Atch D - SOW - PHX-AO Media Destruction.pdf

PHOENIX AREA INDIAN HEALTH SERVICE

Media Destruction – Asset Disposal

Statement of Work

Prepared by:

Phoenix Area Office 40 N Central, Suite 605 Phoenix, Arizona 85004

January 29, 2025

1. Background. The Phoenix Area Indian Health Service (PAIHS) has accumulated since the Covid Pandemic, a large number of computers (laptop/desktop), various types of hardware storage media, and cell phones. This equipment was either deemed too expensive to repair and out of warranty, with most well beyond the 5-year life-cycle, which the manufacture doesn’t support beyond 5 years and creates a security risk.

2. Scope. PAIHS requires a Contractor that can provide off-site media destruction and IT Asset Disposition, with proper logistics and secure chain-of-custody methods to ensure compliance, security and sustainability. This support shall include all of the equipment and supplies required for the collection of media destruction and IT Asset Disposition within the Phoenix Area Office. The categories and estimated quantity of media that require secure destruction and/or disposition are:

a. Hard disk drives (HDD)/Solid State drives (SSD)/ External HDDs = 1067

b. NVMe M.2 SSDs/Computer Memory = 2 x boxes (each weighing approx. 35lbs)

c. Tape/Data Cartridges = 243

d. Laptops/Desktops/All-in-One Computers = 365

e. Mobile Phones = 182

f. SD Cards = 50

1. Requirements. The Contractor (FACTA and HIPAA compliant) must be a certified eWaste recycler, and shall provide all personnel, containers, secured vehicles, and other related supplies and services to pick up media/assets to provide media destruction and IT Asset Disposition.

2. Media Handling, Destruction and Types. Media shall be “destroyed” as defined by NIST Special Publication 800-88

Revision 1 Guidelines for Media Sanitization. Media shall be in the form of devices containing bits and bytes such as hard drives, random access memory (RAM), read-only memory (ROM), disks, flash memory, memory devices, phones, mobile computing devices, networking devices, office equipment. The types of destruction, Disintegrate, Pulverize, Melt, and Incinerate; these sanitization methods are designed to completely Destroy the media. Other options related to possible recycle/disposition of items will be at the discretion of and approved by the Government COR.

3. Loading and Transport of Media/Assets. Pickup location is at the Phoenix Area Office, Indian Health Services, Renaissance II, 40 N Central, 5th (Suite 520), 6th (Suite 605), and 7th (Suite 720) floors during the regular work day, 8am – 5pm. Contract will provide a signed receipt / acceptance document on the type and number of items they are picking up from each floor. The Contractor shall be responsible for the loading of all media containers (boxes, carts, bins, etc.). The Contractor shall be responsible for secure transport to their off-site destruction facility.

4. Security. The Contractor shall be responsible for maintaining the security of the media containers and their contents at all times during the collection, transport and destruction process.

5. Recycling. All material shall be destroyed and made ready for recycling. The Contractor is responsible for ensuring that all materials are destroyed in accordance with “NIST Special Publication 800-88 Revision 1 Guidelines for Media Sanitization” prior to recycling. Under no circumstances is the waste material to be sold or disposed of before it is destroyed. The Solid-State drives should be Disintegrated or Incinerated, and not sanitized. The legacy Hard Disk Drives (spinning disk) are authorized for sanitization” but most of our HDDs are very old, and risk data storage lost.

6. Certificate of Destruction. After the destruction of serial numbered items, the Contractor shall be required to provide a Certificate of Destruction which shall be provided to the Government COR with the respective Invoice submission. The valid Certificate of Destruction shall at a minimum include the following:

a. Name, address and phone number of contractor;

b. Name, address and phone number of destruction location site;

c. Contract number;

d. Certificate/Service/Invoice number;

e. Date of service;

f. Description of service;

g. Quantity destroyed;

h. Signature of Authorized person witnessing destruction;

i. Date of destruction; and

j. Serial number of device if available.

A valid Certificate of Destruction is considered the integrity document under this contract. If there is any discrepancy between an invoice and its respective Certificate of Destruction; the Certificate of Destruction shall prevail and the invoice will be revised accordingly.

END OF STATEMENT OF WORK