Additional Requirements 36C25621Q1711.pdf

Combined Synopsis/Solicitation 36C25621Q1711 – Document Destruction Services

1. This is a combined synopsis/solicitation for commercial items prepared in accordance with the format in Federal

Acquisition Regulation (FAR) subpart 12.6, in conjunction with FAR Part 13.5, Simplified Procedures for Certain

Commercial Items as supplemented with additional information included in this notice. This announcement constitutes the only solicitation; quotes are being requested and a written solicitation will not be issued. This solicitation is issued unrestricted as a total Service-Disabled Veteran Owned Small Business set-aside.

2. The combined synopsis solicitation number is 36C25621Q1711. It is issued as a Request for Quote. The Government anticipates awarding one firm-fixed price contract resulting from this solicitation.

3. Solicitation document and incorporated provisions and clauses are those in effect through Federal Acquisition Circular

2021-06 (effective 7/12/2021).

4. This requirement is solicited as a total Service Disabled Veteran Owned Small Business Set-Aside. The North

American Industry Classification System number is 561990 with a size standard of $12,000,000.00.

5. The contractor shall provide document destruction services as outlined in the Performance Work Statement (PWS).

Wage Determinations (WD) 2015-5233, Revision 18, Dated July 20, 2021, WD 2015-5217, Revision 17, Dated July 20, 2021, and WD 2015-5279, Revision 18, Dated July 20, 2021 applies to this requirement.

6. Places of Performance:

Main Campus

Michael E. DeBakey VA medical Center main campus

2002 Holcombe Boulevard, Houston, Texas 77030

Community Based Out Patient Clinics

Beaumont: 3420 Veterans Circle, Beaumont, TX 77707

Conroe: Loop 3360, Conroe, TX 77304

Galveston: 3828 Avenue N, Galveston, TX 77550

Katy: 750 Westgreen Blvd. Ste. 300, Katy, TX 77450

Lake Jackson: 208 Oak Drive South, Lake Jackson, TX 77566

Lufkin (Charles Wilson): 2206 North John Redditt Drive, Lufkin. TX 75904

Richmond: 22001 Southwest Freeway, Ste. 200, Richmond, TX 77469

Texas City: 9300 Emmett F. Lowry Express way, Ste. 206, Texas City, TX 77591

Tomball: 1200 Main Street, Tomball, TX 77375

Sugarland: 1327 Lake Pointe Parkway, Ste. 520 ( ST. Luke’s Professional Bldg.)

Humble: 1845 FM 1960 Bypass Rd. E , Humble, TX 77338

Houston (Downtown): 1418 Preston, Houston, TX 77002

7. Period of Performance:

The period of performance is a 12-month base period with four 12-month option periods exercisable at the discretion of the Government.

8. A complete description of the services to be acquired, and/or applicable Government need(s) are as follows:

See Attached 36C25621Q1711 - Additional Requirements

Contracting Office:

Department of Veterans Affairs

Regional Procurement Office Central

Network Contracting Office (NCO) -16

2002 Holcombe Blvd., Bldg. 100

Houston, Texas

Contracting Officer:

Orlando Whitaker

Point of Contact (POC) Information:

Email: Orlando.Whitaker@va.gov

Quotes in response to this combined synopsis/solicitation are due at 11:00AM Central Standard Time (CST), September 9, 2021. Quotes shall be submitted in writing and sent via email to orlando.whitaker@va.gov. Please insert “RFQ 36C25621Q1711 – Document Destruction Services” in the subject line of your email. Questions regarding this solicitation shall be submitted via email to Contracting Officer, Orlando Whitaker at

Orlando.Whitaker@va.gov no later than 11:00AM CST on September 3, 2021. If questions are received, all responses will be posted with all questions and answers to the same announcement.

COMPLETING A QUOTE FOR SUBMITTAL

a. The Quoter shall complete Contract Administration and provide the name, title, address, email address and telephone number of the company/division point of contact regarding business decisions made with respect to the quote and who can contractually obligate the company. The quoter shall identify those individuals authorized to negotiate with the

Government.

b. See Section B.1, Price Cost Schedule. Pricing for each CLIN must be submitted in the proper format. The proper format consists of QUANTITY *UNIT PRICE = AMOUNT/NET AMOUNT. In the event there is a discrepancy in the calculation, the UNIT PRICE will be held to the intended price multiplied by the QUANTITY. If the quoter shows only the AMOUNT/NET AMOUNT, but fails to enter a UNIT PRICE, the AMOUNT/NET AMOUNT divided by the

QUANTITY will be held to be the intended price.

d. The provision at FAR 52.212-1, Addendum to Instructions to Quoters-Commercial, applies to this acquisition.

e. The provision at FAR 52.212-2, Addendum Evaluation-Commercial Items applies to this acquisition. See FAR 52.212-

2 Addendum for additional information.

f. All delivery of items and services shall be performed in accordance with the Statement of Work and 36C25621Q1711 –

Additional Requirements.

g. Quoter must submit both Technical and Price volumes. See FAR Clause 52.212-2 Addendum for basis for award.

h. All quotes shall remain valid for 120 calendar days.

Attachments(s):

1. 36C25621Q1711 – Additional Requirements

2. Wage Determinations mailto:Orlando.Whitaker@va.gov mailto:orlando.whitaker@va.gov mailto:Orlando.Whitaker@va.gov

36C25621Q1711

SECTION B - CONTINUATION OF SF 1449 BLOCKS

B.1 CONTRACT ADMINISTRATION DATA

1. Contract Administration: All contract administration matters will be handled by the following individuals:

a. CONTRACTOR:

b. GOVERNMENT: Contracting Officer 36C256

Network Contracting Office 16

Michael E. DeBakey VA Medical Center

2002 Holcombe BLVD

Houston TX 77030 4298

2. CONTRACTOR REMITTANCE ADDRESS: All payments by the Government to the contractor will be made in accordance with:

[X] 52.232-33, Payment by Electronic Funds Transfer—System For Award Management, or

[] 52.232-36, Payment by Third Party

3. INVOICES: Invoices shall be submitted in arrears:

a. Quarterly []

b. Semi-Annually []

c. Other []

4. GOVERNMENT INVOICE ADDRESS: All Invoices from the contractor shall be submitted electronically in accordance with VAAR Clause 852.232-72 Electronic Submission of Payment Requests.

FSC e-Invoice Payment http://www.fsc.va.gov/fsc/einvoice.asp

Invoice Setup Information 1-877-489-6135 invoice must be submitted electronically

ACKNOWLEDGMENT OF AMENDMENTS: The offeror acknowledges receipt of amendments to the

Solicitation numbered and dated as follows:

AMENDMENT NO DATE

B.2 PRICE/COST SCHEDULE

ITEM INFORMATION

ITEM

NUMBER

DESCRIPTION OF

SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

12.00 MO __________________ __________________

Estimated

The contractor shall provide services in accordance with the PWS for the Houston

(Main Campus) location.

Rate Per Container $___________________

Monday thru Friday

Three times a week each container

340-360 containers

Contract Period: Base

POP Begin: 09-24-2021

POP End: 09-23-2022

The contractor shall provide services in accordance with the PWS for the Sugar Land location.

Once per Month

10 containers

Contract Period: Base

The contractor shall provide services in accordance with the PWS for the Beaumont

Once per Week

40 containers

Contract Period: Base

Estimated

The contractor shall provide services in accordance with the PWS for the Conroe

27 containers

Contract Period: Base

The contractor shall provide services in accordance with the PWS for the Galveston

Contract Period: Base

The contractor shall provide services in accordance with the PWS for the Katy

25 containers

Contract Period: Base

The contractor shall provide services in accordance with the PWS for the Lake

Jackson location.

8 containers

Contract Period: Base

The contractor shall provide services in accordance with the PWS for the Lufkin

30 containers

Contract Period: Base

The contractor shall provide services in accordance with the PWS for the Richmond

Contract Period: Base

The contractor shall provide services in accordance with the PWS for the Texas City

11 containers

Contract Period: Base

The contractor shall provide services in accordance with the PWS for the Tomball

Contract Period: Base

The contractor shall provide services in accordance with the PWS for the Houston

(Downtown) location.

1 (98gal Toter)

Contract Period: Base

The contractor shall provide services in accordance with the PWS for the Humble

Once per Month

5 containers

Contract Period: Base

4.00 JB __________________ __________________

The contractor shall provide an End of Quarter Purge in accordance with the PWS.

Rate Per Purge $___________________

4 Times Per Year

Contract Period: Base

1.00 JB __________________ __________________

The contractor shall provide additional purge services in accordance with the PWS.

Once Per Year

30 (96 gallon toter) Containers

Contract Period: Base

The contractor shall provide services in accordance with the PWS for the Houston

340-360 containers

Contract Period: Option 1

POP Begin: 09-24-2022

POP End: 09-23-2023

The contractor shall provide services in accordance with the PWS for the Sugar Land

Contract Period: Option 1

The contractor shall provide services in accordance with the PWS for the Beaumont

Contract Period: Option 1

The contractor shall provide services in accordance with the PWS for the Conroe

Contract Period: Option 1

The contractor shall provide services in accordance with the PWS for the Galveston

Contract Period: Option 1

The contractor shall provide services in accordance with the PWS for the Katy

Contract Period: Option 1

The contractor shall provide services in accordance with the PWS for the Lake

Contract Period: Option 1

The contractor shall provide services in accordance with the PWS for the Lufkin

Contract Period: Option 1

The contractor shall provide services in accordance with the PWS for the Richmond

Contract Period: Option 1

The contractor shall provide services in accordance with the PWS for the Texas City

Contract Period: Option 1

The contractor shall provide services in accordance with the PWS for the Tomball

Contract Period: Option 1

The contractor shall provide services in accordance with the PWS for the Houston

Contract Period: Option 1

The contractor shall provide services in accordance with the PWS for the Humble

5 containers

Contract Period: Option 1

Contract Period: Option 1

Contract Period: Option 1

The contractor shall provide services in accordance with the PWS for the Houston

340-360 containers

Contract Period: Option 2

POP Begin: 09-24-2023

POP End: 09-23-2024

The contractor shall provide services in accordance with the PWS for the Sugar Land

10 containers

Contract Period: Option 2

The contractor shall provide services in accordance with the PWS for the Beaumont

Contract Period: Option 2

The contractor shall provide services in accordance with the PWS for the Conroe

Contract Period: Option 2

The contractor shall provide services in accordance with the PWS for the Galveston

Contract Period: Option 2

The contractor shall provide services in accordance with the PWS for the Katy

Contract Period: Option 2

The contractor shall provide services in accordance with the PWS for the Lake

Contract Period: Option 2

The contractor shall provide services in accordance with the PWS for the Lufkin

Contract Period: Option 2

The contractor shall provide services in accordance with the PWS for the Richmond

Contract Period: Option 2

The contractor shall provide services in accordance with the PWS for the Texas City

Contract Period: Option 2

The contractor shall provide services in accordance with the PWS for the Tomball

Contract Period: Option 2

The contractor shall provide services in accordance with the PWS for the Houston

Contract Period: Option 2

The contractor shall provide services in accordance with the PWS for the Humble

Contract Period: Option 2

Contract Period: Option 2

Contract Period: Option 2

The contractor shall provide services in accordance with the PWS for the Houston

340-360 containers

Contract Period: Option 3

POP Begin: 09-24-2024

POP End: 09-23-2025

The contractor shall provide services in accordance with the PWS for the Sugar Land

Contract Period: Option 3

The contractor shall provide services in accordance with the PWS for the Beaumont

Contract Period: Option 3

The contractor shall provide services in accordance with the PWS for the Conroe

Contract Period: Option 3

The contractor shall provide services in accordance with the PWS for the Galveston

Contract Period: Option 3

The contractor shall provide services in accordance with the PWS for the Katy

Once per Week

25 containers

Contract Period: Option 3

The contractor shall provide services in accordance with the PWS for the Lake

Contract Period: Option 3

The contractor shall provide services in accordance with the PWS for the Lufkin

Contract Period: Option 3

The contractor shall provide services in accordance with the PWS for the Richmond

Contract Period: Option 3

The contractor shall provide services in accordance with the PWS for the Texas City

Contract Period: Option 3

Estimated

The contractor shall provide services in accordance with the PWS for the Tomball

Contract Period: Option 3

The contractor shall provide services in accordance with the PWS for the Houston

Contract Period: Option 3

The contractor shall provide services in accordance with the PWS for the Humble

Contract Period: Option 3

Contract Period: Option 3

Contract Period: Option 3

The contractor shall provide services in accordance with the PWS for the Houston

340-360 containers

Contract Period: Option 4

POP Begin: 09-24-2025

POP End: 09-23-2026

The contractor shall provide services in accordance with the PWS for the Sugar Land

Contract Period: Option 4

The contractor shall provide services in accordance with the PWS for the Beaumont

Contract Period: Option 4

The contractor shall provide services in accordance with the PWS for the Conroe

Contract Period: Option 4

The contractor shall provide services in accordance with the PWS for the Galveston

Contract Period: Option 4

The contractor shall provide services in accordance with the PWS for the Katy

Contract Period: Option 4

The contractor shall provide services in accordance with the PWS for the Lake

Contract Period: Option 4

The contractor shall provide services in accordance with the PWS for the Lufkin

Contract Period: Option 4

The contractor shall provide services in accordance with the PWS for the Richmond

Contract Period: Option 4

The contractor shall provide services in accordance with the PWS for the Texas City

Contract Period: Option 4

The contractor shall provide services in accordance with the PWS for the Tomball

Contract Period: Option 4

The contractor shall provide services in accordance with the PWS for the Houston

Contract Period: Option 4

The contractor shall provide services in accordance with the PWS for the Humble

Contract Period: Option 4

Contract Period: Option 4

Contract Period: Option 4

GRAND TOTAL __________________

PERFORMANCE WORK STATEMENT

ON-SITE DOCUMENT DESTRUCTION

MICHAEL E. DEBAKEY VETERANS AFFAIRS MEDICAL CENTER

A. GENERAL:

1. The contractor shall provide all labor, personnel, equipment, supplies, secured vehicles, materials, supervision and other related services necessary to provide on-site commercial document destruction (shredding) services for the Michael E. DeBakey Veterans Affairs Medical

Center (MEDVAMC) and affiliated Community Based Out Patient Clinics (CBOCs) in

Beaumont, Conroe, Galveston, Katy, Lake Jackson, Lufkin, Richmond, Texas City, Tomball, Sugarland, Houston (Downtown) and Humble. Pickup schedule for each location is identified in location. Changes to the schedule shall be coordinated with the Contracting Officer

Representative (COR). The contractor shall be responsible for pick-up and return of bins to collection locations. The Government intends to award a firm fixed price requirements contract.

The quantities are estimated in the solicitation and impending award. Fixed quantities and amounts will be listed on the Task Orders issued against the Requirements contract after award.

2. The locations for the bulk containers are subject to change by the Government. The Government shall notify the contractor, in writing, of location changes or adding of additional bins.

3. The Contractor Furnished Equipment shall be 36" tall / 32-gallon front feed lockable consoles.

Executive Consoles shall be installed in specific locations by the contractor. Changes in location of any console shall be by agreement of both the Government Contracting Officer (CO) and the contractor. Any console movement shall be accomplished by the contractor.

4. Container Access. The Contractor shall provide keys to the COR at each location to the secure, locked containers used to store material for destruction/shredding in case of emergency.

B. WORK HOURS:

1. Normal Work Hours: VA normal business hours, 7:30 a.m. through 4:30 p.m., Monday through

Friday, excluding Federal holidays any scheduled work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO). VA follows all

Federal holidays that are set by law (USC Title 5 Section 6103).

The Government hereby provides notice and Contractor hereby acknowledges receipt that Government personnel observe the listed days as holidays:

New Year's Day January 1

Martin Luther King's Birthday Third Monday in January

President's Birthday Third Monday in February

Memorial Day Last Monday in May

Independence Day July 4

Labor Day First Monday in September

Columbus Day Second Monday in October

Veterans Day November 11

Thanksgiving Day Fourth Thursday in November

Christmas December 25

In addition to the days designated as holidays, the Government observes the following days:

1. Any other day designated by Executive Order;

2. Any other day designated by the President’s Proclamation; and

3. Any other day designated by Federal Statute.

C. PERIOD OF PERFORMANCE: The period of performance shall be a base period of 12 months with four 12-month option periods exercisable by the discretion of the Government. The base period includes a transition period from September 24, 2021 through September 28, 2021. The contractor shall be at full performance by September 29, 2021.

Base Year: 24 September 2021 - 23

September 2022

1st Option Period 24 September 2022 - 23

September 2023

2nd Option Period 24 September 2023 - 23

September 2024

3rd Option Period 24 September 2024 - 23

September 2025

4th Option Period 24 September 2025 - 23

September 2026

D. SHREDDING SPECIFICATIONS:

The on-site process through which temporary records are pulped, macerated or shredded shall be to a degree that definitively ensures that they are not readable or reconstructed to any degree. Periodically

(unscheduled and at any of the identified facilities) at the COR’s request, a sample of shredded material shall be provided to the Privacy Officer for confirmation that the onsite shredding is to a degree that meets final destruction requirements. The contractor shall protect, safeguard, control, manage and destroy VA designated confidential documents complying with VA Directive 6371, Appendix A, 2014.

Final destruction shall be performed onsite. Information shall also be protected in accordance with the

Privacy Act and Health Insurance Portability and Accountability Act (HIPAA) of 1992. Shredder shall be of such capacity that limited quantities of incidentals such as paper clips, staples, rubber bands, patient plastic armbands and other types of paper can be shredded.

E. TASKS:

Contractor shall perform tasks described below:

Collection Points:

Main Campus

Michael E. DeBakey VA medical Center main campus

2002 Holcombe Boulevard, Houston, Texas 77030

Community Based Out Patient Clinics

Beaumont: 3420 Veterans Circle, Beaumont, TX 77707

Conroe: Loop 3360, Conroe, TX 77304

Galveston: 3828 Avenue N, Galveston, TX 77550

Katy: 750 Westgreen Blvd. Ste. 300, Katy, TX 77450

Lake Jackson: 208 Oak Drive South, Lake Jackson, TX 77566

Lufkin (Charles Wilson): 2206 North John Redditt Drive, Lufkin. TX 75904

Richmond: 22001 Southwest Freeway, Ste. 200, Richmond, TX 77469

Texas City: 9300 Emmett F. Lowry Express way, Ste. 206, Texas City, TX 77591

Tomball: 1200 Main Street, Tomball, TX 77375

Sugarland: 1327 Lake Pointe Parkway, Ste. 520 ( ST. Luke’s Professional Bldg.)

Humble: 1845 FM 1960 Bypass Rd. E , Humble, TX 77338

Houston (Downtown): 1418 Preston, Houston, TX 77002

1. Collection Sites: Contractor shall pick up all bins from locations specified in the list of bin locations listed below. All shredding must be done on-site at the MEDVAMC and affiliated CBOCs.

The contractor shall maintain a chain of security/custody from pick up to final destruction. The

Contractor will provide to the Government a Certificate of Destruction which contains all the required elements described in the PWS. The warehouse at the Michael E. DeBakey VA Medical

Center main campus has a storage area for contractor use which fits between fifteen to twenty 96-gallon totters.

F. CERTIFICATE OF DESTRUCTION.

LOCATIONS

Facility Number of Containers Frequency

Houston (Main Campus)

Bldg 100

Bldg 103

Bldg 108

Bldg 108A

Bldg 109

Bldg 110

Bldg 120

Bldg 125 (12-20 EC)

340-360 Monday thru Friday

Sugar Land 10 Once per Month

Beaumont 40 Once Per Week

Conroe 27 Once Per Week

Galveston 10 Once Per Month

Katy 25 Once Per Week

Lake Jackson 8 Once per Month

Lufkin 30 Once per Month

Richmond 8 Once per Month

Texas City 11 Once per Month

Tomball 25 Once Per Week

Houston (Downtown) 1 (98gal Toter) Once Per Month

Humble 5 Once Per Month

End of Quarter Purge 4 4 times a year

Additional Purge Service (Per 96 gal Toter)

30 Per year

Total HSM Executive Security

Console (EC)

1. Shredding shall be conducted on site at collection points. The MEDVAMC COR or representative shall be present to observe the process at any time to ensure proper quality control.

2. If shredding is not the final destruction method and shredding is only an interim step in the destruction process, then shredding to National Institute of Standards Technology

(NIST) standards is not required, but the shredded material must be secured until it is no longer readable or able to be reconstructed, which means material must be pulverized bleached, pulped or fully destroyed by other means.

3. Contractor shall furnish facility pounds of shredded materials (monthly, quarterly, and/or annually as requested by the COR).

4. All containers shall have a barcode on the interior of the locking security container.

Each container shall be scanned with each service. A document shall be sent to the

COR to ensure the container was serviced. The contractor shall furnish this document

(monthly, quarterly, and/or annually as requested by the COR).

5. The Contractor shall be responsible for maintaining the security of the bins and their contents at all times during the collection process.

6. The Contractor shall ensure that locked containers are returned to their assigned locations after shredding is completed by the Contractor's personnel.

7. Contractor shall perform shredding/pick-up on days listed above. Any changes to the schedule shall be approved in advance of the contractor visiting the facilities.

8. Contractor shall provide a Certificate of Destruction for every date document were destroyed.

9. Any additional service calls will be answered with in 24hrs.

10. When the Government is in need of additional Purge Services. This will be a Price per Container cost. (96 gal Toter)

11. End of quarter clean out purge event shall be performed four times a year. The annual purge amount from the four quarterly purges averages up to 25 pallets per year. The amount of each quarterly purge varies.

12. Environmental certificates shall be provided on a yearly basis in an effort to comply with

VA’s policy to maintain a green environment by reducing the amount of waste going to landfills through recycling.

13. Insurance shall be provided for destruction of VA material.

14. Contractor shall be bonded or be covered for Error and Omissions Insurance in the amount of at least $500,000. PROOF OF SUCH SHALL BE SUBMITTED TO COR NO LATER

THAN SEVEN DAYS AFTER EFFECTIVE DATE OF AWARD.

G. NON-DISCLOSURE OF SENSITIVE INFORMATION

1. Contractor staff involved in this contract will have access to some privileged and confidential materials of the U.S. Government. These printed and electronic documents are for internal use only and remain the sole property of the U.S. Government. Some of the materials are protected by

Privacy Act of 1974 (Amended) and Title 38. Unauthorized disclosure of Privacy Act or Title 38 covered materials, by any contractor or subcontracted staff, is a criminal offense. The contractor shall be responsible for actions of contract employees.

2. The contractor acknowledges that in the performance of this contract, the contractor will have access to sensitive information, including information provided on a proprietary basis by carriers, equipment manufacturers, and other private or public entities. The contractor agrees to safeguard these privileges and use the information exclusively in the performance of this contract. The contractor shall comply with applicable Government regulations regarding information document security to prevent disclosure of sensitive information to unauthorized individuals or organizations.

The contractor shall not inspect, view, peruse, copy, or examine any confidential material or document whether designated for shredding/disposal or not. Should any violation or breach of this provision occur, such shall constitute cause for immediate termination of this contract upon receipt of written notice of such termination.

H. INSPECTION: Representatives of the Government shall have the right to inspect the contractor’s and/or Subcontractor’s facilities and operations provided for the performance of work under this agreement. This includes inspection of the entire process – pickup, onsite shredding, and final disposal of the document.

I. CONTRACTOR QUALITY CONTROL: The contractor shall develop and maintain quality control programs to ensure destruction services are performed in accordance with mandated specifications, regulations and laws. The contractor shall implement procedures to identify and prevent the occurrence of defective services.

J. CERTIFICATION OF DESTRUCTION: The contractor shall deliver industry standard

Certificate of Destruction for completed destruction according to the NIST and FIPS Regulation.

The certificate should be ELECTRONICALLY delivered to the COR on the 1st and 15th of each month. The contractor shall maintain proper records concerning each Certificate of Destruction issued. The Certificate of Destruction shall at a minimum contain the following:

1. Pickup/Delivery Location

2. Pickup/Delivery Date

3. Name and signature of Government Contact or designee at Pickup Location

4. Amount of shredded waste (number of containers picked up and/or pounds shredded)

5. Destruction Certification Document Number

6. Destruction Certification Date

7. Any other information as determined necessary by the COR.

8. Name and signature of contractor’s employee who observed final destruction

K. PRIVACY POLICY TRAINING: All contractor and subcontractor employees performing work under this contract are required to complete VA 10203 HIPAA and Privacy Training.

• Successfully complete VA General Privacy training and annual refresher training as required.

A copy of the training certificates for each applicable employee shall be provided to the COR within (1) week of the initiation of the contract and annually thereafter, as required. These online courses are located at the following website: (https://www.tms.va.gov). Failure to complete this mandatory training within the timeframe required will be grounds for suspension or termination of all physical and/or electronic privileges and removal from work on the contract until such time as the training is completed.

L. CONTRACTOR PERSONNEL BADGES AND PARKING:

1. The contractor shall provide the COR with a list of contractor employees expected to pick up confidential documents. While on VA premises, all contractor personnel shall comply with the rules, regulations, and procedures governing the conduct of personnel and the operation of the facility.

2. Contractor employees found reading any of the VA materials shall be promptly removed from the premises where the on-site document destruction (shredding) is being performed and the person(s) involved shall not be allowed to return for any future on-site document destruction

(shredding) services.

3. All contract personnel must properly display their access badges. Access badges must be worn at or above the waist (facing forward). The contractor’s employees must display contractor’s badge(s) to the contact person or designee at the end of each pick-up process.

https://www.tms.va.gov/ https://www.tms.va.gov/ https://www.tms.va.gov/ https://www.tms.va.gov/ https://www.tms.va.gov/

4. The contractor shall be required to comply with all security policies/requirements of

MEDVAMC. All security policies/requirements must be met, and employees cleared prior to the contractor performing work under this contract. Employees that cannot meet the security and clearance requirements shall not be allowed to perform work under this contract.

5. It is the responsibility of the contractor’s personnel to park in the appropriate designated parking areas. Parking information shall be coordinated with each facility Supervisory, Environment of Care Specialist at the LR and NLR facilities.

6. MEDVAMC does not validate or make reimbursement for parking violations of the contractor’s personnel under any circumstance

7. Uniforms supplied by the Company shall be worn at all times while personnel are on duty.

8. Upon termination or departure of any Contractor employee, the Contractor shall notify the

Government within 24 hours. The Contractor shall return all government issued badges from the employee and return the badges to the government within 72 hours of the employee’s employment end date.

M. QUALITY ASSURANCE: The Government will receive and investigate complaints from various customers located at MEDVAMC. All information received will be provided either verbally and/or in writing to the contractor for appropriate action.

Performance Objective Performance Threshold

Contractor picks up from all designated areas as outlined above in the final contract, dependent on the final shredding method agreed upon between

MEDVAMC and the contractor.

Less than three (3) verified complaints of non-pickups per quarter.

N. CHANGES TO CONTRACT OR PWS: Changes to this PWS or the impending contract shall only be authorized and approved through written correspondence from the CO. A copy of each change shall be kept in a project folder along with all other documents or items pertaining to the project. Costs incurred by the Contractor through the actions of parties other than the CO shall be borne by the Contractor.

O. SECURITY

A Business Associate Agreement (BAA) shall be required for this contract. A local BAA shall be put in place if the VA Privacy Officer does not determine a valid National BAA is in place for this contractor. Regardless of the determination, the contractor shall provide a signed BAA with their quote.

VA INFORMATION AND INFORMATION SYSTEM SECURITY/PRIVACY

LANGUAGE

1. GENERAL

Contractors, contractor personnel, subcontractors, and subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security.

2. ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS

a. A contractor/subcontrator shall request logical (technical) or physical access to VA information and VA information systems for their employees, subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order.

b. All contractors, subcontractors, and third-party servicers and associates working with

VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures.

c. Contract personnel who require access to national security programs must have a valid security clearance. National Industrial Security Program (NISP) was established by Executive

Order 12829 to ensure that cleared U.S. defense industry contract personnel safeguard the classified information in their possession while performing work on contracts, programs, bids, or research and development efforts. The Department of Veterans Affairs does not have a

Memorandum of Agreement with Defense Security Service (DSS). Verification of a Security

Clearance must be processed through the Special Security Officer located in the Planning and

National Security Service within the Office of Operations, Security, and Preparedness.

d. Custom software development and outsourced operations must be located in the U.S.

to the maximum extent practical. If such services are proposed to be performed abroad and are not disallowed by other VA policy or mandates, the contractor/subcontractor must state where all non-U.S. services are provided and detail a security plan, deemed to be acceptable by VA, specifically to address mitigation of the resulting problems of communication, control, data protection, and so forth. Location within the U.S. may be an evaluation factor.

e. The contractor or subcontractor must notify the Contracting Officer immediately when an employee working on a VA system or with access to VA information is reassigned or leaves the contractor or subcontractor’s employ. The Contracting Officer must also be notified immediately by the contractor or subcontractor prior to an unfriendly termination.

3. VA INFORMATION CUSTODIAL LANGUAGE

a. Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the contractor/subcontractor's rights to use data as described in Rights in Data

- General, FAR 52.227-14(d) (1).

b. VA information should not be co-mingled, if possible, with any other data on the contractors/subcontractor’s information systems or media storage systems in order to ensure

VA requirements related to data protection and media sanitization can be met. If co-mingling must be allowed to meet the requirements of the business need, the contractor must ensure that VA’s information is returned to the VA or destroyed in accordance with VA’s sanitization requirements. VA reserves the right to conduct on site inspections of contractor and subcontractor IT resources to ensure data security controls, separation of data and job duties, and destruction/media sanitization procedures are in compliance with VA directive requirements.

c. Prior to termination or completion of this contract, contractor/subcontractor must not destroy information received from VA, or gathered/created by the contractor in the course of performing this contract without prior written approval by the VA. Any data destruction done on behalf of VA by a contractor/subcontractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media

Sanitization. Self-certification by the contractor that the data destruction requirements above have been met must be sent to the VA Contracting Officer within 30 days of termination of the contract.

d. The contractor/subcontractor must receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with the terms of the contract and applicable Federal and VA information confidentiality and security laws, regulations and policies. If Federal or VA information confidentiality and security laws, regulations and policies become applicable to the VA information or information systems after execution of the contract, or if NIST issues or updates applicable FIPS or Special Publications (SP) after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations and policies in this contract.

e. The contractor/subcontractor shall not make copies of VA information except as authorized and necessary to perform the terms of the agreement or to preserve electronic information stored on contractor/subcontractor electronic storage media for restoration in case any electronic equipment or data used by the contractor/subcontractor needs to be restored to an operating state. If copies are made for restoration purposes, after the restoration is complete, the copies must be appropriately destroyed.

f. If VA determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12.

g. If a VHA contract is terminated for cause, the associated BAA must also be terminated and appropriate actions taken in accordance with VHA Handbook 1600.01, Business

Associate Agreements. Absent an agreement to use or disclose protected health information, there is no business associate relationship.

h. The contractor/subcontractor must store, transport, or transmit VA sensitive information in an encrypted form, using VA-approved encryption tools that are, at a minimum, FIPS 140-2 validated.

i. The contractor/subcontractor’s firewall and Web services security controls, if applicable, shall meet or exceed VA’s minimum requirements. VA Configuration Guidelines are available upon request.

j. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor/subcontractor may use and disclose VA information only in two other situations: (i) in response to a qualifying order of a court of competent jurisdiction, or (ii) with VA’s prior written approval. The contractor/subcontractor must refer all requests for, demands for production of, or inquiries about, VA information and information systems to the VA contracting officer for response.

k. Notwithstanding the provision above, the contractor/subcontractor shall not release VA records protected by Title 38 U.S.C. 5705, confidentiality of medical quality assurance records and/or Title 38 U.S.C. 7332, confidentiality of certain health records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse, or infection with human immunodeficiency virus. If the contractor/subcontractor is in receipt of a court order or other requests for the above mentioned information, that contractor/subcontractor shall immediately refer such court orders or other requests to the VA contracting officer for response.

l. For service that involves the storage, generating, transmitting, or exchanging of VA sensitive information but does not require C&A or an MOU-ISA for system interconnection, the contractor/subcontractor must complete a Contractor Security Control Assessment (CSCA) on a yearly basis and provide it to the COTR.

4. SECURITY INCIDENT INVESTIGATION

a. The term “security incident” means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. The contractor/subcontractor shall immediately notify the COTR and simultaneously, the designated ISO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/subcontractor has access.

b. To the extent known by the contractor/subcontractor, the contractor/subcontractor’s notice to VA shall identify the information involved, the circumstances surrounding the incident

(including to whom, how, when, and where the VA information or assets were placed at risk or compromised), and any other information that the contractor/subcontractor considers relevant.

c. With respect to unsecured protected health information, the business associate is deemed to have discovered a data breach when the business associate knew or should have known of a breach of such information. Upon discovery, the business associate must notify the covered entity of the breach. Notifications need to be made in accordance with the executed business associate agreement.

d. In instances of theft or break-in or other criminal activity, the contractor/subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG and Security and Law Enforcement. The contractor, its employees, and its subcontractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The contractor/subcontractor shall cooperate with VA in any civil litigation to recover VA information, obtain monetary or other compensation from a third party for damages arising from any incident, or obtain injunctive relief against any third party arising from, or related to, the incident.

5. LIQUIDATED DAMAGES FOR DATA BREACH

a. Consistent with the requirements of 38 U.S.C. §5725, a contract may require access to sensitive personal information. If so, the contractor is liable to VA for liquidated damages in the event of a data breach or privacy incident involving any SPI the contractor/subcontractor processes or maintains under this contract.

b. The contractor/subcontractor shall provide notice to VA of a “security incident” as set forth in the Security Incident Investigation section above. Upon such notification, VA must secure from a non-Department entity or the VA Office of Inspector General an independent risk analysis of the data breach to determine the level of risk associated with the data breach for the potential misuse of any sensitive personal information involved in the data breach. The term 'data breach' means the loss, theft, or other unauthorized access, or any access other than that incidental to the scope of employment, to data containing sensitive personal information, in electronic or printed form, that results in the potential compromise of the confidentiality or integrity of the data. Contractor shall fully cooperate with the entity performing the risk analysis. Failure to cooperate may be deemed a material breach and grounds for contract termination.

c. Each risk analysis shall address all relevant information concerning the data breach, including the following:

(1) Nature of the event (loss, theft, unauthorized access);

(2) Description of the event, including:

(a) date of occurrence;

(b) data elements involved, including any PII, such as full name, social security number, date of birth, home address, account number, disability code;

(3) Number of individuals affected or potentially affected;

(4) Names of individuals or groups affected or potentially affected;

(5) Ease of logical data access to the lost, stolen or improperly accessed data in light of the degree of protection for the data, e.g., unencrypted, plain text;

(6) Amount of time the data has been out of VA control;

(7) The likelihood that the sensitive personal information will or has been compromised

(made accessible to and usable by unauthorized persons);

(8) Known misuses of data containing sensitive personal information, if any;

(9) Assessment of the potential harm to the affected individuals;

(10) Data breach analysis as outlined in 6500.2 Handbook, Management of Security and

Privacy Incidents, as appropriate; and

(11) Whether credit protection services may assist record subjects in avoiding or mitigating the results of identity theft based on the sensitive personal information that may have been compromised.

d. Based on the determinations of the independent risk analysis, the contractor shall be responsible for paying to the VA liquidated damages in the amount of $35 per affected individual to cover the cost of providing credit protection services to affected individuals consisting of the following:

(1) Notification;

(2) One year of credit monitoring services consisting of automatic daily monitoring of at least

3 relevant credit bureau reports;

(3) Data breach analysis;

(4) Fraud resolution services, including writing dispute letters, initiating fraud alerts and credit freezes, to assist affected individuals to bring matters to resolution;

(5) One year of identity theft insurance with $20,000.00 coverage at $0 deductible; and

(6) Necessary legal expenses the subjects may incur to repair falsified or damaged credit records, histories, or financial affairs.

6. TRAINING

a. All contractor employees and subcontractor employees requiring access to VA information and VA information systems shall complete the following before being granted access to VA information and its systems:

(1) Sign and acknowledge (either manually or electronically) understanding of and responsibilities for compliance with the Contractor Rules of Behavior, Appendix E relating to access to VA information and information systems;

(2) Successfully complete the VA Cyber Security Awareness and Rules of Behavior training and annually complete required security training;

(3) Successfully complete the appropriate VA privacy training and annually complete required privacy training; and

(4) Successfully complete any additional cyber security or privacy training, as required for

VA personnel with equivalent information system access [to be defined by the VA program official and provided to the contracting officer for inclusion in the solicitation document – e.g., any role-based information security training required in accordance with NIST Special

Publication 800-16, Information Technology Security Training Requirements.]

b. The contractor shall provide to the contracting officer and/or the COTR a copy of the training certificates and certification of signing the Contractor Rules of Behavior for each applicable employee within 1 week of the initiation of the contract and annually thereafter, as required.

c. Failure to complete the mandatory annual training and sign the Rules of Behavior annually, within the timeframe required, is grounds for suspension or termination of all physical or electronic access privileges and removal from work on the contract until such time as the training and documents are complete.

P. CONTRACT ADMINISTRATION AND PERFORMANCE MONITORING:

1. Notwithstanding the Contractor's responsibility for total management during the performance of this contract, the administration of the contract shall require maximum coordination between the

Government and the Contractor. The COR and Program Manager (PM) will assist by monitoring contractor performance and reporting the findings to the CO.

2. The COR shall be designated on the authority of the CO at the time of contract award to monitor all technical aspects of the contract. In no event is the COR empowered to change any of the terms and conditions of the contract. Changes in any section of this contract shall be made only by the CO pursuant to a properly executed modification. The types of actions within the purview of the COR’s authority are to ensure that the Contractor performs the technical requirements of the contract, and to notify both the Contractor and the CO of any deficiencies observed. A memorandum of designation shall be issued to the COR and a copy shall be sent to the Contractor at the time of contract award setting forth in full the responsibilities and limitations of the COR.

A. Contracting Officer’s Representative (COR):

Email:

B. Contracting Officer (CO):

Network Contracting Office 16 E-mail:

Q. PAYMENTS:

VA’s Electronic Invoice Presentment and Payment System – The FSC uses a third-party contractor, Tungsten, Vendor Electronic Invoice Submission Methods. Facsimile, e-mail, and scanned documents are not acceptable forms of submission for payment requests. Electronic form means an automated system transmitting information electronically according to the accepted electronic data transmission methods below:

• VA’s Electronic Invoice Presentment and Payment System – The FSC uses a third-party contractor, Tungsten, to transition vendors from paper to electronic invoice submission. Please go to this website:

http://www.tungstennetwork.com/US/en/veterans-affairs/ to begin submitting electronic invoices, free of charge.

• A system that conforms to the X12 electronic data interchange (EDI) formats established by the

Accredited Standards Center (ASC) chartered by the American National Standards Institute (ANSI). The

X12 EDI Web site (http://www.x12.org).

R. CONTRACTOR QUALIFICATIONS

CONTRACTOR QUALIFICAITONS

The contractor shall possess a NAID certification OR shall be a non-NAID certified contractor who can satisfy the minimum standards for information destruction listed below. The contractor shall provide a

NAID certification by letter/certificate OR non-NAID certified contractors who can satisfy the minimum standards for information destruction shall confirm they meet this standard in their quote by the solicitation due date.

Minimum Standards for Information Destruction

Information destruction contractors and subcontractors must be able to meet the following standards:

1. Physical and Operational Security

a. Monitored Alarm System(s) that include the following:

• Motion Detectors;

• Door Contacts;

• Battery Back-Up; and

• Monitoring Service.

b. Taped Closed Circuit TV (CCTV) monitors with the following:

http://www.x12.org/

• Fully Functional Cameras;

• Recording Devices; and

• Secure Recording Tape Library.

c. Sufficient Lighting to allow CCTV

d. Locks and…