36C25627Q0078_1.docx

Sources Sought Notice Sources Sought Notice

GENERAL INFORMATION

Network Contracting Office 16 5075 Westheimer Road, Suite 750

Houston TX 77056-5643

POINT OF CONTACT*

Contracting Specialist Christopher Rossi christopher.rossi2@va.gov christopher.rossi2@va.gov

PLACE OF PERFORMANCE

(SLVHCS)

2400 Canal Street

New Orleans LA

ADDITIONAL INFORMATION

AGENCY’S URL

URL DESCRIPTION

AGENCY CONTACT’S EMAIL ADDRESS

EMAIL DESCRIPTION

DESCRIPTION

This is a SOURCES SOUGHT NOTICE ONLY.

This SOURCE SOUGHT NOTICE is for the purpose of Market Research. Response to this notice will be used for information and planning purposes and issued in accordance with Federal Acquisition Regulation (FAR) Part 10- Market Research, in order to conduct market research. No proposals or quotes are being requested or accepted with this notice. Responses to this notice are not offers and cannot be accepted by the Government to form a binding contract. This RFI is issued solely for information and planning purposes and does not constitute a solicitation or a guarantee to issue a solicitation in the future. This RFI does not commit the Government to contract for any supply or service. All information submitted in response to this announcement is voluntary; the Government will not pay for information requested nor will it compensate any respondent for any cost incurred in developing information provided to the Government. Not responding to this RFI does not preclude participation in any future solicitation, if issued. This announcement is based on the best information available at this time and is subject to future modification. This notice shall NOT be construed as solicitation or as an obligation on the part of the Department of Veterans Affairs (VA). Responses to this notice is not a request to be added to a prospective bidders list or to receive a copy of the solicitation.

The purpose of this synopsis is to gain knowledge of potential qualified sources and their size classification, Service Disabled/Veteran Owned Small Business. (SDVOSB/VOSB), HUBZone, 8(a), small, small disadvantage, woman owned small business, or large business) relative to NAICS code is 561612 (Security Guards and Patrol Services) and the size standard is $29 Million. The Product Service Code (PSC) is S206, Housekeeping—Guard Services.

Requirement:

The Southeast Louisiana Veterans Health Care System (SLVHCS) has a requirement for non-personal, unarmed security guard services. The contractor shall provide licensed unarmed security guards trained and qualified on duty from the first day of performance through completion of the contract in accordance with the Performance Based Work Statement (PWS) and any other mandatory federal, state, local and VA regulation at the following SLVHCS Medical Center locations: ALL SITES ARE LOCATED AT 2400 CANAL STREET, NEW ORLEANS, LA 70119. Responses must be received by no later than 13:00 p.m. Central Standard Time, Friday, 4 November, 2026. Responses shall be emailed to Christopher.Rossi2@va.gov Capabilities Statements to include UEI number. Facsimile or Telephonic responses will not be accepted.

Note: All interested parties are reminded to be registered, active and verified in the following to be considered for Award (as applicable).

SAM: https://www.sam.gov/portal/public/SAM/ This RFI is issued solely for information and planning purposes only and does not constitute a solicitation. All information received in response to this RFI that is marked as proprietary will be handled accordingly. In accordance with FAR 15.201(e), responses to this notice are not offers and cannot be accepted by the Government to form a binding contract. Responders are solely responsible for all expenses associated with responding to this RFI. No quotes will be accepted.

Performance Work Statement Unarmed Security Guard Services Southeast Louisiana Veterans Health Care System New Orleans, LA

1. BACKGROUND

1.1 The Department of Justice has determined that premises owned or leased by the Department of Veterans Affairs (VA) for medical clinics are under the law enforcement jurisdiction of VA as that phrase issued in 38 U.S.C. Section 218. This determination rests upon the proviso that VA is the leaseholder/owner of the space coupled with possession and control of the space. Security & Law Enforcement Circular Letter 07-91-1 authorizes security services obtained by contract when VA police officer positions are unavailable. Contract security guards utilized by VA leased outpatient clinics shall exercise any local law enforcement authority vested in them within the limits of their licensing or special police commissioning by the State in which the clinic is located. This exercise of local law enforcement authority does not include authorization to bear firearms in VA leased/owned clinic space.

2. SCOPE

2.1 The Southeast Louisiana Veterans Health Care System (SLVHCS) has a requirement for non-personal, unarmed security guard services. The contractor shall provide licensed unarmed security guards trained and qualified on duty from the first day of performance through completion of the contract in accordance with the Performance Based Work Statement (PWS) and any other mandatory federal, state, local and VA regulation at the following SLVHCS Medical Center locations:

ALL SITES ARE LOCATED AT 2400 CANAL STREET, NEW ORLEANS, LA 70119.

Site #1: One Security Guard Supervisor: 24/7/365- Contractor’s Lead (Supervisory) Security Guard will rover each stationary post to check on other Guards. Total Hours- 8,760 Site #2: Site Foyer/Horseshoe: Located at 2400 Canal St. New Orleans, Louisiana 70119 One (1) STATIONARY POST, 1700-0700 (5 Days a week) 14 hours a day Weekdays, excluding Federal Holidays. Total Hours: 3,500 Site #3: Site Foyer/Horseshoe: Located at 2400 Canal St. New Orleans, Louisiana 70119. One (1) STATIONARY POST, 24 Hours Per Day- Saturday, Sunday, and Federal Holidays. Total Hours: 2,760 Site #4: Site Building 5 (Patient Parking Garage): Located at 2400 Canal St. New Orleans, Louisiana 70119. One (1) STATIONARY POST, Twenty-four (24) hours per day, seven days a week including Federal Holidays. Total Hours: 8,760 Site #5: Building 6 (Central Energy Plant): Located at 2400 Canal St. New Orleans, Louisiana 70119. One (1) STATIONARY POST, Twenty-four (24) hours per day, seven days a week including Federal Holidays. Total Hours: 8,760 Site #6: Building 6 (Transitional Living): Located at 2400 Canal St. New Orleans, Louisiana 70119 One (1) STATIONARY POST, 1600-0630 (5 Days a week) 14.50 hours a day Weekdays, excluding Federal Holidays. Total Hours: 3,625 Site #7: Building 6 (Transitional Living): Located at 2400 Canal St. New Orleans, Louisiana 70119. One (1) STATIONARY POST, 24 Hours Per Day- Saturday, Sunday, and Federal Holidays. Total Hours: 2,760 Site #8: Building 8 (Staff Parking Garage): Located at 2400 Canal St. New Orleans, Louisiana 70119 One (1) STATIONARY POST, Twenty-four (24) hours per day, seven days a week including Federal Holidays. Total Hours: 8,760 Site #9: Building ED (D&T): Located at 2400 Canal St. New Orleans, Louisiana 70119. One (1) STATIONARY POST, Twenty-four (24) hours per day, seven days a week including Federal Holidays. Total Hours: 8,760 Contractor’s Lead (Supervisory) Security Guard will rove each stationary post to check on other Guards. Please refer to section 3.8 and 3.9 Please see section 15. Performance Requirements Summary Matrix.

2.2 HOLIDAYS: The contractor is required to work during U.S. federal Holidays. Each post in the schedule of prices/services specifies the required working schedule. In accordance with 5 U.S.C. 6103, Executive Order 11582 and Public Law 94-97 the following national holidays are observed and for the purpose of this contract are defined as "Legal Federal, official holidays”.

Or any other specifically declared by the President of the United States to be a National Holiday.

2.3 Contractor shall furnish all qualified personnel, equipment and supplies (including communication equip.), uniforms, training and supervision.

2.4 The contractor shall provide necessary guards to cover all posts without interruption.

2.5 Any property furnished by the Government to fulfill contract requirements which is lost or damaged resulting from improper use or negligence by the contractor’s employee, shall be repaired or replaced by the Government and the cost of such repairs or replacement shall be deducted from the contractor’s invoice or the contract price. The contractor shall take all reasonable precautions to safeguard and protect Government property.

2.6 Government property shall be used for official Government business only in the performance of this contract. The contractor or contractor’s employees will not use government property for personal advantage, business gain or other personal endeavor.

2.7 Rules and Regulations governing Security and Law Enforcement and Standard of Conduct on Veterans Affairs Property (38 CFR 1.218-1.220) are posted in all buildings under the charge and control of the Veterans Affairs and are applicable to all persons entering in or on such property.

2.8 VHA Directive 0730 contains the basic procedures and forms to be used during the contract and will be supplied by the Contracting Officer Representative (COR). While this Directive applies to VA Police Officers, it serves as a primary guide for VA contracted security services and shall be followed to the maximum extent practicable. Information to be provide at post-award meeting, or as determined by the CO.

2.9 An officer’s duty book with Standard Operating Procedures will be furnished by the COR. This book shall be maintained by the contractor at a central control point. It will contain complete duty instructions for the post involved to include emergency procedures. The officer’s duty book shall not be removed from government property or reproduced or copied in any manner unless properly authorized, in writing, by the COR.

2.10 The contractor shall assume full liability for any act of his/her employees in the exercise of all such police authority and duties exercised under this contract.

3. QUALIFICATIONS

3.1 Contractor shall insure all guards meet all training, licensing, and certification requirements as identified in the following:

3.2 Contractor employees performing guard services shall be U.S. citizens with a minimum of eighteen (18) years of age.

3.3 Contractor provides all pre-performance and in-service training and is responsible for all associated expenses, state fees, license fees, and certification fees.

3.4 The contractor shall provide a certified instructor to conduct all training that directly pertains to the duties to be performed by the contractor guards. As a minimum, the following trainings shall be provided:

3.4.1 Use of Force/Rules of Engagement

3.4.2 Emergency response

3.4.3 Intruder confrontation

3.4.4 Conflict resolution

3.4.5 Interpersonal communication

3.4.6 OSHA

3.4.7 Physical security

3.4.8 Customer Service

3.4.9 Protective equipment and Procedures to include Blood Borne Pathogens

3.5 All guards shall possess a valid driver’s license or state ID issued by the State of Louisiana to exercise security guard duties. Must possess a high school diploma or equivalency, and have two (2) years of experience demonstrating: the ability to meet and deal with the general public; ability to read, understand and apply printed rules, detailed orders, instructions, and training materials; the ability to maintain poise and self-control under stress; ability to construct and write clear, concise, accurate and detailed reports.

3.6 Guards working under this contract shall not have felony convictions and no convictions that reflect on the individual's reliability.

3.7 Guards shall be literate in English to the extent of reading and understanding printed regulations, detailed written orders, training instructions and material, and shall be able to compose reports which convey complete information.

3.8 The contractor shall appoint a Lead Guard. This individual shall be skilled and trained to act on behalf of the Contractor for all matters relating to this contract.

3.9 The Lead Guard shall be capable of interpreting and implementing all functions required within the contract specifications, and shall ensure that other guards perform their duties as outlined in the PWS. The name of this individual shall be provided to the COR, in writing, prior to the appointment. This requirement applies to any replacement individual. The lead guard will not double as a stationary guard except to provide temporary relief.

3.10 Uniforms: The contractor will provide standard security guard uniforms in accordance with commercial standards. The color of the uniform shall be any neutral color. Contractor shall provide a complete uniform set sample along with his proposal, for Government evaluation; prior to purchase.

3.11 All guards shall wear, on the right breast of outer garment; identification Name badge, whether such garment is a shirt, overcoat, or raincoat. If contractor provides badges, they shall be worn on the left breast of outer garment. Uniform accessories will uniformly match, Standard security cap may be worn.

3.12 No guard shall enter on duty without wearing the proper uniform, including accessories. Guards shall wear their hair neatly fashioned and not to extend below the collar. No more than two finger rings may be worn while on duty (e.g., wedding, class). Male guards will not wear earrings. Female guards will be allowed to wear “stud” earrings not exceeding 1/8” in width; these are the only allowable piercings for male and female accessories. All guards shall be in uniform and ready to begin work promptly at the start of their shift and shall and remain on the job and in full uniform until the end of their tour of duty.

3.13 The contractor is required to provide guards with all equipment necessary to perform security guard duties. Supplemental or personal equipment (concealed or unconcealed firearms, knives, “come-along” or other nonstandard items) are not authorized. Security guard equipment will not include firearms, batons or mace.

3.14 Guards are required to adhere to the facility’s no smoking policy.

3.15 The use of personal cellphones is not authorized while guard is on duty.

4. REQUIREMENTS

4.1 The Contractor shall be licensed and certified in the state of Louisiana and have experience in performing security services. The Contractor shall provide licensed unarmed security guards trained and qualified on duty from the first day of performance through completion of the contract in accordance with the Performance Based Work Statement (PWS) and any other mandatory federal, state, local and VA regulation.

4.2 The Security Guard Agency/Company License shall comply with the Louisiana State Board of Private Security Examiners. Company license shall be effective, without interruption; during the entire contract performance period.

4.3 Security Guard 1 – Position No. 27101, as per Department of labor (DOL) Directory of Occupations, meets minimum requirements for this solicitation/contract.

4.4 Contractor shall submit evidence demonstrating that personnel have received the required Federal and Louisiana State OSHA training; training in First Aid, Heat Stress, Blood borne Pathogens, CPR, AED and Workplace Violence. Documentation of training will be completed prior to assignment of a guard to duty.

4.5 Guards shall adhere to the facility's no smoking policy.

4.6 Security services shall be provided at designated locations on a continuous basis.

4.7 Reporting Requirements: The Contractor shall report to the COR any information or circumstances which may pose a threat to the security and/or safety of SLVHS personnel, Contractor personnel, resources, and or visitors.

4.8 Incident Reporting: The Contractor shall immediately report all incidents to the VA Police and document the incident in writing as per the established standard operating procedure. Incidents include but are not limited to weapons discharge, breach of security, graffiti, vandalism. accidents, procedural violations, or injury to persons or property. The Contractor and all employees will not discuss or provide any information concerning any incident with any other private, civil, or government organization without prior approval of the COR or the Contracting Officer.

4.9 List of Employees: The contractor shall maintain a current listing of employees, which must include employee’s full name, last four digits of social security number, date of hire, guard license number and date of birth. The list will be validated by the COR and provided to CO. The list shall be provided annually and updated whenever any employee’s status or information changes.

4.10 HEALTH AND PHYSICAL FITNESS REQUIREMENTS:

4.10.1 All guards assigned by the Contractor to work under this contract shall be physically able to perform all general duties, functions, and activities; shall be free from any communicable disease (i.e., active tuberculosis, mumps, measles, viral conjunctivitis, varicella, etc.).

4.10.2 Guards shall be well proportioned as to height and weight; shall be in good general health without physical defects or abnormalities which would interfere with the performance of these duties.

4.10.3 Guards shall possess binocular vision correctable to 20/30; in the better eye and 20/40 in the other eye with eyeglasses or contact lenses. If uncorrected distance vision is not at least 20/40 in the better eye, the individual shall carry an extra pair of corrective lenses. Near visual acuity, corrected or uncorrected, shall be at least 20/40 in the better eye. Field of vision must be at least 70 horizontal meridians in each eye.

4.10.4 The ability to distinguish red, green, and yellow colors is required. Loss of vision in one eye is disqualifying. Glaucoma shall be disqualifying unless controlled by acceptable medical or surgical means, provided such medications, as may be used for controlling glaucoma do not cause undesirable side effects which adversely affect the individual’s ability to perform assigned security job duties, and provided the visual requirements stated above are met. On the job evaluation, shall be used for individuals who exhibit a mild color vision defect. The use of corrective eyeglasses or contact lenses shall not interfere with an individual's ability to effectively perform assigned security job duties during normal or emergency operations.

4.10.5 Guards shall be capable of hearing ordinary conversation at 15 feet with either ear without benefit of a hearing aid. A hearing aid is acceptable provided suitable testing procedures demonstrate auditory acuity equivalent to the above stated requirement. The use of a hearing aid shall not decrease the effective performance of the individual's assigned guard duties during normal or emergency operations.

4.10.6 Each guard service employee shall be in good physical condition; having the ability to protect themselves and others; and withstand sudden emotional stress and physical exertion in apprehension of suspects and violators. Pursuit may be on foot, requiring running, jumping, climbing, and/or crawling, followed by physical contact to overpower the violator as necessary

4.10.7 Individuals shall have no established medical history or medical diagnosis of habitual alcoholism or drug addiction, or, where such a condition has existed, the individual shall provide certified documentation of having completed a rehabilitation program which would give a reasonable degree of confidence that the individual can perform assigned guard services duties.

4.10.8 In addition, all contractor employees shall undergo a psychological assessment, with results furnished to the Contracting Officer (CO) at least five (5) days prior to assignment of the guard to duty. This psychological assessment must be carried out in accordance with accepted professional standards by a physician or licensed practitioner authorized to conduct such examinations. For detailed policy see the Federal Personnel Manual, Chapter 339, and Medical Qualification Determinations. Security guard duties include personal encounters with patients, visitors, and other employees. Encounters are often with mentally ill, irrational or disturbed persons who although assaultive or destructive, must be handled with understanding, full control of force, and unimpeded judgment. Any emotional or mental condition which could cause the applicant to be a hazard to others or self during stress situations and physical altercations will disqualify.

5. SPECIFICATIONS

5.1 Guards shall be UNARMED.

5.2 Operate and enforce a system of personnel identification as necessary. All patients, staff and vendors will be asked for a valid SLVHCS, vendor, or Veteran ID as they enter any entry control point location.

5.3 Perform checks of individual identification for authenticity. The Contractor shall provide courteous and timely service continuously while maintaining control of all personnel during required document verification and or personnel identification processing prior to allowing entry to the premises.

5.4 Perform package inspection when directed to do so.

5.5 Conduct random and established patrols in accordance with established site facility needs, routes and schedules.

5.6 Direct traffic at gates (vehicle and pedestrian), control parking. Must be able to operate control devices to facilitate access and egress. Deny access to vehicles that are not road worthy or lack permanent or temporary license tags.

5.7 Observe parking occupants and visitors for compliance with posted rules and regulations. Notify VA Police of any violation.

5.8 Parking lot security shall include continuous checks of the parking area to assure the following rules are adhere to:

5.8.1 Drivers with valid Handicapped placard/plates use handicap parking only and all safety codes are being met in parking and driving areas.

5.8.2 Fire lanes are free of parked vehicles.

5.8.3 Reserved parking spaces for government vehicles and staff from visiting facilities are enforced.

5.8.4 Patrol government leased parking area at the minimum four times a day. Capture patrols on the contractor duty log and turn in one copy to Police Operations daily.

5.8.5 Challenge all suspicious activity.

5.8.6 Notify VA Police of all discovered parking violations.

5.9 Keep all post clean and orderly.

5.10 Maintain law and order within the areas of assignment. If assistance is necessary, call the Department of Veterans Affairs, Police Department.

5.11 Discover and detain persons attempting to gain unauthorized access to the property.

5.12 Report potentially hazardous conditions to the COR and VA Police. Note condition in the contractor duty log and turn in one copy to the VA Police Operations.

5.13 Perform all security functions necessary to include notifying VA Police of situations or occurrences such as civil disturbances, attempts to commit espionage, sabotage, vandalism, or other criminal acts adversely affecting the security and/or safety of the Government, its employees, property and the general public lawfully in parking space under the control of the Government.

5.14 All guards shall be in uniform and ready to begin work promptly at the start of their shift, and shall remain on the job and in full uniform until the end of their tour of duty.

5.15 In the event the contract security guard is unable to report to duty, he/she is responsible for notifying the contractor’s supervisor/lead guard, not VA personnel, with sufficient time for the contractor to provide a replacement guard without shift interruption. The contractor shall provide a replacement security guard prior to the on-duty guard being relieved of duty in the event of an emergency/illness. Note shift interruptions in the contractor duty log and turn in one copy to the VA Police Operations complete with assigned shift participants by name.

5.16 Contractor is required to submit evidence demonstrating each guard has received the required Federal and Local OSHA training; training in First Aid, Heat Stress, Blood Borne Pathogens, and Workplace Violence. Documentation of training will be completed prior to assignment of a guard to duty. Also, provide annual training related to security and submit a copy of the training certificate to the COR.

5.17 Station guard at site 4. Guard will note time and circumstances by daily log of all entry and exiting vehicles to include time, driver name, and company. The guard will note if the delivery agent is wearing appropriate personal protective equipment (PPE) if required for access. Log will be collected weekly with a copy provided to the Police Operations Office.

6. SITE CONDITIONS

6.1 There shall be no smoking, eating, or drinking inside the facility at any time.

6.2 There is no guaranteed parking at the facility. Facility to provide parking in the Galvez garage for contract security staff on an as available basis at no cost. Vehicles must be registered with Police Administration in advance. Security staff must have a valid drivers license, registration and insurance card. Vehicle must be road worthy. On a space available basis level 5 and higher, contract staff will be issued a red decal for parking. Loss of the decal will result in charge to the security staff member of $5. Failure to pay for the loss will result in denial of access and a charge to the security company. Local parking policies apply to the contracted staff.

7. PERIOD OF PERFORMANCE

7.1 Base Period Dec 20, 2026 through Dec 19, 2027

7.2 Option Year one Dec 20, 2027 through Dec 19, 2028

7.3 Option Year two Dec 20, 2028 through Dec 19, 2029

7.4 Option Year three Dec 20, 2029 through Dec 19, 2030

7.5 Option Year four Dec 20, 2030 through Dec 19, 2031

8. PROTECTION OF PROPERTY

8.1 Contractor shall protect all items from damage. The Contractor shall take precaution against damage to the building(s), grounds and furnishings. The Contractor shall repair or replace any items related to building(s) or grounds damaged accidentally or on purpose due to actions by the Contractor.

8.2 The Contractor shall perform an inspection of the building(s) and grounds with the COR prior to commencing work. To ensure that the Contractor shall be able to repair or replace any items, components, building(s) or grounds damaged due to negligence and/or actions taken by the Contractor. The source of all repairs beyond simple surface cleaning is the facility construction contractor (or appropriate subcontractor), so that building warranty is maintained. Concurrence from the VA Facilities Management POC and COR is required before the Contractor may perform any significant repair work. In all cases, repairs shall utilize materials of the same quality, size, texture, grade, and color to match adjacent existing work.

8.3 The Contractor shall be responsible for security of the areas in which the work is being performed prior to completion.

9. SAFETY REQUIREMENTS

9.1 The Department of Veterans Affairs has identified the minimum worker safety standards and related training that are required by State law. All contractors providing service at VA facilities shall be in compliance with the Louisiana Code of Regulations. These regulations require the employer to develop, implement and document written programs, as well as requiring initial and recurrent employee training and record keeping.

9.2 Hepatitis B Vaccination: Louisiana Code of Regulations state employers shall make available the Hepatitis B Vaccine and vaccination series to all employees who have occupation exposure, and post-exposure evaluation and follow-up to all employees who have had an exposure incident. Under the terms of this contract, the contractor will either provide, at no expense to the Government, the required vaccination defined herein, or have a letter of declination on file with the contractor. A copy of this letter shall also be filed with the COTR and placed in the official contract file. Copies of treatment and follow-up records shall be provided to the COTR.

9.3 Exposure to Hazardous Working Conditions: Contractor personnel may be required to perform work under potentially hazardous conditions. Contractor shall inform personnel of this, and shall provide the requisite training in the techniques and equipment/PPE to recognize and deal with such situations to minimize personal risk, and they must adhere to standard techniques for personal protection.

9.4 Fire and Safety: In performance of this contract, the contractor shall take all safety precautions as necessary to protect the lives and health of occupants of the building(s). The contractor shall immediately report any fire & safety deficiencies caused by its personnel. The contractor will comply with applicable Federal, State and local safety and fire regulations and codes which are in effect at the beginning of the contract period. The contractor will keep abreast of and comply with changes in these regulations and codes applicable to this contract. The contractor's personnel will follow applicable facility policies concerning fire & safety. Note safety and fire deficiencies in the contractor duty log and turn in one copy to the VA Police Operations

9.5 Radiation Safety: The Government will provide all contractor employees, the radiation safety training required by the U.S. Nuclear Regulatory Commission (NRC), prior to beginning work and annually thereafter.

10. SECURITY REQUIREMENTS

10.1 A&A requirements do not apply--Security Accreditation Package is not required".

10.2 ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS

10.2.1 A contractor/sub-contractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order.

10.2.2 All contractors, subcontractors, and third-party servicers and associates working with VA information is subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures.

10.2.3 Contract personnel who require access to national security programs must have a valid security clearance. National Industrial Security Program (NISP) was established by Executive Order 12829 to ensure that cleared U.S. defense industry contract personnel safeguard the classified information in their possession while performing work on contracts, programs, bids, or research and development efforts. The Department of Veterans Affairs does not have a Memorandum of Agreement with Defense Security Service (DSS). Verification of a Security Clearance must be processed through the Special Security Officer located in the Planning and National Security Service within the Office of Operations, Security and Preparedness.

10.2.4 Custom software development and outsourced operations must be located in the U.S. to the maximum extent practical. If such services are proposed to be performed abroad and are not disallowed by other VA policy or mandates, the contractor/subcontractor must state where all non-U.S. services are provided and detail a security plan, deemed to be acceptable by VA, specifically to address mitigation of the resulting problems of communication, control, data protection, and so forth. Location within the U.S. may be an evaluation factor.

10.2.5 The contractor or subcontractor must notify the Contracting Officer immediately when an employee working on a VA system or with access to VA information is reassigned or leaves the contractor or subcontractor’s employment. The Contracting Officer must also be notified immediately by the contractor or subcontractor prior to an unfriendly termination. The employee must turn in parking decal if assigned.

10.3 VA INFORMATION CUSTODIAL LANGUAGE

10.3.1 Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the contractor/subcontractor's rights to use data as described in Rights in Data - General, FAR 52.227-14(d) (1).

10.3.2 VA information should not be co-mingled, if possible, with any other data on the contractors/subcontractor’s information systems or media storage systems to ensure VA requirements related to data protection and media sanitization can be met. If co-mingling must be allowed to meet the requirements of the business need, the contractor must ensure that VA’s information is returned to the VA or destroyed in accordance with VA’s sanitization requirements. VA reserves the right to conduct onsite inspections of contractor and subcontractor IT resources to ensure data security controls, separation of data and job duties, and destruction/media sanitization procedures in compliance with VA directive requirements.

10.3.3 Prior to termination or completion of this contract, contractor/subcontractor must not destroy information received from VA, or gathered/created by the contractor while performing this contract without prior written approval by the VA. Any data destruction done on behalf of VA by a contractor/subcontractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self-certification by the contractor that the data destruction requirements above have been met must be sent to the VA Contracting Officer within 30 days of termination of the contract.

10.3.4 The contractor/subcontractor must receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with the terms of the contract and applicable Federal and VA information confidentiality and security laws, regulations and policies. If Federal or VA information confidentiality and security laws, regulations and policies become applicable to the VA information or information systems after execution of the contract, or if NIST issues or updates applicable FIPS or Special Publications (SP) after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations and policies in this contract.

10.3.5 The contractor/subcontractor shall not make copies of VA information except as authorized and necessary to perform the terms of the agreement or to preserve electronic information stored on contractor/subcontractor electronic storage media for restoration in case any electronic equipment or data used by the contractor/subcontractor needs to be restored to an operating state. If copies are made for restoration purposes, after the restoration is complete, the copies must be appropriately destroyed.

10.3.6 If VA determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12.

10.3.7 If a VHA contract is terminated for cause, the associated BAA must also be terminated and appropriate actions taken in accordance with VHA Handbook 1600.01, Business Associate Agreements. Absent an agreement to use or disclose protected health information, there is no business associate relationship.

10.3.8 The contractor/subcontractor must store, transport, or transmit VA sensitive information in an encrypted form, using VA-approved encryption tools that are, at a minimum, FIPS 140-2 validated.

10.3.9 The contractor/subcontractor’s firewall and Web services security controls, if applicable, shall meet or exceed VA’s minimum requirements. VA Configuration Guidelines are available upon request.

10.3.10 Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor/subcontractor may use and disclose VA information only in two other situations: (i) in response to a qualifying order of a court of competent jurisdiction, or (ii) with VA’s prior written approval. The contractor/subcontractor must refer all requests for, demands for production of, or inquiries about, VA information and information systems to the VA contracting officer for response.

10.3.11 Notwithstanding the provision above, the contractor/subcontractor shall not release VA records protected by Title 38 U.S.C. 5705, confidentiality of medical quality assurance records and/or Title 38 U.S.C. 7332, confidentiality of certain health records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse, or infection with human immunodeficiency virus. If the contractor/subcontractor is in receipt of a court order or other requests for the above-mentioned information, that contractor/subcontractor shall immediately refer such court orders or other requests to the VA contracting officer for response.

10.3.12 Bio-Medical devices and other equipment or systems containing media (hard drives, optical disks, etc.) with VA sensitive information must not be returned to the vendor at the end of lease, for trade-in, or other purposes.

The options are:

(1) Vendor must accept the system without the drive;

(2) VA’s initial medical device purchase includes a spare drive which must be installed in place of the original drive at time of turn-in; or

(3) VA must reimburse the company for media at a reasonable open market replacement cost at time of purchase occur that may

(4) Due to the highly specialized and sometimes proprietary hardware and software associated with medical equipment/systems, if it is not possible for the VA to retain the hard drive, then;

(5) The equipment vendor must have an existing BAA if the device being traded in has sensitive information stored on it and hard drive(s) from the system are being returned physically intact;

(6) Any fixed hard drive on the device must be non-destructively sanitized to the greatest extent possible without negatively impacting system operation. Selective clearing down to patient data folder level is recommended using VA approved and validated overwriting technologies/methods/tools. Applicable media sanitization specifications need to be preapproved and described in the purchase order or contract.

(7) A statement needs to be signed by the Director (System Owner) that states that the drive could not be removed and that (a) and (b) controls above are in place and completed.

The ISO needs to maintain the documentation.

10.4 SECURITY INCIDENT INVESTIGATION

10.4.1 The term “security incident” means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. The contractor/subcontractor shall immediately notify the COTR and simultaneously, the designated ISO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/subcontractor has access.

10.4.2 To the extent known by the contractor/subcontractor, the contractor/subcontractor’s notice to VA shall identify the information involved, the circumstances surrounding the incident including to whom, how, when, and where the VA information or assets were placed at risk or compromised), and any other information that the contractor/subcontractor considers relevant. Note the incident and subsequent internal contractor investigation in the contractor duty log and turn in one copy to the VA Police Operations.

10.4.3 With respect to unsecured protected health information, the business associate is deemed to have discovered a data breach when the business associate knew or should have known of a breach of such information. Upon discovery, the business associate must notify the covered entity of the breach. Notifications need to be made in accordance with the executed business associate agreement.

10.4.4 In instances of theft or break-in or other criminal activity, the contractor/subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG and VA Security and Law Enforcement. The contractor, its employees, and its subcontractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The contractor/subcontractor shall cooperate with VA in any civil litigation to recover.

10.5 LIQUIDATED DAMAGES FOR DATA BREACH

10.5.1 Consistent with the requirements of 38 U.S.C. §5725, a contract may require access to sensitive personal information. If so, the contractor is liable to VA for liquidated damages in the event of a data breach or privacy incident involving any SPI the contractor/subcontractor processes or maintains under this contract.

10.5.2 The contractor/subcontractor shall provide notice to VA of a “security incident” as set forth in the Security Incident Investigation section above. Upon such notification, VA must secure from a non-Department entity or the VA Office of Inspector General an independent risk analysis of the data breach to determine the level of risk associated with the data breach for the potential misuse of any sensitive personal information involved in the data breach. The term 'data breach' means the loss, theft, or other unauthorized access, or any access other than that incidental to the scope of employment, to data containing sensitive personal information, in electronic or printed form, that results in the potential compromise of the confidentiality or integrity of the data. Contractor shall fully cooperate with the entity performing the risk analysis. Failure to cooperate may be deemed a material breach and grounds for contract termination.

10.5.3 Each risk analysis shall address all relevant information concerning the data breach, including the following:

(1) Nature of the event (loss, theft, unauthorized access);

(2) Description of the event, including:

(3) Date of occurrence;

(4) Data elements involved, including any PII, such as full name, social security number, date of birth, home address, account number, disability code;

(5) Number of individuals affected or potentially affected;

(6) Names of individuals or groups affected or potentially affected;

(7) Ease of logical data access to the lost, stolen or improperly accessed data considering the degree of protection for the data, e.g., unencrypted, plain text;

(8) Amount of time the data has been out of VA control;

(9) The likelihood that the sensitive personal information will or has been compromised (made accessible to and usable by unauthorized persons); VA information, obtain monetary or other

(10) Known misuses of data containing sensitive personal information, if any;

(11) Assessment of the potential harm to the affected individuals;

(12) Data breach analysis as outlined in 6500.2 Handbook, Management of Security and Privacy Incidents, as appropriate; and

(13) Whether credit protection services may assist record subjects in avoiding or mitigating the results of identity theft based on the sensitive personal information that may have been compromised.

Based on the determinations of the independent risk analysis, the contractor shall be responsible for paying to the VA liquidated damages in the amount of $37.50 per affected individual to cover the cost of providing credit protection services to affected individuals consisting of the following:

(14) Notification;

(15) One year of credit monitoring services consisting of automatic daily monitoring of at least 3 relevant credit bureau reports;

(16) Data breach analysis;

(17) Fraud resolution services, including writing dispute letters, initiating fraud alerts and credit freezes, to assist affected individuals to bring matters to resolution;

(18) One year of identity theft insurance with $20,000.00 coverage at $0 deductible; and

(19) Necessary legal expenses the subjects may incur to repair falsified or damaged credit records, histories, or financial affairs.

10.6 CONFIDENTIALITY AND NONDISCLOSURE

It is agreed that:

10.6.1 The preliminary and final deliverables and all associated working papers, application source code, and other material deemed relevant by the VA which have been generated by the contractor in the performance of this task order are the exclusive property of the U.S. Government and shall be submitted to the CO at the conclusion of the task order.

10.6.2 The CO will be the sole authorized official to release verbally or in writing, any data, the draft deliverables, the final deliverables, or any other written or printed materials pertaining to this task order. No information shall be released by the contractor. Any request for information relating to this task order presented to the contractor shall be submitted to the CO for response.

10.6.3 Press releases, marketing material or any other printed or electronic documentation related to this project, shall not be publicized without the written approval of the CO.

10.6.4 If you should have any questions regarding results of this review, please contact the FISOs at (504) 539-7423, (504) 539-7422 or vhanolisa@va.gov.

10.6.5 Contractors, contractor personnel, subcontractors, and subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security.

11. SCHEDULE AND DELIVERY INSTRUCTIONS:

11.1 The specific deliverables and schedule for delivery shall be per the Schedule of Supplies/Services and the Performance Requirements Summary.

Unsatisfactory Work – Performance by the contractor to correct defects identified by the Government because of quality assurance surveillance and by the contractor because of quality control shall be at the contractor’s own expense without additional reimbursement by the Government.

The acceptance of deliverables and satisfactory work performance required herein shall be based on the standards as specified in the requirements per Section 7 of this document. The COR will review the contractor’s performance indicators in accordance with all the specifications stated in this document. Only the COR or authorized alternate has the authority to inspect, accept, or reject work performed under this contract.

12. QUALITY CONTROL:

12.1 The contractor shall develop, implement, and maintain a complete Quality Control Plan (QCP) that contains, as a minimum, the items listed in Section 7 to the Contracting Officer (CO) for acceptance not later than ten (10) business days after the contract award. The CO will notify the contractor of acceptance or required modifications to the plan within five (5) work days. The contractor shall make appropriate modifications and obtain final acceptance of the plan by the CO within five (5) work days of notification of required changes.

12.2 The plan shall include the following minimum requirements:

12.2.1 A description of the inspection system to cover all services listed in the Performance/Deliverables Matrix. Description shall include specifics as to the areas to be inspected on both a scheduled and unscheduled basis, frequency of inspections, and the title and organizational placement of the inspectors. Additionally, control procedures for any government provided keys or lock combination should be included.

12.2.2 A description of the methods to be used for identifying and preventing defects in the quality of service performed.

12.2.3 A description of the records to be kept to document inspections and corrective or preventive actions taken.

12.2.4 All records of inspections performed shall be retained and made available to the government upon request throughout the contract period of performance, and for the period after contract completion, until final settlement of any claims under this contract.

13. QUALITY ASSURANCE SURVEILLANCE PLAN (QASP)

13.1 A Quality Assurance Surveillance Plan is designed to provide an effective surveillance method of monitoring and evaluating the Contractor performance. Upon contract award, the COR, with the assistance of the CO will establish a complete Quality Assurance Surveillance Plan (QASP) to ensure that the requirements of this contract are being met by the Contractor.

13.2 The objective of the QASP is to reduce the…