RFQ). However, the small business size standard for a concern that submits a quote, other than on a construction or service acquisition, but proposes to furnish an end item that it did not itself manufacture, process, or produce is 500 employees if the acquisition—

(1) Is set aside for small business and has a value above the simplified acquisition threshold; or

(2) Uses the HUBZone price evaluation preference regardless of dollar value, unless the quoter waives the price evaluation preference; or

(3) Is an 8(a), HUBZone, service-disabled veteran-owned, economically disadvantaged women-owned, or women-owned small business set-aside or sole-source award regardless of dollar value.

(b) Submission of Quotes. Submit signed and dated quotes to the office specified in this Request for Quote (RFQ) at or before the exact time specified. Quotes may be submitted on letterhead stationery, or as otherwise specified in the RFQ. As a minimum, quotes must show—

(1) The solicitation number;

(2) The time specified in the solicitation for receipt of quotations;

(3) The name, address, and telephone number of the quoter;

(4) A technical description of the items being quoted in sufficient detail to evaluate compliance with the requirements in the solicitation. This may include product literature, or other documents, if necessary;

(5) Terms of any express warranty;

(6) Price and any discount terms;

(7) "Remit to" address, if different than mailing address;

(8) A completed copy of the representations and certifications at Federal Acquisition Regulation (FAR) 52.212-3 (see FAR 52.212-3(b) for those representations and certifications that the quoter shall complete electronically);

(9) Acknowledgment Request for Quotation amendments;

(10) Past performance will not be considered in simplified acquisition procurements.

(11) Quote should include a statement specifying the extent of agreement with all terms, conditions, and provisions included in the solicitation. Quotes that fail to furnish required representations and certifications, information requested in (1) to (9), and accept the terms and conditions of the solicitation may be excluded from consideration.

(c) Period for acceptance of Quotes. The quoter agrees to hold the prices in its quote firm for 30 calendar days from the date specified for receipt of quotes, unless another time period is specified in an addendum to the solicitation.

(d) Product samples. When required by the solicitation, product samples shall be submitted at or prior to the time specified for receipt of quotes. Unless otherwise specified in this solicitation, these samples shall be submitted at no expense to the Government, and returned at the sender’s request and expense, unless they are destroyed during testing.

(e) Multiple Quotes. Quoters are encouraged to submit multiple quotes presenting alternative line items (provided that the alternative line items are consistent with FAR subpart 4.10), or alternative commercial products or commercial services for satisfying the requirements of this solicitation. Each quote submitted will be evaluated separately.

(f) Late submissions, revisions, and withdrawals of quotes.

(1) Quoters are responsible for submitting quotes so as to reach the Government office designated in the solicitation by the time specified in the solicitation. If no time is specified in the solicitation, the time for receipt is 4:30 p.m., local time, for the designated Government office on the date that quotes are due.

(2) Any quotation received at the Government office designated in the solicitation after the exact time specified for receipt of quotes is "late" and may not be considered unless it is received before purchase order issuance and the Contracting Officer (CO) determines that accepting the late quotation would not unduly delay the acquisition.

(3) If an emergency or unanticipated event interrupts normal Government processes so that quotations cannot be received at the Government office designated for receipt of quotes by the exact time specified in the solicitation, and urgent Government requirements preclude a notice of an extension of the closing date, the time specified for receipt of quotes will be deemed to be extended to the same time of day specified in the solicitation on the first work day on which normal Government processes resume.

(g) Issuance of Purchase Order. The Government may issue a purchase order to one or more quoters as identified in the Request for Quote (RFQ). Therefore, the quoter’s initial quote should contain the best terms from a price and technical standpoint. However, the Government may reject any or all quotes if such action is in the public’s best interest. The Contracting Officer (CO) may issue a purchase order to other than the quoter with the lowest priced quotation.

(h) Multiple awards. The Government may issue a purchase order for any item or group of items of a quotation, unless the quoter qualifies the quotation by specific limitations. Unless otherwise provided in the Schedule, quotations may not be submitted for quantities less than those specified. The Government reserves the right to issue a purchase order for a quantity less than the quantity quoted, at the unit prices quoted, unless the quoter specifies otherwise in the quotation.

(1) Availability of requirements documents cited in the solicitation.

(i) The GSA Index of Federal Specifications, Standards and Commercial Item Descriptions, FPMR Part 101-29, and copies of specifications, standards, and commercial item descriptions cited in this solicitation may be obtained for a fee by submitting a request to- GSA Federal Supply Service Specifications Section Suite 8100 470 East L’Enfant Plaza, SW Washington, DC 20407 Telephone (202) 619-8925, Facsimile (202) 619-8978.

(ii) If the General Services Administration, Department of Agriculture, or Department of Veterans Affairs issued this solicitation, a single copy of specifications, standards, and commercial item descriptions cited in this solicitation may be obtained free of charge by submitting a request to the addressee in paragraph (i)(1)(i) of this provision. Additional copies will be issued for a fee.

(2) Most unclassified Defense specifications and standards may be downloaded from the following ASSIST websites:

(i) ASSIST ( https://assist.dla.mil/online/start/).

(ii) Quick Search ( http://quicksearch.dla.mil/).

(3) Documents not available from ASSIST may be ordered from the Department of…