Draft SOW.pdf

STATEMENT OF WORK

Defense Finance and Accounting Service (DFAS-CL)

Contract For Destruction of Tapes & Hard Drives

1. Background

The purpose of this requirement is to provide Defense Finance and Accounting Service, Indianapolis, IN, with on-site destruction services for approximately 1353 Tapes and 7891 Hard Drives. The contractor shall ensure the confidential on-site destruction of sensitive materials to protect against identity theft and unauthorized disclosure of information. Destruction shall consist of shredding the media in accordance with all applicable federal laws, regulations and standards, including but not limited to :

• The Privacy Act of 1974

• The Gramm-Leach-Bliley Act of 1999

• The Data Protection Act of 1998

• DFAS Regulation 5200.1-R (Information Security)

• DFAS Regulation 5205.1 (Operations Security)

• NIST SP 800-88 Rev 2, Guidelines for Media Sanitization

2. Scope

The contractor shall provide all personnel, equipment, materials, supervision, transportation, and services necessary to perform the complete, secure, and on-site destruction of tapes and hard drives at DFAS Indianapolis.

All destruction shall be conducted in a manner that ensures protection of sensitive information and prevents reconstruction of data.

3. Period of Performance

Performance shall be completed within 30 calendar days after contract is awarded, unless otherwise directed by the Contracting Officer (CO).

4. Place of Performance

Destruction/shredding site:

DFAS Indianapolis 8899 E. 56th Street Indianapolis, IN 46249

5. Contracting Officer Representative (COR) and other Government Designated Official

A COR will be appointed in writing by the Contracting Officer to provide technical directions and administration of the contract. The COR:

• Shall act only within the scope of authority delegated in the written appointment letter.

• May provide technical directions that are within scope of the contract.

• Is not authorized to make changes to the contract terms and conditions.

• Has no authority to obligate or de-obligate funds.

Upon contract award, a written designation letter will be issued to the COR and provided to the Contractor.

6. General Requirements

• The Contractor shall provide confidential on-site destruction services consisting of shredding approximately 1353 Tapes and 7891 Hard Drives, ensuring full compliance with applicable federal security and privacy requirements. All destruction shall occur on-site.

• Destruction activities shall be performed in the presence of the COR or designated DFAS personnel.

• DFAS personnel will stage the materials for destruction at the site identified in Section 4.

• Media destruction shall render the materials unusable and unrecoverable in accordance with NIST

SP 800-88 Rev 2 destruction standards.

• The Contractor shall provide a Certificate of Destruction upon completion of services.

6.1 On-Site Shredding

The contractor shall provide confidential on-site destruction consisting of shredding approximately 1353 Tapes and 7891 Hard Drives, ensuring full compliance with applicable federal standards and protection of sensitive information. DFAS-Indianapolis personnel will stage the materials for destruction at the site identified in Section 4.

Requirements for Shredded Tapes and Hard drives include:

• All tapes and hard drives shall be destroyed in a manner that renders data recovery infeasible, in accordance with NIST SP 800-88 Rev2. Guidelines for Media Sanitization.

• The Contractor shall perform shredding services in a safe, secure, and controlled manner to prevent unauthorized access, loss or compromised materials. Hard Drives: Hard drives shall be shredded into particles such that:

o The majority of particles, are 2 mm or smaller, and o No fragment exceeds 10 mm in any dimension.

• Tapes: Tapes shall be destroyed by one of the following methods:

1. Shredding into particles where:

o The majority of particles are 2mm or smaller, and o No fragment exceeds 10mm in any dimension; or

2. Degaussing using a degausser listed on the NSA/Evaluated Products List (EPL), followed by shredding. When degaussing is performed prior to shredding, a specific particle size requirement after shredding is not required.

• Shredded materials shall be collected and transported securely to a certified electronics recycling facility for final disposition. Final destruction shall include smelting, incineration, or reduction to molten metal or ash in accordance with NSA/CSS Policy Manual 9-12, as applicable.

6.3 Equipment and Personnel

• The Contractor shall provide all equipment necessary to perform on-site shredding services. All equipment shall meet applicable federal standards for secure data destruction.

• The Contractor personnel shall be properly trained and certified in handling and destruction of sensitive information and media.

• Vehicles used for transporting shredded materials shall:

o Have fully enclosed, watertight bodies that prevent loss of materials.

o Not include open-box trucks, with or without canvas cover.

o Be operated in accordance with all installation security requirements and activity regulations.

o Vehicles used for shredding and transporting material to the disposal site must have locking capability, remaining closed and always secured while in transit or when unattended.

o All vehicular equipment must be maintained in good repair and in safe and clean condition. The contractor’s name must be painted or otherwise displayed prominently on each contractor’s owned vehicle.

o The contractor will have sufficient equipment for backup of regularly assigned vehicles to ensure completion of contract requirements.

o

7. Reporting and Certification

Upon completion of services, the Contractor shall provide a detailed report no later than 24 hours after destruction, including:

• A Certificate of Destruction for all destroyed media.

• The certificate must include the contract number, invoice number, price per pound or price per unit, total price and company name.

• Details of the shredding process used.

• Serial numbers of destroyed media.

• Date, Time and location of destruction.

• Number of pounds shredded and disposed of.

• The certificate must be signed by the Contractor and COR.

8. Security Requirements – UNCLEARED ESCORTED CONTRACTORS

The following security requirements are for contractor personnel not requiring direct access to DFAS systems/networks, Classified Information, CUI, to include Personally Identifiable Information (PII), Escorted Continuously by DFAS personnel, and who Do Not currently possess a current U.S.

Government background investigation of Tier 1 (formerly IT-III) or equivalent and higher.

General Requirements. Contractor personnel must meet the following conditions of employment.

1. Must be a U.S Citizen or National.

2. Registered for Selective Service (males born after 12-31-1959). A Status Information Letter is required for any male born after 12-31-1959 that is not registered with Selective Service.

• The following items must be submitted to the DFAS Personnel Security Office for contractor personnel who are escorted:

1. DFAS Form 9035, Contractor Request for Investigation (CRI).

2. OF306, Declaration for Federal Employment.

3. A request from the Contracting Officer Representative (COR), in writing, for “Escorted

Access Only”.

4. A set of fingerprints, unless any of the following apply.

a. The person has been fingerprinted for the Defense Counterintelligence and Security Agency

(DCSA) within the past 30 days.

b. The person is currently undergoing a background investigation, or reinvestigation, by DCSA or any other Federal agency.

c. The person has a background investigation currently being adjudicated by the DCSA

Adjudication and Vetting Services (DCSA AVS) or another AVS.

d. The person has been favorably adjudicated within the past 30 days by the DCSA AVS or an AVS from any other Federal agency: or

e. The person comes directly from another DoD agency, with no break in service. This includes any of the military branches as well as the U.S. Coast Guard; however, service members in an inactive reserve status are not included.

f. The DFAS Personnel Security Office otherwise determines that no new fingerprints are required.

• Once the results of the fingerprints are received, and the results are negative for a criminal record, the DFAS Personnel Security Office will issue a notice to the COR indicating the contractor employee is clear to proceed. No further action will be needed at this point.

• In cases where a fingerprint record check indicates contractor personnel have been involved in any criminal activity within the previous seven (7) years, DFAS Personnel Security will conduct a review of the record to determine if the activity is disqualifying i.e. presents a security risk to U.S. Government/DFAS personnel or assets. If it is determined that the record is not disqualified, the DFAS Personnel Security Office will issue a notice to the COR indicating the contractor employee is clear to proceed.

• Contractor personnel with current pending criminal charges or criminal cases that have not yet been adjudicated and concluded by the court having jurisdiction, are not eligible to work on the contract.

• DFAS personnel will escort and remain with the contractors 100% of the time the contractors are onsite (within a DFAS facility). Contractors will not have or need direct system access.

• The DFAS Manager of the area to which the contractors are assigned, after consulting with the COR, and the Site Force Protection Office, will determine escort requirements for contractors working outside of a DFAS facility.

9. Data Protection

The Contractor shall comply with Cybersecurity Maturity Model Certification (CMMC) Level 1 requirements for the protection of Federal Contract Information (FCI), as applicable to this contract. This requirement is limited to safeguarding FCI that may be provided to or generated by the Contractor in performance of HVAC maintenance and repair services under this contract. This requirement does not involve the processing, storage, or transmission of Controlled Unclassified Information (CUI).

9.1. The Contractor shall implement and maintain, at a minimum, the safeguarding requirements prescribed in FAR 52.204-21, Basic Safeguarding of Covered Contractor Information Systems. FCI under this contract may include but is not limited to work schedules; maintenance logs and service reports;

equipment inventories; technical manuals or drawings provided for maintenance purposes; and contract administration documentation.

9.2. The Contractor shall ensure that any information system used to process, store, or transmit FCI in performance of this contract meets CMMC Level 1 safeguarding requirements and maintains compliance throughout the period of performance.

9.3. The Contractor shall flow down the substance of applicable CMMC Level 1 and FAR 52.204-21 requirements to subcontractors that may process, store, or transmit FCI in support of this contract.

10. Federal Holidays/Inclement Weather

No work shall be performed on Federal Holidays. A full list of Federal Holidays is available at:

https://www.opm.gov/policy-data-oversight/pay-leave/federal-holidays/

10.1 Contractor personnel are not required to report to the work site when the Federal Government facility is closed due to inclement weather, emergency conditions, or other unscheduled closure. The Government will not be liable for costs or charges associated with such closures. Delay and closure announcements may be broadcast via local radio and television stations. Additionally, Contractors may obtain DFAS Center wide status updates by calling 1-877-277-3983, Option 8.

11. Invoicing

11.1 A Certificate of Destruction shall accompany the invoice submission.

11,2 Contractors shall comply with the Wide Area Workflow (WAWF) electronic invoicing system when submitting invoices for payment. All invoices and receiving reports must be submitted electronically through the WAWF in accordance with the DFARS 252.232-7006, WAWF Payment Instructions. The Contractor shall ensure that all required data fields are completed accurately, and that appropriate supporting document is attached. Failure to comply with WAWF submission requirements may result in payment delays.

Specific WAWF instructions, including document types, routing codes, and payment office information, will be provided by the CO or designated representative at the time of award.

https://www.opm.gov/policy-data-oversight/pay-leave/federal-holidays/