P02_Market Research_Draft PWS_DLS Intrusition Alarm System Service.pdf

PERFORMANCE WORK STATEMENT

FOR

Denver Logistics Service Intrusion Alarm System Service

Acquisition Plan Number 36C79126AP0003

REVISION DATE: October 28, 2025

Prepared by:

Department of Veterans Affairs

Commodities & Services Acquisition Service (003B6E) 555 Corporate Circle

Golden, CO 80401-5621

B.2 PERFORMANCE WORK STATEMENT

1. PROCUREMENT BACKGROUND

This Performance Work Statement (PWS) is intended to ensure that the Denver Logistics Service (DLS) has a reliable and functional alarm system through the delivery of contractor supported diligent services and maintenance actions, that are accompanied by a rapid and efficient contractor support response to system failures and anomalies in system operation.

The Department of Veterans Affairs (VA) National Acquisition Center's DLS; formerly known as the Denver Logistics Center, provides holistic supply chain management for the VA National Hearing Aid and Home Telehealth Programs and supports VA and other Government agencies with professional logistical services. Commodities managed by the DLS include the worldwide distribution of hearing aids, hearing aid accessories, cochlear implants, assistive devices, batteries, prosthetic socks, orthotic soft-goods, aids for the visually impaired, telehealth messaging devices and numerous peripherals.

2. STATEMENT OF NEED

The DLS facility located in Golden, Colorado has identified an on-going and reoccurring requirement for contractor supported services to test and perform system maintenance as needed (e.g., preventative and corrective maintenance) on the facility’s Intrusion Alarm System. The DLS facility requires a properly functioning intrusion alarm system to ensure the security of employees, warehouse inventory, and information technology equipment.

This Performance Work Statement (PWS) outlines the requirements for contractor supported routine service, troubleshooting, and ensuring proper connectivity with the Department of Homeland Security (DHS) MEGA Center that monitors the DLS’s intrusion alarm system.

3. SCOPE OF WORK

The successful Offeror shall deliver contractor supported services to test, perform system maintenance as needed (e.g., preventative and corrective maintenance), and ensure connectivity on the DLS facility’s Intrusion Alarm System.

a. SERVICE AGREEMENT: The successful Offeror shall enter into a service agreement with DLS. The service agreement must cover quarterly checks, testing, and regular system-wide maintenance to ensure the intrusion alarm system is functioning properly and transmitting data as designed to the DHS MEGA Center.

b. EMERGENCY RESPONSE REQUIREMENT: The successful Offeror shall be capable of provided service technicians on-site at the DLS facility within 6 hours of a reported total intrusion alarm system failure event.

c. ROUTINE ISSUES AND ANOMALIES RESPONSE REQUIREMENT: The successful Offeror shall be capable of provided service technicians on-site at the DLS facility within 24 hours of reported system anomalies or possible issues with the intrusion alarm system.

d. EQUIPMENT REMOVAL, REPLACEMENT, AND INSTALLATION REQUIRMENT: The successful Offeror shall provide the Government price quotes prior to any work that is needed outside of the scope of routine maintenance actions. Once the purchase of replacement equipment is approved by the Government, the successful Offeror shall be capable of performing the equipment installation and system-wide testing within 72 hours after receipt of the replacement equipment.

4. PERFORMANCE REQUIREMENTS: The successful Offeror shall ensure the following contractual performance and delivery of service requirements are met:

a. Conduct quarterly checks on the alarm system to verify normal operation;

b. Perform regular preventative and corrective maintenance on the alarm system;

c. Troubleshoot and resolve alarm system issues to ensure continuous operation and connectivity to the DHS MEGA Center;

d. Provide the DLS facility timely on-site service support as per the emergency and routine alarm system issue response timelines;

e. Submission of detailed quotes of required repair parts to the Government for review and approval to purchase prior to the delivery of performance for non-routine corrective maintenance work; and

f. Install additional or replacement equipment as needed and perform operation testing of newly installed equipment within the stipulated time frame once the work is approved by the Government and the equipment is received.

5. DELIVERABLES: The successful Offeror shall ensure the following contractually required documents are submitted to the Government within the stipulated time frame, the acceptance criteria for all deliverables are as follows:

a. Quarterly Maintenance Reports: Detailed reports of quarterly checks and maintenance activities. Quarterly maintenance reports must be submitted to the Government on time and demonstrate that the alarm system is fully functional;

b. Emergency and Issue Response Logs: Contractor maintained logs shall accurately detail the contractor’s actual on-site response times and the contractor’s actions taken to restore alarm system operability for each reported system failure and alarm system operation anomalies. Emergency and issue responses must meet the contractual specified response times;

c. Quotes: Detailed price quotes shall be submitted to the Government for any additional work outside the scope of routine maintenance. All quotes for repair parts must be provided to the Government for approval prior to the delivery of any non-routine maintenance work; and

d. Installation Records: Documentation of the installation of approved repair or replacement parts and equipment shall be accomplished within 72 hours of the receipt of Government approval and the contractor’s receipt of the replacement equipment.

6. CONTRACTOR’S RESPONSIBILITIES:

a. The successful Offeror shall maintain certificates of insurance for general liability and insurance and provide the Government with written evidence of the policies at the time of award.

b. The contractor’s employees assigned to provide services to the DLS facility shall present the Government with written evidence of their certification from the Bosch/Keenfinity- Group to perform the required services on the alarm system at the time of award.

c. Any work other than as specified in the resultant contract shall be identified as a non-priced task, and if determined by the Contracting Officer to be within the overall scope of the contract, the work shall be added to the contract through a bilaterally executed modification to the contract.

d. Any work requested that is identified by the Contracting Officer as being outside the scope of the resultant contract shall be addressed by the Government as a separate procurement.

7. COMMERCIALITY DETERMINATION

The types of services included in this requirement are readily available services offered in the commercial market, these services are widely sold for applications other than the Government’s needs. All the various types of services in this requirement fit the definition of commercial services as set forth at Federal Acquisition Regulation (FAR) 2.101.

8. PROCUREMENT TYPE

This efforts procurement type shall be determined through the results of market research pursuant to the policies and procedures as set forth at Veterans Affairs Acquisition Regulation (VAAR) 819.7005 Contracting Order of Priority.

a. In determining the acquisition strategy applicable to a procurement requirement not otherwise covered under VAAR 808.002, the contracting officer shall observe the order of contracting preferences in 38 U.S.C. 8127(h).

b. Specifically, preferences for awarding contracts to small business concerns shall be applied in the following order of priority:

(1) Contracts awarded to small business concerns owned and controlled by Veterans with service-connected disabilities as provided in this subpart.

(2) Contracts to small business concerns owned and controlled by Veterans that are not covered by paragraph (b)(1) of this section as provided in this subpart.

(3) Contracts awarded pursuant to -

I. Section 8(a) of the Small Business Act (15 U.S.C. 637(a) as provided in Federal Acquisition Regulation (FAR) Subpart 19.8; or

II. Section 31 of the Small Business Act (15 U.S.C. 657a) as provided in FAR Subpart 19.13.

(4) Contracts awarded pursuant to any other small business set aside contracting preference, with due deference to the priority for awarding to women-owned small businesses as provided in FAR 19.203(b) through (e) and FAR Subpart 19.15.

(5)

9. CONTRACT TYPE

Pursuant to the procurement restrictions as set forth at the FAR 12.207(a), except as provided in paragraph (b) of this section, agencies shall use firm-fixed-price (FFP) contracts or fixed-price contracts with economic price adjustment for the acquisition of commercial products or commercial services. As set forth at FAR 12.207(b), no exceptions to the requirement of a FFP contract type applies to this requirement. In accordance with (IAW) FAR 16.103(b), A FFP contract, which best utilizes the basic profit motive of a business enterprise, shall be used when the risk involved is minimal or can be predicted with an acceptable degree of certainty. It is not anticipated that the contractor(s) proposing to a posted solicitation for this requirement would incur any undue risks during contract performance due to unforeseeable increases in labor costs in this mature industry. An FFP contract provides for a fixed price that is not subject to any adjustment on the basis of the contractor’s cost experience in performing the contract. The FFP contract type places upon the performing contractor the maximum amount of risk and full responsibility for controlling all incurred costs experienced in the performing of the contract and the resulting profit or loss realized in the performing of the contract.

10. CONTRACT LINE ITEM NUMBER STRUCTURE

The structure of the Contract Line Item Numbers (CLINs) are anticipated to be as follows:

CLIN TITLE / DESCRIPTION TYPE

X001 Quarterly System Inspections and Testing

(Preventative Maintenance) Firm Fixed Price

X002 Maintenance Calls / Request For Services (Corrective Maintenance & Troubleshooting)

Firm Fixed Price

X003 Repair Parts / Replacement Parts & Installation

Firm Fixed Price

11. PERIOD OF PERFORMANCE

The period of performance (PoP) of the resultant contact is anticipated to be not longer than five (5) years to include one (1) base year PoP and four (4) option year PoPs.

12. PLACE OF PERFORMANCE

The tasks to be performed under this Performance Work Statement (PWS) shall be performed at the following facility:

• DLS Main Warehouse 555 Corporate Cir.

Golden, CO 80401

13. TRAVEL

The Government does not anticipate the need for contractor to travel outside of the scope of this effort. The contractor shall include the planned travel to the one (1) warehouse location listed in section 11. PLACE OF PERFORMANCE. The contractor is instructed to include the price of that planned travel in their labor hour price section of the proposal.

14. TASK STATEMENT

a. Tasks performed shall be of a non-personal services nature.

b. VA organizations and personnel shall not provide supervision of contractor personnel. Contractor personnel shall at no time allow an employer-employee relationship to develop with VA organizations or their staff. VA organizations will refrain from any activities that create the appearance of such a relationship.

c. Contractors shall not perform inherently governmental functions including decision-making, supervision of Government employees, supervision of other contractors performing on other contracts, and activities that create the appearance of performing such functions.

d. This task order will require Service Group 5: Supply Chain Management on the

Veteran Enterprise Contracting for Transformation and Operation Readiness (VECTOR) multiple award Indefinite Delivery – Indefinite Quality (IDIQ) contract vehicle.

e. The applicable North American Industry Classification System (NAICS) code for this requirement is NAICS Code 561621 - Security Systems Services (Except Locksmiths). The size standard for NAICS Code 561621 (Security Systems Services, except Locksmiths) is $25 million in average annual receipts for the preceding five fiscal years. This standard is used by the Small Business Administration (SBA) to determine eligibility for government contracting programs and other small business programs.

f. The Product Service Code (PSC) for this requirement is 6350 - Miscellaneous Alarm, Signal, And Security Detection Systems. PSC 6350 encompasses miscellaneous alarm, signal, and security detection systems, covering a wide range of sophisticated security technologies and solutions. These systems include intrusion detection equipment, access control mechanisms, closed-circuit television (CCTV) surveillance systems, fire alarm panels, emergency notification systems, and specialized security monitoring technologies. The products and services under this category are designed to provide comprehensive physical security infrastructure for federal facilities, military bases, research centers, and critical infrastructure installations.

15. QUALITY ASSURANCE SURVEILLANCE PLAN (QASP)

This acquisition will rely on the FAR Clause 52.246-4; Inspection of Services clause as prescribed in FAR Part 46 to satisfy performance objectives of this effort. Performance Standards define required performance for specific tasks. The Government performs surveillance to determine if the contractor exceeds, meets or does not meet these standards. The Government may utilize the QASP to compare contractor performance to the Acceptable Levels of Performance (ALPs).

15.1 METHODS OF SURVEILLANCE

Various methods exist to monitor Contractor performance. The COR shall use any or several of the surveillance methods listed below in the administration of this QASP.

a. 100% Inspection (evaluates all outcomes) - Each month, the COR shall review all of the contractor’s performance/generated documentation and document results accordingly. This assessment shall be placed in the COR’s QA file.

b. Random Sample - The COR shall review a random sampling of the contractor’s performance/generated documentation and document your results accordingly. This assessment shall be placed in the COR’s QA file.

c. Validated Customer Complaint or Validated Below Average ALP in a Specific Area -

Each month, the COR shall review the contractor’s performance/generated documentation corresponding to a validated customer complaint or validated inability to perform in accordance with the ALP in a specific area and document your results accordingly. This assessment shall be placed in the COR’s QA file.

15.2 FREQUENCY OF MEASUREMENT

During task order performance, the COR will periodically analyze whether the negotiated frequency of surveillance is appropriate for the work being performed, and at a minimum shall be twice a year.

15.3 ACCEPTABLE PERFORMANCE LEVELS (APLs)

Requirement Performance

Standard Surveillance

Method Outcome

WRITTEN

COMMUNICATION

Uses correct English grammar, punctuation, and spelling 95% of the time;

communicates information in a succinct and organized manner, produces written information that is appropriate for the intended audience

Random Sampling Written communication is consistently error-free and clear and concise so that the message is easily understood by others

CUSTOMER

SUPPORT

Courteous and professional interactions to receive and fill task order deliverables and in providing order status. Customer (VA) support satisfaction, having no more than 5 incidents of dissatisfaction.

Customer Feedback and Complaints based on interactions with the contractor

Customer problems are resolved within the same business day; no more than 5 incidents spent by Government personnel in providing corrective feedback on unacceptable customer service/professionalism

15.4 DOCUMENTING PERFORMANCE

This contract is subject to the policies and procedures of the Contractor Performance Assessment Reporting System (CPARS). Pursuant to FAR 42.1502, which states “past performance evaluations shall be prepared at least annually and at the time the work under a contract or order is completed.

a. Acceptable Performance

The Government shall document acceptable performance in accordance with the chart above at paragraph 12.3. Any report may become a part of the supporting documentation for any contractual action or contractor past performance reporting.

d. Unacceptable Performance

When unacceptable performance occurs, the assigned Contracting Officer’s Representative (COR) shall inform the assigned Contracting Officer (CO). This COR report shall always be in writing, although when circumstances necessitate immediate verbal communication, that communication will be followed up in writing.

The COR shall document the discussion and place it in the COR file. When the CO determines formal written communication with the contractor is required, the COR shall prepare a Contract Discrepancy Report (CDR) and present it to the contractor's Program Manager (PM) for submission. The contractor shall acknowledge receipt of the CDR in writing to the CO within 48 hours of receipt. The CDR will state how long after receipt the contractor has to take the CO directed corrective action.

The CDR will also specify if the contractor is required to prepare a corrective action plan (CAP) to document in advance how the contractor shall correct the unacceptable performance and avoid a recurrence. The CO shall review the contractor's corrective action plan to determine acceptability. Any CDRs may become a part of the supporting documentation for any contractual action deemed necessary by the CO.

16. SECURITY AND PRIVACY REQUIREMENTS

16.1 POSITION/TASK RISK DESIGNATION LEVEL(S)

Position Sensitivity

Background Investigation (in accordance with Department of Veterans Affairs 0710 Handbook, “Personnel Suitability and Security Program,” Appendix A) Low / Tier 1 Tier 1 / National Agency Check with Written Inquiries (NACI) A Tier 1/NACI is conducted by OPM and covers a 5-year period. It consists of a review of records contained in the OPM Security Investigations Index (SII) and the DOD Defense Central Investigations Index (DCII), Federal Bureau of Investigation (FBI) name check, FBI fingerprint check, and written inquiries to previous employers and references listed on the application for employment.

In VA it is used for Non-sensitive or Low Risk positions.

Moderate / Tier 2 Tier 2 / Moderate Background Investigation (MBI) A Tier 2/MBI is conducted by OPM and covers a 5-year period. It consists of a review of National Agency Check (NAC) records [OPM Security Investigations Index (SII), DOD Defense Central Investigations Index (DCII), FBI name check, and an FBI fingerprint check], a credit report covering a period of 5 years, written inquiries to previous employers and references listed on the application for employment; an interview with the subject, law enforcement check; and a verification of the educational degree.

High / Tier 4 Tier 4 / Background Investigation (BI) A Tier 4/BI is conducted by OPM and covers a 10-year period. It consists of a review of National Agency Check (NAC) records [OPM Security Investigations Index (SII), DOD Defense Central Investigations Index (DCII), FBI name check, and a FBI fingerprint check report], a credit report covering a period of 10 years, written inquiries to previous employers and references listed on the application for employment; an interview with the subject, spouse, neighbors, supervisor, co-workers; court records, law enforcement check, and a verification of the educational degree.

The position sensitivity and the level of background investigation commensurate with the required level of access for the following tasks within the Performance Work Statement are:

Position Sensitivity and Background Investigation Requirements by Task Task Number Tier1 / Low / NACI Tier 2 / Moderate / MBI Tier 4 / High / BI

INSERT TASK # N/A N/A N/A

The Tasks identified in the table above and the resulting Position Sensitivity and Background Investigation requirements identify, in effect, the Background Investigation requirements for Contractor individuals, based upon the tasks the particular Contractor individual will be working.

The submitted Contractor Staff Roster must indicate the required Background Investigation Level for each Contractor individual based upon the tasks the Contractor individual will be working, in accordance with their submitted quote.

16.2 CONTRACTOR PERSONNEL SECURITY REQUIREMENTS

16.2.1 CONTRACTOR RESPONSIBILITIES:

a. The Contractor shall prescreen all personnel requiring access to the computer systems to ensure they maintain the appropriate Background Investigation, and are able to read, write, speak and understand the English language. The Contractor shall be responsible for the actions of all personnel provided to work for VA under this contract. In the event that damages arise from work performed by Contractor provided personnel, under the auspices of this contract, the Contractor shall be responsible for all resources necessary to remedy the incident.

b. The Contractor shall bear the expense of obtaining background investigations. Within 3 business days after award, the Contractor shall provide a roster of Contractor and Subcontractor employees to the COR to begin their background investigations in accordance with the ProPath template. The Contractor Staff Roster shall contain the Contractor’s Full Name, Date of Birth, Place of Birth, individual background investigation level requirement (based upon Section 7.0 Tasks), etc. The Contractor shall submit full Social Security Numbers either within the Contractor Staff Roster or under separate cover to the COR. The Contractor Staff Roster shall be updated and provided to VA within 1 day of any changes in employee status, training certification completion status, Background Investigation level status, additions/removal of employees, etc. throughout the Period of Performance. The Contractor Staff Roster shall remain a historical document indicating all past information and the Contractor shall indicate in the Comment field, employees no longer supporting this contract.

The preferred method to send the Contractor Staff Roster or Social Security Number is by encrypted e-mail. If unable to send encrypted e-mail, other methods which comply with FIPS 140-2 are to encrypt the file, use a secure fax, or use a traceable mail service.

c. The Contractor should coordinate the location of the nearest VA fingerprinting office through the COR. Only electronic fingerprints are authorized.

d. The Contractor shall ensure the following required forms are submitted to the COR within 5 days after contract award:

(1) For a Tier 1/Low Risk designation:

(a). OF-306

(b). DVA Memorandum – Electronic Fingerprints

(2) For Tier 2/Moderate or Tier 4/High Risk designation:

(a). OF-306

(b). VA Form 0710

(c). DVA Memorandum – Electronic Fingerprints

The Contractor personnel shall submit all required information related to their background investigations (completion of the investigation documents (SF85, SF85P, or SF 86) utilizing the Office of Personnel Management’s (OPM) Electronic Questionnaire for Investigations Processing (e-QIP) after receiving an email notification from the Security and Investigation Center (SIC). The Contractor employee shall certify and release the e-QIP document, print and sign the signature pages, and send them encrypted to the COR for electronic submission to the SIC.

These documents shall be submitted to the COR within 3 business days of receipt of the e-QIP notification email. (Note: OPM is moving towards a “click to sign” process.

If click to sign is used, the Contractor employee should notify the COR within 3 business days that documents were signed via eQIP).

e. The Contractor shall be responsible for the actions of all personnel provided to work for VA under this contract. In the event that damages arise from work performed by Contractor provided personnel, under the auspices of this contract, the Contractor shall be responsible for all resources necessary to remedy the incident.

f. A Contractor may be granted unescorted access to VA facilities and/or access to VA Information Technology resources (network and/or protected data) with a favorably adjudicated Special Agreement Check (SAC) or “Closed, No Issues” (SAC) fingerprint results, training delineated in VA Handbook 6500.6 (Appendix C, Section 9), and the signed “Contractor Rules of Behavior.” However, the Contractor will be responsible for the actions of the Contractor personnel they provide to perform work for VA. The investigative history for Contractor personnel working under this contract must be maintained in the database of the Office of Personnel Management (OPM).

g. The Contractor, when notified of an unfavorably adjudicated background investigation on a Contractor employee as determined by the Government, shall withdraw the employee from consideration in working under the contract. Failure to comply with the Contractor personnel security investigative requirements may result in loss of physical and/or logical access to VA facilities and systems by Contractor and Subcontractor employees and/or termination of the contract for default.

Identity Credential Holders must follow all HSPD-12 policies and procedures as well as use and protect their assigned identity credentials in accordance with VA policies and procedures, displaying their badges at all times, and returning the identity credentials upon termination of their relationship with VA. Contractor employees shall complete a VA Systems Access Agreement if they are provided access privileges as an authorized user of the computer system of VA.

13.2.3 Physical Security and Safety Requirements:

The Contractor and their personnel shall follow all VA policies, standard operating procedures, applicable laws and regulations while on VA property. Violations of VA regulations and policies may result in citation and disciplinary measures for persons violating the law.

a. The Contractor and their personnel shall wear visible identification at all times while they are on the premises.

b. VA does not provide parking spaces at the work site; the Contractor must obtain parking at the work site if needed. It is the responsibility of the Contractor to park in the appropriate designated parking areas. VA will not invalidate or make reimbursement for parking violations of the Contractor under any conditions.

e. Smoking is prohibited inside/outside any building other than the designated smoking areas.

f. Possession of weapons is prohibited.

g. The Contractor shall obtain all necessary licenses and/or permits required to perform the work, with the exception of software licenses that need to be procured from a Contractor or vendor in accordance with the requirements document. The Contractor shall take all reasonable precautions necessary to protect persons and property from injury or damage during the performance of this contract.

13.2.4 Confidentiality and Non-Disclosure

a. The Contractor shall follow all VA rules and regulations regarding information security to prevent disclosure of sensitive information to unauthorized individuals or organizations.

b. The VA CO will be the sole authorized official to release in writing, any data, draft deliverables, final deliverables, or any other written or printed materials pertaining to this contract. The Contractor shall release no information. Any request for information relating to this contract presented to the Contractor shall be submitted to the VA CO for response.

c. Contractor personnel recognize that in the performance of this effort, Contractor personnel may receive or have access to sensitive information, including information provided on a proprietary basis by carriers, equipment manufacturers and other private or public entities. Contractor personnel agree to safeguard such information and use the information exclusively in the performance of this contract. Contractor shall follow all VA rules and regulations regarding information security to prevent disclosure of sensitive information to unauthorized individuals or organizations as enumerated in this section and elsewhere in this Contract and its subparts and appendices.

d. Contractor shall limit access to the minimum number of personnel necessary for contract performance for all information considered sensitive or proprietary in nature. If the Contractor is uncertain of the sensitivity of any information obtained during the performance this contract, the Contractor has a responsibility to ask the VA CO.

e. Contractor shall train all of their employees involved in the performance of this contract on their roles and responsibilities for proper handling and nondisclosure of sensitive VA or proprietary information. Contractor personnel shall not engage in any other action, venture or employment wherein sensitive information shall be used for the profit of any party other than those furnishing the information. The sensitive information transferred, generated, transmitted, or stored herein is for VA benefit and ownership alone.

f. Contractor shall maintain physical security at all facilities housing the activities performed under this contract, including any Contractor facilities according to VA-approved guidelines and directives. The Contractor shall ensure that security procedures are defined and enforced to ensure all personnel who are provided access to patient data must comply with published procedures to protect the privacy and confidentiality of such information as required by VA.

g. Contractor must adhere to the following:

1) The use of “thumb drives” or any other medium for transport of information is expressly prohibited.

2) Controlled access to system and security software and documentation.

3) Recording, monitoring, and control of passwords and privileges.

4) All terminated personnel are denied physical and electronic access to all data, program listings, data processing equipment and systems.

5) VA, as well as any Contractor (or Subcontractor) systems used to support development, provide the capability to cancel immediately all access privileges and authorizations upon employee termination.

6) Contractor PM and VA PM are informed within twenty-four (24) hours of any employee termination.

7) Acquisition sensitive information shall be marked "Acquisition Sensitive" and shall be handled as "For Official Use Only (FOUO)".

8) Contractor does not require access to classified data.

h. Regulatory standard of conduct governs all personnel directly and indirectly involved in procurements. All personnel engaged in procurement and related activities shall conduct business in a manner above reproach and, except as authorized by statute or regulation, with complete impartiality and with preferential treatment for none. The general rule is to strictly avoid any conflict of interest or even the appearance of a conflict of interest in VA/Contractor relationships.

i. VA Form 0752, Confidentiality of Sensitive Information Non-Disclosure Agreement, shall be completed by all Contractor employees that receive Government furnished laptops, and shall be provided to the CO before any work is performed. In the case that Contractor personnel are replaced in the future, their replacements shall complete VA Form 0752 prior to beginning work.

13.3 APPLICABLE VA INFORMATION AND INFORMATION SYSTEM

SECURITY/PRIVACY LANGUAGE (per VA HANDBOOK 6500.6, APPENDIX C, APRIL 22 2024)

13.3.1 GENERAL:

Contractors, contractor personnel, subcontractors and subcontractor personnel will be subject to the same federal laws, regulations, standards, VA directives and handbooks, as VA personnel regarding information and information system security and privacy.

13.3.2 PART ONE - ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS:

a. The Government shall receive unlimited rights to data/intellectual property first produced and delivered in the performance of this contract or order (hereinafter “contract”) unless expressly stated otherwise in this contract. This includes all rights to source code and all documentation created in support thereof. The primary clause used to define Government and Contractor data rights is FAR 52.227-14 Rights in Data – General. The primary clause used to define computer software license (not data/intellectual property first produced under this contractor or order) is FAR 52.227-19, Commercial Computer Software License.

b. Information made available to the contractor by VA for the performance or administration of this contract will be used only for the purposes specified in the service agreement, SOW, PWS, PD, and/or contract.

The contractor shall not use VA information in any other manner without prior written approval from a VA Contracting Officer (CO). The primary clause used to define Government and Contractor data rights is FAR 52.227-14 Rights in Data – General.

c. VA information will not be co-mingled with any other data on the contractor’s information systems or media storage systems. The contractor shall ensure compliance with Federal and VA requirements related to data protection, data encryption, physical data segregation, logical data segregation, classification requirements and media sanitization.

d. VA reserves the right to conduct scheduled or unscheduled audits, assessments, or investigations of contractor Information Technology (IT) resources to ensure information security is compliant with Federal and VA requirements. The contractor shall provide all necessary access to records (including electronic and documentary materials related to the contracts and subcontracts) and support (including access to contractor and subcontractor staff associated with the contract) to VA, VA's Office Inspector General (OIG), and/or Government Accountability Office (GAO) staff during periodic control assessments, audits, or investigations.

e. The contractor may only use VA information within the terms of the contract and applicable Federal law, regulations, and VA policies. If new Federal information security laws, regulations or VA policies become applicable after execution of the contract, the parties agree to negotiate contract modification and adjustment necessary to implement the new laws, regulations, and/or policies.

f. The contractor shall not make copies of VA information except as specifically authorized and necessary to perform the terms of the contract. If copies are made for restoration purposes, after the restoration is complete, the copies shall be destroyed in accordance with VA Directive 6500, VA Cybersecurity Program and VA Information Security Knowledge Service.

g. If a Veterans Health Administration (VHA) contract is terminated for default or cause with a business associate, the related local Business Associate Agreement (BAA) shall also be terminated and actions taken in accordance with VHA Directive 1605.05, Business Associate Agreements. If there is an executed national BAA associated with the contract, VA will determine what actions are appropriate and notify the contactor.

h. The contractor shall store and transmit VA sensitive information in an encrypted form, using VA-approved encryption tools which are, at a minimum, Federal Information Processing Standards (FIPS) 140-2, Security Requirements for Cryptographic Modules (or its successor) validated and in conformance with VA Information Security Knowledge Service requirements.

The contractor shall transmit VA sensitive information using VA approved Transport Layer Security (TLS) configured with FIPS based cipher suites in conformance with National Institute of Standards and Technology (NIST) 800-52, Guidelines for the Selection, Configuration and Use of Transport Layer Security (TLS) Implementations.

i. The contractor’s firewall and web services security controls, as applicable, shall meet or exceed VA’s minimum requirements.

j. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor may use and disclose VA information only in two situations: (i) in response to a qualifying order of a court of competent jurisdiction after notification to VA CO (ii) with written approval from the VA CO. The contractor shall refer all requests for demands for production of or inquiries about VA information and information systems to the VA CO for response.

k. Notwithstanding the provision above, the contractor shall not release VA records protected by Title 38 U.S.C. § 5705, Confidentiality of medical quality-assurance records and/or Title 38 U.S.C. § 7332, Confidentiality of certain medical records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse or infection with Human Immunodeficiency Virus (HIV). If the contractor is in receipt of a court order or other requests for the above-mentioned information, the contractor shall immediately refer such court order or other requests to the VA CO for response.

l. Information made available to the contractor by VA for the performance or administration of this contract or information developed by the contractor in performance or administration of the contract will be protected and secured in accordance with VA Directive 6500 and Identity and Access Management (IAM) Security processes specified in the VA Information Security Knowledge Service.

m. Any data destruction done on behalf of VA by a contractor shall be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management, VA Handbook 6300.1, Records Management Procedures, and applicable VA Records Control Schedules.

n. The contractor shall provide its plan for destruction of all VA data in its possession according to VA Directive 6500 and NIST 800-88, Guidelines for Media Sanitization prior to termination or completion of this contract. If directed by the COR/CO, the contractor shall return all Federal Records to VA for disposition.

o. Any media, such as paper, magnetic tape, magnetic disks, solid state devices or optical discs that is used to store, process, or access VA information that cannot be destroyed shall be returned to VA. The contractor shall hold the appropriate material until otherwise directed by the Contracting Officer’s Representative (COR) or CO.

Items shall be returned securely via VA-approved methods.

VA sensitive information must be transmitted utilizing VA-approved encryption tools which are validated under FIPS 140-2 (or its successor) and NIST 800-52. If mailed, the contractor shall send via a trackable method (USPS, UPS, FedEx, etc.) and immediately provide the COR/CO with the tracking information. Self-certification by the contractor that the data destruction requirements above have been met shall be sent to the COR/CO within 30 business days of termination of the contract.

p. All electronic storage media (hard drives, optical disks, CDs, back-up tapes, etc.)

used to store, process or access VA information will not be returned to the contractor at the end of lease, loan, or trade-in. Exceptions to this paragraph will only be granted with the written approval of the VA CO.

13.3.3 PART TWO - ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS:

a. A contractor/subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees and subcontractors only to the extent necessary to perform the services specified in the solicitation or contract. This includes indirect entities, both affiliate of contractor/subcontractor and agent of contractor/subcontractor.

b. Contractors and subcontractors shall sign the VA Information Security Rule of

Behavior (ROB) before access is provided to VA information and information systems (see Section 4, Training, below).

The ROB contains the minimum user compliance requirements and does not supersede any policies of VA facilities or other agency components which provide higher levels of protection to VA’s information or information systems. Users who require privileged access shall complete the VA elevated privilege access request processes before privileged access is granted.

c. All contractors and subcontractors working with VA information are subject to the same security investigative and clearance requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors shall be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program.

The Office of Human Resources and Administration/Operations, Security and Preparedness (HRA/OSP) is responsible for these policies and procedures. Contract personnel who require access to classified information or information systems shall have an appropriate security clearance. Verification of a Security Clearance shall be processed through the Special Security Officer located in HRA/OSP. Contractors shall conform to all requirements stated in the National Industrial Security Program Operating Manual (NISPOM).

d. All contractors and subcontractors shall comply with conditions specified in VAAR 852.204-71(d); Contractor operations required to be in United States. All contractors and subcontractors working with VA information must be permanently located within a jurisdiction subject to the law of the United States or its Territories to the maximum extent feasible. If services are proposed to be performed abroad the contractor must state where all non-U.S. services are provided. The contractor shall deliver to VA a detailed plan specifically addressing communications, personnel control, data protection and potential legal issues. The plan shall be approved by the COR/CO in writing prior to access being granted.

e. The contractor shall notify the COR/CO in writing immediately (no later than 24 hours) after personnel separation or occurrence of other causes. Causes may include the following:

1) Contractor/subcontractor personnel no longer has a need for access to VA information or VA information systems.

2) Contractor/subcontractor personnel are terminated, suspended, or otherwise has their work on a VA project discontinued for any reason.

3) Contractor believes their own personnel or subcontractor personnel may pose a threat to their company’s working environment or to any company-owned property. This includes contractor- owned assets, buildings, confidential data, customers, employees, networks, systems, trade secrets and/or VA data.

4) Any previously undisclosed changes to contractor/subcontractor background history are brought to light, including but not limited to changes to background investigation or employee record.

5) Contractor/subcontractor personnel have their authorization to work in the United

States revoked.

6) Agreement by which contractor provides products and services to VA has either been fulfilled or terminated, such that VA can cut off electronic and/or physical access for contractor personnel.

f. In such cases of contract fulfillment, termination, or other causes; the contractor shall take the necessary measures to immediately revoke access to VA network, property, information, and information systems (logical and physical) by contractor/subcontractor personnel. These measures include (but are not limited to):

removing and then securing Personal Identity Verification (PIV) badges and PIV – Interoperable (PIV-I) access badges, VA-issued photo badges, credentials for VA facilities and devices, VA-issued laptops, and authentication tokens. Contractors shall notify the appropriate VA COR/CO immediately to initiate access removal.

g. Contractors/subcontractors who no longer require VA accesses will return VA-issued property to VA. This property includes (but is not limited to): documents, electronic equipment, keys, and parking passes. PIV and PIV-I access badges shall be returned to the nearest VA PIV Badge Issuance Office. Once they have had access to VA information, information systems, networks and VA property in their possessions removed, contractors shall notify the appropriate VA COR/CO.

13.3.4 VA INFORMATION CUSTODIAL LANGUAGE

a. Information made available to the Contractor or Subcontractor by VA for the performance or administration of this contract or information developed by the Contractor/Subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of VA. This clause expressly limits the Contractor/Subcontractor's rights to use data as described in Rights in Data - General, FAR 52.227-14(d) (1).

b. VA information should not be co-mingled, if possible, with any other data on the

Contractors/Subcontractor’s information systems or media storage systems in order to ensure VA requirements related to data protection and media sanitization can be met. If co-mingling must be allowed to meet the requirements of the business need, the Contractor must ensure that VA information is returned to VA or destroyed in accordance with VA’s sanitization requirements. VA reserves the right to conduct onsite inspections of Contractor and Subcontractor IT resources to ensure data security controls, separation of data and job duties, and destruction/media sanitization procedures are in compliance with VA directive requirements.

c. Prior to termination or completion of this contract, Contractor/Subcontractor must not destroy information received from VA, or gathered/created by the Contractor in the course of performing this contract without prior written approval by VA. Any data destruction done on behalf of VA by a Contractor/Subcontractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook

6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self-certification by the Contractor that the data destruction requirements above have been met must be sent to the VA CO within 30 days of termination of the contract.

d. The Contractor/Subcontractor must receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with the terms of the contract and applicable Federal and VA information confidentiality and security laws, regulations and policies.

If Federal or VA information confidentiality and security laws, regulations and policies become applicable to VA information or information systems after execution of the contract, or if NIST issues or updates applicable FIPS or Special Publications (SP) after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations and policies in this contract.

e. The Contractor/Subcontractor shall not make copies of VA information except as authorized and necessary to perform the terms of the agreement or to preserve electronic information stored on Contractor/Subcontractor electronic storage media for restoration in case any electronic equipment or data used by the Contractor/Subcontractor needs to be restored to an operating state. If copies are made for restoration purposes, after the restoration is complete, the copies must be appropriately destroyed.

f. If VA determines that the Contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the Contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12.

g. The Contractor/Subcontractor must store, transport, or transmit VA sensitive information in an encrypted form, using VA-approved encryption tools that are, at a minimum, FIPS 140-2 validated.

h. The Contractor/Subcontractor’s firewall and Web services security controls, if applicable, shall meet or exceed VA minimum requirements. VA Configuration Guidelines are available upon request.

i. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the Contractor/Subcontractor may use and disclose VA information only in two other situations: (i) in response to a qualifying order of a court of competent jurisdiction, or (ii) with VA prior written approval. The Contractor/Subcontractor must refer all requests for demands for production of, or inquiries about, VA information and information systems to the VA CO for response.

j. Notwithstanding the provision above, the Contractor/Subcontractor shall not release VA records protected by Title 38 U.S.C. 5705, confidentiality of medical quality assurance records and/or Title 38 U.S.C. 7332, confidentiality of certain health records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse, or infection with human immunodeficiency virus. If the Contractor/Subcontractor is in receipt of a court order or other requests for the above mentioned information, that Contractor/Subcontractor shall immediately refer such court orders or other requests to the VA CO for response.

k. For service that involves the storage, generating, transmitting, or exchanging of VA sensitive information but does not require C&A or a Memorandum of Understanding- Interconnection Service Agreement (MOU-ISA) for system interconnection, the Contractor/Subcontractor must complete a Contractor Security Control Assessment (CSCA) on a yearly basis and provide it to the COR.

13.3.5 SECURITY INCIDENT INVESTIGATION:

a. The term “security incident” means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures.