PERFORMANCE WORK STATEMENT (PWS)

Secure Document and Media Destruction Services

Military Sealift Command (MSC), Hampton Roads, VAN3220524Q7019

1.0 SCOPE

1.1 Objective

The Military Sealift Command (MSC) requires the on-site secure and recurring destruction of non-record, For Official Use Only (FOUO), secret and other sensitive classified materials, including paper documents and digital media (e.g., CDs and DVDs) hard drives, and cell phones.

This requirement does not include Top Secret material.

The objective is to ensure all materials are destroyed in a manner that renders them completely unrecoverable in accordance with applicable security requirements.

1.2 Contractor Requirements

The Contractor shall provide all personnel, equipment, materials, supervision, and transportation necessary to perform on-site collection and destruction services for MSC facilities located On

Naval Station Norfolk, Virginia. Other locations in the Hampton Roads, Virginia area may be added upon contract modification. All shredding shall be to NSA standards.

2.0 APPLICABLE DOCUMENTS

2.1

DoD Manual 5200.01 (Information Security Program). All services shall be performed in accordance with requirements for handling and destruction of Controlled Unclassified

Information (CUI) and other sensitive materials.

NIST 800-88 and DoD 5220 standards

NSA Secret Level Destruction procedures/processes

2.2

All contractor personnel shall comply with Naval Station Norfolk activity regulations, including safety, fire, traffic, and security requirements.

3.0 PERFORMANCE REQUIREMENTS

3.1 Service Frequency

The Contractor shall perform collection and destruction services on a monthly basis.

3.2 Service Window

Services shall be performed the second Thursday of each month, excluding Federal holidays, unless otherwise coordinated with the COR. The service window will be from 0900 to 1500.

The period shall be from 11 FEB 2027 to 12 AUG 2027.

3.3 Service Locations

The Contractor shall service all designated collection points listed below. Collection points will generally be at MSC buildings but could also be pier side at docked MSC ships on Naval Station

Norfolk. Pier side shredding will be Ad Hoc with 7 days advance notice and not to exceed two events.

3.3.1 The Contractor shall be required to supply lockable bins with openings that will allow ease of disposal of paper products without unlocking the bin. The bins shall be placed at each location and at the minimum quantities listed below. Bins shall be utilized for all paper product classification levels up to the Secret Level. Bins shall be labeled “Classified up to Secret level”

Bins shall be added or deleted via contract modification.

3.3.2 The Contractor shall be required to access each facility, retrieve the bins, perform the shredding service and return the bins to each location without supervision. Each Contractors employee that performs this requirement shall obtain a Courier Card and a Secret Clearance. At the start of the contract, the Government shall identify bin locations. Bins on upper floors shall be accessible via elevators.

3.3.3 The service locations may include, but are not limited to the locations below, example of locations to be serviced, though the exact service locations are subject to change.

Building(s) Minimum Number of Bins Collection Point Address

SP47, SP48, SP64 3 per building 471 East C Street (MSC Headquarters Horseshoe)

SP16, SP30 1 per building 469-479 Chapel Road

SP257 2 per building 480 Bellinger Boulevard

Naval Station

Norfolk Piers Ad Hoc Decatur Avenue

S29 1 per building 1278 Franklin Street

R52 1 per building 1283 Tow Way Drive

N19 2 per building 1249 Bainbridge Avenue

KBB 1 per building 1653 Morris Street

X-132 28 per building 9712 Virginia Avenue

3.4 Routing and Scheduling

The Contractor shall determine the most efficient routing and sequencing to service all locations within the required service window. The COR may direct schedule changes, but only with three business days advanced notice to the Contractor by e-mail.

4.0 PERFORMANCE STANDARDS & RESPONSIBILITIES

4.1 On-Site Destruction

All materials shall be destroyed on-site on the same day of collection in a manner that renders them unrecoverable per NSA standards.

4.2 Secure Handling

The Contractor shall ensure all materials are handled in a manner that prevents loss, compromise, or unauthorized disclosure at all times. All shredding shall occur on site at the Governments location.

4.2.1 Vendors personnel shall be US Citizens with a Secret clearance, DOD base access, and possess the training and certifications required by NSA standards, and publications to be able to carry out the requirements of this PWS.

4.2.2 The vendor shall report any violations of the applicable regulations to the COR within 30 minutes of discovery.

4.3 Collection Support

The Contractor shall provide lockable collection containers sufficient to support efficient and secure transfer of materials. Containers shall be clearly marked to prevent commingling of shred materials with trash.

4.4 Government Responsibility

Government personnel are responsible for transporting materials to designated collection points and ensuring materials are free of large binding devices (e.g., binders, large clips).

4.5 Contractor Autonomy & Oversight

The Contractor shall perform services independently. Government oversight will be conducted through surveillance methods outlined in Section 10.0.

4.6 Service Delays

The Contractor shall notify the Government within 30 minutes of any event that may impact timely completion of services.

5.0 NON-REGULAR SHRED EVENTS

5.1 The Government shall require non-regular shred events for bulk destruction needs. The

Contractor shall shred all material according to NSA Standard. The Contractor shall prepare devices for destruction under NSA standards, log the serial number, asset tag, and location of every device on a transport manifest. Once documented, the physical hardware must be sanitized using strict physical destruction methods dictated by the NSA/CSS Policy Manual 9-12.

5.1.1 The destruction devices, methods and records must meet the required NSA/CSS evaluation criteria for the appropriate media and classification level.

5.1.2 Preferred Destruction Method

• Perform Onsite Secure Degaussing Followed by Shredding All Classified Platter Hard Drives.

Shred all Unclassified Platter Drives. and Data Storage Devices. Disintegrate Solid State Drives and Classified Cell Phones. Shred Unclassified Cell Phones

• Degaussing: Upon capturing and completing the serial number scan, Vendor will degauss each media storage device using a NSA-approved degausser, while a designated representative of

MSC observes the process.

• Shred Hard Disk Drives (HDDs): Shred hard disk drives in accordance with NIST 800-88 and

DoD 5220 standards.

Vendor will then shred all Hard Disk Drive (HDD) storage devices in compliance with NIST

800-88 and DoD 5220 standards, while a designated representative of MSC observes the process.

Shredding generates an output particle size of 1.5” strips.

• Disintegrate Solid State Drives (SSDs): The serial numbers of the SSDs will be scanned before they are disintegrated down to the NSA required 2mm particle size, while a designated representative of MSC observes the process. The disintegrator is listed on the NSA’s Evaluated

Products List (EPL).

• Unclassified Cell Phones: Vendor will break open each cell phone to remove the battery before the phone is shredded. Shredding generates an output particle size of 1.5” strips. Vendor will count the cell phones during the destruction process when asset tags or serial number barcodes are not available.

• Vendor will deploy a team of professional security technicians (US Citizens) and fully equipped trucks to perform on-site hard drive degaussing, followed by shredding inside the processing trucks at the MSC Norfolk location.

• Vendor will remove all data storage devices from destruction location while an MSC representative maintains custody.

• Serial Number Capture: The serial numbers of the HDD, SSD’s, Flash Drives, and mobile devices will be scanned by the vendor and compared to the MSC representative list before the drives are destroyed inside the onsite trucks. Any serialized material not listed shall be returned to the Government.

• Upon completion of the service, the vendor will transport all by-products of the process to its secure facility in Norfolk, Virginia. All MSC by-products will be transferred to one of vendors qualified domestic partners for certified metals smelting, in accordance with its R2V3, ISO 9001, ISO 14001, ISO 45001 and DLA certifications.

5.1.3 Quality Assurance: When completed, the MSC’s witness will then sign the serialized data inventory provided by the Contractor, certifying that the destruction occurred in the quantities outlined on the contractors release form.

5.2 The Government will provide at least ten (10) business days’ notice prior to a non-regular shred event.

5.3 Services shall be performed within the standard service window and the contractor shall include the pricing in the contract for the following:

5.4 It is anticipated that the requirement will be for the destruction of up to 800 unclassified platter type hard drives, 800 unclassified solid state type hard drives, 250 unclassified cell phones or tablets per year.

5.5 It is anticipated that the requirement will be for the destruction of up to 800 classified platter type hard drives, 800 classified solid state type hard drives, 20 secret cell phones or tablets per year.

6.0 DELIVERABLES AND REPORTING

6.1 Certificate of Destruction (CDRL A001)

The Contractor shall provide a Certificate of Destruction within two (2) business days following each service.

6.2 Certificate Contents

The certificate shall include:

• Contract number

• Date of service

• Locations serviced

• Estimated quantity destroyed (Paper Products only)

• List of devices (hard drives, SSD, flash drives and cell phones only)

₋ Nomenclature

₋ Model Number

₋ Part Number (if applicable)

₋ Serial Number

• Signed certification statement confirming compliance with contract requirements at the time of destruction.

6.3 Invoice Submission

Invoices shall not be approved without a compliant Certificate of Destruction. The certificate shall be attached to the Contractors electronic invoice.

7.0 SECURITY AND ACCESS REQUIREMENTS

7.1 Installation Access

The Contractor shall obtain and maintain required installation access credentials (e.g., DBIDS).

7.2 Building Access

The Contractor shall comply with all building access procedures as required by the Government.

7.3 Emergency Contact List

The Contractor shall provide designated points of contact prior to contract performance.

8.0 GOVERNMENT FURNISHED MATERIAL & INFORMATION

8.1 Material

None.

8.2 Points of Contact - TBD

9.0 PERFORMANCE REQUIREMENTS SUMMARY (PRS)

Deliverable or

Service

Requirement

Measurement/

Metric

Performance

Standard

Acceptable

Quality

Level

(AQL)

Method of

Surveillance

Disincentive

Bi-Weekly

Shredding

Services

3.1

3.2

3.3

All scheduled locations serviced within required service window

Contractor shall service 100% of designated collection points during each scheduled service within the established service window.

98% Customer

Feedback

COR Direct

Observation

Review of

Contractor

Service Logs

Unsatisfactory/Poor

Performance will be documented in

CPARS.

Repeated failure may result in invoice withholding or corrective action.

On-Site

Destruction of

Materials

4.1

Materials destroyed on-site and rendered unrecoverable

All materials shall be destroyed on-site on the same day of collection in accordance with security requirements.

100% Direct Observations

Random Inspection

Review of

Certificate of

Destruction

Unsatisfactory/Poor

Performance will be documented in CPARS.

Security violations may result in removal of personnel, termination, or other contractual remedies.

Schedule

Adherence

3.2/4.6 performed within agreed service window

Contractor shall complete services within the approved service window unless otherwise coordinated with the COR.

95% Customer Feedback

Review of Service

Logs

Customer Feedback

Unsatisfactory/Poor

Performance will be documented in CPARS.

Repeated delays may result in invoice withholding or corrective action.

Delay Notification

4.6

Timely notification of delays

Contractor shall notify the

Government within 30 minutes of any delay impacting performance.

95% COR review of

Communication

Logs

Unsatisfactory/Poor

Performance will be documented in CPARS

Certificate of

Destruction

(CDRL A001)

6.1/6.2

Accurate certificate submitted on time

Certificate shall be submitted within two (2) business days following service and include all required elements.

98% Review of

Deliverables

Invoice Review

Invoices will not be approved without a compliant Certificate of

Destruction.

Unsatisfactory/Poor

Performance will be documented in CPARS

Non-Regular

Shred Events

5.0 performed as scheduled

Contractor shall perform non-regular shred events within required timeframe upon

Government notification.

95% Customer Feedback

COR Validation

Unsatisfactory/Poor

Performance will be documented in CPARS

Non-Regular

Shred Events

5.0 performed as per regulation

Contractor shall perform non-regular shred events within the standards of applicable regulations.

100% POC feedback to the COR

Non-compliance with regulations shall be documented in the

CPARS and reported to the MSC Security

Director for action.

CTIP

Compliance

Compliance with

FAR 52.222-50,

Combating

Trafficking in

Persons. The contractor shall-

1. Notify its employees of (i)

The U.S.

Government’s

Zero Tolerance policy. (ii)

Actions that will be taken against employees for violations of this policy. 2.

Take appropriate actions

Compliance with

CTIP

Validate that the contractor: 1.

Conducted training or kept records with employee signatures understanding of

U.S. Zero

Tolerance policy.

2. Has a documented list of what the contractor cites as appropriate actions to violations 3.

Documented the number of violations to date (if any) 4.

Documented actions taken.

Standard is met 100% of the time

REMEDY if not met: The contractor’s failure to comply with this FAR clause may result in:

1. Requiring the contractor to remove an employee from the performance of this contract.

2. Requiring the contractor to terminate a subcontract.

3. Suspension of contract payments.

4. Loss of award fee.

5. Termination

Conduct periodic inspection IAW

COR surveillance schedule. 1.

Review meeting/training/si gnature records as proof of contractor to employee notification. 2.

Validate actions taken by the contractor are documented and if employees are found to be in violation-matches those in FAR

55.222- 50(e)(1).

3. Review violations and document contractor actions.

In accordance with PGI

222.17 and FAR 52.222-

50, the KO will be notified immediately of any information from any source that alleges a contractor employee, subcontractor and/or subcontractor employee has engaged in conduct that violates the United

States Government “zero” tolerance policy regarding trafficking in persons.

of contract for default or cause.

6. Suspension or debarment.

WHISTLEBLOWER

The COR shall verify that the contractor has met and complied with contractual whistleblower requirements. The oversight of the requirement in this contract surveillance plan for whistleblower includes the following:

• Mandatory Oversight Requirements:

1. Provide confirmation to the Contracting Officer that the contractor informed employees of whistleblower rights, include the POC, date, and time of communication in the COR documents housed in PIEE – SPM

2. Ensure contractor is complying and has implemented the whistleblower clause

3. Communicate and document any abuse of authority which means an arbitrary and capricious exercise of authority that is inconsistent with the mission of DoD or the successful performance of a DoD contract (see DFARS

203.901)

4. Communicate any complaints of reprisal to the Contracting Officer

5. Confirm whistleblower / hotline posters are visible at the contractor’s site

6. Ensure COR documentation is included in the COR file in PIEE – SPM

9.0 PERFORMANCE REQUIREMENTS SUMMARY (PRS)