A1b - Statement of Work.docx

Statement of Work Waste Removal and Single Stream Recycling Services

SECTION 1 – SCOPE OF WORK

1. Domestic Waste Removal Services for CDC/NIOSH, 1095 Willowdale Road, Morgantown, WV 26505

Contractor shall perform onsite weekly waste removal services including provision of an onsite 35 cubic yard or similar-sized compactor/dumpster to store the waste. The cost of the dumpster rental, removal, and all transportation/fuel costs shall be in one contract line item.

Period of Performance (Base +4):

Base: 2/1/2025 through 1/31/2026 Option 1: 2/1/2026 through 1/31/2027 Option 2: 2/1/2027 through 1/31/2028 Option 3: 2/1/2028 through 1/31/2029 Option 4: 2/1/2029 through 1/31/2030

2. Domestic Waste Removal Services for CDC/NIOSH, 1000 Frederick Lane, Morgantown, WV 26508

Contractor shall perform onsite twice weekly waste removal services including provision of an onsite 3 cubic yard or similar-sized container to store the waste. The cost of the dumpster rental, removal, and all transportation/fuel costs shall be in one contract line item.

Period of Performance (Base +4):

Base: 2/1/2025 through 1/31/2026 Option 1: 2/1/2026through 1/31/2027 Option 2: 2/1/2027 through 1/31/2028 Option 3: 2/1/2028 through 1/31/2029 Option 4: 2/1/2029 through 1/31/2030

3. Single Stream Recycling Services for CDC/NIOSH, 1095 Willowdale Road, Morgantown, WV 26505

Contractor shall perform onsite monthly single stream recyclable removal services including provision of an onsite enclosed 20 cubic yard roll-off recycling container. The cost of the container rental, removal, and all transportation/fuel costs shall be in one contract line item.

Period of Performance (Base +4):

Base: 2/1/2025 through 1/31/2026 Option 1: 2/1/2026through 1/31/2027 Option 2: 2/1/2027 through 1/31/2028

The Contractor’s recycling services shall include the following:

Paper:

Paper Newspaper Envelopes Junk mail Phone books Brochures Magazines

Cardboard:

Ream wrappers File folders Poster board Frozen food boxes Cardboard boxes Milk cartons

Plastic:

Plastics # 1 – 7 Water bottles Take-out containers Soda bottles

Aluminum/Metal:

Aluminum beverage cans Food cans Pots, pans, tins and utensils Scrap metal

Glass:

Beverage containers Glass food jars

SECTION 2 - PERIOD OF PERFORMANCE

Period of Performance (Base +4):

Base: 2/1/2025 through 1/31/2026 Option 1: 2/1/2026through 1/31/2027 Option 2: 2/1/2027 through 1/31/2028

508 Language

Electronic and Information Technology Accessibility

(a) Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d), as amended by the Workforce Investment Act of 1998 and the Architectural and Transportation Barriers Compliance Board Electronic and Information (EIT) Accessibility Standards (36 CFR part 1194), require that when Federal agencies develop, procure, maintain, or use electronic and information technology, Federal employees with disabilities have access to and use of information and data that is comparable to the access and use by Federal employees who are not individuals with disabilities, unless an undue burden would be imposed on the agency. Section 508 also requires that individuals with disabilities, who are members of the public seeking information or services from a Federal agency, have access to and use of information and data that is comparable to that provided to the public who are not individuals with disabilities, unless an undue burden would be imposed on the agency.

(b) Accordingly, any offeror responding to this solicitation must comply with established HHS EIT accessibility standards. Information about Section 508 is available at http://www.hhs.gov/web/508. The complete text of the Section 508 Final Provisions can be accessed at http://www.access-aboard.gov/sec508/standards.htm.

(c) The Section 508 accessibility standards applicable to this contract are: 1194.

205 WCAG 2.0 Level A & AA Success Criteria 302 Functional Performance Criteria 502 Inoperability with Assistive Technology 504 Authoring Tools 602 Support Documentation 603 Support Services

In order to facilitate the Government's determination whether proposed EIT supplies meet applicable Section 508 accessibility standards, offerors must submit an HHS Section 508 Product Assessment Template, in accordance with its completion instructions. The purpose of the template is to assist HHS acquisition and program officials in determining whether proposed EIT supplies conform to applicable Section 508 accessibility standards. The template allows offerors or developers to self-evaluate their supplies and documentation detail - whether they conform to a specific Section 508 accessibility standard, and any underway remediation efforts addressing conformance issues. Instructions for preparing the HHS Section 508 Evaluation Template are available under Section 508 policy on the HHS Web site http://hhs.gov/web/508.

In order to facilitate the Government's determination whether proposed EIT services meet applicable Section 508 accessibility standards, offerors must provide enough information to assist the Government in determining that the EIT services conform to Section 508 accessibility standards, including any underway remediation efforts addressing conformance issues.

(d) Respondents to this solicitation must identify any exception to Section 508 requirements. If a offeror claims its supplies or services meet applicable Section 508 accessibility standards, and it is later determined by the Government, i.e., after award of a contract or order, that supplies or services delivered do not conform to the accessibility standards, remediation of the supplies or services to the level of conformance specified in the contract will be the responsibility of the Contractor at its expense.

(e) Electronic content must be accessible to HHS acceptance criteria. Checklist for various formats are available at http://508.hhs.gov/, or from the Section 508 Coordinator listed at https://www.hhs.gov/web/section-508/additional-resources/section-508-contacts/index.html. Materials that are final items for delivery should be accompanied by the appropriate checklist, except upon approval of the Contracting Officer or Representative.

Physical Access to Government Controlled Facilities Deliverables

Standard Language Training Mandatory Training for All Contractor Staff. All Contractor (and/or any subcontractor) employees assigned to work on this contract shall complete the applicable HHS/CDC Contractor Information Security Awareness, Privacy, and Records Management training (provided upon contract award) before performing any work under this contract. Thereafter, the employees shall complete CDC Security Awareness Training (SAT), Privacy, and Records Management training at least annually, during the life of this contract. All provided training shall be compliant with HHS training policies.

Role-based Training. All Contractor (and/or any subcontractor) employees with significant security responsibilities (as determined by the program manager) must complete role-based training (RBT) within 60 days of assuming their new responsibilities. Thereafter, they shall complete RBT at least annually in accordance with HHS policy and the HHS Role-Based Training (RBT) of Personnel with Significant Security Responsibilities Memorandum.

All HHS employees and contractors with SSR who have not completed the required training within the mandated timeframes shall have their user accounts disabled until they have met their RBT requirement.

Training Records. The Contractor (and/or any subcontractor) shall maintain training records for all its employees working under this contract in accordance with HHS policy. A copy of the training records shall be provided to the CO and/or COR within 30 days after contract award and annually thereafter or upon request.

Incident Response The contractor shall cooperate with and exchange information with CDC officials, as deemed necessary by the CDC Breach Response Team, to report and manage a suspected or confirmed breach.

The Contractor (and/or any subcontractor) must respond to all alerts/Indicators of Compromise (IOCs)provided by HHS Computer Security Incident Response Center (CSIRC)/CDC IRT teams within 24 hours, whether the response is positive or negative. In accordance with FISMA and OMB M-17-12, Preparing for and Responding to a Breach of Personally Identifiable Information (PII), an incident is "an occurrence that (1) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (2) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies" and a privacy breach is "the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where (1) a person other than an authorized user accesses or potentially accesses personally identifiable information or (2) an authorized user accesses or potentially accesses personally identifiable information for an other than authorized purpose." For additional information on the HHS breach response process, please see the HHS Policy and Plan for Preparing for and Responding to a Breach of Personally Identifiable Information (PII)."

In the event of a suspected or confirmed incident or breach, the Contractor (and/or any subcontractor) must:

i. Protect all sensitive information, including any PII created, stored, or transmitted in the performance of this contract, with encryption solution that is validated with current FIPS 140 validation certificate from the NIST CMVP.

ii. NOT notify affected individuals unless so instructed by the Contracting Officer or designated representative. If so instructed by the Contracting Officer or representative, the Contractor must send CDC/HHS approved notifications to affected individuals.

iii. All contractors and subcontractors shall report a suspected or confirmed breach in any medium or form, including paper, oral, or electronic, as soon as possible and without unreasonable delay as soon as possible and no later than one (1) hour of discovery, consistent with applicable CDC IT acquisitions guidance, HHS/CDC, incident management policy, and United States Computer Emergency Readiness Team (US-CERT) notification guidelines. To this end, the Contractor (and/or any subcontractor) shall respond to all alerts/Indicators of Compromise (IOCs) provided by HHS Computer Security Incident Response Center (CSIRC) or CDC Computer Incident Response Team (CSIRT) within 24 hours via email at csirt@cdc.gov or telephone at 866-655-2245, whether the response is positive or negative. The types of information required in an incident report must include at a minimum: company and point of contact information, contact information, impact classifications/threat vector, and the type of information compromised. In addition, the Contractor must:

i. Cooperate and exchange any information, as determined by the Agency, necessary to effectively manage or mitigate a suspected or confirmed breach;

ii. Not include any sensitive information in the subject or body of any reporting e-mail; and

iii. Encrypt sensitive information in attachments to email, media, etc.

Comply with OMB M-17-12, Preparing for and Responding to a Breach of Personally Identifiable Information, and HHS/CDC privacy breach response policies when handling PII breaches.

Provide full access and cooperate on all activities as determined by the Government to ensure an effective incident response, including providing all requested images, log files, and event information to facilitate rapid resolution of sensitive information incidents. This may involve disconnecting the system processing, storing, or transmitting the sensitive information from the Internet or other networks or applying additional security controls. This may also involve physical access to contractor facilities during a breach/incident investigation.

Homeland Security Presidential Directive (HSPD)-12 The Contractor (and/or any subcontractor) and its employees shall comply with Homeland Security Presidential Directive (HSPD)-12, Policy for a Common Identification Standard for Federal Employees and Contractors; OMB M-05-24; FIPS 201, Personal Identity Verification (PIV) of Federal Employees and Contractors; HHS HSPD-12 policy; and Executive Order 13467, Part 1 §1.2.

Roster Roster. The Contractor (and/or any subcontractor) shall submit a roster by name, position, e-mail address, phone number and responsibility of all staff working under this acquisition where the Contractor will develop, have the ability to access, or host and/or maintain a government information system(s). The roster shall be submitted to the COR and/or CO by the effective date of this contract. Any revisions to the roster as a result of staffing changes shall be submitted immediately upon change. The COR will notify the Contractor of the appropriate level of investigation required for each staff member.

If the employee is filling a new position, the Contractor shall provide a position description and the Government will determine the appropriate suitability level.

Records Management and Retention

1. The Contractor (and/or any subcontractor) must maintain all information in accordance with Executive Order 13556 -- Controlled Unclassified Information, National Archives and Records Administration (NARA) records retention policies and schedules and HHS Policy for Records Management and CDC policies and must not dispose of any records unless authorized by HHS/CDC In the event that a contractor (and/or any subcontractor) accidentally disposes of or destroys a record without proper authorization, he/she must document and report the incident in accordance with HHS/CDC policies.

COVID-19 Language HHS reserves the right to exercise priorities and allocations authority with respect to this contract, to include rating this order in accordance with 45 CFR Part 101, Subpart A—Health Resources Priorities and Allocations System.