36C25618U0090-000.docx

DOCX document 34 KB Posted Jul 30, 2018

Attached to: Virtual Enviroment and Centralized Storage Seeking sources only Federal contract opportunity
Solicitation number: 36C25618U0090
Issued by: Department of Veterans Affairs Veterans Health Administration Veterans Integrated Service Network 17

About this file

From the source

36C25618U0090 36C25618U0090.docx

View the file

On GovTribe

Work with this file on GovTribe

Download the original file
Contacts named in this file
Similar government files
Ask GovTribe AI about this file

Try for free Login

Text version

The file's text, extracted by GovTribe without its formatting.

FedBizOpps Sources Sought Notice

CLASSIFICATION CODE

SUBJECT

CONTRACTING OFFICE'S

ZIP-CODE

SOLICITATION NUMBER

RESPONSE DATE (MM-DD-YYYY)

ARCHIVE

DAYS AFTER THE RESPONSE DATE

RECOVERY ACT FUNDS

SET-ASIDE

NAICS CODE

CONTRACTING OFFICE

ADDRESS

POINT OF CONTACT

(POC Information Automatically Filled from User Profile Unless Entered)

DESCRIPTION

See Attachment

AGENCY'S URL

URL DESCRIPTION

AGENCY CONTACT'S EMAIL

ADDRESS

EMAIL DESCRIPTION

ADDRESS

POSTAL CODE

COUNTRY

ADDITIONAL INFORMATION

GENERAL INFORMATION

PLACE OF PERFORMANCE

* = Required Field FedBizOpps Sources Sought Notice Rev. March 2010 Virtual Enviroment and Centralized Storage Seeking sources only 77030 4298 36C25618U0090 08-31-2018 N 334111 Department of Veterans Affairs Network Contracting Office 1 2002 Holcombe Boulevard Houston TX 77030 4298 Michael E DeBakey VA Medical Center 2002 Holcombe Boulevard Houston, TX 77030 United States corey.labbe@va.gov THIS IS A SOURCES SOUGHT ANNOUNCEMENT FOR INFORMATION ONLY. THIS IS NOT A SOLICITATION FOR PROPOSALS AND NO CONTRACT WILL BE AWARDED FROM THIS ANNOUNCEMENT. The purpose of this notice is to conduct market research and obtain information from qualified businesses with special interest in seeking: Small Businesses (SB); VA certified Service Disabled Veteran owned Business (SDVOSB), Veteran Owned Small Business (VOSB) small business concerns; and vendors who hold GSA/FSS schedules. No solicitation is being issued at this time. All information submitted in response to this announcement is voluntary; the Government will not pay for information requested nor will it compensate any respondent for any cost incurred in developing information provided to the Government.

The Michael E. DeBakey VA Medical Center (MEDVAMC), 2002 Holcombe Blvd, Houston, TX 77030 has a requirement for Virtual Environment and centralized storage.

See the attached requirement summary.

The appropriate NAICS Code 334111 (Electronic Computer Manufacturing) and the small business size standard is 1,250.

Email statements of capabilities to corey.labbe@va.gov outlining your company's capability and provide the business size status in accordance with the small business administration website (www.sba.gov) for the above referenced NAICS code. Your responses must be submitted by 10:00 am (CST) on Friday, August 3 2018. No submissions will be accepted after this date and time. This notice is to assist the VA in determining sources only. A solicitation is not currently available. If a solicitation is issued it will be announced at a later date, and all interested parties must respond to that solicitation announcement separately from the responses to this announcement. Responses to this sources sought notice are not considered adequate responses to any future solicitation announcements.

STATEMENT OF WORK

Virtual Environment Michael E. DeBakey VA Medical Center April 23, 2018

1.	Program Objective
	1.1	Contractor shall provide all equipment, labor, material, hardware, software, licensing, warranty, installation, user training, and supplies necessary install a virtual environment and centralized storage system at the Michael E. DeBakey VA Medical Center (MEDVAMC) located at 2002 Holcombe Blvd., Houston, Texas 77030. The Michael E. DeBakey VA Medical Center shall provide all power requirements and all Rackspace as required.

2. Scope:

2.1 The contractor shall provide a comprehensive turnkey Virtual Environment, server and backup, solution that enables MEDVAMC to improve clinical care.

2.2 Necessary system capabilities are described below:

	2.2.1	Ability and capacity to create at least 80 Windows/Linux based virtual machines.
	2.2.2	System must have 300TeraBytes of spinning disk space.
	2.2.3	1280GB DDR4 Memory
	2.2.4	120 Core processors (physical)
	2.2.5	16TeraByes of SSD disk space
	2.2.6	Convergence of industry standard x86 compute and storage in a single distributed platform with all intelligence in software
	2.2.7	100% Software driven system with no dependencies on proprietary hardware
	2.2.8	Redundant components with no single point of failure in the system.
	2.2.9	Aggregation of direct-attached storage resources across all nodes in the cluster into a pool that is accessible to all hosts.
	2.2.10	Support for a broad range of server hardware enabling infrastructure flexibility and maximizing performance.
2.2.11 Qualified hardware from more than 1 server vendor

2.2.12 Wide variety of different server models, CPU options, and memory configurations

2.2.13	Broad range of different server footprints supporting high density configurations and high performance/large capacity/storage only configurations
2.2.14	Customer can choose the exact configuration for the system at time of order (e.g. ‘Config to Order’ procurement model)
	2.2.15	Support for non-identical server models and configurations in the same cluster
	2.2.16	Virtual graphics processing unit (GPU) support
	2.2.17	Support for a wide variety of storage architectures and enterprise class data features, enabling infrastructure flexibility and maximizing performance.
	2.2.18	Uses local non-shared direct attached storage
2.2.19	Support for enterprise class storage features (Deduplication, Compression, Erasure Coding,		Snapshots, Clones, Replication, etc.)
2.2.20	Snapshots, Clones and Replication applied at a VM level (not LUN/Volume based)
2.2.21	Software-defined aggregation of direct-attached storage resources across all nodes in the cluster into a pool that is accessible to all hosts
2.2.22	Intelligent Data Tiering across SSDs and HDDs (e.g. SSD used beyond a simple cache)
2.2.23	Flash/SSDs contribute to the overall capacity of the aggregated storage pool
2.2.24	Ability to pin VMs with high performance requirements (e.g. VDI gold image) to the flash tier.
2.2.25	Support for hybrid (flash + SSD) nodes
2.2.26	Support for all-flash nodes
2.2.27	Support for storage only nodes (providing the ability to independently scale compute and storage)
2.2.28	Support for non-identical storage nodes in the same cluster
2.2.29	Support for NFS
2.2.30	Support for CIFS/SMB3
2.2.31	Support for iSCSI
2.2.32	Minimum 1TB Write Buffer
2.2.33	Effective and efficient support for networking in a virtualized server infrastructure.
	2.2.34	IPv6 support for hypervisor and VM guests
	2.2.35	Support for 10GbE and 1GbE NICs
	2.2.36	No mandatory requirement for Jumbo frames
	2.2.37	Separate networks for virtual machine and management traffic
	2.2.38	Support for Virtual Distributed Switch (VDS) and Network I/O Control (NOIC)
	2.2.39	Open source virtual switch integration
	2.2.40	Placement of data in physical proximity to the application thus reducing overall network utilization and latency. Data re-localization to maintain network efficiency when VM moves to another node in the cluster.
2.2.41	Support for all mainstream hypervisors (ESXi, Hyper-V, KVM) giving customers choice and avoiding vendor lock-in.
2.2.42	Official support for mainstream hypervisors (ESXi, Hyper-V, KVM)
2.2.43	Single management interface for multiple hypervisor deployments
2.2.44	Ability to convert cluster from one hypervisor to another on the fly without data movement
2.2.45	Ability to mix different hypervisors between primary and DR datacenters (i.e. use an alternate hypervisor as a DR target)
2.2.46	Provides a flexible pay-as-you-grow deployment model that enables customers to expand cluster resources to meet real-time business demands with predicable linear scale while completely eliminating 3-5 year planning cycles, expensive over-provisioning and forklift upgrades forever.
2.2.47	Ability to add nodes non-disruptively
2.2.48	Ability to remove nodes non-disruptively
2.2.49	Ability to scale-out one node at a time
2.2.50	Ability to expand cluster resources in a scale-out model with predicable linear performance
2.2.51	Ability to scale storage capacity independent of compute
2.2.52	Platform scalability beyond hypervisor limitations (i.e. >64 nodes)
2.2.53	Management tool is built into the distributed system and scales with the cluster
2.2.54	All cluster nodes participate in a disk rebuild operation and disk rebuilds get more efficient as the cluster scales
2.2.55	Management shifts from infrastructure focused management to an application or VM-centric focused design.

2.2.56	Consumer Grade (designed to be simple and requires no specific knowledge of underlying infrastructure)
2.2.57	Application / VM-centric Design
2.2.58	Core management tasks completed in a single management tool
2.2.59	Single management tool supports multiple clusters in multiple geographic locations
2.2.60	Single management tool supports any hypervisor and manages mixed hypervisor environments
2.2.61	Management tool provides visibility of network infrastructure
2.2.62	Management tool deployment architecture is highly available by design
2.2.63	Management tool is built into the distributed system, scales with the cluster, and does not require separate hardware infrastructure
2.2.64	Platform includes a sizer feature to ‘right-size’ the initial configuration to support desired workloads
2.2.65	Management tool includes a capacity planning feature to ‘right size’ expansion to support application growth and addition of new workloads.
2.2.66	Management tool provides Predictive Analysis and Capacity Optimization
2.2.67	Management tool supports customizable dashboards
2.2.68	Management tool has ‘Google Like’ search capabilities
2.2.69	Support for Rest APIs
2.2.70	Support for Powershell cmdlets
2.2.71	Platform integration with vRealize Automation
2.2.72	Platform integration with OpenStack
2.2.73	Platform integration with Windows Azure Pack
2.2.74	Hyper-converged systems should support autonomous healing and non-disruptive updates
2.2.75	Ability to automatically recover from failures without user intervention (disk, node, etc.)
2.2.76	Ability to automatically re-direct IO to another controller VM in the even the local CVM goes offline (autopathing)
2.2.77	Ability to update hyper-converged system software in 1-2 clicks with no impact to running workloads
2.2.78	Ability to update host hypervisor in 1-2 clicks with no impact to running workloads
2.2.79	Ability to update hardware firmware in 1-2 clicks with no impact to running workloads
2.2.80	Ability to perform updates from a single management interface without need for 3rd party tools
2.2.81	Support for distributed data protection and recoverability features
2.2.82	Support for multiple data resiliency options in a single cluster (e.g. Replication Factor 2 or 3)
2.2.83	Ability to set custom RF level for each workload across the cluster
2.2.84	Software defined resiliency across distributed system (as opposed to local hardware defined RAID)
2.2.85	Support for synchronous and asynchronous data replication
2.2.86	Integrated VM/virtual disk level backup and recovery solutions
2.2.87	Official support from mainstream enterprise data protection software (Commvault, Veeam, etc.)
2.2.88	Support for native snapshot based backups at VM and virtual disk level
2.2.89	Disk from across the cluster participates in a disk rebuild operation and disk rebuilds get more efficient as the cluster scales
2.2.90	Self Service Granular Restore (e.g. users can restore individual files from a local VM snapshot without admin involvement)
2.2.91	Support for enterprise class storage technologies that drive efficient storage utilization and maximize data efficiency.
2.2.92	Deduplication (storage capacity savings for workloads with redundant data sets)
2.2.93	Compression (storage capacity savings for workloads with binary level redundancy with data blocks)
2.2.94	Erasure Coding (capacity efficient data resiliency)
2.2.95	Auto-Rebalancing of data across the cluster (eliminating hotspots and enabling efficient flash wear leveling)
2.2.96	Thin Provisioning
2.2.97	Reduction in data center footprint over traditional 3-tier architecture
2.2.98	Provides a single platform that can run all workloads, reduce infrastructure complexity and eliminate resource silos.
2.2.99	Eliminates the need for application specific storage devices (SAN, NAS, DAS) and associated resource silos
2.2.100	Single product roadmap for entire solution, eliminating complex multi-vendor solutions with disjointed roadmaps and conflicting priorities
2.2.101	True single support organization for entire solution
2.2.102	Support for mainstream database software and application middleware
2.2.103	Customer references and case studies for all major applications

2.2.104 Support for enterprise class features that enable multi-site configurations.

2.2.105	Support for Stretch or Metro Clustering across a WAN or metropolitan area network
2.2.106	Support for synchronous and asynchronous replication between sites
2.2.107	Automated site-to-site failover and failback
2.2.108	Support for non-identical server and storage configurations in the remote site
2.2.109	Replication at a VM or Virtual Disk Level (as opposed to LUN/Volume granularity)
2.2.110	Ability to seamlessly integrate with public and hybrid clouds and manage any workload regardless of where it operates.
2.2.111	Ability to run hyper-converged software in the public cloud
2.2.112	Ability to use Amazon Web Services as a target for long term data retention for backup, disaster recovery, and archival.
2.2.113	Ability to use Azure as a target for long term data retention for backup, disaster recovery, and archival.
2.2.114	Fully integrated cloud based backup with no cloud-specific management tools required
2.2.115	Features to ensure the hyper-converged platform is secure.
2.2.116	Platform hardened by default in code (instead of manually hardened after deployment)
2.2.117	Multifactor authentication for management interface
2.2.118	Logging and auditing of all administrative actions with mechanism to ensure log integrity
2.2.119	Encrypted management traffic by default
2.2.120	Support for Self Encrypting Drives (validated to FIPS 140-2 Level 2 Compliant)
2.2.121	Self-Remediating Security Automation (system automatically reverts back to approved secure state at designated interval)
2.2.122	Fully automated Security Technical Implementation Guide STIG compliance
2.2.123	Maintain compliance with the following:

· Sarbanes Oxley (SOX)

· Security Technical Implementation Guide (STIG)

· Payment Card Industry – Data Security Standard (PCI-DSS)

· Health Insurance Portability and Accountability Act (HIPPA)

· US Federal Risk and Authorization Management Program (FedRAMP)

· Intelligence Community Directive Certification and Accreditation for US Intelligence Agencies (IDC 503)

· US Department of Defense Information Assurance Certification and Accreditation Process (DIACAP)

2.3 The virtual environment provider must provide support and maintenance services for the first five years after purchase.

2.3.1 Technical Support:

2.3.1.1. Must include 24x7x365 software maintenance and support for all (hardware &) softwarecomponents of the proposed solution, including updates and patches as well as technicalsupport available via telephone, email, and web during all hours (24 hours per day, 365 days per year).

2.3.1.2. Must provide US-soil-based support.

2.3.2 Parts Replacement:

2.3.2.1 Parts replacement delivery will include 4-hour delivery.

2.4 The vendor shall provide a ninety-day warranty at a minimum.

2.5 DELIVERY, INSTALLATION AND IMPLEMENTATION

2.5.1	DELIVERY
	2.8.1.1	Contractor shall deliver all equipment to the basement (BA-200) in the Michael E. DeBakey VA Medical Center, 2002 Holcombe Blvd. Houston, TX 77030.
	2.8.1.2	Deliver materials to job in manufacturer's original sealed containers with brand name marked thereon.
	2.8.1.3	Package to prevent damage or deterioration during shipment, handling, storage, and installation. Maintain protective covering in place and in good repair until removal is necessary.
	2.8.1.4	Deliver specified items only when the site is ready for installation work to proceed.
	2.8.1.5	Store products in dry condition inside enclosed facilities.
	2.8.1.6	Any government requested delayed delivery up to 90 days after initial award delivery date, shall be at no additional cost to the Government.
	2.8.1.7	A pre-delivery meeting will be conducted 60 days prior to initial award delivery date for verification of delivery and installation dates.
	2.8.1.8	Delivery and Installation will be coordinated through the COR.

2.5.2	INSTALLATION AND IMPLEMENTATION
		2.5.2.1	The contractor shall provide installation and implementation project management to include site visits for each building to confirm physical installation of the Integration system. Contractors shall provide a final project schedule within 10 days of award.

2.5.2.2 The hospital is responsible for furnishing all conduit and raceways unless specified otherwise on the delivery order.

2.5.2.3 The contractor shall be responsible for all equipment until installed and accepted by the Government.

2.5.2.4 All required equipment shall be fully installed by the Contractor, to include painting and patching of walls penetrated by the Contractor.

2.5.2.5 The Contractor shall remove all related shipping debris and cleanup, any construction associated with delivery and installation of the specified items. Contractor shall remove all packaging from the MEDVAMC premises. The Contractor shall be responsible for any damage to the building that occurs due to Contractor error or neglect.

2.5.2.6 The contractor shall coordinate all deliveries, staging areas, installations, and parking arrangements with the COR.

2.5.2.7 Upon coordination with COR for installation, the contractor shall inform the Contracting Officer of any problems which may be anticipated about installation or which will affect optimum performance once installation is completed.

2.5.3	INSTALLATION SCHEDULE
		2.8.5.1	The buildings will be available for cabling installation upon award of the contract.

2.5.3.2 Phasing Schedule:

· Final Approved Schedule: 10 Days after Award

· Network Design Plan: 30 Days after Award

· Physical Installation: 75 Days after Award, but the installation cannot occur until the Network Plan is approved by the COR

· Implementation Phase 1 (Outpatient): 25 Days after Server Installation

· Implementation Phase 2 (Inpatient): 75 days after award

2.5.4	SITE CONDITIONS
		2.8.4.1	There shall be no smoking, eating, or drinking inside the hospital at any time unless done so in designated smoking and dining areas respectively.

3.	PERIOD OF PERFORMANCE:
	3.1	The anticipated Period of Performance for delivery and installation is from October 1, 2019 to June 1, 2020. See paragraph 2.5.3.2 for estimated phasing.

3.2 The anticipated period of performance for support services from the warranty is at a minimum from June 1, 2019 to June 1, 2024. Support services begin when physical installation and final implementation of all buildings are complete.

4.	INSPECTION AND ACCEPTANCE
	4.1	The Contractor shall conduct a joint inspection with the COR once all equipment had been delivered and installed. The COR shall inspect all phases of delivery and installation and provide a punch list of any and all missing or damaged products.

4.2 Contractor shall provide dates of completion of punch list items and replacement parts and/or short ship items from the manufacturer(s).

4.3 The COR shall ensure all work is completed satisfactorily prior to acceptance. Disputes shall be resolved by the Contracting Officer.

5.	DELIVERABLES
	5.1	The contractor shall provide a proposed system design to be approved by the COR.

5.2 Contractor shall provide documentation of the network and include a marked up drawing (as built) showing jacks and room locations after the installation is complete.

5.3 The Contractor shall provide a Final Schedule that can be imported into Microsoft Project.

5.4	User and Service Manuals
	5.4.1	The Contractor shall provide, at no charge, two (2) complete and unabridged printed copies and one (1) electronic version (CD) of operator manuals, service manuals, electronic schematics, troubleshooting guides and parts lists for each model of equipment purchased to the Contracting Officer’s Representative (COR) with delivery of equipment. Additionally the Contractor free of charge shall provide any upgrades to these documents. These manuals will include all components and subassemblies, including those not manufactured by the Contractor. These manuals and documentation shall contain the diagnostic codes, commands, and passwords utilized in maintenance, repair and calibration of the equipment.

6.	PROTECTION OF PROPERTY
	6.1	Contractor shall protect all items from damage. The Contractor shall take precaution against damage to the building(s), grounds and furnishings. The Contractor shall repair or replace any items related to building(s) or grounds damaged accidentally or on purpose due to actions by the Contractor.

6.2 The Contractor shall perform an inspection of the building(s) and grounds with the COR prior to commencing work. To insure that the Contractor shall be able to repair or replace any items, components, building(s) or grounds damaged due to negligence and/or actions taken by the Contractor. The source of all repairs beyond simple surface cleaning is the facility construction contractor (or appropriate subcontractor), so that building warranty is maintained. Concurrence from the VA Facilities Management POC and COR is required before the Contractor may perform any significant repair work. In all cases, repairs shall utilize materials of the same quality, size, texture, grade, and color to match adjacent existing work.

6.3 The Contractor shall be responsible for security of the areas in which the work is being performed prior to completion.

6.4 Contractor shall provide floor protection while working in all VA facilities. All material handling equipment shall have rubber wheels.

7.	PERFORMANCE REQUIREMENTS SUMMARY
		7.1	The Contractor shall provide a proposed Performance Requirements Summary (PRS) for review and approval.

8.	SECURITY REQUIREMENTS
	8.1	Contractor is responsible for notifying COR for escorting duties prior to arriving at the facility. Contractor personnel shall check in with Biomed located in BA-200 upon arrival and departure each day. All contractor personnel must provide one form of valid picture identification at the time of check-in to receive a visitor’s badge. Badges must be worn above the waist and visible at all times while on the jobsite. All contractor personnel will be accompanied by a cleared member of the contractor (PIV cardholder) or MEDVAMC representative at all times while on the jobsite. All contractor personnel must turn-in their badges at the end of each day.

8.2 Contractor is responsible for notifying COR for vehicle parking prior to arriving at the facility. All contractor personnel must provide vehicle insurance, registration and valid driver’s license at the time of check-in to receive a vehicle-parking pass. Vehicle parking passes must be displayed on the front dashboard of the registered vehicle at all times while on MEDVAMC property. Contractor personnel will be allowed to register up to five (5) vehicles only. All contractor personal vehicles will be allowed to park in the designated vehicle parking spaces in the parking lot as advised by the VA Police upon registering the vehicle. All contractor personnel must turn-in their vehicle parking passes at the end of each day.

8.3 Information System Security/Privacy Language: See Below.

No data, on any type of storage device will be removed from this VA location.

Information technology security requirements: The contractor, their personnel, and their subcontractors shall be subject to the Federal laws, regulations, standards, and VA Directives and Handbooks regarding information and information system security as delineated in this contract. The contractor shall comply with all Federal laws and regulations the VA has developed when VA sensitive information is accessed, used, stored, generated, transmitted, or exchanged by and between VA and a contractor. The information made available to the contractor by VA for the performance of this contract will be used only for the purposes of performance under this contract. The certification and accreditation requirements do not apply to this requirement and a security accreditation package is not required.

SECURITY STATEMENT: Sensitive VA information is contained within the systems covered by this contract.

Biomedical Engineering shall perform virus scans on all removable media prior to use on VA medical equipment. This includes all types of removable media, including media (e.g., USB devices, CDs, dongles, etc.) that has been issued by VA, media not issued by VA, and media brought in by vendors or independent service organizations. Within accordance of VA Directive 6500, Information Security Program, September 2007

The Vendor will not transfer any VA information to a location outside the VA and only to VA locations determined by the VA System Administrator. The information in these systems may be covered by the Privacy Act 1974 which contains criminal penalties of abuse of information.

During onsite service, the Vendor shall be chaperoned by VA Personnel. However, the vendor shall not be issued a UserID/Password.

Non-volatile memory devices, working or non-working, shall NOT be removed from the VA facility until the ISO has certified that the data has been destroyed. For magnetic devices and media, the data destruction will be by degaussing. Other forms of cleansing will be used for non-magnetic media.

The vendor will not have remote access to complete the repair(s) and preventive maintenance.

The vendor shall sign a Business Associate Agreement with the VA.

The COTR or designee is responsible for the actions of the vendor during the repair.

9.	RECORDS MANAGEMENT STATEMENT
	All records (administrative and program specific) created during the period of the contract belong to Michael E. Debakey VA Medical Center (MEDVAMC) and must be returned to MEDVAMC at the end of the contract or destroyed in accordance to the VHA Record Control Schedule (RCS)10-1.

9.1.	Citations to pertinent laws, codes and regulations such as 44 U.S.C Chapter 21 , 29, 31 and 33; Freedom of Information Act (5 U.S.C. 552); Privacy Act (5 U.S.C. 552a); 36 CFR Part 1222 and Part 1228.
9.2.	Contractor shall treat all deliverables under the contract as the property of the U.S. Government for which the Government Agency shall have unlimited rights to use, dispose of, or disclose such data contained therein as it determines to be in the public interest.
9.3.	Contractor shall not create or maintain any records that are not specifically tied to or authorized by the contract using Government ‘IT’ equipment and/or Government records.
9.4.	Contractor shall not retain, use, sell, or disseminate copies of any deliverable that contains information covered by the Privacy Act of 1974 or that which is generally protected by the Freedom of Information Act.
9.5.	Contractor shall not create or maintain any records containing any Government Agency records that are not specifically tied to or authorized by the contract or identified in the RCS 10-1.
9.6.	The Government Agency owns the rights to all data/records produced as part of this contract.
9.7.	The Government Agency owns the rights to all electronic information (electronic data, electronic information systems, electronic databases, etc.) and all supporting documentation created as part of this contract. Contractor must deliver sufficient technical documentation with all data deliverables to permit the agency to use the data.
9.8	Contractor agrees to comply with Federal and Agency records management policies, including those policies associated with the safeguarding of records covered by the Privacy Act of 1974. These policies include the preservation of all records created or received regardless of format [paper, electronic, etc.] or mode of transmission [e-mail, fax, etc.] or state of completion [draft, final, etc.].
9.9.	No disposition of documents will be allowed without the prior written consent of the Contracting Officer. The Agency and its contractors are responsible for preventing the alienation or unauthorized destruction of records, including all forms of mutilation. Willful and unlawful destruction, damage or alienation of Federal records is subject to the fines and penalties imposed by 18 U.S.C. 2701. Records may not be removed from the legal custody of the Agency or destroyed without regard to the provisions of the agency records schedules.
9.10 Contractor is required to obtain the Contracting Officer's approval prior to engaging in any contractual relationship (sub-contractor) in support of this contract requiring the disclosure of information, documentary material and/or records generated under or relating to this contract. The Contractor (and any sub-contractor) is required to abide by Government and Agency guidance for protecting sensitive and proprietary information.

Page 1 of

File details come from the government source that posted it.