36C25626Q0115.docx

SUBJECT*

NOI Equip Lease Pitney Bowes IDIQ#36C10X25D0005 Contract Delivery Order for Shreveport VAMC

GENERAL INFORMATION

Network Contracting Office 16 5075 Westheimer Road, Suite 750

Houston TX 77056-5643

POINT OF CONTACT*

Contracting Officer Le Kisha Douglas, MPA LeKisha.Douglas@va.gov 713-794-7421

ADDITIONAL INFORMATION

AGENCY’S URL

URL DESCRIPTION

AGENCY CONTACT’S EMAIL ADDRESS

EMAIL DESCRIPTION

DESCRIPTION

NOTICE OF INTENT TO AWARD SOLE SOURCE

I. The Network Contracting Office (NCO) 16, located at Galleria Financial Center, 5075 Westheimer Rd, Ste 750, Houston, TX 77056 in support Overton Brooks Medical Center of Shreveport, Louisiana, intends to solicit and award Sole Source, Firm-Fixed-Price, five-year task order to one Large Business Source, Pitney Bowes Global Financial Services, LLC.

Pitney Bowes Global Financial Services, LLC.

27 Waterview Drive Shelton, CT 06484-4301, United States The Overton Brooks VA Medical Center of Shreveport, Louisiana, is seeking a contractor that shall provide the leasing of digital mailing system equipment and software services required to meter mail, provides best cost shipping options, allows for accurate reporting, accountability of volume and expenditures and traceability of mail and parcels. All applicable hardware, software and support services must adhere to the United States Postal Service (USPS) Domestic Mail Manual (DMM) www.usps.gov, and shipping partners rules and regulations of those as United Parcel Service (UPS), Federal Express (FedEx), DHL, etc. The leased equipment shall include all mail processing equipment, web-based browser software, scalable cloud-based software solution for data hosting (with web-portal access), mail facility processing accessories, handheld scanners - all supported by maintenance and support services to keep all systems fully operational. Contract shall include a five-year delivery order. Coverage shall include updates to manufacturer software, firmware and hardware, as required.

The Government intends to sole-source the proposed requirement on the awarded National VA Contract (as awarded by the Strategic Acquisition Center- SAC). The proposed sole sourced order is against a firm-fixed-price, indefinite-delivery indefinite-quantity contract (IDIQ), 36C10X25D0005.

The rental equipment and software shall include all the equipment mentioned but not limited to all inspection, maintenance, and support services.

The potential exists for trade-in on current VA owned equipment. Model numbers listed below:

The installation, on current rented equipment. Model numbers listed below:

· Postage Meter Machine - S/N 6010560

· Postage Meter Monitor - S/N 5203893

· Folding Machine Paper Machine - S/N F790048

· Folding Machine Monitor - 3CM2040MN3

· RISO Equipment - S/N 34416590

· Thermal Printer – S/N 0008375

· HP Monitor - S/N 3CQ43914K6

· HP Monitor - S/N 3CQ84917TF

· HP Monitor - S/N CNK9210Q5M

· Scale - S/N 093140500024

· Scale - S/N 19318522512877

· Tower - S/N 0001646

· Tower - S/N 0004893

· Tower - S/N 0000241

· Pharmacy Equipment

· Pitney Bowes Printer – S/N 0020405

· Computer – S/N JLQ4223

· Monitor – S/N CN014KON74445065920U

II. The North American Industry Classification (NAICS) code for this acquisition is 532420, Office Machinery and Equipment Rental and Leasing. Size Standard $40M.

III. This procurement is being conducted under Federal Acquisition Regulation (FAR) Parts 12 and under the authority of FAR 6.302-1 in accordance with (IAW) FAR Part 13.106-1(b) Soliciting from a single source as well as IAW FAR 16.505(b)(2)(i)(B) – Only one capable source.

IV. The anticipated award date is December 20, 2025. The Government intends to award a Firm-Fixed-Price Contract/Delivery Order.

V. Please note that this is not a request for competitive quotes and is being posted for informational purposes only. The government does not anticipate receiving responses to this notice. However, interested parties who disagree with this action may submit a letter of interest that demonstrates your firm’s technical expertise, certifications, and original equipment manufacturer (OEM) authorization to compete for this acquisition to provide the required supplies to include a rationale for why you should be considered. The government reserves the right to verify any request additional documentation submitted.

VI. Interested parties may identify their interests, OEM authorization, OEM training and capability meet the government requirement and respond to this notice within four (4) calendar days of the publication of this notice. Any response to this notice must show clear and convincing evidence that competition would be advantageous to the Government.

Interested parties may identify their interest solely via email to Contracting Officer, Le Kisha Douglas, MPA LeKisha.Douglas@va.gov no later than December 16, 2025, 1300 Central Standard Time (CST). When responding to this announcement, respondents should include " 36C25626Q0115 Notice of Intent" in the subject line.

VII. Late responses may not be accepted. No telephone inquiries will be accepted nor will phone Special Notice Special Notice calls be returned. Only emailed responses will be considered. Information received will be utilized solely for determining whether to conduct a competitive procurement. A determination not to compete this proposed acquisition based upon responses to this notice is at the sole discretion of the Government.

Special Notice

Veterans Affairs Overton Brooks VA Medical Center

Mail and Shipping System Procurement & Rental

PERFORMANCE WORK STATEMENT (PWS)

DEFINITION AND ACRONYMS

BPA - Blanket Purchase Agreement CDR - Contract Discrepancy Report Contracting Officer (CO) - The person executing this contract on behalf of the Government with the authority to enter and administer contracts and make related determinations and findings.

Contracting Officer’s Representative (COR) - A person appointed by the CO to take necessary action to ensure the Vendor performs in accordance with and adheres to the specifications contained in the contract and to protect the interest of the Government. The COR shall report to the CO promptly any indication of non-compliance in order that appropriate action can be taken.

OIG – Office of Inspector General OSHA - U.S. Occupational Health and Safety Administration PHI – Patient Health Identifiers POC – Point of Contact POP - Period of Performance QASP - Quality Assurance Surveillance Plan OBVAMC - Overton Brooks VA Medical Center

SCOPE OF WORK

The OBVAMC intends to purchase digital mailing system equipment software and services required to meter mail, provides best cost shipping options, allows for accurate reporting, accountability of volume and expenditures and traceability of mail and parcels. All applicable hardware, software and support services must adhere to the United States Postal Service (USPS) Domestic Mail Manual (DMM) www.usps.gov, and shipping partners rules and regulations of those as United Parcel Service (UPS), Federal Express (FedEx), DHL, etc.

Also, OBVAMC intends to enter maintenance agreements and postage meter rental contract.

The purchased equipment shall include all mail processing equipment, web-based browser software, scalable cloud-based software solution for data hosting (with web-portal access), mail facility processing accessories, handheld scanners - all supported by maintenance and support services to keep all systems fully operational. The purchased equipment will additionally include the services of delivery, set-up, configuration, user training, complete functionality testing, sixty (60) days quantity of operating supplies and removal of old equipment (where applicable).

The rental equipment and software shall include all mentioned under purchased equipment but not limited to all inspection, maintenance, and support services.

The potential exists for trade-in on current VA owned equipment. Model numbers listed below:

The installation, on current rented equipment. Model numbers listed below:

· Postage Meter Machine - S/N 6010560

· Postage Meter Monitor - S/N 5203893

· Folding Machine Paper Machine - S/N F790048

· Folding Machine Monitor - 3CM2040MN3

· RISO Equipment - S/N 34416590

· Thermal Printer – S/N 0008375

· HP Monitor - S/N 3CQ43914K6

· HP Monitor - S/N 3CQ84917TF

· HP Monitor - S/N CNK9210Q5M

· Scale - S/N 093140500024

· Scale - S/N 19318522512877

· Tower - S/N 0001646

· Tower - S/N 0004893

· Tower - S/N 0000241

· Pharmacy Equipment

· Pitney Bowes Printer – S/N 0020405

· Computer – S/N JLQ4223

· Monitor – S/N CN014KON74445065920U

OBVAMC supply chain services Background Supply Chain Services OBVAMC is an indispensable component of the Veterans Affairs Overton Brooks Medical Center OBVAMC, providing comprehensive supply and logistical support to all OBVAMC facilities. Our core competency lies in procuring and delivering all the materials required for patient care, including medications, medical supplies, ADP equipment, and other essential items. OBVAMC is responsible for sourcing and distributing all these items.

OBVAMC Pharmacy Service and Materiel Management (MM).MM the Mailroom / Reproduction. The VA Mail Room's primary goal is to provide excellent customer service to all VA Medical Center staff and patients. We offer services to three off station locations, VA Buckner Square, VA Knight Street Clinic, VA Vet Center, and three outer CBOCs: Monroe, Texarkana, and Longview. We also provide UPS overnight service to all the clinics. Additional services, such as UPS overnight express mail. The following are the services we provide:

1. We process VA Business Mail daily.

2. We offer UPS overnight shipment services

3. We manage the United States Postal Mail for Pharmacy.

4. We assist VA Staff with Mail Code and Department Change requests.

5. We help with United States Postal Service-related queries.

6. We offer Reproduction Requests services.

In addition, we manage mail routing and mail routing symbols of the facility.

In FY24, SCS MM’s Mail Room’s 167,070 pieces of outgoing mail items and 32,323 parcels were processed via postage machines. The facility is seeking a comprehensive method of managing and processing mail as well as the ability to track packages once they arrive at their destination.

Place of PerformancE Equipment and software (procured and rented) and services provided under this PWS shall be performed at the following:

510 East Stone Avenue, Shreveport, Louisiana 71101

Rental

510 East Stone Avenue, Shreveport, Louisiana 71101

Rental

Period of Performance The Period of Performance shall be for 29 months from date of contract award. This individual task order shall not extend further 29 months from the date of task order award.

QASP

As per the Federal Acquisition Regulation (FAR) subparts 46.103, the contractor is required to create and implement a quality control plan that will report quality metrics to the vaobm OBVAMC COR to ensure high levels of performance throughout the contract's PoP. The quality control assurance plan must be provided to the respective CO and COR for review at least 10 business days before the contractor begins work. The plan should include, but is not limited to, the following aspects:

1. Monitoring to verify and ensure that the requirements and quality, as described by state and federal regulations, are met.

2. Maintaining compliance in operations training requirements/certification annually to current and new VA-designated team members.

3. Document management of all training, certifications, attestations, and other requirements. In the event of a survey/audit, the contractor should be ready and able to provide this documentation to OBVAMC.

4. Performing all mail system maintenance (both preventive and reparative). This maintenance includes all parts and labor. The contractor shall respond to all maintenance request within 24-hours of notification. Any portion of the mail system (procured and rental) that cannot be repaired shall replace within 2 days.

5. Ensuring inspection, maintenance, and support are provided within 24 hours. This may include but not limited to provision of contingency strategy in the event of unrepairable outcome of maintenance or any portion of the mail system (procured and rental) that cannot be repaired shall replace within 2 days.

MAIL SYSTEM REQUIREMENTS

The below chart depicts mail facility by size (Small, Medium, and Large) based on average OBVAMC processing volumes. The model provides users of the IDIQ and industry the ability to estimate requirements and proposed configurations. The table below shows that OBVAMC is a Large size facility.

· 10-100 parcels/day Mail Metering Machine (5.1, 5.2) Scalable Cloud Based Data Hosting (5.1) Mail Metering Software (5.3) Web-Based Mail Machine Software (5.3)

· 100-200 parcels/day

· 200+ parcels/day

OBVAMC requires cost effective digital metered mail system and associated USPS certified postal funds meter capability for its mail facilities. Equipment and software to be procured and/ rented are to be of the latest technologies associated with mail processing. The postage metering capability shall meet the performance and volume/throughput demands of the individual facility or facilities as defined in the requirements.

The digital mail metering system provided for use at OBVAMC must process at least 310 letters per minute (LPM), handle mail up to 3/4-inch thick, with a 1lb. dynamic weight scale which measures mail and determines, sets, and prints the appropriate postage (175 LPM w/o dynamic weight scale in use). The meter must have a scanner and labeler for certified mail.

OBVAMC requires contractor to provide compliance on requirements, its amendments, supplementary information and or appendments to document citation, 85 FR 78234, 39 CFR 501.

Postage Meter and System Requirements OBVAMC requires a certified postal funds meter capability associated with the United States Postal Service (USPS). To ensure a smooth and efficient mailing process, the mail system should be equipped to accurately scan, weigh, rate, meter, and account for all outbound mail and parcels. The equipment and software must include postage meters with remote capabilities allowing replenishment, usage and balance reporting, and software updates. The postage metering capability must comply with the Government Publishing Office (GPO) Code of Federal Regulations 41 CFR 102 – 192 – Mail Management and the Department of Treasury's requirement for using depositaries to hold public money, Chapter 4100 Section 4130. The mail system should also support VA carrier-negotiated USPS, UPS, and FedEx rates. This includes these carriers' discounted rates on the GSA Schedule 48 and any VA carrier-negotiated rates. Additionally, the multi-carrier shipping workstations with PC postage (web-based postage) should include the following features:

· 3 x shipping workstations that include Intelligent Mail Package Barcode (IMPB) processing for priority mail, first class parcels, and package services multi-carrier capability (i.e., USPS, and UPS) to allow for rate shopping and to ensure continuity of operations for package shipments.

· Two >70-pound scale for the mailroom location and (1) for the Pharmacy location.

· Workstation to include VA Provided PC. (2) in the mailroom, location, and (1) for the Pharmacy location, label printer, scales, barcode scanner and cube tape.

· Cloud Based Departmental/Categories Accounting

· Must have the ability to capture all usage through shipping workstations and current mail machines and combine in the cloud into a single report.

· Cloud services for tracking packages and viewing accounting information to include monthly reporting of number of pieces processed and dollar amount.

· Must be configured to allow for best rate selection (i.e., Priority Mail Commercial base and Priority Mail Commercial Plus).

· USPS – approved Intelligent Mail Indicia (IMI) system capability (printed indicia and mail system must be capable of providing USPS Commercial Plus Pricing on Priority and Express Mail).

· The contractor shall be responsible for updating software for Endicia, UPS Mailing and Shipping Software Requirements The contractor is required to provide and maintain the most up-to-date version of their software to ensure optimal operational performance. They should take all necessary measures to ensure uninterrupted flow of the software requirements and ensure that the software is consistently updated and maintained. The contractor is responsible for meeting all mailing and shipping software requirements, including but not limited to:

· Software shall be delivered and maintained at the contractors most current version.

· Software and application(s) shall support seamless processing of all carriers through automatic rate shopping.

· Software shall automatically determine the most economical delivery method for letters, flats, and parcels by examining criteria such as applied business rules, delivery time, priority, and transportation method. Upon identifying the most economical delivery method, the system shall produce the carrier compliant label.

· Software shall have the ability to capture and download postage, track, and determine how much postage has been downloaded; determine postage remaining on the meter, and report daily/monthly/yearly spending from the meter.

· Software shall be Cloud-based allowing local and remote access to mail machines.

· Mail machines shall have locally stored data which includes United States and International volumes and expenditures for USPS letters/flats/packages in all mail classes; and commercially provided expedited services in all shipping classes.

· Multi-carrier capability (i.e., USPS, and UPS) to allow for rate shopping and to ensure continuity of operations for package shipments.

The contractor must have a software solution must access VA carrier negotiated rates, USPS Commercial Plus Pricing (CPP), GSA Schedule 48 rates, and UPS and FedEx NGDS Rates. This includes USPS CMOP rates for pharmacy.

Additionally, the software must be cloud-based and capable of departmental and category accounting. Also, it must comply with all the requirements of Software-as-a-Service (SaaS).

The software applications must have FedRAMP authorization / compliant to protect VA PII information.

The Solicitation requires a cloud-based software solution for data hosting, including Personally Identifiable Information as defined in the Controlled Unclassified Information (CUI) Registry at http://www.archives.gov/cui/registry/category-list.html. Therefore, it is mandatory that the software for shipping, inbound tracking, and reporting must have a FedRAMP ATO issued by the VA.

The solution requires that VA names and addresses, which are PII, be transmitted outside the VA network. Hence, the component for shipping must have an ATO from the VA.

All equipment and software procured or rented must be Intelligent Mail Indicia (IMI) compliant. IMI compliance refers to acquiring a postage meter capable of sending and receiving data from the USPS securely and efficiently. As digitally based mailing systems rely on communication between the USPS and the meter itself, being IMI compliant means having a postage meter that meets these updated communication standards.

Mail System Accessory Requirements

· Sorters

· Shall count the number of pieces in a postal tray and have the ability to sort 310 pieces per day.

· Sorters shall leverage postal discounts and report mailing cost statistics.

· Digital Scale

· Digital scales shall provide the ability to electronically weigh postal and parcel items for shipping.

· Scales shall be USB capable for downloading weight to a computer or other connected devices.

· Facility processing requires scales able to handle weight ranges from 0-100 lbs.

Maintenance Support Requirements The contractor shall perform all mail system maintenance (both preventive and reparative). This maintenance includes all parts and labor. The contractor shall respond to all maintenance requests within 24-hours of notification. Any portion of the mail system that cannot be repaired shall be replaced within 2 days. Only qualified personnel, materials, spare parts, tool, hardware/software, and network components necessary to perform the service shall be provided by the contractor.

The contractor shall repair the mail system within 24-hours working hours after the request for the service call during the hours of 7:30 a.m. to 3:30 p.m. CST Monday through Friday (excluding Federal holidays).

The contractor shall regularly and systematically examine, clean, lubricate, test, adjust the equipment (procured and rental), and as conditions warrant, repair, or replace equipment included under the contract. The contractor shall ensure that the mail system (procured and rental) operates as originally designed and installed throughout the entire awarded contract period.

· The contractor maintenance shall include preventative maintenance at manufacturer-recommended intervals.

· The contractor shall provide complete remedial and preventive maintenance for the components of the installed solution.

· The contractor shall provide all replacement component parts as required to meet original equipment (procured and rental) performance at no additional cost to VA.

· The contractor shall provide an affixed label to equipment (procured and rental) which identifies equipment (procured and rental) make, model, device serial number, mail meter serial number and equipment (procured and rental) service support and contact information.

· Manuals, handbooks, or brochures shall be provided in hard copy, soft copy or with electronic access instructions, consistent with standard industry practices for the equipment or device (procured and rental).

Delivery, Installation, Operational Readiness and Transition Requirements

The Contractor must take full responsibility for installing and operating the mailing solution, including all necessary accessories as ordered. To ensure operational readiness, they must complete delivery, installation, configuration, and testing.

The Contractor must ensure internet connectivity to the postage meter for replenishment, rate change updates, and other necessary functions. They must thoroughly test remote diagnostics and troubleshooting as part of the operational readiness process.

The Contractor must provide shipping of mail equipment (procured and rental) to the mail facility or facilities at no cost to VA. VA will not reimburse the Contractor for shipping or freight costs.

Once the new solution is installed and fully operational, the Contractor must immediately remove old or discarded equipment (procured and rental) from the installation site. This must be done at no cost to VA.

In case of any facility renovation, the equipment (procured and rental) may need to be relocated to another area within the same building. At such time, VA will request a quote from the Contractor to modify the awarded contract. The Contractor must adhere to this requirement and provide a quote promptly.

Material and Supply Requirements

The Contractor shall provide the initial supplies for the Mailing System. This initial stock must be sufficient to cater to the requirements of the Mailing System for 60 business days. The stock must include ink, meter tape, sealing solution, and any other system-specific supplies necessary for the average use of the installed Mailing System for 60 business days.

The Contractor must provide the supplies on time and in quantity and quality. The supplies must be compatible with the Mailing System installed and should not have any adverse effect on the system's performance.

Suppose the Contractor fails to provide the supplies as per the contract agreement; a failed notification of performance evaluation will be provided to the national contracting officer.

Training Requirements

The contractor shall provide training at User site(s) to at least one key operator and three alternates for each solution installed with the following responsibilities but not limited to:

· The contractor shall provide and complete key operator training within two business days of the solution’s installation.

· The contractor shall schedule training in coordination with the local Mail Manager or COR.

· Training shall cover, at a minimum, the following operations: proper operation of the solution component(s), replacement and ordering of supplies, performance of routine tasks such as daily maintenance, adding postage to the meter, reporting of mail volumes and costs, locating a component’s model and serial numbers, meter serial number, and placing a service call.

· The contractor shall provide and complete key operator training within two business days of the any software/process minor or major updates. This training can be virtual (e.g., zoom, Webex or Microsoft teams) or face-to-face.

INSTALLATION, TRAINING, AND ON-GOING SUPPORT/MAINTENANCE

The vendor must ensure complete installation, configuration, setup, testing, and maintenance of all equipment (procured and rented) and software, including integration with and configuration for data streams and document types processed. These will include the following but not limited to:

· Detailed and onsite end-user training must be provided to Mailroom and Pharmacy staff on all equipment (procured and rental), software, and procedures.

· Additional onsite end-user training must be provided, as requested.

· Detailed and onsite administrative training and documentation for Mail Manager and other identified staff on Mail Output/Document Management Software Solution, Browser-Based, Multi-Carrier Integrated Shipping System.

All scheduled and periodic maintenance required by equipment and software (procured and rental) manufacturers must be included in the proposal and performed by certified individuals during regular business hours (7:30 am to 3:30 pm EST). The vendor is required to coordinate exclusively with OBVAMC Office of Information Technology (OI&T), and onsite and, or remote support must be always provided. Any deviation from these requirements will not be acceptable.

EXPECTATIONS

The contractor must ensure that all administrative and technical team members who visit federal facilities and communicate with both OBVAMC and contracting personnel maintain decorum. The contractor shall be held accountable for any breach of rules of behavior by their team members during their interactions at any of the federal facilities. The contractor must take all necessary steps to ensure their team members conduct themselves professionally and respectfully. Such measures may include training their team members on appropriate conduct and etiquette when interacting with personnel or visiting federal facilities. By doing so, the contractor will help to maintain a productive and professional working relationship with OBVAMC and its contracting personnel. The contractor shall ensure that the following requirements are met:

· Identification The contractor will require all their team members to wear uniforms that are easily identifiable with the name of the company printed on them when coming to OBVAMC. Additionally, the contractor is required to issue an identification badge to the technical team member which should ideally have a picture and the name of the team member. This badge must be worn by the technical team member while providing contracted services at all OBVAMC facilities.

· Conduct The contractor will be held liable for unacceptable behavior team members and OBVAMC and these unacceptable behaviors will not be will not be tolerated. These behaviors include, but are not limited to, improper physical actions (touching), improper verbal statements (using derogatory comments and verbal abuse), and improper visual actions (ogling, making sexual gestures).

Photography, video, or audio recording of any kinds is not permitted within, nor outside the premises in any OBVAMC facilities.

OBVAMC is committed to creating an environment where everyone is treated with civility, compassion, and respect. Sexual assault, sexual harassment, and other forms of harassment violate our values and make our workplace unsafe for everyone.

Sexual Assault is any type of sexual contact or attempted sexual contact that occurs without the explicit consent of the recipient of the unwanted sexual activity. Sexual assaults may involve psychological coercion, physical force, or victims who cannot consent due to dementia, anesthesia, severe mental illness, or other factors that remove the capacity to consent. Sexual assault is a crime. Report sexual assaults immediately to VA Police at (56) 65891 or (56) 65892. Report even when the assault is committed by a patient with diminished capacity. We have an obligation to report assaults and to support victims. Timely reporting is imperative as VA Police are mandated to report incidents within two hours of discovery.

Sexual Harassment is any unsolicited or unwanted verbal, gesture, or conduct that is sexual in nature. OBVAMC has a zero-tolerance sexual harassment policy. Management will take prompt and effective action to address the harassment. Harassment is any unwelcomed conduct that creates an intimidating, hostile, or offensive environment.

Federal law prohibits the possession of firearms or other dangerous weapons in Federal facilities and Federal court facilities by all persons not specifically authorized by Title 18, United States Code, Section 930. Violators will be subject to fine and/or imprisonment for periods up to five (5) years.

· Business Associate Agreement (BAA) Compliance

Business Associate is a person, organization, or company that performs or assists in performing functions or activities that involve the use or disclosure of PHI on behalf of the VHA facility or provides certain services involving the disclosure of PHI by VHA. Disclosure is the release, transfer, provision of access to, or divulgence of information outside of VHA, except the phrase "accounting of disclosures."

· Records Management

This clause applies to contractors whose employees handle federal records. Federal records, as defined in 44 U.S.C. § 3301, include all recorded information made or received by a Federal agency under Federal law or in connection with public business. They are preserved as evidence of Government activities or for their informational value.

The term "Federal record" encompasses records of the Veterans Affairs (VA) and those generated, received, or maintained by contractors under their contract with the VA. It excludes personal materials and may comprise deliverables and associated documentation. The term is of significance to businesses and academic institutions operating within the purview of the VA.

· The contractor is required to comply with all applicable laws and regulations related to records management, as well as the records policies of the National Archives and Records Administration (NARA). These policies include preserving all records regardless of their form or characteristics, mode of transmission, or state of completion. All data created for government use and delivered to, or under the legal control of, the government are considered federal records subject to the provisions of the Federal Records Act, the Freedom of Information Act (FOIA), and the Privacy Act of 1974.

· Contractors must manage and schedule the disposition of such records in accordance with federal law.

· The contractor must maintain all records created for government use, or created while performing the contract, and/or delivered to, or under the legal control of the government. Electronic records and associated metadata must be accompanied by sufficient technical documentation for understanding and using the records and data.

· Contractors must prevent the alienation or unauthorized destruction of records, including all forms of mutilation. Records may not be removed from the legal custody of the agency or destroyed except in accordance with the provisions of the agency records schedules and with the written concurrence of the Head of the Contracting Activity.

· Contractors must immediately report to the appropriate Contracting Officer upon discovering any inadvertent or unauthorized disclosures of information, data, documentary materials, records, or equipment (procured and rental). Disclosure of non-public information is limited to authorized personnel with a need-to-know.

· The contractor must establish appropriate personnel, administrative, technical, and physical safeguards to ensure the security and confidentiality of information, data, documentary material, records, and equipment (procured and rental).

· The contractor must not remove material from government facilities or systems, or facilities or systems operated or maintained on the government’s behalf, without the express written permission of the Head of the Contracting Activity. When information, data, documentary material, records, and/or equipment (procured and rental) are no longer required, they shall be returned to VA control, or the Contractor must hold them until otherwise directed. Destruction of records is expressly from public disclosure by an exemption to the Freedom of Information Act. All data and records produced as part of this contract are the property of the U.S. Government, for which VA shall have unlimited rights to use, dispose of, or disclose such data contained therein as it determines to be in the public interest. Any contractor rights in the data or deliverables must be identified as required by FAR 52.227-11 through FAR 52.227-20. prohibited unless authorized.

· The contractor is required to obtain the Contracting Officer's approval before engaging in any contractual relationship (sub-contractor) in support of this contract requiring the disclosure of information, documentary material, and records generated under or relating to contracts.

· The contractor (and any sub-contractor) must abide by Government and VA guidance to protect sensitive, proprietary, classified, and controlled unclassified information. The contractor must only use Government IT equipment for purposes explicitly tied to or authorized by the contract and VA policy.

· The contractor must not create or maintain records containing non-public VA information not explicitly tied to or authorized by the contract.

· The contractor must not retain, use, sell, or disseminate copies of any deliverable containing information covered by the Privacy Act of 1974 or generally protected.

Note:

The Contractor is expected to complete records management training as a prerequisite for their engagement. Furthermore, it is incumbent upon the Contractor to maintain a state of readiness to furnish any documentation that may be requested by auditors or surveyors in the event of an audit or survey. This documentation must conform to the requirements of the auditors or surveyor promptly and efficiently.

· Flow down of requirements to subcontractors The Contractor must ensure that all subcontractors are well-informed and equipped to comply with the requirements outlined in this clause due to:

1. The Contractor shall incorporate the substance of this clause, its terms and requirements including this paragraph, in all subcontracts under this [contract vehicle], and require written subcontractor acknowledgment of same.

2. Violation by a subcontractor of any provision set forth in this clause will be attributed to the Contractor.

OBVAMC ROLES/RESPONSIBILITIES/POCS

The following services roles and responsibilities are:

· OI&T

· Provide workstation PCs.

· Provide network connections (from the network closet to WLAN/Internet)

· Provide Security software for servers (Anti-Virus, Firewall, etc.)

· Provide Ongoing OS support and all VA-provided software.

Note: The hard drive is the property of the VA Facility.

· Engineering

· Inspect and provide appropriate electrical connections with power filters

· Inspect and provide network connections (cable from the closet to equipment location)

· Supply Chain Services, Mail Room

· Contracting Officer's Representative.

· Key personnel/staff attendance for installation and training.

Note: The facility is responsible for procuring ink and labels.

The following are the key personnel for each location that will be the utilizing the equipment for each Place of Performance:

510 E Stoner Ave.

Shreveport, LA 71101

Darrell.Broom@va.gov

Pharmacy Service Building 1, Room 1E95 510 E Stoner Ave.

Shreveport, LA 71101

matthew.pirkey@va.gov

PERTINENT SECURITY CLAUSES

1. GENERAL

This entire section applies to all acquisitions requiring any Information Security and Privacy language.

Contractors, contractor personnel, subcontractors and subcontractor personnel will be subject to the same federal laws, regulations, standards, VA directives and handbooks, as VA personnel regarding information and information system security and privacy.

2. VA INFORMATION CUSTODIAL LANGUAGE.

This entire section applies to all acquisitions requiring any Information Security and Privacy language.

a. The Government shall receive unlimited rights to data/intellectual property first produced and delivered in the performance of this contract or order (hereinafter “contract”) unless expressly stated otherwise in this contract. This includes all rights to source code and all documentation created in support thereof. The primary clause used to define Government and Contractor data rights is FAR 52.227-14 Rights in Data – General. The primary clause used to define computer software license (not data/intellectual property first produced under this contractor or order) is FAR 52.227-19, Commercial Computer Software License.

b. Information made available to the contractor by VA for the performance or administration of this contract will be used only for the purposes specified in the service agreement, SOW, PWS, PD, and/or contract. The contractor shall not use VA information in any other manner without prior written approval from a VA Contracting Officer (CO). The primary clause used to define Government and Contractor data rights is FAR 52.227-14 Rights in Data – General.

c. VA information will not be co-mingled with any other data on the contractor’s information systems or media storage systems. The contractor shall ensure compliance with Federal and VA requirements related to data protection, data encryption, physical data segregation, logical data segregation, classification requirements and media sanitization.

d. VA reserves the right to conduct scheduled or unscheduled audits, assessments, or investigations of contractor Information Technology (IT) resources to ensure information security is compliant with Federal and VA requirements. The contractor shall provide all necessary access to records (including electronic and documentary materials related to the contracts and subcontracts) and support (including access to contractor and subcontractor staff associated with the contract) to VA, VA's Office Inspector General (OIG), and/or Government Accountability Office (GAO) staff during periodic control assessments, audits, or investigations.

e. The contractor may only use VA information within the terms of the contract and applicable Federal law, regulations, and VA policies. If new Federal information security laws, regulations or VA policies become applicable after execution of the contract, the parties agree to negotiate contract modification and adjustment necessary to implement the new laws, regulations, and/or policies.

f. The contractor shall not make copies of VA information except as specifically authorized and necessary to perform the terms of the contract. If copies are made for restoration purposes, after the restoration is complete, the copies shall be destroyed in accordance with VA Directive 6500, VA Cybersecurity Program and VA Information Security Knowledge Service.

g. If a Veterans Health Administration (VHA) contract is terminated for default or cause with a business associate, the related local Business Associate Agreement (BAA) shall also be terminated and actions taken in accordance with VHA Directive 1605.05, Business Associate Agreements. If there is an executed national BAA associated with the contract, VA will determine what actions are appropriate and notify the contactor.

h. The contractor shall store and transmit VA sensitive information in an encrypted form, using VA-approved encryption tools which are, at a minimum, Federal Information Processing Standards (FIPS) 140-2, Security Requirements for Cryptographic Modules (or its successor) validated and in conformance with VA Information Security Knowledge Service requirements. The contractor shall transmit VA sensitive information using VA approved Transport Layer Security (TLS) configured with FIPS based cipher suites in conformance with National Institute of Standards and Technology (NIST) 800-52, Guidelines for the Selection, Configuration and Use of Transport Layer Security (TLS) Implementations.

i. The contractor’s firewall and web services security controls, as applicable, shall meet or exceed VA’s minimum requirements.

j. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor may use and disclose VA information only in two situations: (i) in response to a qualifying order of a court of competent jurisdiction after notification to VA CO (ii) with written approval from the VA CO. The contractor shall refer all requests for, demands for production of or inquiries about, VA information and information systems to the VA CO for response.

k. Notwithstanding the provision above, the contractor shall not release VA records protected by Title 38 U.S.C. § 5705, Confidentiality of medical quality-assurance records and/or Title 38 U.S.C. § 7332, Confidentiality of certain medical records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse or infection with Human Immunodeficiency Virus (HIV). If the contractor is in receipt of a court order or other requests for the above-mentioned information, the contractor shall immediately refer such court order or other requests to the VA CO for response.

l. Information made available to the contractor by VA for the performance or administration of this contract or information developed by the contractor in performance or administration of the contract will be protected and secured in accordance with VA Directive 6500 and Identity and Access Management (IAM) Security processes specified in the VA Information Security Knowledge Service.

m. Any data destruction done on behalf of VA by a contractor shall be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management, VA Handbook 6300.1, Records Management Procedures, and applicable VA Records Control Schedules.

n. The contractor shall provide its plan for destruction of all VA data in its possession according to VA Directive 6500 and NIST 800-88, Guidelines for Media Sanitization prior to termination or completion of this contract. If directed by the COR/CO, the contractor shall return all Federal Records to VA for disposition.

o. Any media, such as paper, magnetic tape, magnetic disks, solid state devices or optical discs that is used to store, process, or access VA information that cannot be destroyed shall be returned to VA. The contractor shall hold the appropriate material until otherwise directed by the Contracting Officer’s Representative (COR) or CO. Items shall be returned securely via VA-approved methods. VA sensitive information must be transmitted utilizing VA-approved encryption tools which are validated under FIPS 140-2 (or its successor) and NIST 800-52. If mailed, the contractor shall send via a trackable method (USPS, UPS, FedEx, etc.) and immediately provide the COR/CO with the tracking information. Self-certification by the contractor that the data destruction requirements above have been met shall be sent to the COR/CO within 30 business days of termination of the contract.

p. All electronic storage media (hard drives, optical disks, CDs, back-up tapes, etc.) used to store, process or access VA information will not be returned to the contractor at the end of lease, loan, or trade-in. Exceptions to this paragraph will only be granted with the written approval of the VA CO.

3. ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS.

This section applies when any person requires access to information made available to the contractor by VA for the performance or administration of this contract or information developed by the contractor in performance or administration of the contract.

a. A contractor/subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees and subcontractors only to the extent necessary to perform the services specified in the solicitation or contract. This includes indirect entities, both affiliate of contractor/subcontractor and agent of contractor/subcontractor.

b. Contractors and subcontractors shall sign the VA Information Security Rule of Behavior (ROB) before access is provided to VA information and information systems (see Section 4, Training, below). The ROB contains the minimum user compliance requirements and does not supersede any policies of VA facilities or other agency components which provide higher levels of protection to VA’s information or information systems. Users who require privileged access shall complete the VA elevated privilege access request processes before privileged access is granted.

c. All contractors and subcontractors working with VA information are subject to the same security investigative and clearance requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors shall be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office of Human Resources and Administration/Operations, Security and Preparedness (HRA/OSP) is responsible for these policies and procedures. Contract personnel who require access to classified information or information systems shall have an appropriate security clearance. Verification of a Security Clearance shall be processed through the Special Security Officer located in HRA/OSP. Contractors shall conform to all requirements stated in the National Industrial Security Program Operating Manual (NISPOM).

d. All contractors and subcontractors shall comply with conditions specified in VAAR 852.204-71(d); Contractor operations required to be in United States. All contractors and subcontractors working with VA information must be permanently located within a jurisdiction subject to the law of the United States or its Territories to the maximum extent feasible. If services are proposed to be performed abroad the contractor must state where all non-U.S. services are provided. The contractor shall deliver to VA a detailed plan specifically addressing communications, personnel control, data protection and potential legal issues. The plan shall be approved by the COR/CO in writing prior to access being granted.

e. The contractor shall notify the COR/CO in writing immediately (no later than 24 hours) after personnel separation or occurrence of other causes. Causes may include the following:

1) Contractor/subcontractor personnel no longer has a need for access to VA information or VA information systems.

2) Contractor/subcontractor personnel are terminated, suspended, or otherwise has their work on a VA project discontinued for any reason.

3) Contractor believes their own personnel or subcontractor personnel may pose a threat to their company’s working environment or to any company-owned property. This includes contractor-owned assets, buildings, confidential data, customers, employees, networks, systems, trade secrets and/or VA data.

4) Any previously undisclosed changes to contractor/subcontractor background history are brought to light, including but not limited to changes to background investigation or employee record.

5) Contractor/subcontractor personnel have their authorization to work in the United States revoked.

6) Agreement by which contractor provides products and services to VA has either been fulfilled or terminated, such that VA can cut off electronic and/or physical access for contractor personnel.

f. In such cases of contract fulfillment, termination, or other causes; the contractor shall take the necessary measures to immediately revoke access to VA network, property, information, and information systems (logical and physical) by contractor/subcontractor personnel. These measures include (but are not limited to): removing and then securing Personal Identity Verification (PIV) badges and PIV – Interoperable (PIV-I) access badges, VA-issued photo badges, credentials for VA facilities and devices, VA-issued laptops, and authentication tokens. Contractors shall notify the appropriate VA COR/CO immediately to initiate access removal.

g. Contractors/subcontractors who no longer require VA accesses will return VA-issued property to VA. This property includes (but is not limited to): documents, electronic equipment, keys, and parking passes.