UPDATED PWS - Doc Shredding - AA FINAL.docx

?.## PERFORMANCE WORK STATEMENT

Document Destruction (Shredding) and Media Destruction Services

1. GENERAL: This is a non-personnel services contract to provide Document and Media Destruction services. The Government shall not exercise any supervision or control over the contract service providers performing the services herein. Such contract service providers shall be accountable solely to the Contractor who, in turn is responsible to the Government.

A. Description of Services / Introduction: The contractor shall provide all personnel, equipment, tools, materials, vehicles, supervision, and other items and services necessary to perform collection, and shredding of paper /and non-paper media materials at Veterans Integrated Service Network (VISN)10 facilities including:

· VA Ann Arbor Main Hospital - 2215 Fuller Rd., An Arbor, MI 48105

· VA Canton CBOC- 5900 N Lotz Rd, Canton Township, MI 48187

· Domino Farms - 36 Frank Lloyd Wright Dr. Ann Arbor, MI 48106 (Finance Dept - Lobby K)

· Domino Farms - 36 Frank Lloyd Wright Dr. Ann Arbor, MI 48106 (Contracting Dept - Lobby M)

· VA Packard Rd CBOC - 3800 Packard Rd, Ann Arbor, MI 48108

· VA Green Rd CBOC - 25 Green Rd Ann Arbor 48105

· VA Toledo CBOC - 1200 South Detroit Ave., Toledo, MI 43614

· VA HSR&D - 2800 Plymouth Rd, Ann Arbor, MI 48105 (U of M, NCRC Bldg 16/3rd floor)

· VA Howell CBOC- 3399 E Grand River Ave., Ste 100, Howell, MI 48843

· VA Adrian CBOC- 770 Riverside Ave., 1st Floor, Adrian MI 49221

· VA Flint CBOC- 2360 South Linden Rd, Flint MI 48532

· VA Jackson CBOC- 4328 Page Avenue Michigan Center, MI 49254

· VA Findlay - 1720 East Melrose Avenue, Findlay, OH 45840

· VAAAHS Off-site Warehouse - 844 Highland Drive, Ann Arbor, MI 48108

Complete list of all facilities to be serviced is available in Appendix B.

Per the VA Directive 6371, the Contractor shall be certified by (NAID) National Association for Information Destruction or be a non-NAID-certified contractor who can satisfy the standards outlined in the Appendix. The current VA Directive 6371 can be found online at: https://www.va.gov/vapubs. The contractor shall perform to the standards in the contract as well as all local, state, and federal regulations. Paper materials will be defined as any type of paper used in an office environment, such as copy paper, brochure paper, newspaper, coated stock, slick magazine-type paper, envelopes, computer paper, any type of note paper, manila folders, and hanging folders. Contractor will not require cardboard inserts, staples, paper clips, binder clips, rubber bands, or plastic covers to be removed from material placed in collection units.

The following are not included in this requirement:

· Hard Drives

· Tape Media

· Floppy Disk

· DLT (Digital Linear Tape)

· LTO (Linear Tape Open)

· Optical Disk (CD, DVD, etc.)

· VHS

· Data and Audio Cassette

· Data Tape Reels

· Microfiche (Prepare in bundles of 100).

· Printer Ribbon

· X-Rays

· Removable USB Memory (Thumb Drive)

· Removable Flash Memory (Compact Flash, SD Memory Card, SIM Cards).

· Mobile Devices: Cell Phones (Apple iPhone, Blackberry, Samsung, Android, etc.)

· PIV Cards (Personal Identify Verification)

· SSD Storage (Solid State Drive)

· Digital Cameras

· Tablets: (Ex: Samsung Galaxy, Apple iPad, Amazon Fire) Shredding of non-paper media includes CDs, VHS or cassette tapes, PIV badges, government credit cards. Non-Paper media shall be picked up from three (3) areas within the medical facilities (The areas include: ISO, OI&T, and Privacy office). Pickups are to be once a quarter at the 3 locations identified at the VA Ann Arbor Main Hospital.

COMPETENCY OF PERSONNEL CONDUCTING SHREDDING:

The Contractor and any/all subcontractors (if applicable) shall be National Association for Information Destruction (NAID) certified or be able to attest that they can satisfy the standards outlined in VA Directive 6371. Any additions, modifications, or changes to VA Directive 6371 shall take precedence and the contractor shall have a reasonable amount of time to make the recommended changes. Any certification shall be continued/renewed during the entirety of the contract period of performance.

B. COLLECTION SITES: Each site will appoint a Technical Contract Officer's Representative, (T-COR) to address local issues and communicate with the contractor as needed. The local Technical CORs will include the VISN COR in all communication between the local facility and the contractor. The Contractor shall collect all materials from the Contractor supplied lock boxes (consoles) or designated Contractor secured holding area. All consoles will be emptied as scheduled regardless of the volume of paper that they hold. Locations to be collected from and bin quantities are listed in Appendix A. List is subject to change based on revised usage or needs.

C. CONTAINERS: The Contractor will supply secure collection containers (consoles) that are aesthetically pleasing and fit for use in public areas. Standard Containers will have a capacity of no more than 32 gallons. They will be lockable and tamper-resistant/evident. All containers will be numbered, and a list of the container location(s) shall be provided to the COR and Contracting Office. The Contractor will supply keys for the containers to the local COR's, ISO, and other staff as required and confirmed by the Contracting Officer. Contractor shall ensure that all bins/cabinets are labelled with contact information for facility personnel to contact should an issue arise with the bin/cabinets that is construction or lock related. Also, the vendor shall allow VA staff to affix instructional signage on the bins.

D. MAINTENANCE: The contractor will be responsible for the routine maintenance and repair of all contractor-owned equipment at no cost to the government.

E. PERSONNEL: All contractor staff will be uniformed as appropriate and will always display photo ID badges. Contractor staff will check in with designated Facility point of contact upon arrival at the facility.

F. COLLECTIONS: All collections and destruction will be conducted during normal business hours (M-F 0800-1630) unless prior written approval from facility management is obtained. The contractor shall service each collection point and remove all material and shred in a secure manner per directive 6371 Page 12, #17. Collection shall be in accordance with the following schedule. Any variation from this requirement must be approved in writing from Facility Management:

1. VA Medical Centers and Ambulatory Care Centers - See Schedule in Appendix A

2. Community Based Outpatient Clinics (CBOCs) – See Schedule in Appendix A

3. Off-Site Admin Offices (Network Contracting Offices) – See Schedule in Appendix A

4. Other VA Supported facilities – See schedule in Appendix A

Collection schedules at Community Based Outpatient Clinics (CBOCs) and other leased and/or VA owned facilities may be altered to accommodate need. The contractor will communicate any anticipated changes to collection dates and/or times to the COR and CBOC/Building Officer in charge at least one (1) week prior to the service date.

If any location cannot be serviced for any reason including locked doors or buildings, it is the contractor’s responsibility to reach out to the applicable site COR immediately. Additional remediation efforts shall be sent to the Privacy officer, site COR, and the contracting officer/specialist. A spreadsheet of POC’s shall be provided with a list of locations upon contract award. Updates to contact information, bin locations, or additional bins shall be sent as soon as possible to all parties.

The Government reserves the right to add or remove any additional Medical Centers, CBOC’s or other facilities to the contract as they become available. Furthermore, the Government reserves the right to increase or decrease frequencies of collections or quantities of collection devices to allow for fluctuations of client demand that are otherwise unknown at time of solicitation. The total contract value may increase up to 15% of the base award.

G. UNSCHEDULED COLLECTIONS: The contracting officer representative may require the contractor to make unscheduled collection or purge, and disposals. The contractor shall respond to the request within 24 hours. The two parties (VA and Contractor) shall work collaboratively to arrange the unscheduled services/ purge as soon as possible. Additionally, the contractor shall respond to requests for additional equipment, equipment moves, etc. within one business day and shall work collaboratively with the VA to facilitate these changes/moves etc. as soon as possible. All purges will be quoted in 300 “Banker Box” increments in the price cost schedule.

H. INCLEMENT WEATHER SCHEDULE: The contractor shall collect during periods of inclement weather. In cases of severe weather, the contracting officer or COR may authorize exceptions. When exceptions are granted, the contractor shall make up all missed collections within 24 hours after the severe weather has terminated or work collaboratively to arrange a makeup as soon as possible.

I. ROUTE PARAMETERS: The contractor shall communicate with local facilities to establish routes to the facilities as well as identifying any access requirements and/or restrictions within the facilities.

J. POINTS OF COLLECTION: The contractor shall position containers for customer ease in depositing materials. This may require repositioning of containers from time to time. The contractor shall also position containers to minimize interference with foot traffic within areas being serviced. Containers will be placed in accordance with applicable safety and security regulations.

K. CAPACITY: Proposed capacity of containers is such to maximize the use of available space. The government reserves the right to change any collection station or change the number of collection stations if it does not impact resources needed by the Contractor to fulfill the requirement of this PWS. The contractor shall comply with the request to move collection station during next collection date. If movement is required to alleviate a health or safety issue the government will move container and notify contractor of the new location. The government may also reduce the frequency of collections. Purges of large volumes of materials may be arranged as a special service. Office purges or special service shall be arranged through the COR.

L. GOVERNMENT-APPROVED CONTAINERS: Collection of materials in all areas shall be from contractor-provided, government-approved containers. All changes to collection containers must be approved by the local facility management prior to placement.

M. MAINTAINING CONTAINERS AND COLLECTION AREA: The contractor shall return the containers to their original location after servicing. The contractor will also be responsible for immediately cleaning up any debris, etc., which may occur during servicing of containers. All materials identified in para A. DESCRIPTION OF SERVICES located on the ground within two feet of the container which are dropped by the contractor shall be picked up by the contractor during the shredding process, leaving the area intact. VA personnel have been instructed to only leave items inside of the locked collection bins. The contractor shall notify the Facility COR, EMS Personnel, or Housekeeping immediately if any Items are left on or around the collection bins and not inside the locked collection bins. The Facility COR, EMS Personnel, or Housekeeping shall coordinate immediate removal or disposal of the identified items. Collected material shall always be secured and under the control of the contractor during the collection and shredding process.

Containers are to be constructed with a deadbolt lock and an offset document slot to prevent unauthorized removal of material. The unit is to securely hold approximately 100 pounds of material. Containers (non-wheeled style) can be no larger than 32 gallons. Wheeled containers can be no larger than 95 gallons. Collections shall always remain in the vendor’s sight. Items shall remain in locked containers while transporting from collection sites to the mobile shredding vehicle.

All services provided under this contract must be performed in conformance with VA Directive 6371. http://vaww.va.gov/vapubs/viewPublication.asp?Pub_ID=742&FType=2

N. OFF-SITE DISPOSAL: The contractor shall transport all material in a locked vehicle. Contractor will dispose of all shredded material at a licensed off-site disposal area selected by the contractor. Material will be destroyed with the standards set forth in VA Directive 6371 April 8, 2014 (Destruction of Temporary Paper Records). Disposal shall comply with all existing local, state, and federal regulations. The contractor shall be responsible for any permit or fees associated with the use of off-site disposal locations. All materials will be shredded by producing particles that are 1x5 millimeters in size or that will pulverize/disintegrate paper material using disintegrator devices with a security screen, per VA Directive 6371 and NARA CUI Notice 2019-03). All materials shall be shredded in a mobile shredding vehicle prior to removal from the premises and all materials shall meet a VA Directive 6371 shredding requirement before being disposed of according to all local, state and federal regulations. If the mobile vehicle cannot meet the VA Directive 6371 requirement the contractor shall transport the shredded materials to a secure facility in order to meet that final requirement.

O. REPORTS AND RECORDS: Contractor shall provide the following information (at a minimum).

· Monthly report and invoice detailing actual tonnage of materials shredded.

· Certificates of destruction for each location.

· Certificates of destruction shall document the chain of custody of all materials up to the final destruction of the material.

· Certificates of destruction shall identify at a minimum,

· Date of Pickup from facility

· Amount (in weight) picked up

· VA personnel signing for pickup

· VA Hospital location

· Bin location(s)

· Destruction Date

· Amount (in weight) destroyed

· Final signature of personnel who witnessed destruction of materials.

· Total actual weight of materials destroyed

A copy of each certificate of destruction will be supplied on a minimum of a monthly basis to the Privacy Officer, Record Manager, and COR. A list of station personnel will be provided to the contractor upon award of contract and/or kick-off meeting.

· The vendor will supply a final destruction sample to the Privacy Officer on a quarterly basis.

· Contractor shall be required to submit monthly documentation on poundage of shredding.

Contractor shall monitor the usage of containers and under no circumstances are containers to be added and/or removed from locations without prior approval from the COR. Contractor shall notify the COR if containers are being underutilized or if additional containers are needed for any particular area at all locations.

The contractor will provide personnel government approved security clearance, and or training records upon request.

P. Minimum Standards for Information Destruction: Information destruction contractors and subcontractors must be able to meet the following standards:

1. Physical and Operational Security

a. Monitored Alarm System(s) that include the following:

• Motion Detectors;

• Door Contacts;

• Battery Back-Up; and

• Monitoring Service.

b. Taped Closed Circuit TV (CCTV) monitors with the following:

• Fully Functional Cameras;

• Recording Devices; and

• Secure Recording Tape Library.

c. Sufficient Lighting to allow CCTV

d. Locks and Key Controls

e. Visitor Logs

• Visitor In/Out Logs; and

• Visitor ID Badges.

f. Written Policies and Procedures

2. Documentation and Control of Resources

a. Documentation and control of contractor:

b. Documentation and control of employees:

• Documentation of who has access to materials (minimum necessary access only is allowed);

• Documentation of background investigations (types and frequency);

• Documentation of citizenship, naturalization (no non-US citizens);

• Documentation of drug screen; and

• Documentation of re-evaluation of above items (at least every two years).

c. Documentation and control of destruction equipment:

• Type (Mobile or Plant-Based);

• Manufacturer and Model;

• Serial Number; and

• Dates of non-operational downtime for repair.

d. Documentation and control of destruction and collection vehicles:

• Vehicle make and model;

• License plate number;

• State/County of registration;

• Acceptable overnight storage address and location;

• Acceptable roadworthiness of vehicles;

• Locks and security of vehicles; and

• Driver logs to show who has control of vehicle at any given time.

e. Documentation and control of all recipients of materials:

• Name of individual/company;

• Address where received;

• Method of final disposition; and

• Certifications of destruction (general documentation acceptable as long as it is attributable to VA’s data (e.g., “bails shipped on <date> were pulped on <date>).

Q. Other Operational Requirements

a. All destruction will take place within the enclosure of the destruction facility, which consists of four solid walls and a ceiling, and meets all criteria related to physical building security.

b. The only permissible uses of a mobile destruction vehicle will be within the enclosure of the destruction facility, on-site at the VA’s premises, or at an off-site location if approved of in advance by VA and is located within walking distance of the VA premises.

c. A log is kept to record the dates and times that the mobile destruction vehicle is operating within the destruction facility, which shall be made available to VA during an audit, by means of review of CCTV images.

d. The mobile destruction vehicle will be made available to VA for audit, within the enclosure of the destruction facility, during the initial audit and during all scheduled re-audits, for demonstration purposes.

R. QUALITY CONTROL AND QUALITY ASSURANCE FOR CONTRACT SERVICE: The contractor shall be responsible for effective implementation of their Quality Control Program, and shall be responsive to the requirements of the Government’s Quality Assurance Plan conducted by the COR.

a. Quality Control. The contractor shall have a Quality Control program to assure that the requirements of the contract are provided as specified. One copy of the Contractor’s basic Quality Control Program shall be submitted for approval by the COR. Subsequent changes to the approved Quality Control Program must also be reviewed and approved by the COR with final approval by the Contracting officer. The program shall include, but not be limited to the following.

1. An inspection system covering the performance indicators given in the Quality Assurance/Performance Requirements table below.

2. A method for identifying deficiencies in the quality of services performed before the level of performance becomes unacceptable.

3. A file of all quality control inspections inspection results, and any corrective action required shall be maintained by the Contractor throughout the duration of this contract. This file shall be the property of the Government and shall be available to the COR during normal working hours. The file shall be turned over to the Government within 14 days of completion of termination of the contract.

b. QASP: A Quality Assurance Surveillance Plan (QASP) has been developed for in-house operations or to implement a service contract. It is designed to aid the Government in providing effective and systematic surveillance of all aspects of document and media destruction. This plan provides for monitoring all contract requirements through a combination of methods. These are:

1. Random observation

2. Client/Customer Complaints

3. Surveillance Activity Checklist

The QASP is a “living document” and the Government may review and revise it on a regular basis. However, the Government shall coordinate changes with the contractor. Updates shall ensure that the QASP remains a valid, useful, and enforceable document. Copies of the original QASP and revisions shall be provided to the contractor and Government officials implementing surveillance activities.

The objective of this surveillance plan is to evaluate how the Government or contractor is performing in key areas. We are primarily interested in the final product or service being provided and not the details of the accomplishment.

Quality Assurance / Performance Requirements Table

(Facilities and VISN)

Department of Labor - Wage Determination Compliance

Compliance with FAR 52.219-14 and 15 U.S.C. § 657s Limitations on Subcontracting

***Report of Non-Compliance shall be directed to SBA for remediation by the CO.***

Possible fines and debarment may be imposed. Please see Note 7.1 under this table.

Note 7.1: IAW 13 CFR § 125.6(g), Whoever violates the requirements set forth in paragraph (a) of this section shall be subject to the penalties prescribed in 15 U.S.C. 645(d), except that the fine shall be treated as the greater of $500,000 or the dollar amount spent, in excess of permitted levels, by the entity on subcontractors. A party's failure to comply with the spirit and intent of a subcontract with a similarly situated entity may be considered a basis for debarment on the grounds, including but not limited to, that the parties have violated the terms of a government contract or subcontract pursuant to far 9.406-2(b)(1)(i) (48 CFR 9.406-2(b)(1)(i)).

Performance Monitoring:

a. The government will periodically evaluate the contractor's performance by appointing representative(s) from serviced facilities to monitor performance to ensure services are received.

b. The government representative will evaluate the contractor's performance through intermittent observation and on-site inspections of the contractor's quality control program and receipt of complaints from facility personnel.

c. Routine shreds will be observed by a government representative at random intervals no less than once per month.

d. The government representative will perform on-site inspections of the contractor's facility(s) no less than once annually.

e. The government may increase the number of quality control inspections if deemed appropriate because of repeated failures discovered during quality control inspections or because of repeated customer complaints. The government will also receive and investigate complaints from various customers located on the installation.

f. The contractor shall be responsible for initially validating customer complaints. However, the government representative shall make final determination of the validity of customer complaint(s) in cases of disagreement with customer(s).

ACCEPTABLE PERFORMANCE

The Government shall document positive performance. Any report may become a part of the supporting documentation for any contractual action.

UNACCEPTABLE PERFORMANCE

When unacceptable performance occurs, the COR shall inform the contractor. This will normally be in writing unless circumstances necessitate verbal communication. In any case the COR shall document the discussion and place it in the COR file.

a. When the COR determines formal written communication is required, the COR shall prepare a Contract Discrepancy Report (CDR) and present it to the contractor's program manager.

b. The contractor shall acknowledge receipt of the CDR in writing. The CDR will specify if the contractor is required to prepare a corrective action plan to document how the contractor shall correct the unacceptable performance and avoid a recurrence. The CDR will also state how long after receipt the contractor has to present this corrective action plan to the COR. The Government shall review the contractor's corrective action plan to determine acceptability.

c. Any CDRs may become a part of the supporting documentation for any contractual action deemed necessary by the CO.

S. SUSTAINABILITY: To meet emergency preparedness guidelines contractor will provide plan to insure 96 hours of sustainability.

a. This requirement means that the contractor must have a plan showing how they will continue to operate for up to 96 hours (four days) in the event of an emergency. “Sustainability” in this context refers to the contractor’s ability to keep providing essential shredding services—even during disruptions such as power outages, severe weather, supply issues, staffing shortages, or other emergencies.

Contractor’s plan should demonstrate things like:

· How they will maintain operations for 96 hours without relying on normal utilities or external support

· How equipment, fuel, transportation, and staffing will be sustained during an emergency

· How they will ensure secure handling and destruction of materials during that period The purpose of the requirement is to ensure continuity of operations and compliance with emergency preparedness guidelines.

T. GOVERNMENT REMEDIES: The contracting officer shall follow FAR 52.212-4, Contract Terms and Conditions-Commercial items (Oct 2018), for contractor's failure to perform satisfactory services or failure to correct non-conforming services.

U. SAFETY REQUIREMENTS: In the performance of this contract, the Contractor shall take such safety precautions as the Contracting Officer may determine to be reasonably necessary to protect the lives and health of Contractor’s employees and occupants of the building. The Contracting Officer/COTR shall notify the Contractor of any safety issues and the action necessary. Such notice, when served on the Contractor or his representative at the work site shall be deemed sufficient for the corrective actions to be taken. If the Contractor fails or refuses to comply promptly, the Contracting Officer may issue an order stopping all or part of the work and may hold the Contractor in default.

V. INVOICES:

0. Invoices shall be submitted monthly in arrears in accordance with 852.232-72 ELECTRONIC SUBMISSION OF PAYMENT REQUESTS (NOV 2018)

0. Payments shall be made in arrears upon receipt of a properly prepared invoice

0. The VA has mandated electronic invoice submission to the Veterans Affairs Financial Services Center (VAFSC). VAFSC has partnered with Tungsten Network e-Invoicing network, for submissions of all electronic invoices to VA. Tungsten Network electronic invoicing is free to all VA vendors. In order to submit electronic invoices, all VA vendors must register with Tungsten Network by submitting an email to VA.Registration@Tungsten-Network.com or calling 1-877-489-6135 for Enrollment.

0. All invoices shall reference the vendor’s name and address, customer name, contract number, appropriate obligation/funding order number, description of services provided, quantity, unit price, and total invoice amount (any additional info). Invoices shall also include any payment discount terms.

0. Invoices must include CLIN/SLINS from the schedule of the contract in order to ensure timely reconciliation and payment. Each station will provide a unique PO number.

W. Other Pertinent Information or Special Considerations.

0. Laws and Ordinances. The contractor shall comply with all applicable laws, ordinances, and regulations (Federal, State, City or otherwise) covering operations performed under this contract. Contractor shall be bonded, insured, and certified by the National Association for Information Destruction, Inc. (NAID) for paper/printed media destruction if applicable, and/or be sufficiently knowledgeable of the following guidelines and practices:

0. Association for Records Managers and Administrators, International (ARMA)

0. American Society for Industrial Security (ASIS)

3) Privacy Act of 1974, 5 USC 552a

4) Federal Records Act, 44 USC Chapter 31

7) VA Directive 6300, Records and Information Management

8) VA Directive 6500, Information Security Program

9) VA Handbook 6500.1, Electronic Media Sanitization

0. Contractor is responsible for maintaining all containers in clean, odor free, secure, and safe condition.

0. Contracting Officer’s Representative (COR). At the time of contract award, the VA shall designate a COR to represent the contracting officer in furnishing technical guidance and advice regarding the work being performed under this contract. The foregoing is not to be construed as authorization to interpret or furnish advice and information to the contractor.

0. Liability Insurance. Contractor must maintain liability insurance in the amount of $1 million to include covering claims of negligence and/or other torts alleged to have been committed by the Contractor, its employees, and/or its sales representatives, including, but not limited to, any allegations arising out of the presence of the Contractor's representatives in patient care areas. Contractor will provide Government with proof of insurance upon request. All representatives of the Contractor who will be present in-patient care areas will comply with all applicable Government policies governing visitors to patient care areas. Contractor agrees to defend, indemnify, and hold harmless Government and any agents and employees of Government from any and all liabilities, claims, actions, or suits for personal injury or death arising out of or in connection with the presence of Contractor's representatives in patient care areas. Defense of any claims against Government entities will be conducted in accordance with the procedures of the United States Department of Justice governing claims under the Federal Tort Claims Act.

0. APPLICABLE PUBLICATIONS: The Contractor must abide by all applicable regulations, publications, manuals, and local policies and procedures listed below. VA Handbooks and Directives can be found at the VA Publications site at http://www.va.gov/vapubs/. Note: This list may not be all-inclusive for the requirements listed in this section.

i. VA Handbook 6371, dated April 8, 2014 – Destruction of Temporary Paper Records

ii. VA Handbook 6500, dated September 18, 2007 – Information Security Program

iii. VA Handbook 6500.6, dated March 12, 2010 – Contract Security

iv. VA Directive 6371, dated April 8, 2014 – Destruction of Temporary Paper Records

v. VA Directive 6500, dated September 20, 2012 – Managing Information Security Risk: VA Information Security Program

2. INFORMATION AND INFORMATION TECHNOLOGY SECURITY REQUIREMENTS:

The contractor, their personnel, and their subcontractors shall be subject to the Federal laws, regulations, standards, and VA Directives and Handbooks regarding information and information system security as delineated in this contract.

Contractors, contractor personnel, subcontractors, and subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security.

The contractor/subcontractor will report any incident or breach of information to the COR and facility Privacy Officer within one (1) hour of becoming aware of the incident.

A contractor/subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order.

All contractors, subcontractors, and third-party servicers and associates working with VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures.

Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the contractor/subcontractor's rights to use data as described in Rights in Data - General, FAR 52.227-14(d)(1).

The contractor/subcontractor must receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with the terms of the contract and applicable Federal and VA information confidentiality and security laws, regulations and policies. If Federal or VA information confidentiality and security laws, regulations and policies become applicable to the VA information or information systems after execution of the contract, or if NIST issues or updates applicable FIPS or Special Publications (SP) after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations and policies in this contract.

The contractor/subcontractor shall not make copies of VA information except as authorized and necessary to perform the terms of the agreement or to preserve electronic information stored on contractor/subcontractor electronic storage media for restoration in case any electronic equipment or data used by the contractor/subcontractor needs to be restored to an operating state. If copies are made for restoration purposes, after the restoration is complete, the copies must be appropriately destroyed.

If VA determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be enough grounds for VA to withhold payment to the contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12.

Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor/subcontractor may use and disclose VA information only in two other situations: (i) in response to a qualifying order of a court of competent jurisdiction, or (ii) with VA's prior written approval. The contractor/subcontractor must refer all requests for, demands for production of, or inquiries about, VA information and information systems to the VA contracting officer for response.

Notwithstanding the provision above, the contractor/subcontractor shall not release VA records protected by Title 38 U.S.C. 5705, Confidentiality of Medical Quality Assurance Records and/or Title 38 U.S.C. 7332, Confidentiality of Certain Health Records Pertaining to Drug Addiction, Sickle Cell Anemia, Alcoholism or Alcohol Abuse, or Infection with Human Immunodeficiency Virus. If the contractor/subcontractor is in receipt of a court order or other requests for the above-mentioned information, that contractor/subcontractor shall immediately refer such court orders or other requests to the VA contracting officer for response.

The term "security incident" means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. The contractor/subcontractor shall immediately notify the COR and simultaneously, the designated ISO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/subcontractor has access.

To the extent known by the contractor/subcontractor, the contractor/subcontractor's notice to VA shall identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the VA information or assets were placed at risk or compromised), and any other information that the contractor/subcontractor considers relevant.

With respect to unsecured protected health information, the business associate is deemed to have discovered a data breach when the business associate knew or should have known of a breach of such information. Upon discovery, the business associate must notify the covered entity of the breach. Notifications need to be made in accordance with the executed business associate agreement (BAA).

14.In instances of theft or break-in or other criminal activity, the contractor/subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG and Security and Law Enforcement. The contractor, its employees, and its subcontractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The contractor/subcontractor shall cooperate with VA in any civil litigation to recover VA information, obtain monetary or other compensation from a third- party for damages arising from any incident, or obtain injunctive relief against any third-party arising from, or related to, the incident.

16. Consistent with the requirements of 38 U.S.C. §5725, a contract may require access to sensitive personal information or personally identifiable information. If so, the contractor is liable to VA for liquidated damages in the event of a data breach or privacy incident involving any SPI the contractor/subcontractor processes or maintains under this contract.

The contractor/subcontractor shall provide notice to VA of a "security incident" as set forth in the Security Incident Investigation section above. Upon such notification, VA must secure from a non-Department entity or the VA Office of Inspector General an independent risk analysis of the data breach to determine the level of risk associated with the data breach for the potential misuse of any sensitive personal information involved in the data breach. The term “data breach” means the loss, theft, or other unauthorized access, or any access other than that incidental to the scope of employment, to data containing sensitive personal information, in electronic or printed form, that results in the potential compromise of the confidentiality or integrity of the data. Contractor shall fully cooperate with the entity performing the risk analysis. Failure to cooperate may be deemed a material breach and grounds for contract termination.

Each risk analysis shall address all relevant information concerning the data breach, including the following:

(a) Nature of the event (loss, theft, unauthorized access);

(b) Description of the event, including:

(i) date of occurrence;

(ii) data elements involved, including any PII, e.g.: full name, social security number, date of birth, home address, account number, disability code;

(c) Number of individuals affected or potentially affected;

(d) Names of individuals or groups affected or potentially affected;

(e) Ease of logical data access to the lost, stolen or improperly accessed data considering the degree of protection for the data, e.g., unencrypted, plain text;

(f) Amount of time the data has been out of VA control;

(g) The likelihood that the sensitive personal information will or has been compromised (made accessible to and usable by unauthorized persons);

(h) Known misuses of data containing sensitive personal information, if any;

(i) Assessment of the potential harm to the affected individuals;

(j) Data breach analysis as outlined in 6500.2 Handbook, Management (Security and Privacy Incidents), as appropriate; and

(k) Whether credit protection services may assist record subjects in avoiding or mitigating the results of identity theft based on the sensitive personal information that may have been compromised.

Based on the determinations of the independent risk analysis, the contractor shall be responsible for paying to the VA liquidated damages in the amount of $37.50 per affected individual to cover the cost of providing credit protection services to affected individuals consisting of the following:

(a) Notification;

(b) One year of credit monitoring services consisting of automatic daily monitoring of at least three (3) relevant credit bureau reports;

(c) Data breach analysis;

(d) Fraud resolution services, including writing dispute letters, initiating fraud alerts and credit freezes, to assist affected individuals to bring matters to resolution;

(e) One year of identity theft insurance with $20,000.00 coverage at $0 deductible; and

(f) Necessary legal expenses the subjects may incur to repair falsified or damaged credit records, histories, or financial affairs.

20. All contractor employees and subcontractor employees requiring access to VA information and VA information systems shall complete the following before being granted access to VA information and its systems:

· Sign and acknowledge (either manually or electronically) understanding of and responsibilities for compliance with the Contractor Rules of Behavior, relating to access to VA information and information systems;

· Successfully complete the VA Cyber Security Awareness and Rules of Behavior training and annually complete required security training;

· Successfully complete the appropriate VA privacy training and annually complete required privacy training; and

· Successfully complete any additional cyber security or privacy training, as required for VA personnel with equivalent information system access (to be defined by the VA program official and provided to the contracting officer for inclusion in the solicitation document - e.g., any role-based information security training required in accordance with NIST Special Publication 800-16, Information Technology Security Training Requirements.)

The contractor shall provide to the contracting officer and the COR a copy of the training certificates and certification of signing the Contractor Rules of Behavior for each applicable employee within one (1) week of the initiation of the contract and annually thereafter, as required.

(a) Note – all employees who have access to VA information is required to take the training. This includes the drivers who pick up the information, the workers in the plant who sort and shred the information, etc.

Failure to complete the mandatory annual training and sign the Rules of Behavior annually, within the timeframe required, is grounds for suspension or termination of all physical or electronic access privileges and removal from work on the contract until such time as the training and documents are complete.

A. PRIVACY TRAINING: The contractor and all subcontractors are required to complete annual privacy training TMS 20939. The document should be read and signed and returned to the COR and Privacy Officer.

B. CONFIDENTIALITY: Contractor shall have a complete, approved Business Associate Agreement (BAA) with the VA.

NO KEYS SHALL BE PROVIDED FOR ANY CONTAINERS TO VA PERSONNEL WITHOUT THE APPROVAL IN WRITING BY THE CONTRACTING OFFICER

C. RECORD MANAGEMENT: When Federal agencies acquire goods or services, they need to determine what Federal records management requirements should be included in the contract. Federal contractors often create, send, or receive Federal records. Federal contracts should provide clear legal obligations describing how the contract employees must handle Federal records. Agency records officers, procurement counsel, and acquisitions officers must discuss how to integrate records management obligations into their existing procurement processes. NARA has developed the following language to be included as an agency-specific term and condition in Federal contracts for a variety of services and products. The majority of contracts should include language on records management obligations, but each contract should be evaluated individually. For example, the data-rights paragraph (Paragraph 10 below) may not be appropriate for all contracts. Instead, agencies may be better served by one of the established data-rights clauses in the Federal Acquisition Regulations.

This language should not replace specific records management requirements included within Federal information system contracts.

RECORDS MANAGEMENT OBLIGATIONS

A. Applicability This clause applies to all Contractors whose employees create, work with, or otherwise handle Federal records, as defined in Section B, regardless of the medium in which the record exists.

B. Definitions “Federal record” as defined in 44 U.S.C. § 3301, includes all recorded information, regardless of form or characteristics, made or received by a Federal agency under Federal law or in connection with the transaction of public business and preserved or appropriate for preservation by that agency or its legitimate successor as evidence of the organization, functions, policies, decisions, procedures, operations, or other activities of the United States Government or because of the informational value of data in them.

The term Federal record:

C. Requirements

1. Contractor shall comply with all applicable records management laws and regulations, as well as National Archives and Records Administration (NARA) records policies, including but not limited to the Federal Records Act (44 U.S.C. chs. 21, 29, 31, 33), NARA regulations at 36 CFR Chapter XII Subchapter B, and those policies associated with the safeguarding of records covered by the Privacy Act of 1974 (5 U.S.C. 552a). These policies include the preservation of all records, regardless of form or characteristics, mode of transmission, or state of completion.

2. In accordance with 36 CFR 1222.32, all data created for Government use and delivered to, or falling under the legal control of, the Government are Federal records subject to the provisions of 44 U.S.C. chapters 21, 29, 31, and 33, the Freedom of Information Act (FOIA) (5 U.S.C. 552), as amended, and the Privacy Act of 1974 (5 U.S.C. 552a), as amended and must be managed and scheduled for disposition only as permitted by statute or regulation.

3. In accordance with 36 CFR 1222.32, Contractor shall maintain all records created for Government use or created in the course of performing the contract and/or delivered to, or under the legal control of the Government and must be managed in accordance with Federal law. Electronic records and associated metadata must be accompanied by sufficient technical documentation to permit understanding and use of the records and data.

4. [Agency] and its contractors are responsible for preventing the alienation or unauthorized destruction of records, including all forms of mutilation. Records may not be removed from the legal custody of [Agency] or destroyed except for in accordance with the provisions of the agency records schedules and with the written concurrence of the Head of the Contracting Activity. Willful and unlawful destruction, damage or alienation of Federal records is subject to the fines and penalties imposed by 18 U.S.C. 2701.