SOW-Final 4-14-26.pdf

STATEMENT OF WORK

Defense Finance and Accounting Service (DFAS-IN)

Hard Drive and Tape Destruction Services

1. Background

The purpose of this requirement is to provide Defense Finance and Accounting Service, Indianapolis, IN, with on-site destruction services for approximately 1353 Tapes and 7891 Hard Drives. The contractor shall ensure the confidential on-site destruction of sensitive materials to protect against identity theft and unauthorized disclosure of information. Destruction shall consist of shredding the media in accordance with all applicable federal laws, regulations and standards, including but not limited to:

• The Privacy Act of 1974

• The Gramm-Leach-Bliley Act of 1999

• The Data Protection Act of 1998

• DFAS Regulation 5200.1-R (Information Security)

• DFAS Regulation 5205.1 (Operations Security)

• NIST SP 800-88 Rev 2, Guidelines for Media Sanitization

2. Scope

The contractor shall provide all personnel, equipment, materials, supervision, transportation, and services necessary to perform the complete, secure, and on-site destruction of tapes and hard drives at DFAS Indianapolis.

All destruction shall be conducted in a manner that ensures protection of sensitive information and prevents reconstruction of data.

3. Period of Performance

The period of performance shall consist of one (1) 12-month base period and one (1) additional option period.

During the base period, the Contractor shall complete the initial media destruction requirement within thirty (30) calendar days from the date of contract award, unless otherwise directed by the Contracting Officer.

Following completion of the initial destruction requirement, the Contractor shall provide additional media destruction services on an as-needed basis throughout the remainder of the base period, in accordance with tasking or direction from Contracting Officer or designated Contracting Officer Representative

(COR).

The option period may be exercised at the discretion of the Government to continue media destruction services under the same terms and conditions.

4. Place of Performance

Destruction/shredding site:

DFAS Indianapolis 8899 E. 56th Street Indianapolis, IN 46249

5. Contracting Officer Representative (COR) and other Government Designated Official

A COR will be appointed in writing by the Contracting Officer to provide technical directions and administration of the contract. The COR:

• Shall act only within the scope of authority delegated in the written appointment letter.

• May provide technical directions that are within scope of the contract.

• Is not authorized to make changes to the contract terms and conditions.

• Has no authority to obligate or de-obligate funds.

Upon contract award, a written designation letter will be issued to the COR and provided to the Contractor.

6. Media Destruction Requirements

The Contractor shall provide secure, on-site destruction of Government-owned media, including hard drives and magnetic tapes, in accordance with NIST SP 800-88 Rev. 1, Guidelines for Media Sanitization.

6.1 Mixed Media Hard Drive Destruction

The Government anticipates that hard drives requiring destruction will consist of a mixed population of media types, including both Hard Disk Drives (HDDs) and Solid-State Drives (SSDs). The Government will not segregate or identify hard drives by type prior to destruction, and the exact quantity of each type is unknown with approximately 7891 Hard Drives.

The Contractor shall be capable of destroying mixed media and may process materials together or separately at its discretion, provided all media meets the required destruction standards. All hard drives shall be physically destroyed such that data recovery is infeasible.

• SSDs shall be physically destroyed by shredding to a particle size where the majority of particles are 2 mm or smaller, and no fragment exceeds 10 mm in any dimension.

• HDDs after the drives have been degaussed, do not have a particle size requirement, but the platters must be physically damaged.

6.1.1 Pricing: The Contractor shall provide a single unit price per hard drive that accounts for the mixed media composition (HDD and SSD). Offerors shall base their pricing on the requirement to meet all applicable destruction standards in this section including the most stringent requirements where applicable.

6.2 Tape Destruction

The Government has an estimated quantity of 1,353 magnetic tapes requiring destruction. Tape destruction shall be performed in accordance with NIST SP 800-88 Rev. 1.

Tapes shall be destroyed by one of the following methods:

(a) Shredding into particles where the majority of particles are 2 mm or smaller and no fragment exceeds 10 mm in any dimension; or

(b) Degaussing using equipment listed on the NSA Evaluated Products List (EPL), followed by shredding when required to meet specified destruction standards.

6.2.1 Pricing: The Contractor shall provide pricing for tape destruction on a per-unit basis.

6.3 General Requirements

The Contractor shall ensure all destruction activities are performed in a safe, secure, and controlled manner to prevent unauthorized access, loss, or compromise of materials.

All destruction shall occur on-site in the presence of the Contracting Officer’s Representative (COR) or designated Government personnel. Government personnel will stage the materials for destruction at the designated location.

All media destruction shall render the materials unusable and data unrecoverable in accordance with NIST SP 800-88 Rev. 1.

The Contractor shall provide a Certificate of Destruction upon completion of services, to include quantity, method of destruction, date, and location.

6.4 Equipment and Personnel

• The Contractor shall provide all equipment necessary to perform on-site shredding services. All equipment shall meet applicable federal standards for secure data destruction.

• The Contractor personnel shall be properly trained and certified in handling and destruction of sensitive information and media.

• Vehicles used for transporting shredded materials shall:

o Have fully enclosed, watertight bodies that prevent loss of materials.

o Not include open-box trucks, with or without canvas cover.

o Be operated in accordance with all installation security requirements and activity regulations.

o Vehicles used for shredding and transporting material to the disposal site must have locking capability, remaining closed and always secured while in transit or when unattended.

o All vehicular equipment must be maintained in good repair and in safe and clean condition. The contractor’s name must be painted or otherwise displayed prominently on each contractor’s owned vehicle.

o The contractor will have sufficient equipment for backup of regularly assigned vehicles to ensure completion of contract requirements.

o

7. Reporting and Certification

Upon completion of services, the Contractor shall provide a detailed report no later than 24 hours after destruction, including:

• A Certificate of Destruction for all destroyed media.

• The certificate must include the contract number, invoice number, price per pound or price per unit, total price and company name.

• Details of the shredding process used.

• Serial numbers of destroyed media.

• Date, Time and location of destruction.

• Number of pounds shredded and disposed of.

• The certificate must be signed by the Contractor and COR.

8. Security Requirements – UNCLEARED ESCORTED CONTRACTORS

The following security requirements are for contractor personnel not requiring direct access to DFAS systems/networks, Classified Information, CUI, to include Personally Identifiable Information (PII), Escorted Continuously by DFAS personnel, and who Do Not currently possess a current U.S.

Government background investigation of Tier 1 (formerly IT-III) or equivalent and higher.

General Requirements. Contractor personnel must meet the following conditions of employment.

1. Must be a U.S Citizen or National.

2. Registered for Selective Service (males born after 12-31-1959). A Status Information Letter is required for any male born after 12-31-1959 that is not registered with Selective Service.

• The following items must be submitted to the DFAS Personnel Security Office for contractor personnel who are escorted:

1. DFAS Form 9035, Contractor Request for Investigation (CRI).

2. OF306, Declaration for Federal Employment.

3. A request from the Contracting Officer Representative (COR), in writing, for “Escorted

Access Only”.

4. A set of fingerprints, unless any of the following apply.

a. The person has been fingerprinted for the Defense Counterintelligence and Security Agency

(DCSA) within the past 30 days.

b. The person is currently undergoing a background investigation, or reinvestigation, by DCSA or any other Federal agency.

c. The person has a background investigation currently being adjudicated by the DCSA

Adjudication and Vetting Services (DCSA AVS) or another AVS.

d. The person has been favorably adjudicated within the past 30 days by the DCSA AVS or an AVS from any other Federal agency: or

e. The person comes directly from another DoD agency, with no break in service. This includes any of the military branches as well as the U.S. Coast Guard; however, service members in an inactive reserve status are not included.

f. The DFAS Personnel Security Office otherwise determines that no new fingerprints are required.

• Once the results of the fingerprints are received, and the results are negative for a criminal record, the DFAS Personnel Security Office will issue a notice to the COR indicating the contractor employee is clear to proceed. No further action will be needed at this point.

• In cases where a fingerprint record check indicates contractor personnel have been involved in any criminal activity within the previous seven (7) years, DFAS Personnel Security will conduct a review of the record to determine if the activity is disqualifying i.e. presents a security risk to U.S. Government/DFAS personnel or assets. If it is determined that the record is not disqualified, the DFAS Personnel Security Office will issue a notice to the COR indicating the contractor employee is clear to proceed.

• Contractor personnel with current pending criminal charges or criminal cases that have not yet been adjudicated and concluded by the court having jurisdiction, are not eligible to work on the contract.

• DFAS personnel will escort and remain with the contractors 100% of the time the contractors are onsite (within a DFAS facility). Contractors will not have or need direct system access.

• The DFAS Manager of the area to which the contractors are assigned, after consulting with the COR, and the Site Force Protection Office, will determine escort requirements for contractors working outside of a DFAS facility.

9. Data Protection

The Contractor shall comply with Cybersecurity Maturity Model Certification (CMMC) Level 1 requirements for the protection of Federal Contract Information (FCI), as applicable to this contract. This requirement is limited to safeguarding FCI that may be provided to or generated by the Contractor in performance of HVAC maintenance and repair services under this contract. This requirement does not involve the processing, storage, or transmission of Controlled Unclassified Information (CUI).

9.1. The Contractor shall implement and maintain, at a minimum, the safeguarding requirements prescribed in FAR 52.204-21, Basic Safeguarding of Covered Contractor Information Systems. FCI under this contract may include but is not limited to work schedules; maintenance logs and service reports;

equipment inventories; technical manuals or drawings provided for maintenance purposes; and contract administration documentation.

9.2. The Contractor shall ensure that any information system used to process, store, or transmit FCI in performance of this contract meets CMMC Level 1 safeguarding requirements and maintains compliance throughout the period of performance.

9.3. The subject requirement is designated as CMMC Level 1, which focuses on basic protection of Federal Contract Information (FCI). To meet this requirement, contractors must complete a CMMC Level 1 self-assessment in the Supplier Performance Risk System (SPRS). The Level 1 self-assessment includes 15 basic security practices, as required by FAR 52.204-21, Basic Safeguarding of Covered Contractor Information Systems.

To complete the self-assessment, you will need the “SPRS Cyber Vendor User” role in PIEE. If you do not currently have this role, you may request it through PIEE. The Contractor shall complete the Level 1 self-assessment prior to award. The Government will verify the Offeror’s CMMC status in the Supplier Performance Risk System (SPRS). The offeror shall provide the CMMC Unique Identifier (UID) once the self-assessment is complete. For additional information on the CMMC program, please visit: https://dodcio.defense.gov/cmmc/About/

10. Federal Holidays/Inclement Weather

No work shall be performed on Federal Holidays. A full list of Federal Holidays is available at:

https://www.opm.gov/policy-data-oversight/pay-leave/federal-holidays/

10.1 Contractor personnel are not required to report to the work site when the Federal Government facility is closed due to inclement weather, emergency conditions, or other unscheduled closure. The Government will not be liable for costs or charges associated with such closures. Delay and closure announcements may be broadcast via local radio and television stations. Additionally, Contractors may obtain DFAS Center wide status updates by calling 1-877-277-3983, Option 8.

11. Invoicing

11.1 A Certificate of Destruction shall accompany the invoice submission.

11,2 Contractors shall comply with the Wide Area Workflow (WAWF) electronic invoicing system when submitting invoices for payment. All invoices and receiving reports must be submitted electronically through the WAWF in accordance with the DFARS 252.232-7006, WAWF Payment Instructions. The Contractor shall ensure that all required data fields are completed accurately, and that appropriate supporting document is attached. Failure to comply with WAWF submission requirements may result in payment delays.

Specific WAWF instructions, including document types, routing codes, and payment office information, will be provided by the CO or designated representative at the time of award.

https://dodcio.defense.gov/cmmc/About/ https://www.opm.gov/policy-data-oversight/pay-leave/federal-holidays/