N64469824Q50370001.pdf

1301123697

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15A. NAME AND TITLE OF SIGNER (Type or print)

30-105-04EXCEPTION TO SF 30

APPROVED BY OIRM 11-84

STANDARD FORM 30 (Rev. 10-83) Prescribed by GSA

FAR (48 CFR) 53.243

The purpose of this amendment is to update the Statement of Work, answ er questions and extend the solicitation closing date. All other terms and conditions remain unchanged.

1. CONTRACT ID CODE PAGE OF PAGES

J 1 5

16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)

16C. DATE SIGNED

BY 11-Apr-2024

16B. UNITED STATES OF AMERICA15C. DATE SIGNED15B. CONTRACTOR/OFFEROR

(Signature of Contracting Officer)(Signature of person authorized to sign)

8. NAME AND ADDRESS OF CONTRACTOR (No., Street , County, State and Zip Code) X N6449824Q5037

X 9B. DATED (SEE ITEM 11)

28-Feb-2024

10B. DATED (SEE ITEM 13)

9A. AMENDMENT OF SOLICITATION NO.

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

X The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offer X is extended, is not extended.

Offer must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended by one of the following methods:

(a) By completing Items 8 and 15, and returning 1 copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted;

or (c) By separate letter or telegram which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGMENT TO BE RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN

REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by telegram or letter, provided each telegram or letter makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

12. ACCOUNTING AND APPROPRIATION DATA (If required)

13. THIS ITEM APPLIES ONLY TO MODIFICATIONS OF CONTRACTS/ORDERS.

IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE

CONTRACT ORDER NO. IN ITEM 10A.

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, appropriation date, etc.) SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(B).

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER (Specify type of modification and authority)

E. IMPORTANT: Contractor is not, is required to sign this document and return copies to the issuing office.

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

10A. MOD. OF CONTRACT/ORDER NO.

2. AMENDMENT/MODIFICATION NO. 5. PROJECT NO.(If applicable)

6. ISSUED BY

3. EFFECTIVE DATE

11-Apr-2024

CODE

NAVAL SURFACE WARFARE CENTER PHILA

CODE 0223, KAREN MORRIS

215-897-1114, KAREN.MORRIS@NAVY.MIL

5001 SOUTH BROAD STREET

PHILADELPHIA PA 19112

N64498 7. ADMINISTERED BY (If other than item 6)

4. REQUISITION/PURCHASE REQ. NO.

CODE

See Item 6

FACILITY CODECODE

EMAIL:TEL:

N6449824Q5037

SECTION SF 30 BLOCK 14 CONTINUATION PAGE

SUMMARY OF CHANGES

SECTION SF 30 - BLOCK 14 CONTINUATION PAGE

The following have been added by full text:

QUESTIONS AND ANSWERS

First – The majority of the media that we will be destroying will be at the CUI level, but there will be classified media – up to the SECRET level and including Restricted Data and Formerly Restricted Data. Another note – We do sometimes get older media types that have not been in use for a while – punched paper tape for example, or a large tray of aperture cards, these older media types may need to be destroyed as part of this effort.

Answers in BOLD This RFQ's Statement of Work (SOW) is in direct violation of 32 CFR Part 2001.42(b), 32 CFR Part 2001.47, NISPOM 117.15, NIST 800-53r5, SECNAV M-5239.3, SECNAV 5510.63B, and DOD 5200.01 Volume 3. All of these regulations and controls direct individuals and organizations to follow NSA PM 9-12 for destruction and disposal of classified information systems media (ISM). The SOW lines 6 & 7 are in conflict with the NSA's guidance for classified ISM destruction. Any vendor agreeing to follow this SOW to the letter is agreeing to violate these security controls of classified ISM. I cannot quote or agree to do work in direct conflict with cyber security controls and regulations.

Additionally by requiring Solid State Media to be incinerated (SOW 12) and not allowing disintegration (IAW NSA policies), the Government is unintentionally limiting competition to companies in close proximity to the contract location and with access to an incineration facility. I anticipate the number of companies who can support this task being very small in number. This could result in higher than necessary costs upon the government.

We will be following the NSA guidance (NSA PM 9-12) here. Media/devices can be destroyed using whatever means is appropriate for the type of media and classification.

The SOW line 7 requests Hard Drive Destruction for Floppies and CD/DVDs. This is inaccurate for both categories of media. Floppy disks are magnetic media and may be degaussed or incinerated. Optical drives (CD/DVDs) may be disintegrated using a NSA evaluated optical disintegration device or incinerated.

Floppy drives and optical media (CD/DVD) may be destroyed by using whatever means is appropriate as per the NSA guidance as appropriate for the type of media and classification.

The SOW asks for shredded tapes and other "soft media" to be incinerated. For Tape drives this is not required after degaussing. This step is an unneeded cost center to the government and unnecessary environmental impact. I have never heard the term "soft media" before. What categories of devices is this equipment?

Magnetic tapes in various formats (9-track and multiple cartridge/cassette formats may be destroyed as per the NSA guidance as appropriate for the type of media and classification. The contractor may be requested to destroy some non-magnetic media like badge printer ribbons/film which would require a method like shredding to correctly dispose of.

The Government is asking for solid state drives to be incinerated. There are other NSA approved sanitization methods such as disintegration using NSA Evaluated Solid State disintegrators.

We will follow the NSA guidance (NSA PM 9-12) for the solid state media.

In the event SSD disintegration is acceptable, what would be the up to volume?

Solid State media to be destroyed may include items like flash memory cards, internal or external solid stated ‘disks’, government cellphones (iPhone) for example. The amount of solid state devices is increasing over time. The numbers of devices for any event could get to about 1500-2000 at the largest, but the numbers in any specific event may vary considerably depending on what items need to be destroyed at a particular event.

Is there any historic volume or other data to help ensure the government is given a cost effective quote?

Item counts from a recent event are below.

My recommendation is that the Statement of Work requests something like "All Information Systems Media listed below must be destroyed in accordance with NSA PM 9-12 and its supporting references." Then have the statement of work list all categories of "information systems media" requiring destruction. The burden should be on potential contractors to detail exactly how they will achieve NSA PM 9-12 destruction for the different types of media. This will ensure the Government is able to consider all potential options and select the option which best works for their situation.

We will be following the NSA guidance (NSA PM 9-12) here. The contractor should describe how they plan to meet the requires of the NSA guidance with the types of media we can get.

SECTION A - SOLICITATION/CONTRACT FORM

The required response date/time has changed from 05-Mar-2024 12:00 PM to 18-Apr-2024 12:00 PM.

SECTION C - DESCRIPTIONS AND SPECIFICATIONS

The following have been modified:

STATEMENT OF WORK

Scope of Work Media Destruction

1. The Contractor must be certified to handle classified material up to and including the SECRET level. This may also include Restricted Data and Formerly Restricted data.

2. The contract will contain a twelve (12) month Base Term and two (2), twelve (12) month Option Terms. Period of Performance (POP) will be 12 months after award through 12 months after last option invocation. There is an estimate of 2 events each year, each event will be one day.

3. The Contractor will perform work on-site in Philadelphia during the required timeframe as requested by customer on a mutually agreed date.

4. The contractor is required to remove the storage media from external hard/SSD drives to ensure that the storage media is appropriately destroyed. The casing of the external drives should be disposed of correctly.

5. The Contractor will scan and record serial numbers on all hard drives.

6. NSA guidance on media destruction (NSA PM 9-12) will be followed.

7. The Contractor will degauss up to 2000 standard sized hard drives (without caddies) and

1500 tapes before destruction using equipment listed on the latest NSA/CSS Evaluated Products List.

8. Approximately 2000 hard drives and 1500 hard drives and tapes will be destroyed at Customer’s facility using equipment listed on the latest NSA/CSS Evaluated Products List and NSA PM 9-12..

9. The Contractor will shred up to 10,000 floppies and CDs/DVDs at Customer’s facility using equipment listed on the latest NSA/CSS Evaluated Products List.

10. The contractor will destroy old cellphone (primarily older Apple iPhones, this will include removing the batteries and destroying them appropriately), old film, paper, key cards, aperture cards, and other items that may also require destruction.

11. All personnel working on customer’s premises undergo a background check, sign a confidentiality agreement and are thoroughly trained in security procedures. All personnel are bonded and company is thoroughly insured. The Contractor will be certified by the Defense Logistics Information Service to store and transport military critical technical data. Personnel that handle classified media MUST possess a SECRET or higher clearance with the ability to handle Restricted Data and Formerly Restricted Data.

12. Customer may witness the entire destruction process.

13. Residual pieces will be removed from customer’s premises and handled according to the

EPA (Environmental Protection Agency) requirement that a recycler have R2 or E-

Stewards Certification. This certification is required for any recycler that is recycling federally owned electronic equipment.

14. All resulting materials will be disposed of in full compliance with all local, state and federal regulations. Shredded tapes and soft media will be incinerated. Customer may send personnel to witness this destruction.

15. The Contractor will transport and appropriately destroy any media that is not destroyed on-site, eg. Solid state media.

16. The Contractor will issue and send to the Navy a Certificate of Destruction certifying that the media has been destroyed using NSA Evaluated products and rendered un-recoverable. The Certificate will include the serial numbers all of the hard drives destroyed. The Certificate of Destruction will suffice for all compliance purposes. The Contractor shall keep copies on file for one (1) year.

17. OPSEC - The Contractor shall protect critical information associated with this contract to prevent unauthorized disclosure. The NSWC Philadelphia Division's (NSWCPD) CIIL (Critical Indicators and information list) will be provided on site, if warranted.

Performance under this contract requires the contractor to adhere to OPSEC requirements. During the period of this contract, the Contractor may be exposed to, use, or produce, NSWCPD Critical Information (CI) and/or observables and indicators which may lead to discovery of CI. NSWCPD’s CI will not be distributed to unauthorized third parties, including foreign governments, or companies under Foreign Ownership, Control, or Influence (FOCI) unless such FOCI has been appropriately mitigated through measures approved by the Defense Counterintelligence and Security Agency. Questions concerning these requirements shall be directed to the PCO.

CUI correspondence transmitted internally on the contractor's unclassified networks or information systems, and externally, shall be protected per NIST SP-800-171, Protecting Controlled Unclassified Information (CUI) in Non-federal Systems and Organizations.

NSWCPD’s CI shall not be publicized in corporate wide newsletters, trade magazines, displays, intranet pages or public facing websites.

Any attempt by unauthorized third parties to solicit, obtain, photograph, or record, or;

incidents of loss/compromise of government Classified or CI, Business Sensitive, Company Proprietary information related to this or other program must be immediately reported to the contractor's Facility Security Officer and Cognizant Security Office and/or the Naval Criminal Investigative Service, and the NSWCPD Security Division (Code 105).

(End of Summary of Changes)