C03 - Attachment (4) - Contractor Confidentiality Agreement (VA Form 0752).pdf

VA FORM

SEP 2005 (RS) 0752 Adobe Forms Designer 6.0

CONFIDENTIALITY OF SENSITIVE INFORMATION NON-DISCLOSURE AGREEMENT

1. This Non-Disclosure Agreement is entered into by the United States Department of Veterans Affairs (VA) and __________________________________, ___________________________________ on _______________.

VA and the contractor have entered into a contract, _________________________________________________ under which the contractor will _________________________________________________________________

(Name of Contractor) (Name of Contracting Company) (mm/dd/yyyy)

(Enter identifying information on contract)

(Enter task that the contractor will perform)

2. In order to perform this contract, the contractor will need access to VA data, software, and computer systems either at a VA location, at the contractor's place of business, or both, in accordance with the contract.

3. By signing this agreement, the contractor acknowledges and understands the following:

a. The contractor and any subcontractor(s) shall presume that the VA computer systems and storage media that the contractor or subcontractor access have sensitive information and applications, the modification or disclosure of which could cause significant harm or embarrassment to VA beneficiaries and employees and to VA's ability to perform its mission. If the security requirements for accessing, handling, and storing VA data and systems are specified in the contract, the contractor will comply with the contractual security requirements. If the contract does not contain the requirements, the contractor will handle the VA property with the same degree of care, but no less than a reasonable degree of care, to prevent the unauthorized access, use, dissemination, publication, or destruction that the contractor uses to protect its own sensitive information and systems.

b. Any VA information, software, applications, computer systems, and hardware accessed by the contractor in the performance of the contract remain the sole property of VA.

c. To the extent that any software or applications on the VA systems are protected by copyright, the contractor agrees that it will not copy or disclose them without first obtaining VA's prior written authorization, which will be provided only where authorized under applicable copyright law.

d. The contractor, the contractor's employees, and any subcontractor and subcontractor's employees will access the VA information, software, applications, computer systems, and hardware which VA provides, or provides access to, only to the extent necessary, and only for the purpose of performing the contract. The contractor will take reasonable steps to ensure that it will allow only those contractor and subcontractor employees who need to see the VA materials in order to perform the contract to do so. However, this agreement also applies to any other VA systems or data to which the contractor may have access to or be disclosed to the contractor.

CONFIDENTIALITY OF SENSITIVE INFORMATION NON-DISCLOSURE AGREEMENT

e. The contractor will not authorize anyone else to access, disclose, modify, or destroy the information, software or applications on the VA systems provided or accessed under this contract without VA's prior written authorization.

f. The contractor and its employees shall not make any copies of any VA information, including software or applications that are not copyrighted, except as necessary to restore VA computer systems or data storage devices to an operating state. Any copies made by the contractor or subcontractor shall be identified as VA property and handled as sensitive information under this non-disclosure agreement.

g. Any information that the contractor and its employees learns about VA data and VA computer systems shall not be recorded except to the extent necessary to perform the contract, and such information, whether recorded or not, shall be handled as sensitive information under this agreement. The contractor may not use or disclose it except as the contractor is permitted to use or disclose VA sensitive information under the contract and this nondisclosure agreement.

h. The contractor may disclose VA sensitive information to persons other than in the performance of this contract as authorized by the contract and this agreement in only two situations: (1) pursuant to an order of a court of competent jurisdiction; or (2) with VA's prior written authorization. Prior to any disclosure pursuant to a court order, the contractor shall promptly notify VA of the court order and provide VA with a copy by fax or e-mail, whichever is faster, and notify by telephone the VA individual designated in advance to receive such notices. If the contractor cannot notify VA before being compelled to produce the information under court order, the contractor will notify VA of the disclosure as soon as practical. The notice under this provision will include the following information to the extent that the contractor knows it, if it does not show on the face of the court order:

the records disclosed pursuant to the order, to whom, where, and when, for what purpose, and any other information that the contractor reasonably believes is relevant to the disclosure.

i. The contractor will refer all requests or demands for production of , or access to, VA data and systems to VA for response. The contractor will immediately inform VA by telephone, fax and/or e-mail of any access, disclosure, disposition or destruction of VA data and systems not authorized under the contract or this agreement.

To the extent known, the contractor will notify VA of the information disclosed, to whom, how when, the reason for the access, disclosure, disposition or destruction, and any other information that the contractor considers relevant. VA will provide the contractor with the name, title, telephone number, fax number, and e-mail address of the VA official whom the contractor will notify if the records are requested, sought under a court order, or if any unauthorized access, modification, disposition, or destruction of VA sensitive information or computer systems occurs.

j. The contractor, its employees, and its subcontractors and their employees will cooperate with VA and any law enforcement authority response for the investigation and prosecution of any possible criminal law violation(s) associated with any unauthorized access, disclosure, disposition, or destruction of VA property. The contractor will also cooperate with VA in any civil litigation to recover VA property, to obtain monetary or other compensation for a third party, or to obtain injunctive relief against any third party who accessed, modified, disclosed, or destroyed VA sensitive data and computer systems except as authorized under the contract or this agreement.

CONFIDENTIALITY OF SENSITIVE INFORMATION NON-DISCLOSURE AGREEMENT

k. Upon completion or termination of the contract for any reason, the contractor will immediately deliver all VA records, data, copies of VA records and data, software and equipment, and information about VA data and systems recorded or documented by the contractor, in its possession or the possession of any subcontractors, to the VA official designated in the contract or pursuant to this agreement. The contractor will not retain any copies of any of these documents.

l. All additions to, or modifications of, this agreement must be in writing and signed by both parties.

m. This agreement is made under, and shall be governed by, the laws of the United States.

4. SECURITY

a. Contractor personnel performing work under this contract shall satisfy all requirements for appropriate security eligibility in dealing with access to sensitive information and information systems belonging to or being used on behalf of VA. To satisfy VA requirements, procedures defined in VA Directive & Handbook 0710, Personnel Suitability and Security Program are required.

b. The investigative history for contractor personnel working under this contract must be maintained in the databases of either the Office of Personnel Management (OPM) or the Defense Industrial Security Clearance Organization (DISCO). Should the contractor use a vendor other than OPM or Defense Security Service (DSS) to conduct investigations, the investigative company must be certified by OPM/DSS to conduct contractor investigations.

c. All costs associated with obtaining clearances for contractor provided personnel will be the responsibility of the contractor. Further, the contractor will be responsible for the actions of all individuals provided to work for VA under this contract. In the event that damages arise from work performed by contractor provided personnel, under the auspices of this contract, the contractor will be responsible for all resources necessary to remedy the incident.

5. SOFTWARE PROGRAM INTEGRITY

The contractor warrants and represents that the contractor-supplied software, other than the key software, does not and will not contain any program routine, device, code, or instructions (including any code or instructions provided by third parties) or other undisclosed feature, including, without limitation, a time bomb, virus, software lock, drop-dead device, malicious logic, worm, Trojan horse, bug, error, defect, or trap door, that is capable of accessing, modifying, deleting, damaging, disabling, deactivating, interfering with or otherwise harming the contractor software, any computers, networks, data, or other electronically stored information, or computer programs or systems (collectively, "disabling procedures"). Such representation and warranty applies regardless of whether such disabling procedures are authorized by the contractor to be included in the contractor software.

CONFIDENTIALITY OF SENSITIVE INFORMATION NON-DISCLOSURE AGREEMENT

If the contractor incorporates into the contractor software programs or routines supplied by other vendors, licensors, or contractors (other than the key software), the contractor shall obtain comparable warranties from such providers, or the contractor shall take appropriate action to ensure that such programs or routines are free of disabling procedures. Notwithstanding any other limitations in this agreement, the contractor agrees to notify VA immediately upon discovery of any disabling procedures that are or may be included in the contractor software. If disabling procedures are discovered or reasonably suspect to be present in the contractor software, the contractor, as its entire liability and VA's sole and exclusive remedy for the breach of the warranty in this section, agrees to take action immediately, at its own expense, to identify and eradicate (or to equip VA to identify and eradicate) such disabling procedures and carry out any recovery necessary to remedy any impact of such disabling procedures.

Federal Acquisition Regulation clause 52.246-18, Warranty of Supplies of a Complex Nature (May 2001), is hereby incorporated into VA Form 0752.

(a) Definitions. As used in this clause - "Acceptance" means the act of an authorized representative of the Government by which the Government assumes for itself, or as an agent of another, ownership of existing and identified supplies, or approves specific services rendered, as partial or complete performance of the contract.

"Supplies" means the end items furnished by the Contractor and related services required under this contract. The word does not include "data."

(b) Contractor's obligations. (1) The Contractor warrants that for two years all supplies furnished under this contract will be free from defects in material and workmanship and will conform with all requirements of this contract; provided, however, that with respect to Government-furnished property, the Contractor's warranty shall extend only to its proper installation, unless the Contractor performs some modification or other work on the property, in which case the Contractor's warranty shall extend to the modification or other work. (2) Any supplies or parts thereof corrected or furnished in replacement shall be subject to the conditions of this clause to the same extent as supplies initially delivered. This warranty shall be equal in duration to that set forth in paragraph (b)(1) of this clause and shall run from the date of delivery of the corrected or replaced supplies. (3) The Contractor shall not be obligated to correct or replace supplies if the facilities, tooling, drawings, or other equipment or supplies necessary to accomplish the correction or replacement have been made unavailable to the Contractor by action of the Government. In the event that correction or replacement has been directed, the Contractor shall promptly notify the Contracting Officer, in writing, of the nonavailability. (4) The Contractor shall also prepare and furnish to the Government data and reports applicable to any correction required (including revision and updating of all affected data called for under this contract) at no increase in the contract price. (5) When supplies are returned to the Contractor, the Contractor shall bear the transportation costs from the place of delivery specified in the contract (irrespective of the f.o.b. point or the point of acceptance) to the Contractor's plant and return. (6) All implied warranties of merchant ability and "fitness for a particular purpose" are excluded from any obligation contained in this contract. (c) Remedies available to the Government. (1) In the event of a breach of the Contractor's warranty in paragraph (b)(1) of this clause, the Government may, at no increase in contract price -

(i) Require the Contractor, at the place of delivery specified in the contract (irrespective of the f.o.b. point or the point of acceptance) or at the Contractor's plant, to repair or replace, at the Contractor's election, defective or nonconforming suppies; or (ii) Require the Contractor to furnish at the Contractor's plant the materials or parts and installation instructions required to successfully accomplish the correction. (2) If the Contracting Officer does not require correction or replacment of defective or nonconforming supplies or the Contractor is not obligated to correct or replace under paragraph (b)(3) of this clause, the Government shall be entitled to an

CONFIDENTIALITY OF SENSITIVE INFORMATION NON-DISCLOSURE AGREEMENT

equitable reduction in the contract price. (3) The Contracting Officer shall notify the Contractor in writing of any breach of the warranty in paragraph (b) of this clause within 45 days after discovery of the defect or intrusion.

The Contractor shall submit to the Contracting Officer a written recommendation within 5 work days as to the corrective action required to remedy the breach. After the notice of breach, but not later than 10 work days after receipt of the Contractor's recommendation for corrective action, the Contracting Officer may, in writing, direct correction or replacement as in paragraph (c)(1) of this clause, and the Contractor shall, notwithstanding any disagreement regarding the existence of a breach of warranty, comply with this direction. If it is later determined that the Contractor did not breach the warranty in paragraph (b)(1) of this clause, the contract price will be equitably adjusted. (4) If supplies are corrected or replaced, the period for notification of a breach of the Contractor's warranty in paragraph (c)(3) of this clause shall be two years from the furnishing or return by the Contractor to the Government of the corrected or replaced supplies or parts thereof, or, if correction or replacement is effect by the Contractor at a Government or other activity, for two years thereafter. (5) The rights and remedies of the Government provided in this clause are in addition to and do not limit any rights afforded to the Government by any other clause of the contract.

DEPARTMENT OF VETERANS AFFAIRS CONTRACTOR

SIGNATURE SIGNATUREDATE DATE

PRINT NAME

PRINT TITLE

PRINT NAME

PRINT TITLE