Attachment_A_PWS_Records Storage Document Shredding and Support.pdf

Records Storage, Transportation, and Destruction Support Services Performance Work Statement

1. BACKGROUND

The Office of Administration (OA) Records Management Department (RMD) provides a variety of necessary administrative services to VA Central Office (VACO) headquarter organizations and employees located in Washington, D.C. and at satellite locations. The Records Management Office has a need for Records Storage, Document Shredding, Records retrieval, Records Transition and Transportation, Records Retrieval (Files) and Records Retrieval (Boxes), to include but not limited to (e.g. electronic media, paper, CD’s maps, floppy discs, cassette tapes and data tapes), and record containers for records management, maintenance, and/or disposition, as defined in this PWS.

APPLICABLE DOCUMENTS.

a. The National Institute Standards and Technology (NIST) Special Publications 800-88, Revision 1, The NIST guide, Guidelines for Media Sanitization (December 2014) http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-88r1.pdf

b. VA Directive 6508. Privacy Impact Assessment, July 30, 2015

c. VA Directive 6300, Records and Information Management, February 26, 2009

d. VA Handbook, 6300.1, Records Management Procedures, March 24, 2010

e. 36 CFR1224 – DISPOSITION OF FEDERAL RECORDS

f. 36 CFR 1234 – FACILITY STANDARDS FOR RECORDS STORAGE FACILITIES

g. 36 CFR 1236 - ELECTRONIC RECORDS MANAGEMENT

h. 44 U.S.C. Chapter 29 – RECORDS MANAGEMENT BY THE ARCHIVIST OF

THE UNITED STATES

2. SCOPE OF WORK.

The contractor shall provide and maintain adequately trained and a sufficient number of personnel, equipment (e.g. pallets, pallet jack, forklift, etc.), supplies (e.g. shrink wrap), materials, records center and storage facility(s), transportation vehicle(s), tools, supervision, and other items as necessary to successfully perform Records Management Services (RMS), as defined in this PWS.

The contractor shall transport Administrative / program records and non-records material to include PII, HR records, Budget records and shred in a secure transportation vehicle(s), from a variety of VA Central Offices (VACO) headquarter organizations and areas in Washington, D.C. and at satellite locations to there storage facility. The contractor shall provide secure transportation that meets all VA requirements for transporting records removed from the contractor’s and/or VA facility, and comply with all local, state, and Department of Transportation (DOT) regulations.

http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-88r1.pdf

3. PERIOD OF PERFORMANCE:

Base Year: 06/27/2021 – 06/26/2022 Option Year 1: 06/27/2022 – 06/26/2023 Option Year 2: 06/27/2023 – 06/26/2024 Option Year 3: 06/27/2024 – 06/26/2025 Option Year 4: 06/27/2025 – 06/26/2026

4. CONTRACT TYPE: Firm Fixed Price Level of Effort contract.

5. DESCRIPTION OF SERVICES.

The contractor shall perform transition services for records or record container(s) from an existing contractor owned or operated facility in Richmond, Virginia to the contractor’s owned or operated records center(s), transport records or record container(s) from various locations to the designated records center, or disposition or destruction facility, and perform records maintenance services, as required.

Services shall be provided on an "as required" basis, specific pick-up dates for the services cannot be established until the work is actually required. The contractor shall collect all government owned records as defined in 44 U.S.C. Chapter 33 Section 3301, to include but not limited to (e.g. electronic media, paper, CD’s maps, floppy discs, cassette tapes and data tapes), and record containers for records management, maintenance, and/or disposition, as defined in this PWS.

6. PERFORMANCE DETAILS.

There are approximately 5,282 records1 in storage at a contractor owned or operated facility in Richmond, Virginia. All other record(s) or record container(s) are primarily located at any one of the following VA Office of Administration Records Management Division locations below:

7. PLACE OF PERFORMANCE. Location of the facilities are as follow:

1. 810 Vermont Avenue, Washington, D.C.

2. 1800 G Street NW, Washington, D.C.

3. 1575 I Street NW, Washington, D.C.

4. 1100 First St. NE, Washington, D.C.

5. 801 I Street NW, Washington, D.C.

6. 1717 H Street NW, Washington, D.C.

7. 90 K Street NE, Washington, D.C.

8. 425 I Street NE, Washington, D.C.

9. 1722 I Street NW, Washington, D.C.

1 As of 06/02/2021.

10. 811 Vermont Avenue, Washington, D.C.

11. 470 L’Enfant Plaza SW, Washington, DC

12. 490 L’Enfant Plaza SW, Washington, DC

13. 7100 Old Landover Rd., Landover, MD

7.1. PERFORMANCE SCHEDULE.

The contractor shall perform services as requested, during regular business hours from 8:00 a.m. to 5:00 p.m. EST, Monday through Friday (except on the day of observance for all Federal holidays as set forth in 5 U.S.C § 6103). The contractor is not required to perform services during inclement weather, administrative closings, local or national emergencies, or similar Government directed closings. Government status can be found at http://www.opm.gov/policy- data-oversight/snow-dismissal-procedures/current-status/

There are ten Federal holidays set by law (5 U.S.C. § 6103) that the VA follows:

New Year’s Day January 1 Independence Day July 4 Veterans Day November 11 Christmas Day December 25

If any of the above falls on a Saturday, then Friday is observed as a holiday. If any falls on a Sunday, then Monday is observed as a holiday.

The following six Federal holidays are set by a day of the week and month:

Martin Luther King’s Birthday Third Monday in January Washington’s Birthday Third Monday in February Memorial Day Last Monday in May Labor Day First Monday in September Columbus Day Second Monday in October Thanksgiving Fourth Thursday in November http://www.opm.gov/policy-data-oversight/snow-dismissal-procedures/current-status/

8. SPECIFIC TASK/ REQUIREMENTS

A. Records Transition and Transportation.

1. Upon request by the Contracting Officer Representative (COR), the contractor shall coordinate the retrieval of all record(s) or record container(s) from their current location, create an inventory list of all records and record container(s) in accordance with section (8.A) and transport the records to a contractor owned or operated records center for records maintenance.

2. The contractor shall document the contents of all record(s) or record container(s) before leaving the government’s or contractor’s location on a signed manifest and submit a copy to the COR two (2) business days from the date of pick-up. The contractor shall notify the COR within one (1) hour of arrival to the pick-up location. In addition, the contractor shall also notify the COR when the records are in route and have arrived at the designated storage facility.

3. The contractor shall maintain a secure chain of custody of all records or record container(s) retrieved from the Pickup location until properly stored at the designated storage facility.

4. The contractor shall transport all records and/or record container(s) by road only (air, rail, and sea transportation are strictly prohibited), with overnight stays or layovers permitted for extenuating circumstances or emergency situations that may impact life or property.

5. The contractor shall transport all records or record containers in a dry, clean, air-ride rigid- side, leak, and waterproof vehicle. Soft-sided trucks are strictly prohibited. Vehicles must be free from mold, foodstuffs, chemicals, stains from previous use and hazardous materials.

6. The contractor shall not leave the containers unattended at any time during transition to include loading, off-loading, and transportation, except on government owned property and in an approved secure area.

7. The contractor shall ensure that all records or record container(s) in the contractor’s possession remain safe and secure at all times, free from foul or harsh weather elements or tampering during handling and transportation.

8. The contractor shall provide the COR with an inventory list in accordance with section (8.A), of all record containers retrieved for transition from their current location(s) to the designated storage facility, no later than five (5) days after the date of pick-up.

9. The contractor shall ensure that all records and/or container(s) are properly stacked for optimum stability and record integrity; are properly secured to pallets or the like with stretch wrap or similar material; are properly secured to the interior of the vehicle; and remain stationary during loading, off-loading, and transport.

10. Upon request by the COR, the contractor shall provide corner supports and/or inter- layers of corrugated board between each level of boxes for additional support.

B. Records Center and Storage.

1. The contractor shall provide a secure, climate controlled, records center and storage facility that meets all National Archives and Records Administration (NARA) standards as prescribed in 36 CFR 1234, Subpart B-Facility Standards and 36 CFR Section 1236, Subpart C- Additional Requirements for Electronic Records; for all record containers until requested to be retrieved by the COR, destroyed, or until terminated by this contract.

The contractor shall:

a. Remain in compliance with NARA standards per section (8.B) and

b. Certify compliance and submit a Certification Statement in Lieu of Checklist to the COR, 30 business days prior to the annual renewal date of this contract or as otherwise determined by the CO.

c. The contractor shall provide a barcoding and tracking system to maintain a continuous inventory list of all record container(s) placed into storage. At a minimum, the inventory list shall include the Box Identification Number (seven (7) digit Accession Number and Agency Box Number (# _of _ )), indicate the disposition of the record container (e.g. storage, sanitized, retrieved, etc.), and contractor inventory barcode and tracking number.

d. The contractor shall provide an explanation of any specific labeling/marking/coding schemes utilized to inventory and store the records, which may be utilized by the COR to request retrieval of a record.

e. The contractor shall provide the COR with a current inventory list of record containers maintained in storage, on a quarterly basis. The list shall be in an MS Excel file format and submitted to the COR by electronic mail on the first business day of the start of the quarter.

f. In the event a catastrophic event occurs, which damages the records being stored in the contractor’s records facility, the contractor shall immediately notify the COR of the event. In the case where damage has taken place and there is a need to move the records stored, the contractor shall be solely responsible, physically and financially, to move the records to another facility that meets or exceeds the requirements of the NARA Standards.

C. Records Retrieval.

1. Within three (3) hours from the time of the COR’s request to retrieve a record(s) or record container(s), the contractor shall acknowledge, confirm the record(s) and/or record container(s) availability, and provide an estimated delivery date and time.

2. The contractor shall properly secure and prepare all records for delivery to the

COR and deliver to the location identified on the request within 24 hours from the date and time of the COR’s request. The contractor shall provide a copy of the receipt for shipping of the records(s) to the COR with the monthly invoice.

Upon request by the COR, the contractor shall:

3. Return the record(s) or record container(s) to the location indicated in the request via a traceable and insurable delivery service, and provide the COR via email the tracking number of the shipment, estimated delivery, and name of carrier no more than one (1) hour from the time of drop-off. The contractor shall confirm delivery for anytime during the performance schedule at section 7.1 of this PWS, or as otherwise specified by the COR. schedule at section 7.2 of this PWS, or as otherwise specified by the COR.

4. On an as needed basis, provide a room at the contractor facility with sufficient working space for the COR and/or up to four (4) additional government personnel to review files prior to removal by the COR.

5. The contractor shall maintain proper documentation and inventory of all records removed from the records center and storage facility, in accordance with section (8.B).

6. The contractor shall track the delivery number of retrieved files within 1 hour from time of drop-off

7. The Contractor shall use certified services from one of the following services United States Postal Services (USPS), United Parcel Service (UPS), and Federal Express (FedEx) to provide records to VA whichever one is most cost effective to the VA.

D. Records Disposition and Destruction.

1. The contractor shall apply the appropriate sanitization technique to the record(s) or record container(s) in accordance with NIST Guidelines for Media Sanitization, to reasonably assure that the record(s) or record container(s) are infeasible to recover.

2. The COR and contractor shall coordinate a mutually agreed upon date and time (in accordance with section 8.1), to perform all destruction services within three (3) days from the date of the COR’s request.

3. The COR will provide the contractor with an estimated number of record container(s), a number of pallets, type of media to be destroyed, the location of the record container(s) in accordance with section 7.1, access restrictions (as applicable), and a location point of contact.

Upon request by the COR, the contractor shall:

4. Coordinate with the COR in accordance with section 8.1 and perform and provide mobile destruction services at one or more of the government facilities listed at section 8.1. OR.

5. Perform destruction services at the contractor’s facility.

6. The contractor shall coordinate pick-up of designated record(s) or record container(s) and transport the records in accordance with section 7.1 and 8.1, to the contractor’s location where destruction services will be performed.

7. The minimum cumulative volume requested for pick-up shall be no less than

120 record containers and shall not exceed 520 containers per request.

8. Upon request by the COR, the contractor shall provide the COR with sufficient access to witness the destruction of records in accordance with the VA Handbook 6300.1.

9. The contractor shall complete and sign a Certificate of Destruction in accordance with the NIST Guidelines for each completed destruction request.

The contractor shall submit the original signed certificate to the COR within two (2) days from the date of destruction. The Certificate of Destruction number shall be stated on the invoice.

At a minimum, each Certificate of Destruction shall contain:

a. Destruction Certification Number, Date, and point of contact information for person completing the certificate

b. Pick-up date and address of pick-up location

c. Name of COR or designated government personnel at pick-up location

d. Type of records destroyed and weight

e. Number of records or record container(s) picked up

f. Point of contact information for government personnel witnessing the destruction

g. The contractor shall maintain proper record of each Certificate of Destruction issued and make additional copies available upon the government’s request

9. KEY PERSONNEL

The following are considered to be key personnel and essential to successful performance and accomplishment of tasks performed under this contract: Contract Project Manager, Driver, and Handler. The contractor shall provide a Contract Project Manager and alternate(s), to serve as a primary point(s) of contact on behalf of the contractor and be available during the performance schedule. The contractor shall designate and identify all key personnel and alternate(s) in writing and submit to the contracting officer and notify the COR of any subsequent changes. The Project Manager shall be responsible for the management of services and have full authority to make decisions relating to the day-to-day operations under this contract

The contractor shall submit to the COR, the full name (first and last) and driver’s license number of the driver, identification number of the handler (if applicable), the make and model of the vehicle, and license plate number of the vehicle, no less than one (1) day from the date that services are scheduled to commence in accordance with this PWS.

10. DISASTER RECOVERY PLAN.

In the case of flood, fire or any other unforeseen event in which records stored and in the contractor’s possession, the contractor shall develop, update, and maintain a disaster recovery plan and make available to the government for review anytime during the term of this contract At a minimum, the disaster recovery plan shall address what actions the contractor will take to avoid damage from occurring, actions the contractor will take to minimize the extent of damage, how both damaged and undamaged records will be identified, methods the contractor will apply to report damages, and respective timeframes for each.

11. QUALITY CONTROL.

The contractor shall develop, implement, and maintain an effective Quality Control Plan (QCP) to reasonable assure that all work and services performed under this contract, conform to the requirements and standards as defined in this PWS, without defect. The contractor shall provide the Contracting Officer (CO) with a copy of the QCP no later than thirty (30) days after award. After acceptance of the quality control plan by the CO, the contractor shall obtain written acceptance by the CO of any proposed subsequent changes.

12. PERFORMANCE REQUIREMENTS SUMMARY.

The government will utilize a Quality Assurance Surveillance Plan (QASP) throughout the life of this contract to ensure that the contractor is performing services required by this PWS in an acceptable manner. Table 1 depicts how performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s). The government reserves the right to alter or change the QASP as needed by modification. A Performance Based Service Assessment Survey may also be used in combination with the QASP to assist the government in assessing the contractor’s level of performance under this contract.

Table 1. Performance Requirements Summary.

Section

PWS

Performance Objective Standard Performance Threshold

Method of Surveillan

8.B.1 Contractor shall provide Records Storage of files for the VA Office of Administration on a daily, weekly and monthly basis

Compliance with the

PWS

requirements stated.

Acceptable: 97% error free

Unacceptable: less than 97% error free.

100% COR

Inspection

8.B.1.C Contractor shall label all files in the records storage facility, provide an inventory list/barcoding of files upon receipt of records, and provide a copy to the COR.

Compliance with the

PWS

requirements stated.

Acceptable: 97% error free

Unacceptable: less than 97% error free.

100% COR

Inspection

8.C.2 Timely Records Retrieval of files when requested by

COR.

Compliance with the

PWS

requirements stated.

Acceptable: 97% error free

Unacceptable: less than 97% error free.

100% COR

Inspection

8.D.2 Requests for destruction are responded to and completed in a timely manner, and according to established guidelines.

Compliance with the

PWS

requirements stated.

Acceptable: 97% error free

Unacceptable: less than 97% error free.

100% COR

Inspection

8.D.9 Certification of Destruction is completed and submitted within the defined time frame.

Complies with the VA and Regulations listed in the

PWS.

Acceptable: 97% error free

Unacceptable: less than 97% error free.

100% COR

Inspection

13. SCHEDULE OF DELIVERABLES. Table 2. Deliverable Schedule

PWS

SECTION

DELIVERABLES DUE METHOD OF

DELIVERY

8.A.2 Signed Manifest List 2 business days from the date of pick-up

E-mail list to the

COR

8.A.1

Inventory list of files retrieved and transitioned to the contractor’s storage facility.

5 days from the date of pick-up

E-mail list to the

8.B.1.B

Certification Statement in Lieu of Checklist

30 business days prior to the end of this Task order

E-mail to the COR

8.B.1.C

Continuous inventory list

First business day after the start of the quarter

E-mail MS Excel file to the COR

8.C.2 Records Retrieval

24 hours from the date and time of request

Physical Delivery

8.C.7 Tracking and Delivery Number for retrieved files

1 hour from time of drop-off

E-mail list to the

COR

8.D.10 Disaster Recovery Plan 15 business days prior to the end of the

TO

E-mail to the COR

8.D.11 Quality Control Plan 30 business days from the date of award

E-mail to the CO and a copy to the

14. GENERAL REQUIREMENTS THAT APPLY TO ALL CONTRACTOR

PERSONNEL

All contractor personnel, new applicants, or substitute personnel shall be U.S.

citizens or in possession of an Alien Registration that authorizes the holder to work legally in the United States.

All contractor personnel shall read, write, speak, and understand the English language fluently and maintain good communication skills with all government personnel.

All contractor personnel providing services under this agreement shall be professional in appearance and conduct at all times. Contractor personnel conduct shall not reflect discredit upon the United States and/or the Department of Veterans Affairs.

The government reserves the right to immediately remove contractor personnel for misconduct, conduct that presents a safety risk or security concern to themselves, other staff or property, and/or may direct the contractor to remove any contractor personnel from any U.S. Department of Veterans Affairs facilities for the same. An immediate removal or a request for removal does not relieve the contractor of the responsibility to continue providing the services required under this agreement. The Contracting Officer (CO) shall provide the contractor with a written determination to support any request for removal within five (5) days from the date of the request for removal.

Privacy Act of 1974. Portions of information disclosed during the performance of this task are protected by the provisions of the Privacy Act of 1974. The contractor is responsible for ensuring that all personnel assigned to perform services under this agreement are properly trained and take proper precautions to protect the information from unauthorized disclosure and mitigate all risks of a security incident. The contractor and contractor personnel shall immediately report any unauthorized disclosure of information to the COR and the Contracting Officer.

The term “security incident” means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action the breaches VA security procedures. The contractor/sub-contractor shall immediately notify the COR and simultaneously, the designated Information Security Officer (ISO) and Privacy Officer for the agreement of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including those contained in system(s) to which the contractor/sub- contractor have access to. The COR will provide the ISO/Privacy Officer information at the time of award

Confidentiality and Non-disclosure. The contractor agrees to surrender all preliminary and final deliverables, all associated working papers, application source code, and other materials deemed relevant by the government generated by the contractor under this agreement, to the COR at the conclusion or termination of this agreement or resultant task order. All materials surrendered will become the exclusive property of the U.S.

Government. The CO will be the sole authorized official to release verbally or in writing, any data, the draft deliverables, the final deliverables, or any other written or printed materials pertaining to this agreement. Any request for information relating to this agreement shall be submitted to the CO for a response. The contractor is permitted to release any information related to this agreement.

Press releases, marketing material or any other printed or electronic documentation related to this project, shall not be publicized without written approval by the Contracting Officer.

Commitment to Protect Sensitive Information. The contractor shall not release, publish, or disclose sensitive information to unauthorized personnel, and shall protect such information in accordance with 18 U.S.C. Chapter 31 Section 641, and any other pertinent laws and regulations governing the confidentiality of sensitive information.

15. SECUIRTY

A. GENERAL

Contractors, contractor personnel, subcontractors, and subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security. The C&A requirements do not apply, and a Security Accreditation Package is not required.

B. ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS

a. A contractor/subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement.

b. All contractors, subcontractors, and third-party servicers and associates working with VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures.

c. The contractor or subcontractor must notify the Contracting Officer immediately when an employee working on a VA system or with access to VA information is reassigned or leaves the contractor or subcontractor’s employ. The Contracting Officer must also be notified immediately by the contractor or subcontractor prior to an unfriendly termination.

C. VA INFORMATION CUSTODIAL LANGUAGE

a. Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the contractor/subcontractor's rights to use data as described in Rights in Data - General, FAR 52.227-14(d) (1).

b. The contractor/subcontractor shall not make copies of VA information except as authorized and necessary to perform the terms of the agreement or to preserve electronic information stored on contractor/subcontractor electronic storage media for restoration in case any electronic equipment or data used by the contractor/ subcontractor needs to be restored to an operating state. If copies are made for restoration purposes, after the restoration is complete, the copies must be appropriately destroyed.

c. If VA determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12.

D. SECURITY INCIDENT INVESTIGATION

a. The term “security incident” means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. The contractor/subcontractor shall immediately notify the COR and simultaneously, the designated ISO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/subcontractor has access.

b. To the extent known by the contractor/subcontractor, the contractor/subcontractor’s notice to VA shall identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the VA information or assets were placed at risk or compromised), and any other information that the contractor/ subcontractor considers relevant.

c. With respect to unsecured protected health information, the business associate is deemed to have discovered a data breach when the business associate knew or should have known of a breach of such information. Upon discovery, the business associate must notify the covered entity of the breach. Notifications need to be made in accordance with the executed business associate agreement.

d. In instances of theft or break-in or other criminal activity, the contractor/subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG and Security and Law Enforcement. The contractor, its employees, and its subcontractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The contractor/subcontractor shall cooperate with VA in any civil litigation to recover VA information, obtain monetary or other compensation from a third party for damages arising from any incident, or obtain injunctive relief against any third party arising from, or related to, the incident.

LIQUIDATED DAMAGES FOR DATA BREACH

a. Consistent with the requirements of 38 U.S.C. §5725, a contract may require access to sensitive personal information. If so, the contractor is liable to VA for liquidated damages in the event of a data breach or privacy incident involving any SPI the contractor/subcontractor processes or maintains under this contract.

b. The contractor/subcontractor shall provide notice to VA of a “security incident” as set forth in the Security Incident Investigation section above. Upon such notification, VA must secure from a non-Department entity or the VA Office of Inspector General an independent risk analysis of the data breach to determine the level of risk associated with the data breach for the potential misuse of any sensitive personal information involved in the data breach. The term 'data breach' means the loss, theft, or other unauthorized access, or any access other than that incidental to the scope of employment, to data containing sensitive personal information, in electronic or printed form, that results in the potential compromise of the confidentiality or integrity of the data. Contractor shall fully cooperate with the entity performing the risk analysis. Failure to cooperate may be deemed a material breach and grounds for contract termination.

c. Each risk analysis shall address all relevant information concerning the data breach, including the following:

(1) Nature of the event (loss, theft, unauthorized access);

(2) Description of the event, including:

(a) Date of occurrence;

(b) Data elements involved, including any PII, such as full name, social security number, date of birth, home address, account number, disability code;

(3) Number of individuals affected or potentially affected;

(4) Names of individuals or groups affected or potentially affected;

(5) Ease of logical data access to the lost, stolen or improperly accessed data in light of the degree of protection for the data, e.g., unencrypted, plain text;

(6) Amount of time the data has been out of VA control;

(7) The likelihood that the sensitive personal information will or has been compromised (made accessible to and usable by unauthorized persons);

(8) Known misuses of data containing sensitive personal information, if any;

(9) Assessment of the potential harm to the affected individuals;

(10) Data breach analysis as outlined in 6500.2 Handbook, Management of Security and Privacy Incidents, as appropriate; and

(11) Whether credit protection services may assist record subjects in avoiding or mitigating the results of identity theft based on the sensitive personal information that may have been compromised.

d. Based on the determinations of the independent risk analysis, the contractor shall be responsible for paying to the VA liquidated damages in the amount of $37.50 per affected individual to cover the cost of providing credit protection services to affected individuals consisting of the following:

(1) Notification;

(2) One year of credit monitoring services consisting of automatic daily monitoring of at least 3 relevant credit bureau reports;

(3) Data breach analysis;

(4) Fraud resolution services, including writing dispute letters, initiating fraud alerts and credit freezes, to assist affected individuals to bring matters to resolution;

(5) One year of identity theft insurance with $20,000.00 coverage at $0 deductible; and

(6) Necessary legal expenses the subjects may incur to repair falsified or damaged credit records, histories, or financial affairs.

E. TRAINING

a. All contractor employees and subcontractor employees requiring access to VA information and VA information systems shall complete the following before being granted access to VA information and its systems:

(1) Sign and acknowledge (either manually or electronically) understanding of and responsibilities for compliance with the Contractor Rules of Behavior, Appendix E relating to access to VA information and information systems;

(2) Successfully complete the VA Cyber Security Awareness and Rules of Behavior training and annually complete required security training;

(3) Successfully complete the appropriate VA privacy training and annually complete required privacy training; and (4) Successfully complete any additional cyber security or privacy training, as required for VA personnel with equivalent information system access.

b. The contractor shall provide to the contracting officer and/or the COR a copy of the training certificates and certification of signing the Contractor Rules of Behavior for each applicable employee within 1 week of the initiation of the contract and annually thereafter, as required.

c. Failure to complete the mandatory annual training and sign the Rules of Behavior annually, within the timeframe required, is grounds for suspension or termination of all physical or electronic access privileges and removal from work on the contract until such time as the training and documents are complete.