DRAFT Statement of Work Cepheid Instrument Rental and Service Agreement Alexandria VA Health Care System (AVAHCS)

1. Contract Title.

Cepheid Instrument Rental and Service Agreement

2. Background.

The Cepheid GeneXpert systems are advanced molecular diagnostics platforms that integrate sample preparation, amplification, and detection into a single, automated process. This technology utilizes real-time polymerase chain reaction (PCR) to rapidly and accurately identify various pathogens, including bacteria, viruses, and genetic mutations.

The Alexandria VA Medical Center in Pineville, Louisiana, along with its five (5) associated CBOCs located in Lafayette, Lake Charles, Jennings, Natchitoches, and Fort Polk, Louisiana requires an instrument rental and service agreement for one base year and two option years (36 months) for the Instruments identified below (collectively “Instruments”):

Instruments

Accessories

The GeneXpert systems will be employed to enhance diagnostic capabilities, support timely clinical decision-making, and improve patient outcomes through reliable and efficient detection of infectious agents and other molecular targets.

3. Scope.

3.1 The Contractor shall lease the listed Instruments as well as provide the maintenance, repair, and support services necessary to complete all work associated with the above-listed equipment in complete and strict accordance the contract and all attachments thereto.

4. Specific Tasks.

4.1 Placed Instruments:

a. The Contractor shall supply the Contractor-owned Instruments identified in the table above for the Government’s use during the Period of Performance.

b. Once installed, the Instruments shall not be relocated from the locations specified at the time of installation without Contractor’s written agreement.

c. The Contractor retains title to the Instruments, and the Government shall only use the Instruments as allowed under this agreement.

4.2 Instrument Care and Use:

a. The Government will:

i. use the Instruments only to run Contractor’s reagent tests;

ii. keep the Instruments in good condition; and

iii. use and maintain the Instruments in accordance with the applicable labeling, inserts, and manuals, and other product-related information and materials from the Contractor or any regulatory authority;

b. The Government will not:

i. modify, repair, rent, lease, license, loan, sell, transfer, mortgage, pledge, encumber, decompile, disassemble, or reverse engineer the Instruments, including their hardware, software, or firmware;

ii. abuse, neglect, or otherwise misuse the Instruments; or

iii. modify or remove any labels, symbols, serial numbers, or other indications of Contractor ownership affixed to or appearing on the Instruments.

c. On Contractor’s request, the Government will identify the location of any Instrument.

d. The Government will provide Contractor with access during normal business hours and other reasonable assistance to allow Contractor to perform the services required under the Agreement.

4.3 Instrument Loss or Damage:

a. From the time of delivery until the Instruments are returned to Contractor, the Government is responsible for the risk of all loss or damage to the Instruments, except for

i. reasonable wear and tear resulting from the Government’s proper use (“Wear and Tear”); and

ii. any loss or damage caused by Contractor. The Government must promptly notify Contractor of any loss or damage to the Instruments.

4.4 Instrument Returns:

a. Within 15 days after any expiration or termination of the Agreement, the Government must return the Instruments to Contractor in good condition, excluding Wear and Tear and any damage caused by Contractor. The Government shall comply with all reasonable return instructions from Contractor.

4.5 Service:

a. During the Period of Performance, Contractor shall provide the maintenance, repair, and support services detailed below for the Instruments. Service does not include any consumables or instrument accessories, such as universal power supply devices or printers.

b. Scope of Coverage:

i. This Agreement only covers repairs of defects arising from the Government’s use of Instruments under normal conditions in compliance with Contractor’s operator manual.

ii. Coverage under this Agreement does not include repairing malfunctions or failures resulting from: operating an Instrument in an unsuitable environment, using an Instrument inconsistent with its design or Contractor’s published specifications, use of unauthorized attachments, acts of nature, unusual physical or electrical stress, unauthorized modifications, repairs done by the Government or anyone other than Contractor, or misuse, abuse, or neglect of the Instruments (collectively “Excluded Repairs”).

iii. Excluded Repairs may result in additional charges. Contractor shall notify the Government in writing concerning any Excluded Repairs and shall provide a quote with the costs to perform the Excluded Repairs. Contractor shall not proceed with any Excluded Repairs unless the Government approves those additional costs in writing.

4.6 Telephone Technical Support:

a. During the Period of Performance, except for holidays, Contractor shall provide technical phone support for the Instruments every day at any time. The Government may contact Contractor’s technical support personnel at +1-888-838-3222 or by opening a ticket online.

b. If Contractor cannot repair the Instruments remotely, then Contractor shall repair the Instruments following the procedures below (see “4.7 Instrument Repair”).

4.7 Instrument Repair:

a. If an onsite visit is necessary to repair an Instrument, then the Parties shall schedule a mutually acceptable time during a business day from 9:00 am to 5:00 pm local time.

b. After Contractor determines that an onsite visit is necessary, a field service engineer will be available to perform onsite repairs within four business days.

c. Contractor may use new or refurbished parts to repair Instruments. All replaced parts remain the property of Contractor.

d. Before Contractor performs any on-site repairs, the Government must (a) notify Contractor of any potential on-site hazards and (b) ensure that the Instruments are safe to handle.

4.8 Instrument Replacements:

a. If Contractor cannot repair a damaged Instrument or decides not to repair a damaged Instrument, then it shall ship the Government a new or refurbished replacement instrument at Contractor’s expense, and the Government shall return the damaged Instrument to Contractor as required below (see “4.9 Instrument Returns”).

b. Contractor shall retain title to any replacement instrument.

c. Any new replacement instrument shall become an Instrument for the remaining Period of Performance, and the Parties shall cooperate in good faith to modify the Instruments listing to reflect the change in instruments.

4.9 Instrument Returns:

a. If Contractor requires the Government to return an Instrument for repair, the Government must provide a completed decontamination form from Contractor with any item shipped to Contractor, which lists all potential biohazards that the Instruments have been exposed to or analyzed.

b. Contractor shall pay for the shipping costs to return the Instruments to Contractor.

4.10 Annual Preventative Maintenance:

a. Contractor shall ship one (1) Xpert Check kit to the Government, per each Instrument, once every twelve (12) months during the Period of Performance during each option year that the Government exercises.

i. The Xpert Check kit includes five (5) test cartridges, a fan filter, optics brush, a CD with test software, instructions, and a blank CD for saving results where an internet connection is not possible.

ii. The Xpert Check will generate a Summary Report that details the working condition of the instrument.

b. Contractor shall schedule an on-site visit with the Government to perform the Xpert Check at a mutually acceptable time once during each option year that the Government exercises.

c. If the Xpert Check fails, then Contractor shall repair the Instrument.

d. Contractor will also perform the following annual preventative maintenance on the Instruments:

i. replace worn module ejectors;

ii. lubricate moving parts for GeneXpert Infinity Systems only;

iii. replace fan filters;

iv. brush clean module optics; and

v. replace automation batteries if necessary for GeneXpert Infinity System only.

4.11 Software Updates:

a. “Software Update” means a revision to Contractor’s software installed on the Instruments with slight modifications or added capability (e.g., an update from version 1.0 to 1.1).

b. Contractor shall install available Software Updates on the Instruments when it performs the annual preventative maintenance described above.

c. Software Updates do not include major revisions or upgrades to Contractor’s software (e.g., an update from 1.0 to 2.0) or any updates to third-party software.

4.12 Limited Repair Warranty:

a. Contractor will perform all repair work according to applicable regulatory and industry standards and warrants that all replacement parts will be free from defects in workmanship for 90 days from the time of repair. This limited repair warranty only extends to the Government. No other warranties apply to the services that Contractor provides under this Agreement.

5. PERFORMANCE

5.1 Requests for services shall be made via telephone or email by authorized VA Clinical Engineering personnel, the Contracting Officer’s Representative (COR), or other authorized VA designees only.

5.2 All work shall be approved prior to commencement.

5.3 Work shall not be considered complete until accepted by an authorized VA designee. Contractor shall only be paid for work that has been completed during the performance period of the contract. Contractors cannot be paid (and should not invoice for work/services that have not been scheduled or completed).

5.4 All work shall be coordinated through an authorized VA designee. Access to VA space must be coordinated and approved by VA Laboratory personnel and/or VA Clinical Engineering personnel (or designee) prior to the beginning any work that is to be performed.

6. MANDATORY SAFETY CORRECTIONS

Safety corrections on the equipment as required by OEM or FDA regulations shall be covered within the scope of this agreement.

7. RESPONSE TIME

Response time for scheduled preventive maintenance (PM) service is within the month when the PMs are due. Contractor shall strictly follow the PM due dates and schedule for services in advance. Response time for unscheduled maintenance shall be within four (4) business days of first contact with the Contractor.

8. MOBILE MEDIA SCANNING

The Contractor shall identify if removable media (i.e. USB or DVD/CD Device) is required to perform the tasks/deliverables during the performance period of the contract. The COR (or other authorized representative/designee) shall ensure that the removable media (to be used) is scanned with anti-virus software (to include running current virus definitions) prior to connection to any medical device system located in the facility. The computer system for scanning removable media shall be designated by the COR.

9. REPORTS/DOCUMENTATION

For any services performed on site, upon arrival at the Medical Center, the technical service representative shall check in with Laboratory staff before performing any warranty related services, repairs and/or other maintenance services. This check-in is mandatory. A legible, signed service report shall be provided following completion of each service call/visit and shall include equipment identification (i.e. serial number), date and time of service call, list of parts replaced, results of inspections and/or calibrations, and a description of the work accomplished. This report shall be signed or initialed by Laboratory staff and/or the COR (or other authorized representative/designee). Service reports shall be provided within five days after completion of the work performed. All service reports shall be emailed within five days of completion of the maintenance work to amy.morgan5@va.gov. During the service, the Contractor shall report any changes in delivery requirements/problems to the COR (Contracting Officer Representative).

10. PERSONNEL

15.1 Contractor shall provide all necessary personnel to maintain the system. Labor required for both scheduled and unscheduled (emergencies) services are included as part of the cost of the service plan/contract for this requirement. Contractor employees (who will be performing work and executing tasks/deliverables) on the equipment shall be factory trained, qualified, certified, and licensed on the specific maintenance services that are required/needed. Work/tasks shall not be performed by individuals lacking the credentials/qualifications/certifications listed herein.

15.2 Contractor shall provide written assurance of the competency for their personnel and a list of credentials of approved Field Service Engineers for each system before these individuals begin work or perform services on the equipment/system. All technical service representatives provided by the Contractor shall comply with VA security management program directives and shall obtain the appropriate clearances from the VA police, possess the appropriate identification (job title, position/employer), and only be allowed in areas where access has been granted/authorized. All key personnel shall be certified by the manufacturer to be able to perform maintenance, upgrades, or any other service covered under this contract.

11. PRODUCT SUBSTITUTION

No service substitutions will be accepted.

12. ORDERING PROCEDURES

Ordering procedures are not required under this contract.

13. INVOICE AND PAYMENT

Contractor shall invoice the Alexandria VA Health Care System for the agreed upon annual fee. Invoice shall be properly prepared and sent to the VA Financial Service Center at: P.O. Box 149971, Austin, Texas 78714-8971.

The invoice shall be properly prepared in accordance with FAR 52.212-4, contain sufficient details, and at a minimum, include the following details:

a. IFCAP Obligation Number

b. Contract Number

c. Description of the supply/service rendered

d. Billing period/date when the services were rendered and

e. Invoice number and date Payments will be made in accordance with the Prompt Payment Act out of the Government annual appropriated funds obligated in an order which will be issued after the contract is awarded.

Note: Invoices that are not in compliance with the aforementioned requirements under this paragraph will be rejected for payments and required to be resubmitted.

14. LOCATION OF SERVICES

The Equipment for which service is to be rendered is at the following locations:

Alexandria VA Medical Center 2495 Shreveport Hwy Building 7, 3rd Floor, Room 351 Pineville, Louisiana 71360

Lafayette VA Clinic 3149 Ambassador Caffery Parkway Room 117 Lafayette, LA 70506

Douglas Fournet VA Clinic 3601 Gerstner Memorial Drive, Hwy 14 Lake Charles, LA 70607

Fort Polk VA Clinic 3353 University Parkway Leesville, LA 71446

Jennings VA Clinic 1907 Johnson Street Jennings, LA 70546

Natchitoches VA Clinic 740 Keyser Avenue, Suite B Natchitoches, LA 71457

15. CHANGES / MODIFICATIONS

If any service awarded under this requirement requires modification or is removed by the Contractor or manufacturer, or if any required modification or removal is suggested or mandated by a regulatory or official agency, the following steps will immediately be taken by the Contractor or manufacturer:

27.1 Notify the Contracting Officer, in writing, by the most expeditious manner possible. Provide two copies of the notification which shall include, but not be limited to the following:

a. Complete service description and/or identification and the contract number assigned as a result of an award on this Statement of Work.

b. Reasons for modifications or removal.

c. Necessary instructions for any corrective action.

27.2 Contractor shall be responsible for any costs associated with the above.

16. SITE CONDITIONS

27.1 Smoke Free Facility: The Alexandria VA Health Care System and its associated CBOCs are smoke free facilities. Smoking is prohibited inside any building or on facility grounds. Violators shall be removed from the premises.

27.2 There shall be no eating or drinking inside the Laboratory at any time.

27.3 Normal Clinical Hours for the Alexandria VA Medical Center and CBOCs are Monday through Friday, 8:00 am to 4:30 pm (CST), excluding weekends and federal holidays.

27.4 FEDERAL HOLIDAYS ARE: New Year’s Day; Martin Luther King Jr.’s Birthday; President’s Day, Memorial Day, Juneteenth, Independence Day; Veteran’s Day; Labor Day; Columbus Day; Thanksgiving Day, and Christmas Day.

a. When a holiday falls on a Sunday, the following Monday will be observed as a legal holiday.

b. When a holiday falls on a Saturday, the preceding Friday is observed by the US government agencies.

27.5 Use of Cell Phones: The use of cellular phones is permitted within certain areas of the medical center. All contractors are required to ask either the Contracting Officer (CO) or the Contracting Officer’s Representative (COR) if there is doubt in the usage of cellular phones.

17. PROTECTION OF PROPERTY

Contractor shall protect all items from damage. The Contractor shall take precaution against damage to the building(s), grounds and furnishings. The Contractor shall repair or replace any items related to building(s) or grounds damaged accidentally or on purpose due to actions by the Contractor.

18. EQUIPMENT MANUALS

Equipment manuals are not addressed as part of this contract.

19. OPERATOR TRAINING

Operator training is not addressed as part of this contract.

20. GOVERNMENT-FURNISHED EQUIPMENT (GFE)/GOVERNMENT-FURNISHED INFORMATION (GFI).

No GFE/GFI shall be provided to the Contractor.

21. MSDS, HAZARDOUS MATERIALS AND WASTE ANALYSIS.

MSDS or Hazardous Materials and Waste Analysis is not applicable for this contract.

22. RISK CONTROL.

All employees, contractors, and visitors are required to abide by local infection control procedures. To aid in the prevention of the spread of COVID and other communicable diseases, transporters may be required to wear a surgical mask upon entry to the facility and maintain wear of mask until exiting the facility, depending on current policy of the local facility.

23. PLACE OF PERFORMANCE.

The Instruments for which service is to be rendered are located at the Alexandria VA Medical Center and its associated CBOCs. Refer to “14. Location of Services” above for addresses.

24. PERIOD OF PERFORMANCE.

This contract shall be for 1 base year followed by 2 option years for Equipment service.

Base Year: October 1, 2026 – September 30, 2027 for $165,989.64 Option Year 1: October 1, 2027 – September 30, 2028 for $165,989.64* Option Year 2: October 1, 2028 – September 30, 2029 for $165,989.64* *Denotes: Exercisable at the discretion of the Government and availability of funds.

25. Schedule.

Base Year: October 1, 2026 – September 30, 2027

Option Year 1: October 1, 2027 – September 30, 2028

Option Year 2: October 1, 2028 – September 30, 2029

26. Equipment Delivery Schedule / Installation.

The Government shall require the Contractor to deliver the above Instruments to their designated locations no later than sixty (60) calendar days after receipt of notice of award.

The Contractor shall be responsible for installation per industry standards in coordination with AVAHCS Laboratory staff and in accordance with VA rules and regulations.

27. Information System Security and Privacy

27.1 GENERAL. This entire section applies to all acquisitions requiring any Information Security and Privacy language. Contractors, contractor personnel, subcontractors and subcontractor personnel will be subject to the same federal laws, regulations, standards, VA directives and handbooks, as VA personnel regarding information and information system security and privacy.

27.2 VA INFORMATION CUSTODIAL LANGUAGE. This entire section applies to all acquisitions requiring any Information Security and Privacy language.

a. The Government shall receive unlimited rights to data/intellectual property first produced and delivered in the performance of this contract or order (hereinafter “contract”) unless expressly stated otherwise in this contract. This includes all rights to source code and all documentation created in support thereof. The primary clause used to define Government and Contractor data rights is FAR 52.227-14 Rights in Data – General. The primary clause used to define computer software license (not data/intellectual property first produced under this contractor or order) is FAR 52.227-19, Commercial Computer Software License.

b. Information made available to the contractor by VA for the performance or administration of this contract will be used only for the purposes specified in the service agreement, SOW, PWS, PD, and/or contract. The contractor shall not use VA information in any other manner without prior written approval from a VA Contracting Officer (CO). The primary clause used to define Government and Contractor data rights is FAR 52.227-14 Rights in Data – General.

c. VA information will not be co-mingled with any other data on the contractor’s information systems or media storage systems. The contractor shall ensure compliance with Federal and VA requirements related to data protection, data encryption, physical data segregation, logical data segregation, classification requirements and media sanitization.

d. VA reserves the right to conduct scheduled or unscheduled audits, assessments, or investigations of contractor Information Technology (IT) resources to ensure information security is compliant with Federal and VA requirements. The contractor shall provide all necessary access to records (including electronic and documentary materials related to the contracts and subcontracts) and support (including access to contractor and subcontractor staff associated with the contract) to VA, VA's Office Inspector General (OIG), and/or Government Accountability Office (GAO) staff during periodic control assessments, audits, or investigations.

e. The contractor may only use VA information within the terms of the contract and applicable Federal law, regulations, and VA policies. If new Federal information security laws, regulations or VA policies become applicable after execution of the contract, the parties agree to negotiate contract modification and adjustment necessary to implement the new laws, regulations, and/or policies.

f. The contractor shall not make copies of VA information except as specifically authorized and necessary to perform the terms of the contract. If copies are made for restoration purposes, after the restoration is complete, the copies shall be destroyed in accordance with VA Directive 6500, VA Cybersecurity Program and VA Information Security Knowledge Service.

g. If a Veterans Health Administration (VHA) contract is terminated for default or cause with a business associate, the related local Business Associate Agreement (BAA) shall also be terminated and actions taken in accordance with VHA Directive 1605.05, Business Associate Agreements. If there is an executed national BAA associated with the contract, VA will determine what actions are appropriate and notify the contactor.

h. The contractor shall store and transmit VA sensitive information in an encrypted form, using VA-approved encryption tools which are, at a minimum, Federal Information Processing Standards (FIPS) 140-2, Security Requirements for Cryptographic Modules (or its successor) validated and in conformance with VA Information Security Knowledge Service requirements. The contractor shall transmit VA sensitive information using VA approved Transport Layer Security (TLS) configured with FIPS based cipher suites in conformance with National Institute of Standards and Technology (NIST) 800-52, Guidelines for the Selection, Configuration and Use of Transport Layer Security (TLS) Implementations.

i. The contractor’s firewall and web services security controls, as applicable, shall meet or exceed VA’s minimum requirements.

j. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor may use and disclose VA information only in two situations: (i) in response to a qualifying order of a court of competent jurisdiction after notification to VA CO (ii) with written approval from the VA CO. The contractor shall refer all requests for, demands for production of or inquiries about, VA information and information systems to the VA CO for response.

k. Notwithstanding the provision above, the contractor shall not release VA records protected by Title 38 U.S.C. § 5705, Confidentiality of medical quality-assurance records and/or Title 38 U.S.C. § 7332, Confidentiality of certain medical records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse or infection with Human Immunodeficiency Virus (HIV). If the contractor is in receipt of a court order or other requests for the above-mentioned information, the contractor shall immediately refer such court order or other requests to the VA CO for response.

l. Information made available to the contractor by VA for the performance or administration of this contract or information developed by the contractor in performance or administration of the contract will be protected and secured in accordance with VA Directive 6500 and Identity and Access Management (IAM) Security processes specified in the VA Information Security Knowledge Service.

m. Any data destruction done on behalf of VA by a contractor shall be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management, VA Handbook 6300.1, Records Management Procedures, and applicable VA Records Control Schedules.

n. The contractor shall provide its plan for destruction of all VA data in its possession according to VA Directive 6500 and NIST 800-88, Guidelines for Media Sanitization prior to termination or completion of this contract. If directed by the COR/CO, the contractor shall return all Federal Records to VA for disposition.

o. Any media, such as paper, magnetic tape, magnetic disks, solid state devices or optical discs that is used to store, process, or access VA information that cannot be destroyed shall be returned to VA. The contractor shall hold the appropriate material until otherwise directed by the Contracting Officer’s Representative (COR) or CO. Items shall be returned securely via VA-approved methods. VA sensitive information must be transmitted utilizing VA-approved encryption tools which are validated under FIPS 140-2 (or its successor) and NIST 800-52. If mailed, the contractor shall send via a trackable method (USPS, UPS, FedEx, etc.) and immediately provide the COR/CO with the tracking information. Self-certification by the contractor that the data destruction requirements above have been met shall be sent to the COR/CO within 30 business days of termination of the contract.

p. All electronic storage media (hard drives, optical disks, CDs, back-up tapes, etc.) used to store, process or access VA information will not be returned to the contractor at the end of lease, loan, or trade-in. Exceptions to this paragraph will only be granted with the written approval of the VA CO.

27.3 ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS. This section applies when any person requires access to information made available to the contractor by VA for the performance or administration of this contract or information developed by the contractor in performance or administration of the contract.

a. A contractor/subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees and subcontractors only to the extent necessary to perform the services specified in the solicitation or contract. This includes indirect entities, both affiliate of contractor/subcontractor and agent of contractor/subcontractor.

b. Contractors and subcontractors shall sign the VA Information Security Rule of Behavior (ROB) before access is provided to VA information and information systems (see Section 4, Training, below). The ROB contains the minimum user compliance requirements and does not supersede any policies of VA facilities or other agency components which provide higher levels of protection to VA’s information or information systems. Users who require privileged access shall complete the VA elevated privilege access request processes before privileged access is granted.

c. All contractors and subcontractors working with VA information are subject to the same security investigative and clearance requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors shall be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office of Human Resources and Administration/Operations, Security and Preparedness (HRA/OSP) is responsible for these policies and procedures. Contract personnel who require access to classified information or information systems shall have an appropriate security clearance. Verification of a Security Clearance shall be processed through the Special Security Officer located in HRA/OSP. Contractors shall conform to all requirements stated in the National Industrial Security Program Operating Manual (NISPOM).

d. All contractors and subcontractors shall comply with conditions specified in VAAR 852.204-71(d); Contractor operations required to be in United States. All contractors and subcontractors working with VA information must be permanently located within a jurisdiction subject to the law of the United States or its Territories to the maximum extent feasible. If services are proposed to be performed abroad the contractor must state where all non-U.S. services are provided. The contractor shall deliver to VA a detailed plan specifically addressing communications, personnel control, data protection and potential legal issues. The plan shall be approved by the COR/CO in writing prior to access being granted.

e. The contractor shall notify the COR/CO in writing immediately (no later than 24 hours) after personnel separation or occurrence of other causes. Causes may include the following:

i. Contractor/subcontractor personnel no longer has a need for access to VA information or VA information systems.

ii. Contractor/subcontractor personnel are terminated, suspended, or otherwise has their work on a VA project discontinued for any reason.

iii. Contractor believes their own personnel or subcontractor personnel may pose a threat to their company’s working environment or to any company-owned property. This includes contractor-owned assets, buildings, confidential data, customers, employees, networks, systems, trade secrets and/or VA data.

iv. Any previously undisclosed changes to contractor/subcontractor background history are brought to light, including but not limited to changes to background investigation or employee record.

v. Contractor/subcontractor personnel have their authorization to work in the United States revoked.

vi. Agreement by which contractor provides products and services to VA has either been fulfilled or terminated, such that VA can cut off electronic and/or physical access for contractor personnel.

f. In such cases of contract fulfillment, termination, or other causes; the contractor shall take the necessary measures to immediately revoke access to VA network, property, information, and information systems (logical and physical) by contractor/subcontractor personnel. These measures include (but are not limited to): removing and then securing Personal Identity Verification (PIV) badges and PIV – Interoperable (PIV-I) access badges, VA-issued photo badges, credentials for VA facilities and devices, VA-issued laptops, and authentication tokens. Contractors shall notify the appropriate VA COR/CO immediately to initiate access removal.

g. Contractors/subcontractors who no longer require VA access will return VA-issued property to VA. This property includes (but is not limited to): documents, electronic equipment, keys, and parking passes. PIV and PIV-I access badges shall be returned to the nearest VA PIV Badge Issuance Office. Once they have had access to VA information, information systems, networks and VA property in their possessions removed, contractors shall notify the appropriate VA COR/CO.

27.4 TRAINING. This entire section applies to all acquisitions which include section “ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS”.

a. All contractors and subcontractors requiring access to VA information and VA information systems shall successfully complete the following before being granted access to VA information and its systems:

i. VA Privacy and Information Security Awareness and Rules of Behavior course (Talent Management System (TMS) #10176) initially and annually thereafter.

ii. Sign and acknowledge (electronically through TMS #10176) understanding of and responsibilities for compliance with the Organizational Rules of Behavior, relating to access to VA information and information systems initially and annually thereafter; and

iii. Successfully complete any additional cyber security or privacy training, as required for VA personnel with equivalent information system or information access [to be defined by the VA program official and provided to the VA CO for inclusion in the solicitation document – i.e., any role-based information security training].

b. The contractor shall provide to the COR/CO a copy of the training certificates and certification of signing the Organizational Rules of Behavior for each applicable employee within five days of the initiation of the contract and annually thereafter, as required.

c. Failure to complete the mandatory annual training is grounds for suspension or termination of all physical or electronic access privileges and removal from work on the contract until such time as the required training is complete.

27.5 SECURITY INCIDENT INVESTIGATION. This entire section applies to all acquisitions requiring any Information Security and Privacy language.

a. The contractor, subcontractor, their employees, or business associates shall immediately (within one hour) report suspected security / privacy incidents to the VA OIT’s Enterprise Service Desk (ESD) by calling (855) 673-4357 (TTY: 711). The ESD is OIT’s 24/7/365 single point of contact for IT-related issues. After reporting to the ESD, the contractor, subcontractor, their employees, or business associates shall, within one hour, provide the COR/CO the incident number received from the ESD.

b. To the extent known by the contractor/subcontractor, the contractor/ subcontractor's notice to VA shall identify the information involved and the circumstances surrounding the incident, including the following:

i. The date and time (or approximation of) the Security Incident occurred.

ii. The names of individuals involved (when applicable).

iii. The physical and logical (if applicable) location of the incident.

iv. Why the Security Incident took place (i.e., catalyst for the failure).

v. The amount of data belonging to VA believed to have been compromised.

vi. The remediation measures the contractor is taking to ensure no future incidents of a similar nature.

c. After the contractor has provided the initial detailed incident summary to VA, they will continue to provide written updates on any new and relevant circumstances or facts they discover. The contractor, subcontractor, and their employes shall fully cooperate with VA or third-party entity performing an independent risk analysis on behalf of VA. Failure to cooperate may be deemed a material breach and grounds for contract termination.

d. VA IT contractors shall follow VA Handbook 6500, Risk Management Framework for VA Information Systems VA Information Security Program, and VA Information Security Knowledge Service guidance for implementing an Incident Response Plan or integrating with an existing VA implementation.

e. In instances of theft or break-in or other criminal activity, the contractor/subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG, and the VA Office of Security and Law Enforcement. The contractor, its employees, and its subcontractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The contractor/subcontractor shall cooperate with VA in any civil litigation to recover VA information, obtain monetary or other compensation from a third party for damages arising from any incident, or obtain injunctive relief against any third party arising from, or related to, the incident.

f. The contractor shall comply with VA Handbook 6500.2, Management of Breaches Involving Sensitive Personal Information, which establishes the breach management policies and assigns responsibilities for the oversight, management and reporting procedures associated with managing of breaches.

g. With respect to unsecured Protected Health Information (PHI), the contractor is deemed to have discovered a data breach when the contractor knew or should have known of breach of such information. When a business associate is part of VHA contract, notification to the covered entity (VHA) shall be made in accordance with the executed BAA.

h. If the contractor or any of its agents fails to protect VA sensitive personal information or otherwise engages in conduct which results in a data breach involving any VA sensitive personal information the contractor/subcontractor processes or maintains under the contract; the contractor shall pay liquidated damages to the VA as set forth in clause 852.211-76, Liquidated Damages—Reimbursement for Data Breach Costs.

27.6 PRODUCT INTEGRITY, AUTHENTICITY, PROVENANCE, ANTI-COUNTERFEIT AND ANTI-TAMPERING. This entire section applies when the acquisition involves any product (application, hardware, or software).

a. The contractor shall comply with Code of Federal Regulations (CFR) Title 15 Part 7, “Securing the Information and Communications Technology and Services (ICTS) Supply Chain”, which prohibits ICTS Transactions from foreign adversaries. ICTS Transactions are defined as any acquisition, importation, transfer, installation, dealing in or use of any information and communications technology or service, including ongoing activities, such as managed services, data transmission, software updates, repairs or the platforming or data hosting of applications for consumer download.

b. When contracting terms require the contractor to procure equipment, the contractor shall purchase or acquire the equipment from an Original Equipment Manufacturer (OEM) or an authorized reseller of the OEM. The contractor shall attest that equipment procured from an OEM or authorized reseller or distributor are authentic. If procurement is unavailable from an OEM or authorized reseller, the contractor shall submit in writing, details of the circumstances prohibiting this from happening and procure a product waiver from the VA COR/CO.

c. All contractors shall establish, implement, and provide documentation for risk management practices for supply chain delivery of hardware, software (to include patches) and firmware provided under this agreement. Documentation will include chain of custody practices, inventory management program, information protection practices, integrity management program for sub-supplier provided components, and replacement parts requests. The contractor shall make spare parts available. All contractor(s) shall specify how digital delivery for procured products, including patches, will be validated and monitored to ensure consistent delivery. The contractor shall apply encryption technology to protect procured products throughout the delivery process.

d. If a contractor provides software or patches to VA, the contractor shall publish or provide a hash conforming to the FIPS Security Requirements for Cryptographic Modules (FIPS 140-2 or successor).

e. The contractor shall provide a software bill of materials (SBOM) for procured (to include licensed products) and consist of a list of components and associated metadata which make up the product. SBOMs must be generated in one of the data formats defined in the National Telecommunications and Information Administration (NTIA) report “The Minimum Elements for a Software Bill of Materials (SBOM).”

f. Contractors shall use or arrange for the use of trusted channels to ship procured products, such as U.S. registered mail and/or tamper-evident packaging for physical deliveries.

g. Throughout the delivery process, the contractor shall demonstrate a capability for detecting unauthorized access (tampering).

h. The contractor shall demonstrate chain-of-custody documentation for procured products and require tamper-evident packaging for the delivery of this hardware.

27.7 VIRUSES, FIRMWARE AND MALWARE. This entire section applies when the acquisition involves any product (application, hardware, or software).

a. The contractor shall execute due diligence to ensure all provided software and patches, including third-party patches, are free of viruses and/or malware before releasing them to or installing them on VA information systems.

b. The contractor warrants it has no knowledge of and did not insert, any malicious virus and/or malware code into any software or patches provided to VA which could potentially harm or disrupt VA information systems. The contractor shall use due diligence, if supplying third-party software or patches, to ensure the third-party has not inserted any malicious code and/or virus which could damage or disrupt VA information systems.

c. The contractor shall provide or arrange for the provision of technical justification as to why any “false positive” hit has taken place to ensure their code’s supply chain has not been compromised. Justification may be required, but is not limited to, when install files, scripts, firmware, or other contractor-delivered software solutions (including third-party install files, scripts, firmware, or other software) are flagged as malicious, infected, or suspicious by an anti-virus vendor.

d. The contractor shall not upload (intentionally or negligently) any virus, worm, malware or any harmful or malicious content, component and/or corrupted data/source code (hereinafter “virus or other malware”) onto VA computer and information systems and/or networks. If introduced (and this clause is violated), upon written request from the VA CO, the contractor shall:

i. Take all necessary action to correct the incident, to include any and all assistance to VA to eliminate the virus or other malware throughout VA’s information networks, computer systems and information systems; and

ii. Use commercially reasonable efforts to restore operational efficiency and remediate damages due to data loss or data integrity damage, if the virus or other malware causes a loss of operational efficiency, data loss, or damage to data integrity.

27.8 SPECIALIZED DEVICES/SYSTEMS (MEDICAL DEVICES, SPECIAL PURPOSE SYSTEMS, RESEARCH SCIENTIFIC COMPUTING). This entire section applies when the acquisition includes one or more Medical Device, Special Purpose System or Research Scientific Computing Device.

a. Contractor supplies/delivered Medical Devices, Special Purpose Systems-Operational Technology (SPS-OT) and Research Scientific Computing Devices shall comply with all applicable Federal law, regulations, and VA policies. New developments require creation, testing, evaluation, and authorization in compliance with processes specified on the Specialized Device Cybersecurity Department Enterprise Risk Management (SDCD-ERM) Portal, VA Directive 6550, Pre-Procurement Assessment and Implementation of Medical Devices/Systems, VA Handbook 6500, and the VA Information Security Knowledge Service. Deviations from Federal law, regulations, and VA Policy are identified and documented as part of VA Directive 6550 and/or the VA Enterprise Risk Analysis (ERA) processes for Specialized Devices/Systems processes.

b. All contractors and third-party service providers shall address and/or integrate applicable VA Handbook 6500 and Information Security Knowledge Service specifications in delivered IT systems/solutions, products and/or services. If systems/solutions, products and/or services do not directly match VA security requirements, the contractor shall work though the COR/CO for governance or resolution.

c. The contractor shall certify to the COR/CO that devices/systems that have completed the VA Enterprise Risk Analysis (ERA) process for Specialized Devices/Systems are fully functional and operate correctly as intended. Devices/systems must follow the VA ERA authorized configuration prior to acquisition and connection to the VA computing environment. If VA determines a new VA ERA needs to be created, the contractor shall provide required technical support to develop the configuration settings. Major changes to a previously approved device/system will require a new ERA.

d. The contractor shall comply with all practices documented by the Food Drug and Administration (FDA) Premarket Submission for Management of Cybersecurity in Medical Devices and Postmarket Management of Cybersecurity in Medical Devices.

e. The contractor shall design devices capable of accepting all applicable security patches with or without the support of the contractor personnel. If patching can only be completed by the contractor, the contractor shall commit the resources needed to patch all applicable devices at all VA locations. If unique patching instructions or packaging is needed, the contractor shall provide the necessary information in conjunction with the validation/testing of the patch. The contractor shall apply security patches within 30 business days of the patch release and have a formal tracking process for any security patches not implemented to include explanation when a device cannot be patched.

f. The contractor shall provide devices able to install and maintain VA-approved antivirus capabilities with the capability to quarantine files and be updated as needed in response to incidents. Alternatively, a VA-approved whitelisting application may be used when the contractor cannot install an anti-virus / anti-malware application.

g. The contractor shall verify and document all software embedded within the device does not contain any known viruses or malware before delivery to or installation at a VA location.

h. Devices and other equipment or systems containing media (hard drives, optical disks, solid state, and storage via chips/firmware) with VA sensitive information will be returned to the contractor with media removed. When the contract requires return of equipment, the options available to the contractor are the following:

i. The contractor shall accept the system without the drive, firmware and solid state.

ii. VA’s initial device purchase includes a spare drive or other replacement media which must be installed in place of the original drive at time of turn-in; or

iii. Due to the highly specialized and sometimes proprietary hardware and software associated with the device, if it is not possible for VA to retain the hard drive, firmware, and solid state, then:

1) The equipment contractor shall have an existing BAA if the device being traded in has sensitive information stored on it and hard drive(s) from the system are being returned physically intact.

2) Any fixed hard drive, Complementary Metal-Oxide-Semiconductor (CMOS), Programmable Read-Only Memory (PROM), solid state and firmware on the device must be non-destructively sanitized to the greatest extent possible without negatively impacting system operation. Selective clearing down to patient data folder level is recommended using VA approved and validated overwriting technologies/methods/tools. Applicable media sanitization specifications need to be pre-approved and described in the solicitation, contract, or order.

Based upon a review of the PWS/SOW as presented and my conversation/email/teams exchange with the submitter, the contractor will have access to VA sensitive information to fulfill the terms of the contract. That sensitive information will include PII/PHI. As a result, a BAA will be required. When the contract has been awarded, please contact the Facility Privacy Officer, Lakeeshun.Davis@va.gov and the team will work with the contractor to execute the appropriate BAA. Please contact the team with any questions.